Abatron bdiGDB QorIQ P3 Скачать руководство пользователя страница 39

Страница: 39 / 49

bdi

GDB

for BDI3000 (QorIQ P3/P4/P5)

User Manual

V 1.03

To debug the Linux kernel when MMU is enabled you may use the following load and startup se-
quence:

• Load the compressed linux image

• Set a hardware breakpoint with the Telnet at a point where MMU is enabled. For example at

"start_kernel".
BDI> BI 0xC0061550

• Start the code with GO at the Telnet

• The Linux kernel is decompressed and started

• The system should stop at the hardware breakpoint (e.g. at start_kernel)

• Disable the hardware breakpoint with the Telnet command CI.

• If not automatically done by the kernel, setup the page table pointers for the BDI.

• Start GDB with vmlinux as parameter

• Attach to the target

• Now you should be able to debug the Linux kernel

To setup the BDI page table information structure manually, set a hardware breakpoint at
"start_kernel" and use the Telnet to write the address of "swapper_pg_dir" to the appropriate place.

BDI>bi 0xc0061550

/* set breakpoint at start_kernel */

BDI>go

/* target stops at start_kernel */

BDI>ci

BDI>mm 0xf0 0xc00000f8

/* Let PTBASE point to an array of two pointers*/

BDI>mm 0xf8 0xc0057000

/* write address of swapper_pg_dir to first pointer */

BDI>mm 0xfc 0x00000000

/* clear second (user) pointer */

Содержание bdiGDB QorIQ P3

Страница 1: ...bdiGDB JTAG debug interface for GNU Debugger QorIQ P3 P4 P5 User Manual Manual Version 1 03 for BDI3000 1997 2012 by Abatron AG ...

Страница 2: ...P 16 2 6 Testing the BDI3000 to host connection 18 2 7 TFTP server for Windows 18 3 Using bdiGDB 19 3 1 Principle of operation 19 3 2 Configuration File 20 3 2 1 Part INIT 21 3 2 2 Part TARGET 24 3 2 3 Part HOST 28 3 2 4 Part FLASH 30 3 2 5 Part REGS 34 3 3 Debugging with GDB 36 3 3 1 Target setup 36 3 3 2 Connecting to the target 36 3 3 3 GDB monitor command 36 3 3 4 Target serial I O via BDI 37 ...

Страница 3: ...e standard GDB remote protocol An additional Telnet interface is available for special debug tasks e g force a hardware reset program flash memory The following figure shows how the BDI3000 interface is connected between the host and the target 1 1 BDI3000 The BDI3000 is the main part of the bdiGDB system This small box implements the interface be tween the JTAG pins of the target CPU and a 10 100...

Страница 4: ... 0 and 1 TARGET common parameters POWERUP 5000 start delay after power up detected in ms JTAGCLOCK 1 use 16 MHz JTAG clock WAKEUP 1000 give reset time to complete CoreID 0 parameters active vCPU after reset 0 CPUTYPE P4080 0 0 Core0 SOC0 0 STARTUP HALT halt at the reset vector this halts all cores CoreID 1 parameters 1 CPUTYPE P4080 1 0 Core1 SOC0 1 STARTUP HALT halt at the reset vector HOST IP 15...

Страница 5: ...orter target cable available p n 90020 S This may improve JTAG communication reliability But best is to keep the JTAG traces on the board as short as possible Warning Before you can use the BDI3000 with an other target processor type e g PPC ARM a new setup has to be done see chapter 2 5 During this process the target cable must be disconnected from the target system To avoid conflicts between dat...

Страница 6: ...c level reference for the input comparators It also controls the output logic levels to the target It is normally connected to Vdd I O on the target board 7 TCK JTAG Test Clock This output of the BDI3000 connects to the target TCK pin 8 IO8 General purpose I O This output of the BDI3000 connects to the target CKSTP_IN pin Currently not used 9 TMS JTAG Test Mode Select This output of the BDI3000 co...

Страница 7: ...supply is not covered up and not situated near a heater or in direct sun light Dry location use only For error free operation the power supply to the BDI3000 must be between 4 75V and 5 25V DC The maximal tolerable supply voltage is 5 25 VDC Any higher voltage or a wrong polarity might destroy the electronics Please switch on the system in the following sequence 1 external power supply 2 target sy...

Страница 8: ...ODE The built in LED indicates the following BDI states MODE LED BDI STATES OFF The BDI is ready for use the firmware is already loaded ON The output voltage from the power supply is too low BLINK The BDI loader mode is active an invalid firmware is loaded or loading firmware is active TARGET A TARGET B BDI TRGT MODE ...

Страница 9: ...n of the bdiGDB system The host is connected to the BDI through the serial interface COM1 COM4 The communication cable included between BDI and Host is a serial cable There is the same connector pinout for the BDI and for the Host side Refer to Figure below RS232 Connector for PC host BDI3000 Target System RS232 PC Host 1 NC 2 RXD data from host 3 TXD data to host 4 NC 5 GROUND 6 NC 7 NC 8 NC 9 NC...

Страница 10: ...ns the meanings of the built in LED lights LED Function Description LED 1 green Link Activity When this LED light is ON data link is successful between the UTP port of the BDI3000 and the hub to which it is connected The LED blinks when the BDI3000 is receiving or transmitting data LED 2 amber Speed When this LED light is ON 100Mb s mode is selected default When this LED light is OFF 10Mb s mode i...

Страница 11: ...Telnet default IP to load the initial configuration parameters IP address of the BDI IP address of the host with the configuration file Name of the configuration file This file is accessed via TFTP Optional network parameters subnet mask default gateway Activating BOOTP The BDI can get the network configuration and the name of the configuration file also via BOOTP For this simple enter 0 0 0 0 as ...

Страница 12: ... c cc O2 c o bdicnf o bdicnf c cc O2 c o bdidll o bdidll c cc s bdisetup o bdicnf o bdidll o o bdisetup 2 Check the serial connection to the BDI With bdisetup v you may check the serial connection to the BDI The BDI will respond with infor mation about the current loaded firmware and network configuration Note Login as root otherwise you probably have no access to the serial port bdisetup v p dev ...

Страница 13: ...is automatically read by the BDI3000 after every start up Configuration file Enter the full path and name of the configuration file This file is read via TFTP Keep in mind that TFTP has it s own root directory usual tftpboot You can simply copy the configuration file to this directory and the use the file name without any path For more information about TFTP use man tftpd bdisetup c p dev ttyS0 b1...

Страница 14: ...ory The following options allow you to do this Port Select the communication port where the BDI3000 is connected during this setup session If you select Network make sure the Loader is already active Mode LED blinking If there is already a firmware loaded and run ning use the Telnet command boot loader to activate Loader Mode Speed Select the baudrate used to communicate with the BDI3000 loader du...

Страница 15: ...he correct subnet mask Default Gateway Enter the IP address of the default gateway Ask your network administra tor for the correct gateway IP address If the gateway feature is disabled you may enter 255 255 255 255 or any other value Config Host IP Address Enter the IP address of the host with the configuration file The configura tion file is automatically read by the BDI3000 after every start up ...

Страница 16: ...et If a firmware is already running enter boot loader and reconnect via Telnet telnet 192 168 53 72 or telnet your BDI IP address Update the network parameters so it matches your needs LDR network BDI MAC 00 0c 01 30 00 01 BDI IP 192 168 53 72 BDI Subnet 255 255 255 0 BDI Gateway 255 255 255 255 Config IP 255 255 255 255 Config File LDR netip 151 120 25 102 LDR nethost 151 120 25 112 LDR netfile b...

Страница 17: ...y 255 255 255 255 Config IP 151 120 25 112 Config File bdi3000 mytarget cfg LDR fwload e temp b30qp4gd 100 erasing firmware flash passed programming firmware flash passed LDR info BDI Firmware 23 1 00 BDI CPLD ID 01285043 BDI CPLD UES ffffffff BDI MAC 00 0c 01 30 00 01 BDI IP 151 120 25 102 BDI Subnet 255 255 255 0 BDI Gateway 255 255 255 255 Config IP 151 120 25 112 Config File bdi3000 mytarget c...

Страница 18: ...Windows Abatron provides a TFTP server application tftpsrv exe This WIN32 console application runs as normal user application not as a system ser vice Command line syntax tftpsrv p w dRootDirectory Without any parameter the server starts in read only mode This means only read access request from the client are granted This is the normal working mode The bdiGDB system needs only read access to the ...

Страница 19: ...the JTAG interface There is no need for any debug software on the target system After loading the code via TFTP debugging can begin at the very first assembler statement Whenever the BDI system is powered up the following sequence starts Power On initial configuration valid Get configuration file via TFTP Reset System and Power OFF activate BDI3000 loader Power OFF no yes Process target init list ...

Страница 20: ...tifier parameter1 parameter2 parameterN etc Numeric parameters can be entered as decimal e g 700 or as hexadecimal 0x80000 Note about how to enter 64bit values The syntax for 64 bit parameters is high word _ low word Hex values may also be entered as 0xnnnnnnnnnnnnnnnn The high word optional and low word can be entered as decimal or hexadecimal They are han dled as two separate values concatenated...

Страница 21: ...ter in DCSR space address address offset in DCSR space value the value to write into the register Example WDCSR 0x20c 0x0000000e CGCR1 Core Group 1 DELAY value Delay for the selected time A delay may be necessary to let the clock PLL lock again after a new clock rate is selected value the delay time in milliseconds 1 30000 Example DELAY 500 delay for 0 5 seconds WM8 address value Write a byte 8bit...

Страница 22: ...pace TSZ2 start end Defines a memory range with 2 byte maximal transfer size TSZ4 start end Defines a memory range with 4 byte maximal transfer size TSZ8 start end Defines a memory range with 8 byte maximal transfer size MMAP start end Because a memory access to an invalid memory space via JTAG can lead to a deadlock this entry can be used to define up to 32 valid memory rang es If at least one me...

Страница 23: ...000003f 1 2 e0000000 0_e0000000 256MB I G RWXRWX WTLB 0x80000a00_0x00000000 0x10030000_0x0000003f 1 3 00000000 0_00000000 1GB RWXRWX WTLB 0x80000a00_0x40000000 0x10040000_0x4000003f 1 4 40000000 0_40000000 1GB RWXRWX WTLB 0x80000500_0x80000000 0x10050000_0x8000003f 1 5 80000000 0_80000000 1MB RWXRWX Setup TLB0 MAS1 MAS2 MAS0 MAS7 MAS3 WTLB 0x80000100_0xc0000000 0x00000000_0x0000003f WAY0 c0000000 ...

Страница 24: ...o code from a boot ROM is executed after power up The value entered in this configuration line is the delay time in milliseconds the BDI waits before it begins JTAG communication This time should be longer than the on board reset circuit asserts HRESET delay the power up start delay in milliseconds Example POWERUP 5000 start delay after power up RESET type time Normally the BDI drives the HRESET l...

Страница 25: ...P 3000 let the CPU run for 3 seconds BREAKMODE mode This parameter defines how breakpoints are implemented The current mode can also be changed via the Telnet interface SOFT This is the normal mode Breakpoints are implemented by replacing code with a DNH instruction HARD In this mode the target breakpoint hardware is used Only 2 breakpoints at a time is supported LOOP In this mode breakpoints are ...

Страница 26: ...or more information see also chapter Embedded Linux MMU Sup port If this parameter is not defined the BDI searches TLB0 in order to translate a virtual address TLB1 is always searched If the additional 64BIT option is present the BDI assume a 64 bit PTE addr Physical address of the memory used to store the virtual address of the array with the two page table pointers Example PTBASE 0xf0 SIO port b...

Страница 27: ...ap propriate information also for the devices following the PowerPC chip Successor SCANPRED count irlen This value gives the BDI information about JTAG devices present before the PowerPC chip in the JTAG scan chain count The number of preceding devices irlen The sum of the length of all preceding instruction regis ters IR Example SCANPRED 1 8 one device with an IR length of 8 SCANSUCC count irlen ...

Страница 28: ...om the im age file format SREC BIN AOUT ELF or ROM Example FORMAT ELF FORMAT ELF 0x10000 LOAD mode In Agent mode this parameters defines if the code is loaded automatically after every reset mode AUTO MANUAL Example LOAD MANUAL START address The address where to start the program file If this value is not defined and the core is not in ROM the address is taken from the image file If this val ue is...

Страница 29: ...d filename the filename including the full path Example DUMP dump bin TELNET mode By default the BDI sends echoes for the received characters and supports command history and line editing If it should not send echoes and let the Telnet client in line mode add this entry to the configuration file mode ECHO default NOECHO or LINE Example TELNET NOECHO use old line mode ...

Страница 30: ...ed to one flash chip For example enter 16 if you are using two AM29F010 to build a 16bit flash memory bank with the width of the flash memory bus in bits 8 16 32 64 Example BUSWIDTH 16 FILE filename The default name of the file that is programmed into flash using the Telnet prog command This name is used to access the file via TFTP If the file name starts with a this is replace with the path of th...

Страница 31: ...art of the unlock list This unlock list is processed if the Telnet UNLOCK command is entered without any parameters Note Chip erase does not work for large chips because the BDI time outs after 3 minutes Use block erase wait The wait time in ms is only used for the unlock mode Af ter starting the flash unlock the BDI waits until it pro cesses the next entry Example ERASE 0xff040000 erase sector 4 ...

Страница 32: ...se S29M32X16 for these flashes The AMD and AT49 algorithm are almost the same The only difference is that the AT49 algorithm does not check for the AMD status bit 5 Exceeded Timing Limits Only the AMD and AT49 algorithm support chip erase Block erase is only supported with the AT49 algorithm If the algorithm does not support the selected mode sector erase is performed If the chip does not support ...

Страница 33: ...s of an Intel J3 Strata flash takes up to 0 7 seconds If unlock is used without any parameter all sectors in the erase list with the UNLOCK option are processed To clear all lock bits of an Intel J3 Strata flash use for example BDI unlock 0xFF000000 1000 To erase or unlock multiple continuous flash sectors blocks of the same size the following Telnet commands can be used ERASE addr step count UNLO...

Страница 34: ...pped register IMM1 IMM4 Indirect memory mapped register addr The address offset or number of the register size The size 8 16 32 of the register default is 32 SWAP If present the bytes of a 16bit or 32bit register are swapped This is useful to access little endian ordered registers e g PCI bridge configuration reg isters The following entries are supported in the REGS part of the configuration file...

Страница 35: ...ddr size sp GPR 1 atbl SPR 526 atbu SPR 527 bucsr SPR 1013 csrr0 SPR 58 csrr1 SPR 59 tlb0cfg SPR 688 tlb1cfg SPR 689 tsr SPR 336 usprg0 SPR 256 xer SPR 1 Local Bus Controller br0 CCSR 0x124000 br1 CCSR 0x124008 br2 CCSR 0x124010 br3 CCSR 0x124018 fcr CCSR 0x1240E8 fbar CCSR 0x1240EC fpar CCSR 0x1240F0 fbcr CCSR 0x1240F4 Now the defined registers can be accessed by name via the Telnet interface BDI...

Страница 36: ...gger it must be connected to the remote target This can be done with the fol lowing command at the GDB prompt gdb target remote bdi3000 2001 bdi3000 This stands for an IP address The HOST file must have an appropriate entry You may also use an IP address in the form xxx xxx xxx xxx 2001 This is the TCP port used to communicate with the BDI If not already suspended this stops the execution of appli...

Страница 37: ...rver stub running on the target should also be possible The configuration parameter SIO is used to enable this serial I O routing The used framing parameters are 8 data 1 stop and not parity TARGET SIO 7 9600 Enable SIO via TCP port 7 at 9600 baud Warning Once SIO is enabled connecting with the setup tool to update the firmware will fail In this case either disable SIO first or disconnect the BDI ...

Страница 38: ... the kernel page table the second one can point to the current user page table As long as the base pointer or the first entry is zero the BDI does only L2 CAM L2 TLB1 and default translation Default translation maps a 256 Mbyte range starting at KERNELBASE to 0x00000000 The second page table is only searched if its address is not zero and there was no match in the first one The pointer structure i...

Страница 39: ...able the hardware breakpoint with the Telnet command CI If not automatically done by the kernel setup the page table pointers for the BDI Start GDB with vmlinux as parameter Attach to the target Now you should be able to debug the Linux kernel To setup the BDI page table information structure manually set a hardware breakpoint at start_kernel and use the Telnet to write the address of swapper_pg_d...

Страница 40: ...P4080 Core 0 Core state halted Debug entry cause device event Current PC 0xfffffffc Current CR 0x00000000 Current MSR 0x00000000 Current LR 0x00000000 Current CCSRBAR 0x0_fe000000 P4080 0 rd GPR00 c11bc002 06278553 80028188 aba40000 GPR04 609db195 ad1944b2 deadbeef 002883a6 GPR08 20119520 2032dc90 94110404 29038003 GPR12 9422cf8e 0c105000 613b00b0 4e0d4548 GPR16 0f15d163 3820d4a3 806b42d8 4c005402...

Страница 41: ...SR space Run Control WDCSR addr value write to a register in DCSR space Run Control DCACHE addr set display L1 data cache content ICACHE addr set display L1 inst cache content L2CACHE set display L2 cache content TLB0 from to display L2 TLB0 entry TLB1 from to display L2 TLB1 entry WTLB0 way epn rpn write to a L2 TLB0 entry WTLB1 idx epn rpn write to a L2 TLB1 entry RESET HALT RUN time reset the t...

Страница 42: ... the cores SAP accesses memory like an additional bus master If memory access CORE is selected the current core executes load store instructions in its current context In this mode MMU translation takes place unless the use of real addresses is forced For memory accesses via core the attr parameter in the Telnet MEMACC command has the fol lowing meaning default is 0 R W I M G E R 1 Real Addressing...

Страница 43: ...give reset time to complete define the core ID the x without any holes no need that core ID matches the core number A valid example is 1 CPUTYPE P4080 5 0 Core 0 parameters active vCPU after reset 0 CPUTYPE P4080 0 0 Core0 SOC0 0 STARTUP STOP 5000 let U boot setup the system 0 BREAKMODE HARD SOFT or HARD HARD uses PPC hardware breakpoint 0 STEPMODE HWBP ICMP or HWBP HWBP uses a hardware breakpoint...

Страница 44: ... Current MSR 0x00029200 Current LR 0x7ff74c38 Current CCSRBAR 0x0_fe000000 P4080 0 state Core 0 halted 0x7ff74c34 debug halt Core 1 running Core 2 running Core 3 running Core 4 running Core 5 running Core 6 running Core 7 running P4080 0 halt 0xf0 TARGET core 4 has entered debug mode TARGET core 5 has entered debug mode TARGET core 6 has entered debug mode TARGET core 7 has entered debug mode P408...

Страница 45: ...ata Bits 8 Parity Bits none Stop Bits 1 Network Interface 10 100 BASE T BDM JTAG clock up to 32 MHz Supported target voltage 1 2 5 0 V Operating Temperature 5 C 60 C Storage Temperature 20 C 65 C Relative Humidity noncondensing 90 rF Size 160 x 85 x 35 mm Weight without cables 280 g Host Cable length RS232 2 5 m Electromagnetic Compatibility CE compliant Restriction of Hazardous Substances RoHS 20...

Страница 46: ...000 QorIQ P3 P4 P5 User Manual 46 Copyright 1997 2012 by ABATRON AG Switzerland V 1 03 5 Environmental notice Disposal of the equipment must be carried out at a designated disposal site 6 Declaration of Conformity CE ...

Страница 47: ...tive storage mediums Update and Support The agreement includes free software maintenance update and support for one year from date of purchase After this period the client may purchase software maintenance for an additional year 7 3 Warranty and Disclaimer ABATRON AND ITS SUPPLIERS HEREBY DISCLAIMS AND EXCLUDES TO THE EXTENT PERMITTED BY APPLICABLE LAW ALL WARRANTIES EXPRESS OR IMPLIED INCLUDING W...

Страница 48: ...ible reasons Wrong pin assignment BDM JTAG connector of the target system see chapter 2 Target system initialization is not correctly enter an appropriate target initialization list An incorrect IP address was entered BDI3000 configuration BDM JTAG signals from the target system are not correctly short circuit break The target system is damaged Problem Network processes do not function loading the...

Страница 49: ...right 1997 2012 by ABATRON AG Switzerland V 1 03 B Maintenance The BDI needs no special maintenance Clean the housing with a mild detergent only Solvents such as gasoline may damage it C Trademarks All trademarks are property of their respective holders ...

Результаты поиска

Содержание bdiGDB QorIQ P3

Отзывы:

Похожие инструкции для bdiGDB QorIQ P3

Бренды по названию

Популярные бренды

Abatron bdiGDB QorIQ P3, Руководство пользователя

Результаты поиска

Содержание bdiGDB QorIQ P3

Отзывы:

Похожие инструкции для bdiGDB QorIQ P3

Бренды по названию

Популярные бренды