Abatron bdiGDB User Manual Download Page 1

Page: 1 / 60

bdi

GDB

JTAG debug interface for GNU Debugger

ARM11 / Cortex

User Manual

Manual Version 1.21 for BDI2000

Summary of Contents for bdiGDB

Page 1: ...bdiGDB JTAG debug interface for GNU Debugger ARM11 Cortex User Manual Manual Version 1 21 for BDI2000 1997 2014 by Abatron AG ...

Page 2: ... 3 Recover procedure 19 2 6 Testing the BDI2000 to host connection 20 2 7 TFTP server for Windows 20 3 Using bdiGDB 21 3 1 Principle of operation 21 3 2 Configuration File 21 3 2 1 Part INIT 22 3 2 2 Part TARGET 25 3 2 3 Part HOST 31 3 2 4 Part FLASH 33 3 2 5 Part REGS 41 3 3 Debugging with GDB 43 3 3 1 Target setup 43 3 3 2 Connecting to the target 43 3 3 3 Breakpoint Handling 44 3 3 4 GDB monito...

Page 4: ...s the standard GDB remote protocol An additional Telnet interface is available for special debug tasks e g force a hardware reset program flash memory The following figure shows how the BDI2000 interface is connected between the host and the target 1 1 BDI2000 The BDI2000 is the main part of the bdiGDB system This small box implements the interface be tween the JTAG pins of the target CPU and a 10...

Page 5: ...POWERUP 3000 start delay after power up detected in ms ENDIAN LITTLE memory model LITTLE BIG VECTOR CATCH 0x1f catch D_Abort P_Abort SWI Undef and Reset BREAKMODE HARD SOFT or HARD SCANPRED 0 0 no JTAG devices before the ARM1136 SCANSUCC 1 4 the ETMBUF after the ARM1136 core HOST IP 151 120 25 119 FILE E cygwin home demo pid7t fibo x FORMAT ELF LOAD MANUAL load file MANUAL or AUTO after reset FLAS...

Page 6: ...t System ARM 9 1 13 14 2 1 10 2 The green LED TRGT marked light up when target is powered up Rev A 1 19 20 2 Connector 1 Vcc Target 2 NC 3 TRST 4 NC 5 TDI 6 NC 7 TMS 8 GROUND 9 TCK 10 GROUND 11 NC 12 NC 13 TDO 14 NC 15 RESET 16 NC 17 NC 18 NC 19 NC 20 NC 1 Vcc Target 2 GROUND 3 TRST 4 GROUND 5 TDI 6 NC 7 TMS 8 NC 9 TCK 10 NC 11 TDO 12 RESET 13 NC 14 NC 20 pin Multi ICE Connector BDI2000 Target Sys...

Page 7: ...n drain push pull output of the BDI2000 resets the JTAG TAP controller on the target Default driver type is open drain 3 5 GND System Ground 4 TCK JTAG Test Clock This output of the BDI2000 connects to the target TCK line 6 TMS JTAG Test Mode Select This output of the BDI2000 connects to the target TMS line 7 RESET This open collector output of the BDI2000 is used to reset the target system 8 TDI ...

Page 8: ...sures that the BDI2000 never loses synchronization with the target device whatever the target clock speed is To achieve this BDI2000 uses two signals TCK and RTCK When adaptive clocking is selected BDI2000 issues a TCK signal and waits for the Re turned TCK RTCK to come back BDI2000 does not progress to the next TCK until RTCK is re ceived For more information about adaptive clocking see ARM docum...

Page 9: ...ators It also controls the output logic levels to the target It is normally fed from Vdd I O on the target board 3 0 5 0V with Rev A B This input to the BDI2000 is used to detect if the target is powered up If there is a current limiting resistor between this pin and the target Vdd it should be 100 Ohm or less 7 TCK JTAG Test Clock This output of the BDI2000 connects to the target TCK line 8 TRST ...

Page 10: ...ESET This open collector output of the BDI2000 can be used to hard reset the target system 9 Vcc Target 1 8 5 0V This is the target reference voltage It indicates that the target has power and it is also used to create the logic level reference for the input comparators It also controls the output logic levels to the target It is normally fed from Vdd I O on the target board 3 0 5 0V with Rev A B ...

Page 11: ...I2000 keep the power supply cable as short as possible For error free operation the power supply to the BDI2000 must be between 4 75V and 5 25V DC The maximal tolerable supply voltage is 5 25 VDC Any higher voltage or a wrong polarity might destroy the electronics Please switch on the system in the following sequence 1 external power supply 2 target system BDI TRGT MODE TARGET A TARGET B POWER 1 V...

Page 12: ...atus LED MODE The built in LED indicates the following BDI states MODE LED BDI STATES OFF The BDI is ready for use the firmware is already loaded ON The power supply for the BDI2000 is 4 75VDC BLINK The BDI loader mode is active an invalid firmware is loaded or loading firmware is active BDI TRGT MODE TARGET A TARGET B ...

Page 13: ... of the bdiGDB system The host is connected to the BDI through the serial interface COM1 COM4 The communication cable included between BDI and Host is a serial cable There is the same connector pinout for the BDI and for the Host side Refer to Figure below RS232 Connector for PC host BDI2000 Target System RS232 Host 1 NC 2 RXD data from host 3 TXD data to host 4 NC 5 GROUND 6 NC 7 NC 8 NC 9 NC RS2...

Page 14: ...r network administrator if you have questions about the network The following explains the meanings of the built in LED lights LED Name Description LI Link When this LED light is ON data link is successful between the UTP port of the BDI2000 and the hub to which it is connected TX Transmit When this LED light BLINKS data is being transmitted through the UTP port of the BDI2000 RX Receive When this...

Page 15: ... configuration process Create a new directory on your hard disk Copy the entire contents of the enclosed CD into this directory Linux only extract the setup tool sources and build the setup tool Use the setup tool to load update the BDI firmware logic Note A new BDI has no firmware logic loaded Use the setup tool to transmit the initial configuration parameters IP address of the BDI IP address of ...

Page 16: ...nf c cc O2 c o bdidll o bdidll c cc s bdisetup o bdicnf o bdidll o o bdisetup 2 Check the serial connection to the BDI With bdisetup v you may check the serial connection to the BDI The BDI will respond with infor mation about the current loaded firmware and network configuration Note Login as root otherwise you probably have no access to the serial port root LINUX_1 bdisetup bdisetup v p dev ttyS...

Page 17: ...the host IP is 255 255 255 255 then the setup tool stores the configura tion read from the file into the BDI internal flash memory In this case no TFTP server is necessary Configuration file Enter the full path and name of the configuration file This file is read by the setup tool or via TFTP Keep in mind that TFTP has it s own root direc tory usual tftpboot root LINUX_1 bdisetup bdisetup c p dev ...

Page 18: ... do this Channel Select the communication port where the BDI2000 is connected during this setup session Baudrate Select the baudrate used to communicate with the BDI2000 loader during this setup session Connect Click on this button to establish a connection with the BDI2000 loader Once connected the BDI2000 remains in loader mode until it is restarted or this dialog box is closed Current Press thi...

Page 19: ...up via TFTP If the host IP is 255 255 255 255 then the setup tool stores the configura tion read from the file into the BDI internal flash memory In this case no TFTP server is necessary Configuration file Enter the full path and name of the configuration file This file is read by the setup tool or via TFTP Transmit Click on this button to store the configuration in the BDI2000 flash memory 2 5 3 ...

Page 20: ...rovides a TFTP server appli cation tftpsrv exe This WIN32 console application runs as normal user application not as a system service Command line syntax tftpsrv p w dRootDirectory Without any parameter the server starts in read only mode This means only read access request from the client are granted This is the normal working mode The bdiGDB system needs only read access to the configuration and...

Page 21: ...n file is automatically read by the BDI2000 after every power on The syntax of this file is as follows comment part name core identifier parameter1 parameter2 parameterN comment core identifier parameter1 parameter2 parameterN part name core identifier parameter1 parameter2 parameterN core identifier parameter1 parameter2 parameterN etc Numeric parameters can be entered as decimal e g 700 or as he...

Page 22: ... the selected Coprocessor register n the CP number 0 15 register the register number see chapter CPx registers value the value to write into the register Example WCP15 2 0x00004000 set Translation Base 0 WM8 address value Write a byte 8bit to the selected memory place address the memory address value the value to write to the target memory Example WM8 0xFFFFFA21 0x04 SYPCR watchdog disable WM16 ad...

Page 23: ...back WAIT mask equal Waits until memory mask equal The last RM8 RM16 or RM32 entry defines the address and the size for the following WAIT mask the bit mask used before comparing equal the value to compare against Example RM16 0x2000000a WAIT 0x000f0ff 0x00001034 wait until equal MMAP start end Because a memory access to an invalid memory space via JTAG leads to a deadlock this entry can be used t...

Page 24: ...ates it after a timeout of 5 seconds FILE filename The name of the file with the startup code This name is used to access the startup code via TFTP filename the filename including the full path Example FILE F gdb target config pid7t startup hex FORMAT format The format of the startup file Currently COFF S Record a out Binary and ELF file formats are supported If the startup code is already stored ...

Page 25: ...parameter addr Defines the APB address of the Cross Trigger Interface CTI component cgroup This is a bitmap of selected cores It gives the BDI infor mation about how to restart multiple cores in response to a GDB continue command See chapter Multi Core Support Example 0 CTI 0x82158000 0x0f CTI base core group master 1 CTI 0x82159000 0x02 CTI base core group slave CLOCK main init SLOW With this val...

Page 26: ...or 1 second STARTUP mode runtime This parameter selects the target startup mode The following modes are supported HALT This default mode tries to forces the target to debug mode immediately out of reset STOP In this mode the BDI lets the target execute code for runtime milliseconds after reset This mode is useful when boot code should initialize the target system RUN After reset the target execute...

Page 27: ...TTLE default BIG Example ENDIAN LITTLE VECTOR CATCH mask When this line is present the BDI catches exceptions The mask is used to setup the ARM Vector catch register mask selects the exceptions to catch Example VECTOR CATCH 0x1B catch Abort Undef Reset BREAKMODE SOFT HARD HYP control This parameter defines how GDB breakpoints are handled and defines some bits in the break watch control register DB...

Page 28: ...he TCP port used for this BDI to host communication You may choose any port except 0 and the default Telnet port 23 On the host open a Telnet session using this port Now you should see the UART output in this Telnet session You can use the normal Telnet connection to the BDI in parallel they work completely in dependent Also input to the UART is implemented port The TCP IP port used for the host c...

Page 29: ...map raw SWO to even port 8020 Daisy chained JTAG devices For ARM targets the BDI can also handle systems with multiple devices connected to the JTAG scan chain In order to put the other devices into BYPASS mode and to count for the additional bypass registers the BDI needs some information about the scan chain layout Enter the number count and total instruction register irlen length of the devices...

Page 30: ... SCANPOST i10 ffff scan bypass The following low level JTAG commands are supported in the string Use between commands I n b2b1b0 write IR b0 is first scanned not for SWD D n b2b1b0 write DR b0 is first scanned not for SWD n the number of bits 1 256 bx a data byte two hex digits W n wait for n decimal micro seconds T1 assert TRST not for SWD T0 release TRST not for SWD R1 assert RESET R0 release RE...

Page 31: ...the format The optional parameter offset is added to any load address read from the im age file format SREC BIN AOUT ELF COFF or ROM Example FORMAT ELF FORMAT ELF 0x10000 LOAD mode In Agent mode this parameters defines if the code is loaded automatically after every reset mode AUTO MANUAL Example LOAD MANUAL START address The address where to start the program file If this value is not defined and...

Page 32: ...DUMP filename The default file name used for the DUMP command from a Telnet session filename the filename including the full path Example DUMP dump bin TELNET mode By default the BDI sends echoes for the received characters and supports command history and line editing If it should not send echoes and let the Telnet client in line mode add this entry to the configuration file mode ECHO default NOE...

Page 33: ...ash chips Do not en ter the width of the flash chip itself The parameter CHIPTYPE carries the information about the number of data lines connected to one flash chip For example enter 16 if you are using two AM29F010 to build a 16bit flash memory bank with the width of the flash memory bus in bits 8 16 32 Example BUSWIDTH 16 FILE filename The default name of the file that is programmed into flash u...

Page 34: ...ommand is entered without any parameters Note Chip erase does not work for large chips because the BDI time outs after 3 minutes Use block erase wait The wait time in ms is only used for the unlock mode Af ter starting the flash unlock the BDI waits until it pro cesses the next entry Example ERASE 0xff040000 erase sector 4 of flash ERASE 0xff060000 erase sector 6 of flash ERASE 0xff000000 CHIP era...

Page 35: ...e STM32L15xx internal flash memory Option byte programming is not directly supported but can be done manually via Telnet mm md commands FLASH CHIPTYPE STM32L15 CHIPSIZE 0x20000 128 kB FLASH BUSWIDTH 32 32 bit flash access FILE E temp dump16k bin FORMAT BIN 0x08010000 ERASE 0x08010000 256 64 erase 64 x 256 byte pages Stellaris LM3S Internal Flash Memory The BDI supports programming of the Luminary ...

Page 36: ...AY 100 WM32 0x400E0430 0x00000011 PMC_MCKR set PRES 1 clk 2 DELAY 100 WM32 0x400E0430 0x00000012 PMC_MCKR set CSS 2 select PLLA DELAY 100 TARGET CPUTYPE CORTEX M3 CLOCK 1 4 BDI2000 start with 1MHz then use 16MHz POWERUP 3000 start delay after power up detected in ms RESET HARD 100 assert reset for 100 ms WAKEUP 100 wait after reset released STARTUP HALT halt immediatelly at the reset vector MEMACC...

Page 37: ...00 BLANK erase sector 20 27 with blank check ERASE 0x00000002 erase only sector 1 no blank check The BDI needs a workspace of 1 5 kbytes 0x600 in the internal SRAM It is used to store the data to program and to create a context from which the flash drivers can be called Examples see also LPC1114 and LPC1768 configuration files on the CD FLASH CHIPTYPE LPC1000 96000 LPC1768 flash CCLK 96 000 MHz CH...

Page 38: ... Mass and Sector Erase of the Main Flash memory is supported The BUSWIDTH parameter defines the used Program Erase Parallelism see STM32F2 and STM32F4 Flash programming manual Option byte programming is not directly supported but can be done manually via Telnet mm md commands FLASH WORKSPACE 0x20000000 workspace in internal SRAM CHIPTYPE STM32F2 CHIPSIZE 0x100000 1 MB FLASH BUSWIDTH 32 x32 Program...

Page 39: ...fset Use S29M32X16 for these flashes The AMD and AT49 algorithm are almost the same The only difference is that the AT49 algorithm does not check for the AMD status bit 5 Exceeded Timing Limits Only the AMD and AT49 algorithm support chip erase Block erase is only supported with the AT49 algorithm If the algorithm does not support the selected mode sector erase is performed If the chip does not su...

Page 40: ...ck bits of an Intel J3 Strata flash takes up to 0 7 seconds If unlock is used without any parameter all sectors in the erase list with the UNLOCK option are processed To clear all lock bits of an Intel J3 Strata flash use for example BDI unlock 0xFF000000 1000 To erase or unlock multiple continuos flash sectors blocks of the same size the following Telnet commands can be used ERASE addr step count...

Page 41: ...lative direct memory mapped register IMM1 IMM4 Indirect memory mapped register APB APB memory mapped register addr The address offset or number of the register size The size 8 16 32 of the register default is 32 SWAP If present the bytes of a 16bit or 32bit register are swapped This is useful to access big endian ordered registers from a little endian core The following entries are supported in th...

Page 42: ... CP15 0x6000 32 TCM type ctr CP15 0x0001 32 Control aux CP15 0x2001 32 Auxiliary Control cpacc CP15 0x4001 32 Coprocessor Access CM1136JF S core module control registers cm_id MM 0x10000000 cm_proc MM 0x10000004 cm_osc MM 0x10000008 cm_ctrl MM 0x1000000c cm_stat MM 0x10000010 Cortex A8 debug registers dscr APB 0xd4011088 Debug Status and Control prcr APB 0xd4011310 Device Power Down and Reset Cont...

Page 43: ... immediately started otherwise only the target PC is set BDI now waits for GDB request from the debugger running on the host After starting the debugger it must be connected to the remote target This can be done with the fol lowing command at the GDB prompt gdb target remote bdi2000 2001 bdi2000 This stands for an IP address The HOST file must have an appropriate entry You may also use an IP addre...

Page 44: ...BREAKMODE SOFT SOFT or HARD HARD uses hardware breakpoints The BDI supports only a GDB version that uses a Z Packet to set breakpoints GDB Version 5 0 or newer GDB tells the BDI to set clear breakpoints with this special protocol unit The BDI will re spond to this request by replacing code in memory with the BKPT instruction or by setting the appro priate hardware breakpoint 3 3 4 GDB monitor comm...

Page 45: ...ning on the target should also be possible The configuration parameter SIO is used to enable this serial I O routing The BDI asserts RTS and DTR when a TCP connection is established TARGET SIO 7 9600 Enable SIO via TCP port 7 at 9600 baud Warning Once SIO is enabled connecting with the setup tool to update the firmware will fail In this case either disable SIO first or disconnect the BDI from the ...

Page 46: ...w some simple functions you can link to your application in order to implement IO via DCC define DSCR_WDTR_FULL 1L 29 define DSCR_RDTR_FULL 1L 30 static unsigned int read_dtr void unsigned int c __asm__ volatile mrc p14 0 0 c0 c5 n r c return c static void write_dtr unsigned int c __asm__ volatile mcr p14 0 0 c0 c5 n r c static unsigned int read_dscr void unsigned int ret __asm__ volatile mrc p14 ...

Page 47: ...a SWO prepare SWO ASCII output via Stimulus0 WM32 0xE00400F0 0x00000002 TPIU_PROTOCOL async mode NRZ WM32 0xE0040010 99 TPIU_PRESCALER select 500000 baud WM32 0xE0040304 0x00000100 TPIU_FF_CONTROL formatter bypass WM32 0xE0000FB0 0xC5ACCE55 ITM_LOCK_ACCESS enable access WM32 0xE0000E80 0x00000001 ITM_TRACE_CTRL enable trace WM32 0xE0000E00 0x00000001 ITM_TRACE_ENA enable stimulus0 TARGET SWO 8023 ...

Page 48: ...installation of the bdiGDB system or in case of special debug needs Multiple commands separated by a semicolon can be entered on one line Example of a Telnet session ARM1136 info Core number 0 Core state debug mode ARM Debug entry cause Vector Catch RESET Current PC 0x00000000 Current CPSR 0x000001d3 Supervisor ARM1136 rd GPR00 000000fc f1c72a88 ff5ffdf7 3bb15ae6 GPR04 f87f47f7 3c7c6959 ba398649 d...

Page 49: ...value modify CP register default is CP15 RMFP number value modify floating point register WDBG nbr value modify core debug register MODE usr sys hyp svc abt und mon irq fiq set processor mode SECURE Cortex A switch from nonsecure to secure state NONSECURE Cortex A switch from secure to nonsecure state MMU ENABLE DISABLE enable disable MMU via control register DTLB from to ARM1136 display Data TLB ...

Page 50: ...nfiguration FENA addr size enable autoamtic programming to flash memory FDIS disable autoamtic programming to flash memory DELAY ms delay for a number of milliseconds MEMACC CORE AHB hprot Cortex A8 select memory access mode SELECT core change the current core ATTACH core connect to a core DETACH core disconnect from a core HOST ip change IP address of program file host PROMPT string defines a new...

Page 51: ...5 number value modify control processor 15 register RMCP 14 number value modify control processor 14 register RMCP 13 number value modify control processor 13 register The parameter number selects the CPxx register This parameter is used to build the appropriate MCR or MRC instruction opc_2 0 CRm opc_1 0 CRn Some examples CP15 ID register CRn 0 opcode_2 0 BDI rdcp 15 0x0000 CP15 Cache Type CRn 0 o...

Page 52: ...P CoreID 1 parameters 1 CPUTYPE CORTEX A9 0x82152000 force APB Debug Base address 1 CTI 0x82159000 0x02 CTI base address and core group slave 1 STARTUP HALT 1 ENDIAN LITTLE memory model LITTLE BIG 1 MEMACCESS CORE 10 memory access via core 80 TCK s access delay 1 STEPMODE OVER OVER or INTO 1 BREAKMODE SOFT SOFT or HARD 1 SCANPRED 2 9 count for SJC and SDMA 1 SCANSUCC 0 0 no device after DAP CoreID...

Page 53: ...l cores in the group are started synchronously and CTI and CTM is setup so that all cores in this group halt when one of it halts If there is a core bit map entered for the halt command then all cores in the bit map are halted syn chronously Example where all cores halt when core 0 halts on a breakpoint IMX6 0 stat Core 0 halted 0x00900100 Debug Request Core 1 halted 0x00900100 Debug Request Core ...

Page 54: ...UP core mask includes other cores beside the actual one then all cores in the mask are prepared for restart if not already done and finally the whole core group is restarted at the same time and CTI and CTM is setup so that all cores in this group halt when one of it halts This supports two different debug scenarios where the first one is actually a special case of the sec ond one Debug only one c...

Page 55: ...0 19 200 38 400 57 600 115 200 Data Bits 8 Parity Bits none Stop Bits 1 Network Interface 10 BASE T Serial Transfer Rate between BDI and Target up to 16 Mbit s Supported target voltage 1 8 5 0 V 3 0 5 0 V with Rev A B Operating Temperature 5 C 60 C Storage Temperature 20 C 65 C Relative Humidity noncondensing 90 rF Size 190 x 110 x 35 mm Weight without cables 420 g Host Cable length RS232 2 5 m Sp...

Page 56: ...er BDI2000 ARM11 Cortex User Manual 56 Copyright 1997 2014 by ABATRON AG Switzerland V 1 21 5 Environmental notice Disposal of the equipment must be carried out at a designated disposal site 6 Declaration of Conformity CE ...

Page 57: ...or defective storage mediums Update and Support The agreement includes free software maintenance update and support for one year from date of purchase After this period the client may purchase software maintenance for an additional year 7 3 Warranty and Disclaimer ABATRON AND ITS SUPPLIERS HEREBY DISCLAIMS AND EXCLUDES TO THE EXTENT PERMITTED BY APPLICABLE LAW ALL WARRANTIES EXPRESS OR IMPLIED INC...

Page 58: ...mmunication port Com 1 Com 4 is selected Problem No working with the target system loading firmware is ok Possible reasons Wrong pin assignment BDM JTAG connector of the target system see chapter 2 Target system initialization is not correctly enter an appropriate target initialization list An incorrect IP address was entered BDI2000 configuration BDM JTAG signals from the target system are not co...

Page 59: ...tage or wrong polarity To exchange the fuse or to perform special initialization please proceed according to the following steps Observe precautions for handling Electrostatic sensitive device Unplug the cables before opening the cover Use exact fuse replacement Microfuse MSF 1 6 AF 1 2 3 1 1 Unplug the cables BDI TRGT MODE BDI MAIN BDI OPTION 2 1 Remove the two plastic caps that cover the screws ...

Page 60: ...ully the print Check that the LEDs align with the holes in the front panel elastic sealing Reinstallation back panel 5 2 Push carefully the front panel and the red elastig sealing on the casing Check that the LEDs align with the holes in the front panel and that the 5 3 Mount the screws do not overtighten it 5 4 Mount the two plastic caps that cover the screws 5 5 Plug the cables position of the s...

Search results

Summary of Contents for bdiGDB

Reviews:

Related manuals for bdiGDB

Brands by name

Popular brands

Abatron bdiGDB, User Manual

Search results

Summary of Contents for bdiGDB

Reviews:

Related manuals for bdiGDB

Brands by name

Popular brands