OpenOCD+ARM-USB-OCDでKURO-NAS/X4もどきにアクセスする。

いまいち不調。とりあえずやっている事のメモ。

・OpenOCDをリポジトリから取得する。

アーカイブで提供されている0.4.0からビルドしたOpenOCDは少しおかしい。

一部コマンドでox7fffffff以降にアクセスしようとすると、一部コマンドでパラメータオーバーフローと怒られる。（肝心の39VF020は0xfffc0000にアサインされている様子）

どうもintの関係で32bit環境で出る現象らしく、パッチを当てれば良いらしいけれど、折角なのでGit経由で最新のソースを取得して再ビルド。

• mysysgitから「Git-1.7.3.1-preview20101002.exe」を取得してインストール。（インストールの際のオプションはデフォルトでOK）
• C:\MinGW\msys\1.0\etc\profileの24行目辺りに以下を追加
  • x86の場合
    

    export PATH="$PATH:/c/Program Files/Git/bin"

  • x64の場合
    

    export PATH="$PATH:/c/Program Files (x86)/Git/bin"

• MinGW Shellを起動し適当なディレクトリを作成してそこに移動してから下記を実行
  

  git clone git://openocd.git.sourceforge.net/gitroot/openocd/openocd

• コード取得後、openocdディレクトリが作成されているので、そこに移動してから
  • ./bootstrap
  • ./configure（オプションは「ARM回りの環境を整える。」参照）
  • make

  を実行する。

・OpenOCDの設定ファイル

ターゲットは

• CPU
  Marvell 88F5281 Feroceon
• Flashメモリ(NOR)
  SST 39VF020-70-4C-WHE

OpenOCDには一応デフォルトで設定サンプルが用意されていて、

• CPU
  C:\Program Files (x86)\OpenOCD\0.4.0\target
• インターフェイス
  C:\Program Files (x86)\OpenOCD\0.4.0\interface

なので、今回は

• CPU
  C:\Program Files (x86)\OpenOCD\0.4.0\target\feroceon.cfg
• インターフェイス
  C:\Program Files (x86)\OpenOCD\0.4.0\interface\arm-usb-ocd.cfg

を参考に設定ファイルを作成。

該当機種ではないけれど”nas-central.org”さんの「JTAG & OpenOCD for LS-Pro」も参考に。

interface ft2232
ft2232_device_desc "Olimex OpenOCD JTAG"
ft2232_layout olimex-jtag
ft2232_vid_pid 0x15ba 0x0003
if { [info exists CHIPNAME] } {
    set  _CHIPNAME $CHIPNAME
} else {
    set  _CHIPNAME feroceon
}
if { [info exists ENDIAN] } {
    set  _ENDIAN $ENDIAN
} else {
    set  _ENDIAN little
}
if { [info exists CPUTAPID ] } {
    set _CPUTAPID $CPUTAPID
} else {
    set _CPUTAPID 0x20a023d3
}

jtag newtap $_CHIPNAME cpu -irlen 4 -ircapture 0x1 -irmask 0xf -expected-id $_CPUTAPID
set _TARGETNAME $_CHIPNAME.cpu
target create $_TARGETNAME feroceon -endian $_ENDIAN -chain-position $_TARGETNAME
reset_config srst_only

flash bank 39vf020 cfi 0xfffc0000 0x00040000 1 1 0 jedec_probe

とりあえず、こんな内容にして”c:\openocd.cfg“として保存。

・OpenOCDの起動

OpenOCDが起動していない状態で、もどきの電源を入れるとMPUが反応しないとエラーを出してうるさいので、先にOpenOCDを起動。

OpenOCDの起動は、コマンドプロンプトを起動して

openocd -f openocd.cfg

を実行。起動すると

C:\>openocd -f openocd.cfg
Open On-Chip Debugger 0.5.0-dev-00719-ga727418 (2011-01-24-14:43)
Licensed under GNU GPL v2
For bug reports, read
        http://openocd.berlios.de/doc/doxygen/bugs.html
Info : only one transport option; autoselect 'jtag'
adapter_nsrst_delay: 200
jtag_ntrst_delay: 200
srst_only separate srst_gates_jtag srst_open_drain
Info : device: 4 "2232C"
Info : deviceID: 364511235
Info : SerialNumber: FTTI0U5AA
Info : Description: Olimex OpenOCD JTAG A
Info : clock speed 6000 kHz
Info : JTAG tap: feroceon.cpu tap/device found: 0x07926041 (mfg: 0x020, part: 0x7926, ver: 0x0)
Warn : JTAG tap: feroceon.cpu       UNEXPECTED: 0x07926041 (mfg: 0x020, part: 0x7926, ver: 0x0)
Error: JTAG tap: feroceon.cpu  expected 1 of 1: 0x20a023d3 (mfg: 0x1e9, part: 0x0a02, ver: 0x2)
Error: Trying to use configured scan chain anyway...
Warn : Bypassing JTAG setup events due to errors
Info : Embedded ICE version 0
Info : feroceon.cpu: hardware has 1 breakpoint/watchpoint unit

のようなメッセージが表示される。

実際の操作はtelnet等で”localhost”の”4444″番ポートにアクセス。

別途コマンドプロンプトを起動して

telnet localhost 4444

とするか、PuTTYやTeraTerm等からtelnetでアクセスしてもOK。

うまく接続できれば

Open On-Chip Debugger
>

のように表示されるはず。

・実際の操作

> poll
background polling: on
TAP: feroceon.cpu (enabled)
target state: running
> halt
target state: halted
target halted in ARM state due to debug-request, current mode: Undefined instruction
cpsr: 0x000000db pc: 0xffff0004
MMU: disabled, D-Cache: disabled, I-Cache: disabled
> reset
JTAG tap: feroceon.cpu tap/device found: 0x07926041 (mfg: 0x020, part: 0x7926, ver: 0x0)
JTAG tap: feroceon.cpu       UNEXPECTED: 0x07926041 (mfg: 0x020, part: 0x7926, ver: 0x0)
JTAG tap: feroceon.cpu  expected 1 of 1: 0x20a023d3 (mfg: 0x1e9, part: 0x0a02, ver: 0x2)
Trying to use configured scan chain anyway...
Bypassing JTAG setup events due to errors
> soft_reset_halt
requesting target halt and executing a soft reset
target state: halted
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x000000d3 pc: 0x00000000
MMU: disabled, D-Cache: disabled, I-Cache: disabled
> flash banks
#0 : 0 (cfi) at 0xfffc0000, size 0x00040000, buswidth 1, chipwidth 1
> flash probe 0
Flash Manufacturer/Device: 0x00bf 0x00d6
Flash Manufacturer/Device: 0x00bf 0x00d6
flash 'cfi' found at 0xfffc0000
> flash info 0
#0 : cfi at 0xfffc0000, size 0x00040000, buswidth 1, chipwidth 1
 #  0: 0x00000000 (0x1000 4kB) protected
 #  1: 0x00001000 (0x1000 4kB) protected
 #  2: 0x00002000 (0x1000 4kB) protected
 #  3: 0x00003000 (0x1000 4kB) protected
 #  4: 0x00004000 (0x1000 4kB) protected
 #  5: 0x00005000 (0x1000 4kB) protected
 #  6: 0x00006000 (0x1000 4kB) protected
 #  7: 0x00007000 (0x1000 4kB) protected
 #  8: 0x00008000 (0x1000 4kB) protected
 #  9: 0x00009000 (0x1000 4kB) protected
 # 10: 0x0000a000 (0x1000 4kB) protected
 # 11: 0x0000b000 (0x1000 4kB) protected
 # 12: 0x0000c000 (0x1000 4kB) protected
 # 13: 0x0000d000 (0x1000 4kB) protected
 # 14: 0x0000e000 (0x1000 4kB) protected
 # 15: 0x0000f000 (0x1000 4kB) protected
 # 16: 0x00010000 (0x1000 4kB) protected
 # 17: 0x00011000 (0x1000 4kB) protected
 # 18: 0x00012000 (0x1000 4kB) protected
 # 19: 0x00013000 (0x1000 4kB) protected
 # 20: 0x00014000 (0x1000 4kB) protected
 # 21: 0x00015000 (0x1000 4kB) protected
 # 22: 0x00016000 (0x1000 4kB) protected
 # 23: 0x00017000 (0x1000 4kB) protected
 # 24: 0x00018000 (0x1000 4kB) protected
 # 25: 0x00019000 (0x1000 4kB) protected
 # 26: 0x0001a000 (0x1000 4kB) protected
 # 27: 0x0001b000 (0x1000 4kB) protected
 # 28: 0x0001c000 (0x1000 4kB) protected
 # 29: 0x0001d000 (0x1000 4kB) protected
 # 30: 0x0001e000 (0x1000 4kB) protected
 # 31: 0x0001f000 (0x1000 4kB) protected
 # 32: 0x00020000 (0x1000 4kB) protected
 # 33: 0x00021000 (0x1000 4kB) protected
 # 34: 0x00022000 (0x1000 4kB) protected
 # 35: 0x00023000 (0x1000 4kB) protected
 # 36: 0x00024000 (0x1000 4kB) protected
 # 37: 0x00025000 (0x1000 4kB) protected
 # 38: 0x00026000 (0x1000 4kB) protected
 # 39: 0x00027000 (0x1000 4kB) protected
 # 40: 0x00028000 (0x1000 4kB) protected
 # 41: 0x00029000 (0x1000 4kB) protected
 # 42: 0x0002a000 (0x1000 4kB) protected
 # 43: 0x0002b000 (0x1000 4kB) protected
 # 44: 0x0002c000 (0x1000 4kB) protected
 # 45: 0x0002d000 (0x1000 4kB) protected
 # 46: 0x0002e000 (0x1000 4kB) protected
 # 47: 0x0002f000 (0x1000 4kB) protected
 # 48: 0x00030000 (0x1000 4kB) protected
 # 49: 0x00031000 (0x1000 4kB) protected
 # 50: 0x00032000 (0x1000 4kB) protected
 # 51: 0x00033000 (0x1000 4kB) protected
 # 52: 0x00034000 (0x1000 4kB) protected
 # 53: 0x00035000 (0x1000 4kB) protected
 # 54: 0x00036000 (0x1000 4kB) protected
 # 55: 0x00037000 (0x1000 4kB) protected
 # 56: 0x00038000 (0x1000 4kB) protected
 # 57: 0x00039000 (0x1000 4kB) protected
 # 58: 0x0003a000 (0x1000 4kB) protected
 # 59: 0x0003b000 (0x1000 4kB) protected
 # 60: 0x0003c000 (0x1000 4kB) protected
 # 61: 0x0003d000 (0x1000 4kB) protected
 # 62: 0x0003e000 (0x1000 4kB) protected
 # 63: 0x0003f000 (0x1000 4kB) protected

non-CFI flash: mfr: 0x00bf, id:0x00d6

qry: 'QRY', pri_id: 0x0002, pri_addr: 0x0000, alt_id: 0x0000, alt_addr: 0x0000
Vcc min: 0.0, Vcc max: 0.0, Vpp min: 0.0, Vpp max: 0.0
typ. word write timeout: 1024 us, typ. buf write timeout: 8192 us, typ. block erase timeout: 8192 ms, typ. chip erase timeout: 65536 ms
max. word write timeout: 1024 us, max. buf write timeout: 8192 us, max. block erase timeout: 8192 ms, max. chip erase timeout: 65536 ms
size: 0x40000, interface desc: 0, max buffer write size: 0x1

Spansion primary algorithm extend information:
pri: 'PRI', version: 1.0
Silicon Rev.: 0x0, Address Sensitive unlock: 0x0
Erase Suspend: 0x0, Sector Protect: 0x0
VppMin: 0.0, VppMax: 0.0

> flash list
{name cfi base 4294705152 size 262144 bus_width 1 chip_width 1}
> flash protect 0 0 63 off
protect: cfi primary command set 2 unsupported
cleared protection for sectors 0 through 63 on flash bank 0
> flash info 0
#0 : cfi at 0xfffc0000, size 0x00040000, buswidth 1, chipwidth 1
 #  0: 0x00000000 (0x1000 4kB) protected
 #  1: 0x00001000 (0x1000 4kB) protected
 #  2: 0x00002000 (0x1000 4kB) protected
 #  3: 0x00003000 (0x1000 4kB) protected
 #  4: 0x00004000 (0x1000 4kB) protected
 #  5: 0x00005000 (0x1000 4kB) protected
 #  6: 0x00006000 (0x1000 4kB) protected
 #  7: 0x00007000 (0x1000 4kB) protected
 #  8: 0x00008000 (0x1000 4kB) protected
 #  9: 0x00009000 (0x1000 4kB) protected
 # 10: 0x0000a000 (0x1000 4kB) protected
 # 11: 0x0000b000 (0x1000 4kB) protected
 # 12: 0x0000c000 (0x1000 4kB) protected
 # 13: 0x0000d000 (0x1000 4kB) protected
 # 14: 0x0000e000 (0x1000 4kB) protected
 # 15: 0x0000f000 (0x1000 4kB) protected
 # 16: 0x00010000 (0x1000 4kB) protected
 # 17: 0x00011000 (0x1000 4kB) protected
 # 18: 0x00012000 (0x1000 4kB) protected
 # 19: 0x00013000 (0x1000 4kB) protected
 # 20: 0x00014000 (0x1000 4kB) protected
 # 21: 0x00015000 (0x1000 4kB) protected
 # 22: 0x00016000 (0x1000 4kB) protected
 # 23: 0x00017000 (0x1000 4kB) protected
 # 24: 0x00018000 (0x1000 4kB) protected
 # 25: 0x00019000 (0x1000 4kB) protected
 # 26: 0x0001a000 (0x1000 4kB) protected
 # 27: 0x0001b000 (0x1000 4kB) protected
 # 28: 0x0001c000 (0x1000 4kB) protected
 # 29: 0x0001d000 (0x1000 4kB) protected
 # 30: 0x0001e000 (0x1000 4kB) protected
 # 31: 0x0001f000 (0x1000 4kB) protected
 # 32: 0x00020000 (0x1000 4kB) protected
 # 33: 0x00021000 (0x1000 4kB) protected
 # 34: 0x00022000 (0x1000 4kB) protected
 # 35: 0x00023000 (0x1000 4kB) protected
 # 36: 0x00024000 (0x1000 4kB) protected
 # 37: 0x00025000 (0x1000 4kB) protected
 # 38: 0x00026000 (0x1000 4kB) protected
 # 39: 0x00027000 (0x1000 4kB) protected
 # 40: 0x00028000 (0x1000 4kB) protected
 # 41: 0x00029000 (0x1000 4kB) protected
 # 42: 0x0002a000 (0x1000 4kB) protected
 # 43: 0x0002b000 (0x1000 4kB) protected
 # 44: 0x0002c000 (0x1000 4kB) protected
 # 45: 0x0002d000 (0x1000 4kB) protected
 # 46: 0x0002e000 (0x1000 4kB) protected
 # 47: 0x0002f000 (0x1000 4kB) protected
 # 48: 0x00030000 (0x1000 4kB) protected
 # 49: 0x00031000 (0x1000 4kB) protected
 # 50: 0x00032000 (0x1000 4kB) protected
 # 51: 0x00033000 (0x1000 4kB) protected
 # 52: 0x00034000 (0x1000 4kB) protected
 # 53: 0x00035000 (0x1000 4kB) protected
 # 54: 0x00036000 (0x1000 4kB) protected
 # 55: 0x00037000 (0x1000 4kB) protected
 # 56: 0x00038000 (0x1000 4kB) protected
 # 57: 0x00039000 (0x1000 4kB) protected
 # 58: 0x0003a000 (0x1000 4kB) protected
 # 59: 0x0003b000 (0x1000 4kB) protected
 # 60: 0x0003c000 (0x1000 4kB) protected
 # 61: 0x0003d000 (0x1000 4kB) protected
 # 62: 0x0003e000 (0x1000 4kB) protected
 # 63: 0x0003f000 (0x1000 4kB) protected

non-CFI flash: mfr: 0x00bf, id:0x00d6

qry: 'QRY', pri_id: 0x0002, pri_addr: 0x0000, alt_id: 0x0000, alt_addr: 0x0000
Vcc min: 0.0, Vcc max: 0.0, Vpp min: 0.0, Vpp max: 0.0
typ. word write timeout: 1024 us, typ. buf write timeout: 8192 us, typ. block erase timeout: 8192 ms, typ. chip erase timeout: 65536 ms
max. word write timeout: 1024 us, max. buf write timeout: 8192 us, max. block erase timeout: 8192 ms, max. chip erase timeout: 65536 ms
size: 0x40000, interface desc: 0, max buffer write size: 0x1

Spansion primary algorithm extend information:
pri: 'PRI', version: 1.0
Silicon Rev.: 0x0, Address Sensitive unlock: 0x0
Erase Suspend: 0x0, Sector Protect: 0x0
VppMin: 0.0, VppMax: 0.0

という感じ。

何か書き込んでみる。

> flash fillb 0xfffc0000 0x00 0x40000
No working memory available. Specify -work-area-phys to target.
not enough working area available(requested 96)
Programming at 0xfffc0000, count 0x00000400 bytes remaining
Programming at 0xfffc0100, count 0x00000300 bytes remaining
Programming at 0xfffc0200, count 0x00000200 bytes remaining
Programming at 0xfffc0300, count 0x00000100 bytes remaining
Verification error address 0xfffc0000, read back 0xff, expected 0x00
Command handler execution failed
in procedure 'flash'

もう少し設定ファイルを詰めないとまずそう。