View source for OpenOCD

== <big>Barracuda module debug over JTAG using OpenOCD</big> ==


It was tested on  Ubuntu 10.04 LTS and  reciva-kernel-v24080215+00.tar.bz2 kernel pack.

===OpenOCD installation and testing ===

To install openocd in Ubuntu enter command

 sudo apt-get install openocd 

Create openocd config file ''JTAGdebug.cfg'' with this contents:

 #
 # Parallel port wiggler (many clones available) on port 0xc8b8
 #
 telnet_port 4444
 gdb_port 3333
 interface parport
 parport_port 0
 parport_cable wiggler
 # Found on the 'TinCanTools' Hammer board.
 if { [info exists CHIPNAME] } {
   set  _CHIPNAME $CHIPNAME
   } else {
   set  _CHIPNAME s3c2410
  }
  if { [info exists ENDIAN] } {
   set  _ENDIAN $ENDIAN
  } else {
  # This config file was defaulting to big endian..
   set  _ENDIAN little
 }
 if { [info exists CPUTAPID] } {
   set  _CPUTAPID $CPUTAPID
 } else {
   set  _CPUTAPID 0xffffffff
 }
 #use combined on interfaces or targets that cannot set TRST/SRST separately
 reset_config trst_and_srst
 #jtag scan chain
 jtag newtap $_CHIPNAME cpu -irlen 4 -ircapture 0x1 -irmask 0xf -expected-id $_CPUTAPID
 set _TARGETNAME $_CHIPNAME.cpu
 target create $_TARGETNAME arm920t -endian $_ENDIAN -chain-position $_TARGETNAME -variant arm920t
 $_TARGETNAME configure -work-area-virt 0 -work-area-phys 0x30800000 -work-area-size  0x20000 -work-area-backup 0
 # speed up memory downloads
 arm7_9 fast_memory_access enable
 arm7_9 dcc_downloads enable
 nand device s3c2410 s3c2410.cpu
 
Now it's possible to  test OpenOCD.
Connect JTAG cable to pc, power on radio and execute command in a shell 

 sudo openocd -f JTAGdebug.cfg 

You should see the output

 Open On-Chip Debugger 0.3.1 (2010-01-18-14:21)
 $URL$
 For bug reports, read
 	http://openocd.berlios.de/doc/doxygen/bugs.html
 parport port = 0
 trst_and_srst separate srst_gates_jtag trst_push_pull srst_open_drain
 fast memory access is enabled
 dcc downloads are enabled
 Error: Translation from jtag_speed to khz not implemented
 Info : interface specific clock speed value 0
 Info : JTAG tap: s3c2410.cpu tap/device found: 0x0032409d (mfg: 0x04e, part: 0x0324, ver: 0x0)
 Warn : JTAG tap: s3c2410.cpu       UNEXPECTED: 0x0032409d (mfg: 0x04e, part: 0x0324, ver: 0x0)
 Error: JTAG tap: s3c2410.cpu  expected 1 of 1: 0xffffffff (mfg: 0x7ff, part: 0xffff, ver: 0xf)
 Error: Trying to use configured scan chain anyway...
 Warn : Bypassing JTAG setup events due to errors
 Info : Embedded ICE version 2
 
Now you can halt radio connecting to OpenOCD with telnet in a new shell window

 telnet localhost 4444 

Telnet output : 

 Code: [Select]
 Trying ::1...
 Trying 127.0.0.1...
 Connected to localhost.
 Escape character is '^]'.
 Open On-Chip Debugger
 > 

In telnet terminal enter command ''halt'' and terminal writes

 > halt
 target state: halted
 target halted in ARM state due to debug-request, current mode: Supervisor
 cpsr: 0x20000093 pc: 0xc0015c74
 MMU: enabled, D-Cache: enabled, I-Cache: enabled
 >  

Now we can power off radio and go to second part.

=== Kernel with debug options compiling ===

To see debugging symbols in gdb shell you need compiled kernel with debug option enabled.
In reciva kernel Makefile you need to add -g option after -Wall in these 2 lines:

 HOSTCFLAGS	= -Wall '''-g''' -Wstrict-prototypes -O2 -fomit-frame-pointer
 CFLAGS := $(CPPFLAGS) -Wall '''-g''' -Wstrict-prototypes -Wno-trigraphs -O2 \
 
Now you can rebuild kernel.
After build you need a file vmlinux from reciva kernel root dir it's about 32M size.

If your radio kernel version is the same like kernel source you can skip information below how to flash new kernel to radio.

=== New  kernel flashing ===

The kernel file zImage could be found in folder 
/arch/arm/boot

To be suitable for sharpflash you need to use getpart utility

 getpart zImage 0 fc000 kernel.new

After this kernel.new size must be the same like kernel-mtd.bin from backups.

<span style="color:#FF0000"> <big>Before doing this be sure you have backup of your radio working kernel partition.</big> 

Now turn on radio and sharpflash the new kernel.

 sharpflash -w kernel.new 4000 fc000 
When flashing is finished restart radio.
If you have changed  in kernel source something, for debugging must use apropriate vmlinux file. 

=== Debugging with gdb ===
Turn on radio.
Run OpenOCD and  telnet. Enter ''halt'' command in telnet window when radio display lights up.
Now we need to run gdb in a new shell window. 

 root@reciva-dev:/home/shared# gdb

Gdb output screen

  GNU gdb (GDB) 7.1-ubuntu
 Copyright (C) 2010 Free Software Foundation, Inc.
 License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
 This is free software: you are free to change and redistribute it.
 There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
 and "show warranty" for details.
 This GDB was configured as "i486-linux-gnu".
 For bug reporting instructions, please see:
 <http://www.gnu.org/software/gdb/bugs/>.
 (gdb)  

to load debug symbols in gdb environment execute ''file vmlinux''.(I have copied vmlinux file to the place where  execute gdb in my case /home/shared) 

 (gdb)file vmlinux 

Output:

 Reading symbols from /home/shared/gdb/vmlinux...done.
 (gdb) 

Now connect to OpenOCD enter in gdb this command

 target remote localhost:3333 

Output :

 Remote debugging using localhost:3333
 0xc01b8d28 in cr_alignment ()
 (gdb) 

Now i'ts possible to get kernel variable values.

Below it's shown method how to get dmesg printout using log_buf variable.

===Gdb script for dmesg===

You can simply copy paste this script to gdb environment

 define dmesg
 set $i=0
 set $end_idx=(log_end -1)
  while($i< logged_chars)
  printf"%c",log_buf[$i]
  set $i=$i+1
  end
 end 

At the end you need to press enter.
Output :

 (gdb) define dmesg
 Type commands for definition of "dmesg".
 End with a line saying just "end".
 >set $i=0
 >set $end_idx=(log_end -1)
  >while($i< logged_chars)
  >printf"%c",log_buf[$i]
  >set $i=$i+1
  >end
 >end
 (gdb) 

Now execute ''dmesg'' command in gdb shell

 (gdb) dmesg
 <4>Linux version 2.4.26-vrs1-bast2 (pb@bob.internal.reciva.com) (gcc version 3.3.4) v24080215+00 #1 Fri Feb 15 17:33:14 GMT 2008
 <4>CPU: Arm920Tid(wb) revision 0
 <4>Machine: Reciva-IR2
 <4>HWCONFIG values are: 15 1f (1013)
 <4>S3C2410: 202.800000 MHz, memory 101.400000 MHz, pclk 50.700000 MHz
 <4>On node 0 totalpages: 8192
 <4>zone(0): 8192 pages.
 <4>zone(1): 0 pages.
 <4>zone(2): 0 pages.
 <4>Kernel command line: root=/dev/mtdblock2 ro init=/linuxrc
 <7>Relocating machine vectors to 0xffff0000
 <4>irq: clearing subpending status 00000402
 <4>bast_init_irq:
 <4>setup_timer: TCNTB4 at d890003c
 <4>setup_timer: tcon=00000000, tcnt should be f799
 <4>setup_timer: about to configure timer4
 <4>setup_timer: stopping timer
 <4>setup_timer: adding interrupt
 <4>setup_timer: starting timer
 <4>Calibrating delay loop (skipped)... 101.17 BogoMIPS
 <6>Memory: 32MB = 32MB total
 ---Type <return> to continue, or q <return> to quit---

Pressing enter you can read all dmesg.