SparkFun Forums 

Where electronics enthusiasts find answers.

Open source ARM Debugger
By elvis61
#157304
hi,

I downloaded this kernel under http://www.xilka.com/sheeva/3/3.6/3.6.9/source/ . After patching and compiling this kernel i loaded it on the target (sheevaplug) with openOCD and try it to debug. But if i set a breakpoint and try to run to this braekpoint i get problems like
- DCC write failed, expected end address 0xc065a714 got 0xc0008000
- Unable to set 32 bit software breakpoint at address c05ee48c - check that memory is read/writable

I am a newbie with openOCD. Please give me any hints

Here are my terminal outputs and my configurations for openOCD



Terminal 1: u-boot
-------------------------------------------------------------------------------
Using egiga0 device
TFTP from server 192.168.178.20; our IP address is 192.168.178.26
Filename 'uImage'.
Load address: 0x2000000
Loading: T T T T T T T T T T
Retry count exceeded; starting again
## Booting image at 02000000 ...
Bad Magic Number
Marvell>>


Terminal 2: openOCD
-------------------------------------------------------------------------------
lmde 1 # openocd
Open On-Chip Debugger 0.5.0 (2011-08-11-06:56)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.berlios.de/doc/doxygen/bugs.html
Info : only one transport option; autoselect 'jtag'
2000 kHz
trst_and_srst separate srst_gates_jtag trst_push_pull srst_open_drain
adapter_nsrst_delay: 200
jtag_ntrst_delay: 200
dcc downloads are enabled
fast memory access is disabled
sheevaplug_load_uboot
Info : clock speed 2000 kHz
Info : JTAG tap: feroceon.cpu tap/device found: 0x20a023d3 (mfg: 0x1e9, part: 0x0a02, ver: 0x2)
Info : Embedded ICE version 0
Info : feroceon.cpu: hardware has 1 breakpoint/watchpoint unit
Info : accepting 'telnet' connection from 4444
requesting target halt and executing a soft reset
target state: halted
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x000000d3 pc: 0x00000000
MMU: disabled, D-Cache: disabled, I-Cache: disabled
invalid command name "oad_image"
Error: DCC write failed, expected end address 0xc065a714 got 0xc0008000
in procedure 'load_image'
6629140 bytes written at address 0xc0008000
downloaded 6629140 bytes in 66.804214s (96.907 KiB/s)
Info : accepting 'gdb' connection from 3333
Warn : acknowledgment received, but no packet pending
Error: Unable to set 32 bit software breakpoint at address c05ee48c - check that memory is read/writable
Error: Unable to set 32 bit software breakpoint at address c05ee48c - check that memory is read/writable
Warn : breakpoint not set
Error: Unable to set 32 bit software breakpoint at address c05ee48c - check that memory is read/writable
Error: Unable to set 32 bit software breakpoint at address c05ee48c - check that memory is read/writable
Warn : breakpoint not set



Terminal 3: netcat
-------------------------------------------------------------------------------
lmde tux # netcat localhost 4444
????????Open On-Chip Debugger
> soft_reset_halt
soft_reset_halt
requesting target halt and executing a soft reset
target state: halted
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x000000d3 pc: 0x00000000
MMU: disabled, D-Cache: disabled, I-Cache: disabled
> oad_image /home/tux/aaa/arm/she/linux-3.6.9/vmlinux
oad_image /home/tux/aaa/arm/she/linux-3.6.9/vmlinux
invalid command name "oad_image"
> load_image /home/tux/aaa/arm/she/linux-3.6.9/vmlinux
load_image /home/tux/aaa/arm/she/linux-3.6.9/vmlinux
DCC write failed, expected end address 0xc065a714 got 0xc0008000
in procedure 'load_image'
> load_image /home/tux/aaa/arm/she/linux-3.6.9/vmlinux
load_image /home/tux/aaa/arm/she/linux-3.6.9/vmlinux
6629140 bytes written at address 0xc0008000
downloaded 6629140 bytes in 66.804214s (96.907 KiB/s)
accepting 'gdb' connection from 3333
acknowledgment received, but no packet pending
Unable to set 32 bit software breakpoint at address c05ee48c - check that memory is read/writable
Unable to set 32 bit software breakpoint at address c05ee48c - check that memory is read/writable
breakpoint not set
Unable to set 32 bit software breakpoint at address c05ee48c - check that memory is read/writable
Unable to set 32 bit software breakpoint at address c05ee48c - check that memory is read/writable
breakpoint not set
>


Terminal 4: gdb
-------------------------------------------------------------------------------
lmde linux-3.6.9 # arm-linux-gdb ./vmlinux
GNU gdb (GDB) 7.4.1
Copyright (C) 2012 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "--host=i686-pc-linux-gnu --target=arm-unknown-linux-uclibcgnueabi".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /home/tux/aaa/arm/she/linux-3.6.9/vmlinux...done.
(gdb) target remote localhost:3333
Remote debugging using localhost:3333
0x00000000 in ?? ()
(gdb) b start_kernel
Breakpoint 1 at 0xc05ee48c: file init/main.c, line 467.
(gdb) c
Continuing.
Unable to set 32 bit software breakpoint at address c05ee48c - check that memory is read/writable

^C
Program received signal SIGINT, Interrupt.
0x00640884 in ?? ()
(gdb) hbreak start_kernel
Note: breakpoint 1 also set at pc 0xc05ee48c.
Hardware assisted breakpoint 2 at 0xc05ee48c: file init/main.c, line 467.
(gdb) c
Continuing.
Unable to set 32 bit software breakpoint at address c05ee48c - check that memory is read/writable
^C
Program received signal SIGINT, Interrupt.
0x00640874 in ?? ()
(gdb)


openocd.cfg
-------------------------------------------------------------------------------
# Marvell SheevaPlug

source [find interface-sheevaplug.cfg]
source [find target-feroceon.cfg]

$_TARGETNAME configure \
-work-area-phys 0x10000000 \
-work-area-size 65536 \
-work-area-backup 0

arm7_9 dcc_downloads enable

arm7_9 fast_memory_access

# this assumes the hardware default peripherals location before u-Boot moves it
set _FLASHNAME $_CHIPNAME.flash

# nand device $_FLASHNAME orion 0 0xd8000000
nand device 0 orion feroceon.cpu 0xd8000000

proc sheevaplug_init { } {

# We need to assert DBGRQ while holding nSRST down.
# However DBGACK will be set only when nSRST is released.
# Furthermore, the JTAG interface doesn't respond at all when
# the CPU is in the WFI (wait for interrupts) state, so it is
# possible that initial tap examination failed. So let's
# re-examine the target again here when nSRST is asserted which
# should then succeed.
jtag_reset 0 1
feroceon.cpu arp_examine
halt 0
jtag_reset 0 0
wait_halt

arm mcr 15 0 0 1 0 0x00052078

mww 0xD0001400 0x43000C30 ;# DDR SDRAM Configuration Register
mww 0xD0001404 0x39543000 ;# Dunit Control Low Register
mww 0xD0001408 0x22125451 ;# DDR SDRAM Timing (Low) Register
mww 0xD000140C 0x00000833 ;# DDR SDRAM Timing (High) Register
mww 0xD0001410 0x000000CC ;# DDR SDRAM Address Control Register
mww 0xD0001414 0x00000000 ;# DDR SDRAM Open Pages Control Register
mww 0xD0001418 0x00000000 ;# DDR SDRAM Operation Register
mww 0xD000141C 0x00000C52 ;# DDR SDRAM Mode Register
mww 0xD0001420 0x00000042 ;# DDR SDRAM Extended Mode Register
mww 0xD0001424 0x0000F17F ;# Dunit Control High Register
mww 0xD0001428 0x00085520 ;# Dunit Control High Register
mww 0xD000147c 0x00008552 ;# Dunit Control High Register
mww 0xD0001504 0x0FFFFFF1 ;# CS0n Size Register
mww 0xD0001508 0x10000000 ;# CS1n Base Register
mww 0xD000150C 0x0FFFFFF5 ;# CS1n Size Register
mww 0xD0001514 0x00000000 ;# CS2n Size Register
mww 0xD000151C 0x00000000 ;# CS3n Size Register
mww 0xD0001494 0x003C0000 ;# DDR2 SDRAM ODT Control (Low) Register
mww 0xD0001498 0x00000000 ;# DDR2 SDRAM ODT Control (High) REgister
mww 0xD000149C 0x0000F80F ;# DDR2 Dunit ODT Control Register
mww 0xD0001480 0x00000001 ;# DDR SDRAM Initialization Control Register
mww 0xD0020204 0x00000000 ;# Main IRQ Interrupt Mask Register
mww 0xD0020204 0x00000000 ;# "
mww 0xD0020204 0x00000000 ;# "
mww 0xD0020204 0x00000000 ;# "
mww 0xD0020204 0x00000000 ;# "
mww 0xD0020204 0x00000000 ;# "
mww 0xD0020204 0x00000000 ;# "
mww 0xD0020204 0x00000000 ;# "
mww 0xD0020204 0x00000000 ;# "
mww 0xD0020204 0x00000000 ;# "
mww 0xD0020204 0x00000000 ;# "
mww 0xD0020204 0x00000000 ;# "
mww 0xD0020204 0x00000000 ;# "
mww 0xD0020204 0x00000000 ;# "
mww 0xD0020204 0x00000000 ;# "
mww 0xD0020204 0x00000000 ;# "
mww 0xD0020204 0x00000000 ;# "
mww 0xD0020204 0x00000000 ;# "
mww 0xD0020204 0x00000000 ;# "
mww 0xD0020204 0x00000000 ;# "
mww 0xD0020204 0x00000000 ;# "
mww 0xD0020204 0x00000000 ;# "
mww 0xD0020204 0x00000000 ;# "
mww 0xD0020204 0x00000000 ;# "
mww 0xD0020204 0x00000000 ;# "
mww 0xD0020204 0x00000000 ;# "
mww 0xD0020204 0x00000000 ;# "
mww 0xD0020204 0x00000000 ;# "
mww 0xD0020204 0x00000000 ;# "
mww 0xD0020204 0x00000000 ;# "
mww 0xD0020204 0x00000000 ;# "
mww 0xD0020204 0x00000000 ;# "
mww 0xD0020204 0x00000000 ;# "
mww 0xD0020204 0x00000000 ;# "
mww 0xD0020204 0x00000000 ;# "
mww 0xD0020204 0x00000000 ;# "
mww 0xD0020204 0x00000000 ;# "

mww 0xD0010000 0x01111111 ;# MPP 0 to 7
mww 0xD0010004 0x11113322 ;# MPP 8 to 15
mww 0xD0010008 0x00001111 ;# MPP 16 to 23

mww 0xD0010418 0x003E07CF ;# NAND Read Parameters REgister
mww 0xD001041C 0x000F0F0F ;# NAND Write Parameters Register
mww 0xD0010470 0x01C7D943 ;# NAND Flash Control Register

}

proc sheevaplug_reflash_uboot { } {

# reflash the u-Boot binary and reboot into it
sheevaplug_init
nand probe 0
nand erase 0 0x0 0xa0000
nand write 0 uboot.bin 0 oob_softecc_kw
resume

}

proc sheevaplug_reflash_uboot_env { } {

# reflash the u-Boot environment variables area
sheevaplug_init
nand probe 0
nand erase 0 0xa0000 0x40000
nand write 0 uboot-env.bin 0xa0000 oob_softecc_kw
resume

}

proc sheevaplug_load_uboot { } {

# load u-Boot into RAM and execute it
sheevaplug_init
load_image uboot.elf
verify_image uboot.elf
resume 0x00600000

}


interface-sheevaplug.cfg
-------------------------------------------------------------------------------
#
# Marvel SheevaPlug Development Kit
#
# http://www.marvell.com/products/embedde ... vaplug.jsp
#

interface ft2232
ft2232_layout sheevaplug
ft2232_vid_pid 0x9e88 0x9e8f
ft2232_device_desc "SheevaPlug JTAGKey FT2232D B"
adapter_khz 2000


target-feroceon.cfg
-------------------------------------------------------------------------------
######################################
# Target: Marvell Feroceon CPU core
######################################

if { [info exists CHIPNAME] } {
set _CHIPNAME $CHIPNAME
} else {
set _CHIPNAME feroceon
}

if { [info exists ENDIAN] } {
set _ENDIAN $ENDIAN
} else {
set _ENDIAN little
}

if { [info exists CPUTAPID ] } {
set _CPUTAPID $CPUTAPID
} else {
set _CPUTAPID 0x20a023d3
}

jtag newtap $_CHIPNAME cpu -irlen 4 -ircapture 0x1 -irmask 0xf -expected-id $_CPUTAPID

set _TARGETNAME $_CHIPNAME.cpu
target create $_TARGETNAME feroceon -endian $_ENDIAN -chain-position $_TARGETNAME

reset_config trst_and_srst
adapter_nsrst_delay 200
jtag_ntrst_delay 200






tanks in advance
By hsutherl
#157431
Hello Elvis,

I confess I only gave your post a quick once-over, so I may have missed something crucial.

It looks to me as if the SheevaPlug processor only has two hardware breakpoints (and gdb has somehow assigned them both to the same location?). If you're trying to debug code that resides in flash, you can only use hardware breakpoints. You'll have to clear #1 before you can set #3, clear #2 before you can set #4, and so forth. You may have to use the hbreak command rather than break (from gdb). [edit: maybe only one?]

Once you start debugging code in ram, you should be able to use software breakpoints, (unless there are hardware issues - I noticed a message saying MMU disabled but dunno if there might also be a memory protection unit or some such.)

It looks to me as if you might have configuration issues as well. No clue about those - sorry. I'm pretty much a newbie myself - hope NTfreak comes to your rescue. I'm interested in your results - I have a (gift) SheevaPlug that I've never tried openOCD with.

-Hugh

[edit]
After re-reading your post, I see you did use hbreak. Wonder why the messages about soft breakpoints. Maybe openOCD is not behaving as a perfect gdb server? Since it looks like you know that first address, you might try setting the breakpoint from the openocd telnet client and see if that works any better.
By elvis61
#157689
Hi hsutherl,
i followed your advice but without success unfortunately. Here my results

lmde openocd # openocd
Open On-Chip Debugger 0.5.0 (2011-08-11-06:56)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.berlios.de/doc/doxygen/bugs.html
Info : only one transport option; autoselect 'jtag'
2000 kHz
trst_and_srst separate srst_gates_jtag trst_push_pull srst_open_drain
adapter_nsrst_delay: 200
jtag_ntrst_delay: 200
dcc downloads are enabled
sheevaplug_load_uboot
Info : clock speed 2000 kHz
Info : JTAG tap: feroceon.cpu tap/device found: 0x20a023d3 (mfg: 0x1e9, part: 0x0a02, ver: 0x2)
Info : Embedded ICE version 0
Info : feroceon.cpu: hardware has 1 breakpoint/watchpoint unit
Info : accepting 'telnet' connection from 4444
target state: halted
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x000000d3 pc: 0xffff0000
MMU: disabled, D-Cache: disabled, I-Cache: disabled
requesting target halt and executing a soft reset
target state: halted
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x000000d3 pc: 0x00000000
MMU: disabled, D-Cache: disabled, I-Cache: disabled
6733916 bytes written at address 0xc0008000
downloaded 6733916 bytes in 71.533730s (91.930 KiB/s)
Warn : memory read caused data abort (address: 0xc0008000, size: 0x4, count: 0x1)
Warn : memory read caused data abort (address: 0xc0008000, size: 0x4, count: 0x1)
Error: Couldn't calculate PC of next instruction, current opcode was 0x00000000
in procedure 'step'
invalid command name "l"
Info : accepting 'gdb' connection from 3333
Warn : acknowledgment received, but no packet pending
Warn : memory read caused data abort (address: 0xc0008000, size: 0x4, count: 0x1)
Warn : memory read caused data abort (address: 0xc0007ffc, size: 0x4, count: 0x1)
Warn : memory read caused data abort (address: 0xc0008000, size: 0x4, count: 0x1)
Warn : memory read caused data abort (address: 0xc0007ffc, size: 0x4, count: 0x1)
Warn : memory read caused data abort (address: 0xc0008000, size: 0x4, count: 0x1)
Warn : memory read caused data abort (address: 0xc0007ffc, size: 0x4, count: 0x1)
Warn : memory read caused data abort (address: 0xc0008000, size: 0x4, count: 0x1)
Warn : memory read caused data abort (address: 0xc0007ffc, size: 0x4, count: 0x1)
Warn : memory read caused data abort (address: 0xc0008000, size: 0x4, count: 0x1)
Warn : memory read caused data abort (address: 0xc0008000, size: 0x4, count: 0x1)
Warn : memory read caused data abort (address: 0xc0008000, size: 0x4, count: 0x1)
Warn : memory read caused data abort (address: 0xc060348c, size: 0x4, count: 0x1)
Warn : memory read caused data abort (address: 0xc060348c, size: 0x4, count: 0x1)
Warn : memory read caused data abort (address: 0xc060348c, size: 0x4, count: 0x1)
Error: can't add breakpoint: unknown reason
usage: bp <address> <length> ['hw']
bp [address length ['hw']]
rbp address
in procedure 'bp'

lmde tux # netcat localhost 4444
��������Open On-Chip Debugger
> sheevaplug_init
sheevaplug_init
target state: halted
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x000000d3 pc: 0xffff0000
MMU: disabled, D-Cache: disabled, I-Cache: disabled
> soft_reset_halt
soft_reset_halt
requesting target halt and executing a soft reset
target state: halted
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x000000d3 pc: 0x00000000
MMU: disabled, D-Cache: disabled, I-Cache: disabled
> load_image /home/tux/aaa/arm/she/linux-3.7.8/vmlinux 0 elf
load_image /home/tux/aaa/arm/she/linux-3.7.8/vmlinux 0 elf
6733916 bytes written at address 0xc0008000
downloaded 6733916 bytes in 71.533730s (91.930 KiB/s)
> step 0xc0008000
step 0xc0008000
memory read caused data abort (address: 0xc0008000, size: 0x4, count: 0x1)
memory read caused data abort (address: 0xc0008000, size: 0x4, count: 0x1)
Couldn't calculate PC of next instruction, current opcode was 0x00000000
in procedure 'step'
>
accepting 'gdb' connection from 3333
acknowledgment received, but no packet pending
memory read caused data abort (address: 0xc0008000, size: 0x4, count: 0x1)
memory read caused data abort (address: 0xc0007ffc, size: 0x4, count: 0x1)
memory read caused data abort (address: 0xc0008000, size: 0x4, count: 0x1)
memory read caused data abort (address: 0xc0007ffc, size: 0x4, count: 0x1)
memory read caused data abort (address: 0xc0008000, size: 0x4, count: 0x1)
memory read caused data abort (address: 0xc0007ffc, size: 0x4, count: 0x1)
memory read caused data abort (address: 0xc0008000, size: 0x4, count: 0x1)
memory read caused data abort (address: 0xc0007ffc, size: 0x4, count: 0x1)
memory read caused data abort (address: 0xc0008000, size: 0x4, count: 0x1)
memory read caused data abort (address: 0xc0008000, size: 0x4, count: 0x1)
memory read caused data abort (address: 0xc0008000, size: 0x4, count: 0x1)
memory read caused data abort (address: 0xc060348c, size: 0x4, count: 0x1)
memory read caused data abort (address: 0xc060348c, size: 0x4, count: 0x1)
memory read caused data abort (address: 0xc060348c, size: 0x4, count: 0x1)
can't add breakpoint: unknown reason
> bp start_kernel
bp start_kernel
usage: bp <address> <length> ['hw']
bp [address length ['hw']]
rbp address
in procedure 'bp'
> continue
continue
>

lmde linux-3.7.8 # arm-linux-gdb ./vmlinux
GNU gdb (GDB) 7.4.1
Copyright (C) 2012 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "--host=i686-pc-linux-gnu --target=arm-unknown-linux-uclibcgnueabi".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /home/tux/aaa/arm/she/linux-3.7.8/vmlinux...(no debugging symbols found)...done.
(gdb) target remote localhost:3333
Remote debugging using localhost:3333
0xc0008000 in stext ()
(gdb) break start_kernel
Breakpoint 1 at 0xc060348c
(gdb) c
Continuing.
Warning:
Cannot insert breakpoint 1.
Error accessing memory address 0xc060348c: Unknown error 4294967295.

(gdb)

can really nobody help me ??

thanx
By hsutherl
#157693
I dug my SheevaPlug out of mothballs for comparision, but the FT2232 (or something related) seems to be dead. :( Maybe someone on plugcomputer.org can assist.