Ok, we've got basic JTAG debugging via BDI 2000 working.
HOW TO
0. Jumper settings: JP2: no special config needed, just leave them as
specified in the QuickStart Guide, p. 14
1. Set up a tftp server on the PC to contain BDI 2000 config files
2. BDI 2000 config file: The following basic configuration is based on the
Freescale M9328MX31ADS board and seems to work for us. It may be incomplete, thought:
[TARGET]
CPUTYPE ARM1136
;CLOCK 10 ; work fine for bring-up JTAG clock (0=Adaptive,1=16MHz,2=8MHz,3=4MHz, 10=10KHz)
CLOCK 1 ; high speed with Freescale MX31 ADS
WAKEUP 200 ; because of medium rising reset line
RESET HARD 100 ; beause of light capacitive load on reset line
ENDIAN LITTLE ; memory model (LITTLE | BIG)
BREAKMODE HARD ; HARD, ARM / Thumb break code
;VECTOR CATCH 0x1f ;catch D_Abort, P_Abort, SWI, Undef and Reset
;VECTOR CATCH 0x00 ;do not catch any vector
SCANPRED 2 9 ;
SCANSUCC 1 4 ; the ETMBUF after the ARM1136 core
STARTUP RESET ; the ARM 11 core is stop after reset
[HOST]
IP 192.168.100.120
PROMPT Freescale-Mx31>
;FILE /bdi2000/appramMX31ADS.elf
FORMAT ELF
LOAD MANUAL ; load code MANUAL or AUTO after reset
[REGS]
FILE /bdi2000/reg1136.def
3. Connect the BDI 2000 to the LITEKIT with the JTAG cable, and the BDI 2000 to
the PC via Ethernet.
4. Power up the BDI 2000 and telnet to it from the PC
$ telnet 192.168.100.225
Trying 192.168.100.225...
Connected to 192.168.100.225.
Escape character is '^]'.
BDI Debugger for ARM
====================
...
- TARGET: waiting for target Vcc
- TARGET: waiting for target Vcc
- TARGET: waiting for target Vcc
- TARGET: waiting for target Vcc
5. Connect the LITEKIT to the power supply and press the Power On button.
Something like the following should appear on the telnet console:
- TARGET: waiting for target Vcc
- TARGET: processing power-up delay
- TARGET: processing reset request
- TARGET: BDI asserts TRST and RESET
- TARGET: BDI removes TRST
- TARGET: Bypass check 0x00000001 => 0xFFFFFFFF
- TARGET: JTAG exists check failed
- TARGET: Remove RESET and try again
- TARGET: BDI waits for RESET inactive
- TARGET: Bypass check 0x00000001 => 0x00000008
- TARGET: JTAG exists check passed
- Core#0: ID code is 0x07B3601D
- Core#0: DIDR is 0x15110004
- TARGET: BDI removes RESET
- TARGET: BDI waits for RESET inactive
- TARGET: Reset sequence passed
- TARGET: resetting target passed
- TARGET: processing target startup ....
- TARGET: processing target startup passed
Freescale-Mx31>
* type 'go' to launch losh
6. To make a quick test with gdb, we just compiled the second stage boot
loader from hhyilmaz. See
http://www.logicpd.com/su...rder=asc&start=0
http://mx31.lbox.ca/download/bootloader.tar.gz
* Do not forget to add '-g' to the CFLAGS in the Makefile.
* Download the executable as follows:
losh> load raw 0x800d0384 71348
loading from stdin:
loading raw binary to 0x800d0384 (ram) len 000116b4:
............done
file loaded
losh>
(See the thread above for the load magic numbers)
7. On the PC, start up gdb, connect to the remote target, set a break point
at main, and type "cont" to continue with losh:
$ arm-elf-gdb.exe test
GNU gdb 6.0
Copyright 2003 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "--host=i686-pc-cygwin --target=arm-elf"...
(gdb) target remote 192.168.100.225:2001
Remote debugging using 192.168.100.225:2001
0x8000320c in ?? ()
(gdb) break *0x800d0384
Breakpoint 1 at 0x800d0384: file test.c, line 232.
(gdb) cont
Continuing.
8. On the LogicLoader shell, type 'jump' to start executing the test code just
downloaded. gdb should stop the program on the break point:
Breakpoint 1, main (argc=0, argv=0x800d0384) at test.c:232
232 {
(gdb) list
227 }
228
229
230
231 int main(int argc,char *argv[])
232 {
233
234 void (*theKernel)(void);
235 u32 exec_at = (u32)-1;
236 u32 parm_at = (u32)-1;
(gdb) step
235 u32 exec_at = (u32)-1;
(gdb)
236 u32 parm_at = (u32)-1;
(gdb)
237 int machine_type = 447 ;
(gdb) info locals
theKernel = (void (*)(void)) 0x8000245c
exec_at = 2147535192
parm_at = 2147824180
machine_type = -2147143096
i = -2147369724
(gdb) step
238 int i = 0 ;
(gdb)
240 exec_at = DRAM_BASE;
(gdb)
241 parm_at = PARAM_LOAD_ADRESS_BASE + 0x100;
(gdb)
242 setup_tags(parm_at); /* sets up parameters */
(gdb)
258 return 0;
(gdb) run
The program being debugged has been started already.
Start it from the beginning? (y or n) n
TODO
- gdb does not step into subroutines with the 'step' command. A possible
explanation is that gdb and gcc disagree about the frame pointer register setup?