[ ]# mkdir /home/OpenOCD
[ ]# cd /home/OpenOCD
Download FT2xxx USB-UART drivers from FTDI Ltd
[ ]# wget http://www.ftdichip.com/Drivers/D2XX/Linux/libftd2xx0.4.16.tar.gz
[ ]# tar zxvf libftd2xx0.4.16.tar.gz
[ ]# cd libftd2xx0.4.16
[ ]# cp ftd2xx.h WinTypes.h /usr/include/
[ ]# cp libftd2xx.so.0.4.16 /usr/lib/libftd2xx.so.0.4.16
[ ]# ln -sf /usr/lib/libftd2xx.so.0.4.16 /usr/lib/libftd2xx.so.0.4
[ ]# ln -sf /usr/lib/libftd2xx.so.0.4.16 /usr/lib/libftd2xx.so.0
[ ]# ln -sf /usr/lib/libftd2xx.so.0.4.16 /usr/lib/libftd2xx.so
Download/Compile latest OpenOCD from GIT:
[ ]# cd /home/OpenOCD
[ ]# git clone git://openocd.git.sourceforge.net/gitroot/openocd/openocd
[ ]# cd openocd
[ ]# ./bootstrap
[ ]# ./configure --enable-maintainer-mode --enable-ft2232_ftd2xx
[ ]# make
[ ]# make install
Or Download/Compile OpenOCD 4.0 tarball
[ ]# wget http://download.berlios.de/openocd/openocd-0.4.0.tar.bz2
[ ]# tar jxvf openocd-0.4.0.tar.bz2
[ ]# cd openocd-0.4.0
[ ]# ./configure --enable-maintainer-mode --enable-ft2232_ftd2xx
[ ]# make
[ ]# make install
What OpenOCD can do for a developer
1. Read/Write register on your target
2. Read/Write memory on your target
3. Program flash chips
4. GDB
5. more...
How to use OpenOCD
Running OpenOCD on Cavium Networks CNS3000/CNW5000 Platform
[ ]# ./openocd -f openocd-cnx.cfgOpen On-Chip Debugger 0.4.0 (2011-03-22-03:04)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.berlios.de/doc/doxygen/bugs.html
6000 kHz
trst_and_srst separate srst_gates_jtag trst_push_pull srst_open_drain
jtag_ntrst_delay: 100
jtag_nsrst_delay: 100
Info : device: 4 "2232C"
Info : deviceID: 341266712
Info : SerialNumber:
Info : Description: USB<=>JTAG&RS232 A
Info : clock speed 6000 kHz
Info : JTAG tap: arm11.cpu tap/device found: 0x07b37477 (mfg: 0x23b, part: 0x7b37, ver: 0x0)
Info : JTAG tap: arm11.cpu tap/device found: 0x07b37477 (mfg: 0x23b, part: 0x7b37, ver: 0x0)
Warn : JTAG tap: arm11.cpu UNEXPECTED: 0x07b37477 (mfg: 0x23b, part: 0x7b37, ver: 0x0)
Error: JTAG tap: arm11.cpu expected 1 of 1: 0xffffffff (mfg: 0x7ff, part: 0xffff, ver: 0xf)
Error: Trying to use configured scan chain anyway...
Warn : Bypassing JTAG setup events due to errors
Info : found ARM11 MPCore
Info : arm11.cpu: hardware has 6 breakpoints, 2 watchpoints
Info : accepting 'telnet' connection from 0
Recover u-boot
[ ]# telnet localhost 4444
> halt
target state: halted
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x600001d3 pc: 0x000146c4
> flash probe 0
Flash Manufacturer/Device: 0x0001 0x227e
configuration specifies 0x800000 size, but a 0x1000000 size flash was found
flash 'cfi' found at 0x10000000
> flash list
{name cfi base 268435456 size 8388608 bus_width 2 chip_width 2}
> flash info 0
#0 : cfi at 0x10000000, size 0x00800000, buswidth 2, chipwidth 2
# 0: 0x00000000 (0x20000 128kB) protection state unknown
# 1: 0x00020000 (0x20000 128kB) protection state unknown
# 2: 0x00040000 (0x20000 128kB) protection state unknown
. . .
#125: 0x00fa0000 (0x20000 128kB) protection state unknown
#126: 0x00fc0000 (0x20000 128kB) protection state unknown
#127: 0x00fe0000 (0x20000 128kB) protection state unknown
cfi information:
mfr: 0x0001, id:0x227e
qry: 'QRY', pri_id: 0x0002, pri_addr: 0x0040, alt_id: 0x0000, alt_addr: 0x0000
Vcc min: 2.7, Vcc max: 3.6, Vpp min: 0.0, Vpp max: 0.0
typ. word write timeout: 64, typ. buf write timeout: 64, typ. block erase timeout: 512, typ. chip erase timeout: 524288
max. word write timeout: 512, max. buf write timeout: 2048, max. block erase timeout: 4096, max. chip erase timeout: 2097152
size: 0x1000000, interface desc: 2, max buffer write size: 40
Spansion primary algorithm extend information:
pri: 'PRI', version: 1.3
Silicon Rev.: 0x5, Address Sensitive unlock: 0x0
Erase Suspend: 0x2, Sector Protect: 0x1
VppMin: 11.5, VppMax: 12.5
> flash erase_address 0x10000000 0x40000
erased address 0x10000000 (length 262144) in 1.737926s (147.302 kb/s)
> flash write_bank 0 /tftpboot/u-boot.bin 0
No working memory available. Specify -work-area-phys to target.
Programming at 10000000, count 000295d8 bytes remaining
Programming at 10000100, count 000294d8 bytes remaining
. . .
Programming at 10029300, count 000002d8 bytes remaining
Programming at 10029400, count 000001d8 bytes remaining
Programming at 10029500, count 000000d8 bytes remaining
wrote 169432 bytes from file /tftpboot/u-boot.bin to flash bank 0 at offset 0x00000000 in 810.315613s (0.204 kb/s)
> reset
> halt
> arm disassemble 0x10000000
core state: ARM
0x00989680 0xfdfefbfd LDC2L p11, c15, [r14, #244]!
0x10000000 0xea000013 B 0x10000054
0x10000004 0xe59ff014 LDR r15, [r15, #0x14]
0x10000008 0xe59ff014 LDR r15, [r15, #0x14]
0x10000000 0xea000013 B 0x10000054
0x10000004 0xe59ff014 LDR r15, [r15, #0x14]
0x10000008 0xe59ff014 LDR r15, [r15, #0x14]
0x1000000c 0xe59ff014 LDR r15, [r15, #0x14]
0x10000010 0xe59ff014 LDR r15, [r15, #0x14]
0x10000014 0xe59ff014 LDR r15, [r15, #0x14]
0x10000018 0xe59ff014 LDR r15, [r15, #0x14]
0x1000001c 0xe59ff014 LDR r15, [r15, #0x14]
0x10000020 0x00000120 ANDEQ r0, r0, r0, LSR #0x2
0x10000024 0x00000180 ANDEQ r0, r0, r0, LSL #0x3
0x10000028 0x000001e0 ANDEQ r0, r0, r0, ROR #0x3
0x1000002c 0x00000240 ANDEQ r0, r0, r0, ASR #0x4
0x10000030 0x000002a0 ANDEQ r0, r0, r0, LSR #0x5
0x10000034 0x00000300 ANDEQ r0, r0, r0, LSL #0x6
0x10000038 0x00000360 ANDEQ r0, r0, r0, ROR #0x6
0x1000003c 0xdeadbeef CDPLE p14, 0x0a, c11, c13, c15, 0x07
0x10000040 0x00000000 ANDEQ r0, r0, r0
0x10000044 0x00000000 ANDEQ r0, r0, r0
0x10000048 0x08000000 STMDAEQ r0, i??i??i}
0x1000004c 0x000295d8 LDREQD r9, [r2], -r8
0x10000050 0x00071600 ANDEQ r1, r7, r0, LSL #0xc
0x10000054 0xe10f0000 MRS r0, CPSR
0x10000058 0xe3c0001f BIC r0, r0, #0x1f
0x1000005c 0xe38000d3 ORR r0, r0, #0xd3
...
Here is what I used to try -- [$800 NT, $30 USD]
OpenJTAG ARM JTAG USB
[ ]# ./configure --enable-jlink --enable-maintainer-mode
[ ]# make
[ ]# ./src/openocd -f openocd-cnx-jlink.cfg
Reference:
http://psas.pdx.edu/OlimexLPC2148Setup
http://scottshulinux.blogspot.com/2008/12/jtag-cable.html
http://scottshulinux.blogspot.com/2008/10/open-on-chip-debugger.html
TargetName Type Endian TapName State
-- ------------------ ---------- ------ ------------------ ------------
0* arm11.cpu arm11 little arm11.cpu halted
Recover u-boot
[ ]# telnet localhost 4444
> halt
target state: halted
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x600001d3 pc: 0x000146c4
> flash probe 0
Flash Manufacturer/Device: 0x0001 0x227e
configuration specifies 0x800000 size, but a 0x1000000 size flash was found
flash 'cfi' found at 0x10000000
> flash list
{name cfi base 268435456 size 8388608 bus_width 2 chip_width 2}
> flash info 0
#0 : cfi at 0x10000000, size 0x00800000, buswidth 2, chipwidth 2
# 0: 0x00000000 (0x20000 128kB) protection state unknown
# 1: 0x00020000 (0x20000 128kB) protection state unknown
# 2: 0x00040000 (0x20000 128kB) protection state unknown
. . .
#125: 0x00fa0000 (0x20000 128kB) protection state unknown
#126: 0x00fc0000 (0x20000 128kB) protection state unknown
#127: 0x00fe0000 (0x20000 128kB) protection state unknown
cfi information:
mfr: 0x0001, id:0x227e
qry: 'QRY', pri_id: 0x0002, pri_addr: 0x0040, alt_id: 0x0000, alt_addr: 0x0000
Vcc min: 2.7, Vcc max: 3.6, Vpp min: 0.0, Vpp max: 0.0
typ. word write timeout: 64, typ. buf write timeout: 64, typ. block erase timeout: 512, typ. chip erase timeout: 524288
max. word write timeout: 512, max. buf write timeout: 2048, max. block erase timeout: 4096, max. chip erase timeout: 2097152
size: 0x1000000, interface desc: 2, max buffer write size: 40
Spansion primary algorithm extend information:
pri: 'PRI', version: 1.3
Silicon Rev.: 0x5, Address Sensitive unlock: 0x0
Erase Suspend: 0x2, Sector Protect: 0x1
VppMin: 11.5, VppMax: 12.5
> flash erase_address 0x10000000 0x40000
erased address 0x10000000 (length 262144) in 1.737926s (147.302 kb/s)
> flash write_bank 0 /tftpboot/u-boot.bin 0
No working memory available. Specify -work-area-phys to target.
Programming at 10000000, count 000295d8 bytes remaining
Programming at 10000100, count 000294d8 bytes remaining
. . .
Programming at 10029300, count 000002d8 bytes remaining
Programming at 10029400, count 000001d8 bytes remaining
Programming at 10029500, count 000000d8 bytes remaining
wrote 169432 bytes from file /tftpboot/u-boot.bin to flash bank 0 at offset 0x00000000 in 810.315613s (0.204 kb/s)
> reset
Disassemble u-boot
[ ]# telnet localhost 4444> halt
> arm disassemble 0x10000000
core state: ARM
0x00989680 0xfdfefbfd LDC2L p11, c15, [r14, #244]!
0x10000000 0xea000013 B 0x10000054
0x10000004 0xe59ff014 LDR r15, [r15, #0x14]
0x10000008 0xe59ff014 LDR r15, [r15, #0x14]
0x10000000 0xea000013 B 0x10000054
0x10000004 0xe59ff014 LDR r15, [r15, #0x14]
0x10000008 0xe59ff014 LDR r15, [r15, #0x14]
0x1000000c 0xe59ff014 LDR r15, [r15, #0x14]
0x10000010 0xe59ff014 LDR r15, [r15, #0x14]
0x10000014 0xe59ff014 LDR r15, [r15, #0x14]
0x10000018 0xe59ff014 LDR r15, [r15, #0x14]
0x1000001c 0xe59ff014 LDR r15, [r15, #0x14]
0x10000020 0x00000120 ANDEQ r0, r0, r0, LSR #0x2
0x10000024 0x00000180 ANDEQ r0, r0, r0, LSL #0x3
0x10000028 0x000001e0 ANDEQ r0, r0, r0, ROR #0x3
0x1000002c 0x00000240 ANDEQ r0, r0, r0, ASR #0x4
0x10000030 0x000002a0 ANDEQ r0, r0, r0, LSR #0x5
0x10000034 0x00000300 ANDEQ r0, r0, r0, LSL #0x6
0x10000038 0x00000360 ANDEQ r0, r0, r0, ROR #0x6
0x1000003c 0xdeadbeef CDPLE p14, 0x0a, c11, c13, c15, 0x07
0x10000040 0x00000000 ANDEQ r0, r0, r0
0x10000044 0x00000000 ANDEQ r0, r0, r0
0x10000048 0x08000000 STMDAEQ r0, i??i??i}
0x1000004c 0x000295d8 LDREQD r9, [r2], -r8
0x10000050 0x00071600 ANDEQ r1, r7, r0, LSL #0xc
0x10000054 0xe10f0000 MRS r0, CPSR
0x10000058 0xe3c0001f BIC r0, r0, #0x1f
0x1000005c 0xe38000d3 ORR r0, r0, #0xd3
...
Here is what I used to try -- [$800 NT, $30 USD]
OpenJTAG ARM JTAG USB
The man page for ARM11 CPU
(Download)[ ]# ./configure --enable-jlink --enable-maintainer-mode
[ ]# make
[ ]# ./src/openocd -f openocd-cnx-jlink.cfg
Open On-Chip Debugger 0.4.0 (2011-03-28-18:03)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.berlios.de/doc/doxygen/bugs.html
10000 kHz
trst_and_srst separate srst_gates_jtag trst_push_pull srst_open_drain
jtag_ntrst_delay: 100
jtag_nsrst_delay: 100
Info : J-Link initialization started / target CPU reset initiated
Info : J-Link ARM V7 compiled Jun 30 2009 11:05:27
Info : JLink caps 0xb9ff7bbf
Info : JLink hw version 70000
Info : JLink max mem block 9152
Info : Vref = 3.293 TCK = 1 TDI = 0 TDO = 0 TMS = 0 SRST = 0 TRST = 0
Info : J-Link JTAG Interface ready
Info : clock speed 10000 kHz
Info : JTAG tap: arm11.cpu tap/device found: 0x07b37477 (mfg: 0x23b, part: 0x7b37, ver: 0x0)
Info : JTAG tap: arm11.cpu tap/device found: 0x07b37477 (mfg: 0x23b, part: 0x7b37, ver: 0x0)
Info : found ARM11 MPCore
Info : arm11.cpu: hardware has 6 breakpoints, 2 watchpoints
Info : accepting 'telnet' connection from 0
Reference:
http://psas.pdx.edu/OlimexLPC2148Setup
http://scottshulinux.blogspot.com/2008/12/jtag-cable.html
http://scottshulinux.blogspot.com/2008/10/open-on-chip-debugger.html
No comments:
Post a Comment