About JTAG — debugger

There are always a lot of questions on the initial stage by starting of a hardware. Especially, when something is not working, or there is no understanding how it should work.

This section contains working versions of your log files, commands, debug algorithms that can be oriented and compared with yours to understand what is not working.

There is a working example with jtag-debugger named peedi.

The connection to the debugger peedi can be realized via the serial port
rs232 and via the network port Ethernet using utility named telnet.

For information about network settings of peedi it is needed to use the connection via the serial port rs232. Booting log:

Starting Redboot v11.4.15 ...
Platform: PEEDI
RAM: 0x00000000-0x00800000 [0x0000db48-0x007e1000 available]
FLASH SST39VF3201B: 0x05800000-0x05bfffff, 64 x 0x10000 blocks

*** INFO: to enter RedBoot restart while holding both buttons pressed ***

== Executing boot script
RedBoot> fis load peedi; go
Please wait... 

  IP address         :
  Subnet mask        :
  Gateway            :
  MAC address        : 02:00:14:86:67:0b

PEEDI - Powerful Embedded Ethernet Debug Interface
Copyright (c) 2005-2011 www.ronetix.at - All rights reserved
Hw:1.2, Fw:11.5.12, SN: PD-0000-1486-670B

Network settings of peedi are available for editing from redboot. For entering redboot two buttons are to be pressed on a frontal panel and you should reset peedi by using reset button. For changing of network settings the following command is to be run in the command line of redboot fconfig:

RedBoot> fconfig

Connection to the jtag debugger peedi via telnet:

$ telnet
Connected to
Escape character is '^]'.

PEEDI - Powerful Embedded Ethernet Debug Interface
Copyright (c) 2005-2011 www.ronetix.at - All rights reserved
Hw:1.2, L:JTAG v1.5 Fw:11.5.12, SN: PD-0000-1486-670B

After the start or after the running of the command reset, peedi initializes the hardware according to the configuration file. The debugger peedi obtains a configuration file via tftp. The path where the configuration file will be searched for can be viewed using the command config:

mrv> config
Current config file -> tftp://

It would be better to use some configuration file from source, but to change the initialization in it according to your hardware.

There is an example of initialization:

; dram init
mem wr 0xD0001400 0x4301503E ;  DDR SDRAM Configuration Register
mem wr 0xD0001404 0x39943000 ;  Dunit Control Low Register

The string mem wr 0xD0001400 0x4301503E means to run the command
memory write 0xD0001400 0x4301503E, it means to set the value 0x4301503E in the register 0xD0001400.

If the file is successfully loaded, the log will look like this:

peedi> ++ info: opening file 'tftp://'
++ info: loading file 'tftp://' ...
++ info: done, loaded 3475 meaningful bytes.
++ info: opening file 'eep:license.txt'
++ info: loading file 'eep:license.txt' ...
++ info: done, loaded 146 meaningful bytes.
++ info: serial to telnet disabled

If the processor was initialized correctly on the board, the log will look like this:

++ info: RESET and TRST asserted
++ info: TRST released
++ info: BYPASS check passed
++ info: 1 TAP controller(s) detected
++ info: TAP : IDCODE = 0x20A023D3, Marvell 88F6281 -> CORE0
++ info: RESET released
++ info: core 0: initialized

If the RAM was initialized, the running of commands from the group memory should be working correctly. It means, the sequence operations of writing and reading should give the desired result:

mrv> memory write 0x2000000 0xaa55 50
mrv> memory read 0x2000000 50        

0x2000000: 0x0000AA55 0x0000AA55 0x0000AA55 0x0000AA55
0x2000010: 0x0000AA55 0x0000AA55 0x0000AA55 0x0000AA55
0x2000020: 0x0000AA55 0x0000AA55 0x0000AA55 0x0000AA55
0x2000030: 0x0000AA55 0x0000AA55 0x0000AA55 0x0000AA55
0x2000040: 0x0000AA55 0x0000AA55 0x0000AA55 0x0000AA55
0x2000050: 0x0000AA55 0x0000AA55 0x0000AA55 0x0000AA55
0x2000060: 0x0000AA55 0x0000AA55 0x0000AA55 0x0000AA55
0x2000070: 0x0000AA55 0x0000AA55 0x0000AA55 0x0000AA55
0x2000080: 0x0000AA55 0x0000AA55 0x0000AA55 0x0000AA55
0x2000090: 0x0000AA55 0x0000AA55 0x0000AA55 0x0000AA55
0x20000A0: 0x0000AA55 0x0000AA55 0x0000AA55 0x0000AA55
0x20000B0: 0x0000AA55 0x0000AA55 0x0000AA55 0x0000AA55
0x20000C0: 0x0000AA55 0x0000AA55

You can also check the status of previously installed registers:

mrv> memory read 0xD0001400
0xD0001400: 0x4301503E

If the flash memory was initialized, the running of commands of the group flash should be working correctly (it should be noticed that the access to memory will not be available, if the RAM was not initialized):

mrv> flash info

FLASH configuration for core #0:
  NAND ID   : 0x20, 0xDC, 0x10, 0x95, 0x54
  NAND Flash: ST, ID=0xDC, 8-bit, 512 MB
    number of dies       = 1
    cell type            = 2-level cell
    page size            = 2048 + 64 bytes
    pages per block      = 64
    number of blocks     = 4096
    number of bad blocks = 0 (use "flash query" to get the list)
    erase bad blocks     = false

OOB Info:   FF
Burst mode: no

Access to the flash memory without RAM initialization:

mrv> flash info 
-- error: unable to load agent at address 0x00000000
-- error: cannot start FLASH agent
-- error: unable to start flash programmer

You can read the flash memory at the address 0x0000, where u-boot is located:

mrv> flash read 0x0000 100 

Block 0, Page 0 (absolute 0) - DATA:
0x0000: 8B 00 00 08 1C 3C 07 00 - 00 00 00 00 00 02 00 00 
0x0010: 00 00 60 00 00 00 67 00 - 00 00 00 00 00 00 01 BC 
0x0020: 40 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 
0x0030: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 
0x0040: E0 00 D1 FF 9B 1B 1B 1B - 00 14 D0 FF 3E 50 01 43 
0x0050: 04 14 D0 FF 00 30 84 B9 - 08 14 D0 FF 63 76 13 33 
0x0060: 0C 14 D0 FF 3A 0C 00 16 - 10 14 D0 FF CC 00 00 04 

There are useful commands of peedi:

reset run - сбросить и запустить на выполнение прошивку которая стартует по умолчанию из памяти.

reset reset - сбросить и остановить процессор.

проверка оперативной памяти (загрузка образа и затем его сравнение с эталоном):
memory load tftp:// bin 0x000000
memory verify tftp:// bin 0

memory read 0x10000000 - чтение по адресу 256 мегабайт
memory write 0xffffff8 0x87654321 - запись по адресу (256 мегабайт-8 байт)