TEXT 37
Arm.txt Guest on 10th February 2021 12:41:09 AM
  1. ARM microcontroller development
  2.  
  3. Some notes about developing software for ARM microcontrollers on
  4. linux, more specifically:
  5.  
  6.      - Atmel AT91SAM7 (ARM7TDMI)
  7.      - OpenOCD
  8.      - Olimex ARM-USB-OCD
  9.  
  10.  
  11.  
  12. Entry: ARM JTAG
  13. Date: Thu Aug 19 17:50:41 CEST 2010
  14.  
  15. With my recent experience using gdb + gdbserver on an Atmel AT91SAM7
  16. using a closed Segger JLink[4] interface I'm wondering what tools I
  17. should get to be able to use all full open source chain.
  18.  
  19. 1. How to get my ET-ARM STAMP LPC2110[1] board to work with JTAG?
  20.    I.e. how does the plugin board[2] connect to the stamp board?
  21.  
  22. 2. What JTAG interface to use to get maximum support from OpenOCD[3]?
  23.    What are the different JTAG features some have and some don't?  How
  24.    do all the pieces fit together? (uC JTAG + gdbserver).
  25.  
  26.    Olimex[5] has several.
  27.  
  28. 3. Can this work on a DIP-package small uC?  Probably not PIC as it
  29.    has an incompatible proprietary debugging interface (one reason to
  30.    stop using it..), but maybe AVR?  I can only find AVR32 links..
  31.    Does AVR8 have JTAG actually[6]?
  32.  
  33.  
  34. First I wonder, is there a natural way to map a 2-way serial byte
  35. stream to a JTAG stream?  JTAG is SPI, right?
  36.  
  37. Then: is there any monitor code running on the target to support
  38. JTAG/gdbserver functionality that is not implemented in hardware?
  39.  
  40. Ok, the basic idea as explained in Dominic Rath's thesis[8].  
  41.  
  42.   On-chip debugging allows external control over the uC as opposed to
  43.   sub-based debugging which would use a monitor and some kind of
  44.   interrupt mechanis, i.e. a serial port.
  45.  
  46.   ARM7 and ARM9 have halt mode debugging, where the core is completely
  47.   stopped.  Both cores support 2 comparators that allow to break on
  48.   instruction fetches or data access.
  49.  
  50. Disadvantage of stub-based programming for flash uC is setting of
  51. breakpoints (as opposed to code in RAM).  HW debug can set hardware
  52. breakpoints.
  53.  
  54.  
  55.  
  56. [1] http://www.futurlec.com/ET-ARM_Stamp.shtml
  57. [2] http://www.futurlec.com/ET-ARM_Stamp_Board.shtml
  58. [3] http://openocd.berlios.de/web/
  59. [4] http://www.segger.com/cms/jlink.html
  60. [5] http://olimex.com/dev/index.html
  61. [6] http://www.scienceprog.com/build-your-own-avr-jtagice-clone/
  62. [7] http://sourceforge.net/apps/mediawiki/urjtag/index.php?title=Main_Page
  63. [8] http://openocd.berlios.de/thesis.pdf
  64.  
  65.  
  66. Entry: JTAG for LPC2119
  67. Date: Fri Aug 20 16:59:45 CEST 2010
  68.  
  69. dir signal pin port
  70. --------------------
  71. <-  TRST   20  1.31
  72. <-  TMS    52  1.30
  73. <-  TCK    56  1.29
  74. <-  TDI    60  1.28
  75. ->  TDO    64  1.27
  76. ->  RTCK   24  1.26
  77.  
  78.  
  79.  
  80.  
  81. Entry: OpenOCD on Olimex ARM-USB-OCD
  82. Date: Wed Sep 15 14:47:30 CEST 2010
  83.  
  84. # Starting with "apt-get install openocd" I get openocd which seems to
  85. # support the FT2232 (see openocd -c interface_list).
  86.  
  87. # Scripts are relative to /usr/share/openocd/ in my install.
  88.  
  89. # This also seems to have config support for an the Olimex SAM7-EX256
  90. # board[3].  scripts/board/olimex_sam7_ex256.cfg
  91.  
  92. # The script only sources this script:
  93. scripts/target/sam7x256.cfg
  94.  
  95. # I have the SAM7-H256 board[2] connected, so it should just work.
  96.  
  97. # For the programmer Olimex ARM-USB-OCD it seems these scripts are used:
  98. scripts/interface/olimex-arm-usb-ocd-h.cfg
  99. scripts/interface/olimex-arm-usb-ocd.cfg
  100.  
  101. # To use these scripts (had to use sudo -> need to fix perms).
  102.  
  103. $ cd /usr/share/openocd/scripts
  104. $ openocd --file interface/arm-usb-ocd.cfg  --file target/sam7x256.cfg
  105. Open On-Chip Debugger 0.4.0 (2010-02-23-16:59)
  106. Licensed under GNU GPL v2
  107. For bug reports, read
  108.       http://openocd.berlios.de/doc/doxygen/bugs.html
  109. srst_only srst_pulls_trst srst_gates_jtag srst_open_drain
  110. Info : clock speed 6000 kHz
  111. Info : JTAG tap: sam7x256.cpu tap/device found: 0x3f0f0f0f (mfg: 0x787, part: 0xf0f0, ver: 0x3)
  112. Info : Embedded ICE version 1
  113. Info : sam7x256.cpu: hardware has 2 breakpoint/watchpoint units
  114.  
  115.  
  116. # The default port is 3333.
  117.  
  118. $ arm-eabi-gdb
  119. (gdb) target remote localhost:3333
  120. Remote debugging using localhost:3333
  121. 0x00000000 in ?? ()
  122.  
  123. # Now the `monitor' command can be used.
  124. (gdb) monitor help
  125. # for output see [4]
  126.  
  127. # Trying to upload the code gives this:
  128.  
  129. (gdb) load
  130. Loading section .text, size 0x14595 lma 0x1000000
  131. Load failed
  132.  
  133. # The OpenOCD output gives:
  134. Warn : memory write caused data abort (address: 0x01000000, size: 0x4, count: 0xf24)
  135.  
  136. # It seems to be writing to Flash as if it were RAM.  My guess is that
  137. # gdb also needs to be told where things are.
  138.  
  139. # The gdbinitscript I have for the Segger JTAG / gdbserver just talks
  140. # to the monitor (gdbserver) giving it some non-standard commands to
  141. # enable flash writing.
  142.  
  143. (gdb) monitor flash list
  144. {name at91sam7 base 1048576 size 262144 bus_width 4 chip_width 0}
  145. (gdb) monitor flash banks
  146. #0: at91sam7 at 0x00100000, size 0x00040000, buswidth 4, chipwidth 0
  147.  
  148. # Ah, maybe it's protected memory?
  149.  
  150. (gdb) monitor flash info 0
  151. #0 : at91sam7 at 0x00100000, size 0x00040000, buswidth 4, chipwidth 0
  152.       #  0: 0x00000000 (0x4000 16kB) protected
  153.       #  1: 0x00004000 (0x4000 16kB) protected
  154.       #  2: 0x00008000 (0x4000 16kB) not protected
  155.       #  3: 0x0000c000 (0x4000 16kB) not protected
  156.       #  4: 0x00010000 (0x4000 16kB) not protected
  157.       #  5: 0x00014000 (0x4000 16kB) not protected
  158.       #  6: 0x00018000 (0x4000 16kB) not protected
  159.       #  7: 0x0001c000 (0x4000 16kB) not protected
  160.       #  8: 0x00020000 (0x4000 16kB) not protected
  161.       #  9: 0x00024000 (0x4000 16kB) not protected
  162.       # 10: 0x00028000 (0x4000 16kB) not protected
  163.       # 11: 0x0002c000 (0x4000 16kB) not protected
  164.       # 12: 0x00030000 (0x4000 16kB) not protected
  165.       # 13: 0x00034000 (0x4000 16kB) not protected
  166.       # 14: 0x00038000 (0x4000 16kB) not protected
  167.       # 15: 0x0003c000 (0x4000 16kB) not protected
  168.  
  169.  at91sam7 driver information: Chip is AT91SAM7S256
  170.  Cidr: 0x270b0941 | Arch: 0x0070 | Eproc: ARM7TDMI | Version: 0x001 | Flashsize: 0x00040000
  171.  Master clock (estimated): 48054 KHz | External clock: 18432 KHz
  172.  Pagesize: 256 bytes | Lockbits(16): 2 0x0003 | Pages in lock region: 128
  173.  Securitybit: 0 | Nvmbits(2): 0 0x0
  174.  
  175.  
  176. # Switching off protection of the first two sectors:
  177.  
  178. (gdb) mon flash protect 0 0 1 off
  179. cleared protection for sectors 0 through 1 on flash bank 0
  180.  
  181. # Something fishy..  The "flash info 0" command says the flash is at
  182. # 0x00100000, while I'm trying to load it at 0x01000000?
  183.  
  184. # Do the SAM7S256 and SAM7S512 use different memory maps? No.
  185.  
  186. # Why is lma set to 0x01000000?  The error message also says that's
  187. # the address with a write error.
  188.  
  189. # OK, that was stupid.  It was a linux/i386 elf.  Fixing that:
  190.  
  191. (gdb) load
  192. Loading section .rom_vectors, size 0x40 lma 0x100000
  193. Loading section .text, size 0x1805c lma 0x100040
  194. Loading section .rodata, size 0x2084 lma 0x11809c
  195. Loading section .got, size 0x23c lma 0x11a120
  196. Loading section .data, size 0xcec lma 0x11a35c
  197. Start address 0x100040, load size 110664
  198. Transfer rate: 5 KB/sec, 10060 bytes/write.
  199. (gdb)
  200.  
  201.  
  202. # Then stepping through the code works, and is quite fast too.
  203. # Breakpoints work up to 2.  My original app code for SAM7X512 does
  204. # eventuall hang on the SAM7X256.  It freezes somewhere in HAL config.
  205.  
  206. # Let's see if upload speed can be set a bit higher.  It doesn't seem
  207. # to be the JTAG speed (at 6MHz).  Something else causes only 5Kb/sec
  208. # transfer rate.  Seems I'm not the only one with the problem[5] on
  209. # this hardware.
  210.  
  211. # Using fast memory access (slow is potentially safer?) it does seem
  212. # to work a bit faster: 5 -> 9 kB/sec.
  213.  
  214. (gdb) monitor arm7_9 fast_memory_access enable
  215.  
  216.  
  217. [1] http://www.openhardware.net/Embedded_ARM/OpenOCD_JTAG/
  218. [2] http://www.olimex.com/dev/sam7-h256.html
  219. [3] http://www.olimex.com/dev/sam7-ex256.html
  220. [4] entry://20100915-174237
  221. [5] https://lists.berlios.de/pipermail/openocd-development/2010-July/015961.html
  222.  
  223.  
  224. Entry: monitor help
  225. Date: Wed Sep 15 17:42:37 CEST 2010
  226.  
  227.  
  228.  
  229. add_help_text command_name helptext_string
  230.       Add new command help text; Command can be multiple tokens. (command
  231.       valid any time)
  232. add_usage_text command_name usage_string
  233.       Add new command usage text; command can be multiple tokens. (command
  234.       valid any time)
  235. arm
  236.       ARM command group (command valid any time)
  237.   arm core_state ['arm'|'thumb']
  238.         display/change ARM core state
  239.   arm disassemble address [count ['thumb']]
  240.         disassemble instructions
  241.   arm mcr cpnum op1 CRn op2 CRm value
  242.         write coprocessor register
  243.   arm mrc cpnum op1 CRn op2 CRm
  244.         read coprocessor register
  245.   arm reg
  246.         display ARM core registers
  247. arm7_9
  248.       arm7/9 specific commands (command valid any time)
  249.   arm7_9 dbgrq ['enable'|'disable']
  250.         use EmbeddedICE dbgrq instead of breakpoint for target halt
  251.         requests (command valid any time)
  252.   arm7_9 dcc_downloads ['enable'|'disable']
  253.         use DCC downloads for larger memory writes (command valid any time)
  254.   arm7_9 fast_memory_access ['enable'|'disable']
  255.         use fast memory accesses instead of slower but potentially safer
  256.         accesses (command valid any time)
  257.   arm7_9 semihosting ['enable'|'disable']
  258.         activate support for semihosting operations
  259. at91sam7
  260.       at91sam7 flash command group (command valid any time)
  261.   at91sam7 gpnvm bitnum ('set'|'clear')
  262.         set or clear one General Purpose Non-Volatile Memory (gpnvm) bit
  263. bp [address length ['hw']]
  264.       list or set hardware or software breakpoint
  265. command
  266.       core command group (introspection) (command valid any time)
  267.   command mode [command_name ...]
  268.         Returns the command modes allowed by a  command:'any', 'config', or
  269.         'exec'.  If no command isspecified, returns the current command
  270.         mode.  Returns 'unknown' if an unknown command is given. Command
  271.         can be multiple tokens. (command valid any time)
  272.   command type command_name [...]
  273.         Returns the type of built-in command:'native', 'simple', 'group',
  274.         or 'unknown'. Command can be multiple tokens. (command valid any
  275.         time)
  276. debug_level number
  277.       Sets the verbosity level of debugging output. 0 shows errors only; 1
  278.       adds warnings; 2 (default) adds other info; 3 adds debugging.
  279.       (command valid any time)
  280. drscan tap_name [num_bits value]* ['-endstate' state_name]
  281.       Execute Data Register (DR) scan for one TAP.  Other TAPs must be in
  282.       BYPASS mode.
  283. dump_image filename address size
  284. etm
  285.       Emebdded Trace Macrocell command group (command valid any time)
  286. exit
  287.       exit telnet session
  288. fast_load
  289.       loads active fast load image to current target - mainly for profiling
  290.       purposes
  291. fast_load_image filename address ['bin'|'ihex'|'elf'|'s19'] [min_address [max_length]]
  292.       Load image into server memory for later use by fast_load; primarily
  293.       for profiling (command valid any time)
  294. find <file>
  295.       print full path to file according to OpenOCD search rules (command
  296.       valid any time)
  297. flash
  298.       NOR flash command group (command valid any time)
  299.   flash banks
  300.         Display table with information about flash banks. (command valid
  301.         any time)
  302.   flash erase_address ['pad'] address length
  303.         Erase flash sectors starting at address and continuing for length
  304.         bytes.  If 'pad' is specified, data outside that range may also be
  305.         erased: the start address may be decreased, and length increased,
  306.         so that all of the first and last sectors are erased.
  307.   flash erase_check bank_id
  308.         Check erase state of all blocks in a flash bank.
  309.   flash erase_sector bank_id first_sector_num last_sector_num
  310.         Erase a range of sectors in a flash bank.
  311.   flash fillb address value n
  312.         Fill n bytes with 8-bit value, starting at word address.  (No
  313.         autoerase.)
  314.   flash fillh address value n
  315.         Fill n halfwords with 16-bit value, starting at word address.  (No
  316.         autoerase.)
  317.   flash fillw address value n
  318.         Fill n words with 32-bit value, starting at word address.  (No
  319.         autoerase.)
  320.   flash info bank_id
  321.         Print information about a flash bank.
  322.   flash list
  323.         Returns a list of details about the flash banks. (command valid any
  324.         time)
  325.   flash probe bank_id
  326.         Identify a flash bank.
  327.   flash protect bank_id first_sector [last_sector|'last'] ('on'|'off')
  328.         Turn protection on or off for a range of sectors in a given flash
  329.         bank.
  330.   flash protect_check bank_id
  331.         Check protection state of all blocks in a flash bank.
  332.   flash write_bank bank_id filename offset
  333.         Write binary data from file to flash bank, starting at specified
  334.         byte offset from the beginning of the bank.
  335.   flash write_image [erase] [unlock] filename [offset [file_type]]
  336.         Write an image to flash.  Optionally first unprotect and/or erase
  337.         the region to be used.  Allow optional offset from beginning of
  338.         bank (defaults to zero)
  339. flush_count
  340.       Returns the number of times the JTAG queue has been flushed.
  341. gdb_breakpoint_override ('hard'|'soft'|'disable')
  342.       Display or specify type of breakpoint to be used by gdb 'break'
  343.       commands. (command valid any time)
  344. gdb_port [port_num]
  345.       Display or specify base port on which to listen for incoming GDB
  346.       connections.  No arguments reports GDB port; zero disables. (command
  347.       valid any time)
  348. gdb_sync
  349.       next stepi will return immediately allowing GDB to fetch register
  350.       state without affecting target state (command valid any time)
  351. halt [milliseconds]
  352.       request target to halt, then wait up to the specifiednumber of
  353.       milliseconds (default 5) for it to complete
  354. help [command_name]
  355.       Show full command help; command can be multiple tokens. (command
  356.       valid any time)
  357. init
  358.       Initializes configured targets and servers.  Changes command mode
  359.       from CONFIG to EXEC.  Unless 'noinit' is called, this command is
  360.       called automatically at the end of startup. (command valid any time)
  361. interface_list
  362.       List all built-in interfaces (command valid any time)
  363. irscan [tap_name instruction]* ['-endstate' state_name]
  364.       Execute Instruction Register (DR) scan.  The specified opcodes are
  365.       put into each TAP's IR, and other TAPs are put in BYPASS.
  366. jtag
  367.       perform jtag tap actions (command valid any time)
  368.   jtag arp_init
  369.         Validates JTAG scan chain against the list of declared TAPs using
  370.         just the four standard JTAG signals. (command valid any time)
  371.   jtag arp_init-reset
  372.         Uses TRST and SRST to try resetting everything on the JTAG scan
  373.         chain, then performs 'jtag arp_init'. (command valid any time)
  374.   jtag cget tap_name '-event' event_name
  375.         Return any Tcl handler for the specified TAP event.
  376.   jtag configure tap_name '-event' event_name handler
  377.         Provide a Tcl handler for the specified TAP event.
  378.   jtag drscan tap_name [num_bits value]* ['-endstate' state_name]
  379.         Execute Data Register (DR) scan for one TAP.  Other TAPs must be in
  380.         BYPASS mode.
  381.   jtag flush_count
  382.         Returns the number of times the JTAG queue has been flushed.
  383.   jtag init
  384.         initialize jtag scan chain (command valid any time)
  385.   jtag interface
  386.         Returns the name of the currently selected interface. (command
  387.         valid any time)
  388.   jtag names
  389.         Returns list of all JTAG tap names. (command valid any time)
  390.   jtag pathmove start_state state1 [state2 [state3 ...]]
  391.         Move JTAG state machine from current state (start_state) to state1,
  392.         then state2, state3, etc.
  393.   jtag tapdisable tap_name
  394.         Try to disable the specified TAP using the 'tap-disable' TAP event.
  395.   jtag tapenable tap_name
  396.         Try to enable the specified TAP using the 'tap-enable' TAP event.
  397.   jtag tapisenabled tap_name
  398.         Returns a Tcl boolean (0/1) indicating whether the TAP is enabled
  399.         (1) or not (0).
  400. jtag_khz [khz]
  401.       With an argument, change to the specified maximum jtag speed.  Pass 0
  402.       to require adaptive clocking. With or without argument, display
  403.       current setting. (command valid any time)
  404. jtag_nsrst_assert_width [milliseconds]
  405.       delay after asserting srst in ms (command valid any time)
  406. jtag_nsrst_delay [milliseconds]
  407.       delay after deasserting srst in ms (command valid any time)
  408. jtag_ntrst_assert_width [milliseconds]
  409.       delay after asserting trst in ms (command valid any time)
  410. jtag_ntrst_delay [milliseconds]
  411.       delay after deasserting trst in ms (command valid any time)
  412. jtag_rclk [fallback_speed_khz]
  413.       With an argument, change to to use adaptive clocking if possible;
  414.       else to use the fallback speed.  With or without argument, display
  415.       current setting. (command valid any time)
  416. jtag_reset trst_active srst_active
  417.       Set reset line values.  Value '1' is active, value '0' is inactive.
  418. load_image filename address ['bin'|'ihex'|'elf'|'s19'] [min_address] [max_length]
  419. log_output file_name
  420.       redirect logging to a file (default: stderr) (command valid any time)
  421. mdb ['phys'] address [count]
  422.       display memory bytes
  423. mdh ['phys'] address [count]
  424.       display memory half-words
  425. mdw ['phys'] address [count]
  426.       display memory words
  427. mflash
  428.       mflash command group (command valid any time)
  429. mwb ['phys'] address value [count]
  430.       write memory byte
  431. mwh ['phys'] address value [count]
  432.       write memory half-word
  433. mww ['phys'] address value [count]
  434.       write memory word
  435. nand
  436.       NAND flash command group (command valid any time)
  437.   nand drivers
  438.         lists available NAND drivers (command valid any time)
  439. ocd_array2mem arrayname bitwidth address count
  440.       convert a TCL array to memory locations and write the 8/16/32 bit
  441.       values
  442. ocd_mem2array arrayname bitwidth address count
  443.       read 8/16/32 bit memory and return as a TCL array for script
  444.       processing
  445. pathmove start_state state1 [state2 [state3 ...]]
  446.       Move JTAG state machine from current state (start_state) to state1,
  447.       then state2, state3, etc.
  448. pld
  449.       programmable logic device commands (command valid any time)
  450. poll ['on'|'off']
  451.       poll target state; or reconfigure background polling
  452. power_restore
  453.       Overridable procedure run when power restore is detected. Runs 'reset
  454.       init' by default. (command valid any time)
  455. profile
  456.       profiling samples the CPU PC
  457. rbp address
  458.       remove breakpoint
  459. reg [(register_name|register_number) [value]]
  460.       display or set a register; with no arguments, displays all registers
  461.       and their values
  462. reset [run|halt|init]
  463.       Reset all targets into the specified mode.Default reset mode is run,
  464.       if not given.
  465. reset_config [none|trst_only|srst_only|trst_and_srst]
  466.           [srst_pulls_trst|trst_pulls_srst|combined|separate]
  467.           [srst_gates_jtag|srst_nogate] [trst_push_pull|trst_open_drain]
  468.           [srst_push_pull|srst_open_drain]
  469.       configure JTAG reset behavior (command valid any time)
  470. reset_nag ['enable'|'disable']
  471.       Nag after each reset about options that could have been enabled to
  472.       improve performance.  (command valid any time)
  473. resume [address]
  474.       resume target execution from current PC or address
  475. runtest num_cycles
  476.       Move to Run-Test/Idle, and issue TCK for num_cycles.
  477. rwp address
  478.       remove watchpoint
  479. sam7x256.cpu
  480.       target command group (command valid any time)
  481.   sam7x256.cpu arm
  482.         ARM command group (command valid any time)
  483.   sam7x256.cpu arm7_9
  484.         arm7/9 specific commands (command valid any time)
  485.   sam7x256.cpu arp_examine
  486.         used internally for reset processing
  487.   sam7x256.cpu arp_halt
  488.         used internally for reset processing
  489.   sam7x256.cpu arp_halt_gdb
  490.         used internally for reset processing to halt GDB
  491.   sam7x256.cpu arp_poll
  492.         used internally for reset processing
  493.   sam7x256.cpu arp_reset
  494.         used internally for reset processing
  495.   sam7x256.cpu arp_waitstate
  496.         used internally for reset processing
  497.   sam7x256.cpu array2mem arrayname bitwidth address count
  498.         Writes Tcl array of 8/16/32 bit numbers to target memory
  499.   sam7x256.cpu cget target_attribute
  500.         returns the specified target attribute (command valid any time)
  501.   sam7x256.cpu curstate
  502.         displays the current state of this target
  503.   sam7x256.cpu etm
  504.         Emebdded Trace Macrocell command group (command valid any time)
  505.   sam7x256.cpu eventlist
  506.         displays a table of events defined for this target
  507.   sam7x256.cpu invoke-event event_name
  508.         invoke handler for specified event
  509.   sam7x256.cpu mdb address [count]
  510.         Display target memory as 8-bit bytes
  511.   sam7x256.cpu mdh address [count]
  512.         Display target memory as 16-bit half-words
  513.   sam7x256.cpu mdw address [count]
  514.         Display target memory as 32-bit words
  515.   sam7x256.cpu mem2array arrayname bitwidth address count
  516.         Loads Tcl array of 8/16/32 bit numbers from target memory
  517.   sam7x256.cpu mwb address data [count]
  518.         Write byte(s) to target memory
  519.   sam7x256.cpu mwh address data [count]
  520.         Write 16-bit half-word(s) to target memory
  521.   sam7x256.cpu mww address data [count]
  522.         Write 32-bit word(s) to target memory
  523. scan_chain
  524.       print current scan chain configuration (command valid any time)
  525. script <file>
  526.       filename of OpenOCD script (tcl) to run (command valid any time)
  527. shutdown
  528.       shut the server down (command valid any time)
  529. sleep milliseconds ['busy']
  530.       Sleep for specified number of milliseconds.  "busy" will busy wait
  531.       instead (avoid this). (command valid any time)
  532. soft_reset_halt
  533.       halt the target and do a soft reset
  534. srst_deasserted
  535.       Overridable procedure run when srst deassert is detected. Runs 'reset
  536.       init' by default. (command valid any time)
  537. step [address]
  538.       step one instruction from current PC or address
  539. svf filename ['quiet']
  540.       Runs a SVF file.
  541. target_request
  542.       target request command group (command valid any time)
  543.   target_request debugmsgs ['enable'|'charmsg'|'disable']
  544.         display and/or modify reception of debug messages from target
  545. targets [target]
  546.       change current default target (one parameter) or prints table of all
  547.       targets (no parameters) (command valid any time)
  548. telnet_port [port_num]
  549.       Specify port on which to listen for incoming telnet connections.  No
  550.       arguments reports telnet port; zero disables. (command valid any
  551.       time)
  552. test_image filename [offset [type]]
  553. tms_sequence ['short'|'long']
  554.       Display or change what style TMS sequences to use for JTAG state
  555.       transitions:  short (default) or long.  Only for working around JTAG
  556.       bugs. (command valid any time)
  557. trace
  558.       trace command group
  559.   trace history ['clear'|size]
  560.         display trace history, clear history or set size
  561.   trace point ['clear'|address]
  562.         display trace points, clear list of trace points, or add new
  563.         tracepoint at address
  564. usage [command_name]
  565.       Show basic command usage; command can be multiple tokens. (command
  566.       valid any time)
  567. verify_image filename [offset [type]]
  568. verify_ircapture ['enable'|'disable']
  569.       Display or assign flag controlling whether to verify values captured
  570.       during Capture-IR. (command valid any time)
  571. verify_jtag ['enable'|'disable']
  572.       Display or assign flag controlling whether to verify values captured
  573.       during IR and DR scans. (command valid any time)
  574. version
  575.       show program version (command valid any time)
  576. virt2phys virtual_address
  577.       translate a virtual address into a physical address (command valid
  578.       any time)
  579. wait_halt [milliseconds]
  580.       wait up to the specified number of milliseconds (default 5) for a
  581.       previously requested halt
  582. wp [address length [('r'|'w'|'a') value [mask]]]
  583.       list (no params) or create watchpoints
  584. xsvf (tapname|'plain') filename ['virt2'] ['quiet']
  585.       Runs a XSVF file.  If 'virt2' is given, xruntest counts are
  586.       interpreted as TCK cycles rather than as microseconds.  Without the
  587.       'quiet' option, all comments, retries, and mismatches will be
  588.       reported.
  589.  
  590. Entry: Segger JLink OpenOCD
  591. Date: Thu Sep 16 09:59:14 CEST 2010
  592.  
  593. Seems to be Supported [1].
  594.  
  595. Actually, I need the Atmel SAM-ICE, which is restricted to Atmel
  596. devices[2][3].  The SAM-ICE is cheaper ($104 at DigiKey).  The
  597. standard J-Link is 248 Euro.
  598.  
  599. [1] https://lists.berlios.de/pipermail/openocd-development/2010-August/016312.html
  600. [2] http://www.segger.com/cms/j-link-oem-versions.html
  601. [3] http://www.atmel.com/dyn/products/tools_card.asp?tool_id=3892
  602.  
  603.  
  604. Entry: Armpit scheme on Olimex SAM7-H256
  605. Date: Sun Sep 26 22:15:15 CEST 2010
  606.  
  607. To build (see script in root dir)
  608.  
  609. arm-eabi-as -mcpu=arm7tdmi armpit_00.0225.s -o a.o
  610. arm-eabi-ld -Map bin/armpit_00.0225_SAM7_H256.map --script armpit_build_link -o a.elf a.o
  611.  
  612. To program: Use the following OpenOCD command.  Note that the offset
  613. is necessary because the elf starts at 0.  This is in contrast to the
  614. eCos elfs that start at the correct flash base address.
  615.  
  616. flash write_image erase /opt/src/armpit/a.elf 0x100000 elf                      
  617.  
  618. UPDATE: It flashes and seems to run fine, stepping in gdb.  However I
  619. do have some config wrong because I don't see any console activity on
  620. DBGU and there is no virtual serial port popping up either..
  621.  
  622.  
  623. [1] http://www.olimex.com/dev/sam7-h256.html
  624. [2] http://armpit.sourceforge.net/
  625.  
  626.  
  627.  
  628. Entry: Olimex stuff
  629. Date: Tue Sep 28 14:57:12 CEST 2010
  630.  
  631. I got some eCos app loaded and running, but I can't set breakpoints.
  632. This worked before:
  633.  
  634. Unable to set 32 bit software breakpoint at address 001001f8 - check that memory is read/writable
  635.  
  636. This seems to work:
  637.  
  638. (gdb) monitor gdb_breakpoint_override hard
  639.  
  640.  
  641.  
  642. Entry: gdbserver
  643. Date: Wed Oct 13 11:34:58 CEST 2010
  644.  
  645. I still don't have a proper way to reset the olimes ocd/at91
  646. combination such that "load, continue" will work.  
  647.  
  648. What seems to work is to:
  649.   - quit gdb, quit OpenOCD
  650.   - unplug everything (programmer + board)
  651.   - start OpenOCD, start gdb, reset, load
  652.  
  653. The following init sequence seems to work a bit:
  654.  
  655.  
  656.        target remote :3333
  657.  
  658.        monitor poll
  659.  
  660.        monitor reset init
  661.        monitor sleep 500
  662.  
  663.        ### needed for gdb 6.8 and higher
  664.        set mem inaccessible-by-default off
  665.        monitor flash probe 0
  666.  
  667.        monitor gdb_breakpoint_override hard
  668.        monitor arm7_9 dcc_downloads enable
  669.        # monitor arm7_9 fast_memory_access enable
  670.  
  671.  
  672. Some remarks:
  673.  
  674. * The target needs to be halted before you can do anyting like
  675.   uploading and setting breakpoints.
  676.  
  677. * Why doesn't the program entry point change after `load'?  On the
  678.   Segger J-Link this seems to work just fine.
  679.  
  680. * Reset seems to work, but it doesn't halt the target.  Fix: use
  681.   `soft_reset_halt'.
  682.  
  683.  
  684. // This is not initialized properly on Olimex board ??
  685. // const char bytes[] = {1,2,3,1,2,3,1,2,3,1,2,3};
  686.  
  687.  
  688.  
  689.  
  690.  
  691. Entry: OpenOCD getting started
  692. Date: Thu Nov 11 13:16:05 EST 2010
  693.  
  694. As I forget this every time:
  695.  
  696. 1. start ocd, i.e. like in [1].
  697.  
  698. 2. start gdb for arm and connect with the "target remote localhost 3333" connect.
  699.  
  700. 3. initialize the arm chip, i.e. halt + init stack.
  701.  
  702. steps 2. and 3. are best bundled in a script such as [2]
  703.  
  704. cd ~/ecos/build/demo
  705. /opt/xc/arm9/bin/arm-linux-gnu-gdb -x ~/ecos/bin/eCos.gdb demo
  706.  
  707.  
  708.  
  709. [1] http://zwizwa.be/darcs/pool/bin/ocd.SAM7-H256
  710. [2] http://zwizwa.be/darcs/ecos/bin/eCos.gdb
  711.  
  712.  
  713. Entry: More OpenOCD
  714. Date: Thu Nov 11 14:14:25 EST 2010
  715.  
  716. A minefield.  One thing is sure: target needs reset before `load', and
  717. I get different behaviour depending on the JTAG clock speed.  Set to
  718. 300kHz or less, a "halt reset" will work, higher it doesn't always.
  719.  
  720. Let's play a bit more.
  721.  
  722.  
  723. [1] http://www.mail-archive.com/[email protected]/msg13435.html
  724.  
  725.  
  726. Entry: OpenOCD current
  727. Date: Thu Nov 11 14:23:40 EST 2010
  728.  
  729. git clone git://repo.or.cz/openocd.git
  730. cd openocd
  731. ./bootstrap
  732.  
  733. Bootstrap complete. Quick start build instructions:
  734.  
  735. 1. Build Jim Tcl
  736.  
  737. git submodule init
  738. git submodule update
  739. cd jimtcl
  740. ./configure --with-jim-ext=nvp
  741. make
  742. make install
  743.  
  744. 2. Configure
  745. ./configure --enable-maintainer-mode ....
  746.  
  747.  
  748. ./configure --enable-maintainer-mode --enable-ft2232_libftdi
  749.  
  750.  
  751.  
  752. This one seems to work better.
  753.  
  754. Playing it a bit more it seems to be "mon reset init" that doesn't
  755. work properly when JTAG clock is fast.
  756.  
  757. Conclusion: it seems to work +- reliably when JTAG clock is set to a
  758. slow rate (i.e. 100-300 kHz) before "reset init" is invoked.
  759.  
  760.  
  761.  
  762. Entry: LPC2119 ET-ARM STAMP
  763. Date: Sat Jul 11 15:30:55 CEST 2009
  764.  
  765. The getting started document mentions the "LPC2000 flash utility"
  766. which can be downloaded[3] from Philips (NXP) website.  There is a
  767. linux utilities here[4][6].
  768.  
  769. Forum[5].  In order to get this to work convieniently, it's probably
  770. best to make a motherboard which is connected using a USBSERIAL 3.3V
  771. cable, and cut out the MAX3232 serial port.  Have to wait for the
  772. Futurlec order.
  773.  
  774.  
  775. [1] http://www.ett.co.th
  776. [2] http://www.ett.co.th/prod2009/ET-ARM/ET_ARM_STAMP_ADUC7024.html
  777. [3] http://www.nxp.com/files/products/standard/microcontrollers/utilities/lpc2000_flash_utility.zip
  778. [4] http://www.pjrc.com/arm/lpc2k_pgm/
  779. [5] http://tech.groups.yahoo.com/group/lpc2000/
  780. [6] http://kroy.hu/lpc2k/
  781.  
  782.  
  783.  
  784.  
  785. Entry: Setting up AT91SAM7S-EK + Olimex ARM-USB-OCD
  786. Date: Wed Feb  2 12:22:38 EST 2011
  787.  
  788. The Olimex ARM-USB-OCD has a RS232 port which can be plugged to the
  789. Atmel AT91SAM7S-EK (AT9).  It is an FTDI2232C:
  790.  
  791. Feb  2 12:26:50 zoo kernel: [4894878.109218] usb 1-4.4.4: new full speed USB device using ehci_hcd and address 35
  792. Feb  2 12:26:50 zoo kernel: [4894878.226327] usb 1-4.4.4: New USB device found, idVendor=15ba, idProduct=0003
  793. Feb  2 12:26:50 zoo kernel: [4894878.226330] usb 1-4.4.4: New USB device strings: Mfr=1, Product=2, SerialNumber=0
  794. Feb  2 12:26:50 zoo kernel: [4894878.226393] usb 1-4.4.4: Product: Olimex OpenOCD JTAG
  795. Feb  2 12:26:50 zoo kernel: [4894878.226395] usb 1-4.4.4: Manufacturer: Olimex
  796. Feb  2 12:26:50 zoo kernel: [4894878.229669] usb 1-4.4.4: Ignoring serial port reserved for JTAG
  797. Feb  2 12:26:50 zoo kernel: [4894878.232305] ftdi_sio 1-4.4.4:1.1: FTDI USB Serial Device converter detected
  798. Feb  2 12:26:50 zoo kernel: [4894878.232333] usb 1-4.4.4: Detected FT2232C
  799. Feb  2 12:26:50 zoo kernel: [4894878.232348] usb 1-4.4.4: Number of endpoints 2
  800. Feb  2 12:26:50 zoo kernel: [4894878.232350] usb 1-4.4.4: Endpoint 1 MaxPacketSize 64
  801. Feb  2 12:26:50 zoo kernel: [4894878.232352] usb 1-4.4.4: Endpoint 2 MaxPacketSize 64
  802. Feb  2 12:26:50 zoo kernel: [4894878.232355] usb 1-4.4.4: Setting MaxPacketSize 64
  803. Feb  2 12:26:50 zoo kernel: [4894878.233289] usb 1-4.4.4: FTDI USB Serial Device converter now attached to ttyUSB2
  804.  
  805.  
  806. To identify usb serial ports I have a small script[1][2] that resides
  807. in /lib/udev and tries to provide a unique name for the device.  The
  808. OCD doesn't seem to expose a serial number, so i'm generating a tty
  809. name based on the idVendor idProduct info, which then becomes
  810. /dev/tty-15ba0003 which I've linked to /dev/ttyOCD.
  811.  
  812. Out of the box, the AT91 doesn't seem to produce any serial output, at
  813. least not at 9600 baud.
  814.  
  815. Starting the OpenOCD script[3] I used for the other SAM7 board seems
  816. to work:
  817.  
  818. [email protected]:~/bin$ ./ocd.SAM7-H256
  819. #!/bin/bash
  820. cat $0
  821. SCRIPTS=/usr/local/share/openocd/scripts
  822. exec openocd \
  823.     --file $SCRIPTS/interface/arm-usb-ocd.cfg  \
  824.     --file $SCRIPTS/target/sam7x256.cfg \
  825.     --file $0.cfg \
  826. Open On-Chip Debugger 0.5.0-dev-00586-gc62fb3f (2010-11-11-14:30)
  827. Licensed under GNU GPL v2
  828. For bug reports, read
  829.       http://openocd.berlios.de/doc/doxygen/bugs.html
  830. Info : only one transport option; autoselect 'jtag'
  831. srst_only srst_pulls_trst srst_gates_jtag srst_open_drain
  832. 300 kHz
  833. dcc downloads are enabled
  834. fast memory access is enabled
  835. force hard breakpoints
  836. Info : clock speed 300 kHz
  837. Info : JTAG tap: sam7x256.cpu tap/device found: 0x3f0f0f0f (mfg: 0x787, part: 0xf0f0, ver: 0x3)
  838. Info : Embedded ICE version 1
  839. Info : sam7x256.cpu: hardware has 2 breakpoint/watchpoint units
  840. Info : JTAG tap: sam7x256.cpu tap/device found: 0x3f0f0f0f (mfg: 0x787, part: 0xf0f0, ver: 0x3)
  841. Warn : srst pulls trst - can not reset into halted mode. Issuing halt after reset.
  842. target state: halted
  843. target halted in Thumb state due to debug-request, current mode: Supervisor
  844. cpsr: 0x40000033 pc: 0x000007f4
  845.  
  846.  
  847. I spent some time in november getting the other ARM board setup after
  848. my move.  That took some time: I had to work around an issue by
  849. setting the clock slower before reset, then setting faster before
  850. load.  See [3][4].
  851.  
  852. Next: get something running on the arm board.
  853.  
  854. So I got something to run + output to the serial port (DBGU 9600
  855. baud).  However, only 2 or 3 times this worked, after that I no longer
  856. get any signal on the debug port.  Also measured on the analog scope.
  857.  
  858. I'm able to single-step code on the ARM, but breakpoints (actually I
  859. tried the "next" command) don't work reliably.
  860.  
  861. My guess is there's a bug with the OpenOCD somewhere.  Let's see if
  862. there are any config issues I should be aware of.
  863.  
  864. I've upgraded OpenOCD to git tag
  865. 75cdbff5aa93d93e414cb22d413f41fb38a076bb.  After power cylcing the
  866. board and the OCD it seems to work again.
  867.  
  868. When using just `load' and `continue' everything seems to work just
  869. fine.  Using `reset' (see eCos.gdb) messes things up for good.
  870.  
  871.  
  872. [1] http://zwizwa.be/darcs/pool/bin/ttyUSB_id
  873. [2] entry://../pool/20101231-230904
  874. [3] entry://20101111-142340
  875. [4] http://zwizwa.be/darcs/ecos/bin/eCos.gdb
  876.  
  877.  
  878.  
  879.  
  880. Entry: AT91SAM7 devices
  881. Date: Mon Feb  7 14:08:57 EST 2011
  882.  
  883. SAM7S : 64 pins   http://www.atmel.com/dyn/products/devices.asp?category_id=163&family_id=605&subfamily_id=1586&source=left_nav
  884. SAM7X : 100 pins  http://www.atmel.com/dyn/products/devices.asp?category_id=163&family_id=605&subfamily_id=1724&source=left_nav
  885.  
  886.           Flash     RAM
  887. -------------------------          
  888. SAM7S256  256K      64K
  889. SAM7S512  512K      64K
  890.  
  891. SAM7X256  256K      64K
  892. SAM7X512  512K     128K
  893.      
  894.  
  895.  
  896. Entry: AT91SAM7-EK expansion header
  897. Date: Tue Feb  8 09:12:16 EST 2011
  898.  
  899. To what does the numbering on the expansion header correspond?  There
  900. are numbers 0-31 and AD4-AD7.  Looking at the data sheet these are
  901. probably the PA PIO numbers not package pin numbers.
  902.  
  903. That seems to be corrected.  AD4-AD7 are dedicated pins while AD0-AD3
  904. are mapped to PA17-PA20.
  905.  
  906. For SPI there is:
  907.  
  908.       perA  perB
  909. ------------------
  910. PA11  NPCS0 PWM0
  911. PA12  MISO  PWM1
  912. PA13  MOSI  PWM2
  913. PA14  SPCK  PWM3
  914.  
  915.  
  916.  
  917.  
  918. Entry: OpenOCD slow?
  919. Date: Sat Feb 12 12:12:08 EST 2011
  920.  
  921. I get 8kb/sec transfer when I upload the image.  The reason is
  922. probably the Flash write speed, as other JTAG tranfers go very fast.
  923.  
  924.  
  925. Entry: More robust OCD : USB replug
  926. Date: Sun Feb 13 13:14:56 EST 2011
  927.  
  928. Error: ftdi_write_data: usb bulk write failed
  929. Error: couldn't write MPSSE commands to FT2232
  930. Polling target failed, GDB will be halted. Polling again in 6300ms
  931.  
  932. Can we work around that?
  933.  
  934. Also for serial connectors, I see that minicom can detect an unplugged
  935. cable and will reconnect properly.
  936.  
  937.  
  938.  
  939.  
  940. Entry: OpenOCD problems target replug
  941. Date: Tue Feb 15 09:07:12 EST 2011
  942.  
  943. When disconnecting the target I get this:
  944.  
  945. Error: Target not halted
  946. Error: auto_probe failed
  947. Error: Connect failed. Consider setting up a gdb-attach event for the target to prepare target for GDB connect, or use 'gdb_memory_map disable'.
  948. Error: attempted 'gdb' connection rejected
  949.  
  950. Restarting OOCD helps.
  951.  
  952.  
  953. Entry: OpenOCD hardware breakpoing issues
  954. Date: Tue Feb 15 12:26:21 EST 2011
  955.  
  956. Another issue: sometimes gdb seems to loose the pedals when it won't
  957. issue `thbreak' or `next' correctly.  Maybe the hardware breakpoint
  958. management gets messed up?
  959.  
  960. Error: could not add breakpoint
  961.  
  962. Is there a way to list the hardware breakpoints?  Yes:
  963.  
  964.   mon bp
  965.  
  966. That doesn't seem to list anything though.  I get the following error
  967. message:
  968.  
  969. Error: address + size wrapped(0xfffffffe, 0x00000004)
  970.  
  971. To list the gdb-known breakpoints:
  972.  
  973. (gdb) info breakpoints
  974. Num     Type           Disp Enb Address    What
  975. 7       hw breakpoint  del  y   0x00101498 in demo at /home/tom/ubidata-tom/src/spi/spi.c:339
  976.  
  977.  
  978. Something's not right.  Exiting OCD does solve the problem.
  979.  
  980. It seems that the "reset" command doesn't really perform a full reset.
  981. Is there a way to reset everything, just as it would be done at init?
  982.  
  983. My current workaround is to use a "while sleep 1; do ... ; done" loop
  984. around oocd, and invoke "mon shutdown" from gdb, followed by a
  985. reconnect.
  986.  
  987.  
  988.  
  989.  
  990.  
  991. Entry: ocd over network problem
  992. Date: Wed Mar 23 13:14:54 EDT 2011
  993.  
  994. On localhost works fine:
  995.  
  996. requesting target halt and executing a soft reset
  997. target state: halted
  998. target halted in ARM state due to debug-request, current mode: Supervisor
  999. cpsr: 0x600000d3 pc: 0x00000000
  1000. - Loading /home/tom/priv/git-private/ubidata/dbb_trailer/build/out/arm_tom/test-blockmanager
  1001. Loading section .rom_vectors, size 0x40 lma 0x100000
  1002. Loading section .text, size 0x2cc34 lma 0x100040
  1003. Loading section .rodata, size 0x198c lma 0x12cc74
  1004. Loading section .data, size 0x7b4 lma 0x12e600
  1005. Start address 0x100040, load size 191924
  1006. Transfer rate: 10 KB/sec, 12794 bytes/write.
  1007. - Done.
  1008. - Continuing.
  1009.  
  1010.  
  1011. Same from other host, either using tunneling or direct TCP connection
  1012. the speed is something like 195 KB/sec and it doesn't seem to upload
  1013. properly.
  1014.  
  1015. ?
  1016.  
  1017.  
  1018. Entry: openocd OLIMEX OCD-USB-EW
  1019. Date: Mon May 16 14:36:32 CEST 2011
  1020.  
  1021. --enable-arm-jtag-ew
  1022.  
  1023.  
  1024.  
  1025. Entry: OpenOCD on the AT91
  1026. Date: Sat May 28 12:14:09 CEST 2011
  1027.  
  1028. It's slow and I don't know why.  Setting debug loglevel gives this as
  1029. the main programming loop:
  1030.  
  1031. Debug: 15414 145857 target.c:1652 target_write_u32(): address: 0xffffff64, value: 0x5a03d801
  1032. Debug: 15415 145857 embeddedice.c:502 embeddedice_write_reg(): 0: 0x00000004
  1033. Debug: 15416 145857 embeddedice.c:502 embeddedice_write_reg(): 0: 0x00000005
  1034.  
  1035. Debug: 15417 145873 at91sam7.c:353 at91sam7_flash_command(): Flash command: 0x5a03d801, flash bank: 1, page number: 984
  1036. Debug: 15418 145874 arm7_9_common.c:2270 arm7_9_read_memory(): address: 0xffffff68, size: 0x00000004, count: 0x00000001
  1037.  
  1038. Debug: 15420 145889 target.c:1575 target_read_u32(): address: 0xffffff68, value: 0x00000401
  1039. Debug: 15421 145889 at91sam7.c:328 at91sam7_wait_status_busy(): status[0]: 0x401
  1040. Debug: 15422 145889 at91sam7.c:1102 at91sam7_write(): Write flash bank:0 page number:984
  1041. Debug: 15423 145889 embeddedice.c:502 embeddedice_write_reg(): 0: 0x00000004
  1042. Debug: 15424 145889 embeddedice.c:502 embeddedice_write_reg(): 0: 0x00000005
  1043.  
  1044. So what we see here is that the flash command 0x5a03d801 goes to
  1045. register 0xffffff64.  Looking at the data sheet this is a block of 256
  1046. registers called MC (memory controller) at 0xffffff00, which is
  1047. documented in section 18 in the AT91SAM7X datasheet.  At offset 60 and
  1048. 70 in this window are two EFCs : embedded Flash Controllers which are
  1049. documented in section 19.
  1050.  
  1051. 0x64 : MC_FCR : Memory Controller Flash Command Register
  1052.  
  1053.  5A  0  3D8 0       1
  1054. key    page   command
  1055.                = WP (write page)
  1056.  
  1057.  
  1058. The key is the write-protection key, always 0x5A
  1059.  
  1060. 0x68 : MC_FSR : Memory Controller Flash Status Register
  1061.  
  1062. bit 0 is the ready bit.
  1063. -> find out if this causes the delay
  1064.  
  1065. No it doesn't : that bit is 1 when it's read.
  1066.  
  1067.  
  1068.  
  1069. Ok, I tried again on the host and I get 7kByte/sec, but it doesn't
  1070. work properly.
  1071.  
  1072. Why is this so buggy?  I had similar problems a couple of months ago.
  1073. Is it just that I miss some console messages, or is it electrical?
  1074.  
  1075. I think it's worth investing some time to see how this actually works,
  1076. so I can understand the error messages.
  1077.  
  1078.  
  1079. Entry: gdb cheat sheet
  1080. Date: Sat May 28 16:34:23 CEST 2011
  1081.  
  1082. # List breakpoints
  1083. info breakpoints
  1084.  
  1085. # List breakpoints in monitor.  This doesn't always show the
  1086. # breakpoints; it seems GDB will set them at a `continue' command.  To
  1087. # verify, log into OpenOCD using telnet and execute the `bp' command
  1088. # when gdb is inside a `continue' command.
  1089. mon bp
  1090.  
  1091. # List memory map
  1092. info mem
  1093.  
  1094.  
  1095.  
  1096.  
  1097. Entry: force hard breakpoints
  1098. Date: Sat May 28 16:43:42 CEST 2011
  1099.  
  1100. dcc downloads are enabled
  1101. fast memory access is enabled
  1102. force hard breakpoints
  1103.  
  1104.  
  1105. Entry: OpenOCD, scripting in tcl
  1106. Date: Sun May 29 13:57:05 CEST 2011
  1107.  
  1108. The thing is: OpenOCD is not only useful for gdb, but another
  1109. debugger/monitor could be bolted on.  It might be a good idea to get
  1110. to know it a bit better.
  1111.  
  1112. Cheat sheet
  1113.  
  1114. # Load 10 bytes (8) from memory at 0xF000 ainto var (arr) and print it
  1115. # to the console.
  1116. mem2array arr 8 0xF000 10
  1117. puts $arr
  1118.  
  1119. # The bytes arrive on the OpenOCD console.  How to make them go to the
  1120. # GDB console?
  1121.  
  1122.  
  1123.  
  1124. # startup.tcl
  1125.  
  1126. [email protected]:~/git/openocd$ find -name startup.tcl
  1127. ./src/jtag/startup.tcl
  1128. ./src/startup.tcl
  1129. ./src/target/startup.tcl
  1130. ./src/helper/startup.tcl
  1131. ./src/server/startup.tcl
  1132. ./src/flash/startup.tcl
  1133.  
  1134.  
  1135. [1] http://openocd.berlios.de/doc/html/About-Jim_002dTcl.html
  1136. [2] http://openocd.berlios.de/doc/html/Tcl-Crash-Course.html#Tcl-Crash-Course
  1137.  
  1138. Entry: OpenOCD docs
  1139. Date: Sun May 29 15:00:14 CEST 2011
  1140.  
  1141.  
  1142. It would be helpful to read the OpenOCD documentation once,
  1143. completely.
  1144.  
  1145. ./configure --enable-maintainer-mode --enable-ft2232_libftdi --enable-doxygen-pdf
  1146. make -C doc pdf
  1147. make doxygen
  1148.  
  1149. (!!! apt-get install doxygen)
  1150.  
  1151. doc/openocd.pdf
  1152. doxygen/latex/refman.pdf    (1500 pages!)
  1153.  
  1154.  
  1155. Entry: Python scripting in GDB
  1156. Date: Sun May 29 15:21:06 CEST 2011
  1157.  
  1158. [1] http://sourceware.org/gdb/wiki/PythonGdb
  1159. [2] http://sourceware.org/gdb/wiki/PythonGdbTutorial
  1160.  
  1161.  
  1162.  
  1163. Entry: OpenOCD bugs
  1164. Date: Sun May 29 16:09:57 CEST 2011
  1165.  
  1166. I'm trying to get to a reliable workaround for all the bugs I run
  1167. into.  Up to now there hasn't been a simple pattern.  This is an
  1168. attempt to separate multiple bugs + their workaround.
  1169.  
  1170.  
  1171. * Error: address + size wrapped(0xffffffff, 0x00000004)
  1172.  
  1173. This is supposed to be a bug in GDB[1].  I have no reliable
  1174. workaround.
  1175.  
  1176. * Target not halted, starts running when left alone for a while
  1177.   (i.e. +- 1 hour)
  1178.  
  1179. Could be WDT?
  1180.  
  1181. It seems to be seriously messed up.  I can't fix it with just software.
  1182.  
  1183. Warn : srst pulls trst - can not reset into halted mode. Issuing halt after reset.
  1184. Error: Jazelle debug entry -- BROKEN!
  1185. Error: Jazelle state handling is BROKEN!
  1186. target state: halted
  1187. target halted in Jazelle state due to debug-request, current mode: Supervisor
  1188. cpsr: 0x61000013 pc: 0x00106a72
  1189. requesting target halt and executing a soft reset
  1190. Error: Jazelle state handling is BROKEN!
  1191. target state: halted
  1192. target halted in Jazelle state due to debug-request, current mode: Supervisor
  1193. cpsr: 0x610000d3 pc: 0x00000000
  1194. 1000 kHz
  1195.  
  1196. There are 3 things to reset:
  1197. - target power
  1198. - programmer power
  1199. - OpenOCD
  1200.  
  1201. Assuming it's not the programmer, it should be possible for OpenOCD to
  1202. reset the chip, whatever the state it is in.  So assume the bug is
  1203. with OpenOCD and restart it.
  1204.  
  1205. When I reset just OpenOCD (not the board) I run into the other error:
  1206.  
  1207. GDB:     Cannot find bounds of current function
  1208. OpenOCD: Error: address + size wrapped(0xffffffff, 0x00000004)
  1209.  
  1210. Doing "reset" and "continue" a couple of times will eventually pull it
  1211. back in line.
  1212.  
  1213. Summary: I managed to reset it:
  1214.   - by re-starting OpenOCD
  1215.   - by fiddling a bit with GDB
  1216.   - did not touch target nor programmer power
  1217.  
  1218. That should be automatable.
  1219.  
  1220.  
  1221. [1] http://lists.berlios.de/pipermail/openocd-development/2009-February/004684.html
  1222.  
  1223.  
  1224. Entry: OpenOCD all zeros
  1225. Date: Sun May 29 17:01:01 CEST 2011
  1226.  
  1227. The following problem was solved by power-cyling the (DBB) board:
  1228.  
  1229. Open On-Chip Debugger 0.5.0-dev-00886-g6152c29 (2011-05-29-14:08)
  1230. Licensed under GNU GPL v2
  1231. For bug reports, read
  1232.         http://openocd.berlios.de/doc/doxygen/bugs.html
  1233. Info : only one transport option; autoselect 'jtag'
  1234. srst_only srst_pulls_trst srst_gates_jtag srst_open_drain
  1235. Warn : use 'at91sam7s256.cpu' as target identifier, not '0'
  1236. debug_level: 2
  1237. 1 kHz
  1238. dcc downloads are enabled
  1239. fast memory access is enabled
  1240. force hard breakpoints
  1241. adapter_nsrst_delay: 200
  1242. jtag_ntrst_delay: 200
  1243. Info : clock speed 1 kHz
  1244. Error: JTAG scan chain interrogation failed: all zeroes
  1245. Error: Check JTAG interface, timings, target power, etc.
  1246. Error: Trying to use configured scan chain anyway...
  1247. Error: at91sam7s256.cpu: IR capture error; saw 0x00 not 0x01
  1248. Warn : Bypassing JTAG setup events due to errors
  1249. Info : Embedded ICE version 0
  1250. Error: unknown EmbeddedICE version (comms ctrl: 0x00000000)
  1251. Info : at91sam7s256.cpu: hardware has 2 breakpoint/watchpoint units
  1252. debug_level: 1
  1253. Error: JTAG scan chain interrogation failed: all zeroes
  1254. Error: Check JTAG interface, timings, target power, etc.
  1255. Error: Trying to use configured scan chain anyway...
  1256. Error: at91sam7s256.cpu: IR capture error; saw 0x00 not 0x01
  1257. Warn : Bypassing JTAG setup events due to errors
  1258. Warn : srst pulls trst - can not reset into halted mode. Issuing halt after reset.
  1259. Error: timed out while waiting for target halted
  1260. TARGET: at91sam7s256.cpu - Not halted
  1261.  
  1262. Runtime Error: ./ocd.SAM7-H256.cfg:38:
  1263. in procedure 'script'
  1264. at file "embedded:startup.tcl", line 58
  1265. in procedure 'reset' called at file "./ocd.SAM7-H256.cfg", line 38
  1266.  
  1267.  
  1268.  
  1269. Entry: OpenOCD errors summary
  1270. Date: Sun May 29 17:03:55 CEST 2011
  1271.  
  1272. TODO: verify the following errors and workarounds.
  1273.  
  1274.  
  1275. - Error: JTAG scan chain interrogation failed: all zeroes
  1276.  
  1277. This is solved by a board power-cycle and OpenOCD restart.
  1278.  
  1279. - Error: Jazelle debug entry -- BROKEN!
  1280.  
  1281. Restarting OpenOCD then brings it to a state where the following
  1282. occurs:
  1283.  
  1284. - Error: address + size wrapped(0xffffffff, 0x00000004)
  1285.  
  1286. This seems to be a generic error caused by GDB getting confused by
  1287. what it gets from OpenOCD, or some other GDB-related issue.
  1288.  
  1289. This is fixable by "nudging", i.e. "reset" + "continue" on the GDB
  1290. prompt: finally it does seem to run reliably, stepping + breakpoints.
  1291.  
  1292.  
  1293.  
  1294. Entry: OpenOCD console output to GDB
  1295. Date: Sun May 29 17:52:15 CEST 2011
  1296.  
  1297.  
  1298. Console output to GDB goes through:
  1299. src/server/gdb_server.c :
  1300. static int gdb_output_con(struct connection *connection, const char* line);
  1301.  
  1302. This seems to be only used in:
  1303. static void gdb_log_callback(void *priv, const char *file, unsigned line,
  1304.             const char *function, const char *string)
  1305.  
  1306.  
  1307.  
  1308. What I think is going on here is that log_add_callback() adds to some
  1309. kind of global logging facility.  Next is to find out how to "puts" to
  1310. that.
  1311.  
  1312. To find a list of commands, do:
  1313.  
  1314.    grep -re ".name = " src/
  1315.  
  1316. It seems that "list" is what I'm looking for.
  1317.  
  1318. Probably a better candidate is "echo", defined in src/command.c :
  1319.  
  1320.             .name = "echo",
  1321.             .handler = jim_echo,
  1322.             .mode = COMMAND_ANY,
  1323.             .help = "Logs a message at \"user\" priority. "
  1324.                   "Output message to stdout. "
  1325.                   "Option \"-n\" suppresses trailing newline",
  1326.             .usage = "[-n] string",
  1327.  
  1328.  
  1329. This calls LOG_USER / LOG_USER_N.
  1330.  
  1331.  
  1332.  
  1333. Entry: AT91SAM7 back channel
  1334. Date: Sun May 29 19:39:03 CEST 2011
  1335.  
  1336. Are the DBGU ports/registers accessible through JTAG in monitor mode?
  1337.  
  1338. Data sheet SAM7S 12.6.1
  1339.  
  1340. * Find out what monitor mode does (as opposed to HALT mode) [1]
  1341.  
  1342. * What are COMMTX and COMMRX signals.  
  1343.  
  1344. I'm browsing [1] looking for monitor mode at 5.9 and I find debug
  1345. communication channel (DCC) at 5.8.  Maybe that's what I'm looking
  1346. for.
  1347.  
  1348. Googling for '"coprocessor 14" openocd' I get [2].  On the ARM side
  1349. it's just a MCR / MRC instruction.  On the host side it's scan chain
  1350. 2.
  1351.  
  1352. Is this the same DCC as in "dcc downloads" ?  Indeed.  This mechanism
  1353. is already used; I've found some ARM code so it looks like it places
  1354. some code in RAM to handle the other side.  Cool.
  1355.  
  1356. It has some setup code in arm7_9_common.c and the bulk in
  1357. embeddedice.c (embeddedice_write_dcc)
  1358.  
  1359. So this _should_ definitely be workable.  How to go about it then?
  1360.  
  1361.  
  1362.  
  1363. [1] http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0210c/I901036.html
  1364. [2] http://openocd.berlios.de/doc/html/Architecture-and-Core-Commands.html
  1365.  
  1366.  
  1367.  
  1368. Entry: Getting debug info from GDB into OpenOCD
  1369. Date: Mon May 30 10:13:22 CEST 2011
  1370.  
  1371. I have a memory buffer that I would like to inspect with some kind of
  1372. script.  I have the option to use the (distorted) gdb scripting
  1373. language, or to use jim tcl on the OpenOCD side.
  1374.  
  1375. For the latter, I wonder how to translate symbols from GDB and pass
  1376. them to the "monitor" command.  The default behaviour is just to pass
  1377. anything after the monitor command verbatim, not dereferencing
  1378. variables.
  1379.  
  1380. It's probably best to just write the scripts in GDB.
  1381.  
  1382.  
  1383. Entry: OpenOCD still unreliable
  1384. Date: Mon May 30 18:40:17 CEST 2011
  1385.  
  1386. I'm getting closer to +- reliable operation.  However, once in a
  1387. couple I get this:
  1388.  
  1389. stepi ignored. GDB will now fetch the register state from the target.
  1390.  
  1391. A couple of stepi commands (3) right after "reset init" seem to solve
  1392. this problem.
  1393.  
  1394.  
  1395.  
  1396. Entry: More OpenOCD errors
  1397. Date: Mon May 30 19:40:20 CEST 2011
  1398.  
  1399. Error: Target not halted
  1400. Error: auto_probe failed
  1401. Error: Connect failed. Consider setting up a gdb-attach event for the target to prepare target for GDB connect, or use 'gdb_memory_map disable'.
  1402. Error: attempted 'gdb' connection rejected
  1403.  
  1404.  
  1405. It doesn't recover from that.  This (I assume) is because of the
  1406. board/firmware bug that causes sporadic resets.
  1407.  
  1408. Fix OpenOCD so it restarts whenever this happens.  Let's try to
  1409. restart manually:
  1410.  
  1411. Error: JTAG scan chain interrogation failed: all zeroes
  1412. Error: Check JTAG interface, timings, target power, etc.
  1413. Error: Trying to use configured scan chain anyway...
  1414. Error: at91sam7s256.cpu: IR capture error; saw 0x00 not 0x01
  1415. Warn : Bypassing JTAG setup events due to errors
  1416. Info : Embedded ICE version 0
  1417. Error: unknown EmbeddedICE version (comms ctrl: 0x00000000)
  1418. Info : at91sam7s256.cpu: hardware has 2 breakpoint/watchpoint units
  1419.  
  1420.  
  1421. Reason: board power failure.
  1422.  
  1423.  
  1424.  
  1425. Entry: OpenOCD ARM DCC debug channel
  1426. Date: Fri Jun  3 17:09:35 CEST 2011
  1427.  
  1428. [1] http://openocd.berlios.de/doc/html/Architecture-and-Core-Commands.html
  1429.  
  1430.  
  1431. Entry: OpenOCD again
  1432. Date: Tue Jun  7 23:47:34 CEST 2011
  1433.  
  1434. Now using the SAM7S Atmel EK, I get a problem at startup.  This is
  1435. right after halt.  The mmw is the first write that resets the device.
  1436. Also if I leave it at 3000 khz, gdb doesn't want to connect.
  1437.  
  1438. [email protected]:~/ecos-build/bin$ ./ocd.SAM7
  1439. Open On-Chip Debugger 0.5.0-dev-00886-g6152c29 (2011-05-29-14:26)
  1440. Licensed under GNU GPL v2
  1441. For bug reports, read
  1442.         http://openocd.berlios.de/doc/doxygen/bugs.html
  1443. Info : only one transport option; autoselect 'jtag'
  1444. srst_only srst_pulls_trst srst_gates_jtag srst_open_drain
  1445. Warn : use 'at91sam7s256.cpu' as target identifier, not '0'
  1446. debug_level: 2
  1447. 100 kHz
  1448. dcc downloads are enabled
  1449. fast memory access is enabled
  1450. force hard breakpoints
  1451. adapter_nsrst_delay: 200
  1452. jtag_ntrst_delay: 200
  1453. Info : clock speed 100 kHz
  1454. Info : JTAG tap: at91sam7s256.cpu tap/device found: 0x3f0f0f0f (mfg: 0x787, part: 0xf0f0, ver: 0x3)
  1455. Info : Embedded ICE version 1
  1456. Info : at91sam7s256.cpu: hardware has 2 breakpoint/watchpoint units
  1457. debug_level: 1
  1458. 100 kHz
  1459. Warn : srst pulls trst - can not reset into halted mode. Issuing halt after reset.
  1460. target state: halted
  1461. target halted in ARM state due to debug-request, current mode: Abort
  1462. cpsr: 0x200000d7 pc: 0x000006e8
  1463. requesting target halt and executing a soft reset
  1464. target state: halted
  1465. target halted in ARM state due to debug-request, current mode: Supervisor
  1466. cpsr: 0x200000d3 pc: 0x00000000
  1467. Warn : memory write caused data abort (address: 0xfffffd00, size: 0x4, count: 0x1)
  1468. in procedure 'mww'
  1469.  
  1470. 3000 kHz
  1471. receiving debug messages from current target charmsg
  1472.  
  1473.  
  1474. Checking:
  1475. /usr/local/share/openocd/scripts/target/at91sam7sx.cfg
  1476.  
  1477. target create $_TARGETNAME arm7tdmi -endian $_ENDIAN -chain-position $_TARGETNAME -variant arm7tdmi
  1478. $_TARGETNAME configure -event reset-init {
  1479.         soft_reset_halt
  1480.         # RSTC_CR : Reset peripherals
  1481.         mww 0xfffffd00 0xa5000004
  1482.         # disable watchdog
  1483.       mww 0xfffffd44 0x00008000
  1484.       # enable user reset
  1485.       mww 0xfffffd08 0xa5000001
  1486.       # CKGR_MOR : enable the main oscillator
  1487.       mww 0xfffffc20 0x00000601
  1488.       sleep 10
  1489.       # CKGR_PLLR: 96.1097 MHz
  1490.       mww 0xfffffc2c 0x00481c0e
  1491.       sleep 10
  1492.       # PMC_MCKR : MCK = PLL / 2 ~= 48 MHz
  1493.       mww 0xfffffc30 0x00000007
  1494.       sleep 10
  1495.       # MC_FMR: flash mode (FWS=1,FMCN=73)
  1496.       mww 0xffffff60 0x00490100
  1497.       sleep 100
  1498. }
  1499.  
  1500.  
  1501. Pfff..  If I remove the "reset init" in the startup script, it seems
  1502. to come up just fine.  Maybe that never really worked properly?  I
  1503. don't remember.
  1504.  
  1505. One thing is clear: it doesn't like 3000 kHz.  I thought it went
  1506. faster..  If I switch to 1000 khz, it seems to work.
  1507.  
  1508. So, again a buch of problems that are too confusing for me to see what
  1509. is actually going on.  I got it working on the Ubi board but the EK is
  1510. borked again.
  1511.  
  1512. Now I do an upload at 3000 kHz and that works:
  1513.  
  1514. (gdb) mon jtag_khz 3000
  1515. 3000 kHz
  1516. (gdb) load
  1517. Loading section .rom_vectors, size 0x40 lma 0x100000
  1518. Loading section .text, size 0x28db8 lma 0x100040
  1519. Loading section .rodata, size 0x7930 lma 0x128df8
  1520. Loading section .data, size 0x1044 lma 0x130728
  1521. Start address 0x100040, load size 202604
  1522. Transfer rate: 8 KB/sec, 13506 bytes/write.
  1523.  
  1524. Let's try 6000: seems to work too.
  1525.  
  1526. This is weird...  Do flash uploads actually talk to the processor or
  1527. directly to the flash?
  1528.  
  1529. Maybe it's time to start paying attention to the CPSR.
  1530.  
  1531. I see several different states:
  1532.  
  1533. 0x600000d3 (normal)
  1534. 0x200000d3
  1535. 0x200000d7
  1536. 0x400000d3
  1537.  
  1538.  
  1539. Let's summarize:
  1540.   - uploads do work at 6000 kHz if the state is ok
  1541.   - "reset init" is not reliable: mww error immediately after soft_reset_halt
  1542.  
  1543.  
  1544. Crap.. can't add comments after a line in jim tcl!
  1545.  
  1546.  
  1547. Ha.. removing the soft_reset_halt in the init routine make the data
  1548. abort error go away.
  1549.  
  1550.  
  1551.  
  1552.  
  1553. Entry: OpenOCD reset-init event
  1554. Date: Wed Jun  8 01:31:26 CEST 2011
  1555.  
  1556. So, it looks like the trouble from last post is mostly that
  1557. "soft_reset_halt" is called inside the reset-init event handler in the
  1558. at91sam7sx.cfg file.  Removing it makes it behave better.
  1559.  
  1560. Comparing it with the at91sam7x256.cfg file there is also no
  1561. "soft_reset_halt".
  1562.  
  1563. [1] http://openocd.berlios.de/doc/html/Config-File-Guidelines.html
  1564.  
  1565.  
  1566.  
  1567. Entry: AT91SAM7 setup from scratch
  1568. Date: Sun Jun 12 18:05:17 CEST 2011
  1569.  
  1570. I've been using eCos up to now.  How to work on the bare metal?  This
  1571. is the program I'm trying to run, residing in the file sam7.S
  1572.  
  1573. main:   nop
  1574.         nop
  1575.         nop
  1576.         b main
  1577.  
  1578.  
  1579. Here's the contents of the makefile:
  1580.  
  1581. all: sam7.elf
  1582.  
  1583. clean:
  1584.       rm -rf *~ *.o *.elf
  1585.  
  1586. CC = arm-eabi-gcc  -mcpu=arm7tdmi -O0 -g
  1587. LD = arm-eabi-gcc  -mno-thumb-interwork -mcpu=arm7tdmi -Wl,-static -g -nostdlib
  1588. OBJDUMP = arm-eabi-objdump
  1589.  
  1590. %.o:  %.S
  1591.       $(CC) -o [email protected] -c $<
  1592.  
  1593. %.elf:      %.o %.ld
  1594.       $(LD) -T$*.ld -o [email protected] $*.o
  1595.  
  1596. %.dump: %.elf
  1597.       $(OBJDUMP) -h $<
  1598.  
  1599. I'm using the following linker script which places everything in RAM.
  1600.  
  1601. SECTIONS
  1602. {
  1603.   . = 0x200000;
  1604.   .text : { *(.text) }
  1605.   .data : { *(.data) }
  1606.   .bss : { *(.bss) }
  1607. }
  1608.  
  1609. Compiling this to arm7.elf and loading with gdb enables me to step
  1610. through the code if I use:
  1611.  
  1612. set $pc = 0x200000
  1613.  
  1614. Next is to set the reset vector and maybe put it in flash?  Though RAM
  1615. seems a lot more convenient if it fits..
  1616.  
  1617. Let's peek in the eCos code to see what vectors.o looks like:
  1618.  
  1619.   0 .text          00000564
  1620.   1 .data          000001d8
  1621.   2 .bss           00001310
  1622.   3 .vectors       00000040
  1623.   4 .fixed_vectors 00000140
  1624.  
  1625. It will place the .vectors at the start of rom.  So where is that
  1626. section defined?
  1627.  
  1628.   packages/hal/arm/arch/current/src/vectors.S
  1629.  
  1630. It seems that this space contains instructions either as branch or
  1631. direct pc load, but not addresses.
  1632.  
  1633. #ifdef CYGSEM_HAL_ROM_RESET_USES_JUMP
  1634. // Assumption:  ROM code has these vectors at the hardware reset address.
  1635. // A simple jump removes any address-space dependencies [i.e. safer]
  1636.         b       reset_vector                    // 0x00
  1637. #else        
  1638.         ldr     pc,.reset_vector                // 0x00
  1639. #endif
  1640.  
  1641.  
  1642.  
  1643. Always difficult to see what is an ARM-ism, and what is an AT91-ism.
  1644. Looks like for arm the vectors are always code.  I'm not sure if they
  1645. are always at 0 though..  I seem to have found some info online about
  1646. an LPC that starts somewhere else, in Flash.  Some more info [1][2].
  1647.  
  1648. For linker docs see [3].
  1649.  
  1650. [1] http://sourceware.org/ml/ecos-discuss/1999-10/msg00087.html
  1651. [2] http://sourceware.org/ml/ecos-discuss/1999-10/msg00095.html
  1652. [3] http://www.delorie.com/gnu/docs/binutils/ld_9.html
  1653.  
  1654. Entry: ARM instruction set
  1655. Date: Sun Jun 12 19:47:26 CEST 2011
  1656.  
  1657. Rules of thumb (har har):
  1658.  
  1659. - Destination register is leftmost, operands rightmost.
  1660. - Immediates need pound sign #
  1661. - The 0xFFFFFFFF word is an invalid instruction
  1662.  
  1663.  
  1664. [1] http://infocenter.arm.com/help/topic/com.arm.doc.qrc0001m/QRC0001_UAL.pdf
  1665.  
  1666.  
  1667. Entry: arm asm/dasm
  1668. Date: Thu Jun 16 18:27:05 CEST 2011
  1669.  
  1670. For Staapl it might be intersting to try to figure out how to convert
  1671. between binary and assembler using objdump.
  1672.  
  1673. This works:
  1674.  
  1675.   arm-eabi-objdump -b binary -m arm -D foo
  1676.  
  1677. Here -D is used instead of -d, because apparently the raw binary data
  1678. is interpreted to be in .data segement.
  1679.  
  1680. Maybe it's simpler to convert bin to .o with all data in the .text
  1681. segment:
  1682.  
  1683.   arm-eabi-objcopy -I binary -O elf32-littlearm -B arm --rename-section .data=.text foo foo.o
  1684.  
  1685. But that doesn't set the CODE attribute that are in ordinary binaries,
  1686. but the DATA attribute is set.  Note that renaming happens after
  1687. setting flags.
  1688.  
  1689.   arm-eabi-objcopy -I binary -O elf32-littlearm -B arm --rename-section .data=.text --set-section-flags .data=code foo foo.o
  1690.  
  1691. To make it less confusing it seems better to reorder the flags, though
  1692. that doesn't change functionality
  1693.  
  1694.   arm-eabi-objcopy \
  1695.     -I binary -O elf32-littlearm -B arm \
  1696.     --set-section-flags .data=code  \
  1697.     --rename-section .data=.text  foo foo.o
  1698.  
  1699.  
  1700.  
  1701. Entry: $pc not reset after soft_reset_halt
  1702. Date: Wed Jun 22 02:29:57 CEST 2011
  1703.  
  1704. Is this because of GDB?  I.e GDB's cache of the register values gets
  1705. out of sync with the machine?  Note that "mon reg" does seem to give
  1706. the correct values.
  1707.  
  1708. (gdb) mon soft_reset_halt
  1709. requesting target halt and executing a soft reset
  1710. target state: halted
  1711. target halted in ARM state due to debug-request, current mode: Supervisor
  1712. cpsr: 0x200000d3 pc: 0x00000000
  1713. (gdb) info registers
  1714. r0             0x0      0
  1715. r1             0x6f     111
  1716. r2             0x204714 2115348
  1717. r3             0x10000002       268435458
  1718. r4             0x2006a8 2098856
  1719. r5             0x13     19
  1720. r6             0x20388c 2111628
  1721. r7             0x1d     29
  1722. r8             0x20384c 2111564
  1723. r9             0x200750 2099024
  1724. r10            0x2006e0 2098912
  1725. r11            0x20384c 2111564
  1726. r12            0x2008d8 2099416
  1727. sp             0x203800 0x203800
  1728. lr             0x1143a4 1131428
  1729. pc             0x11e4a8 0x11e4a8
  1730. fps            0x0      0
  1731. cpsr           0x20000013       536870931
  1732.  
  1733.  
  1734. It happened again on a stepi.  Indeed it seems to be just that gdb's
  1735. idea of the registers gets messed up, so it will set them according to
  1736. a previously saved state before stepping.
  1737.  
  1738. The following is the OpenOCD debug output when stepping after a
  1739. soft_reset_halt.  The PC is supposed to be at 0, but somehow it gets
  1740. set at 0x001100f0 which was the state before soft_reset_halt.
  1741.  
  1742. The problem does not go away with restarting gdb.  Restarting OpenOCD
  1743. however does fix it.
  1744.  
  1745.  
  1746. Debug: 56656 3980801 gdb_server.c:2201 gdb_input_inner(): received packet: 's'
  1747. Debug: 56657 3980801 target.c:1062 target_call_event_callbacks(): target event 7 (gdb-start)
  1748. Debug: 56658 3980801 gdb_server.c:1455 gdb_step_continue_packet(): -
  1749. Debug: 56659 3980801 gdb_server.c:1475 gdb_step_continue_packet(): step
  1750. Debug: 56660 3980801 arm7_9_common.c:2270 arm7_9_read_memory(): address: 0x00000000, size: 0x00000004, count: 0x00000001
  1751. Debug: 56661 3980811 target.c:1605 target_read_u32(): address: 0x00000000, value: 0xe59ff018
  1752. Debug: 56662 3980811 arm7_9_common.c:2270 arm7_9_read_memory(): address: 0x00000020, size: 0x00000004, count: 0x00000001
  1753. Debug: 56663 3980822 target.c:1605 target_read_u32(): address: 0x00000020, value: 0x001100f0
  1754. Debug: 56664 3980822 arm7_9_common.c:1615 arm7_9_restore_context(): -
  1755. Debug: 56665 3980822 arm7_9_common.c:1638 arm7_9_restore_context(): examining Supervisor mode
  1756. Debug: 56666 3980822 arm7_9_common.c:1652 arm7_9_restore_context(): examining dirty reg: r0
  1757. Debug: 56667 3980822 arm7_9_common.c:1652 arm7_9_restore_context(): examining dirty reg: r1
  1758. Debug: 56668 3980822 arm7_9_common.c:1652 arm7_9_restore_context(): examining dirty reg: r2
  1759. Debug: 56669 3980822 arm7_9_common.c:1652 arm7_9_restore_context(): examining dirty reg: r3
  1760. Debug: 56670 3980822 arm7_9_common.c:1652 arm7_9_restore_context(): examining dirty reg: r4
  1761. Debug: 56671 3980822 arm7_9_common.c:1652 arm7_9_restore_context(): examining dirty reg: r5
  1762. Debug: 56672 3980822 arm7_9_common.c:1652 arm7_9_restore_context(): examining dirty reg: r6
  1763. Debug: 56673 3980822 arm7_9_common.c:1652 arm7_9_restore_context(): examining dirty reg: r7
  1764. Debug: 56674 3980822 arm7_9_common.c:1652 arm7_9_restore_context(): examining dirty reg: r8
  1765. Debug: 56675 3980822 arm7_9_common.c:1652 arm7_9_restore_context(): examining dirty reg: r9
  1766. Debug: 56676 3980822 arm7_9_common.c:1652 arm7_9_restore_context(): examining dirty reg: r10
  1767. Debug: 56677 3980822 arm7_9_common.c:1652 arm7_9_restore_context(): examining dirty reg: r11
  1768. Debug: 56678 3980822 arm7_9_common.c:1652 arm7_9_restore_context(): examining dirty reg: r12
  1769. Debug: 56679 3980822 arm7_9_common.c:1652 arm7_9_restore_context(): examining dirty reg: pc
  1770. Debug: 56680 3980822 arm7_9_common.c:1652 arm7_9_restore_context(): examining dirty reg: cpsr
  1771. Debug: 56681 3980822 arm7_9_common.c:1704 arm7_9_restore_context(): writing register 0 mode Supervisor with value 0xffffffff
  1772. Debug: 56682 3980822 arm7_9_common.c:1704 arm7_9_restore_context(): writing register 1 mode Supervisor with value 0xffffffff
  1773. Debug: 56683 3980822 arm7_9_common.c:1704 arm7_9_restore_context(): writing register 2 mode Supervisor with value 0xffffffff
  1774. Debug: 56684 3980822 arm7_9_common.c:1704 arm7_9_restore_context(): writing register 3 mode Supervisor with value 0xffffffff
  1775. Debug: 56685 3980822 arm7_9_common.c:1704 arm7_9_restore_context(): writing register 4 mode Supervisor with value 0xffffffff
  1776. Debug: 56686 3980822 arm7_9_common.c:1704 arm7_9_restore_context(): writing register 5 mode Supervisor with value 0xffffffff
  1777. Debug: 56687 3980822 arm7_9_common.c:1704 arm7_9_restore_context(): writing register 6 mode Supervisor with value 0xffffffff
  1778. Debug: 56688 3980822 arm7_9_common.c:1704 arm7_9_restore_context(): writing register 7 mode Supervisor with value 0xffffffff
  1779. Debug: 56689 3980822 arm7_9_common.c:1704 arm7_9_restore_context(): writing register 8 mode Supervisor with value 0xffffffff
  1780. Debug: 56690 3980822 arm7_9_common.c:1704 arm7_9_restore_context(): writing register 9 mode Supervisor with value 0xffffffff
  1781. Debug: 56691 3980822 arm7_9_common.c:1704 arm7_9_restore_context(): writing register 10 mode Supervisor with value 0xffffffff
  1782. Debug: 56692 3980822 arm7_9_common.c:1704 arm7_9_restore_context(): writing register 11 mode Supervisor with value 0xffffffff
  1783. Debug: 56693 3980822 arm7_9_common.c:1704 arm7_9_restore_context(): writing register 12 mode Supervisor with value 0xffffffff
  1784. Debug: 56694 3980822 arm7_9_common.c:1638 arm7_9_restore_context(): examining Supervisor mode
  1785. Debug: 56695 3980822 arm7_9_common.c:1652 arm7_9_restore_context(): examining dirty reg: pc
  1786. Debug: 56696 3980822 arm7_9_common.c:1638 arm7_9_restore_context(): examining Supervisor mode
  1787. Debug: 56697 3980822 arm7_9_common.c:1652 arm7_9_restore_context(): examining dirty reg: pc
  1788. Debug: 56698 3980822 arm7_9_common.c:1638 arm7_9_restore_context(): examining Supervisor mode
  1789. Debug: 56699 3980823 arm7_9_common.c:1652 arm7_9_restore_context(): examining dirty reg: sp_svc
  1790. Debug: 56700 3980823 arm7_9_common.c:1652 arm7_9_restore_context(): examining dirty reg: lr_svc
  1791. Debug: 56701 3980823 arm7_9_common.c:1652 arm7_9_restore_context(): examining dirty reg: pc
  1792. Debug: 56702 3980823 arm7_9_common.c:1704 arm7_9_restore_context(): writing register 13 mode Supervisor with value 0xffffffff
  1793. Debug: 56703 3980823 arm7_9_common.c:1704 arm7_9_restore_context(): writing register 14 mode Supervisor with value 0xffffffff
  1794. Debug: 56704 3980823 arm7_9_common.c:1638 arm7_9_restore_context(): examining Supervisor mode
  1795. Debug: 56705 3980823 arm7_9_common.c:1652 arm7_9_restore_context(): examining dirty reg: pc
  1796. Debug: 56706 3980823 arm7_9_common.c:1638 arm7_9_restore_context(): examining Supervisor mode
  1797. Debug: 56707 3980823 arm7_9_common.c:1652 arm7_9_restore_context(): examining dirty reg: pc
  1798. Debug: 56708 3980823 arm7_9_common.c:1738 arm7_9_restore_context(): writing cpsr with value 0x200000d3
  1799. Debug: 56709 3980823 arm7tdmi.c:414 arm7tdmi_write_xpsr(): xpsr: 200000d3, spsr: 0
  1800. Debug: 56710 3980823 arm7_9_common.c:1748 arm7_9_restore_context(): writing PC with value 0x00000000
  1801. Debug: 56711 3980823 embeddedice.c:501 embeddedice_write_reg(): 9: 0xffffffff
  1802. Debug: 56712 3980823 embeddedice.c:501 embeddedice_write_reg(): 11: 0xffffffff
  1803. Debug: 56713 3980823 embeddedice.c:501 embeddedice_write_reg(): 12: 0x00000100
  1804. Debug: 56714 3980823 embeddedice.c:501 embeddedice_write_reg(): 13: 0x00000077
  1805. Debug: 56715 3980823 embeddedice.c:501 embeddedice_write_reg(): 16: 0x00000000
  1806. Debug: 56716 3980823 embeddedice.c:501 embeddedice_write_reg(): 17: 0x00000000
  1807. Debug: 56717 3980823 embeddedice.c:501 embeddedice_write_reg(): 19: 0xffffffff
  1808. Debug: 56718 3980823 embeddedice.c:501 embeddedice_write_reg(): 20: 0x00000000
  1809. Debug: 56719 3980823 embeddedice.c:501 embeddedice_write_reg(): 21: 0x000000f7
  1810. Debug: 56720 3980823 target.c:1062 target_call_event_callbacks(): target event 4 (resumed)
  1811. Debug: 56721 3980849 embeddedice.c:501 embeddedice_write_reg(): 9: 0x00000003
  1812. Debug: 56722 3980849 embeddedice.c:501 embeddedice_write_reg(): 11: 0xffffffff
  1813. Debug: 56723 3980849 embeddedice.c:501 embeddedice_write_reg(): 12: 0x00000000
  1814. Debug: 56724 3980849 embeddedice.c:501 embeddedice_write_reg(): 13: 0x000000f7
  1815. Debug: 56725 3980849 embeddedice.c:501 embeddedice_write_reg(): 16: 0x00000000
  1816. Debug: 56726 3980849 embeddedice.c:501 embeddedice_write_reg(): 17: 0x00000000
  1817. Debug: 56727 3980849 embeddedice.c:501 embeddedice_write_reg(): 19: 0x00000000
  1818. Debug: 56728 3980849 embeddedice.c:501 embeddedice_write_reg(): 21: 0x00000000
  1819. Debug: 56729 3980849 embeddedice.c:501 embeddedice_write_reg(): 20: 0x00000000
  1820. Debug: 56730 3980849 embeddedice.c:501 embeddedice_write_reg(): 0: 0x00000005
  1821. Debug: 56731 3980849 embeddedice.c:501 embeddedice_write_reg(): 12: 0x00000000
  1822. Debug: 56732 3980851 arm7_9_common.c:1410 arm7_9_debug_entry(): target entered debug from ARM state
  1823. Debug: 56733 3980866 armv4_5.c:397 arm_set_cpsr(): set CPSR 0x200000d3: Supervisor mode, ARM state
  1824. Debug: 56734 3980866 arm7_9_common.c:1438 arm7_9_debug_entry(): target entered debug state in Supervisor mode
  1825. Debug: 56735 3980866 arm7_9_common.c:1460 arm7_9_debug_entry(): r0: 0xffffffff
  1826. Debug: 56736 3980866 arm7_9_common.c:1460 arm7_9_debug_entry(): r1: 0xffffffff
  1827. Debug: 56737 3980866 arm7_9_common.c:1460 arm7_9_debug_entry(): r2: 0xffffffff
  1828. Debug: 56738 3980866 arm7_9_common.c:1460 arm7_9_debug_entry(): r3: 0xffffffff
  1829. Debug: 56739 3980866 arm7_9_common.c:1460 arm7_9_debug_entry(): r4: 0xffffffff
  1830. Debug: 56740 3980866 arm7_9_common.c:1460 arm7_9_debug_entry(): r5: 0xffffffff
  1831. Debug: 56741 3980866 arm7_9_common.c:1460 arm7_9_debug_entry(): r6: 0xffffffff
  1832. Debug: 56742 3980866 arm7_9_common.c:1460 arm7_9_debug_entry(): r7: 0xffffffff
  1833. Debug: 56743 3980866 arm7_9_common.c:1460 arm7_9_debug_entry(): r8: 0xffffffff
  1834. Debug: 56744 3980866 arm7_9_common.c:1460 arm7_9_debug_entry(): r9: 0xffffffff
  1835. Debug: 56745 3980866 arm7_9_common.c:1460 arm7_9_debug_entry(): r10: 0xffffffff
  1836. Debug: 56746 3980866 arm7_9_common.c:1460 arm7_9_debug_entry(): r11: 0xffffffff
  1837. Debug: 56747 3980866 arm7_9_common.c:1460 arm7_9_debug_entry(): r12: 0xffffffff
  1838. Debug: 56748 3980866 arm7_9_common.c:1460 arm7_9_debug_entry(): r13: 0xffffffff
  1839. Debug: 56749 3980866 arm7_9_common.c:1460 arm7_9_debug_entry(): r14: 0xffffffff
  1840. Debug: 56750 3980866 arm7_9_common.c:1460 arm7_9_debug_entry(): r15: 0x001100f0
  1841. Debug: 56751 3980866 arm7_9_common.c:1468 arm7_9_debug_entry(): entered debug state at PC 0x1100f0
  1842. Debug: 56752 3980870 target.c:1062 target_call_event_callbacks(): target event 2 (gdb-halt)
  1843. Debug: 56753 3980870 target.c:1062 target_call_event_callbacks(): target event 3 (halted)
  1844. Debug: 56754 3980870 target.c:1062 target_call_event_callbacks(): target event 8 (gdb-end)
  1845. Debug: 56755 3980870 arm7_9_common.c:2121 arm7_9_step(): target stepped
  1846. Debug: 56756 3980872 gdb_server.c:2201 gdb_input_inner(): received packet: 'g'
  1847. Debug: 56757 3980873 gdb_server.c:2201 gdb_input_inner(): received packet: 'm1100f0,4'
  1848. Debug: 56758 3980873 gdb_server.c:1278 gdb_read_memory_packet(): addr: 0x001100f0, len: 0x00000004
  1849. Debug: 56759 3980873 target.c:1443 target_read_buffer(): reading buffer of 4 byte at 0x001100f0
  1850. Debug: 56760 3980873 arm7_9_common.c:2270 arm7_9_read_memory(): address: 0x001100f0, size: 0x00000004, count: 0x00000001
  1851. Debug: 56761 3980885 gdb_server.c:2201 gdb_input_inner(): received packet: 'mffffffff,4'
  1852. Debug: 56762 3980885 gdb_server.c:1278 gdb_read_memory_packet(): addr: 0xffffffff, len: 0x00000004
  1853. Debug: 56763 3980885 target.c:1443 target_read_buffer(): reading buffer of 4 byte at 0xffffffff
  1854. Error: 56764 3980885 target.c:1460 target_read_buffer(): address + size wrapped(0xffffffff, 0x00000004)
  1855.  
  1856.  
  1857. Using only OpenOCD commands, the we get the following weirdness:
  1858.  
  1859. (gdb) mon reg pc 0
  1860. pc (/32): 0x00000000
  1861. (gdb) mon step
  1862. target state: halted
  1863. target halted in ARM state due to single-step, current mode: Supervisor
  1864. cpsr: 0x200000d3 pc: 0x001100f0
  1865.  
  1866.  
  1867. Entry: ARM assembler cheat sheet
  1868. Date: Wed Jun 22 03:17:19 CEST 2011
  1869.  
  1870. - destination register is on the left
  1871. - s suffix means "update condition flags", i.e. and vs. ands
  1872.  
  1873.  
  1874. [1] http://infocenter.arm.com/help/topic/com.arm.doc.qrc0001m/QRC0001_UAL.pdf
  1875.  
  1876.  
  1877.  
  1878. Entry: AT91SAM7S slow_reset init/halt work again
  1879. Date: Wed Jun 22 04:11:41 CEST 2011
  1880.  
  1881. With openocd e7c611deeac63e585eb61d6c4cdb54d078c2c579 the previous
  1882. trouble[1] I had with reset not working properly seem to be resolved.
  1883.  
  1884. However, it does seem to need the slow_reset.
  1885.  
  1886. [1] entry://20110607-234734
  1887.  
  1888.  
  1889. Entry: Reset to 0x110070 : warm_reset
  1890. Date: Thu Jun 23 13:34:12 CEST 2011
  1891.  
  1892. I find that when I call soft_reset_halt, the PC gets reset to
  1893. 0x110070, which in my current eCos setup is warm_reset.  It would be
  1894. strange that this is a coincidence.  So how does GDB know how to set
  1895. that address?
  1896.  
  1897.  
  1898.  
  1899. Entry: OpenOCD: reset halt vs. reset init
  1900. Date: Thu Jun 23 13:37:11 CEST 2011
  1901.  
  1902. If the target under debug gets switched off while a debug setting is
  1903. running, issuing a "reset halt" isn't enough.  I verfied this and I
  1904. got faulty JTAG communication, but "poll" did work.  After "reset
  1905. init" things are back to normal.
  1906.  
  1907. (gdb) mon slow_reset halt
  1908. 100 kHz
  1909. srst pulls trst - can not reset into halted mode. Issuing halt after reset.
  1910. target state: halted
  1911. target halted in ARM state due to debug-request, current mode: Supervisor
  1912. cpsr: 0x200000d3 pc: 0x00005bb8
  1913. 1000 kHz
  1914. (gdb) mon poll
  1915. background polling: on
  1916. TAP: at91sam7s256.cpu (enabled)
  1917. target state: halted
  1918. target halted in ARM state due to debug-request, current mode: Supervisor
  1919. cpsr: 0x200000d3 pc: 0x00005bb8
  1920. (gdb) vstepi
  1921. Bad value '00000001' captured during DR or IR scan:
  1922.  check_value: 0x00000009
  1923.  check_mask: 0x00000009
  1924. JTAG error while reading cpsr
  1925. Bad value '00000001' captured during DR or IR scan:
  1926.  check_value: 0x00000009
  1927.  check_mask: 0x00000009
  1928. JTAG error while reading cpsr
  1929. Couldn't calculate PC of next instruction, current opcode was 0x00000000
  1930. 0x00005bb8 in ?? ()
  1931.    0x5bb0:      andeq   r0, r0, r0
  1932.    0x5bb4:      andeq   r0, r0, r0
  1933. => 0x5bb8:      andeq   r0, r0, r0
  1934.    0x5bbc:      andeq   r0, r0, r0
  1935.    0x5bc0:      andeq   r0, r0, r0
  1936.    0x5bc4:      andeq   r0, r0, r0
  1937.    0x5bc8:      andeq   r0, r0, r0
  1938.    0x5bcc:      andeq   r0, r0, r0
  1939.    0x5bd0:      andeq   r0, r0, r0
  1940.    0x5bd4:      andeq   r0, r0, r0
  1941.  
  1942.  
  1943. Entry: AT91SAM7 and reset
  1944. Date: Thu Jun 23 13:53:25 CEST 2011
  1945.  
  1946. Some notes about using OpenOCD on the AT91SAM7 platform.  These notes
  1947. reflect behaviour with a recent OpenOCD git version and using the
  1948. ARM-USB-OCD programmer.
  1949.  
  1950. 1.  Lower clock when requesting a reset.  I can get a reliable reset
  1951.     when I lower the clock to 100kHz.  Higher than that gives
  1952.     problems.  Other commands give no problems if ARM clock is set to
  1953.     fast.  Flash is independent of ARM.
  1954.  
  1955. 2.  The AT91SAM7 can't reset in halt, which means that it _will_
  1956.     execute code in Flash before any JTAG debugger can halt the chip.
  1957.     Therefore it's best to use soft_reset_halt whenever possible and
  1958.     use "reset init" only when JTAG gets out of sync, i.e. when target
  1959.     is power-cycled.
  1960.  
  1961.  
  1962. Entry: gdb can't connect if target error
  1963. Date: Thu Jun 23 14:21:52 CEST 2011
  1964.  
  1965. It might be best to modify such that gdb is allowed to connect such
  1966. that it can issue a "mon reset init" command.
  1967.  
  1968. Error: Target not halted
  1969. Error: auto_probe failed
  1970. Error: Connect failed. Consider setting up a gdb-attach event for the target to prepare target for GDB connect, or use 'gdb_memory_map disable'.
  1971. Error: attempted 'gdb' connection rejected
  1972.  
  1973. That error is printed in server.c when (abstractly) ->new_connection()
  1974. fails.  The implementation of that function is in gdb_server.c :
  1975.  
  1976. static int gdb_new_connection(struct connection *connection);
  1977.  
  1978. The cause seems to be this:
  1979.  
  1980.    Connect must fail if the memory map can't be set up correctly.
  1981.  
  1982. Maybe this should trigger some retry somewhere?
  1983.  
  1984. To switch off memory map[1]:
  1985.  
  1986.    gdb_memory_map disable
  1987.  
  1988. but of course you can't do this from the gdb side..
  1989.  
  1990. Some more info about that particular patch here[2].  So it's probably
  1991. not a good idea to start prodding there, but to use the `gdb-attach'
  1992. event instead.
  1993.  
  1994.  
  1995. [1] http://www.amontec.com/openocd/doc/GDB-and-OpenOCD.html
  1996. [2] http://www.mail-archive.com/[email protected]/msg13048.html
  1997. [3] entry://20110624-000503
  1998.  
  1999.  
  2000. Entry: stepi ignored. GDB will now fetch the register state from the target.
  2001. Date: Thu Jun 23 14:35:35 CEST 2011
  2002.  
  2003. I read in the code, and it seems that this is a workaround in OpenOCD:
  2004.  
  2005.     stepi ignored. GDB will now fetch the register state from the target.
  2006.  
  2007. Before I needed to work around that workaround by adding a harmless
  2008. "stepi" instruction to cancel the ignored stepi.
  2009.  
  2010. So what is this about really?
  2011. From gdbserver.c:
  2012.  
  2013.       } else if ((packet[0] == 's') && gdb_con->sync)
  2014.       {
  2015.             /* Hmm..... when you issue a continue in GDB, then a "stepi" is
  2016.              * sent by GDB first to OpenOCD, thus defeating the check to
  2017.              * make only the single stepping have the sync feature...
  2018.              */
  2019.             nostep = true;
  2020.             LOG_WARNING("stepi ignored. GDB will now fetch the register state from the target.");
  2021.       }
  2022.       gdb_con->sync = false;
  2023.  
  2024.  
  2025.  
  2026. Entry: arm.run
  2027. Date: Thu Jun 23 14:39:51 CEST 2011
  2028.  
  2029. #!/bin/bash
  2030.  
  2031.  
  2032. # --- config
  2033. GDB=arm-eabi-gdb-7.2
  2034. OPENOCD_HOST=openocd
  2035. OPENOCD_PORT=3333
  2036.  
  2037. # --- code
  2038.  
  2039. [ -z "$1" ] && echo "usage: $0 <arm.elf>" && exit 1
  2040. ELF=$1
  2041.  
  2042. # ELF=/home/tom/dbb_trailer/build/out/arm/test-blockmanager
  2043.  
  2044. # LOAD_COMMAND=load
  2045.  
  2046. CMD=`mktemp`
  2047. cat<<EOF >>$CMD
  2048.  
  2049. # Load file for debugging symbols
  2050. file $ELF
  2051.  
  2052. # Connect to OpenOCD
  2053. target remote $OPENOCD_HOST:$OPENOCD_PORT
  2054.  
  2055. # Flash the file if requested.
  2056. echo Flashing...\n
  2057. $LOAD_COMMAND
  2058.  
  2059. # Reset target
  2060. monitor slow_reset init
  2061.  
  2062. # Give a couple of harmless instruction step commands starting from
  2063. # the boot vector.  The first stepi is a workaround for this:
  2064. #
  2065. #   stepi ignored. GDB will now fetch the register state from the target.
  2066. #
  2067. # which is a GDB bug workaround in OpenOCD, preventing the app from
  2068. # starting on a "continue".  The subsequent ones are a workaround for
  2069. # an old sync problem that seems to have disappeared.
  2070. stepi
  2071. stepi
  2072. stepi
  2073.  
  2074. # Run until the test is done
  2075. thbreak cyg_test_exit
  2076. continue
  2077.  
  2078. # Cleanup & exit
  2079. shell rm $CMD
  2080. quit
  2081. EOF
  2082.  
  2083. exec $GDB --command=$CMD
  2084.  
  2085.  
  2086.  
  2087. Entry: OpenOCD hacking
  2088. Date: Thu Jun 23 14:47:31 CEST 2011
  2089.  
  2090. - add some exit mechanism to allow for a full restart
  2091. - "stepi ignored"
  2092. - gdb can't connect if probe fails (fixed: use gdb-attach -> reset init)
  2093. - what determines the PC after load/reset?  (ELF has entry point set)
  2094.  
  2095. Entry: ARM ELF Entry point
  2096. Date: Thu Jun 23 21:31:46 CEST 2011
  2097.  
  2098. It looks like load sets the entry point.  I.e. for my app the PC is
  2099. set to 0x110040.  Where is that data stored?  Using readelf it can be
  2100. retrieved:
  2101.  
  2102. $ arm-eabi-readelf -h <elf>
  2103. ELF Header:
  2104.   Magic:   7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00
  2105.   Class:                             ELF32
  2106.   Data:                              2's complement, little endian
  2107.   Version:                           1 (current)
  2108.   OS/ABI:                            UNIX - System V
  2109.   ABI Version:                       0
  2110.   Type:                              EXEC (Executable file)
  2111.   Machine:                           ARM
  2112.   Version:                           0x1
  2113.   Entry point address:               0x110040
  2114.   Start of program headers:          52 (bytes into file)
  2115.   Start of section headers:          981516 (bytes into file)
  2116.   Flags:                             0x4000002, has entry point, Version4 EABI
  2117.   Size of this header:               52 (bytes)
  2118.   Size of program headers:           32 (bytes)
  2119.   Number of program headers:         2
  2120.   Size of section headers:           40 (bytes)
  2121.   Number of section headers:         21
  2122.   Section header string table index: 18
  2123.  
  2124. According to [1] it's at the start of the file even:
  2125.  
  2126. $ hd example-format |head -n 2
  2127. 00000000  7f 45 4c 46 01 01 01 00  00 00 00 00 00 00 00 00  |.ELF............|
  2128. 00000010  02 00 28 00 01 00 00 00  40 00 11 00 34 00 00 00  |..([email protected]|
  2129.                                    ^^^^^^^^^^^
  2130.  
  2131. [1] http://vx.netlux.org/lib/static/vdat/tuunix02.htm
  2132.  
  2133. Entry: OpenOCD gdb-attach event
  2134. Date: Fri Jun 24 00:05:03 CEST 2011
  2135.  
  2136. # Reset target when gdb connects.  OpenOCD disconnects when a memory
  2137. # map is requested and it can't provide it because target comm is not
  2138. # setup correctly.
  2139. at91sam7s256.cpu configure -event gdb-attach {
  2140.     echo "Reset on gdb-attach."
  2141.     slow_reset init
  2142. }
  2143.  
  2144. [1] http://openocd.berlios.de/doc/html/CPU-Configuration.html
  2145.  
  2146.  
  2147. Entry: Cannot access memory at address 0xffffffff
  2148. Date: Fri Jun 24 00:55:12 CEST 2011
  2149.  
  2150. I get this error after many commands, including "set $pc = 0".
  2151.  
  2152. Seems to be because GDB requests that address.  I don't know where it
  2153. comes from.  When an image file is loaded it doesn't seem to be a
  2154. problem.
  2155.  
  2156. Switching on debug_level 3, the correct operation is:
  2157.  
  2158.  
  2159. Debug: 167 336068 gdb_server.c:2201 gdb_input_inner(): received packet: 'g'
  2160. Debug: 168 336068 gdb_server.c:2201 gdb_input_inner(): received packet: 'm0,4'
  2161. Debug: 169 336068 gdb_server.c:1278 gdb_read_memory_packet(): addr: 0x00000000, len: 0x00000004
  2162. Debug: 170 336068 target.c:1443 target_read_buffer(): reading buffer of 4 byte at 0x00000000
  2163. Debug: 171 336068 arm7_9_common.c:2270 arm7_9_read_memory(): address: 0x00000000, size: 0x00000004, count: 0x00000001
  2164.  
  2165.  
  2166. Actually this skips the register set operation, probably because the
  2167. $pc is already set to 0.  A register set looks like this:
  2168.  
  2169.  
  2170. Debug: 241 552998 gdb_server.c:2201 gdb_input_inner(): received packet: 'Pf=00000000'
  2171. Debug: 242 552998 gdb_server.c:1198 gdb_set_register_packet(): -
  2172.  
  2173.  
  2174. However, when there is no image loaded, GDB tries to read from 0xFFFFFFFF.
  2175.  
  2176.  
  2177. Debug: 567 761913 gdb_server.c:2201 gdb_input_inner(): received packet: 'mffffffff,1'
  2178. Debug: 568 761913 gdb_server.c:1278 gdb_read_memory_packet(): addr: 0xffffffff, len: 0x00000001
  2179. Debug: 569 761913 target.c:1443 target_read_buffer(): reading buffer of 1 byte at 0xffffffff
  2180. Debug: 570 761913 arm7_9_common.c:2270 arm7_9_read_memory(): address: 0xffffffff, size: 0x00000001, count: 0x00000001
  2181. Debug: 571 761916 gdb_server.c:2201 gdb_input_inner(): received packet: 'g'
  2182. Debug: 572 761916 gdb_server.c:2201 gdb_input_inner(): received packet: 'm0,4'
  2183. Debug: 573 761916 gdb_server.c:1278 gdb_read_memory_packet(): addr: 0x00000000, len: 0x00000004
  2184. Debug: 574 761916 target.c:1443 target_read_buffer(): reading buffer of 4 byte at 0x00000000
  2185. Debug: 575 761916 arm7_9_common.c:2270 arm7_9_read_memory(): address: 0x00000000, size: 0x00000004, count: 0x00000001
  2186. Debug: 576 761918 gdb_server.c:2201 gdb_input_inner(): received packet: 'mffffffff,1'
  2187. Debug: 577 761918 gdb_server.c:1278 gdb_read_memory_packet(): addr: 0xffffffff, len: 0x00000001
  2188. Debug: 578 761918 target.c:1443 target_read_buffer(): reading buffer of 1 byte at 0xffffffff
  2189. Debug: 579 761918 arm7_9_common.c:2270 arm7_9_read_memory(): address: 0xffffffff, size: 0x00000001, count: 0x00000001
  2190.  
  2191.  
  2192.  
  2193. Entry: gdb and low-level debugging
  2194. Date: Fri Jun 24 15:04:14 CEST 2011
  2195.  
  2196. Seems that GDB is really a source debugger.  I.e. the "disassemble"
  2197. command can't be used on bare code.  For that you need the "x" examine
  2198. command, i.e. "x/10i $pc" will examine 10 units of data at $pc and
  2199. interpret them as instructions.
  2200.  
  2201. The next problem I ran into is setting breakpoints at raw instructions
  2202. instead of symbolic labels.  Just using "break" or "thbreak" doesn't
  2203. work.  Actually it does, it just needs some special syntax[1]
  2204. (mnemonic: code is a dereferenced code pointer).
  2205.  
  2206.   break *0x0000f000
  2207.  
  2208. ( Related remark: it's possible to save current breakpoint
  2209. configuration as a script.  See "help breakpoints". )
  2210.  
  2211.  
  2212. [1] http://people.cs.uchicago.edu/~bomb154/154/maclabs/gdblab.html
  2213.  
  2214.  
  2215. Entry: gdb variable to register mapping
  2216. Date: Fri Jun 24 17:02:43 CEST 2011
  2217.  
  2218. Is it possible to print the variable->register mapping in gdb?
  2219.  
  2220. Entry: ARM calling conventions
  2221. Date: Fri Jun 24 18:56:56 CEST 2011
  2222.  
  2223. r0-r3   arguments + return value
  2224. r4-r11  local variables (callee must save)
  2225. r12     scratch
  2226. r13     sp
  2227. r14     lr
  2228. r15     pc
  2229.  
  2230. [1] http://en.wikipedia.org/wiki/Calling_convention#ARM
  2231.  
  2232.  
  2233. Entry: Arm and alginment
  2234. Date: Fri Jun 24 20:27:36 CEST 2011
  2235.  
  2236. It's imperative to properly align data storage on ARM.  A normal STR
  2237. instruction needs 4-byte align, STRH[1] needs 2-bytes align and STRB
  2238. needs 2-byte.
  2239.  
  2240. Note that it's very easy to make mistakes against this when you start
  2241. liberally casting void pointers to other types.  I spent a couple of
  2242. hours tracking down an obscure error that happened only in optimized
  2243. code.  Granted, it took so long to find because eCos data exception
  2244. handling just ignored the error, and that stepping through the
  2245. optimized code was nearly impossible due to heavy inlining
  2246. (spaghetti-izing).
  2247.  
  2248. [1] http://www.rz.uni-karlsruhe.de/rz/docs/VTune/reference/INST_STRH.htm
  2249.  
  2250.  
  2251.  
  2252. arm7_9 dcc_downloads enable
  2253. arm7_9 fast_memory_access enable
  2254.  
  2255.  
  2256. Entry: OpenOCD slow?  How to fix?
  2257. Date: Mon Jun 27 16:23:00 CEST 2011
  2258.  
  2259. [1] https://lists.berlios.de/pipermail/openocd-development/2011-June/019747.html
  2260.  
  2261.  
  2262.  
  2263. Entry: urjtag
  2264. Date: Mon Jun 27 16:33:31 CEST 2011
  2265.  
  2266. Another JTAG project[1].
  2267.  
  2268. [1] http://urjtag.org/
  2269.  
  2270.  
  2271.  
  2272. Entry: ARM-USB-OCD-H
  2273. Date: Mon Aug 22 10:54:59 CEST 2011
  2274.  
  2275. I'm using a ARM-USB-OCD which is detected:
  2276.  
  2277. Aug 22 10:55:45 zni kernel: [4122071.964298] usb 3-5.3: new full speed USB device using ehci_hcd and address 19
  2278. Aug 22 10:55:45 zni kernel: [4122072.063273] usb 3-5.3: New USB device found, idVendor=15ba, idProduct=0003
  2279. Aug 22 10:55:45 zni kernel: [4122072.063275] usb 3-5.3: New USB device strings: Mfr=1, Product=2, SerialNumber=0
  2280. Aug 22 10:55:45 zni kernel: [4122072.063278] usb 3-5.3: Product: Olimex OpenOCD JTAG
  2281. Aug 22 10:55:45 zni kernel: [4122072.063279] usb 3-5.3: Manufacturer: Olimex
  2282. Aug 22 10:55:45 zni kernel: [4122072.067085] usb 3-5.3: Ignoring serial port reserved for JTAG
  2283. Aug 22 10:55:45 zni kernel: [4122072.071532] ftdi_sio 3-5.3:1.1: FTDI USB Serial Device converter detected
  2284. Aug 22 10:55:45 zni kernel: [4122072.071565] usb 3-5.3: Detected FT2232C
  2285. Aug 22 10:55:45 zni kernel: [4122072.071567] usb 3-5.3: Number of endpoints 2
  2286. Aug 22 10:55:45 zni kernel: [4122072.071569] usb 3-5.3: Endpoint 1 MaxPacketSize 64
  2287. Aug 22 10:55:45 zni kernel: [4122072.071570] usb 3-5.3: Endpoint 2 MaxPacketSize 64
  2288. Aug 22 10:55:45 zni kernel: [4122072.071571] usb 3-5.3: Setting MaxPacketSize 64
  2289. Aug 22 10:55:45 zni kernel: [4122072.071935] usb 3-5.3: FTDI USB Serial Device converter now attached to ttyUSB2
  2290.  
  2291.  
  2292. Plugging in the identically looking ARM-USB-OCD-H however gives:
  2293.  
  2294. Aug 22 10:56:34 zni kernel: [4122120.341738] usb 3-5.3: new high speed USB device using ehci_hcd and address 20
  2295. Aug 22 10:56:34 zni kernel: [4122120.438456] usb 3-5.3: New USB device found, idVendor=15ba, idProduct=002b
  2296. Aug 22 10:56:34 zni kernel: [4122120.438458] usb 3-5.3: New USB device strings: Mfr=1, Product=2, SerialNumber=3
  2297. Aug 22 10:56:34 zni kernel: [4122120.438461] usb 3-5.3: Product: Olimex OpenOCD JTAG ARM-USB-OCD-H
  2298. Aug 22 10:56:34 zni kernel: [4122120.438462] usb 3-5.3: Manufacturer: Olimex
  2299. Aug 22 10:56:34 zni kernel: [4122120.438464] usb 3-5.3: SerialNumber: OLU9Z1AU
  2300.  
  2301. Looks like my kernel is too old.  Can't upgrade now, so let's just patch the current version.
  2302.  
  2303. /opt/src/linux-2.6.33.7-rt29/drivers/usb/serial:
  2304.  
  2305. ftdi_so_ids.h:
  2306. #define OLIMEX_ARM_USB_OCD_H_PID          0x002b
  2307.  
  2308. ftdi_sio.c:
  2309.       { USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_H_PID),
  2310.             .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
  2311.  
  2312.  
  2313. With this, and after setting the correct permissions (udev) it worked.
  2314. Had to use gcc-4.4 to compile my kernel though:   2.6.33.7-rt29
  2315.  
  2316.  
  2317. [1] https://lkml.org/lkml/2011/3/9/347
  2318.  
  2319.  
  2320. Entry: eCos boot
  2321. Date: Mon Aug 22 11:53:11 CEST 2011
  2322.  
  2323. => 0x0:     ldr   pc, [pc, #24]     ; 0x20
  2324.    0x4:     ldr   pc, [pc, #24]     ; 0x24
  2325.    0x8:     ldr   pc, [pc, #24]     ; 0x28
  2326.    0xc:     ldr   pc, [pc, #24]     ; 0x2c
  2327.  
  2328. This loads pc with the contents of vectors stored at the addresses
  2329. mentioned in the comments.  Why is the offset #24?
  2330.  
  2331. The reason is processor pipeline[1].  The pc is always 8 bytes ahead.
  2332.  
  2333. [1] http://www.keil.com/forum/16417/
  2334.  
  2335.  
  2336.  
  2337.  
  2338. Entry: Loading core files on ARM target
  2339. Date: Wed Jan  4 19:03:30 EST 2012
  2340.  
  2341. wget http://ftp.gnu.org/gnu/gdb/gdb-7.3.1.tar.bz2
  2342. tar xf gdb-7.3.1.tar.bz2
  2343. mkdir -p gdb-7.3.1/build/arm-eabi
  2344. cd gdb-7.3.1/build/arm-eabi
  2345. ../../configure --target=arm-eabi --enable-tui
  2346. make
  2347. sudo cp gdb/gdb /usr/local/bin/arm-eabi-gdb-7.3.1
  2348.  
  2349.  
  2350. ./gdb/corefile.c:77:
  2351.   if (core_target == NULL)
  2352.     error (_("GDB can't read core files on this machine."));
  2353.  
  2354.  
  2355.  
  2356. Entry: Loading binary code into ram
  2357. Date: Mon Jun  4 12:24:03 EDT 2012
  2358.  
  2359. Basically what I want to do is this:
  2360.  
  2361. - Load a firmware in Flash
  2362. - Load some extra code in Flash / RAM that can call into Flash.
  2363.  
  2364.  
  2365.  
  2366. Entry: Better GDB scripting
  2367. Date: Tue Jun  5 13:36:24 EDT 2012
  2368.  
  2369. I'm finding a lot of interesting things in Staapl about "host RPC",
  2370. where a very limitied target (small PIC uC) can recursively call code
  2371. on a host.  It would be nice to get this kind of workflow going in
  2372. GDB.
  2373.  
  2374.  
  2375. Entry: GDB hooks
  2376. Date: Tue Jul 31 17:32:32 EDT 2012
  2377.  
  2378. I want a simple mechanism to check if a certain breakpoint is hit and
  2379. if so, execute a function then continue.
  2380.  
  2381.  
  2382.  
  2383. Entry: OpenOCD
  2384. Date: Fri Nov 30 15:03:26 EST 2012
  2385.  
  2386. Trying again to use OpenOCD on AT91SAM7 board.
  2387. GIT SHA1 1a8223f28b2a459750b6dd9b867f4cec0c14a515
  2388.  
  2389. $ openocd --file interface/arm-usb-ocd.cfg  --file target/sam7x256.cfg
  2390.  
  2391.  
  2392. Entry: AT91SAM7 AIC
  2393. Date: Wed Dec 12 12:55:57 EST 2012
  2394.  
  2395. Source (23.6.3)
  2396. 0: FIQ pin
  2397. 1: SIQ system peripheral interrupt lines (system timer, RTC, PMC, MC, ...)
  2398. 2-31: PID2-PID31: embedded user peripheral / external interrupt lines
  2399.  
  2400. What's the difference between system/user peripheral?  E.g. PIO is a
  2401. user peripheral. The peripheral identification defined at the product
  2402. level corresponds to the interrupt source number.
  2403.  
  2404. For a peripheral table, see 10.2
  2405.  
  2406. Registers: (* = E/D or S/C)
  2407. AIC_SMR   source mode register
  2408. AIC_I*CR  interrupt enable/disable command register
  2409. AIC_I*CR  interrupt set/clear command register
  2410. AIC_IPR   interrupt pending
  2411. AIC_IVR   interrupt vector (read signals entry of ISR)
  2412. AIC_IMR   interrupt mask
  2413. AIC_ISR   current interrupt (p158)
  2414. AIC_CISR  nIRQ/nFIQ lines
  2415.           fast forcing
  2416. AIC_EOICR end of interrupt command register (to signal exit of ISR)
  2417. AIC_SVRn  source vector register n:1-31 (corresponds to AIC_IVR read)
  2418.  
  2419.  
  2420. The basic idea behind the AIC is to extend the ARM's simple
  2421. single-interrupt model to a multi-priority interrupt model by running
  2422. bulk of the ISR routines with arm IRQ enabled.
  2423.  
  2424. AIC enables fast vectored dispatch to allow for lower interrupt
  2425. latencies.  For such routines, care needs to be taken to complete the
  2426. AIC entry/exit in each routine.  The AIC uses a stack internally to
  2427. keep track of the current interrupt being served.  Entry/exit are
  2428. marked by r/w of AIC_IVR and AIC_EOICR.
  2429.  
  2430.  
  2431.  
  2432. [1] http://www.atmel.com/Images/doc6120.pdf
  2433.  
  2434.  
  2435.  
  2436.  
  2437. Entry: Disassembling raw ARM code
  2438. Date: Mon Jul 15 10:00:23 EDT 2013
  2439.  
  2440. Given a binary, how to get a disassembly dump on the command line?
  2441.  
  2442. It seems best to split this in 2 scripts:
  2443. - convert .bin -> arm .elf with .text section
  2444. - run objdump
  2445.  
  2446. arm-none-eabi-objcopy --input binary --output elf32-littlearm --binary-architecture arm --rename-section .data=.text in.bin out.elf
  2447. arm-none-eabi-objdump -D out.elf
  2448.  
  2449.  
  2450. Entry: at91lib USB
  2451. Date: Thu Jul 25 17:46:01 EDT 2013
  2452.  
  2453. at91lib is low-level without task switching.
  2454.  
  2455. Caveat: callbacks are invoked from the interrupt handler, so can't
  2456. call any code that depends on work done in the interrupt handler.
  2457.  
  2458.  
  2459.  
  2460. Entry: Disable / Enable interrupts
  2461. Date: Wed Aug 14 14:24:45 EDT 2013
  2462.  
  2463.         // disable
  2464.         asm("mrs r0, cpsr\n"
  2465.             "orr r0,r0,#0x80\n"
  2466.             "msr cpsr_c,r0\n"
  2467.             "mov r0,#1\n"
  2468.             "bx lr\n");
  2469.  
  2470.  
  2471.         // enable
  2472.         asm("mrs r0, cpsr\n"
  2473.             "bic r0,r0,#0x80\n"
  2474.             "msr cpsr_c,r0\n"
  2475.             "bx lr\n");
  2476.  
  2477.  
  2478. Entry: TI Tiva C Series TM4C123G eval board / EK-TM4C123GXL
  2479. Date: Sat Aug 17 23:49:24 EDT 2013
  2480.  
  2481. Looks like the board[1] has a USB JTAG interface (implemented using a
  2482. second identical micro!).  It seems this is a TI-ICDI supported by
  2483. openocd.
  2484.  
  2485. OpenOCD config is here[2].
  2486.  
  2487. ./configure \
  2488.    --enable-maintainer-mode \
  2489.    --enable-ft2232_libftdi \
  2490.    --enable-ti-icdi \
  2491.    --enable-jlink
  2492.  
  2493.  
  2494. [1] http://www.ti.com/tool/ek-tm4c123gxl
  2495. [2] http://e2e.ti.com/support/microcontrollers/tiva_arm/f/908/t/279223.aspx
  2496.  
  2497.  
  2498.  
  2499. Entry: Community ARM uC boards
  2500. Date: Fri Aug 23 12:48:22 EDT 2013
  2501.  
  2502. Time has come for "standard" platforms:
  2503.  
  2504. - Arduino Due
  2505. - TI Tiva C Launchpad
  2506.  
  2507. Arduino is interesting because it has a potential of being a real
  2508. standard.  I'm not a big fan of the IDE for personal use, but at least
  2509. there is a good patch point into the community as a library provider.
  2510.  
  2511. The TI launchpad is interesting because it is very cheap, and has
  2512. embedded JTAG.  Downside is that TI software cannot be freely
  2513. redistributed.  Though it does seem to have a eLua port.
  2514.  
  2515.  
  2516.  
  2517. Entry: uClinux
  2518. Date: Sun Aug 25 01:11:19 EDT 2013
  2519.  
  2520. On a STM32F437[1]?
  2521.  
  2522. I see.. That board[2] has 16MB PSRAM.
  2523. Not exactly in the 128kByte range :)
  2524.  
  2525. An article that deals with the question of why one would want to do
  2526. that, given that a chip with MMU is not exactly more expensive, and
  2527. that a M3/M4 is not designed to run over external memory interface
  2528. [3].
  2529.  
  2530. [1] https://www.youtube.com/watch?v=k9kKLjefeHM
  2531. [2] http://www.emcraft.com/products/224
  2532. [3] http://electronicdesign.com/embedded/practical-advice-running-uclinux-cortex-m3m4
  2533.  
  2534.  
  2535.  
  2536. Entry: Building Toolchains
  2537. Date: Fri Aug 30 03:07:31 EDT 2013
  2538.  
  2539. - sat https://github.com/esden/summon-arm-toolchain
  2540.  
  2541. I have one built on 2012-12-5, but according to the above this is no
  2542. longer under development. It refers to https://launchpad.net/gcc-arm-embedded
  2543.  
  2544. - crosstool-ng http://crosstool-ng.org/
  2545.  
  2546. Trying this now..  Failed:
  2547.  
  2548. [ERROR]    checking for suffix of object files... configure: error: in `/home/tom/ct-ng/.build/arm-unknown-eabi/build/build-cc-core-pass-2/arm-unknown-eabi/libgcc':
  2549. [ERROR]    configure: error: cannot compute suffix of object files: cannot compile
  2550. [ERROR]    make[1]: *** [configure-target-libgcc] Error 1
  2551. http://gcc.gnu.org/wiki/FAQ#Configuration_fails_with_.27.27configure:_error:_cannot_compute_suffix_of_object_files:_cannot_compile.27.27._What_is_the_problem.3F
  2552.  
  2553. /home/tom/ct-ng/.build/arm-unknown-eabi/build/build-cc-core-pass-2/arm-unknown-eabi/libgcc/config.log:
  2554.  
  2555. conftest.c: In function 'main':
  2556. conftest.c:12:1: sorry, unimplemented: Thumb-1 hard-float VFP ABI
  2557.  
  2558. Weird..  Should I pick a different float arch?
  2559. Linaro has hardfloat thumb?  Trying latest..
  2560. http://crosstool-ng.org/download/ibot-logs/2012-10-07.html
  2561.  
  2562. - cortex m4 hardfloat toolchain:
  2563.  
  2564. https://github.com/prattmic/arm-cortex-m4-hardfloat-toolchain
  2565. Also recommends to look at gcc-arm-embedded
  2566.  
  2567.  
  2568. - https://launchpad.net/gcc-arm-embedded
  2569. GCC dev by ARM employees.
  2570.  
  2571. It does hardfloat:
  2572.  
  2573. [email protected]:/tmp$ ~/gcc-arm-embedded/gcc-arm-none-eabi-4_7-2013q2/bin/arm-none-eabi-gcc -O3 -ffast-math -mfpu=vfp -mfloat-abi=hard -mthumb -mcpu=cortex-m4 -c test.c
  2574. [email protected]:/tmp$ ~/gcc-arm-embedded/gcc-arm-none-eabi-4_7-2013q2/bin/arm-none-eabi-objdump -d test.o
  2575.  
  2576. test.o:     file format elf32-littlearm
  2577.  
  2578.  
  2579. Disassembly of section .text:
  2580.  
  2581. 00000000 <test>:
  2582.    0:   eddf 7a02       vldr    s15, [pc, #8]   ; c <test+0xc>
  2583.    4:   ee30 0a27       vadd.f32        s0, s0, s15
  2584.    8:   4770            bx      lr
  2585.    a:   bf00            nop
  2586.    c:   42f60000        .word   0x42f60000
  2587.  
  2588.  
  2589.  
  2590.  
  2591. So, these options are necessary:
  2592. -mcpu=cortex-m4
  2593. -mthumb           enables thumb-2 mode
  2594. -mfloat-abi=hard  since not all M4 have hard float
  2595.  
  2596.  
  2597.  
  2598.  
  2599. Entry: Paul Stoffregen
  2600. Date: Tue Sep  3 19:10:13 EDT 2013
  2601.  
  2602. http://www.kickstarter.com/profile/paulstoffregen
  2603. http://www.dorkbotpdx.org/blog/paul
  2604. http://www.youtube.com/user/PaulStoffregen
  2605. https://twitter.com/PaulStoffregen
  2606.  
  2607.  
  2608. Entry: Teensy 3.0 - STM Cortex M4
  2609. Date: Wed Sep  4 20:33:21 EDT 2013
  2610.  
  2611. No JTAG though..  Too bad.
  2612. Looks like it's the TI M4 boards are more interesting at this point.
  2613.  
  2614. http://hackaday.com/2012/09/05/meet-the-teensy-3-0/
  2615.  
  2616.  
  2617. Entry: Trying out Tivaware
  2618. Date: Sat Sep  7 17:12:45 EDT 2013
  2619.  
  2620. With arm-none-eabi-* binaries[1] in the path, things seem to work out
  2621. of the box:
  2622.  
  2623. $ cd tivaware/examples/boards/ek-tm4c123gxl/freertos_demo
  2624. $ make
  2625. $ file gcc/freertos_demo.axf
  2626. gcc/freertos_demo.axf: ELF 32-bit LSB executable, ARM, version 1 (SYSV), statically linked, not stripped
  2627.  
  2628.  
  2629. Let's see if there's a simpler example: blinky.c in:
  2630. $ cd tivaware/examples/boards/ek-tm4c123gxl/blinky
  2631.  
  2632. It has a very simple main file.  Where is the chip startup?  Ah, in
  2633. startup_gcc.c - check linker flag "--entry ResetISR".
  2634.  
  2635. using blinky.ld, gnu ld links:
  2636. - blinky.o
  2637. - startup_gcc.o
  2638. - libm.a
  2639. - libc.a
  2640. - libgcc.a
  2641.  
  2642. ( Makefile finds libc.a ... using
  2643.   arm-none-eabi-gcc print-file-name=libc.a )
  2644.  
  2645. The output .axf is just an ELF.
  2646.  
  2647. The startup_gcc.c file seems to have the "viral" clause license..
  2648. From what I read this is probably not a problem in practice.
  2649.  
  2650. Startup does:
  2651.   - ISR vector setup (different than ARMv5 ?)
  2652.   - RAM data,bss setup
  2653.   - Float unit setup
  2654.   - main()
  2655.  
  2656. Let's try to upload it.
  2657. $ openocd --version
  2658. Open On-Chip Debugger 0.8.0-dev-00120-gc93d28d-dirty (2013-08-18-00:30)
  2659.  
  2660.  
  2661. # M-x gdb
  2662. ~/tm4c/gdb -i=mi /opt/xc/tivaware/examples/boards/ek-tm4c123gxl/blinky/gcc/blinky.axf
  2663.  
  2664. After fixing some gdb/emacs problems that required updates, it does
  2665. seem that the "load" command worked as the led is blinking:
  2666.  
  2667. mon reset
  2668. mon halt
  2669.  
  2670.  
  2671. Though there are some problems:
  2672.  
  2673. - first time around, "load" didn't work
  2674. - can't write to PC?
  2675.  
  2676. p $pc
  2677. $5 = (void (*)()) 0x28f <main+35>
  2678. set $pc = 0
  2679. p $pc
  2680. $6 = (void (*)()) 0x1 <g_pfnVectors+1>
  2681.  
  2682.  
  2683. [1] https://launchpad.net/gcc-arm-embedded
  2684.  
  2685.  
  2686. Entry: Cortex M4 boot?
  2687. Date: Sat Sep  7 18:57:58 EDT 2013
  2688.  
  2689. Does a M4 boot differently than an ARM 7 TDMI?
  2690.  
  2691.   From [1]: ...the vector table at 0 is actually a table of vectors
  2692.     (pointers), not instructions. The first entry contains the
  2693.     start-up value for the SP register, the second is the reset
  2694.     vector. This allows writing the reset handler directly in C, since
  2695.     the processor sets up the stack.
  2696.  
  2697. __Vectors       DCD     __initial_sp              ; Top of Stack
  2698.                 DCD     Reset_Handler             ; Reset Handler
  2699.                 DCD     NMI_Handler               ; NMI Handler
  2700.                 DCD     HardFault_Handler         ; Hard Fault Handler
  2701.                 DCD     MemManage_Handler         ; MPU Fault Handler
  2702.                 DCD     BusFault_Handler          ; Bus Fault Handler
  2703.                 DCD     UsageFault_Handler        ; Usage Fault Handler
  2704.                 [...more vectors...]
  2705.  
  2706. [1] http://stackoverflow.com/questions/6139952/what-is-the-booting-process-for-arm
  2707.  
  2708.  
  2709.  
  2710. Entry: PC odd addresses?
  2711. Date: Sat Sep  7 19:07:13 EDT 2013
  2712.  
  2713. Why are PC addresses odd?
  2714. It seems this indicates thumb mode.
  2715.  
  2716. [1] http://stackoverflow.com/questions/15764833/indirect-function-call-uses-odd-address
  2717.  
  2718.  
  2719. Entry: Cheat sheet
  2720. Date: Sat Sep  7 19:50:00 EDT 2013
  2721.  
  2722. [1] http://infocenter.arm.com/help/topic/com.arm.doc.qrc0001l/QRC0001_UAL.pdf
  2723. [2] http://simplemachines.it/doc/arm_inst.pdf
  2724.  
  2725.  
  2726. Entry: Cortex M4
  2727. Date: Sat Sep  7 20:44:33 EDT 2013
  2728.  
  2729. http://www.eejournal.com/archives/articles/20100223-cortex/
  2730.  
  2731.  
  2732. Entry: ARM DSP intrinsics
  2733. Date: Sun Sep  8 19:48:05 EDT 2013
  2734.  
  2735. Goes GCC support this?  According to [3] it doesn't.
  2736.  
  2737. Does LLVM support it?
  2738.  
  2739. Looks like the general idea is that I'm going to have to do this in
  2740. asm.  Maybe this is a good excuse to learn about register allocation
  2741. and some other compiler optimization techniques.
  2742.  
  2743. But first, learn the asm.
  2744.  
  2745.  
  2746. [1] http://www.iar.com/About/Blog/2012/1/Designing-advanced-DSP-applications/
  2747. [2] http://stackoverflow.com/questions/9828567/arm-neon-intrinsics-vs-hand-assembly
  2748. [3] http://stackoverflow.com/questions/14188262/how-to-enable-intrinsics-in-compiler
  2749.  
  2750.  
  2751.  
  2752. Entry: Running Cortex-M4 DSP code on QEMU
  2753. Date: Mon Sep 16 19:50:35 EDT 2013
  2754.  
  2755. The Cortex-M4 is not supported directly.  However, it seems that the
  2756. DSP instruction set is supported in ARM mode, at least just using
  2757. arm-none-eabi-gcc on "qadd r1,r2,r3" produces:
  2758.  
  2759. 00000000 <.text>:
  2760.    0: e1031052    qadd  r1, r2, r3
  2761.  
  2762. As opposed to "-mcpu=cortex-m4 -mthumb" :
  2763.  
  2764. 00000000 <.text>:
  2765.    0: fa83 f182   qadd  r1, r2, r3
  2766.  
  2767.  
  2768. Let's see if qemu in plain arm mode executes the first one.
  2769.  
  2770.   ... DSP instructions were added to the set. These are signified by
  2771.   an "E" in the name of the ARMv5TE and ARMv5TEJ architectures[1].
  2772.  
  2773. Qemu supports:
  2774.  
  2775. $ qemu-system-arm -cpu ?
  2776. Available CPUs:
  2777.   arm1026
  2778.   arm1136
  2779.   arm1136-r2
  2780.   arm1176
  2781.   arm11mpcore
  2782.   arm926
  2783.   arm946
  2784.   cortex-a15
  2785.   cortex-a8
  2786.   cortex-a9
  2787.   cortex-m3
  2788.   pxa250
  2789.   pxa255
  2790.   pxa260
  2791.   pxa261
  2792.   pxa262
  2793.   pxa270-a0
  2794.   pxa270-a1
  2795.   pxa270
  2796.   pxa270-b0
  2797.   pxa270-b1
  2798.   pxa270-c0
  2799.   pxa270-c5
  2800.   sa1100
  2801.   sa1110
  2802.   ti925t
  2803.   any
  2804.  
  2805. For GCC it's -mcpu=name:
  2806.  
  2807.   This specifies the name of the target ARM processor.  GCC uses this
  2808.   name to determine what kind of instructions it can emit when
  2809.   generating assembly code.  Permissible names are: arm2, arm250,
  2810.   arm3, arm6, arm60, arm600, arm610, arm620, arm7, arm7m, arm7d,
  2811.   arm7dm, arm7di, arm7dmi, arm70, arm700, arm700i, arm710, arm710c,
  2812.   arm7100, arm720, arm7500, arm7500fe, arm7tdmi, arm7tdmi-s, arm710t,
  2813.   arm720t, arm740t, strongarm, strongarm110, strongarm1100,
  2814.   strongarm1110, arm8, arm810, arm9, arm9e, arm920, arm920t, arm922t,
  2815.   arm946e-s, arm966e-s, arm968e-s, arm926ej-s, arm940t, arm9tdmi,
  2816.   arm10tdmi, arm1020t, arm1026ej-s, arm10e, arm1020e, arm1022e,
  2817.   arm1136j-s, arm1136jf-s, mpcore, mpcorenovfp, arm1156t2-s,
  2818.   arm1156t2f-s, arm1176jz-s, arm1176jzf-s, cortex-a5, cortex-a7,
  2819.   cortex-a8, cortex-a9, cortex-a15, cortex-r4, cortex-r4f, cortex-r5,
  2820.   cortex-m4, cortex-m3, cortex-m1, cortex-m0, xscale, iwmmxt, iwmmxt2,
  2821.   ep9312, fa526, fa626, fa606te, fa626te, fmp626, fa726te.
  2822.  
  2823. So, pick the simplest one with an 'E' in it.  Don't want an elaborate
  2824. boot massaging process..
  2825.  
  2826. Maybe -cpu=any is good for qemu?
  2827.  
  2828. So both cortex-a8 and cortex-a9 seem to work in ARM and THUMB mode.
  2829.  
  2830. [1] http://en.wikipedia.org/wiki/ARM_architecture#DSP_enhancement_instructions
  2831.  
  2832.  
  2833.  
  2834. Entry: Semihosting exit
  2835. Date: Mon Sep 16 20:51:14 EDT 2013
  2836.  
  2837. Semihisting SYS_EXIT.  See [1].
  2838.  
  2839. [1] http://lists.nongnu.org/archive/html/qemu-devel/2013-08/msg03889.html
  2840.  
  2841.  
  2842. Entry: Inline asm
  2843. Date: Mon Sep 16 21:32:15 EDT 2013
  2844.  
  2845. [1] http://www.ibiblio.org/gferg/ldp/GCC-Inline-Assembly-HOWTO.html
  2846.  
  2847.  
  2848. Entry: DSP instructions
  2849. Date: Mon Sep 16 21:41:51 EDT 2013
  2850.  
  2851. saturating and multiply instructions:
  2852.  
  2853. http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0489c/Cihddjgg.html
  2854. http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0489c/Cihjfeii.html
  2855.  
  2856.  
  2857. Entry: M0 vs M3
  2858. Date: Thu Sep 19 20:25:40 EDT 2013
  2859.  
  2860.   Asked when someone might need to move to 32bit from 8 or 16bit, York
  2861.   said, “The protocol stack for ZigBee is atrocious on an 8bit
  2862.   core. It is the same with USB and Bluetooth, and if an ADC is 16bit,
  2863.   you are going to want 32bits to manipulate the data without
  2864.   overflowing.”
  2865.  
  2866. http://www.electronicsweekly.com/news/components/microprocessors-and-dsps/arms-cortex-m0-processor-how-it-works-2009-03/
  2867.  
  2868.  
  2869. Entry: Debian on Beagleboard xM
  2870. Date: Thu Sep 26 18:43:31 EDT 2013
  2871.  
  2872. Got debian installed through:
  2873. http://elinux.org/BeagleBoardDebian
  2874. 2013-08-26 image
  2875.  
  2876. Though there are problems when netload gets high: USB gives up.
  2877. ( Board has ethernet connector setup through USB instead of the SoC. )
  2878.  
  2879. Found a couple of references to this:
  2880. https://groups.google.com/forum/#!topic/beagleboard/ji8SiHrzC2Y
  2881.  
  2882. How to solve?
  2883.  
  2884. EDIT: Might just be power supply.  I had it powered over USB, but it
  2885. probably takes more than 500mA.  It seems to run fine on a 2A DC
  2886. adapter.
  2887.  
  2888.  
  2889.  
  2890. Entry: qemu osmocom
  2891. Date: Sun Nov 24 08:39:45 EST 2013
  2892.  
  2893. http://git.osmocom.org/qemu
  2894.  
  2895. Trouble with texinfo 5.2, so doing this:
  2896.  
  2897. ./configure --disable-docs --disable-user --target-list=arm-softmmu
  2898.  
  2899. In the diff I see no reference to any command line flag that enables
  2900. this particular machine.  What does `machine_init' do?
  2901.  
  2902. Also patch config-host.mak:
  2903.  
  2904. Add -lrt to LIBS_QGQ and LIBS
  2905.  
  2906. remove -Werror from QEMU_CFLAGS
  2907.  
  2908. compiles.. result is in
  2909. arm-softmmu/qemu-system-arm
  2910.  
  2911. now how does that extension work?
  2912.  
  2913.  
  2914. Start with this:
  2915.  
  2916. static void cc32_register_types(void)
  2917. {
  2918.       type_register_static(&cc32_sysc_info);
  2919.       type_register_static(&cc32_flcon_info);
  2920. }
  2921.  
  2922. type_init(cc32_register_types)
  2923.  
  2924.  
  2925.  
  2926.  
  2927. Entry: qemu primer
  2928. Date: Sun Nov 24 10:23:47 EST 2013
  2929.  
  2930. - modules are registered through init functions defined in module.h :
  2931.  
  2932. #define block_init(function) module_init(function, MODULE_INIT_BLOCK)
  2933. #define machine_init(function) module_init(function, MODULE_INIT_MACHINE)
  2934. #define qapi_init(function) module_init(function, MODULE_INIT_QAPI)
  2935. #define type_init(function) module_init(function, MODULE_INIT_QOM)
  2936.  
  2937. Probably best to start reading here:
  2938.  
  2939. http://qemu.weilnetz.de/qemu-tech.html
  2940. http://wiki.qemu.org/Documentation/GettingStartedDevelopers
  2941.  
  2942.  
  2943. Starting from the CC32RS512 diff, it might be good to add a memory
  2944. mapped I/O for debug output.  This would give a good idea of how
  2945. virtual devices work.
  2946.  
  2947. Relevant calls/macros for the CC32 SYSC emulation:
  2948.  
  2949. type_init(cc32_register_types)
  2950. type_register_static(&cc32_sysc_info);
  2951. cc32_sysc_class_init()
  2952. DEVICE_CLASS()
  2953. SYS_BUS_DEVICE_CLASS()
  2954. cc32_sysc_init
  2955. cc32_sysc_reset
  2956. FROM_SYSBUS()
  2957. qdev_init_gpio_in()
  2958. sysbus_init_irq()
  2959. memory_region_init_io()
  2960. sysbus_init_mmio()
  2961. container_of()
  2962. sysbus_create_varargs() / sysbus_create_simple()
  2963.  
  2964.  
  2965.  
  2966. Datastructures first.
  2967.  
  2968. static void cc32_sysc_reset(DeviceState *d) {
  2969.       cc32_sysc_state *s = container_of(d, cc32_sysc_state, busdev.qdev);
  2970.         ...
  2971. }
  2972.  
  2973. This recovers larger scope for "inlined" C data structures,
  2974. i.e. find s such that &(s->busdev.qdev) == d
  2975.  
  2976. This avoids having to store back-pointers.
  2977.  
  2978. struct cc32_sysc_state {
  2979.         ...
  2980.         SysBusDevice busdev;
  2981.         ...
  2982. };
  2983. struct SysBusDevice {
  2984.         ...
  2985.         DeviceState  qdev;
  2986.         ...
  2987. };
  2988.  
  2989.  
  2990.  
  2991. Entry: Qemu minimal build
  2992. Date: Fri Dec  6 10:09:16 EST 2013
  2993.  
  2994. FIXME: Tried a from scratch LXC Debian wheezy VM.  Doesn't seem to
  2995. have the necessary packages..
  2996.  
  2997. Minimal build for ARM embedded dev.
  2998.  
  2999. apt-get install libpixman-1-dev pkg-config libz-dev libglib2.0-dev
  3000.  
  3001. ./configure --disable-docs --disable-user --target-list=arm-softmmu
  3002.  
  3003. [1] http://www.linuxforu.com/2011/06/qemu-for-embedded-systems-development-part-1/
  3004.  
  3005.  
  3006.  
  3007. Entry: Minimal qemu
  3008. Date: Fri Dec  6 11:45:25 EST 2013
  3009.  
  3010. ## list of things to disable
  3011. # ./configure --help |grep disable |awk -e '{print $1}'
  3012. # ./configure --help|grep list
  3013.  
  3014. ## Don't disable:
  3015. # --disable-system
  3016.  
  3017.  
  3018. ./configure --target-list=arm-softmmu \
  3019. --audio-drv-list= \
  3020. --audio-card-list= \
  3021. --disable-debug-tcg \
  3022. --disable-sparse \
  3023. --disable-strip \
  3024. --disable-werror \
  3025. --disable-sdl \
  3026. --disable-virtfs \
  3027. --disable-vnc \
  3028. --disable-xen \
  3029. --disable-brlapi \
  3030. --disable-vnc-tls \
  3031. --disable-vnc-sasl \
  3032. --disable-vnc-jpeg \
  3033. --disable-vnc-png \
  3034. --disable-vnc-thread \
  3035. --disable-curses \
  3036. --disable-curl \
  3037. --disable-fdt \
  3038. --disable-bluez \
  3039. --disable-slirp \
  3040. --disable-kvm \
  3041. --disable-nptl \
  3042. --disable-system \
  3043. --disable-user \
  3044. --disable-linux-user \
  3045. --disable-darwin-user \
  3046. --disable-bsd-user \
  3047. --disable-guest-base \
  3048. --disable-pie \
  3049. --disable-uuid \
  3050. --disable-vde \
  3051. --disable-linux-aio \
  3052. --disable-cap-ng \
  3053. --disable-attr \
  3054. --disable-blobs \
  3055. --disable-docs \
  3056. --disable-vhost-net \
  3057. --disable-spice \
  3058. --disable-libiscsi \
  3059. --disable-smartcard \
  3060. --disable-smartcard-nss \
  3061. --disable-usb-redir \
  3062. --disable-guest-agent
  3063.  
  3064.  
  3065.  
  3066. Entry: set $pc = 0  on ARM7TMDI
  3067. Date: Fri Dec  6 12:58:42 EST 2013
  3068.  
  3069. About the ARM pipeline.  This is a bit confusing.  It's interesting
  3070. how this confusion has lasted so long..
  3071.  
  3072. Up to this point I seem to recall always reading asm code such that
  3073. the current $pc -- annotated by '=>' in asm dump (e.g. x/10i) --
  3074. points to the current instruction.  However, the instruction that's
  3075. executing is actually 3 instructions back.
  3076.  
  3077. Now the funny thing is that r1 after this:
  3078.  
  3079.     mov r1, pc
  3080.  
  3081. is 20 (0x14) bytes past the address of the instruction.  How is that?
  3082.  
  3083. The reason might be that qemu is not emulating the ARM7TDMI but is
  3084. using -cpu arm926 by default.  It seems that pc-relative addressing is
  3085. standardized across designs with different pipeline depths, but
  3086. register moves are not?
  3087.  
  3088. 20 bytes is 5 instructions.  Is this the 5-stage pipeline?  Shouln't
  3089. it be one byte less in that case?
  3090.  
  3091.  
  3092.  
  3093. Entry: Adding a register-mapped QEMU device
  3094. Date: Sat Dec  7 09:50:54 EST 2013
  3095.  
  3096. 1. Build system
  3097.  
  3098. Create file hw/zwizwa.c
  3099.  
  3100. Add a reference to Makefile.target:
  3101. obj-arm-y += zwizwa.o
  3102.  
  3103.  
  3104. 2. In .c file, register objects:
  3105.  
  3106. #include <stdio.h>
  3107. #include "module.h"
  3108. static void zwizwa_register_types(void) {
  3109.     printf("zwizwa_register_types\n");
  3110. }
  3111. type_init(zwizwa_register_types)
  3112.  
  3113.  
  3114. 3. Call type_register_static on TypInfo struct
  3115.  
  3116. #include "module.h"
  3117. #include "sysbus.h"
  3118. #include "qemu/object.h"
  3119. typedef struct {
  3120. } zwizwa_debug_state;
  3121. static void zwizwa_debug_class_init(ObjectClass *klass, void *data) {
  3122. }
  3123. static TypeInfo zwizwa_debug_info = {
  3124.     .name          = "zwizwa-debug",
  3125.     .parent        = TYPE_SYS_BUS_DEVICE,
  3126.     .instance_size = sizeof(zwizwa_debug_state),
  3127.     .class_init    = zwizwa_debug_class_init,
  3128. };
  3129. static void zwizwa_register_types(void) {
  3130.     type_register_static(&zwizwa_debug_info);
  3131. }
  3132. type_init(zwizwa_register_types)
  3133.  
  3134.  
  3135. 4. Implement ObjectClass init method
  3136.  
  3137. This needs a little explanation of the class system.  What I can
  3138. gather, the hierarchy is:
  3139.  
  3140. object -> device -> sys-bus-device
  3141.  
  3142. For this type, there are two methods to register:
  3143.  
  3144. static int zwizwa_debug_init(SysBusDevice *dev){
  3145.     return 0;
  3146. }
  3147. static void zwizwa_debug_reset(DeviceState *d){
  3148. }
  3149. static void zwizwa_debug_class_init(ObjectClass *klass, void *data) {
  3150.     DeviceClass *dc = DEVICE_CLASS(klass);
  3151.     SysBusDeviceClass *sdc = SYS_BUS_DEVICE_CLASS(klass);
  3152.     sdc->init = zwizwa_debug_init;
  3153.     dc->reset = zwizwa_debug_reset;
  3154. }
  3155.  
  3156. Here DEVICE_CLASS() and SYS_BUS_DEVICE_CLASS() are dynamic casts with
  3157. type checking:
  3158.  
  3159. #define DEVICE_CLASS(klass) OBJECT_CLASS_CHECK(DeviceClass, (klass), TYPE_DEVICE)
  3160. #define TYPE_DEVICE "device"
  3161. #define OBJECT_CLASS(class) ((ObjectClass *)(class))
  3162. #define OBJECT_CLASS_CHECK(class, obj, name) \
  3163.     ((class *)object_class_dynamic_cast_assert(OBJECT_CLASS(obj), (name)))
  3164.  
  3165. with object_ function implemented in object.c
  3166. That file seems to be quite recent:
  3167.  
  3168.  * Copyright IBM, Corp. 2011
  3169.  *
  3170.  * Authors:
  3171.  *  Anthony Liguori   <[email protected]>
  3172.  *
  3173.  
  3174.  
  3175.  
  3176.  
  3177. 5. Nested objects
  3178.  
  3179. From the use of container_of(), it seems that much of QEMU's data
  3180. structures are organized as composite flat objects (as opposed to
  3181. objects pointing to other objects).  I'm guessing this macro
  3182. originates in the Linux source[1].
  3183.  
  3184. Using a flat representation makes ownership relationships very clear
  3185. and makes it possible to traverse the structure hierarchy in two
  3186. directions without extra bookkeeping (e.g. reverse pointers).
  3187.  
  3188.    - down: C structure member dereference
  3189.  
  3190.    - up:   container_of(member_ptr, parent_type, member_name)
  3191.  
  3192.  
  3193.  
  3194.  
  3195. 6. Access to objects in init / reset.
  3196.  
  3197. static int zwizwa_debug_init(SysBusDevice *dev){
  3198.     zwizwa_debug_state *s = FROM_SYSBUS(typeof(*s), dev);
  3199.     // ...
  3200.     return 0;
  3201. }
  3202. static void zwizwa_debug_reset(DeviceState *d){
  3203.     zwizwa_debug_state *s = container_of(d, typeof(*s), busdev.qdev);
  3204.     // ...
  3205. }
  3206.  
  3207.  
  3208. From the CC32RS512 example, the FROM_SYSBUS macro is used to convert a
  3209. SysBusDevice pointer to the full object.  Note that this is also a
  3210. container_of() style macro.
  3211.  
  3212. #define FROM_SYSBUS(type, dev) DO_UPCAST(type, busdev, dev)
  3213. #define DO_UPCAST(type, field, dev) container_of(dev, type, field)
  3214.  
  3215. In the FROM_SYSBUS definition, the field name "busdev" is fixed, so we
  3216. need to make sure we have that in our state structure:
  3217.  
  3218. typedef struct zwizwa_debug_state {
  3219.     SysBusDevice busdev;
  3220. }
  3221.  
  3222. Actually, this seems deprecated[2]: use your own macro based on OBJECT_CHECK()
  3223.  
  3224. For reset, need to know that this is a device method, so we go up one
  3225. more in the hierarchy.
  3226.  
  3227.  
  3228.  
  3229. 7. Implement init / reset.
  3230.  
  3231. Some relevant calls from the CC32RS512 module:
  3232.  
  3233. qdev_init_gpio_in()
  3234. memory_region_init_io()
  3235. sysbus_init_irq()
  3236. sysbus_init_mmio()
  3237.  
  3238. For this example we only use memory mapped io:
  3239.  
  3240. typedef struct {
  3241.     SysBusDevice busdev;
  3242.     MemoryRegion iomem;
  3243. } zwizwa_debug_state;
  3244. static uint64_t zwizwa_debug_read(void *opaque, target_phys_addr_t offset, unsigned size) {
  3245.     return 0;
  3246. }
  3247. static void zwizwa_debug_write(void *opaque, target_phys_addr_t offset, uint64_t value, unsigned size) {
  3248.     printf("%08x <- %08x\n", (unsigned int)offset, (unsigned int)value);
  3249. }
  3250. static const MemoryRegionOps zwizwa_debug_ops = {
  3251.     .read  = zwizwa_debug_read,
  3252.     .write = zwizwa_debug_write,
  3253.     .endianness = DEVICE_NATIVE_ENDIAN,
  3254. };
  3255. static int zwizwa_debug_init(SysBusDevice *dev){
  3256.     zwizwa_debug_state *s = FROM_SYSBUS(typeof(*s), dev);
  3257.     memory_region_init_io(&s->iomem, &zwizwa_debug_ops, s, "zwizwa-debug", 4);
  3258.     sysbus_init_mmio(dev, &s->iomem);
  3259.     return 0;
  3260. }
  3261.  
  3262.  
  3263. 8. Instantiate
  3264.  
  3265. Called from machine init:
  3266.  
  3267. sysbus_create_varargs("zwizwa-debug", 0x0FF000, NULL);
  3268.  
  3269.  
  3270. [1] http://stackoverflow.com/questions/15832301/understanding-container-of-macro-in-linux-kernel
  3271. [2] http://osdir.com/ml/qemu-devel/2013-07/msg05332.html
  3272.  
  3273.  
  3274.  
  3275.  
  3276. Entry: QEMU i/o write prob
  3277. Date: Sat Dec  7 12:26:08 EST 2013
  3278.  
  3279. Somehow the code above doesn't work..  Time to trace it.
  3280. It works from ASM:
  3281.  
  3282.         mov     r0,     #0x10000
  3283.         str     r0,     [r0]
  3284.  
  3285. But not from GDB:
  3286.  
  3287. (gdb) set *0x10000 = 123
  3288.  
  3289. Weird..  Is this a qemu gdb stub problem?  Let's trace it down.
  3290.  
  3291. In gdbstub.c everything goes through:
  3292. target_memory_rw_debug()
  3293.  
  3294. which calls:
  3295. cpu_memory_rw_debug() in exec.c line 4527
  3296.  
  3297. it's because is_ram_rom_romd() returns false
  3298.  
  3299. Qs:
  3300. - should is_ram_rom_romd() return true for i/o memory?
  3301. - why does it return different values for 2 separate calls?  -> it doesn't
  3302.  
  3303. it seems i/o memory is simply excluded in gdbstub
  3304.  
  3305.  
  3306.  
  3307.  
  3308. Entry: libfdt
  3309. Date: Sat Dec  7 13:33:55 EST 2013
  3310.  
  3311. device tree compiler
  3312. http://ozlabs.org/~dgibson/
  3313.  
  3314.  
  3315. Entry: GDB stepping on qemu VM.
  3316. Date: Sat Dec  7 14:15:11 EST 2013
  3317.  
  3318. Something isn't right...
  3319. Tried with more recent QEMU and it doesn't seem to have this problem.
  3320.  
  3321. It executs the instruction at $pc, not the one 3 instructions back
  3322.  
  3323. It would be interesting to find out on the mailing list what exactly
  3324. happened here..
  3325.  
  3326. Conclusion is that single-stepping an ARM doesn't seem so well-defined!
  3327.  
  3328. Last merge was:
  3329. 2012-03-03 5a30d3f19d9c6d135bf7a395a24dc455698d5cf9
  3330.  
  3331. That's a lot of patches..  Cursory glance didn't find antying.
  3332.  
  3333.  
  3334. Hmmm... I wonder if I just disabled it?
  3335.  
  3336.  
  3337.  
  3338.  
  3339. Entry: Moving to new QEMU
  3340. Date: Sat Dec  7 15:26:45 EST 2013
  3341.  
  3342. Some things have shifted around since 2012-03-03.
  3343.  
  3344. Probably best to first merge the zwizwa stuff, then merge the
  3345. CC32RS512.
  3346.  
  3347. EDIT: zwizwa stuff done.
  3348.  
  3349. Tried the pipeline thing and now both instructions have pc pointing 2
  3350. instructions ahead.  Looks like the previous behavior was just a bug.
  3351.  
  3352.  
  3353.    0x3c <InitReset>:    mov   r0, pc          ; loads 0x44
  3354. => 0x40 <InitReset+4>:  ldr   r0, [pc]    ; 0x48 <InitReset+12>
  3355.  
  3356.  
  3357.  
  3358. Entry: Extending QEMU with a new processor target
  3359. Date: Wed Dec 11 13:14:13 EST 2013
  3360.  
  3361. How to do this?  Let's dive into the source:
  3362.  
  3363. target-arm/cpu.c
  3364.  
  3365. static const ARMCPUInfo arm_cpus[] = {
  3366.     ...
  3367.     { .name = "cortex-m3",   .initfn = cortex_m3_initfn,
  3368.                              .class_init = arm_v7m_class_init },
  3369.     ...
  3370. }
  3371.  
  3372.  
  3373. CPU types seem to be factored into feature sets:
  3374.  
  3375. static void cortex_m3_initfn(Object *obj)
  3376. {
  3377.     ARMCPU *cpu = ARM_CPU(obj);
  3378.     set_feature(&cpu->env, ARM_FEATURE_V7);
  3379.     set_feature(&cpu->env, ARM_FEATURE_M);
  3380.     cpu->midr = 0x410fc231;
  3381. }
  3382.  
  3383. To simulate the cortex-m4, I have been using the cortex-a8 for its
  3384. support of the thumb2 DSP instruction set.  Let's trace that down:
  3385.  
  3386. static void cortex_a8_initfn(Object *obj)
  3387. {
  3388.     ARMCPU *cpu = ARM_CPU(obj);
  3389.     set_feature(&cpu->env, ARM_FEATURE_V7);
  3390.     set_feature(&cpu->env, ARM_FEATURE_VFP3);
  3391.     set_feature(&cpu->env, ARM_FEATURE_NEON);
  3392.     set_feature(&cpu->env, ARM_FEATURE_THUMB2EE);
  3393.     set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);
  3394.     cpu->midr = 0x410fc080;
  3395.     cpu->reset_fpsid = 0x410330c0;
  3396.     cpu->mvfr0 = 0x11110222;
  3397.     cpu->mvfr1 = 0x00011100;
  3398.     cpu->ctr = 0x82048004;
  3399.     cpu->reset_sctlr = 0x00c50078;
  3400.     cpu->id_pfr0 = 0x1031;
  3401.     cpu->id_pfr1 = 0x11;
  3402.     cpu->id_dfr0 = 0x400;
  3403.     cpu->id_afr0 = 0;
  3404.     cpu->id_mmfr0 = 0x31100003;
  3405.     cpu->id_mmfr1 = 0x20000000;
  3406.     cpu->id_mmfr2 = 0x01202000;
  3407.     cpu->id_mmfr3 = 0x11;
  3408.     cpu->id_isar0 = 0x00101111;
  3409.     cpu->id_isar1 = 0x12112111;
  3410.     cpu->id_isar2 = 0x21232031;
  3411.     cpu->id_isar3 = 0x11112131;
  3412.     cpu->id_isar4 = 0x00111142;
  3413.     cpu->clidr = (1 << 27) | (2 << 24) | 3;
  3414.     cpu->ccsidr[0] = 0xe007e01a; /* 16k L1 dcache. */
  3415.     cpu->ccsidr[1] = 0x2007e01a; /* 16k L1 icache. */
  3416.     cpu->ccsidr[2] = 0xf0000000; /* No L2 icache. */
  3417.     cpu->reset_auxcr = 2;
  3418.     define_arm_cp_regs(cpu, cortexa8_cp_reginfo);
  3419. }
  3420.  
  3421.  
  3422. // target-arm/cpu.h
  3423.  
  3424. /* If adding a feature bit which corresponds to a Linux ELF
  3425.  * HWCAP bit, remember to update the feature-bit-to-hwcap
  3426.  * mapping in linux-user/elfload.c:get_elf_hwcap().
  3427.  */
  3428. enum arm_features {
  3429.     ARM_FEATURE_VFP,
  3430.     ARM_FEATURE_AUXCR,  /* ARM1026 Auxiliary control register.  */
  3431.     ARM_FEATURE_XSCALE, /* Intel XScale extensions.  */
  3432.     ARM_FEATURE_IWMMXT, /* Intel iwMMXt extension.  */
  3433.     ARM_FEATURE_V6,
  3434.     ARM_FEATURE_V6K,
  3435.     ARM_FEATURE_V7,
  3436.     ARM_FEATURE_THUMB2,
  3437.     ARM_FEATURE_MPU,    /* Only has Memory Protection Unit, not full MMU.  */
  3438.     ARM_FEATURE_VFP3,
  3439.     ARM_FEATURE_VFP_FP16,
  3440.     ARM_FEATURE_NEON,
  3441.     ARM_FEATURE_THUMB_DIV, /* divide supported in Thumb encoding */
  3442.     ARM_FEATURE_M, /* Microcontroller profile.  */
  3443.     ARM_FEATURE_OMAPCP, /* OMAP specific CP15 ops handling.  */
  3444.     ARM_FEATURE_THUMB2EE,
  3445.     ARM_FEATURE_V7MP,    /* v7 Multiprocessing Extensions */
  3446.     ARM_FEATURE_V4T,
  3447.     ARM_FEATURE_V5,
  3448.     ARM_FEATURE_STRONGARM,
  3449.     ARM_FEATURE_VAPA, /* cp15 VA to PA lookups */
  3450.     ARM_FEATURE_ARM_DIV, /* divide supported in ARM encoding */
  3451.     ARM_FEATURE_VFP4, /* VFPv4 (implies that NEON is v2) */
  3452.     ARM_FEATURE_GENERIC_TIMER,
  3453.     ARM_FEATURE_MVFR, /* Media and VFP Feature Registers 0 and 1 */
  3454.     ARM_FEATURE_DUMMY_C15_REGS, /* RAZ/WI all of cp15 crn=15 */
  3455.     ARM_FEATURE_CACHE_TEST_CLEAN, /* 926/1026 style test-and-clean ops */
  3456.     ARM_FEATURE_CACHE_DIRTY_REG, /* 1136/1176 cache dirty status register */
  3457.     ARM_FEATURE_CACHE_BLOCK_OPS, /* v6 optional cache block operations */
  3458.     ARM_FEATURE_MPIDR, /* has cp15 MPIDR */
  3459.     ARM_FEATURE_PXN, /* has Privileged Execute Never bit */
  3460.     ARM_FEATURE_LPAE, /* has Large Physical Address Extension */
  3461.     ARM_FEATURE_V8,
  3462.     ARM_FEATURE_AARCH64, /* supports 64 bit mode */
  3463. };
  3464.  
  3465.  
  3466.  
  3467.  
  3468. What I did not find immediately is where these tags are used in the
  3469. interpretation / compilation..  So let's dive into that first.  Where
  3470. are the instructions defined?
  3471.  
  3472. Beef seems to be in target-arm/translate.c
  3473.  
  3474. Lots of functions prefixed "gen_".  I guess these are code generators
  3475. for the individual instructions?  They call into "tcg_gen_" prefixed
  3476. functions, which is the Tiny Code Generator.
  3477.  
  3478. What are the "disas_" functions?  They call into tcg as well.
  3479.  
  3480.  
  3481.  
  3482. Entry: Qemu ARM IRQ
  3483. Date: Thu Dec 12 15:29:19 EST 2013
  3484.  
  3485. This doesn't work any more:
  3486.  
  3487.       cpu_irq = arm_pic_init_cpu(env);
  3488.  
  3489. Where to find how this changed?
  3490.  
  3491. Here's the answer [1].
  3492.  
  3493. -    pic = arm_pic_init_cpu(s->cpu);
  3494.      s->pic = sysbus_create_varargs("strongarm_pic", 0x90050000,
  3495. -                    pic[ARM_PIC_CPU_IRQ], pic[ARM_PIC_CPU_FIQ], NULL);
  3496. +                    qdev_get_gpio_in(DEVICE(s->cpu), ARM_CPU_IRQ),
  3497. +                    qdev_get_gpio_in(DEVICE(s->cpu), ARM_CPU_FIQ),
  3498. +                    NULL);
  3499.  
  3500.  
  3501.  
  3502.  
  3503. So in the CC32RS512 code, this is probably what it needs to be: the
  3504. cc32-sysc is connected to the 2 ARM interrupts IRQ and FIQ, and the
  3505. rest of the hardware is connected to the interrupt controller which
  3506. has 32 interrupts.
  3507.  
  3508.       dev = DEVICE(cpu);
  3509.       dev = sysbus_create_varargs("cc32-sysc", 0x0F0000,
  3510.                         qdev_get_gpio_in(dev, ARM_CPU_IRQ),
  3511.                         qdev_get_gpio_in(dev, ARM_CPU_FIQ),
  3512.                         NULL);
  3513.  
  3514.       for (i = 0; i < 32; i++) {
  3515.             fprintf(stderr, "PIC %d\n", i);
  3516.             pic[i] = qdev_get_gpio_in(dev, i);
  3517.       }
  3518.  
  3519.  
  3520. [1] http://lists.nongnu.org/archive/html/qemu-devel/2013-08/msg01080.html
  3521.  
  3522.  
  3523.  
  3524. Entry: Qemu overview
  3525. Date: Fri Dec 13 10:39:06 EST 2013
  3526.  
  3527. High-level and mostly wrong overview of qemu:
  3528.  
  3529. - Asm code gets translated to TCG code, then compiled to native code
  3530.   or interpreted.
  3531.  
  3532. - Memory accesses are either based on the RAM/ROM objects, or sysbus objects
  3533.  
  3534. - sysbus objects have behavior associated to read/write.  they also
  3535.   interact with interrupts.
  3536.  
  3537. - not clear how exactly control flow works for interrupts
  3538.  
  3539. From [1]:
  3540.  
  3541.   2.11 Hardware interrupts
  3542.  
  3543.   In order to be faster, QEMU does not check at every basic block if a
  3544.   hardware interrupt is pending. Instead, the user must asynchronously
  3545.   call a specific function to tell that an interrupt is pending. This
  3546.   function resets the chaining of the currently executing basic
  3547.   block. It ensures that the execution will return soon in the main
  3548.   loop of the CPU emulator. Then the main loop can test if the
  3549.   interrupt is pending and handle it.
  3550.  
  3551. - guest code is called synchronously[2]:
  3552.  
  3553.   ... what matters is that both TCG and KVM allow us to jump into
  3554.   guest code and execute it.  Jumping into guest code takes away our
  3555.   control of execution and gives control to the guest.  While a thread
  3556.   is running guest code it cannot simultaneously be in the event loop
  3557.   because the guest has (safe) control of the CPU. Typically the
  3558.   amount of time spent in guest code is limited because reads and
  3559.   writes to emulated device registers and other exceptions cause us to
  3560.   leave the guest and give control back to QEMU. In extreme cases a
  3561.   guest can spend an unbounded amount of time without giving up
  3562.   control and this would make QEMU unresponsive.  In order to solve
  3563.   the problem of guest code hogging QEMU's thread of control signals
  3564.   are used to break out of the guest.
  3565.  
  3566. [1] http://ellcc.org/ellcc/share/doc/qemu/qemu-tech.html#Hardware-interrupts
  3567. [2] http://blog.vmsplice.net/2011/03/qemu-internals-overall-architecture-and.html
  3568.  
  3569.  
  3570. Entry: Why is there no qemu arm7tdmi emulator?
  3571. Date: Fri Dec 13 12:02:25 EST 2013
  3572.  
  3573. From a brief look at the code, patching together a cpu from feature
  3574. sets isn't a big amount of work.
  3575.  
  3576. Maybe have a look at skyeye[1]
  3577.  
  3578.  
  3579. [1] http://balau82.wordpress.com/2010/09/27/simulating-at91-with-skyeye/
  3580.  
  3581.  
  3582.  
  3583. Entry: ARM + high speed usb: SAM3U
  3584. Date: Sat Mar 22 13:37:26 EDT 2014
  3585.  
  3586. [1] http://www.atmel.com/products/microcontrollers/arm/sam3u.aspx
  3587.  
  3588.  
  3589.  
  3590. Entry: Debian multiarch for cross-compilation
  3591. Date: Fri Aug 22 21:30:35 CEST 2014
  3592.  
  3593. sudo sudo dpkg –-add-architecture armel
  3594.  
  3595.  
  3596. It seems this only works with libraries.  Can't have both
  3597. cpp-4.9:amd64 and cpp-4.9:armel installed?  Is there a way to have
  3598. this conflict resolved?
  3599.  
  3600.  
  3601.  
  3602. [1] http://www.lshift.net/blog/2012/06/17/using-debian-multiarch-for-cross-compiling
  3603. [2] http://lwn.net/Articles/482952/
  3604.  
  3605.  
  3606. Entry: emdebian cross compiler
  3607. Date: Mon Aug 25 18:02:30 CEST 2014
  3608.  
  3609. # deb [arch=amd64] http://ftp.uk.debian.org/emdebian/toolchains stable main
  3610. # deb [arch=amd64] http://ftp.uk.debian.org/emdebian/toolchains testing main
  3611. apt-get install g++-4.7-arm-linux-gnueabi
  3612.  
  3613.  
  3614. Entry: Multiarch cross compilers
  3615. Date: Mon Aug 25 19:46:20 CEST 2014
  3616.  
  3617. How to obtain a cross toolchain that works with installed multiarch
  3618. -dev packages?  Prebuilt toolchains are here[2].
  3619.  
  3620.  
  3621. Tried, but currently there is a version gcc-4.9 mismatch in sid wrt[2]
  3622.  
  3623. 4.9.1-9: amd64
  3624. 4.9.1-8: arm64 armel armhf hppa hurd-i386 i386 kfreebsd-amd64 kfreebsd-i386 mipsel powerpc ppc64 s390x sparc x32
  3625.  
  3626. Build one from source?
  3627.  
  3628. [1] https://wiki.debian.org/MultiarchCrossToolchainBuild
  3629. [2] http://toolchains.secretsauce.net/
  3630.  
  3631.  
  3632. Entry: Old way: emdebian xapt
  3633. Date: Mon Aug 25 23:22:53 CEST 2014
  3634.  
  3635. xapt -a armhf -m libusb-1.0-0-dev libboost-filesystem-dev libpython3.4-dev
  3636.  
  3637. This still needs a lot of magic with -I flags and -rpath... How to
  3638. automate?  For pratical purposes, I can now compile on target. Maybe
  3639. best to just wait until the multiarch stuff works.
  3640.  
  3641. [1] https://wiki.debian.org/EmdebianToolchain
  3642.  
  3643.  
  3644.  
  3645. Entry: Time to figure out state-of-the-art cross compilers
  3646. Date: Fri Sep 12 21:47:34 CEST 2014
  3647.  
  3648. Bare-metal isn't that hard.  Use use binaries from [1] together with
  3649. some multiarch i386 suport:.
  3650.  
  3651. sudo apt-get install libc6:i386 libc6-i686:i386 libgcc1:i386
  3652.  
  3653. What I'm interested in though is to cross-compile for Debian on
  3654. beaglebone black, beagleboard xM, and raspberry pi.
  3655.  
  3656. For OpenWRT it seems straightforward since it already comes with a
  3657. toolchain and build system.
  3658.  
  3659. I'd like to also sort out how to build multiple rust compilers, one
  3660. for each architecture.
  3661.  
  3662.  
  3663. [1] https://launchpad.net/gcc-arm-embedded/+download
  3664.  
  3665.  
  3666.  
  3667.  
  3668. Entry: arm-linux-gnueabi-*-4.7  
  3669. Date: Fri Sep 12 22:09:25 CEST 2014
  3670.  
  3671. Packages from emdebian all have a -4.7 version postfix which isn't
  3672. always supported in build systems looking for cross tools, e.g. rust.
  3673.  
  3674. Use this to create symlinks:
  3675.  
  3676. cd /usr/bin
  3677. for i in arm*4.7; do ln -s $i $(basename $i -4.7); done
  3678.  
  3679.  
  3680.  
  3681.  
  3682. Entry: Cortex M4F float vs fixed
  3683. Date: Sun Sep 21 13:51:05 CEST 2014
  3684.  
  3685. Float in M4F is VFP with missing features like double FP.
  3686. FPv4-SP extension
  3687.  
  3688. VFP float ops happen in S registers.
  3689. VLDR/VSTR loads into / stores from S registers.
  3690.  
  3691.  
  3692.  
  3693. Entry: Assembly remarks
  3694. Date: Thu Sep 25 16:44:24 CEST 2014
  3695.  
  3696. pc-relative addressing in arm is quite strange..
  3697.  
  3698. 0xa (10) -> 40
  3699. 0xb (11) -> 44
  3700.  
  3701. but why is this not 40,42,44,46 ?
  3702. looks like PC only increments every 2 instructions in thumb mode.
  3703.  
  3704.    10002:   4b0a        ldr   r3, [pc, #40]     ; (1002c <xpatch_init+0x2c>)
  3705.    10004:   4a0a        ldr   r2, [pc, #40]     ; (10030 <xpatch_init+0x30>)
  3706.    10006:   4e0b        ldr   r6, [pc, #44]     ; (10034 <xpatch_init+0x34>)
  3707.    10008:   4d0b        ldr   r5, [pc, #44]     ; (10038 <xpatch_init+0x38>)
  3708.  
  3709.  
  3710.  
  3711. what is the point of __memset_veneer trampoline?
  3712.  
  3713. what is the ip register?
  3714. -> r12, scratch register / new-sb in inter-link-unit calls
  3715.  
  3716. 00010520 <__memset_veneer>:
  3717.    10520:   b401        push  {r0}
  3718.    10522:   4802        ldr   r0, [pc, #8]      ; (1052c <__memset_veneer+0xc>)
  3719.    10524:   4684        mov   ip, r0
  3720.    10526:   bc01        pop   {r0}
  3721.    10528:   4760        bx    ip
  3722.    1052a:   bf00        nop
  3723.    1052c:   08014471    .word 0x08014471
  3724.  
  3725.  
  3726. what's the difference between
  3727.   push {rx, ...}
  3728. and
  3729.   stmdb sp!, {rx, ...}
  3730.  
  3731. -> push/pop are aliases
  3732.  
  3733.  
  3734. what are the d registers?
  3735.    1007a:   ed2d 8b0c   vpush {d8-d13}
  3736.  
  3737.  
  3738. -> floating point extension registers.  i'm guessing this is just the
  3739.    s registers aliased as d (double) registers so the above is the
  3740.    same as:
  3741.  
  3742.    vpush {s16-s26}
  3743.    
  3744.  
  3745.  
  3746. apparently, 2-word instructions do not need to be 2-word aligned.
  3747.  
  3748. why is "ite ne" followed by movne?
  3749.  
  3750.    100ce:   2b00        cmp   r3, #0
  3751.    100d0:   bf14        ite   ne
  3752.    100d2:   4663        movne r3, ip
  3753.    100d4:   463b        moveq r3, r7
  3754.  
  3755. again for "it mi", "submi"
  3756.  
  3757.    10104:   bf48        it    mi
  3758.    10106:   3a01        submi r2, #1
  3759.  
  3760.  
  3761. -> conditional instructions must be inside an it block
  3762. -> suffix condition or inverse
  3763. -> up to 4 following instr conditional
  3764.  
  3765.  
  3766. it seems gcc does insert vfma instructions (fused mul acc)
  3767.  
  3768.  
  3769.  
  3770. Entry: measure optimality
  3771. Date: Thu Sep 25 17:19:01 CEST 2014
  3772.  
  3773. by computing the ratio of moves to math instructions
  3774.  
  3775.  
  3776.  
  3777. Entry: neon vs. vfp
  3778. Date: Fri Sep 26 17:52:30 CEST 2014
  3779.  
  3780. Entry: Q or GE
  3781. Date: Sat Sep 27 15:54:56 CEST 2014
  3782.  
  3783. Point of Q: perform a series of operations, then check if overflow
  3784. occured at the end.
  3785.  
  3786.  
  3787. CPSR has the following 32 bits.[43]
  3788.  
  3789.     M (bits 0–4) is the processor mode bits.
  3790.     T (bit 5) is the Thumb state bit.
  3791.     F (bit 6) is the FIQ disable bit.
  3792.     I (bit 7) is the IRQ disable bit.
  3793.     A (bit 8) is the imprecise data abort disable bit.
  3794.     E (bit 9) is the data endianness bit.
  3795.     IT (bits 10–15 and 25–26) is the if-then state bits.
  3796.     GE (bits 16–19) is the greater-than-or-equal-to bits.
  3797.     DNM (bits 20–23) is the do not modify bits.
  3798.     J (bit 24) is the Java state bit.
  3799.     Q (bit 27) is the sticky overflow bit.
  3800.     V (bit 28) is the overflow bit.
  3801.     C (bit 29) is the carry/borrow/extend bit.
  3802.     Z (bit 30) is the zero bit.
  3803.     N (bit 31) is the negative/less than bit.
  3804.  
  3805. [1] http://en.wikipedia.org/wiki/ARM_architecture
  3806. [2] http://stackoverflow.com/questions/19557338/importance-of-qsaturation-flag-in-arm
  3807.  
  3808.  
  3809.  
  3810. Entry: STM32F103 board
  3811. Date: Wed Oct 29 14:20:54 EDT 2014
  3812.  
  3813. Board info at [2].
  3814.  
  3815. [master] [email protected]:~/armdev/stm32f103$ cat openocd.cfg
  3816. set CHIPNAME stm32f103c8t6
  3817. source [find interface/arm-usb-ocd.cfg]
  3818. source [find target/stm32f1x.cfg]
  3819.  
  3820.  
  3821. [master] [email protected]:~/armdev/stm32f103$ cat openocd
  3822. #!/bin/bash
  3823. cd $(dirname $0)
  3824. exec openocd -f openocd.cfg "[email protected]"
  3825.  
  3826.  
  3827. [master] [email protected]:~/armdev/stm32f103$ ./openocd
  3828. Open On-Chip Debugger 0.8.0-dev-00173-gc98856b-dirty (2013-09-15-10:22)
  3829. Licensed under GNU GPL v2
  3830. For bug reports, read
  3831.       http://openocd.sourceforge.net/doc/doxygen/bugs.html
  3832. Info : only one transport option; autoselect 'jtag'
  3833. adapter speed: 1000 kHz
  3834. adapter_nsrst_delay: 100
  3835. jtag_ntrst_delay: 100
  3836. cortex_m reset_config sysresetreq
  3837. Info : clock speed 1000 kHz
  3838. Info : JTAG tap: stm32f103c8t6.cpu tap/device found: 0x3ba00477 (mfg: 0x23b, part: 0xba00, ver: 0x3)
  3839. Info : JTAG tap: stm32f103c8t6.bs tap/device found: 0x16410041 (mfg: 0x020, part: 0x6410, ver: 0x1)
  3840. Info : stm32f103c8t6.cpu: hardware has 6 breakpoints, 4 watchpoints
  3841. Error: stm32f103c8t6.cpu -- clearing lockup after double fault
  3842. Polling target stm32f103c8t6.cpu failed, GDB will be halted. Polling again in 100ms
  3843. Polling target stm32f103c8t6.cpu succeeded again
  3844.   C-c C-c
  3845.  
  3846. TODO: compile latest openocd.
  3847.  
  3848.  
  3849. [1] http://electronics.stackexchange.com/questions/30688/clearing-lockup-after-double-fault
  3850. [2] http://www.chinalctech.com/index.php?_m=mod_product&_a=view&p_id=1029
  3851.  
  3852.  
  3853.  
  3854. Entry: libopencm3
  3855. Date: Wed Oct 29 14:47:13 EDT 2014
  3856.  
  3857. git clone git://github.com/libopencm3/libopencm3.git
  3858. cd libopencm3
  3859. make
  3860.  
  3861. This will yield lib/*.a including:
  3862. lib/libopencm3_stm32f1.a
  3863.  
  3864. git clone https://github.com/libopencm3/libopencm3-examples.git
  3865. cd examples/stm32/f1/other/usb_cdcacm
  3866. make OPENCM3_DIR=/home/tom/git/libopencm3
  3867.  
  3868. [master] [email protected]:~/git/libopencm3-examples/examples/stm32/f1/other/usb_cdcacm$ ~/armdev/stm32f103/gdb cdcacm.elf
  3869. GNU gdb (GDB) 7.6.1
  3870. ...
  3871. Reading symbols from /home/tom/pub/git/libopencm3-examples/examples/stm32/f1/other/usb_cdcacm/cdcacm.elf...done.
  3872. 0xffffffff in ?? ()
  3873. (gdb) load
  3874. Loading section .text, size 0x1528 lma 0x8000000
  3875. Loading section .data, size 0x14 lma 0x8001528
  3876. Start address 0x80011a0, load size 5436
  3877. Transfer rate: 9 KB/sec, 2718 bytes/write.
  3878.  
  3879.  
  3880. Entry: Openocd 0.8.0
  3881. Date: Wed Oct 29 15:42:54 EDT 2014
  3882.  
  3883. Let's start with latest release
  3884. wget http://superb-dca3.dl.sourceforge.net/project/openocd/openocd/0.8.0/openocd-0.8.0.tar.gz
  3885. cd openocd-0.8.0/
  3886. ./configure \
  3887.    --enable-maintainer-mode \
  3888.    --enable-legacy-ft2232_libftdi \
  3889.    --enable-ftdi \
  3890.    --enable-ti-icdi \
  3891.    --enable-jlink
  3892.  
  3893. ft2232 for olimex ARM-USB-OCD
  3894.  
  3895. Entry: ftdi driver to replace ft2232 driver for olimex ARM-USB-OCD
  3896. Date: Wed Oct 29 15:55:21 EDT 2014
  3897.  
  3898. ft2232 driver is deprecated.  Compiling it anyway doesn't work for the
  3899. olimex-arm-usb-ocd.cfg that's in openocd 0.8.0
  3900.  
  3901. Ok, both configs are still present.  Just prefix directory with 'ftdi'
  3902. source [find interface/ftdi/olimex-arm-usb-ocd.cfg]
  3903.  
  3904.  
  3905.  
  3906. Entry: Can't connect after flashing bad code + FIX
  3907. Date: Wed Oct 29 17:16:31 EDT 2014
  3908.  
  3909.  
  3910. Now I get:
  3911.  
  3912.  
  3913. [master] [email protected]:~/armdev/stm32f103$ ./openocd
  3914. Open On-Chip Debugger 0.8.0 (2014-10-29-15:46)
  3915. Licensed under GNU GPL v2
  3916. For bug reports, read
  3917.       http://openocd.sourceforge.net/doc/doxygen/bugs.html
  3918. Info : only one transport option; autoselect 'jtag'
  3919. adapter speed: 1000 kHz
  3920. adapter_nsrst_delay: 100
  3921. jtag_ntrst_delay: 100
  3922. cortex_m reset_config sysresetreq
  3923. Info : clock speed 1000 kHz
  3924. Error: JTAG scan chain interrogation failed: all ones
  3925. Error: Check JTAG interface, timings, target power, etc.
  3926. Error: Trying to use configured scan chain anyway...
  3927. Error: stm32f103c8t6.cpu: IR capture error; saw 0x0f not 0x01
  3928. Warn : Bypassing JTAG setup events due to errors
  3929. Warn : Invalid ACK 0x7 in JTAG-DP transaction
  3930.  
  3931.  
  3932.  
  3933. When holding reset it does come up properly.
  3934.  
  3935.  
  3936. [master] [email protected]:~/pub/git/armdev/stm32f103$ ./openocd
  3937. Open On-Chip Debugger 0.5.0 (2011-08-09-08:45)
  3938. Licensed under GNU GPL v2
  3939. For bug reports, read
  3940.       http://openocd.berlios.de/doc/doxygen/bugs.html
  3941. Info : only one transport option; autoselect 'jtag'
  3942. 1000 kHz
  3943. adapter_nsrst_delay: 100
  3944. jtag_ntrst_delay: 100
  3945. cortex_m3 reset_config sysresetreq
  3946. 100 kHz
  3947. Info : clock speed 100 kHz
  3948. Info : JTAG tap: stm32f103c8t6.cpu tap/device found: 0x3ba00477 (mfg: 0x23b, part: 0xba00, ver: 0x3)
  3949. Info : JTAG tap: stm32f103c8t6.bs tap/device found: 0x16410041 (mfg: 0x020, part: 0x6410, ver: 0x1)
  3950. Info : stm32f103c8t6.cpu: hardware has 6 breakpoints, 4 watchpoints
  3951.  
  3952. When releasing reset:
  3953.  
  3954. Warn : Invalid ACK 0x7 in JTAG-DP transaction
  3955. Polling target stm32f103c8t6.cpu failed, GDB will be halted. Polling again in 100ms
  3956.  
  3957. When pressing reset:
  3958.  
  3959. Polling target stm32f103c8t6.cpu succeeded again
  3960.  
  3961.  
  3962. This started happening after uploading something.
  3963.  
  3964. Keeping the reset button pressed:
  3965.  
  3966. (gdb) connect
  3967. Polling target stm32f103c8t6.cpu succeeded again
  3968. Info : accepting 'gdb' connection from 3333
  3969. Info : device id = 0x20036410
  3970. Warn : STM32 flash size failed, probe inaccurate - assuming 128k flash
  3971. Info : flash size = 128kbytes
  3972. undefined debug reason 7 - target needs reset
  3973.  
  3974. (gdb) mon reset
  3975. Info : JTAG tap: stm32f103c8t6.cpu tap/device found: 0x3ba00477 (mfg: 0x23b, part: 0xba00, ver: 0x3)
  3976. Info : JTAG tap: stm32f103c8t6.bs tap/device found: 0x16410041 (mfg: 0x020, part: 0x6410, ver: 0x1)
  3977.  
  3978.  
  3979.  
  3980. So this worked:
  3981. - physically hold target in reset
  3982. - start openocd
  3983. - start gdb  (possibly with .elf)
  3984. - issue "mon halt" then release physical reset
  3985. => target is halted and can be programmed.
  3986.  
  3987. I just erased the flash[1] and now it connects properly.
  3988.  
  3989. (gdb) mon flash erase_address  0x08000000 0x00020000
  3990. erased address 0x08000000 (length 131072) in 0.026083s (4907.411 KiB/s)
  3991.  
  3992.  
  3993. Tried again - didn't work.
  3994.  
  3995. With BOOT0=1 and BOOT1=1
  3996.  
  3997. (gdb) mon flash banks
  3998. #0 : stm32f103c8t6.flash (stm32f1x) at 0x08000000, size 0x00010000, buswidth 0, chipwidth 0
  3999. (gdb) mon flash erase_address  0x08000000 0x00010000
  4000. erased address 0x08000000 (length 65536) in 0.024643s (2597.086 KiB/s)
  4001.  
  4002.  
  4003. [1] http://openocd.sourceforge.net/doc/html/Flash-Commands.html
  4004.  
  4005.  
  4006.  
  4007. Entry: ACM demo
  4008. Date: Wed Oct 29 17:37:58 EDT 2014
  4009.  
  4010. Looks like it actually ran ok:
  4011.  
  4012. Oct 29 16:46:54 zoo kernel: [86274.953817] usb 1-1.1.1.4.4: new full-speed USB device number 90 using xhci_hcd
  4013. Oct 29 16:46:54 zoo kernel: [86275.044193] usb 1-1.1.1.4.4: New USB device found, idVendor=0483, idProduct=5740
  4014. Oct 29 16:46:54 zoo kernel: [86275.044196] usb 1-1.1.1.4.4: New USB device strings: Mfr=1, Product=2, SerialNumber=3
  4015. Oct 29 16:46:54 zoo kernel: [86275.044197] usb 1-1.1.1.4.4: Product: CDC-ACM Demo
  4016. Oct 29 16:46:54 zoo kernel: [86275.044198] usb 1-1.1.1.4.4: Manufacturer: Black Sphere Technologies
  4017. Oct 29 16:46:54 zoo kernel: [86275.044199] usb 1-1.1.1.4.4: SerialNumber: DEMO
  4018. Oct 29 16:46:54 zoo kernel: [86275.044352] usb 1-1.1.1.4.4: ep 0x83 - rounding interval to 1024 microframes, ep desc says 2040 microframes
  4019. Oct 29 16:46:54 zoo kernel: [86275.045072] cdc_acm 1-1.1.1.4.4:1.0: ttyACM0: USB ACM device
  4020. Oct 29 16:46:54 zoo mtp-probe: checking bus 1, device 90: "/sys/devices/pci0000:00/0000:00:14.0/usb1/1-1/1-1.1/1-1.1.1/1-1.1.1.4/1-1.1.1.4.4"
  4021. Oct 29 16:46:54 zoo mtp-probe: bus: 1, device: 90 was not an MTP device
  4022.  
  4023.  
  4024.  
  4025. Entry: BOOT0 BOOT1
  4026. Date: Wed Oct 29 17:57:57 EDT 2014
  4027.  
  4028. There are two jumpers on the board: BOOT0, BOOT1.
  4029. Boot jumpers are originally closest to the large pin header.  (assuming that's 0)
  4030. Trying different
  4031.  
  4032. 0x20000000 RAM
  4033. 0x08000000 Flash  (mapped to 0)
  4034.  
  4035.  
  4036. [1] http://stackoverflow.com/questions/22351703/stm32f030-and-boot0-pin
  4037.  
  4038. Entry: libopencm3 build
  4039. Date: Thu Oct 30 18:31:12 EDT 2014
  4040.  
  4041. [master] [email protected]:~/pub/git/libopencm3-examples/examples/stm32/f1/other/usb_cdcacm$ OPENCM3_DIR=/home/tom/git/libopencm3 make V=1
  4042. Using /home/tom/git/libopencm3 path to library
  4043.  
  4044. arm-none-eabi-gcc -Os -g -Wextra -Wshadow -Wimplicit-function-declaration -Wredundant-decls -Wmissing-prototypes -Wstrict-prototypes -fno-common -ffunction-sections -fdata-sections -MD -Wall -Wundef -I/home/tom/git/libopencm3/include -DSTM32F1 -mthumb -mcpu=cortex-m3 -msoft-float -mfix-cortex-m3-ldrd -o cdcacm.o -c cdcacm.c
  4045.  
  4046. arm-none-eabi-gcc --static -nostartfiles -L/home/tom/git/libopencm3/lib -Tcdcacm.ld -Wl,-Map=cdcacm.map -Wl,--gc-sections -mthumb -mcpu=cortex-m3 -msoft-float -mfix-cortex-m3-ldrd cdcacm.o -lopencm3_stm32f1 -Wl,--start-group -lc -lgcc -lnosys -Wl,--end-group -o cdcacm.elf
  4047.  
  4048.  
  4049. One option per line:
  4050.  
  4051. CFLAGS:
  4052. -Os
  4053. -g
  4054. -Wextra
  4055. -Wshadow
  4056. -Wimplicit-function-declaration
  4057. -Wredundant-decls
  4058. -Wmissing-prototypes
  4059. -Wstrict-prototypes
  4060. -fno-common
  4061. -ffunction-sections
  4062. -fdata-sections
  4063. -MD
  4064. -Wall
  4065. -Wundef
  4066. -I/home/tom/git/libopencm3/include
  4067. -DSTM32F1
  4068. -mthumb
  4069. -mcpu=cortex-m3
  4070. -msoft-float
  4071. -mfix-cortex-m3-ldrd
  4072.  
  4073. LDFLAGS
  4074. --static
  4075. -nostartfiles
  4076. -L/home/tom/git/libopencm3/lib
  4077. -Tcdcacm.ld
  4078. -Wl,-Map=cdcacm.map
  4079. -Wl,--gc-sections
  4080. -mthumb
  4081. -mcpu=cortex-m3
  4082. -msoft-float
  4083. -mfix-cortex-m3-ldrd
  4084. -lopencm3_stm32f1
  4085. -Wl,--start-group
  4086. -lc
  4087. -lgcc
  4088. -lnosys
  4089. -Wl,--end-group
  4090.  
  4091.  
  4092.  
  4093. EDIT: The -m flags were missing on the linker line.
  4094.  
  4095.  
  4096. Entry: stm32f usb libopencm3
  4097. Date: Thu Oct 30 18:50:33 EDT 2014
  4098.  
  4099. libopencm3/lib/usb/usb_f107.c
  4100.  
  4101. stm32fx07_ep_write_packet
  4102. stm32fx07_poll
  4103.  
  4104. Running the cdc example code:
  4105. libopencm3-examples/examples/stm32/f1/other/usb_cdcacm
  4106. Why is it using otg_hs.h and not usb.h ?
  4107.  
  4108.  
  4109.  
  4110. Entry: SW turned off
  4111. Date: Thu Oct 30 19:13:06 EDT 2014
  4112.  
  4113. this might be the culprit ;)
  4114.  
  4115. AFIO_MAPR |= AFIO_MAPR_SWJ_CFG_JTAG_OFF_SW_ON;
  4116.  
  4117.  
  4118.  
  4119. Entry: Stepping on the f103
  4120. Date: Thu Oct 30 19:23:45 EDT 2014
  4121.  
  4122. So I'm able to step through the code.
  4123.  
  4124. (gdb) p/x *0x8000000
  4125. $4 = 0x20005000
  4126. (gdb) p/x *0x8000004
  4127. $5 = 0x8001299
  4128.  
  4129. But setting $pc doesn't work.
  4130.  
  4131. This does seem to reset properly:
  4132.  
  4133. (gdb) mon reset halt
  4134. JTAG tap: stm32f103c8t6.cpu tap/device found: 0x3ba00477 (mfg: 0x23b, part: 0xba00, ver: 0x3)
  4135. JTAG tap: stm32f103c8t6.bs tap/device found: 0x16410041 (mfg: 0x020, part: 0x6410, ver: 0x1)
  4136. target state: halted
  4137. target halted due to debug-request, current mode: Thread
  4138. xPSR: 0x01000000 pc: 0x08001298 msp: 0x20005000
  4139.  
  4140.  
  4141. Registers are out of sync.  How to reload?
  4142. stepi seems to solve that..
  4143. sometimes..
  4144.  
  4145. not much consistent behaviour.
  4146. still buggy as hell this stuff...
  4147. let's upgrade gdb as well..
  4148.  
  4149. it also complains about no hw breakpoint resources available.  restarting openocd helped.
  4150.  
  4151. anyways, seems to be "mostly ok".  gud is working as well with gdb-7.8.1
  4152.  
  4153.  
  4154. Entry: cdcacm example
  4155. Date: Thu Oct 30 19:58:05 EDT 2014
  4156.  
  4157. the elf built from libopencm3-examples works
  4158. mine doesn't
  4159.  
  4160.  
  4161. Entry: jitter
  4162. Date: Fri Oct 31 08:46:46 EDT 2014
  4163.  
  4164. http://www.keil.com/forum/20318/how-to-reduce-interrupt-jitter/
  4165.  
  4166.  
  4167.  
  4168. Entry: arm linux rootfs qemu
  4169. Date: Sun Nov  2 22:41:22 EST 2014
  4170.  
  4171. # tar xf rootfs.tar.gz
  4172. # cp /usr/bin/qemu-arm-static usr/bin
  4173. # chroot . /usr/bin/qemu-arm-static /bin/sh
  4174.  
  4175.  
  4176. Entry: boot process vybrid
  4177. Date: Sun Nov  2 23:01:11 EST 2014
  4178.  
  4179. [1] https://linuxlink.timesys.com/docs/gsg/twr_vf600
  4180.  
  4181.  
  4182. Entry: Interactive C
  4183. Date: Wed Nov  5 13:52:29 EST 2014
  4184.  
  4185. Modify linker script to load into ram?  This is just a vagues idea..
  4186. Let's stick to uploading images as it seems to be quite fast on the
  4187. STM32F103.
  4188.  
  4189. I'd like to figure out though why the reset isn't always working.
  4190.  
  4191.  
  4192.  
  4193. Entry: gud emacs
  4194. Date: Wed Nov  5 15:54:31 EST 2014
  4195.  
  4196. On zoo it works fine: source window comes up.  On tx for some reason
  4197. it doesn't..
  4198.  
  4199. Reading symbols from /home/tom/armdev/stm32f103/cdcacm.elf...done.
  4200. stm32f103_poll (dev=0x20000014 <usbd_dev>) at ../../usb/usb_f103.c:299
  4201. 299   ../../usb/usb_f103.c: No such file or directory.
  4202.  
  4203. Ah it doesn't find the file.
  4204. How to add absolute paths to libopencm3?
  4205.  
  4206. I recompiled it from ~/armdev/libopencm3 and now it works
  4207.  
  4208.  
  4209.  
  4210. Entry: Debugging USB
  4211. Date: Thu Nov  6 12:22:28 EST 2014
  4212.  
  4213. Halting the CPU causes USB timeouts.  Currently I've only managed to
  4214. run the CDCACM application by completely disconnecting the debugger.
  4215.  
  4216. I see two ways to deal with this:
  4217. - Give up on debugging USB in gdb
  4218. - Run a GDB stub over USB while running in the background
  4219.  
  4220. The question is really, what do I expect from a debugger tied to a
  4221. running real-time system?
  4222.  
  4223. Essentially I want to inspect memory and possibly execute some small
  4224. code routines.
  4225.  
  4226. Maybe best to just use the GDB serial protocol.  This would provide a
  4227. "console" through GDB, would avoid having to define an ad-hoc
  4228. protocol, and allows extension of any other kind of RPC that might be
  4229. useful.
  4230.  
  4231. I wonder if a micro like STM32F103 can set its own breakpoints /
  4232. watchpoints?
  4233.  
  4234. EDIT: One thing I didn't think about is that the protocol is
  4235. absolutely horrible :)
  4236.  
  4237. I wonder if there's a translation layer that can be used.
  4238.  
  4239.  
  4240.  
  4241. Entry: OpenOCD on/off
  4242. Date: Thu Nov  6 15:31:46 EST 2014
  4243.  
  4244. Let's first focus on reliably restarting with debugger attached.
  4245.  
  4246. I have a USB hub with power switches.  If I flip the switch, I want
  4247. openocd to stop.  If I power on the JTAG interface, I want openocd to
  4248. start.
  4249.  
  4250. EDIT: see armdev/bin:
  4251. -rwxr-xr-x  1 tom tom  301 Nov  6 14:50 openocd-dispatch
  4252. -rwxr-xr-x  1 tom tom 1704 Nov  6 15:23 udev-arm-usb-ocd.sh
  4253.  
  4254.  
  4255. Entry: Cortex M3 gdb stub
  4256. Date: Thu Nov  6 15:44:37 EST 2014
  4257.  
  4258. Need to find something to start from.
  4259. What I want is async debugging[4].
  4260.  
  4261. [1] https://code.google.com/p/nativeclient/issues/detail?id=2911
  4262. [2] https://gitorious.org/pmp-firmware-s-rockbox/ondabox/source/a42a56d8b00a92379399a648a2b4f25d9f069c72:gdb/arm-stub.c
  4263. [3] http://www.embecosm.com/appnotes/ean4/embecosm-howto-rsp-server-ean4-issue-2.html
  4264. [4] http://www.embecosm.com/appnotes/ean4/embecosm-howto-rsp-server-ean4-issue-2.html#sec_extended_async
  4265. [5] https://www.youtube.com/channel/UCVPF4xiSILwfgo-VfjVohzQ
  4266.  
  4267.  
  4268.  
  4269. Entry: libopencm3 USB IN >64 bytes
  4270. Date: Thu Nov  6 23:22:51 EST 2014
  4271.  
  4272. To make a large transfer, a callback is necessary.
  4273. The cdcacm example doesn't have one:
  4274.  
  4275.       usbd_ep_setup(usbd_dev, 0x01, USB_ENDPOINT_ATTR_BULK, 64, cdcacm_data_rx_cb);
  4276.       usbd_ep_setup(usbd_dev, 0x82, USB_ENDPOINT_ATTR_BULK, 64, NULL);
  4277.       usbd_ep_setup(usbd_dev, 0x83, USB_ENDPOINT_ATTR_INTERRUPT, 16, NULL);
  4278.  
  4279.  
  4280. For IN enpoints this gets called after transfer is complete.
  4281.  
  4282. Suspending output is a bit more painful than suspending input.  So the
  4283. solution is to either throw memory at the problem: generate output in
  4284. memory and have a simple state machine export it, possibly doing some
  4285. postprocessing (like RSP escapes).
  4286.  
  4287. Alternatively, use a task that can be suspended.  Some alternatives:
  4288. - RTOS tasks
  4289. - main program + interrupt state machines
  4290. - cooperative multitasking [1]
  4291.  
  4292.  
  4293. [1] http://hsl.wz.cz/tasks.htm
  4294.  
  4295.  
  4296. Entry: gdb "console"
  4297. Date: Fri Nov  7 18:39:50 EST 2014
  4298.  
  4299. Using gdb as a console to a real-time application.
  4300. RSP protocol is polled from the main real-time loop.
  4301. GDB sees consistent view in between updates of other state machines.
  4302.  
  4303. Allow:
  4304. - memory get/set
  4305. - image loading
  4306. - monitor commands
  4307. - execution of expressions, e.g. "print toggle_pin(1)"
  4308.  
  4309. However, there is no "current thread" in the sense of a halted target.
  4310.  
  4311. $Pe=c9210008#b9
  4312. +$#00
  4313. +$G000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f3031323334353637c92100083c3d3e3f#f6
  4314. +$#00
  4315. +$G000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f3031323330353637c92100083c3d3e3f#f2
  4316. +$#00
  4317. +$G000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f3031323330353637c921000874020008#29
  4318. +$#00
  4319. +$Z0,80021c8,2#aa
  4320. +$#00
  4321. +$m80021c8,2#61
  4322. +$0001#c1
  4323. +$X80021c8,0:#84
  4324. +$#00
  4325. +$M80021c8,2:bebe#09
  4326. +$#00
  4327. +$vCont?#49
  4328. +$#00
  4329. +$Hc0#db
  4330. +$#00
  4331. +$c#63
  4332. +$#00
  4333. +
  4334.  
  4335. That was in response to:
  4336.  
  4337. (gdb) p main()
  4338. warning: Invalid remote reply:
  4339.  
  4340. This contains commands:
  4341.  
  4342. G
  4343. Z
  4344. m
  4345. X
  4346. M
  4347. vCont?
  4348. H
  4349. c
  4350.  
  4351.  
  4352.  
  4353. What I want is maybe non-stop mode?
  4354.  
  4355. Maybe it doesn't matter.  There is no access to other threads anyway
  4356. since there is no active contect while prodding at the console.  Only
  4357. state.
  4358.  
  4359. So what is the current thread?  Just a fake loop?  The real main loop
  4360. that polls the USB OUT endpoint?
  4361.  
  4362.  
  4363. Entry: Look in gdb source for stubs
  4364. Date: Fri Nov  7 21:24:19 EST 2014
  4365.  
  4366. Seems old.. No ARM stub?
  4367. The one from RockBox might actually be functional.
  4368. I have some idea now how it works, so maybe keep that one intact?
  4369.  
  4370.  
  4371.  
  4372. Entry: continue
  4373. Date: Sat Nov  8 13:26:29 EST 2014
  4374.  
  4375. So the basic structure of the stub seems to be working.  Most of
  4376. what's left is low-level fiddling: continue.
  4377.  
  4378. GDB also complains:
  4379.  
  4380. (gdb) p main()
  4381.  
  4382. Program received signal SIGTRAP, Trace/breakpoint trap.
  4383. 0xbc020008 in ?? ()
  4384. The program being debugged was signaled while in a function called from GDB.
  4385. GDB remains in the frame where the signal was received.
  4386. To change this behavior use "set unwindonsignal on".
  4387. Evaluation of the expression containing the function
  4388. (main) will be abandoned.
  4389. When the function is done executing, GDB will silently stop.
  4390.  
  4391.  
  4392. Assuming this is because the stack pointer is not at the expected
  4393. position.  How to find out what it actually expects?  The simplest way
  4394. seems to just reuse working code from the RockBox stub.
  4395.  
  4396.  
  4397. Entry: usbmon
  4398. Date: Sun Nov  9 12:21:09 EST 2014
  4399.  
  4400. zoo:/home/tom# mount -t debugfs none_debugs /sys/kernel/debug
  4401. zoo:/home/tom# modprobe usbmon
  4402. zoo:/home/tom# ls /sys/kernel/debug/usb/usbmon
  4403. 0s  0u  1s  1t  1u  2s  2t  2u  3s  3t  3u  4s  4t  4u
  4404.  
  4405.  
  4406.  
  4407. cat /sys/kernel/debug/usb/usbmon/0u |grep :1:026
  4408.  
  4409. Note that [1] says:
  4410.  
  4411.     The length of collected data is limited and can be less than the
  4412.     data length reported in the Data Length word.
  4413.  
  4414. I've seen this for packet lengths of 128 where only 8 words (32 bytes)
  4415. are presented.
  4416.  
  4417. [1] https://www.kernel.org/doc/Documentation/usb/usbmon.txt
  4418.  
  4419.  
  4420.  
  4421. Entry: debugging USB on f103
  4422. Date: Sun Nov  9 13:22:15 EST 2014
  4423.  
  4424. So it seems that the low-level libopencm3 part is running fine.  RSP
  4425. stub is mostly working as well.  There is no real need for debugging
  4426. at the packet level.
  4427.  
  4428. Something I noticed though is that the max packet size seems to be 32
  4429. instead of 64.  Strange..
  4430.  
  4431. So, what I want to do is to make a pass-through for the RSP data that
  4432. will log it.  The simplest way to do this is to bridge /dev/ttyACM0 to
  4433. a tcp port and use a tcp sniffer.
  4434.  
  4435.  
  4436. socat /dev/ttyACM0 TCP-LISTEN:12345,reuseaddr
  4437. tcpflow -i lo -C -e port 12345
  4438.  
  4439.  
  4440.  
  4441. Entry: p main() hangs gdbstub
  4442. Date: Sun Nov  9 13:37:15 EST 2014
  4443.  
  4444. Reason:
  4445.  
  4446. $X800211c,2:..#fb
  4447. $X800211c,2:..#fb
  4448. $X800211c,2:..#fb
  4449. $X800211c,2:..#fb
  4450.  
  4451.  
  4452. Might be because writing to flash causes an exception.
  4453. EDIT: Sending Exx at least prevents the crash.
  4454.  
  4455. It would be better to not use software breakpoints.
  4456. I.e. let the stub provide a more abstract interface.
  4457.  
  4458.  
  4459. Entry: fixing p main()
  4460. Date: Sun Nov  9 14:18:19 EST 2014
  4461.  
  4462. It tries to set a breakpoint:
  4463.  
  4464. $m8002150,2#2b
  4465. +$0023#c5
  4466. +
  4467. $X8002150,2:..#cc
  4468. +$Efd#0f
  4469. +
  4470.  
  4471.  
  4472. Here 0x8002150 is the reset handler.
  4473. Why does it pick that particular address?
  4474.  
  4475. It doesn't seem to depend on the original $pc.
  4476.  
  4477. The 'Z' packet is used for breakpoints.  It tries this first:
  4478.  
  4479. $Z0,8002154,2#78
  4480. +$#00
  4481.  
  4482. So let's implement it.
  4483.  
  4484. Ok, done.  No more writing software breakpoints.
  4485.  
  4486. So why reset vector?  Maybe it is totally arbitrary?
  4487.  
  4488. Need to look at what it sets:
  4489.  
  4490. $Pe=cd210008#e4
  4491. +$OK#9a
  4492. +
  4493. $Pd=f8ffffff#f3
  4494. +$OK#9a
  4495. +
  4496. $Pf=f0110008#b3
  4497. +$OK#9a
  4498. +
  4499. $P19=00000001#78
  4500. +$OK#9a
  4501. +
  4502. $Z0,80021cc,2#d5
  4503. +$OK#9a
  4504. +
  4505.  
  4506. This corresponds to:
  4507.  
  4508. lr             0x080021cd     134226381
  4509. sp             0xfffffff8     0xfffffff8
  4510. pc             0x080011f0     0x80011f0 <main>
  4511. cpsr           0x01000000     16777216
  4512.  
  4513.  
  4514. bp+1 == lr (lsb is thumb mode)
  4515.  
  4516. It seems that the BP location really doesn't matter.  
  4517.  
  4518. It reserves 2 words on the current stack frame.  Original sp = 0;
  4519.  
  4520. What about cpsr?
  4521.  
  4522.  
  4523.  
  4524. [1] https://sourceware.org/gdb/onlinedocs/gdb/Calling.html
  4525.  
  4526.  
  4527. Entry: STM32F103C8T6
  4528. Date: Sun Nov  9 20:11:08 EST 2014
  4529.  
  4530. The board I'm using has an STM32F103C8T6:
  4531.  
  4532. 20kB RAM    0x5000
  4533. 64kB Flash
  4534.  
  4535. $3.18 at future electronics[1].
  4536.  
  4537. For debugging it might be good to have an STM32F1 chip with a little
  4538. more RAM.  Which one?
  4539.  
  4540.  
  4541. Package names[2]:
  4542.  
  4543. STM32F103 C|R|V|Z F|G
  4544.  
  4545. Package:
  4546.  C = LQFP 48
  4547.  R = LQFP 64
  4548.  V = LQFP 100
  4549.  Z = LFBGA 144
  4550.  
  4551. Flash / RAM kb:
  4552.  
  4553.  6 =   32 / 10
  4554.  8 =   64 / 20
  4555.  B =  128 / 20
  4556.  C =  256 / 48
  4557.  D =  384 / 64
  4558.  E =  512 / 64
  4559.  F =  758 / 96
  4560.  G = 1024 / 96
  4561.  
  4562. What are the last 2 characters from the pin numbering? (T6)
  4563.  
  4564. [1] http://www.futureelectronics.com/en/technologies/semiconductors/microcontrollers/32-bit/Pages/5227137-STM32F103C8T6.aspx?IM=0
  4565. [2] http://www.st.com/web/catalog/mmc/FM141/SC1169/SS1031/LN1565
  4566.  
  4567.  
  4568. Entry: gdbstub flash
  4569. Date: Sun Nov  9 21:18:34 EST 2014
  4570.  
  4571. GDB needs a memory map to handle flashing properly.  However it might
  4572. work with ordinary M packets as well.
  4573.  
  4574. It attempts to write 192 bytes at a time:
  4575.  
  4576. $X8000000,c0:...
  4577.  
  4578. Refman 3.3.3:
  4579.  
  4580. - The Flash memory can be programmed 16 bits (half words) at a time.
  4581.  
  4582. - The Flash memory erase operation can be performed at page level
  4583.  
  4584. Page size is
  4585. - 1kB for medium density devices (< 128kb)
  4586. - 2kB for high density
  4587.  
  4588. So when making the erase explicit this can be supported using ordinary
  4589. memory access.
  4590.  
  4591. Anyways.. its probably not too hard to support it:
  4592.  
  4593. - qSupported[2]
  4594. - qXfer:memory-map:read::offset,length
  4595. - vFlashErase:addr,length
  4596. - vFlashWrite:addr:XX
  4597. - vFlashDone
  4598.  
  4599.  
  4600. [1] https://sourceware.org/gdb/onlinedocs/gdb/Memory-Map-Format.html#Memory-Map-Format
  4601. [2] https://sourceware.org/gdb/onlinedocs/gdb/General-Query-Packets.html#qSupported
  4602.  
  4603.  
  4604. Entry: stm32f103 and jtag
  4605. Date: Mon Nov 10 01:56:26 EST 2014
  4606.  
  4607. Can't get the USB to work while the JTAG is plugged in.  Wondering
  4608. what this is..  Maybe clock issue?  Pins don't seem to conflict.
  4609.  
  4610. Let's try with a SWD interface.
  4611.  
  4612.  
  4613. Thing is though that this probably supports DFU.  Together with serial
  4614. monitor this might not need a separate JTAG adapter.
  4615.  
  4616.  
  4617. Entry: Other arguments
  4618. Date: Mon Nov 10 02:17:25 EST 2014
  4619.  
  4620. (gdb) p $sp
  4621. $9 = (void *) 0x20001000
  4622. (gdb) p test_call(1,2,3,4,0x40,0x41,0x42,0x43)
  4623.  
  4624. $X20000ff4,4:C...#27
  4625. $X20000ff0,4:B...#22
  4626. $X20000fec,4:A...#53
  4627. $X20000fe8,4:@...#27
  4628.  
  4629. It calls the code with sp 20000fe8
  4630. $Pd=e80f0020#e6
  4631.  
  4632.  
  4633. Entry: What are these other registers?
  4634. Date: Mon Nov 10 02:22:40 EST 2014
  4635.  
  4636. $P13=00000000f050510200000000#b4
  4637. $P19=00000000#77
  4638.  
  4639.  
  4640. Entry: 48kB image?
  4641. Date: Tue Nov 11 12:35:35 EST 2014
  4642.  
  4643. Image for gdbstub seems large.  These are the hogs:
  4644.  
  4645. 000002ee,__hexnan
  4646. 000003ec,_realloc_r
  4647. 00000530,_malloc_r
  4648. 00000588,__gethex
  4649. 00000eac,_strtod_r
  4650. 000011b8,__ssvfscanf_r
  4651. 000011f8,_dtoa_r
  4652. 00001ada,_svfprintf_r
  4653.  
  4654. I'm not sure why printf is in there, but scanf can probably be avoided
  4655. as it's only parsing hex numbers.
  4656.  
  4657.  
  4658. Entry: Weird stuff..
  4659. Date: Tue Nov 11 21:29:10 EST 2014
  4660.  
  4661. set *(uint32_t*)0x200000AC = ((uint32_t)counter_tick)|1
  4662.  
  4663.  
  4664. Entry: freenode #stm32
  4665. Date: Wed Nov 12 00:44:40 EST 2014
  4666.  
  4667. Look for the following in the irc log [1].
  4668.  
  4669. 00:42 < doelie> hi. anyone know if it's possible to set breakpoint registers from inside the machine as
  4670.                 opposed to jtag/sw? i'm writing a special purpose gdb stub and was wondering if this even
  4671.                 makes sense.
  4672. 00:43 < doelie> particular machine is stm32f103c8
  4673.  
  4674. dongs' replies lead to:
  4675.  
  4676. Debug inspection and monitor control register DEMCR[2].
  4677. FPB (flash patch breakpoint) programmer model[3].
  4678. Flash Patch Remap Register[4].
  4679.  
  4680. FP_CTRL   0xE0002000    See Flash Patch Control Register
  4681. FP_REMAP  0xE0002004    See Flash Patch Remap Register
  4682. FP_COMP0  0xE0002008    See Flash Patch Comparator Registers
  4683. FP_COMP1  0xE000200C
  4684. FP_COMP2  0xE0002010
  4685. FP_COMP3  0xE0002014
  4686. FP_COMP4  0xE0002018
  4687. FP_COMP5  0xE000201C
  4688. FP_COMP6  0xE0002020
  4689. FP_COMP7  0xE0002024
  4690.  
  4691. The STM32F103 reference manual doesn't mention it except for a brief
  4692. blurb at 31.12
  4693.  
  4694. [1] http://xob.kapsi.fi/~jpa/stm32/2014-11.log
  4695. [2] http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0337e/CEGHJDCF.html
  4696. [3] http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0337e/ch11s04s01.html
  4697. [4] http://infocenter.arm.com/help/topic/com.arm.doc.ddi0337e/ch11s04s01.html#BABGGDHH
  4698.  
  4699.  
  4700.  
  4701. Entry: GDB Stub Developer’s Guide
  4702. Date: Thu Nov 13 12:54:51 EST 2014
  4703.  
  4704. http://www.kpitgnutools.com/developersguide.htm
  4705.  
  4706.  
  4707.  
  4708. Entry: smstub vectors
  4709. Date: Thu Nov 13 13:11:04 EST 2014
  4710.  
  4711. How should vectors be handled?
  4712. Should the stub stay out of the way here?
  4713.  
  4714. Check VTOR register[1][2] 0xE000ED08
  4715.  
  4716. In libopencm3.h all vectors are declared weak in libopencm3/stm32/f1/nvic.h
  4717.  
  4718. [1] http://infocenter.arm.com/help/topic/com.arm.doc.dui0552a/Ciheijba.html
  4719. [2] http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0552a/CIHFDJCA.html
  4720.  
  4721.  
  4722.  
  4723. Entry: Stub mainloop
  4724. Date: Thu Nov 13 13:37:34 EST 2014
  4725.  
  4726. Leave it up to the application.  Poll GDB from its main loop?  No that
  4727. would complicate things.
  4728.  
  4729.  
  4730.  
  4731. Entry: stm32f peripheral info using libopencm3
  4732. Date: Sat Nov 15 11:23:39 EST 2014
  4733.  
  4734. Starting from example [1].
  4735.  
  4736. rcc_peripheral_enable_clock
  4737. timer_reset
  4738. timer_set_mode
  4739.  
  4740. Current timer value can be read out at:
  4741. TIM1_CNT
  4742.  
  4743.  
  4744. [1] https://gitorious.org/mdr32f9-libopencm3/mdr32f9-libopencm3-examples/source/f5b0aa5638b9903c7b76d14786d8090926cf7bb9:examples/stm32/f1/stm32-h103/timer/timer.c
  4745.  
  4746.  
  4747. Entry: stm32f startup
  4748. Date: Sat Nov 15 12:41:01 EST 2014
  4749.  
  4750. So reading out the TMR6 registers at 0x40001000 gives all 0.
  4751. Something isn't starting up properly.
  4752.  
  4753.  
  4754.  
  4755. Entry: Debug remote protocol
  4756. Date: Sat Nov 15 12:53:58 EST 2014
  4757.  
  4758. It can be enabled in gdb as well:
  4759.  
  4760. (gdb) set debug remote 1
  4761.  
  4762.  
  4763.  
  4764. Entry: Larger stm32f103 board works
  4765. Date: Sat Nov 15 12:58:29 EST 2014
  4766.  
  4767. Clock issue:
  4768.  
  4769. - rcc_clock_setup_in_hsi_out_48mhz(); // internal
  4770. + rcc_clock_setup_in_hse_8mhz_out_72mhz();
  4771.  
  4772.  
  4773. Entry: I need a flat register map
  4774. Date: Sat Nov 15 13:01:39 EST 2014
  4775.  
  4776. How to generate from libopenocd defs?
  4777.  
  4778. Tried to mine the header files, but that was a half-working mess of
  4779. ad-hoc shell scripts.  Now using structs with instances defined in
  4780. special secions + linker script.  Can probably be automated further.
  4781.  
  4782.  
  4783. (gdb) p/x M40.RCC.APB1ENR
  4784. 0x800000
  4785. That's just USB.
  4786. TIM6 is not running
  4787.  
  4788. It just refuses to set that bit:
  4789.  
  4790. (gdb) set M40.RCC.APB1ENR = 0x800010
  4791. (gdb) p/x M40.RCC.APB1ENR
  4792. $78 = 0x800000
  4793.  
  4794.  
  4795. Setting TIM2 does work.
  4796. (gdb) set M40.RCC.APB1ENR = 0x800001
  4797. (gdb) p/x M40.RCC.APB1ENR
  4798. $81 = 0x800001
  4799.  
  4800. Maybe the device just doesn't have a TIM5,TIM6?
  4801.  
  4802. Yes, that's why it doesn't work!
  4803. The 103x8 devices only have 4 timers 1,2,3,4
  4804. I have 103C8 and 103R8
  4805.  
  4806.  
  4807. Entry: de-jitter
  4808. Date: Sat Nov 15 23:57:26 EST 2014
  4809.  
  4810. Seems that interrupt latency is 12 cycles.
  4811.  
  4812. Check this again[1] to see the special cases.
  4813.  
  4814. If there are exceptions due to bus operation, de-jittering can be done
  4815. based on timer values followed by a jump into a nop sequence.
  4816.  
  4817. It's a bit harder to understand than on a PIC :)
  4818.  
  4819. [1] http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.faqs/ka16366.html
  4820.  
  4821.  
  4822. Entry: TIM2
  4823. Date: Sun Nov 16 00:07:47 EST 2014
  4824.  
  4825. So can pull one of the several interrupt flags in DEV.TIM2.SR
  4826. Figure out how this gets routed to the ISR.
  4827.  
  4828.  
  4829.  
  4830. Entry: Stub and vectors
  4831. Date: Tue Nov 25 09:22:57 EST 2014
  4832.  
  4833. Move vector table.
  4834.  
  4835. (gdb) p/x (int)&vector_table
  4836. $2 = 0x8002800
  4837.  
  4838. Check VTOR register[1][2] 0xE000ED08
  4839.  
  4840. OK works
  4841.  
  4842.  
  4843. #include <libopencm3/cm3/scb.h>
  4844.  
  4845.     /* Set Vector Table Offset to our memory based vector table */
  4846.     SCB_VTOR = (uint32_t)&vector_table;
  4847.  
  4848.  
  4849. Entry: registers and linker
  4850. Date: Tue Nov 25 09:50:15 EST 2014
  4851.  
  4852. Problem with using linker for register structs is that it will not
  4853. optimize the indirection.  I.e. base of struct is patched.
  4854.  
  4855. DEV.TIM2.SR
  4856.  
  4857. This loads &DEV as 0x40000000, then adds offset of TIM2.SR
  4858.  
  4859. Maybe linker can't patch addresses as offsets, i.e. patching a word by
  4860. adding to it?
  4861.  
  4862.  
  4863.  
  4864.  
  4865. Entry: F1 USART receive
  4866. Date: Thu Dec 18 13:55:49 EST 2014
  4867.  
  4868. CR1[RE] = 1
  4869.  
  4870. It seems that SR needs to be read for DR to be updated.
  4871.  
  4872.  
  4873.  
  4874. Entry: Setting bits
  4875. Date: Sat Feb  7 11:43:48 EST 2015
  4876.  
  4877. What is the fastest way to set a bit in a register on CM3?
  4878.  
  4879. Compiler generates:
  4880.  
  4881.         ldr r3, [pc, #32]     ; r3 <- 0x40000010 TIM2.SR
  4882.       ldr   r2, [r3, #0]
  4883.       bic.w r2, r2, #1
  4884.         str r2, [r3, #0]
  4885.  
  4886. The equivalent in gas is:
  4887.  
  4888.  
  4889.         .thumb
  4890.         .syntax unified
  4891. tim2_isr:      
  4892.         ldr r3, tim2_reg
  4893.       ldr   r2, [r3, #0]
  4894.         bic r2, r2, #1
  4895.         bx  lr
  4896. .align      
  4897. tim2_reg:
  4898.         .word 0x40000010
  4899.  
  4900. Unified syntax[1].
  4901.  
  4902. .syntax [unified | divided]
  4903.     This directive sets the Instruction Set Syntax as described in the ARM-Instruction-Set section.
  4904.  
  4905. W suffix forces a 32-bit instruction encoding. The .N suffix forces a 16-bit instruction encoding.
  4906.  
  4907.  
  4908.  
  4909. [1] https://sourceware.org/binutils/docs-2.23/as/ARM_002dInstruction_002dSet.html#ARM_002dInstruction_002dSet
  4910.  
  4911.  
  4912. Entry: Bit-banded accesses versus read-modify-write accesses
  4913. Date: Sat Feb  7 13:17:24 EST 2015
  4914.  
  4915. The bit-band operation to achieve the same result requires only a
  4916. single instruction and one or two processor clock cycles.
  4917.  
  4918. These operations are available in a fixed range of addresses, with
  4919. each bit in the address range 0x20000000 to 0x200fffff being aliased
  4920. at a word (4-byte) aligned address in the range 0x22000000 to
  4921. 0x23fffffc in the SRAM space. The same mechanism applies to the
  4922. corresponding address ranges in the region 0x40000000 to 0x43fffffc in
  4923. the Peripheral space.
  4924.  
  4925. This setting TIM2.SR.UIF = 0 on STM32F103
  4926.  
  4927.  8002e52:   4b08        ldr   r3, [pc, #32]     ; (8002e74 <tim2_isr+0x24>)
  4928.  8002e54:   2200        movs  r2, #0
  4929.  8002e56:   601a        str   r2, [r3, #0]
  4930.  ...
  4931.  8002e74:   42000400    .word 0x42000400
  4932.  
  4933.  
  4934. [1] http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.faqs/ka16401.html
  4935. [2] http://spin.atomicobject.com/2013/02/08/bit-banding/
  4936.  
  4937.  
  4938. Entry: rust
  4939. Date: Mon Feb 16 02:05:31 EST 2015
  4940.  
  4941. Compile from recent git.
  4942.  
  4943. See bin/rustc* and rust/Makefile
  4944.  
  4945. Qemu works with transparent user mode emulation if qemu-user is
  4946. installed (probably needs armel arch?).
  4947.  
  4948.  
  4949. Entry: STM32F level triggered interrupts
  4950. Date: Sat May  9 02:00:30 CEST 2015
  4951.  
  4952. EXTI is all edge triggered.  This is bad for some applications when it
  4953. is possible to miss an edge during setup.
  4954.  
  4955. The basic problem is that it is possible that an event arrives right
  4956. before a clear pending operation.
  4957.  
  4958. It seems possible to work around this by performing some extra reads..
  4959.  
  4960. [1] https://electronics.stackexchange.com/questions/158749/how-to-use-level-triggered-interrupts-with-stm32f1xx?rq=1
  4961.  
  4962.  
  4963. Entry: Qemu binfmt
  4964. Date: Sat Jun 27 12:18:50 EDT 2015
  4965.  
  4966. The "binfmt" how did it work again?
  4967.  
  4968. qemu-user-binfmt
  4969.  
  4970.  
  4971. Entry: multiarch cross-compile
  4972. Date: Sat Jun 27 12:58:36 EDT 2015
  4973.  
  4974. On zoo there is a dev32 lxc.  Start there.
  4975.  
  4976.  
  4977.  
  4978. Entry: semaphores
  4979. Date: Sat Jul 18 03:48:42 EDT 2015
  4980.  
  4981. http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dht0008a/ch01s03s03.html
  4982.  
  4983.  
  4984. Entry: fakeroot + qemu-arm-static
  4985. Date: Mon Aug 31 14:18:08 CEST 2015
  4986.  
  4987. [1] https://lists.debian.org/debian-embedded/2011/04/msg00001.html
  4988.  
  4989.  
  4990. Entry: rust bare metal arm
  4991. Date: Sun Sep 20 07:08:42 EDT 2015
  4992.  
  4993. http://antoinealb.net/programming/2015/05/01/rust-on-arm-microcontroller.html
  4994.  
  4995.  
  4996. Entry: qemu-arm-static
  4997. Date: Fri Mar 25 18:39:49 EDT 2016
  4998.  
  4999. Hard to understand how it actually works, but with binfmt-support, it
  5000. seems to be sufficient to place the target ld, ld-linux and libc in
  5001. /etc/qemu-binfmt/arm/lib
  5002.  
  5003. [email protected]:/etc/qemu-binfmt/arm/lib# ls -l
  5004. total 1344
  5005. -rwxr-xr-x 1 root root  134328 Feb 27 00:48 ld-2.18.so
  5006. lrwxrwxrwx 1 root root      10 Feb 22 23:03 ld-linux.so.3 -> ld-2.18.so
  5007. -rwxr-xr-x 1 root root 1239048 Feb 27 00:48 libc-2.18.so
  5008. lrwxrwxrwx 1 root root      12 Feb 22 23:02 libc.so.6 -> libc-2.18.so
  5009.  
  5010.  
  5011. https://lists.debian.org/debian-embedded/2011/04/msg00001.html
  5012. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=604268;msg=70
  5013. https://wiki.debian.org/QemuUserEmulation
  5014.  
  5015.  
  5016. So the way to go seems to be to get binfmt-support to work properly.
  5017. That is then linked to run qemu-arm-static (or any other program).
  5018.  
  5019. qemu-arm-static uses /etc/qemu-binfmt/arm/lib (hardcoded default).
  5020.  
  5021. So i have it working up to the point that it works manually:
  5022.  
  5023.   cd $ROOT/bin ; qemu-arm-static ls
  5024.  
  5025. but not automatically
  5026.  
  5027.  
  5028.  
  5029. Installing qemu-user-binfmt made it work on zoo, which uses qemu-arm from qemu-user package.
  5030.  
  5031. Also works on zoe, but I need to keep /etc/qemu-binfmt/arm/lib directory.
  5032.  
  5033. I still find it odd that I can't chroot..
  5034.  
  5035. Ha, on zoo I had trouble before it looks like:
  5036. [email protected]:/lib$ ls -al ld-linux.so.3
  5037. lrwxrwxrwx 1 root root 28 Feb 17 17:26 ld-linux.so.3 -> arm-linux-gnueabi/ld-2.21.so
  5038.  
  5039. It's part of libc6:armel
  5040.  
  5041.  
  5042. Final word:
  5043.  
  5044. dpkg --add-architecture armel
  5045. apt-get update
  5046. apt-get install libc6:armel qemu-user-binfmt
  5047.  
  5048. or
  5049.  
  5050. apt-get install libc6:armel qemu-user-static
  5051.  
  5052. Both work.
  5053. Now why doesn't the timesys chroot work?
  5054.  
  5055.  
  5056.  
  5057. Wow this is tricky...  This worked:
  5058.  
  5059.  
  5060. chroot mnt qemu-arm-static -L / bin/sh
  5061.  
  5062. This runs qemu-arm-static inside chroot, which is then told to look
  5063. for libraries at / instead of its default location.
  5064.  
  5065.  
  5066.  
  5067. Entry: openocd stlink
  5068. Date: Tue Mar 28 11:19:21 EDT 2017
  5069.  
  5070. really... fucking dev tools.  can't figure out how to halt the
  5071. processor.  it comes up fine but won't go into halt.
  5072.  
  5073. Open On-Chip Debugger 0.9.0 (2015-05-28-17:08)
  5074. Licensed under GNU GPL v2
  5075. For bug reports, read
  5076.       http://openocd.org/doc/doxygen/bugs.html
  5077. Info : auto-selecting first available session transport "hla_swd". To override use 'transport select <transport>'.
  5078. Info : The selected transport took over low-level target control. The results might differ compared to plain JTAG/SWD
  5079. adapter speed: 1000 kHz
  5080. adapter_nsrst_delay: 100
  5081. none separate
  5082. Info : Unable to match requested speed 1000 kHz, using 950 kHz
  5083. Info : Unable to match requested speed 1000 kHz, using 950 kHz
  5084. Info : clock speed 950 kHz
  5085. Info : STLINK v2 JTAG v17 API v2 SWIM v4 VID 0x0483 PID 0x3748
  5086. Info : using stlink api v2
  5087. Info : Target voltage: 3.177706
  5088. Info : stm32f103c8t6.cpu: hardware has 6 breakpoints, 4 watchpoints
  5089. Info : accepting 'gdb' connection on tcp/3333
  5090. Info : device id = 0x20036410
  5091. Warn : STM32 flash size failed, probe inaccurate - assuming 128k flash
  5092. Info : flash size = 128kbytes
  5093. undefined debug reason 7 - target needs reset
  5094.  
  5095.  
  5096. Tried on HY-MiniSTM32V, separately powered.  Now "mon halt" worked:
  5097.  
  5098. 1. power up board.
  5099. 2. power up programmer
  5100. 3. target remote
  5101. 4. monitor halt
  5102.  
  5103. Then
  5104. 5. reset board
  5105. 6. monitor halt
  5106.  
  5107. target state: halted
  5108. target halted due to debug-request, current mode: Thread
  5109. xPSR: 0x61000000 pc: 0x08000288 msp: 0x20001ff0
  5110.  
  5111.  
  5112.  
  5113. Now trying fresh small strip board, stlink-powered.  That worked.
  5114.  
  5115. Looks like my board is bad.  Taking it out of the breadboard.
  5116.  
  5117.  
  5118.  
  5119. Entry: git-private/armdev
  5120. Date: Thu Apr 20 10:13:07 EDT 2017
  5121.  
  5122. Does it need to be private?  IIRC that was just a lazy thing because
  5123. at some point it contained some NDA stuff.  It might be enough to just
  5124. kill the history?
  5125.  
  5126. It contains build tools setup and minimal libc for a host of arm and
  5127. other targets, including qemu.  Also has rust for arm setup.
  5128.  
  5129. It seems simplest to leave it as is, and move relevant code to
  5130. git/uc_tools
  5131.  
  5132. The arm.txt file doesn't seem to contain NDA stuff so moved it to
  5133. papers/arm.txt where you're reading it now.
  5134.  
  5135.  
  5136.  
  5137. Entry: uc_tools bootloader + rust code?
  5138. Date: Sat Sep 15 10:18:42 EDT 2018
  5139.  
  5140. What is needed to load a piece of rust code onto the STM32 boot
  5141. loader?  Say I want to write the serial port handler.
  5142.  
  5143. So it needs to be able to:
  5144. - go at a phsical address and find a structure there
  5145. - set the function points to point into rust code
  5146.  
  5147. The first is simple, the rest I don't know how to do.
  5148.  
  5149. How can C code call a Rust function?
  5150.  
  5151.  
  5152. https://users.rust-lang.org/t/how-to-call-rust-library-in-c/11436
  5153.  
  5154.  
  5155. #[no_mangle]
  5156. extern "C" fn foo() {
  5157.     // stuff
  5158. }
  5159.  
  5160. http://greyblake.com/blog/2017/08/10/exposing-rust-library-to-c/
  5161.  
  5162. Maybe the simplest way is to create a static library.
  5163.  
  5164. https://doc.rust-lang.org/cargo/reference/manifest.html#building-dynamic-or-static-libraries
  5165.  
  5166.  
  5167. Practically, start with git/armboot, and produce an .a library
  5168. exposing read and write functions.  Then write a small C wrapper to
  5169. glue it together.
  5170.  
  5171. It's not git/armboot.  This is old code.
  5172.  
  5173.  
  5174.  
  5175. Entry: system level emulation
  5176. Date: Tue May 28 10:41:20 EDT 2019
  5177.  
  5178. Using binfmt it is possible to have qemu run at the linux system call
  5179. interface, i.e. only the application binary is emulated.
  5180.  
  5181. How to use a debugger with that?
  5182.  
  5183. E.g.:
  5184.  
  5185. [email protected]:~/exo/axbc_overlay/mk/build$ qemu-arm-static ./test.pi.elf
  5186.  
  5187.  
  5188.  
  5189. Entry: fractional multiplication in C
  5190. Date: Sun May 17 19:13:30 EDT 2020
  5191.  
  5192. Probably best to do it in asse

Paste is for source code and general debugging text.

Login or Register to edit, delete and keep track of your pastes and more.

Raw Paste

Login or Register to edit or fork this paste. It's free.