Abatron bdiGDB QorIQ P3 User Manual Download Page 3 | Manualshive

Page: 3 / 49

background image

bdi

GDB

for BDI3000 (QorIQ P3/P4/P5)

User Manual

3

© Copyright 1997-2012 by ABATRON AG Switzerland

V 1.03

1 Introduction

bdiGDB enhances the GNU debugger (GDB), with JTAG/COP debugging for QorIQ P4 based tar-
gets. With the built-in Ethernet interface you get a very fast code download speed. No target commu-
nication channel (e.g. serial line) is wasted for debugging purposes. Even better, you can use fast
Ethernet debugging with target systems without network capability. The host to BDI communication
uses the standard GDB remote protocol.

An additional Telnet interface is available for special debug tasks (e.g. force a hardware reset,
program flash memory).

The following figure shows how the BDI3000 interface is connected between the host and the target:

1.1 BDI3000

The BDI3000 is the main part of the bdiGDB system. This small box implements the interface be-
tween the JTAG pins of the target CPU and a 10/100Base-T Ethernet connector. The firmware of the
BDI3000 can be updated by the user with a simple Linux/Windows configuration program or interac-
tively via Telnet/TFTP. The BDI3000 supports 1.2 – 5.0 Volts target systems.

GNU Debugger

(GDB)

BDI

3000

Target System

COP Interface

Ethernet (10/100 BASE-T)

P4080

«
1
2
3
4
5
...
»

Summary of Contents for bdiGDB QorIQ P3

Page 1: ...bdiGDB JTAG debug interface for GNU Debugger QorIQ P3 P4 P5 User Manual Manual Version 1 03 for BDI3000 1997 2012 by Abatron AG ...

Page 2: ...P 16 2 6 Testing the BDI3000 to host connection 18 2 7 TFTP server for Windows 18 3 Using bdiGDB 19 3 1 Principle of operation 19 3 2 Configuration File 20 3 2 1 Part INIT 21 3 2 2 Part TARGET 24 3 2 3 Part HOST 28 3 2 4 Part FLASH 30 3 2 5 Part REGS 34 3 3 Debugging with GDB 36 3 3 1 Target setup 36 3 3 2 Connecting to the target 36 3 3 3 GDB monitor command 36 3 3 4 Target serial I O via BDI 37 ...

Page 3: ...e standard GDB remote protocol An additional Telnet interface is available for special debug tasks e g force a hardware reset program flash memory The following figure shows how the BDI3000 interface is connected between the host and the target 1 1 BDI3000 The BDI3000 is the main part of the bdiGDB system This small box implements the interface be tween the JTAG pins of the target CPU and a 10 100...

Page 4: ... 0 and 1 TARGET common parameters POWERUP 5000 start delay after power up detected in ms JTAGCLOCK 1 use 16 MHz JTAG clock WAKEUP 1000 give reset time to complete CoreID 0 parameters active vCPU after reset 0 CPUTYPE P4080 0 0 Core0 SOC0 0 STARTUP HALT halt at the reset vector this halts all cores CoreID 1 parameters 1 CPUTYPE P4080 1 0 Core1 SOC0 1 STARTUP HALT halt at the reset vector HOST IP 15...

Page 5: ...orter target cable available p n 90020 S This may improve JTAG communication reliability But best is to keep the JTAG traces on the board as short as possible Warning Before you can use the BDI3000 with an other target processor type e g PPC ARM a new setup has to be done see chapter 2 5 During this process the target cable must be disconnected from the target system To avoid conflicts between dat...

Page 6: ...c level reference for the input comparators It also controls the output logic levels to the target It is normally connected to Vdd I O on the target board 7 TCK JTAG Test Clock This output of the BDI3000 connects to the target TCK pin 8 IO8 General purpose I O This output of the BDI3000 connects to the target CKSTP_IN pin Currently not used 9 TMS JTAG Test Mode Select This output of the BDI3000 co...

Page 7: ...supply is not covered up and not situated near a heater or in direct sun light Dry location use only For error free operation the power supply to the BDI3000 must be between 4 75V and 5 25V DC The maximal tolerable supply voltage is 5 25 VDC Any higher voltage or a wrong polarity might destroy the electronics Please switch on the system in the following sequence 1 external power supply 2 target sy...

Page 8: ...ODE The built in LED indicates the following BDI states MODE LED BDI STATES OFF The BDI is ready for use the firmware is already loaded ON The output voltage from the power supply is too low BLINK The BDI loader mode is active an invalid firmware is loaded or loading firmware is active TARGET A TARGET B BDI TRGT MODE ...

Page 9: ...n of the bdiGDB system The host is connected to the BDI through the serial interface COM1 COM4 The communication cable included between BDI and Host is a serial cable There is the same connector pinout for the BDI and for the Host side Refer to Figure below RS232 Connector for PC host BDI3000 Target System RS232 PC Host 1 NC 2 RXD data from host 3 TXD data to host 4 NC 5 GROUND 6 NC 7 NC 8 NC 9 NC...

Page 10: ...ns the meanings of the built in LED lights LED Function Description LED 1 green Link Activity When this LED light is ON data link is successful between the UTP port of the BDI3000 and the hub to which it is connected The LED blinks when the BDI3000 is receiving or transmitting data LED 2 amber Speed When this LED light is ON 100Mb s mode is selected default When this LED light is OFF 10Mb s mode i...

Page 11: ...Telnet default IP to load the initial configuration parameters IP address of the BDI IP address of the host with the configuration file Name of the configuration file This file is accessed via TFTP Optional network parameters subnet mask default gateway Activating BOOTP The BDI can get the network configuration and the name of the configuration file also via BOOTP For this simple enter 0 0 0 0 as ...

Page 12: ... c cc O2 c o bdicnf o bdicnf c cc O2 c o bdidll o bdidll c cc s bdisetup o bdicnf o bdidll o o bdisetup 2 Check the serial connection to the BDI With bdisetup v you may check the serial connection to the BDI The BDI will respond with infor mation about the current loaded firmware and network configuration Note Login as root otherwise you probably have no access to the serial port bdisetup v p dev ...

Page 13: ...is automatically read by the BDI3000 after every start up Configuration file Enter the full path and name of the configuration file This file is read via TFTP Keep in mind that TFTP has it s own root directory usual tftpboot You can simply copy the configuration file to this directory and the use the file name without any path For more information about TFTP use man tftpd bdisetup c p dev ttyS0 b1...

Page 14: ...ory The following options allow you to do this Port Select the communication port where the BDI3000 is connected during this setup session If you select Network make sure the Loader is already active Mode LED blinking If there is already a firmware loaded and run ning use the Telnet command boot loader to activate Loader Mode Speed Select the baudrate used to communicate with the BDI3000 loader du...

Page 15: ...he correct subnet mask Default Gateway Enter the IP address of the default gateway Ask your network administra tor for the correct gateway IP address If the gateway feature is disabled you may enter 255 255 255 255 or any other value Config Host IP Address Enter the IP address of the host with the configuration file The configura tion file is automatically read by the BDI3000 after every start up ...

Page 16: ...et If a firmware is already running enter boot loader and reconnect via Telnet telnet 192 168 53 72 or telnet your BDI IP address Update the network parameters so it matches your needs LDR network BDI MAC 00 0c 01 30 00 01 BDI IP 192 168 53 72 BDI Subnet 255 255 255 0 BDI Gateway 255 255 255 255 Config IP 255 255 255 255 Config File LDR netip 151 120 25 102 LDR nethost 151 120 25 112 LDR netfile b...

Page 17: ...y 255 255 255 255 Config IP 151 120 25 112 Config File bdi3000 mytarget cfg LDR fwload e temp b30qp4gd 100 erasing firmware flash passed programming firmware flash passed LDR info BDI Firmware 23 1 00 BDI CPLD ID 01285043 BDI CPLD UES ffffffff BDI MAC 00 0c 01 30 00 01 BDI IP 151 120 25 102 BDI Subnet 255 255 255 0 BDI Gateway 255 255 255 255 Config IP 151 120 25 112 Config File bdi3000 mytarget c...

Page 18: ...Windows Abatron provides a TFTP server application tftpsrv exe This WIN32 console application runs as normal user application not as a system ser vice Command line syntax tftpsrv p w dRootDirectory Without any parameter the server starts in read only mode This means only read access request from the client are granted This is the normal working mode The bdiGDB system needs only read access to the ...

Page 19: ...the JTAG interface There is no need for any debug software on the target system After loading the code via TFTP debugging can begin at the very first assembler statement Whenever the BDI system is powered up the following sequence starts Power On initial configuration valid Get configuration file via TFTP Reset System and Power OFF activate BDI3000 loader Power OFF no yes Process target init list ...

Page 20: ...tifier parameter1 parameter2 parameterN etc Numeric parameters can be entered as decimal e g 700 or as hexadecimal 0x80000 Note about how to enter 64bit values The syntax for 64 bit parameters is high word _ low word Hex values may also be entered as 0xnnnnnnnnnnnnnnnn The high word optional and low word can be entered as decimal or hexadecimal They are han dled as two separate values concatenated...

Page 21: ...ter in DCSR space address address offset in DCSR space value the value to write into the register Example WDCSR 0x20c 0x0000000e CGCR1 Core Group 1 DELAY value Delay for the selected time A delay may be necessary to let the clock PLL lock again after a new clock rate is selected value the delay time in milliseconds 1 30000 Example DELAY 500 delay for 0 5 seconds WM8 address value Write a byte 8bit...

Page 22: ...pace TSZ2 start end Defines a memory range with 2 byte maximal transfer size TSZ4 start end Defines a memory range with 4 byte maximal transfer size TSZ8 start end Defines a memory range with 8 byte maximal transfer size MMAP start end Because a memory access to an invalid memory space via JTAG can lead to a deadlock this entry can be used to define up to 32 valid memory rang es If at least one me...

Page 23: ...000003f 1 2 e0000000 0_e0000000 256MB I G RWXRWX WTLB 0x80000a00_0x00000000 0x10030000_0x0000003f 1 3 00000000 0_00000000 1GB RWXRWX WTLB 0x80000a00_0x40000000 0x10040000_0x4000003f 1 4 40000000 0_40000000 1GB RWXRWX WTLB 0x80000500_0x80000000 0x10050000_0x8000003f 1 5 80000000 0_80000000 1MB RWXRWX Setup TLB0 MAS1 MAS2 MAS0 MAS7 MAS3 WTLB 0x80000100_0xc0000000 0x00000000_0x0000003f WAY0 c0000000 ...

Page 24: ...o code from a boot ROM is executed after power up The value entered in this configuration line is the delay time in milliseconds the BDI waits before it begins JTAG communication This time should be longer than the on board reset circuit asserts HRESET delay the power up start delay in milliseconds Example POWERUP 5000 start delay after power up RESET type time Normally the BDI drives the HRESET l...

Page 25: ...P 3000 let the CPU run for 3 seconds BREAKMODE mode This parameter defines how breakpoints are implemented The current mode can also be changed via the Telnet interface SOFT This is the normal mode Breakpoints are implemented by replacing code with a DNH instruction HARD In this mode the target breakpoint hardware is used Only 2 breakpoints at a time is supported LOOP In this mode breakpoints are ...

Page 26: ...or more information see also chapter Embedded Linux MMU Sup port If this parameter is not defined the BDI searches TLB0 in order to translate a virtual address TLB1 is always searched If the additional 64BIT option is present the BDI assume a 64 bit PTE addr Physical address of the memory used to store the virtual address of the array with the two page table pointers Example PTBASE 0xf0 SIO port b...

Page 27: ...ap propriate information also for the devices following the PowerPC chip Successor SCANPRED count irlen This value gives the BDI information about JTAG devices present before the PowerPC chip in the JTAG scan chain count The number of preceding devices irlen The sum of the length of all preceding instruction regis ters IR Example SCANPRED 1 8 one device with an IR length of 8 SCANSUCC count irlen ...

Page 28: ...om the im age file format SREC BIN AOUT ELF or ROM Example FORMAT ELF FORMAT ELF 0x10000 LOAD mode In Agent mode this parameters defines if the code is loaded automatically after every reset mode AUTO MANUAL Example LOAD MANUAL START address The address where to start the program file If this value is not defined and the core is not in ROM the address is taken from the image file If this val ue is...

Page 29: ...d filename the filename including the full path Example DUMP dump bin TELNET mode By default the BDI sends echoes for the received characters and supports command history and line editing If it should not send echoes and let the Telnet client in line mode add this entry to the configuration file mode ECHO default NOECHO or LINE Example TELNET NOECHO use old line mode ...

Page 30: ...ed to one flash chip For example enter 16 if you are using two AM29F010 to build a 16bit flash memory bank with the width of the flash memory bus in bits 8 16 32 64 Example BUSWIDTH 16 FILE filename The default name of the file that is programmed into flash using the Telnet prog command This name is used to access the file via TFTP If the file name starts with a this is replace with the path of th...

Page 31: ...art of the unlock list This unlock list is processed if the Telnet UNLOCK command is entered without any parameters Note Chip erase does not work for large chips because the BDI time outs after 3 minutes Use block erase wait The wait time in ms is only used for the unlock mode Af ter starting the flash unlock the BDI waits until it pro cesses the next entry Example ERASE 0xff040000 erase sector 4 ...

Page 32: ...se S29M32X16 for these flashes The AMD and AT49 algorithm are almost the same The only difference is that the AT49 algorithm does not check for the AMD status bit 5 Exceeded Timing Limits Only the AMD and AT49 algorithm support chip erase Block erase is only supported with the AT49 algorithm If the algorithm does not support the selected mode sector erase is performed If the chip does not support ...

Page 33: ...s of an Intel J3 Strata flash takes up to 0 7 seconds If unlock is used without any parameter all sectors in the erase list with the UNLOCK option are processed To clear all lock bits of an Intel J3 Strata flash use for example BDI unlock 0xFF000000 1000 To erase or unlock multiple continuous flash sectors blocks of the same size the following Telnet commands can be used ERASE addr step count UNLO...

Page 34: ...pped register IMM1 IMM4 Indirect memory mapped register addr The address offset or number of the register size The size 8 16 32 of the register default is 32 SWAP If present the bytes of a 16bit or 32bit register are swapped This is useful to access little endian ordered registers e g PCI bridge configuration reg isters The following entries are supported in the REGS part of the configuration file...

Page 35: ...ddr size sp GPR 1 atbl SPR 526 atbu SPR 527 bucsr SPR 1013 csrr0 SPR 58 csrr1 SPR 59 tlb0cfg SPR 688 tlb1cfg SPR 689 tsr SPR 336 usprg0 SPR 256 xer SPR 1 Local Bus Controller br0 CCSR 0x124000 br1 CCSR 0x124008 br2 CCSR 0x124010 br3 CCSR 0x124018 fcr CCSR 0x1240E8 fbar CCSR 0x1240EC fpar CCSR 0x1240F0 fbcr CCSR 0x1240F4 Now the defined registers can be accessed by name via the Telnet interface BDI...

Page 36: ...gger it must be connected to the remote target This can be done with the fol lowing command at the GDB prompt gdb target remote bdi3000 2001 bdi3000 This stands for an IP address The HOST file must have an appropriate entry You may also use an IP address in the form xxx xxx xxx xxx 2001 This is the TCP port used to communicate with the BDI If not already suspended this stops the execution of appli...

Page 37: ...rver stub running on the target should also be possible The configuration parameter SIO is used to enable this serial I O routing The used framing parameters are 8 data 1 stop and not parity TARGET SIO 7 9600 Enable SIO via TCP port 7 at 9600 baud Warning Once SIO is enabled connecting with the setup tool to update the firmware will fail In this case either disable SIO first or disconnect the BDI ...

Page 38: ... the kernel page table the second one can point to the current user page table As long as the base pointer or the first entry is zero the BDI does only L2 CAM L2 TLB1 and default translation Default translation maps a 256 Mbyte range starting at KERNELBASE to 0x00000000 The second page table is only searched if its address is not zero and there was no match in the first one The pointer structure i...

Page 39: ...able the hardware breakpoint with the Telnet command CI If not automatically done by the kernel setup the page table pointers for the BDI Start GDB with vmlinux as parameter Attach to the target Now you should be able to debug the Linux kernel To setup the BDI page table information structure manually set a hardware breakpoint at start_kernel and use the Telnet to write the address of swapper_pg_d...

Page 40: ...P4080 Core 0 Core state halted Debug entry cause device event Current PC 0xfffffffc Current CR 0x00000000 Current MSR 0x00000000 Current LR 0x00000000 Current CCSRBAR 0x0_fe000000 P4080 0 rd GPR00 c11bc002 06278553 80028188 aba40000 GPR04 609db195 ad1944b2 deadbeef 002883a6 GPR08 20119520 2032dc90 94110404 29038003 GPR12 9422cf8e 0c105000 613b00b0 4e0d4548 GPR16 0f15d163 3820d4a3 806b42d8 4c005402...

Page 41: ...SR space Run Control WDCSR addr value write to a register in DCSR space Run Control DCACHE addr set display L1 data cache content ICACHE addr set display L1 inst cache content L2CACHE set display L2 cache content TLB0 from to display L2 TLB0 entry TLB1 from to display L2 TLB1 entry WTLB0 way epn rpn write to a L2 TLB0 entry WTLB1 idx epn rpn write to a L2 TLB1 entry RESET HALT RUN time reset the t...

Page 42: ... the cores SAP accesses memory like an additional bus master If memory access CORE is selected the current core executes load store instructions in its current context In this mode MMU translation takes place unless the use of real addresses is forced For memory accesses via core the attr parameter in the Telnet MEMACC command has the fol lowing meaning default is 0 R W I M G E R 1 Real Addressing...

Page 43: ...give reset time to complete define the core ID the x without any holes no need that core ID matches the core number A valid example is 1 CPUTYPE P4080 5 0 Core 0 parameters active vCPU after reset 0 CPUTYPE P4080 0 0 Core0 SOC0 0 STARTUP STOP 5000 let U boot setup the system 0 BREAKMODE HARD SOFT or HARD HARD uses PPC hardware breakpoint 0 STEPMODE HWBP ICMP or HWBP HWBP uses a hardware breakpoint...

Page 44: ... Current MSR 0x00029200 Current LR 0x7ff74c38 Current CCSRBAR 0x0_fe000000 P4080 0 state Core 0 halted 0x7ff74c34 debug halt Core 1 running Core 2 running Core 3 running Core 4 running Core 5 running Core 6 running Core 7 running P4080 0 halt 0xf0 TARGET core 4 has entered debug mode TARGET core 5 has entered debug mode TARGET core 6 has entered debug mode TARGET core 7 has entered debug mode P408...

Page 45: ...ata Bits 8 Parity Bits none Stop Bits 1 Network Interface 10 100 BASE T BDM JTAG clock up to 32 MHz Supported target voltage 1 2 5 0 V Operating Temperature 5 C 60 C Storage Temperature 20 C 65 C Relative Humidity noncondensing 90 rF Size 160 x 85 x 35 mm Weight without cables 280 g Host Cable length RS232 2 5 m Electromagnetic Compatibility CE compliant Restriction of Hazardous Substances RoHS 20...

Page 46: ...000 QorIQ P3 P4 P5 User Manual 46 Copyright 1997 2012 by ABATRON AG Switzerland V 1 03 5 Environmental notice Disposal of the equipment must be carried out at a designated disposal site 6 Declaration of Conformity CE ...

Page 47: ...tive storage mediums Update and Support The agreement includes free software maintenance update and support for one year from date of purchase After this period the client may purchase software maintenance for an additional year 7 3 Warranty and Disclaimer ABATRON AND ITS SUPPLIERS HEREBY DISCLAIMS AND EXCLUDES TO THE EXTENT PERMITTED BY APPLICABLE LAW ALL WARRANTIES EXPRESS OR IMPLIED INCLUDING W...

Page 48: ...ible reasons Wrong pin assignment BDM JTAG connector of the target system see chapter 2 Target system initialization is not correctly enter an appropriate target initialization list An incorrect IP address was entered BDI3000 configuration BDM JTAG signals from the target system are not correctly short circuit break The target system is damaged Problem Network processes do not function loading the...

Page 49: ...right 1997 2012 by ABATRON AG Switzerland V 1 03 B Maintenance The BDI needs no special maintenance Clean the housing with a mild detergent only Solvents such as gasoline may damage it C Trademarks All trademarks are property of their respective holders ...

Reviews:

No comments

Related manuals for bdiGDB QorIQ P3

Brand: Keithley Pages: 67

Brand: Keithley Pages: 23

Brand: Keithley Pages: 93

Brand: Oki Pages: 44

Brand: Magnescale Pages: 64

Brand: DANLERS Pages: 2

Brand: Haas Automation Pages: 26

Brand: Halyard Pages: 88

Brand: HALDER Pages: 2

Brand: tayco Pages: 111

Brand: Rapala Pages: 14

Brand: S.R.Smith Pages: 43

Brand: Mackie Pages: 18

Brand: Mackie Pages: 2

Brand: Mackie Pages: 8

Brand: Mackie Pages: 7

Brand: XanLite Pages: 4

Brand: YASKAWA Pages: 81

Brands by name

0 1 2 3 4 5 6 7 8 9 A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

Popular brands

Load more brands