DM8148, halting Cortex A8 core when debugging with JTAG using OpenOCD

Should this not be in the Linux forum, as it is not specifically to do with CCS.?

-steve

Hi Delio,

A non-standard JTAG emulator (such as Flyswattter) requires additional ICEPICK setup, just as with the OMAP3530. This document details how to setup the ICEPICK-D for a different emulator: http://processors.wiki.ti.com/images/f/f6/Router_Scan_Sequence-ICEpick-D.pdf . If the document is unclear, i'd reccomend checking the OMAP3530 configuration used in this link: http://www.elinux.org/OMAP3530_ICEPICK. The configuration is slightly different but the snippet shows how to interpret the functions from the ICEPICK document. In this example, they use "urjtag" over OpenOCD - it is more hackable.

An overview of the whole ICEPICK module (including the previous links) can be found here: http://processors.wiki.ti.com/index.php/ICEPICK 

Hi Michael,

Thanks for your reply.

Flyswatter respects the JTAG standard, however I am not working with TI software so I need to issue "setup instructions" explicitly, but this is besides the point.

As stated in my original message I already have the ICEPICK setup and can see the Cortex A8 Core, the problem is that it does not halt. On OMAP3530 an additional step is required in order to make its ARM core halt: asserting the DBGEN of the ARM core as documented in section 25.6.5 of the OMAP3530 and DM3730 Technical Reference Manual and copied on the next line for convenience (for en explanation of the role of DBGEN see section 12.6.3 of the Cortex-A8 Technical Reference Manual):

"The DBGEM signal on the Cortex-A8 is driven by setting bit 13 at address 0x5401 D030 in the DAP-APB address space."

Unfortunately, an equivalent operation for TMS320C6A8148 is not documented in the TRM (or anywhere else on documentation available from TI or elsewhere). This is what I need to know to proceed.

Kind Regards

Hi Delio,

Did you explicitly follow the aforementioned commands by creating a new cfg file for the Flyswatter (note that they are different from the OMAP3 case)? You will likely be able to use the OMAP3 cfg files to connect to the ARM but it won't be fully functional. Thie DBGEN bit on OMAP3 based devices is controlled via DAP_PC module (embedded inside MPUSS).  DM81x devices have a different architecture as the MPUSS in these devices does not instantialize DAP_PC . The control of DBGEN is via the ICEPick non-JTAG control register, which is comprehended in ICEPick router scan sequence. If the sequence from the pdf file is used, DBGEN will be asserted this way.

Hi Michael,

I did try ICEPICK-C, ICEPICK-D and a sequence of commands derived from a different JTAG debugger that was supposed to work OK: there was no apparent difference. However, there was a fair degree of trial and error involved in writing the OpenOCD configuration file, so a different problem may have masked the fact that the ICEPICK-D sequence you referenced was, in fact, working OK. Thanks for the information, I will try it again and confirm if it works for me or not.

Kind Regards

Hi Michael

what exactly is ICEPICK-C and ICEPICK-D?.  Is there a reference somewhere, other than the PDF link you have already provided?.

Thanks

steve turner

AudioScience

Hello Michael,

An update: configuring the ICEPICK using the sequence of commands listed in the PDF you referenced results in the following error and the A8 core not being visible:

Info : JTAG tap: dm8148.jrc tap/device found: 0x3b8f202f (mfg: 0x017, part: 0xb8f2, ver: 0x3)
Info : JTAG tap: dm8148.dap enabled
Warn : Invalid ACK 0x6 in JTAG-DP transaction
Polling target failed, GDB will be halted. Polling again in 100ms
Polling target failed, GDB will be halted. Polling again in 300ms
Polling target failed, GDB will be halted. Polling again in 700ms

Configuring the ICEPICK using a the icepick-c setup distributed with OpenOCD or with an ICEPICK-D sequence converted from a BDI-3000 configuration file results in the A8 core being visible (but halting does not succeed).

The two ICEPICK setup procedures (TI suggested one first, converted from BDI second) follow:

proc icepick_d_tapenable {jrc port} {

	# select router
	irscan $jrc 7 -endstate IRPAUSE
	drscan $jrc 8 0x89 -endstate DRPAUSE

	# set ip control
	irscan $jrc 2 -endstate IRPAUSE
	
	drscan $jrc 32 [expr 0xa0002108 | (($port & 0xF) << 24)] -endstate DRPAUSE
	drscan $jrc 32 0xe0002008 -endstate DRPAUSE

	irscan $jrc 0x3F -endstate RUN/IDLE
	runtest 10
}

proc icepick_d_tapenable_bdi {jrc port} {

	# select router
	irscan $jrc 7 -endstate IRPAUSE
	drscan $jrc 8 0x89 -endstate DRPAUSE

	# set ip control
	irscan $jrc 2 -endstate IRPAUSE
	# Keep powered
	drscan $jrc 32 81000080 -endstate DRPAUSE
	
	drscan $jrc 32 [expr 0xa0002008 | (($port & 0xF) << 24)] -endstate DRPAUSE
	drscan $jrc 32 0xe0002008 -endstate DRPAUSE
	drscan $jrc 32 [expr 0xa0002108 | (($port & 0xF) << 24)] -endstate DRPAUSE

	irscan $jrc 0x3F -endstate RUN/IDLE
	runtest 10
}

icepick_d_tapenable_bdi works and it's just a slight modification to the sequence described in the PDF you originally referenced but the CPU does not halt. I would really appreciate advice or some form of documentation because I cannot go any further at the moment.

Hello Michael,

Posting a new message to make sure you saw the conclusion I added to the previous one:

icepick_d_tapenable_bdi sequence works and it's just a slight modification to the sequence described in the PDF you originally referenced but the CPU does not halt. I would really appreciate advice or some form of documentation because I cannot go any further at the moment.

Also:

1- A person on the OpenOCD mailing list confirmed having the same issue using xds100v2 with OpenOCD and the DM8148 EVM. 

2- The following comment from OpenOCD's OMAP4430 target configuration supports the possibility that the ICEPICK-D setup sequence as published is incorrect:

# Although the OMAP4430 supposedly has an ICEpick-D, only the
# ICEpick-C router commands seem to work.
# See http://processors.wiki.ti.com/index.php/ICEPICK
source [find target/icepick.cfg]

Thanks

Hi Michael

Can you confirm that the only difference between the ICEPick-C and ICEPick-D pdf docs is:

## Function : Do a send-only JTAG IR/DR scan
Parameter : The route to JTAG shift state is ‘shortest transition’
Parameter : The JTAG shift state is ‘shift-dr’
Parameter : The JTAG destination state is ‘pause-dr’
Parameter : The bit length of the command is ‘32’
Parameter : The send data value is ‘0xeQ002008’
Parameter : The actual receive data is ‘disgarded’

where Q i s the core ID (0 for TI814x)

Is this the command that asserts the DBGEN bit?

thanks Steve

Hello,

Any progress on the issue. I also get the same problem with another jtag with the same board?

Regards

Hi Mughees

Unfortunately TI has not released the required info for us to get OpenOCD working with an ICEPICK-D based device.  It maybe that someone in the opensource community will figure this out at some point, but we currently cannot.

regards

steve

 Hi Michael,

I have identical issue on AM3359, I cannot Halt CPU.

When you are talking about " ICEPick non-JTAG control register" are you referring to ICEPick-D Block 6 register 0?

I have bits 3 and 13 set in that register but still AUTHSTATUS register shows that DBGEN is disabled (value is 0xAE).