RPi 2 and OpenOCD

[Jojjec1]

Hi,
Has anyone been able to debug the RPi 2 with OpenOCD yet?
I have been looking for a target config with no luck. I tried to modify another cortex target config but I do not have all details to succeed.

The following is a mix rasperrypi and imx6 config. From my understanding there is alot of changes in the JTAG interface from ARMv6 and ARMv7.
Is there a known CoreSight base address for Raspberry pi 2?

target/raspberypi2.cfg:

Code: Select all

adapter_khz 1000
adapter_nsrst_delay 400
reset_config none

if { [info exists CHIPNAME] } {
set _CHIPNAME $CHIPNAME
} else {
set _CHIPNAME rpi2
}

if { [info exists DAP_TAPID] } {
        set _DAP_TAPID $DAP_TAPID
} else {
        set _DAP_TAPID 0x4ba00477
}

jtag newtap $_CHIPNAME dap -irlen 4 -ircapture 0x01 -irmask 0x0f \
        -expected-id $_DAP_TAPID
set _TARGETNAME $_CHIPNAME.cpu.0
target create $_TARGETNAME cortex_a -chain-position $_CHIPNAME.dap \
        -coreid 0 -dbgbase 0x82150000

$_TARGETNAME configure -event reset-assert-post "cortex_a dbginit"

$_TARGETNAME configure -event gdb-attach { halt }

I've been able to connect gdb to OpenOCD but after that I get lots of errors.

Open On-Chip Debugger 0.8.0 (2015-02-14-10:00)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.sourceforge.net/doc/doxygen/bugs.html
Info : only one transport option; autoselect 'jtag'
adapter speed: 1000 kHz
adapter_nsrst_delay: 400
none separate
Info : clock speed 1000 kHz
Info : JTAG tap: rpi2.dap tap/device found: 0x4ba00477 (mfg: 0x23b, part: 0xba00, ver: 0x4)
Warn : Invalid ACK 0x5 in JTAG-DP transaction
Warn : Invalid ACK 0x5 in JTAG-DP transaction
Warn : Invalid ACK 0x6 in JTAG-DP transaction
Warn : Invalid ACK 0x7 in JTAG-DP transaction

Info : rpi2.cpu.0: hardware has 1 breakpoints, 1 watchpoints
Warn : Invalid ACK 0x6 in JTAG-DP transaction
Polling target rpi2.cpu.0 failed, GDB will be halted. Polling again in 100ms
Polling target rpi2.cpu.0 succeeded again
Warn : Invalid ACK 0x6 in JTAG-DP transaction
Polling target rpi2.cpu.0 failed, GDB will be halted. Polling again in 100ms
Polling target rpi2.cpu.0 succeeded again
Warn : Invalid ACK 0x7 in JTAG-DP transaction
Polling target rpi2.cpu.0 failed, GDB will be halted. Polling again in 100ms
Polling target rpi2.cpu.0 succeeded again
Warn : Invalid ACK 0x6 in JTAG-DP transaction
Polling target rpi2.cpu.0 failed, GDB will be halted. Polling again in 100ms
Polling target rpi2.cpu.0 succeeded again
Info : accepting 'gdb' connection from 3333
Warn : Invalid ACK 0x6 in JTAG-DP transaction
in procedure 'halt'

Error: Register map is not available yet, the target is not fully initialised
...
undefined debug reason 7 - target needs reset
...
Error: Target not halted
...
Error: cortex_a8_mmu: target not halted
...
Warn : Invalid ACK 0x6 in JTAG-DP transaction
...
Polling target rpi2.cpu.0 failed, GDB will be halted. Polling again in 100ms
Polling target rpi2.cpu.0 succeeded again

[mimi123]

It is a Cortex-A7, and you have to modify jtag_init with the new PERI_BASE

[Jojjec1]

mimi123, care to elaborate?
Is jtag_init an internal initialization hook in OpenOCD? Looked at cortex_a.c and saw that there are some cortex a8 and cortex r4 specific details.

You mention PERI_BASE, has that something to do with JTAG? I use a Olimex usb jtag tiny, I do not use the bcm2835gpio OpenOCD driver.

Thanks for the answer.

[mimi123]

mimi123, care to elaborate?
Is jtag_init an internal initialization hook in OpenOCD? Looked at cortex_a.c and saw that there are some cortex a8 and cortex r4 specific details.

You mention PERI_BASE, has that something to do with JTAG? I use a Olimex usb jtag tiny, I do not use the bcm2835gpio OpenOCD driver.

Thanks for the answer.

you need to enable JTAG GPIO function, like on Pi1, or you get garbage, except if you use the VC4 JTAG interface

[Jojjec1]

I have enabled JTAG on the GPIO.
I use GPIO22-27 and I can assume that atleast some pins work since I've been able to recognice the dap tap id (0x4ba00477).
Can I use get JTAG interface on the GPU to debug the CPU? It is technically possible with JTAG but I don't think the pi is built for it.

[mimi123]

I have enabled JTAG on the GPIO.
I use GPIO22-27 and I can assume that atleast some pins work since I've been able to recognice the dap tap id (0x4ba00477).
Can I use get JTAG interface on the GPU to debug the CPU? It is technically possible with JTAG but I don't think the pi is built for it.

Set up OpenOCD for Cortex-A7 with CoreSight.

[mestu]

Hi,

you need to tell OpenOCD that the AP Index is 0
and that the base addresses for each Cortex-A7 in turn are :

0x80010000
0x80012000
0x80014000
0x80016000

just got JTAG working (but not with OpenOCD)

Hope that helps ?

cheers
Newbie Stu

[didrikl]

Hi all,

I've been looking into using OpenOCD with RPi2 for a while, and now it appears that I got everything working. I made a pull request to update dwelch's JTAG test program which can be found here.

You can also check out my test programs which can be found here, and my guide to using RPi2 together with U-Boot and/or a serial adapter and/or the FT2232H Mini-Module JTAG adapter (which I can highly recommend) here.

I hope helped someone solve this, if the solution was not obvious from the previous answers, that is.

[arjunhary]

Hi,

I am using openocd with gdb to load and debug program on the RPI2. I followed the examples from dwelch67/ I am able to do all of the gdb features except watch points. All my breakpoints work and code breaks correctly. But when i set watch points on memory location and also variables, it does not work. For e.g. i am debugging some SPI based issues and set watch *0x3f204000. I can clearly see the register value changing when i do display/x *((int*)0x3f204000). The reason i need the watch point is I am trying to do DMA on the SPI and want to see the register is being written by the DMA engine. Am i missing something here?

Regards
Arjun

[arjunhary]

Hi,

I am using openocd and gdb with RPI2 to do bare metal programming. I used the example setup from dwelch67 and have been using that setup to download and debug programs for a while. I recently have been trying to get SPI working with DMA on baremetal for the piTFT and have been trying to use watchpoints to debug a problem. Looks like the watch points are not working or I am doing not doing it right. I tried doing watch *0x3f204000 and write to that register but the watchpoint does not trigger but it tells me that HW watch point set. I checked it by doing display/x *((int*)0x3f204000) and i see the value has changed. I am trying to see if the DMA engine is writing to this register. Am i missing something and not even sure if the problem is with gdb or openocd. Any help would be appreciated.

Regards
Arjun

[dwelch67]

do watchpoints work elsewhere? what about ram, can you specify a location in arms address space, then modify it with an arm program and see the watchpoint trap that?

possible that the feature you are looking for is not supported or the logic is not something that can trap that access, or the gpu is changing that location which the arm debugger will not be able to watch since it doesnt go through the arm (I wouldnt assume "watching" means beat up the bus polling, I would assume it means if we see this address cross the bus then trigger on it).

David

[dwelch67]

you say dma is writing to this register, whose dma? something outside the arm? I dont know how the arms debugger would be able to watch that.

[arjunhary]

It does not work in the arm address space as well or on local as well as global variables. My code does not use the GPU as far as i know. I set a watchpoint on a RAM location and change it in the program and the watchpoint still does not trigger.

[dwelch67]

The dma controller is not within the arm core so changes to it or changes things it touches are not within the scope of the arm on core debugger, so there is no reason to expect an arm watchpoint to see any of its activity. (nor would you see any other peripherals activity nor gpu activity for the same reason).

The bigger thing though is if you cant watch things that ARE initiated by the arm core (simple memory accesses by the arm program), then all bets are off anyway. Almost 30 years of this kind of baremetal work and I have never had a need for a debugger, there are other ways to figure out what is going on, that do work, so perhaps you should try some other approach.

You can look at the ARM ARM and TRM for this core to see what the ARM debuggers capabilities are, then see if gdb and openocd support those. You may want to telnet into openocd instead of using gdb as your user interface to remove one layer of uncertainty. And that still doesnt mean they compiled all of that into the core...Maybe the CPUID registers will indicate what is available.

[arjunhary]

Even when i use the arm to set memory it does not trigger. When openocd starts it displays the following, which i assume means it has 4 watchpoints though your point that it may not be enabled makes sense.

Info : bcmrpi2.cpu0: hardware has 6 breakpoints, 4 watchpoints
Info : bcmrpi2.cpu1: hardware has 6 breakpoints, 4 watchpoints
Info : bcmrpi2.cpu2: hardware has 6 breakpoints, 4 watchpoints
Info : bcmrpi2.cpu3: hardware has 6 breakpoints, 4 watchpoints


Can you recommend an idea for debug. My problem is i am trying to use DMA to transfer data on the SPI but i cannot confirm if the DMA Is starting the transfer by looking at the SPI control register. Other than a scope, is there any other way to look at it.

[dwelch67]

that would be my answer, either use a scope or find another spi target to play with that you can poll/monitor (nokia 5510 display for example).

you cant use non-dma spi accesses later to inspect the target to see what happened?

[dwelch67]

I barely got that openocd script working and called it done, I use openocd and jtag all day every day at work, but with the rpi when I use one I have gravitated toward a serial based bootloader instead of wiring up jtag. and that rpi2 openocd config, I pulled together info from other folks that had figured it out. so there is a possibility there is more to do there. you have eliminated gdb I assume to make sure that it is not the gdb to openocd that is the problem and instead openocd to arm? None of this will help with the dma since it is not part of the arm.

[dwelch67]

you could take another raspberry pi or other board with gpio configure them as inputs and poll really fast making a homebrew logic analyzer to see what if anything is going on on the spi bus.

[arjunhary]

I have not yet tried to eliminate gdb, I will try that later this week.Question on the DMA though. I read that the DMA control block should use bus address (Starting with 0xc0 in my case since l2 cache is disabled) . Should the source and destination address be bus addresses too? I tried an example where the control block addresses where starting with 0xC but the source and destination addresses where 0x00(arm address spaces in the RAM). It worked. On the rpi2 i am using 0x3f204004 in the DMA for the SPI. Would this work? I am trying to do DMA for the pitft (ILI9341). Any ideas on this?

[arjunhary]

BTW . I have the SPI working in polling mode. Just trying to see if i can get it to work through the DMA.

[dwelch67]

I have not messed with the dma engine so dont know...Maybe someone else here has messed with it.

[arre]

Hi,

I am in fact debugging my Rpi2 with my rpi1 over jtag through bitbanging it via openocd.

> On the pi2, I run the jtagenabler to set up the correct pinmuxes
> On the pi1, I run openocd like this: sudo ../src/openocd -f interface/raspberrypi-native.cfg -f rpi2.cfg
> I have the right pins connected:) (See pinout.xyz and the -native.cfg for the mapping)

My raspberrypi-native.cfg:

Code: Select all

interface bcm2835gpio

bcm2835gpio_peripheral_base 0x20000000

# Transition delay calculation: SPEED_COEFF/khz - SPEED_OFFSET
# These depend on system clock, calibrated for stock 700MHz
# bcm2835gpio_speed SPEED_COEFF SPEED_OFFSET
bcm2835gpio_speed_coeffs 113714 28

# Each of the JTAG lines need a gpio number set: tck tms tdi tdo
# Header pin numbers: 23 22 19 21
bcm2835gpio_jtag_nums 11 25 10 9

# If you define trst or srst, use appropriate reset_config
# Header pin numbers: TRST - 26, SRST - 18

 bcm2835gpio_trst_num 7
 reset_config trst_only

# bcm2835gpio_srst_num 24
# reset_config srst_only srst_push_pull

# or if you have both connected,
# reset_config trst_and_srst srst_push_pull

My rpi2.cfg:

Code: Select all

# ref: http://www.raspberrypi.org/forums/viewtopic.php?f=72&t=100268
#    : http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0464f/ch10s06s01.html

#adapter_khz 1000
adapter_khz 500
#adapter_nsrst_delay 400
jtag_ntrst_assert_width 500
#jtag_ntrst_delay 1000

#reset_config none
reset_config trst_only

if { [info exists CHIPNAME] } {
set _CHIPNAME $CHIPNAME
} else {
set _CHIPNAME rpi2
}

#
# Main DAP
#
if { [info exists DAP_TAPID] } {
   set _DAP_TAPID $DAP_TAPID
} else {
   set _DAP_TAPID 0x4ba00477
}
jtag newtap $_CHIPNAME dap -irlen 4 -ircapture 0x01 -irmask 0xf -expected-id $_DAP_TAPID

set _TARGETNAME $_CHIPNAME.cpu.0
target create $_TARGETNAME cortex_a -chain-position $_CHIPNAME.dap -coreid 0 -dbgbase 0x80010000
set _TARGETNAME $_CHIPNAME.cpu.1
target create $_TARGETNAME cortex_a -chain-position $_CHIPNAME.dap -coreid 1 -dbgbase 0x80012000
set _TARGETNAME $_CHIPNAME.cpu.2
target create $_TARGETNAME cortex_a -chain-position $_CHIPNAME.dap -coreid 2 -dbgbase 0x80014000
set _TARGETNAME $_CHIPNAME.cpu.3
target create $_TARGETNAME cortex_a -chain-position $_CHIPNAME.dap -coreid 3 -dbgbase 0x80016000

$_TARGETNAME configure -event reset-assert-post "cortex_a dbginit"

#target smp $_CHIPNAME.cpu.0 $_CHIPNAME.cpu.1 $_CHIPNAME.cpu.2 $_CHIPNAME.cpu.3

$_TARGETNAME configure -event gdb-attach { halt }

I thought I'd post a nice and lengthy blog entry at some point, but never found the time. Anyway, hope this helps someone.

[ten0]

I've tried arre's code, and it seems to work well until I try to attach GDB :

Code: Select all

Open On-Chip Debugger 0.10.0-dev-00463-g0c2de8b-dirty (2016-12-21-09:33)
Licensed under GNU GPL v2
For bug reports, read
	http://openocd.org/doc/doxygen/bugs.html
BCM2835 GPIO config: tck = 19, tms = 26, tdi = 13, tdo = 6
BCM2835 GPIO nums: swclk = 19, swdio = 26
BCM2835 GPIO config: trst = 5
trst_only separate trst_push_pull
BCM2835 GPIO config: srst = 18
trst_and_srst separate srst_gates_jtag trst_push_pull srst_push_pull connect_deassert_srst
adapter speed: 500 kHz
trst_only separate trst_push_pull
adapter speed: 500 kHz
Info : BCM2835 GPIO JTAG/SWD bitbang driver
Info : JTAG and SWD modes enabled
Info : clock speed 500 kHz
Info : JTAG tap: rpi2.dap tap/device found: 0x4ba00477 (mfg: 0x23b (ARM Ltd.), part: 0xba00, ver: 0x4)
Info : rpi2.cpu.0: hardware has 6 breakpoints, 4 watchpoints
Info : rpi2.cpu.1: hardware has 6 breakpoints, 4 watchpoints
Info : rpi2.cpu.2: hardware has 6 breakpoints, 4 watchpoints
Info : rpi2.cpu.3: hardware has 6 breakpoints, 4 watchpoints
Info : accepting 'gdb' connection on tcp/3333
Error: Register map is not available yet, the target is not fully initialised
Error: Register map is not available yet, the target is not fully initialised
Error: Register map is not available yet, the target is not fully initialised
Error: Register map is not available yet, the target is not fully initialised
Error: Register map is not available yet, the target is not fully initialised
Error: Register map is not available yet, the target is not fully initialised
Error: Register map is not available yet, the target is not fully initialised
Error: Register map is not available yet, the target is not fully initialised
Error: Register map is not available yet, the target is not fully initialised
Error: Register map is not available yet, the target is not fully initialised
Error: Register map is not available yet, the target is not fully initialised
Error: Register map is not available yet, the target is not fully initialised
Error: Register map is not available yet, the target is not fully initialised
Error: Register map is not available yet, the target is not fully initialised
Error: Register map is not available yet, the target is not fully initialised
Error: Register map is not available yet, the target is not fully initialised
Error: Register map is not available yet, the target is not fully initialised
Error: Register map is not available yet, the target is not fully initialised
Error: Register map is not available yet, the target is not fully initialised
Error: Register map is not available yet, the target is not fully initialised
Error: Register map is not available yet, the target is not fully initialised
Error: Register map is not available yet, the target is not fully initialised
Error: Register map is not available yet, the target is not fully initialised
Error: Register map is not available yet, the target is not fully initialised
Error: Register map is not available yet, the target is not fully initialised
Error: Register map is not available yet, the target is not fully initialised
Error: Register map is not available yet, the target is not fully initialised
Error: Register map is not available yet, the target is not fully initialised
Error: Register map is not available yet, the target is not fully initialised
Error: Register map is not available yet, the target is not fully initialised
Error: Register map is not available yet, the target is not fully initialised
Error: Register map is not available yet, the target is not fully initialised
undefined debug reason 7 - target needs reset
Error: Register map is not available yet, the target is not fully initialised
Error: Register map is not available yet, the target is not fully initialised
Error: Register map is not available yet, the target is not fully initialised
Error: Register map is not available yet, the target is not fully initialised
Error: Register map is not available yet, the target is not fully initialised
Error: Register map is not available yet, the target is not fully initialised
Error: Register map is not available yet, the target is not fully initialised
Error: Register map is not available yet, the target is not fully initialised
Error: Register map is not available yet, the target is not fully initialised
Error: Register map is not available yet, the target is not fully initialised
Error: Register map is not available yet, the target is not fully initialised
Error: Register map is not available yet, the target is not fully initialised
Error: Register map is not available yet, the target is not fully initialised
Error: Register map is not available yet, the target is not fully initialised
Error: Register map is not available yet, the target is not fully initialised
Error: Register map is not available yet, the target is not fully initialised
Error: Target not halted
Error: Target not halted
Error: Target not halted
Error: Target not halted
Error: Target not halted
Error: Target not halted
Error: Target not halted
Error: Target not halted
Error: Target not halted
Error: Target not halted
Error: Target not halted
Error: Target not halted
Error: Target not halted
Error: Target not halted
Error: Target not halted
Error: Target not halted
Error: Target not halted
Error: Timeout waiting for cortex_a_exec_opcode
Error: cortex_a_mmu: target not halted
Warn : target not halted
Error: Timeout waiting for cortex_a_exec_opcode
Warn : negative acknowledgment, but no packet pending
Error: Timeout waiting for cortex_a_exec_opcode
Error: cortex_a_mmu: target not halted
Warn : target not halted
Error: Timeout waiting for cortex_a_exec_opcode
Warn : negative acknowledgment, but no packet pending
Error: Timeout waiting for cortex_a_exec_opcode
Error: cortex_a_mmu: target not halted
Warn : target not halted
Error: Timeout waiting for cortex_a_exec_opcode
Warn : negative acknowledgment, but no packet pending
Error: Timeout waiting for cortex_a_exec_opcode
Error: cortex_a_mmu: target not halted
Warn : target not halted
Error: Timeout waiting for cortex_a_exec_opcode
Warn : negative acknowledgment, but no packet pending
Error: Timeout waiting for cortex_a_exec_opcode
Error: cortex_a_mmu: target not halted
Warn : target not halted
Error: Timeout waiting for cortex_a_exec_opcode
Warn : negative acknowledgment, but no packet pending
Error: Timeout waiting for cortex_a_exec_opcode
Error: cortex_a_mmu: target not halted
Warn : target not halted
Error: Timeout waiting for cortex_a_exec_opcode
Warn : negative acknowledgment, but no packet pending
Error: Timeout waiting for cortex_a_exec_opcode
Error: cortex_a_mmu: target not halted
Warn : target not halted
Error: Timeout waiting for cortex_a_exec_opcode
Warn : negative acknowledgment, but no packet pending
Error: Timeout waiting for cortex_a_exec_opcode
Error: cortex_a_mmu: target not halted
Warn : target not halted
Error: Timeout waiting for cortex_a_exec_opcode
Warn : negative acknowledgment, but no packet pending
Error: Timeout waiting for cortex_a_exec_opcode
Error: cortex_a_mmu: target not halted
Warn : target not halted
Error: Timeout waiting for cortex_a_exec_opcode
Warn : negative acknowledgment, but no packet pending
Error: Timeout waiting for cortex_a_exec_opcode
Error: cortex_a_mmu: target not halted
Warn : target not halted
Error: Timeout waiting for cortex_a_exec_opcode
Warn : negative acknowledgment, but no packet pending
Error: Timeout waiting for cortex_a_exec_opcode
Error: cortex_a_mmu: target not halted
Warn : target not halted
Error: Timeout waiting for cortex_a_exec_opcode
Warn : negative acknowledgment, but no packet pending
Error: Timeout waiting for cortex_a_exec_opcode
Error: cortex_a_mmu: target not halted
Warn : target not halted
Error: Timeout waiting for cortex_a_exec_opcode
Warn : negative acknowledgment, but no packet pending
Error: Timeout waiting for cortex_a_exec_opcode
Error: cortex_a_mmu: target not halted
Warn : target not halted
Error: Timeout waiting for cortex_a_exec_opcode
Warn : negative acknowledgment, but no packet pending
Error: Timeout waiting for cortex_a_exec_opcode
Error: cortex_a_mmu: target not halted
Warn : target not halted
Error: Timeout waiting for cortex_a_exec_opcode
Warn : negative acknowledgment, but no packet pending
Error: Timeout waiting for cortex_a_exec_opcode
Error: cortex_a_mmu: target not halted
Warn : target not halted
Error: Timeout waiting for cortex_a_exec_opcode
Warn : negative acknowledgment, but no packet pending
Error: Timeout waiting for cortex_a_exec_opcode
Error: cortex_a_mmu: target not halted
Warn : target not halted
Error: Timeout waiting for cortex_a_exec_opcode
Warn : negative acknowledgment, but no packet pending
Error: Timeout waiting for cortex_a_exec_opcode
Error: cortex_a_mmu: target not halted
Warn : target not halted
Error: Timeout waiting for cortex_a_exec_opcode
Warn : negative acknowledgment, but no packet pending
Error: Timeout waiting for cortex_a_exec_opcode
Error: cortex_a_mmu: target not halted
Warn : target not halted
Error: Timeout waiting for cortex_a_exec_opcode
Warn : negative acknowledgment, but no packet pending
Warn : keep_alive() was not invoked in the 1000ms timelimit. GDB alive packet not sent! (1002). Workaround: increase "set remotetimeout" in GDB

The chip is indeed not halted.
Note that I'm using a RPI3 to debug my RPI2, whose JTAG has been enabled by setting pins 22,24,25,26,27 to their ALT4 function through some baremetal code.

What could cause this error ?

[dwelch67]

which flavor of rpi2? there are two different ones with different processor cores, I dont expect the jtag access to be the same.

[ten0]

It's a Raspberry Pi 2 B V1.1, with a BCM2836 chip (A7 MPCore).