Home

MPE JTAG Widget

Contents

1. O 40 disasm al 0000 0000 18FO9FE5 p e ldr pc pc 18 0 20 6C 0000 0004 18FO9FE5 p e ldr pc pc 18 0 24 00 0000 0008 18FO9FE5 p e ldr pc pc 18 0 28 00 0000 000C 18FO9FE5 p e ldr pc pc 18 0 2C 00 0000 0010 18FO9FE5 p e ldr pc pc 18 30 00 0000 0014 18FO9FE5 p e ldr pc pc 18 0 34 00 0000 0018 20FF1FE5 e ldr pc pc F20 FFFFF100 00 0000 001C 20FF1FE5 e ldr pc pc F20 FFFFF104 00 0000 0020 6C000000 1 and eq rO rO r12 rrx 0000 0024 00000000 and eg rO r0 ro 0000 0028 00000000 and eg r0 rO ro 0000 002C 00000000 and eg r0 rO rO 0000 0030 00000000 and eg rO rO ro 0000 0034 00000000 and eg r0 rO rO 0000 0038 00000000 and eg rO r0 rO 0000 003C 00000000 and eq rO r0 rO ok M J To disassemble a routine whose entry point is known use DisAsm F addr Disassembly will finish when either of the following instructions is encountered with no outstanding forward branches up to a maximum of 512 bytes 128 ARM instructions Chapter 3 First steps in debugging ARM code 17 va 2003C78 disasm f 0200 3C78 00402DE9 i stmdb r13 r14 0200 3C7C OAFAFFEB z k bl 20024AC 0200 3C80 30FAFFEB Oz k bl 2002548 0200 3C84 DAFOFFEB Zy k bl 20023F4 0
2. ss RO A000 001F 8200 E9FF 0200 3744 0000 0001 R4 0200 EE00 5000 0000 0000 0020 0000 0004 R8 0200 585C 0000 0006 0200 COFO 0200 FFOO R12 0200 FEFO 0200 FDEO 0200 5294 0200 A2E0 CPSR A000 001F N_C__ ___ SYS SPSR A000 001F N_C__ ___ SYS 0200 A2D8 OOOOOFE1 a mrs r0 cpsr ok ss RO A000 001F 8200 E9FF 0200 3744 0000 0001 R4 0200 EE00 5000 0000 0000 0020 0000 0004 R8 0200 585C 0000 0006 0200 COFO 0200 FFOO R12 0200 FEFO 0200 FDEO 0200 5294 0200 A2E4 CPSR A000 001F N_C__ ___ SYS SPSR A000 001F N_C__ ___ SYS 0200 A2DC 01002DE9 i stmdb r13 rO ok ss RO A000 001F 8200 E9FF 0200 3744 0000 0001 R4 0200 EE00 5000 0000 0000 0020 0000 0004 R8 0200 585C 0000 0006 0200 COFO 0200 FF00 R12 0200 FEFO 0200 FDDC 0200 5294 0200 A2E8 CPSR A000 001F N_C__ ___ SYS SPSR A000 001F N_C__ ___ SYS 0200 A2EO CO0080E3 c orr rO rO C0 ok ss RO A000 00DF 8200 E9FF 0200 3744 0000 0001 R4 0200 EE00 5000 0000 0000 0020 0000 0004 R8 0200 585C 0000 0006 0200 COFO 0200 FF00 R12 0200 FEFO 0200 FDDC 0200 5294 0200 A2EC CPSR A000 001F N_C__ ___ SYS SPSR A000 001F N_C__ ___ SYS 0200 A2E4 OOFO21E1 p a msr cpsr c rO ok ss RO A000 00DF 8200 E9FF 0200 3744 0000 0001 R4 0200 EE00 5000 0000 0000 0020 0000 0004 R8 0200 585C 0000 0006 0200 COFO 0200 FFOO R12 0200 FEFO 0200 FDDC 0200 5294 0200 A2FO CPSR A000 00DF NC IF SYS SPSR A000 00DF NC IF SYS 0200 A2E
3. Disassemble from addr for len bytes disasm ft from to Disassemble from address FROM to address TO disasm f from Disassemble from address FROM The NEXT macro is displayed as a NEXT macro The display stops when the first NEXT macro is encountered with no outstanding forward branch or if the forward branch is over 256 bytes Hdasm N Disassemble a Forth word on the JTAG Widget 54 MPE JTAG Widget Chapter 9 ARM Assembler 55 9 ARM Assembler The internal assembler can be used to create new ARM definitions on the target CPU and the JTAG Widget itself To keep the code size down the facilities and error checking provided by target versions of the assembler are rudimentary compared to those of hosted assemblers First select the required CPU type from one of arm arm7O arm700 arm710 arm7d arm70d arm7dm arm70dm arm7tdm arm7tdmi arm8 arm810 SA 110 ArmArch5 You can select the instruction set using ARM 32 and Thumb 1 To define a target piece of assembler use address ORG T ASSEMBLER ARM assembler code END ASM To define a procedure on the host use CODE lt name gt lt ARM assembler code gt END CODE CODE and END CODE temporarily select CPU host during the assembly If there is an error during assembly the target memory selection will not be restored by END CODE To define named procedure on the host use PROC name ARM assembler
4. 14 O tos crO crO 0 next end code code writeDCCdr x Write a 32 bit value to the DCC data register mcr 14 O tos cri crO 0 ldr tos psp 4 next end code code readDCCdr x X Read the DCC data register and return the 32 bit value read str tos psp 4 mrc 14 O tos cri crO 0 next end code DCCemit N char Write a character to the DCC begin readDCCcr biti and 0 until writeDCCdr DCCkey X flag X Return true if the DCC read register has a character Chapter 6 ARM debug chains 45 available to be read readDCCcr bitO and 0 lt gt DCCkey N char Wait until the host debugger has written a character to the DCC and return it begin DCCkey 0 while tasking if pause then repeat readDCCdr DCCtype caddr len Write a string to the DCC channel bounds do i c DCCemit loop DCCcr X Write a CR LF pair of characters to the DCC channel 13 DCCemit 10 DCCemit 6 15 3 DCC console tools Before the DCC console is started on the host remember to set the target to use the DCC channel for its I O This code is only compiled if the multitasker has been compiled DCCconsole Runs the DCC as a console until the user presses the lt ESC gt key character 0x1B O value DCCio flag TRUE when the DCC console task is running task DCCtask task The task for the DCC console DCCio X Run DCCconsole as a task if it is
5. M J 9 8 2 Post indexed addressing Post indexed addresses have the following form Rn offset Note that the closing can be used interchangeably with in the same manner as register names to aid readability by experienced ARM programmers Post indexed addressing adds the offset to the base register Rn after the data has been transferred from the address held in the base register This implies that write back always occurs so it is not necessary to specify it It can be used however to force non privileged mode for the transfer cycle same as the T suffix on some ARM assemblers The offset is specified in exactly the same way as for pre indexed addressing Examples of post indexed addressing are C N Instruction Address LDR Rd Rn Rm Load from Rn then add Rm to Rn LDR Rd Rn Rm Load from Rn then subtract Rm from Rn LDR Rd Rn Rm LSL 5 Load from Rn then add Rm shifted logically left five place LDR Rd Rn Rm LSL 5 Load from Rn then subtract Rm shifted logically left five LDR Rd Rn 20 Load from Rn then add 20 to Rn LDR Rd Rn 40 Load from Rn then subtract 40 from Rn M A 9 8 3 PC relative addressing The assembler also recognises addresses specified as either an absolute number or an assembler label e g LDR R2 600 Load from memory location 600 LDR R2 label Load from the address marked by label Addresses specified using PC relative add
6. code which can be compiled by the JTAG Widget A later chapter describes e Using supplied drivers e Writing your own drivers 3 10 Standard CPU support As with Flash drivers initialisation code for different CPUs is supplied as source code which can be compiled by the JTAG Widget These files are in the CPUs folder See the Flash Programming chapter for more details Chapter 4 Further debugging techniques 4 Further debugging techniques In preparation 19 20 MPE JTAG Widget Chapter 5 JTAG primitives 21 5 JTAG primitives The 20 pin JTAG connector has the following pin out defined by ARM See DUI0048F MICE2 2 pdf at www arm com va 1 VTref VCC 2 VCC Vtref from target Vcc from target 3 nTRST 4 Gnd open collector output 5 TDI 6 Gnd output pulled up down on target 7 TMS 8 Gnd output pulled up on target 9 TCK 10 Gnd output pulled up on target 11 RTCK 12 Gnd input 13 TDO 14 Gnd input 15 nSRST 16 Gnd input output pulled up on target 17 DBGRQ 18 Gnd RFU 19 DBGACK 20 Gnd RFU M y 5 1 JTAG pin access The target TAP controller uses the JTAG signals as follows TCK clock input output by us TMS mode input output by us sampled on the RISING edge of TCK and expected to change on the falling edge of TCK TMS should be high at the rising edge of nTRST TDI data input output by us sampled on the RISING edge of TCK and expected to change on the falling edge of TCK TDO data output input by us chang
7. cond Rd psr MSR cond psr Rm MSR cond psrf Rm MSR cond psrf expression MUL lt cond gt lt S gt Rd Rm Rn MLA lt cond gt lt S gt Rd Rm Rs Rn UMULL SMULL UMLAL SMLAL lt cond gt lt S gt RdLo RdHi Rm Rs LDR LDRB LDRH STR STRB STRH lt cond gt Rd address lt gt LDMFD LDMED LDMFA LDMEA LDMIA LDMIB LDMDA LDMDB STMFD STMED STMFA STMEA STMIA STMIB STMDA STMDB cond Rn lt gt Rlist SWP SWPB cond Rd Rm Rn SWI cond expression CDP cond CP operation CRd CRn CRm info LDC LDCL STC STCL cond CPH CRd address MCR MRC cond CP operation Rd CRn CRm info M J Two pseudo instructions MVL and ADR are also available NOP is supported as synonym for b RO RO 9 4 Thumb instruction set The full Thumb 1 instruction set is supported The MOV instruction can be used for low RO R7 or high R8 R15 registers The CPY pseudo instruction is supported and is usually used if a high register R8 R15 is involved Note that unlike MOV CPY does not affect the flags but according to the ARM ARM v2 the result is UNPREDICATBLE if two low registers are used 9 5 Register naming There are fifteen general purpose registers available in any mode These are named RO through R15 Coprocessor registers are named CRO through CR15 The Current Program Status Regis ter and Saved Program Status Register are named CPSR and SPSR
8. 4 4 R7 logically shifted left by 4 BIC R2 R4 R7 ASR R6 NX R7 arithmetically shifted right by the contents of R6 Note that the contents of the register being shifted are not changed by the shift The shifted value is only used during the instruction to calculate the new value to be stored in the destination register Shift operations supported by the ARM are 7 Instruction Purpose LSL n or LSL Rn Logical shift left ASL n or ASL Rn Arithmetic shift left identical to LSL LSR n or LSR Rn Logical shift right ASR n or ASR Rn Arithmetic shift right ROR n or ROR Rn Rotate right ROR Rotate right with extend no shift value or register is needed as the shift is by one bit V Note that as with immediate constants if the shift is by a fixed amount it should be preceded by the symbol to inform the assembler that it is not dealing with a register 9 8 Addressing modes The ARM data processing instructions all work on the contents of registers and immediate operands To transfer data to and from single registers and memory either the LDR STR LDC or STC instructions and their variants have to be used Addresses can be specified in three ways 9 8 1 Pre indexed addressing Pre indexed addressing allows an offset to be added to or subtracted from an address held in a base register to form the address from which data is to be transferred The address has the following format Rn offset Where Rn is th
9. ORR instructions 62 9 9 Control structures MPE JTAG Widget There are assembler equivalents to the Forth control structures The available structures are a cc IF THEN cc IE ELSE THEN BEGIN cc UNTIL BEGIN cc WHILE REPEAT BEGIN AGAIN AC J where cc is one of the condition codes in the table below ARM Forth Condition ARM Forth Condition C8 CS carry set NE NE not equal or non zero CC CC carry clear GE GE greater than or equal PL PL plus positive or zero LT LT less than MI MI minus negative GT GT greater than VS VS overflow set LS LS unsigned less than or equal same VC VC overflow clear HS HS unsigned greater than or equal same LE LE less than or equal LO LO unsigned less than Same as CC EQ EQ equal or zero HI HI unsigned greater than AL Always default M J 9 10 Labels Ten named labels are provided They are defined at the current location by L x where x is 1 10 are are referenced by L x Labels retain their value until reused Consequently labels may not be forward referenced 9 11 Assembler error codes 101 102 103 104 105 106 107 108 109 104 immediate value won t fit format branch to unaligned address 12 bit offset out of range condition code not set not in range 128 127 not a general purpose register not a coprocessor register processor status register 8 bit off
10. PREPARARE 6 1 5 About the manual 222462000 eder qt a RA AR Y UR AUR TR UR UR re AE 6 1 6 fdisaster strikes a err o RUE UR eR RR utes Spine AE EE 6 1 7 Installing software upgrades e 6 1 8 Development Kit Tools n 1 9 Technical supDort arrr a ett a Mae aad A eae At Y 2 How Forth is documented 4222929 ahhh 9 2 Forth word8 noU aed RR ROVER Da Hee e e ee ern 9 2 9 Stack DOTA ON cuela pr Dp ee ER URL Rex REEL es Net 10 2 0 l putdextiozi ssa EE ERA EUR RM EN iR 11 2 4 Other markers ai heh oad eee ee Qe ed e d eR hee ee 12 3 First steps in debugging ARM code ees 13 OL Number basess u l4sjven Tego di TET pe E 13 3 2 Connecting the target eee ccc eee hh n 13 3 3 Initialising the JTAG connection seseeseeeeee ehh 14 3 4 Stopping Stepping and Restarting the CDU 14 3 0 Displaying memory sess A ESAME ee 15 3 6 Disassembling target code 16 3 1 Assembling target ode AANER ANE EE puse pie py e ar rr hr EP ps D 3 8 Target memory and peripherals llus hh 17 35 9 Flash program mine ii RE ORE bU Dr ree erbe ee 18 3 10 Standard CPU s pport 4 RR ce EA UE E RR nes 18 4 Further debugging techniques o o oooooooo o o 19 ii MPE JTAG Widget D JTAG Protesis 21 bl JTAG pin Access acu iue A Rb kal E ii da 21 5 2 Configuration vut deor eren n oa EU ene Ug ed e oU ae 21 5 21 eet NM Iesele DD perrita eka aa eae MEE PRU DERE 22 5 2 2 Hwsel MP ETA caia ii AAA A EAR be 22 5 3 JTAG primitives a EA 22
11. TDO SRST 0 1 GPIO IOPIN nSRST and SRST rshift Read state of SRST InitJTAG N Initialise JTAG system code TCKpulse Pulse TCK high then low code TDOread 0 1 Read TDO after the rising edge of TCK TDO changes on the falling edge of TCK and so the first bit of a transfer is available after any state change TDO is sampled on the rising edge of TCK TDO is written back to TDI to preserve the register when the update is performed code TDIwrite x if x is non zero write 1 to TDI otherwise write 0 TDI is written out on after the falling edge of TCK and is sampled by the target on the rising edge of TCK code TDIOxchg x1 mask x2 if x1 mask is non zero write 1 to TDI otherwise write 0 TDI is written out on after the falling edge of TCK and is sampled by the target on the rising edge of TCK Replace the bit defined by mask with the value read from TDO code TCKpulse Pulse TCK low then high code TDOread 0 1 Read TDO after the rising edge of TCK TDO changes on the falling edge of TCK and so the first bit of a transfer is available after any state change TDO is sampled on the rising edge of TCK TDO is written back to TDI to preserve the register when the update is performed code TDIwrite x if x is non zero write 1 to TDI otherwise write 0 TDI is written out on after the falling edge of TCK and is sampled by the target on the rising edge of TCK 24 MPE JTAG
12. alternate functions 1 VCC 2 VCC from target 3 nTRST P0 26 4 Gnd o p res res res 5 TDI P0 25 6 Gnd o p res res res 7 TMS P0 22 8 Gnd o p res res res 9 TCK P0 23 10 Gnd o p res res res 11 RTCK P0 24 12 Gnd i p res res res 13 TDO PO 27 14 Gnd i p TRST res res 15 nSRST P0 28 16 Gnd o p TMS res res 17 DBGRQ P0 29 18 Gnd RFU TCK res res 19 DBGACK PO 30 20 Gnd RFU TDI res res P0 31 RFU TDO res res M 5 3 JTAG primitives 10 value qbit n Quarter bit delay value for software loops SetJTAGspeed kHz Set the quarter bit delay to achieve the specified J TAG clock speed in Khz create GPIO Pointer to GPIO block nTRSTlo Set TRST low nTRSThi Set TRST high TDllo Set TDI low TDIhi _GPIO ses EY 3 addr TDI TDI nTRST nTRST GPIO 6 IOCLR GPIO 6 IOSET GPIO IOCLR GPIO IOSET Chapter 5 JTAG primitives 23 Set TDI high TMSlo TMS GPIO IOCLR E Set TMS low TMShi TMS GPIO IOSET Set TMS high TCKlo TCK GPIO IOCLR Set TCK low TCKhi TCK GPIO IOSET E Set TCK high nSRST1o nSRST GPIO IOCLR Set nSRST low nSRSThi nSRST GPIO IOSET H Set nSRST high RTCK 0 1 GPIO IOPIN 6 RTCK and HRTCK rshift Read state of RTCK TDO 0 1 GPIO IOPIN TDO and TDO rshift Read state of
13. dummy FL29bv1614 to SecTab set sector table pointer M When a Flash driver is loaded it will set SecTab SectorN n addr len Convert sector number to base address and length addr n Find the sector number containing address addr If addr is outside the internal Flash range n is set to 1 FindSecNum addr start len Find the start and length of the sector containing address addr If len is zero the sector was not found and start is set to addr FindSector 3dup 3dup Useful for src dest len operations 10 2 2 Driver file code If you need to support a device for which we have not provided a driver start from a suitable existing driver in the Flash folder It will benefit all JTAG Widget users if you contribute it back for inclusion in the JTAG Widget software distribution Chapter 10 Flash programming harness 67 There are two approaches that can be taken for Flash programming of ARM systems 1 The direct approach is to use the Widget s memory read write tools to run memory cycles Because a huge number of bits have to be shifted out on the JTAG chain this is very slow sometimes only a few hundred bytes per second 2 The faster approach is to copy some flash programming code to the target and execute it This is our standard approach and permits programming speeds of 10 20 kbytes per second or more depending on CPU and Flash speeds See FlashNAT49bv1614 fth for an example of this a
14. esee 39 BO rOm l ei css ada ta A Hebe Enna d suras KAREE 40 conti ia o aiat 25 EE 25 BOES O 25 grin eee sex ese rr s erc esee ques 27 grout lisseusega sera ea ew oe ee e bau ru Ya 27 rl se Drei eu eda 27 haltC6pu ece dedere er wp nk Reg LE ARE 40 Halted a EET 37 WAST isa keen Ke aie ait a bidon iei de re Re aad 53 here t L2 ho wedesq uve e re E ebd E P dp 49 hostarmc ugue dna et renn a ic 50 I INDICE adr aie ER dus MIR RED s 74 5 6 ne chapeau a e Rae Pa hedera dues 23 30351184 ducendam eet e Eee seated eia 74 TNDUSAMT cai xe A baa ai ee ee 74 he EE T9 MNS KEE 41 DAT M T 27 Oe en Een Aer ee ere EE dee Eh A Dale PERC EE 28 KE E ENT 28 A nef Rer deg eene 27 issuerestart i 42 22 23 a dace drill tw na 37 EE e ee 24 jar P CE 24 UID M Om 24 E O 24 EE oeil coated Ga ed ageres ERR 25 CEET 24 Pda a o dale 24 BEE ts ia ave 24 ISE ada rd da ii edad 24 JSseldrs iii dr a 24 ISS rai rr e IR Ro eh eg 24 JSShdE iia i n 24 SSA it tr se ed 24 jd E 24 ASUMA cse perite gone dia iet ag ead 24 E R 24 jt8gEOLO O WERE TERI RAE ER Re 25 jtagreset c n ss nis pr E RUNE eee IRE 25 jtagstateiico end RES erac a Ha e cet eR 25 85 L VEG WEE ER n EE 17 49 A D WEEN ER RE EE 17 49 lastic statlS ici isa aa edd dogs 36 lensmask ncs id dais ER ds is 37 USACCdO EE 26 A A n n mne red or e Res 50 M DE D ON 74 DE e 74 MOVER CE geet green wed Te E
15. happy EndProc here MemReader equ MRlen image length to copy to target RecvDCC haddr len Read len bytes from the current target memory address held in target R5 into host memory at haddr Haddr and Len must be four byte aligned DCCtoXBuff N Get the required number of bytes bytes into X BUFFER from the target memory pointed to by target R5 See the XModem chapter for more details WaitDCCkey flag Wait for up to 1 second for a character Chapter 13 RAM loader 79 RecvDCCto haddr len Read len bytes from the current target memory address held in target R5 into host memory at haddr Haddr and Len must be four byte aligned 13 2 Copying files to RAM and from memory WriteRAM taddr len Given the address and maximum length of the target memory to be programed copy a host file in binary image format into target RAM The target address must be 4 byte aligned The file is uploaded into the JTAG Widget using the XModem 128 1024 byte block protocol See RecvXmodem in the XModem chapter of the manual for more details of the XModem system RecvMem taddr len Given the address and maximum length of the target memory to be read copy it into a host file in binary image format The target address and length must be 4 byte aligned The file is uploaded from the JTAG Widget using the XModem 128 1024 byte block protocol See RecvXmodem in the XModem chapter of the manual for more details of the XMo
16. loopcount spin if zero indicates last block DCCkey for 32 bit data write low 16 bits write high 16 bits error count DCCemit for error count keeps disassembler happy image length to copy to target 11 4 Programing the device Prog1614 addr len Given the address and maximum length of the target memory to be programed erase the target Flash and read and program the target memory from a host file in binary image format The file is uploaded into the JTAG Widget using the XModem 128 1024 byte block protocol See RecvXmodem in the XModem chapter of the manual for more details of the XModem system 72 MPE JTAG Widget Chapter 12 Atmel AT91SAM7xxx CPUs 73 12 Atmel AT91SAM7xxx CPUs The file CPUsNjwSAMT fth is an example of coding CPU and Flash drivers for a single chip ARM Other files are provided for the NXP Philips LPC2xxx and ST STR91x families The techniques used are very similar to those used for the Flash drivers 12 1 Tools equ NOx Sa exe A synonym for CONSTANT useful when interactively compiling code that will later be cross compiled buffer size addr Create a buffer of the given size At run time the address is returned 12 2 CPU definition This section is used for selecting CPU variants CPU ARM71e select CPU type Define CPU type in use 00 416 lshift equ 7s 01 416 lshift equ 7x 11 416 lshift equ 7xc 7x 256 or value SAMpart N cpu selects Flash stuff 00100
17. memory oo 42 6 14 Target CPU selection cicer RE ere aaa RA 42 6 15 Debug Comms Channel 43 6 15 1 Host Access cee eee een RR eU dE ENEE pe ERE RA Reha 43 6 15 2 Target code s reae EN oer oed e icio s pater eia Lec RR ga 44 6 15 3 DCC console tools ei 45 T Target memory WOrds EE 47 7 1 Big endian host operations s e hn 4T 7 2 Target memory and debug Interface 47 9 Target Memory tOOls esporas nekaip na RERO RR eii Pa ds 50 CA Host Memory 2 14454 serre rir Deo eed da EE E tata 50 B ARM disassemblet 443592 44 355445404080 5040944009644 53 9 ARM Assemble coi 55 9 L Condition CO desir deep clack abate Wena a bade ade gated macnn AR Sech 55 9 2 Number bases iere etre oe ce dod ded e ore et oan 56 9 3 ARM instruction Set c eenscres E tice ieee wee skstaeeitkr amp s Eg datus aaa wee d des 56 9 4 Thumb instruction set ed e ae 57 9 5 Register naming ouest ate XP ERE RU E eg 57 9 6 Immediate constantsa ehh hh 58 9 7 Shift operations sce geet pads go EMERGERE id 58 9 8 Addressing modes isole RR RR LRL RUDI REL EDU CREER da 59 9 8 1 Pre indexed addressing ne 59 9 8 2 Post mdexed addressing 04 tete rese ER EORR Ie Se E dd 60 9 8 3 PC relative addressing ssseeeeeeeeeeee n 60 9 8 4 Byte and half word addressing 0 e eens 60 9 8 5 Register lists zoe here EE error ene rue deese den es wa dedo deas 61 9 83 06 MV Dand AD Rin kt p EE RE ng BARRE RC E ret rtp lo ede Rae 61 9 9 Control
18. memory starting at addr Addr is four byte aligned WTdump addr len dump 16 bit half words Display dump len bytes of target memory starting at addr as 16 bit half words Addr is four byte aligned LTdump addr len dump 32 bit long words Display dump len bytes of target memory starting at addr as 32 bit words Addr is four byte aligned 7 4 Host memory The host memory version is provided so that ARM tools such as the disassembler can be used with both host and target org addr Set the address at which assembly compilation starts in the host create HostARM addr Table describing host memory accesses CPU Host X Select memory accesses from host memory TargetMem flag Returns true if memory accesses are to a target variable dp t haddr A host variable containing the target address at which the next assembly or compilation will occur primhere t NX taddr The target address at which the next assembly or compilation will occur primorg t taddr Set the target address at which the next assembly or compilation will occur Chapter 7 Target memory words 51 op gt caddr opcode Put string in output buffer and return current opcode loreg Nn Apply three bit mask and display register loreg Nn Apply three bit mask and display register with a trailing comma RdRn Ke Display two low registers RdRnImm3 caddr Display two low registers
19. operation 0000 constant ARM7type X x Basic ARM7 type in bits 8 11 0100 constant ARM9type VS Basic ARM9 type in bits 8 11 bit12 constant ARM9Edebug Aer Selects 6 bit debug control register in bit 12 O value TargetMem haddr Returns the address of the current target description table O value DefTarget haddr Returns the address of the default target description table O value TargetISA N n Returns the current target instruction set used by the disassembler and assembler The values returned are dependent on bits 31 28 above O constant ArmISA 0 Use ARM 32 bit instructions 1 constant ThumbiISA Use Thumbl instructions 2 constant Thumb21SA Use Thumb2 instructions e g for Cortex Not yet supported ARM 32 NS Select ARM mode for assembler Thumb 1 Select ARM mode for assembler Thumb flag Return true if the assembler is in either Thumb mode Chapter 7 Target memory words CPUtype cputype Returns the CPU type in bits 8 11 ARM9Ecpu flag Returns true for an ARM9E with the 6 bit debug control register BadMemOp X Aborts with an error message BadCPU NA Aborts with an error message BigEnd X n Returns 0 little endian 1 big endian cell t N n Return size of target cell aligned t X addr addr Align address to next cell boundary count t addr addr len Return address and length of a counted string bOc t
20. or 2 for a single Thumb instruction 42 MPE J TAG Widget Addr2 Len2 represents the range of addresses in which a breakpoint will not occur len2 must be a power of two If len2 is zero no exclusion range is set and addr2 is ignored The Addr values must be on a multiple of the len ranges DBGINTS is called and the CPU is restarted immediately Note that this word does not wait for the breakpoint to be triggered Use Halted above or WaitBreak below to check whether the breakpoint has occurred SetBreak addr Set a breakpoint at the given address Uses SetHWBP The instruction length depends on whether ARM or Thumb mode has been selected ClearBreak N Clear breakpoints WaitBreak X ms running Wait for up to ms milliseconds for a breakpoint to occur returning non zero if the CPU is still running If the CPU is halted the CPU state is saved and 0 is returned Interrupts are disabled by DBGINTS until RESTARTCPU unless you use DBGINTS 6 13 Target memory tools These are words used by the xxx T version for JTAG access to the target They are unlikely to be required by user application code b0 J addr b Fetch a byte at target addr w J addr w Fetch a 16 bit halfword at target addr 1 J addr 1 Fetch a 32 bit word at target addr bt b addr Write a byte at target addr w J w addr Write a 16 bit halfword at target addr 1 CJ 1 addr Write a 32 bit
21. out R5 addr 2 R8 terrs N destroys RO R1 R2 R3 X unlock write command write data 1 3 mov ri 55 offset 5555 orr ri ri 5500 mov ri ri Lal 4 1 but address is for 16 bit unit mov rO AA first unlock byte strh r0 r4 r1 mov r2 AA offset 2AAA orr r2 r2 2A00 mov r2 r2 Lal 1 but address is for 16 bit unit mov rO 55 second unlock byte strh r0 r4 r2 mov rO AO write command code orr rO rO 4000 strh r0 r4 r1 bic r2 r6 FF000000 clear high 16 bits for later compare bic r2 r2 00FF0000 strh r2 r5 write data Chapter 11 AT49BV1614 Flash programming 71 poll data until done or errored mov rO 4000 begin ldrh r3 r5 N cmp r2 r3 N ne while cmp rO 0 N ne while sub ro rO 1 repeat then cmp r2 r3 N add ne r8 r8 1 N add r5 rb 2 N mov pc link N out time out counter read data back same timed out same no update error count step destination address return Main in R4 FlashBase R5 dest uses R7 count R8 errs then patch up AHEAD begin X main loop mov r8 0 bl L 2 mov s r7 rO b eq begin bl L 2 N mov r6 rO bl 1 3 N mov r6 r6 lsr 16 bl 1 3 sub s 17 17 1 eq until mov rO r8 bl 1 1 again mov pc link N EndProc here Writei614 constant Len1614 aA A aA clear error counter DCCkey for block size in cells R7
22. single instruction at debug speed returning the data read back The TAP is left in RTI state DebugStepWrite data Perform an ARM NOP at debug speed writing the given data The TAP is left in RTI state TDebugStepWrite data Perform a Thumb NOP at debug speed writing the given data The TAP is left in RTI state 6 6 Scan chain 2 WriteICE data regi Write an ICEbreaker register leaving the TAP in RTI ReadICE reg data Read an ICEbreaker register leaving the TAP in RTI ICEregs X Display ICEbreaker registers 36 MPE JTAG Widget 6 7 High level debug support Some debug words affect ARM registers RO R15 in the current mode It is assumed that all CPU registers are restored before any application code is executed and that they are saved immediately on entry to debug state Entry into debug mode from Thumb mode causes a switch into ARM mode If the T bit in the CPSR is set return from debug mode will cause a return to Thumb mode doNOP N Execute an ARM NOP at debug speed doTNOP N Execute a Thumb NOP at debug speed doNOPread X data Execute an ARM NOP at debug speed and read data bus Dstep 2 opcode Perform a debug step followed by two ARM NOPs TDstep 2 opcode Perform a debug step followed by two Thumb NOPs ReadReg reg data Read the contents of ARM register reg in the current mode WriteReg data reg Write data to ARM register reg in the
23. speed Programming speed is determined by the Flash the Widget and the USB connection On AIDE s Powerterm Properties Server and XMODEM page ensure that the Enable File Server box is checked and that Xmodem is configured for 1024 byte blocks and CRC checking When AIDE is closed these settings will become the defaults next time Make sure that the Widget uses 1024 byte blocks by configuring AIDE typing Xmodem 1k Chapter 1 Introduction 5 1 3 6 Debugging ARM code The following chapters include an introduction to debugging applications with the JTAG Widget 1 3 7 Saving compiled code After you have configured and tested your configuration you can save it on the JTAG Widget using the word Turnkey Afterwards your code is always present when the JTAG Widget is rebooted This saves you having to recompile the configuration after each reboot and is ideal for production programming Save the compiled image 0 turnkey Either reset the board using the reset button or by typing reboot The board will reboot and your code will already be part of the system You can check this by typing words to see what functions are available You can clear out your previous work by typing EMPTY and rebooting ees reboot 1 3 8 Using other terminal emulators AIDE and PowerTerm are designed for use with the JTAG Widget and include a source file server If you prefer you can use other terminal emulators but yo
24. structures rosi cc eed Rm RR Rs tr EAE REA RET REA Rr td are 62 QO IT T A ead 62 9 11 Assembler error code 62 10 Flash programming harness eere 65 10 1 Using supplied Flash drivers 0 cece e 65 10 2 Writing your own Flash drive 65 10 2 L Resident code eque et edes aduana MER MR gu 65 10 2 2 Driver file codes 24e eren pen x eae orn dd gu a d 66 11 AT49BV1614 Flash programming eene 69 Ll E us ovv etos ca odd Rd ne EK CRANE CR UAM MS 69 11 2 Flash Access routinen eee hh hh hh 69 11 3 Code loaded into target RAN 70 11 4 Programing the device y sci secs cds reegen ENEE HERR RE A 71 12 Atmel ATSISAMTxxx OPUS scvcsuvensvtvver se van gees 73 121 Tool inci ra AR eka dea bea he Ra ea ie eee ee 73 12 2 CPU definition tia snaar Ae Rice aE Uae uh eee anes Ee Hipp O e 73 12 3 Register definitions and utilities ooooooooocororrrccrcrccr eee 73 12 4 Board definitions vgl ee Rete hse da wade deed Bete da 74 12 5 Hardware mtalsaton 00 00 cece tte hh hh hm hn 74 12 6 Flash programming rra id A dace hs pee e RAA 74 12 1 Code for target cox dei a capes A PER cs 15 12 8 Programming with Xmodem suesseeeeseeeeee eee tenes 75 12 9 User nstructiOns sie Pelee eee a pepe E ERR wade a ERA ESAE EE 76 13 RAM loader ssazeseskewwecsuu a AAA 77 13 1 Code loaded into target RAN TI PLA Writing to RAM soga EAR Ee EE pda 77 13 1 2 Reading memory sso oco ASA see nace AAA EE A 78 13 2 Copyi
25. systems e Starting Forth by Leo Brodie A classic but very dated e Thinking Forth by Leo Brodie A classic For more experienced Forth programmers e Object Oriented Forth by Dick Pountain e Scientific Forth by Julian Noble Other miscellaneous Forth books e Forth Applications in Engineering and Industry by John Matthews e Stack Machines The New Wave by Philip J Koopman Jr All of these books can be supplied by MPE Index Index Eon dee ee SA 47 11000000 iii dea 74 Le kat ge EE 26 L bar d KEE orot ir ESE E EOR EET ES 26 MAS ion ad EE A EEE 74 eet EES EE 26 RITPrStdl o ie dit a adi a 26 AA eters eve epe 27 Op gt is ea 51 etaseflash weed uei E bip rare 70 RE E DEE 67 setarmf 1 xg Pei e E adr ky pip iE 43 Starmedia ro e ee ed eas nega 43 setcpu iisiseirek ko EE oe E Ru Rd E E 43 sethwWbp A sucer pais eR UE Nu dak eme edad 41 Stopepu uva EE ke EELER PIRE 40 Waitdcckey oo ck scr s a eb moore nes Ras 78 ga 2202 tac ri on A 40 PASCO MO os OUT 45 Spepipesida ages ana 40 JantYtesamf esperi perse se dc 75 ENEE ia Dis bag FRE RR a idet eg 67 9 X CD ste eo iu IN 4T cObg1nt S seg Usati etn Pi Hit T Pies 40 ECO ia Regg EE 45 ee M P RT 75 o A O 68 S LL aan cari isa ds RES 51 D EA bera e ERG a EP PPRER Eq 51 CODdbr8 icsiec e cues e er rre es 51 a E EEN 40 TOTES oia ia A 35 jtagstate iac av ded eda EE e As 25 LOPES os m 51 83 DOXTIOAS o comi A 40 ER ii E PRU Eun EE Gre CR R
26. wa quada d wies ws ol decodetb AER paa a dad a ied 51 decodet6 seek repe daa dox n Prag auod e pe cs ol decodetT eiii ead deu RA a cd E ol eeler EENS aa 51 deftargeb EE 48 disabletid ia coi b db RR 41 disable ias coins roe Reb as ech ario 41 disasm DEER 53 disasm fi 222 sce ee us bate RM ong gebat 53 GiSasm EEN 53 E EE 75 GOMEMINS ii hase waked aa bre e 3r GONOP EE 36 Get WEE 36 ATP siria dee es 36 ap 0 EEN 50 drin R3 ral beaks WIGGG ITSRRERY 27 drout l lilsecga e ese du Dai a XR a 27 GEET 28 derrota de 28 drxchgl e m se ac aac ce nte rk uae edes 27 G EE 36 SEET 51 GtIMeME coi ri Ead ai sera 51 dtadjustSp c cei e E er TE uen 51 log 51 E enablefiq 20 EM ra AMD CAPS 41 enablerrg n wa tae Eph qu ree S 41 O4U ETE 21 39 73 F finalxXro oe A e Ad quoe 27 a deo RIVER EBYYeRDS Y 66 findSectorb 6os nnne nr eS s eR 66 f149bvi614 1 the oh oe fue un ee eua e mg 69 flashb se c ee lxx e ee ed 66 69 73 flcmnd EE EE 69 PLA ii in os eal ra nas xta NER ER eee 69 PVTES CC ese eevee Pasa wis ee nada adda a eR C Role RR 69 flunlockKc omic sida chewed Dd ha adea 69 Index flushlast ii x2 6 gie benc iore h da dia bon iege TO flushxbut fis ca cake eee cnetea era ey ex acera da Seas 75 forceuncaclhed 21 2 2 d Wan Rey eS EOS PS 69 G getarmstate clica ddr do Kade ake RR Rd 38 getcpustate csos cya ee ges ed nena aa Meiers 39 getstopcodes ied diy re ye or Dea wee he Fa ias 38 Setthumbetate llle
27. 000 to FlashBase Tell the JTAG Widget where the target Flash starts 00200000 to RAMbase Tell the JTAG Widget where the target RAM starts 12 3 Register definitions and utilities This section defines the base addresses and offsets required to access the memory controller unit FFFFFFOO equ MO BASE MC BASE equ MC 00 equ MC RCR Remap Control 04 equ MC_ASR Abort Status 08 equ MC_AASR Abort Address Status 60 equ MC_EFCO EFCO Registers 60 equ MC_FMRO Flash Mode 64 equ MC_FCRO Flash Command 68 equ MC_FSRO Flash Status 70 equ MC_EFC1 V EFC1 70 equ MC_FMR1 Flash Mode 74 equ MC_FCR1 Flash Command 78 equ MC_FSR1 Flash Status offset from MC_EFCO 1 74 00 equ MC_FMR Flash Mode 04 equ MC_FCR Flash Command 08 equ MC_FSR Flash Status mc NX offset x Read 32 bits from an offset in the MC mc x offset Write 32 bits to an offset in the MC 12 4 Board definition 18432000 value XtalHz hz Master oscillator crystal clock rate in HZ 48110000 value MCK hz Target MCK speed used by InitPLLs below 1 value FWS Number of Flash wait states MCK 1000000 1 value HFMCN1 n Number of clocks in lus FMCN1 3 2 1 value FMCN1 5 n Number of clocks in 1 5us 12 5 Hardware initialisation Tcpu N Display cpu description Settings N Display current CPU settings InitFlash N Initialise the target Flash wait states In
28. 200 3C88 00005AE3 Zc cmp r10 00 0200 3C8C O4A09CE4 d ldr ri0 r12 04 0200 3D00 O4A09CE5 ei ldr r10 r12 04 0200 3D04 08C08CE2 b add r12 r12 08 0200 3D08 E5FFFFEA e j b 2003CA4 0200 3D0C O4A09CE5 e ldr r10 r12 04 0200 3D10 08C08CE2 b add r12 r12 08 0200 3D14 OO80BDE8 h ldmia r13 pc AO bytes 28 instructions ok Ns 3 7 Assembling target code To select the instruction set use ARM 32 or Thumb 1 To define a target piece of assembler use address ORG T ASSEMBLER ARM assembler code END CODE Use of the target assembler is covered in a separate chapter 3 8 Target memory and peripherals Individual memory locations can be read and written See the chapter on Target memory words for more detail Because I O is memory mapped on ARM systems these words can be used to read and write peripheral registers b c t addr b 8 bit byte fetch wOc t addr w 16 bit halfword fetch 10c t addr 1 32 bit word fetch x c t addr xl xh 64 bit word fetch b c t b addr 8 bit byte store wic t w addr 16 bit halfword store gt Itel 1 addr 18 MPE JTAG Widget 32 bit word store x c t xl xh addr 64 bit word store 3 9 Flash programming The Flash folder contains drivers for supported Flash devices All drivers are supplied as source
29. 294 967 295 32 the address is aligned to a CELL boundary c addr address 0 4 294 967 295 32 the address is aligned to a character boundary 32b 32 bits not applicable 32 d signed 9 2e18 9 2e18 64 double d positive 0 9 2e18 64 double ud unsigned 0 1 8e19 64 double Sys O 1 or more system dependent entries char character 0 255 8 Lext text read from the input stream S Any other symbol refers to an arbitrary signed 32 bit integer unless otherwise noted Because of the use of two s complement arithmetic the signed 32 bit number n 1 has the same bit representation as the unsigned number u 4 294 967 295 Both of these numbers are within the set of unspecified weighted numbers On many occasions where the context is obvious informal names are used to make the documentation easier to understand 2 3 Input text Some Forth words read text from the input stream e g the keyboard or a file That text is read from the input stream is indicated by the identifiers lt name gt or text This notation refers to text from the input stream not to values on the data stack Likewise ccc indicates a sequence of arbitrary characters accepted from the input stream until 12 MPE JTAG Widget the first occurrence of the specified delimiter character The delimiter is accepted from the input stream but it is not one of the characters ccc and is therefore not otherwise processed This notation refers to text from the input stre
30. 8 OEFOAOE1 p a mov pc r 4 ok ss RO A000 00DF 8200 E9FF 0200 3744 0000 0001 R4 0200 EE00 5000 0000 0000 0020 0000 0004 R8 0200 585C 0000 0006 0200 COFO 0200 FFOO R12 0200 FEFO 0200 FDDC 0200 5294 0200 529C CPSR A000 00DF NC IF SYS SPSR A000 00DF NC IF SYS 0200 5294 04A02CE5 e str r10 r12 04 ok Ns When you are ready to resume normal operation use RestartCPU to restart the CPU You can also use GoFrom addr to resume at a different address 16 MPE JTAG Widget 3 5 Displaying memory Target memory is displayed by the words BTdump WTdump and LTdump These three words all require a starting address and a length in bytes They differ in that they display 8 16 and 32 bit values respectively O 20 btdump 0000 0000 18 FO 9F E5 18 FO 9F E5 18 FO 9F E5 18 FO 9F E5 p e p e p e 0000 0010 18 FO 9F E5 18 FO 9F E5 20 FF 1F E5 20 FF 1F E5 p e p e e e O 20 wtdump 0000 0000 F018 E59F F018 E59F F018 E59F F018 E59F p e p e p e p e 0000 0010 F018 E59F F018 E59F FF20 E51F FF20 E51F p e p e e e ok O 20 1tdump 0000 0000 E59F FO18 E59F F018 E59F FO18 E59F FO18 p 0000 0010 E59F FO18 E59F F018 E51F FF20 E51F FF20 p ok d J o FO Oo oO 9 CO o 0 o o 0 je 0 3 6 Disassembling target code You can disassembler a range of memory using DisAsm AL addr len You can select the instruction set using ARM 32 and Thumb 1 C
31. Convert n bytes 64 max to the memory mask for LDM and STM instructions N must be a multiple of 4 CopyInNext buffer len Copy the next len 32 max bytes from the target The target address is in CPU register R14 Uses RO R7 R14 CopyOutNext buffer len Copy the next len 32 max bytes to the target The target address is in CPU register R14 CopyMemIn taddr buffer len Copy len bytes rounded up to 4 bytes from target memory at taddr to Widget memory at buffer Both taddr and buffer must be 4 byte aligned Uses RO R7 R14 CopyMemOut buffer taddr len Copy len bytes rounded up to 4 bytes from Widget memory at buffer to target memory at taddr Both taddr and buffer must be 4 byte aligned Uses RO R7 R14 38 MPE JTAG Widget 6 8 Modifying registers After the target has been halted the CPU context has been read into the CPUstate array These registers are the current state of the CPU and will be written back to the CPU when it is restarted You can read and write these registers as if they were host variables using the Forth words and Register names are preceded by a h character e g to set register 3 to S55AA55AA you can use 55AA55AA hR3 struct Context N n structure defining a context frame which consists of registers RO R15 CPSR and SPSR in that order The field names are CF RO CFR15 CF CPSR and CF SPSR Context buffer CPUstate N addr The primary CPU state informati
32. IDLE state by clocking TMS high five times and then TMS low once This word is only used as a recovery mechanism to get the JTAG system into a known state UxR gt RTI Take the TAP from UDR or UIR to Run Test Idle TargetReset Reset the target with a 10 ms low pulse on SRST Note that on many ARM systems this will also reset the JTAG system JTAGreset Use the nTRST signal to reset the JTAG logic 10 ms pulse and leave JTAG in RUN TEST IDLE state AllReset Resets the target and the JTAG system leaving JTAG in Run Test Idle Run at power up UxRgoto state Move the JTAG state machine from UxR to one of SeIDRS SelIRS TLR and RTI RTIgoto state Move the JTAG state machine from RTI to one of SeIDRS SelIRS TLR and RTI SelDRSgoto state Move the JTAG state machine from SelDRS to one of SelDRS SelIRS TLR and RTI JTAGgoto state Move the JTAG state machine to the selected state This is principally used to get from Update xR to the next required state It also handles going from Test Logic Reset and Run Test Idle If the current state is not the required state an Update xR Test Logic Reset or Run Test IDLE an error message is issued by a 2 THROW gotoSDR N Move to Select DR state gotoSIR N Move to Select IR state 26 MPE JTAG Widget 5 5 Using multiple devices daisy chain Multiple JTAG devices can be placed in one JTAG chain To select a specific dev
33. K TAP st te machine ACCESS Eed een hehe dude hi eR a A ns ens 24 5 5 Using multiple devices daisy chain ocooccibcraceateate rea Eben pace 26 5 6 Scan chain access deiei a e E A e brides be ERA 26 5 7 Read and write IR and DR neriie iaai i Ea 28 Dre Test 10 EE 28 6 ARM debug Chains 5300000 dades 29 6 1 Instruction register Ne SEELEN EERSTEN RR RR RR RR a EAR 29 6 2 Test data registers nlii e Te dew Rex era epe Kor rbi bee due 20 6 2 1 Instruction fOglSter 2522 cse pe DESEN RC RR RR Roh REC SE ica th 29 0 2 2 By pass ctus er ROUES ebe EE del IS CORN OP RE ER p eb ERR 29 UD EMEGOCNIDEPPERR TEE 29 0 2 4 Scan chain selecta occiso kr rer Meer cece Ra Ee ER ea ER ER Rar ER 30 6 3 Debug R gisters iii tere p e d acd deo Ra ca deed dE 32 6 3 1 DCC control 2900100 A costosa atra 32 6 3 2 Debug control OSDUDOUD ENEE r Robe tombe hate Ae itd ue 33 6 3 3 Debug status 00001 Fl A EE 33 6 3 4 Debug register games 33 6 4 ARM JTAG imstructions 00 aE EE PEA AEE ER EE EREE nn 34 EE EE 34 6 6 Scan chain ii A ee cre et dd dE 35 6 7 High level debug support 4 e se ees od eek eh rhe a E 36 0 8 Modifying Tegisterss cnica id p eR ote M qud cte rc p eed ec teg 38 6 9 CPU halt restart and contest hh hh 38 6 10 CPU state display ionis re rrr redet eh ERRARE RR de anda 40 6 11 CPU Debug f nctiolis v dongunsita rr ned Reb qu ru nx LP EE SES de 40 6 12 Breakpointis eee A a SEE oe d CEPR RI EAS 41 6 13 Target
34. MPE JTAG Widget Microprocessor Engineering Limited Copyright c 2004 2005 2006 2007 2008 Microprocessor Engineering Limited Published by Microprocessor Engineering MPE JTAG Widget User manual Manual revision 3 0 20 March 2009 Software Software version v3 0 For technical support Please contact your supplier For further information MicroProcessor Engineering Limited 133 Hill Lane Southampton SO15 5AF UK Tel 44 0 23 8063 1441 Fax 44 0 23 8033 9691 e mail mpe mpeforth com tech support mpeforth com web www mpeforth com Table of Contents L Introduction PTT PP LE Mm 1 LL bat does b do uenisse Erben Feux Pct Re Pri ac dcc Ba Ru E CRT Ua Kg 1 1 2 About the MPE JTAG Widget mh 1 1 2 1 Widget Hardware ima EI eto eth cre tarte Tp REOR bon epa IR BOR EN 1 L Widget Softwares ud esed eth a 2 L Getting started A ee a dd 2 1 89 1 Software installation ettet e rb newest eee eae nde dane AN 2 1 3 2 Talking to the JLAG Widget eee eee cee rr 3 1 3 3 Selecting your CPU sicco REGERE aides de et Dam np OPER 3 1 3 4 Programming external Flach 4 1 3 5 Optimising programing speed 4 1 3 6 Debugging ARM code oce urhe Er ex Rear RR RAPERE ER ac 5 1 3 7 Saving compiled code 5 1 3 8 Using other terminal emulators ssssseeeeeeeeeeee eee eee 5 1 3 9 Using Lin x and M68 eai piri rpg pii RO Roe Beatle AE 5 1 4 About Forth ssis sii utt EE ed A REACHED
35. MSatTDO n If this value is non zero bits are read written most significant first msb nearest to TDO otherwise they are read written least significant first Isb nearest to TDO MSatTDO 1 to MSatTDO Set the read write direction to most significant bit first LSatTDO 0 to MSatTDO Set the read write direction to least significant bit first Chapter 5 JTAG primitives 27 TCKpulses Nn Outputs n TCK pulses TDI is unchanged and TDO is ignored gR X used to be called xR Start an IR or DR transfer from Select xR going to Shift xR IR y Start an IR transfer from Select IR going to Shift IR and then shifting out any bits destined for after TDO DR ie Start an DR transfer from Select DR going to Shift DR and then shifting out any bits destined for after TDO xRin n x Read n bits as x staying in Shift xR state This word must not be used for the last bit FinalxR u u non zero Clock the IR DR by u bits where u must not be zero TDI is set to one and the last clock is issued with TMS 1 to go to the JTAG Exit1 xR state gRin n after x Read the last n bits as x followed by any BYPASS unused bits ending in Update xR state DRin n x Read the last n bits as x followed by any unused bits ending in Update DR state IRin n x Read the last n bits as x followed by any BYPASS bits ending in Update IR state xRxchg xi n x2 Read write n bits out from x1 and in t
36. Q octal 0454 Hexadecimal numbers may also entered with a 0x prefix or an h suffix 3 2 Connecting the target The first step is to connect the target to the JTAG Widgets JTAG OUT connector J3 with a ribbon cable The J3 20 pin JTAG connector has the following pin out defined by ARM Pin 1 is marked on the PCB and usually lines up with a stripe on the ribbon cable and a small mark on the socket you plug in See DUI0048F MICE2 2 pdf at www arm com for more details of the 20 pin interface Input and Output in the table below are with respect to the J TAG Widget Va 1 VTref VCC 2 VCC Vtref from target Vcc from target 3 nTRST 4 Gnd open collector output 5 TDI 6 Gnd output pulled up down on target 7 TMS 8 Gnd output pulled up on target 9 TCK 10 Gnd output pulled up on target 11 RTCK 12 Gnd input 13 TDO 14 Gnd input 15 nSRST 16 Gnd input output pulled up on target 17 DBGRQ 18 Gnd RFU 19 DBGACK 20 Gnd RFU The JTAG Widget uses level shifters inside a CPLD to interface the target JTAG signals to the CPU inside the host JTAG Widget Thus it needs a very small amount of power from the target board The power should in the range 1 8 to 3 3 volts The signal lines are 5 volt tolerant Most ARM development boards use the standard ARM 20 pin connector standard If your board uses a different format you will have to obtain or make an adaptor 14 MPE JTAG Widget 3 3 Initialising the JTAG connection Commands fo
37. R IRwrite Nxn Write the n 32 max least significant bits of x to the instruction register The TAP is moved to Select IR Scan before starting and is left in Update DR 5 8 Test code This code is only compiled if the equate DIAGS is non zero at compile time Chapter 6 ARM debug chains 29 6 ARM debug chains The ARM7 specific data was extracted from ARM manuals DAI0028 DAI0038B and DDI0029G The ARM9 specific data was extracted from ARM manuals DDI 0145A and DDI_0151C 6 1 Instruction register This is 4 bits wide for ARM7 9 and 5 or 7 bits wide for XScale with the least significant bit at TDO Select LSatTDO before shifting into the IR 4 value IR N n Number of bits in the instruction register 40000 const cmdEXTEST Connects selected scan chain between TDI and TDO ready for DR access 0010 const cmdSCAN N After issuing SCAN N a four bit scan chain number is put into the DR which always returns 7610000 LSatTDO The selected scan chain number is placed between TDI and TDO 10011 const cmdSAMPLE Production test only 10011 const cmdPRELOAD 70100 const cmdRESTART Causes the core to restart selects BYPASS mode and exits debug mode when RUN TEST IDLE is reached 40101 const cmdCLAMP Selects BYPASS and prevents UPDATE DR affecting the data register For scan chain 0 only 6 2 Test data registers 6 2 1 Instruction register 4 bits LSatTDO 6 2 2 Bypass A one bit register which always reads 0 an
38. Widget code TDIOxchg x1 mask x2 if x1 mask is non zero write 1 to TDI otherwise write 0 TDI is written out on after the falling edge of TCK and is sampled by the target on the rising edge of TCK Replace the bit defined by mask with the value read from TDO CkTMShi RS Set TMS high and pulse TCK CkTMSlo X es Set TMS low and pulse TCK 5 4 TAP state machine access This section deals with moving the JTAG state machine between its various states State numbers are as defined in the JTAG specification 0F equ jsTLR NX n Test Logic Reset 0E equ jsCIR NX n Capture IR 0D equ jsUIR NX n Update IR 0C equ jsRTI NX n Run Test Idle 0B equ jsPIR V n Pause IR 0A equ jsShIR X n Shift IR 09 equ jsE1IR NV n Exit IR 08 equ jsE2IR n Exit2 IR 07 equ jsSelDRS X n Select DR scan 06 equ jsCDR NX n Capture DR 05 equ jsUDR NX n Update DR 04 equ jsSelIRS N n Select IR Scan 03 equ jsPDR NX n Pause DR 02 equ jsShDR n Shift DR 01 equ jsE1DR n Exit DR Chapter 5 JTAG primitives 25 00 equ jsE2DR NV n Exit2 DR variable CurrSC addr Holds the current scan chain number variable JTAGstate addr Holds the current JTAG state JTAGstate X Display the name of a JTAG TAP state ShowJTAGstate X Display the name of the current JTAG TAP state goRTI X Use the TMS and TCK signals to leave the JTAG TAP in the RUN TEST
39. a terminal e g ATDE to the Widget in the usual way e 2 Type Reflash and follow the instructions If you cannot complete the operation connect a serial port to to the JTAG Widget convert the image file to a HEX file and use the Philips ISP loader to program the Widget s internal Flash 1 8 Development Kit Tools If you have the development version of the JTAG Widget you will have the MPE Forth cross compiler and all the JTAG Widget source code Install the MPE Forth cross compiler and JTAG Widget source code from the development CD Install the Philips ISP programmer software from the USBSTAMP PhilipsIsp folder This requires a serial connection to the DB9 connector on the board To use it the link marked BOOT on the board must be fitted To run all other software this link must be open The Philips ISP software is only needed if the on board Forth software becomes corrupted N B If you have problems with the on board Flash programming routines check the LPC2106 bootloader version using the Philips ISP software or by typing IAPBootVer dword which will give something of the form 0000 xxyy where xx is the major version number and yy is the minor version number If this number is less than 0000 0134 hexadecimal or 1 52 decimal you should update the bootloader using ISP software version 2 2 0 or greater These are available on the MPE CDs and from www semiconductors philips com files products standard microcontrollers util
40. addr b 8 bit byte fetch wOc t addr w 16 bit halfword fetch 10c t addr 1 32 bit word fetch x c t addr xl xh 64 bit word fetch bic t b addr 8 bit byte store wic t w addr 16 bit halfword store Lier 1 addr 32 bit word store x c t xl xh addr 64 bit word store Moveln t taddr haddr len Move len bytes address units from the target to the host MoveOut t haddr taddr len Move len bytes address units from the host to the target here t taddr Return the address at which target assembly or compilation will take place org t taddr Set the address at which target assembly or compilation will take place allot t n 49 50 MPE JTAG Widget Add n address units normally bytes to the address at which target assembly or compilation will take place Target X Display the current target CPU twO h addr w Fetch a 16 bit target word from host memory returning it as a target value adjusted for byte ordering t10 h addr 1 Fetch a 32 bit target word from host memory returning it as a target value adjusted for byte ordering tw Ch w addr Store a 16 bit target word into host memory adjusting it for byte ordering tl h 1 addr Store a 32 bit target word into host memory adjusting it for byte ordering 7 3 Target memory tools BTdump addr len Display dump len bytes of target
41. am not to values on the data stack Unless noted otherwise the number of characters accepted may be from 0 to 255 2 4 Other markers The following markers may appear after a word s stack comment These markers indicate certain features and peculiarities of the word C The word may only be used during compilation of a colon definition I The word is immediate It will be executed even during compilation unless special action is taken e g by preceding it word with the word POSTPONE Affected by multi tasking U A user variable Chapter 3 First steps in debugging ARM code 13 3 First steps in debugging ARM code After you have connected to the JTAG Widget using a terminal emulator you can start debug ging an ARM target board and its code The JTAG Widget is called the host and the board you want to debug is called the target In turn the PC or other USB master is the host for the JTAG Widget 3 1 Number bases The number base in the Forth assembler can be indicated by the words BINARY DECIMAL and HEX In addition numbers prefixed by the and characters are treated as special cases These characters affect the number base for that number only Note that the characters and follow Motorola usage Note that the symbol attached to a number is not the same as the word that indicates immediate addressing Symbol Base Example hex 55AA decimal 1234 binary 41011001
42. and a three bit immediate RdRnImm5 caddr Display two low registers and a five bit immediate RdRnRm caddr Display three low registers Swi bkpt caddr SWI and BKPT instructions decode SWI instructions dTidpiF8 X caddr string is opcode Display two hi lo registers dTimemF2 Nes Display load store 3 regs instruction TRegMask mask Display 8 bit register mask condBr8 NE Display 8 bit conditional branch dTbri1 N Decode 11 bit unconditional branch bl blxoffii MX Decode BL BLX label instruction pair b1x undef Undefined instruction or BLX second instruction dTadjustSP A Decode adjust stack instructions decodeT8 flag true if processed Decode instructions selected by the top 8 bits decodeT6 flag true if processed Decode instructions selected by the top 6 bits decodeT7 flag true if processed Decode instructions selected by the top 7 bits decodeT5 X flag true if processed Decode instructions selected by the top 5 bits decodeT4 flag true if processed Decode instructions selected by the top 4 bits 52 MPE JTAG Widget Chapter 8 ARM disassembler 53 8 ARM disassembler The disassembler works with target code over specified ranges It uses the target memory software interface defined in a separate chapter You can select the instruction set using ARM 32 and Thumb 1 DISASM al addr len
43. at update NOT capture according to the register address and the R W bit a Address Width Register 400000 4 Debug control 400001 5 Debug status 100010 8 Vector catch control ARM9 100100 6 Debug comms channel DCC control 400101 32 Debug comms channel DCC data 401000 32 Watchpoint O address value 401001 32 addr mask O compare 1 ignore 401010 32 data value 401011 32 data mask O compare 1 ignore 401100 9 control value 401101 8 control mask 410000 32 Watchpoint 1 address value 410001 32 addr mask O compare i ignore 410010 32 data value 410011 32 data mask O compare 1 ignore 410100 9 control value 410101 8 control mask Ns Chapter 6 ARM debug chains 6 3 1 DCC control 9600100 R O Bits 31 26 Embedded ICE version 27 2 RFU 1 W 0 no data from CPU W 1 data from CPU 0 R 0 can send to CPU R i last not read The CPU uses the following instructions to access the DCC in coprocessor 14 MRC 14 O Rd CRO CRO O read DCC control register MCR 14 O Rn CRi CRO O write DCC data send to CPU MRC 14 O Rn CR1 CRO O read DCC data recv from CPU 6 3 2 Debug control 00000 R W Bit 2 INTDIS i disable IRQ and FIQ Bit 1 DBGRQ 1 force debug request Bit O DBGACK i force debug ACK 6 3 3 Debug status 00001 R W Bit 4 TBIT O ARM 1 Thumb Bit 3 cogent Debug memory access completed Bit 2 IFEN Core IFEN signal Bit 1 DBGRQ status Bit O DBGACK status M 6 3 4 De
44. bases he number base in the Forth assembler can be indicated by the words BINARY DECIMAL and HEX In addition numbers prefixed by the and characters are treated as special cases These characters affect the number base for that number only Note that the characters and follow Motorola usage Note that the symbol attached to a number is not the same as the fo word that indicates immediate addressing Symbol Base Example hex 55AA E decimal 1234 binary 41011001 Q octal 0454 M Hexadecimal numbers may also entered with a 0x prefix or an hi suffix 9 3 ARM instruction set The ARM instruction set is highly orthogonal All data processing instructions work on the contents of registers and immediate constants only Any data held in memory has to be loaded into a register manipulated then saved back to memory using one of the memory transfer instructions This may appear to be restrictive but due to the large number of general purpose registers available for scratch storage memory read writes can be kept to a minimum The assembler is of the prefix variety with the instruction mnemonic preceding its parameters Valid instructions are as CS Chapter 9 ARM Assembler 57 o B BL cond expression MOV MVN cond S Rd op2 CMN CMP TEQ TST cond P Rn op2 ADC ADD AND BIC EOR ORR RSB RSC SBC SUB cond S Rd Rn op2 MRS
45. bit 31 first MSatTDO SYSSPEED bit BREAKPT bit DDEN bit Data bus 0 31 DO scanned out first LSatTDO TDO M a Scan chain 2 This 38 bit register chain accesses the Embedded ICE registers You must set INTEST after SCAN N 2 TDI 1 bit R W O read i write Addr 4 0 register select LSatTDO Data 31 0 data LSatTDO TDO M Scan chain 3 Implementation specific external boundary scan Scan chain 4 Provides access to PA TAG RAM 49 bits bit 0 at TDO a TDI 48 PA TAG sel TCK 4T RAM enable 46 Odd not Even 45 40 Scan index 39 33 Scan reg 32 PA TAG sync TCK 31 0 WBPA TDO M J ARMe Scan chain 15 For CP15 access 40 bits bit 0 at TDO 32 MPE JTAG Widget TDI 1 bit R W O read i write addr 5 0 register select LSatTDO data 31 0 instruction or data LSatTDO 1 bit mode O interpreted 1 physical TDO M A ARM 966 Scan chain 15 For CP15 access 30 bits bit 0 at TDO f TDI 1 bit R W O read i write addr 5 0 register select LSatTDO data 31 0 instruction or data LSatTDO TDO S P 6 3 Debug Registers Scan chain 2 is a 38 bit register chain which accesses the Embedded ICE registers for ARM7 and ARM9s You must set INTEST after SCAN NO TDI 1 bit R W O read i write Addr 4 0 register select LSatTDO Data 31 0 data LSatTDO TDO M Data is read written
46. bug entry has occurred OxE7F2E7F2 equ TRestartIns7 X oce Opcodes for ARM Thumb restart branch OxE7F1E7F1 equ TRestartIns9 Opcodes for ARM9 Thumb restart branch RestartThumb Restart the CPU by filling the pipe The required CPU state must have been set by SETCPUSTATE above ISSUERESTART is not performed The CPU is currently in Thumb mode after SETCPUSTATE above RestartCore Restart the CPU by filling the pipe The required CPU state must have been set by SETCPUSTATE above ISSUERESTART is not performed If bit 5 of the CPSR in CpuState is set the CPU is restarted in Thumb mode otherwise it is restarted in ARM mode 40 MPE JTAG Widget 6 10 CPU state display xPSR Mk SS Display x as status register contents in form lt hex gt lt flags gt lt control gt lt mode gt CPUstate context Display the contents of the given context buffer NextIns Disassemble and display the next instruction to be executed This is the instruction at R15 8 for ARM or R15 4 for Thumb where the contents of R15 are taken from the CPUSTATE context structure 1 value ShowRegs Set this value non zero to display the CPU registers at each step in SHOWCPU ShowCPU X Display the CPU state 6 11 CPU Debug functions These are the primary words needed by any command line debugger DbgInts X Set the core INTDIS signal which forces the core to ignore interrupts DbgInts N Release the core INTDIS si
47. bug register names 400000 constant dbrControl N n Debug Control 00001 constant dbrStatus X n Debug Status 100100 constant dbrDCCcontrol X n DCC control 400101 constant dbrDCCdata X n DCC data 701000 constant dbrWOAval X n Watchpoint 0 address value 401001 constant dbrWOAmask N n Watchpoint 0 address mask 401010 constant dbrWODval N n Watchpoint 0 data value 101011 constant dbrWODmask X n Watchpoint 0 data mask 34 MPE JTAG Widget 101100 constant dbrWOCval n Watchpoint 0 control value 401101 constant dbrWOCmask N n Watchpoint 0 address value 410000 constant dbrWiAval N n Watchpoint 1 address value 410001 constant dbrWiAmask N n Watchpoint 1 address mask 410010 constant dbrWiDval N n Watchpoint 1 data value 410011 constant dbrWiDmask N n Watchpoint 1 data mask 410100 constant dbrWiCval N n Watchpoint 1 control value 7410101 constant dbrWiCmask n Watchpoint 1 address value Note that the mask registers are XNOR Matches occur when mask XNOR value data 1 for all bits Setting a mask bit to 0 means that the bit ALWAYS matches mask value data match 0 x x aD 1 0 0 1 1 0 1 0 1 1 0 0 1 1 1 1 6 4 ARM JTAG instructions SetIDCODE b Output the IDCODE instruction SetINTEST NS Output the INTEST instruction SetChain Nn Select scan chain n 0 15 and issue INTEST If the current chain is n no action is taken Set CURRSC to 1 beforeha
48. code ENDPROC here lt name gt constant lt name len gt When name is referred to later the host address is returned This permits you to refer to lt name gt in another piece of assembler The main use of PROC however is for writing position independent pieces of code that will later be copied to a target ARM board for execution Note how the length of the code can be found 9 1 Condition codes The ARM is different from many processors in that most instructions can be executed condition ally depending on the processor status flags by appending one of the mnemonics in the table 56 MPE JTAG Widget below to the instruction An instruction without a condition suffix is assumed to use AL Note that most instructions except the test and compare instructions do not set the status flags by default This has to be done with the S suffix G ADD S RO R1 R2 Add set condition codes ADD NE S RO R1 R2 if NE and set condition codes Ne J ARM Condition ARM Condition CS carry set NE not equal or non zero CC carry clear GE greater than or equal PL plus positive or zero LT less than MI minus negative GT greater than V8 overflow set LS unsigned less than or equal same VC overflow clear HS unsigned greater than or equal same Same LE less than or equal LO unsigned less than Same as CC EU equal or zero HI unsigned greater than AL Always default M 9 2 Number
49. current mode Uses R14 which must be aligned WriteReg2 data reg Write data to ARM register reg in the current mode Uses R13 which must be aligned ReadCPSR A Read the CPSR as x Uses RO ReadSPSR So Read the SPSR as x Uses RO WriteCPSR NES Write x to the CPSR Uses RO WriteSPSR Nx Write x to the SPSR Uses RO WriteMaskRegs context mask Set multiple registers from Widget memory Mask is a bit map with bit 0 corresponding to RO and bit 15 corresponding to R15 PC Context is the address of Widget memory containg RO R15 in that order Note that if you are using WRITEMASKREGS with WRITEMEMNEXT below to write a block of memory mask must specify a continuous set of registers starting with RO ReadMaskRegs context mask Read multiple registers into Widget memory Mask is a bit map with bit 0 corresponding to RO and bit 15 corresponding to R15 PC Context is the address of Widget memory containg RO R15 in that order Note that if you are using READMASKREGS with READMEMNEXT below to read a block of memory mask must specify a continuous set of registers starting with RO The instruction stmia ri4 xxxx O value LastICEstatus N x Chapter 6 ARM debug chains 37 Returns the ICE status register value last read by Halted below O value StopStatus N n Contains the Debug Status register value read on entry to debug Bit 4 is set if the CPU was executing Thumb code Halted fla
50. d xt of target ALIGNED alignment operation int tcount xt of target COUNT equivalent int 8 xt for 8 bit byte fetch int 160 xt for 16 bit halfword fetch int 32 xt for 32 bit word fetch int 64 xt for 64 bit xword fetch returns double int 8 xt for 8 bit byte store int 16 xt for 16 bit halfword store int 32 xt for 32 bit word store int 64 xt for 64 bit xword store uses double int memin xt for memory copy from target to host 48 MPE JTAG Widget int memout int there int torg O field tname end struct xt for memory copy from host to target xt to return assembly compilation address xt to set assembly compilation address target name as a byyte counted string aA A A Target options are defined by the options field whose top four bits define the CPU type and affect the the interpretation of bits 27 0 bit function 0 O little endian 1 big endian 1 1 has ARM instruction set 2 1 has Thumb1 instruction set 3 1 has Thumb2 instruction set 4 1 has Jazelle 5 7 RFU 8 11 JTAG type 0 ARM7 1 ARM9 2 XScale IR5 3 XScale IR7 12 ARM9 debug control register 0 ARM9 920 12 ARMO9xE 12 27 RFU 28 31 CPU type 0 ARM 00000006 constant ARM7TDMIoptions x default bit mask for ARM7TDMI operation 00000106 constant ARM9options NX x Bit mask for ARM9 operation Variations among ARM O9 types are configured using other bits described above 00001106 constant ARM9Eoptions x Bit mask for ARM9E
51. d has no effect on update 6 2 3 Core ID 32 bits LSatTDO TDI Bits 31 28 version Bits 27 12 part number Bits 11 1 manufacturer ID Bit O always 1 TDO Ns 30 Scan chain 0 MPE JTAG Widget Scan chain 0 accesses the ARM7TDMI core periphery It is specified by ARM manual DDI0029G as 105 bits TDI control signals TDO S Data bus 0 31 D31 scanned out first Address 31 0 AO scanned out first MSatTDO LSatTDO Scan chain 1 A 33 bit register TDI Data bus 0 31 D31 scanned out first BREAKPT bit first to appear TDO MSatTDO Scan chain 2 This 38 bit register chain accesses the Embedded ICE registers You must set INTEST after SCAN_N 2 TDI 1 bit R W O read i write Addr 4 0 register select LSatTDO Data 31 0 data LSatTDO TDO M 6 2 4 Scan chain select ARM 4 bits LSatTDO Always reads 961000 ARM9 5 bits LSatTDO Always reads 10000 4 value scan NV n Number of bits in the scan chain select register Scan chain 0 Scan chain 0 accesses the ARM9TDMI core periphery It is specified by ARM manual DDI_0145A as 184 bits Chapter 6 ARM debug chains 31 a TDI Data bus 0 31 D31 scanned out first MSatTDO control signals Address 31 0 AO scanned out first LSatTDO TDO NE Scan chain 1 A 67 bit register 32 value 32 instruction 3 control 4 TDI Instruction data 31 0
52. de heed 36 o DEE 48 pulp 48 MPE J TAG Widget Ebbe A Er Bee SE it C Ro RC E 48 dek TR E EEN 48 GEI es ROS Sm utei aetati dece 50 PLOCH SxnenmebBesceceendeau pires eS Yuan Eg 50 EMS Trener ere do e dais 23 dE 23 trestartins i 18 ia a 39 trestartins O isis NEEN EE ao Cour s 39 ino PM rr 50 twO Ch ze ge x enERPEPIPWaGJGSU iT baa Oks 50 E EE 25 E EE 25 MI te e Ee Ee rs 42 ICID ns uranio dla wares Pe ao 47 EEN 17 49 A deh DE eat a aa ach R eed acs 47 WO CG tides Ga wid facts acct ears al ga ER 42 CA EE EE 47 A EE 17 49 KE EE 42 walthalt illae tekenned ao e nai ard ure ade Rcs 3r Wa Xtrdy 2 oneeexesegieeefenceanesueP e deu Dees ee 74 NEES ED esegue e a 36 WEE Ed Gav et ite E ka Y Wap atr are E apa 35 writemaskdata esser due ee Bae ee 39 writemaskregs cexa c ac kh a pan d 36 Writemem scwewsc chew desrctateduergue esee wu edv 37 Cake dE 37 WEE ES ii aa oa ad EG ee ea RS 79 Wrjbereg ilr siert rr itko EET E EAEE EE 36 KE as ps eed oe as e oes 36 Wrltesamcienk ek e g 4 a ens T9 WIAtespSr i izded igoco ee de ede eee weeds 36 wtd mp is spe bra br er 50 E WEE 18 49 rdc MET 17 49 xbu fftodcc iiis dee dvi A Pad ass 67 A idad obs 27 STOW udi a Dang dee ats ale a ida ias 2T EE Mp UL Ee 27 albina ahaha en ate dug sachs tease dalek 74 Ka de ONE 75
53. dem system 80 MPE JTAG Widget Chapter 14 Further information 81 14 Further information 14 1 MPE courses MicroProcessor Engineering runs the following standard courses which can be held at MPE or at your own site e Architectual Introduction to Forth ATF A three day course for those with little or no experience of Forth but with some programming experience The AIF course provides an introduction to the architecture of a Forth system It shows by teaching and by practical example how software can be coded tested and debugged quickly and efficiently using Forth s interactive abilities e Embedded Software for Hardware Engineers ESHE A three day course for hardware and firmware engineers needing to construct real time embedded applications using Forth cross compilers Includes multitasking and writing interrupt handlers Custom courses are available e Quick Start Course QSC A very hands on tailored course on your site using your own hardware and includes installation of a target Forth on your hardware approaches to writing device drivers designing a framework for your application and whatever else you need The course is usually three days long e Other custom courses we provide are for Open Boot and Open Firmware These are derived from the AIF course above 14 2 MPE consultancy MPE is available for consultancy covering all aspects of Forth and real time software and hard ware development Apart from our For
54. e cr 7x 256 or to SAMpart cr To reset target and JTAG use cr AllReset cr To initialise selected CPU use cr initSAM cr To Flash from a host file use cr lt addr gt len ProgSAM7 cr Number base is DECIMAL Use HEX to change cr MPE J TAG Widget Chapter 13 RAM loader 77 13 RAM loader This code is used by the JTAG Widget to write files to target RAM as is often required when testing applications in RAM before committing them to Flash The code can be used with any ARM device that supports DCC comms 13 1 Code loaded into target RAM This section contains code that is copied to target RAM for execution It is position independent 13 1 1 Writing to RAM Proc RAMwriter do not execute this on host ahead forward unconditional branch DCCemit in R0 x32 destroys R1 191 begin mrc 14 0 ri crO cr0 O N read DCC control reg and s ri ri 02 test bit 1 eq until O for ready to write mcr 14 O rO cri crO 0 write DCC data reg mov pc link return DCCkey out RO x32 destroys R1 1 2 begin mrc 14 0 ri cr0cr00 N read DCC control reg and s ri ri 01 test bit 0 ne until 1 for ready to read mrc 14 0 rO cri crO 0 read DCC data reg mov pc link return X Main in R4 FlashBase R5 dest uses R7 count R8 errs then patch up AHEAD begin main loop mov r8 0 clear error counter bl L 2 X DCCkey for block size in cells m
55. e base register name and the optional offset is either e simple register e An immediate constant e shifted register The address expression must be terminated by a The initial is not strictly necessary but leads to code that is more readable for experienced ARM programmers P simple or shifted register offset needs to be prefixed with or indicating whether the contents of the register should be added or subtracted from the base register Immediate constants do not use the 8 4 bit field format but rather range from 4095 to 4095 Shifted registers can only be shifted by a constant preceded by the symbol and not by the contents of another register The address calculated by combining the base and offset registers is often useful in subsequent loads and stores especially when a sequence of memory locations are to be accessed Use the 60 MPE JTAG Widget operator after the closing to enable the write back feature of the ARM This will write the calculated address back into the base register for subsequent instructions to use C Instruction Address LDR Rd Rn Load from Rn Treated as LDR Rd Rn O LDR Rd Rn Rm Load from Rn plus Rm LDR Rd Rn Rm Load from Rn minus Rm with write back LDR Rd Rn Rm LSL 5 Load from Rn plus Rm shifted logically left five places wit LDR Rd Rn 4 20 Load from Rn plus twenty LDR Rd Rn 40 Load from Rn minus forty with write back
56. ed so that the lowest register is at the lowermost address and the highest register at the uppermost address and up to a maximum of sixteen can be specified Any register name with or without a trailing comma can be used Ranges can be specified with a dash The following are all legal ways of specifying the same list of registers RO R1 R2 R6 R12 RO R2 R6 R12 1 R6 R12 RO R2 Each register can only be specified once The optional final sets the status flags when loading the PC from memory with the LDMxx instruction It can also be used to force loading and storing of user bank registers in non user modes 9 8 6 MVL and ADR As indicated earlier a common source of problems when programming with ARM assembler is the restriction placed on the range of immediate constants that can be used with the data processing instructions To get around this the pseudo instruction MVL can be used to move any signed unsigned 32 bit number into a register MVL R2 127653 The MVL pseudo instruction will attempt to use a single MOV or MVN instruction if possible but may generate up to four ARM instructions to get the value into the register The ADR pseudo instruction performs a similar function but is used to move a 32 bit address into a register ADR label Due to the possibility that a label might be forward referenced and need fixing up later on in the compilation the ADR instruction will always generate a MOV and three
57. en be provided 1 5 About the manual This manual is derived directly from the Forth source code used to generate the on chip Forth The full source code is supplied with the MPE JTAG Widget Development Kit Consequently the documentation includes some words that do not have target entries in the on chip Forth Some words and code routines are marked in the documentation as INTERNAL These are factors used by other words and do not have dictionary entries in the standalone Forth They are only accessible to users of the VFX Forth ARM Cross Compiler This also applies to definitions of the form n EQU name PROC name L name 1 6 If disaster strikes If you get the board into a bad state and it will not sign on you may need to reload the kernel program Reprogram the board using the Philips ISP utility The file to load is BINA RIESNJTA Gwidget hez If the board still misbehaves reload the flash with BINARIESNJTAGRECOVER HEX and run the board This empties the serial EEPROM before signing on Once you have seen the recovery messages and PowerForth has signed on you can use estas to reload JTAGWIDGET IMG and carry on in the normal way 1 7 Installing software upgrades JTAG Widget firmware upgrades are released several times per year The firmware delivery will be a binary image file usually called JTA Gwidget img The procedure to install the upgrade is as follows Chapter 1 Introduction 7 e 1 Connect
58. ena 51 rdrnimm3 i x ek hr pre ERR Pr ees 51 ek EE 51 Kaka EE 51 Settings oss edge ao 74 OPD cir ee 67 SUL DEPE sawed etn e es unes 51 E here ru eie tc e eredi ar 50 del 74 Eege iii a da oe 51 APSE rered iese rne neee a nn 40 E EE 67 CM inicias rr a ug ARES 38 ELlashbUtE ae ace begs e n ue 4 ains 75 IR bbs A ede densa eed 29 MOR eins bie erie A Runa adie Caicos 74 TEEN 22 CAM ea 30 target niea ue ac nee kr rra ered ena 47 TEOStCATUtCDU verebe s ese et eevee e erai ergo 40 TStODCpU iocis keen re leise dee a 40 AP re 47 EE 27 EE POLLO ead at dh nana d and at Gade ta wanda wh iE 27 ED adora llo 27 EE 22 3 decirte ad do becas 74 E UE 66 aligned t ii sea gu EE e pr gees 49 CUBO e E DERESE S A ETE S 49 allreset is sica mas A a EA 25 ALMA ia e se EY Ru Xa rs 48 o ees es Sade RDUM Rn 42 te RE 42 arm7tdmioptions eee 48 84 armftype inxulccesdoed dd 48 arme emi ic a OE REC RU RERO en 43 armJebe rc hae E RE EE E ES TE Re 43 TEE 49 arm ire E 43 TEE 48 A sata nate Petia whee y dee T bartoees 42 E EE 48 ALMOCYPC a ee Bereet erd ea 48 AMS A vara 48 B Did EE 42 ble coi a 17 49 Of iii a ROGER dci 42 POE EE 17 49 e E EE 49 BadMeMop RE 49 LEET 49 DEI 50 puffer ora 38 73 75 C Cel EE 49 CKtMS iii da iia dada 24 D quud ERR 24 clearbreak 222243 dex RR BRE ede id 42 emdc Pic is be dpa te ee aon ain 29 emdextest NEEN da ENEE die kiia beeen 29 Cde ta diri ir A 29 Ccmds MP ir
59. es on the FALLING edge of TCK so we sample it just before the rising edge of TCK nTRST Active low JTAG reset signal nTRST can be held low to disable JTAG in many systems It must be high to use JTAG TMS should high at the rising edge of nTRST Asynchronous independent of TCK The GPIO pin registers are IOPIN r o read pin state IOSET r w write 1 to set read o p state IOCLR w o write 1 to clear IODIR r w O i p 1 0 p 5 2 Configuration These equates select the definitions for the NMI and MPE RevA and RevB boards The TCK active state can also be selected MPErevA equ hwSel Select current hardware 1 equ TCKactiveHi flag If set true TCK is active high and idles low 22 5 2 1 HwSel NMIrevA The connections provided by the NMI ARM serial proto stamp are MPE JTAG Widget y Pin 1 VCC 3 nTRST 5 TDI 7 TMS 9 TCK 11 RTCK 13 TDO 15 nSRST 17 DBGRQ M PO PO PO PO PO PO PO PO 19 DBGACK P0 3 31 30 29 28 20 26 22 2 Pin 2 4 6 8 10 12 14 16 18 20 VCC Gnd Gnd Gnd Gnd Gnd Gnd Gnd Gnd Gnd GPIO alternate functions 3v3 from LK13 or target o p o p o p o p i p i p o p RFU RFU TDO TDI TCK TMS TRST res res SCL SDA res res res res res res res Cap0 0 Mat0 0 res res res res res res res res res 5 2 2 HwSel MPErevA The connections provided by the MPE ARM USB proto stamp are 7 Pin Pin GPIO
60. g Reads the Debug Status Register and returns true if the CPU is halted and in Debug mode Sets LastICEstatus as a side effect WaitHalt X Wait a bit for the system to halt If successful the core is stopped and all memory operations are complete If the CPU cannot be halted a 2 THROW occurs with an error string in ABORTTEXT IssueRestart Issue the RESTART JTAG instruction and go to RTI state doMemIns opcode Perform a memory operation and wait for it to complete ReadMem addr size data Read data from target address addr returning the data Size should be 1 2 or 4 to indicate the data size Data will be read using LDRB LDRH or LDR instructions Uses RO R1 WriteMem data taddr size Write data to target address taddr Size should be 1 2 or 4 to indicate the data size Data will be read using LDRB LDRH or LDR instructions Uses RO R1 WriteMemNext NX mask Write one or more registers to target memory using R14 as the address register Mask is a bit map with bit 0 corresponding to RO and bit 15 corresponding to R15 PC N B The LINK R14 register is left pointing to the next target memory location ReadMemNext mask Read one or more registers from target memory using R14 as the address register Mask is a bit map with bit 0 corresponding to RO and bit 15 corresponding to R15 PC N B The LINK R14 register is left pointing to the next target memory location len gt Mask n mask
61. gnal StopCPU E e Stop the CPU bringing it into debug mode The CPU state is saved in the CPUSTATE array and a THROW occurs if the CPU cannot be HALTed StopCPU N Stop the CPU bringing it into debug mode The CPU state is saved in the CPUSTATE array and a THROW occurs if the CPU cannot be HALTed The CPU state is displayed Interrupts are disabled by DBGINTS until RESTARTCPU unless you use DBGINTS HaltCPU b If not already stopped stop the CPU save its state and apply DbgInts RestartCPU N Restart the CPU using the CPUSTATE array to provide the restart register contents StopCPU wasrunning If the CPU is not halted halt it using STOPCPU and return true 1 otherwise return false 0 RestartCPU flag If flag is non zero restart the CPU PCpipe pe pc Adds the ARM Thumb pipeline offset determined by the CPSR GoFrom addr Restart the CPU at the given target address ssBreak X Chapter 6 ARM debug chains 41 Execute the next instruction at PC 8 4 using the ICEbreaker watchpoint unit ssICEstep Nes Execute the next instruction at PC 8 4 using the ICEbreaker single step unit SingleStep N Execute the next instruction at PC 8 StepFrom addr Restart the CPU at the given target address ss X A synonym for SINGLESTEP Steps Nn Perform n steps without the register dump InsSize X 214 Returns 2 in Thumb mode or 4 in ARM mode acc
62. he number of sectors and starting offset of each sector plus a dummy start address which enables the size of the last sector to be calculated FlUnlock Unlock the flash F1Cmd command Unlock the flash and write the command FlReset Reset device after AutoSelect command Flld manid devid Get manufacturer s ID should be 20 E2 for the ST M29F040B device SecErase secaddr erase sector Erase the sector at the given address 70 MPE JTAG Widget EraseFlash dest dlen Erase the flash sectors covering dlen bytes at dest 11 3 Code loaded into target RAM This section contains code that is copied to target RAM for execution It is position independent The two subroutines labelled DCCemit and DCCkey are the same for all ARM7 CPUs and Flash devices arm tdmi select min CPU required Proc Write1614 do not execute this on host ahead forward unconditional branch DCCemit in RO x32 destroys R1 1 1 begin mrc 14 0 ri crO cr0 O N read DCC control reg and s ri ri 02 test bit 1 eq until O for ready to write mcr 14 0 rO cri crO 0 write DCC data reg mov pc link return DCCkey out RO x32 destroys R1 1 2 begin mrc 14 0 ri crO cr0 O NX read DCC control reg and s ri ri 01 test bit O ne until 1 for ready to read mrc 14 O rO cri crO 0 read DCC data reg mov pc link return Wri6 in R4 FlashBase R5 addr R6 x16 R8 tterrs N
63. hey do not interfere with the debugging facilities The JTAG software provides low and high level functions for JTAG access to ARM and other CPUs The software is based around the Forth programming language You can write your own scripts and programs which can be downloaded compiled and saved onto the JTAG Widget ready for your next session At the lowest level talking directly to the JTAG widget through a terminal emulator is using a very powerful command line debugger with scripting facilities Because the JTAG Widget uses simple communications systems it is very easy to write pro grams DLLs and shared libraries on the host computer that interface the JTAG Widget to third party compilers IDEs and high level debuggers 1 2 About the MPE JTAG Widget 1 2 1 Widget Hardware The JTAG Widget consists of several main blocks Power All power is taken from the USB port On board regulators generate 3 3 and 1 8 volt supplies CPU Philips LPC2106 with 128k Flash and 64k RAM USB FTDI FT245BM provides a fast comms link to the host PC Mac Linux or BSD machine CPLD Xilinx XC32 64 which is user programmable using the Xilinx WebPack software downloadable free from www xilinx com or on CD for a minimal cost This is pro grammed to provide JTAG signal buffering and level shifting 2 MPE JTAG Widget EEPROM Atmel AT24C512 with 64kb storage This can be used for program sorage and for configuration The hardware is complemented by its defau
64. ia ria ee 29 CMGS can EE 29 consolede tiara one hat a 44 CONS tant M M MM Em 48 CODpyJ3inext 2 c lesus aede e 37 COP Mirar ae SA 37 le EE 37 COPY OUENEE E di c rt nga xc ep E seas 37 count Jrs a o das 42 Count e WEE 49 A eme Vee cane ees 43 e EE EE 43 73 e ON 43 e OUER 43 cpucarm96l6 e iei a ai 43 Cpu MO leccion a REG be 43 Cpu hoSt iesas eae EE EE es 50 Cp type re pr m er y RE eR LE Yu 49 G EESQ asides ce es ee eee LAG KR EE ES dA S Ea KG 25 D EE 33 dbrdcccontrol i 29 rias ers 33 dbrdccdata i iles ge y e eh aee E Red 33 dbrstat s sie eee ea oe ERU EIER oe eee 33 dbrwOamask iiiecesc o a err hr ee rne 33 dbrwOaval i ies4 err rn Rh n ret 33 dbrw0emask viii cei c e rer EN EN YE 34 dbrwOcval s eise er rete RE e Res 34 dbrwOdmask cc ice ek nd ne ra RU eee aden os 33 dbrwOdval iid ua ead dca d xa ORO Ee Ba Ea 33 MPE J TAG Widget dbrwiamask 2 223 d eR RR ada AER A 34 lee be 1 EEN 34 dbrwicmask ei ala 34 dbrwlcval mirra a ai 34 dbrwidm sk 21 iaa ais 34 Glen 34 dECECONS O lui a ra c de aia 45 AECA Lair E N E 44 E ENEE 43 ACC EP Ae d ek cara ed 43 O 43 GE RR me ndo 43 dcchtbtype suec el ones Marra ind e ed alee 44 dect irs sea tot d RP RE OT M EE 45 dectasko aiii a RP PUER ERNST 45 dcctoxb ff ci rl2 leg EE 78 debugstep cc sodas dede oe E E pe doe ed 35 debugstepread isses dde i E nn 35 debugstepwrite issus coiteir arti ea d ceeds 35 decodet4 isses uta Badia iaa m
65. ice the JTAG instruction register is written with a sequence that selects one device but puts all other device in BYPASS all bits 1 After this the data register for other devices will be 1 bit wide Instruction register where the selected device has an instruction register that is n bits wide TDI w bits x bits n bits y bits z bits TDO Data register where the selected device has an data register that is m bits wide TDI 1 bit 1 bit m bits 1 bit 1 bit TDO In order to use daisy chained devices we need to know e The number of JTAG units at TDI before the unit we want to talk to e The total number of instruction register bits at TDI before the unit we want to talk to e The number of JTAG units after the unit we want to talk to before TDO e The total number of JTAG units after the unit we want to talk to before TDO O value IRpreTDI N n The number of instruction register bits before the TDI signal of the device we want to talk to O value IRpostTDO N n The number of instruction register bits after the TDO signal of the device we want to talk to O value DRpreTDI N n The number of devices data register bits before the TDI signal of the device we want to talk to O value DRpostTDO N n The number of devices data register bits after the TDO signal of the device we want to talk to 5 6 Scan chain access This section provides routines to read and write the scan chains O value
66. ile UsbStamp Code pdf All the executable software supplied on the CD is for Windows See later for use on Linux Mac and other operating systems 1 3 Getting started 1 3 1 Software installation Run the installer on the CD This will prompt you for a directory folder into which it will install all the issue files It will also add a group called MPE JTAG widget on your Start menu This includes a short cut to AIDE see later Install the FTDI Windows USB drivers from the CD if not already installed If you are using a Mac or a Linux host drivers are available free of charge from www ftdichip com The Windows driver makes a USB connection appear as a COM port To install it Chapter 1 Introduction 3 e Unzip the ZIP file in the USBDRIVERS folder to a new folder e Connect the USB Stamp to a USB port e f Windows asks you for a driver point Windows to the folder you created in the first step The driver will then install In some cases you may have to run the Add New Hardware Programs wizard The FTDI application note AN232 03 PDF in the USBDRIVERS folder describes the process in more detail 1 3 2 Talking to the JTAG Widget AIDE is an Integrated Development Environment IDE that includes a simple editor for your source code and a terminal emulator PowerTerm tuned for use with the PowerForth on the board Use the Properties button on the PowerTerm toolbar to select the COM port The baud rate is irrelevant for the USB sta
67. ile the driver code T hen perform a similar operation for the initialisation code for your CPU e g include CPUs 55800A fth This process adds additional commands to program the Flash and to initialise the CPU If you are reprograming an existing application that has already initialised and mapped memory you just need to set FlashBase and RamBase to point to the base of the Flash to be programmed and to the RAM for the programming code For a blank board with nothing in the Flash you usually need to perform the following opera tions e Program the CPUs clock to a suitable operating speed some ARMs start at 32kHz e Program the chip select unit and improve the memory access timings e Enable your new memory mappings Since some CPUs do not permit you to unmap once a system has been remapped you may have to read the current settings and use those In the majority of cases the Flash you want to program is the boot Flash connected to chip select zero The RAM used by the Flash programming code is usually remapped from its initial high address to zero Once you have all the settings correct and can program the Flash correctly you can save the compiled code in the JTAG Widget s EEPROM This avoids having to download the drivers at the start of each session See TurnKey for more details When you change devices or CPU use Empty to remove the old drivers 10 2 Writing your own Flash driver 10 2 1 Resident code This code allows certai
68. itPLLs N Initialise the target main oscillator and PLL InitSAM7 N Perform a full initialisation of the CPU 12 6 Flash programming MPE J TAG Widget The 256k flash is divided into 16 regions of 16kb which can be locked The Flash is programmed in pages of 256 bytes The Flash controller includes a 256 byte buffer A page is written by writing 32 bit words to the address to be programmed until the buffer contains 256 bytes and then issuing a page write command Pages are 256 byte aligned WaitRdy N status Wait until the Flash is ready and return the status SetFMCN nmcn Write the value into the FMCN field of MC FMRO PageCmd X taddr cmd cmd Chapter 12 Atmel AT91SAM7xxx CPUs 75 Given a target address find its page number and merge the page number and the access key into the command doF1Cmd cmd status Perform the given Flash command wait for completion and return the status value Prog256 haddr taddr status Program a 256 byte page at host haddr to target memory at taddr Return the FSRO register contents ProgBuff haddr len taddr Program a host block to target memory Len is forced to a 256 byte unit 12 7 Code for target Proc WriteSAM X do not execute this on host This procedure is copied into the target and contains the the Flash erase and program tools 12 8 Programming with Xmodem 1024 constant FlashBuff N len Size of Flash data buffer Must be at lea
69. ities 1pc2000_flash_utility zip 1pc2000_b1_update zip Note that v1 52 is only for the LPC2104 5 6 and v1 63 is required for other parts such as the LPC2119 2129 A PDF file in the update describes how to perform the update 1 9 Technical support Technical support is available from your supplier in first instance or from MicroProcessor En gineering MPE JTAG Widget va Ns tel 44 0 23 8063 1441 fax 44 0 23 8033 9691 email mpeOmpeforth com tech support mpeforth com web http www mpeforth com From North America our telephone and fax numbers are 011 44 23 8063 1441 011 44 23 8033 9691 901 313 4312 access number to UK office Chapter 2 How Forth is documented 9 2 How Forth is documented The Forth words in this manual are documented using a methodology based on that used for the ANS standard document As this is not a standards document but a user manual we have taken some liberties to make the text easier to read We are not always as strict with our own in house rules as we should be If you find an error have a complaint about the documentation or suggestions for improvement please send us an email or contact us in some other way When you browse the words in the Forth dictinary using WORDS or when reading source code you may come across some words which are not documented These words are undocumented because they are words which are only used in passing as part of other words factors
70. leurs 49 moveout t een 49 msattdo i 224v ede edad ad eS 26 msattdo ocesecerceegacaa faac NA e Da er 26 N nsrsth ie 9I eR a PRX eReWens 23 NS USC LO co ch vegan pucr e Rn cb edo orm Puro a ws 23 ntrsthi i cil omieleEveReReF 9re43k doer geese 22 ntrstloi lens lose oe odes bused 08 oo eee es 22 O n oe ah ie 50 Org t ces erdt b Esc erawag ads ende ard 49 P pagecmd iia tke eau Fame red e dires 74 primiere teir Ee r e de erario 50 prim rg EE 50 AE EE 71 BEE eet ee erac qe Fa ue Roe ae T5 progbuff ii2akcelasua ede EE T5 progsam ocssrleee ee pw ee ke ie ilie a T5 R rambasei i csg eddie p RE Read beads an 66 69 73 readchipid ici ene e Rr rhe 34 readCpsf i risosoddaski ues SEET AE ee oe 36 e KEE 35 readmaskregs i ia snas ee Gadde Rn das 36 readmem oda sonic dd duo ed ee ead ae 2n readmemnext ii is uodgdeawesuaduauaqddadadeuus ST EE 36 readspsr rociar EE EE AE AE EE 36 TOCVAGCG iis eet dd a 78 TECVACE O iia ase a da AA 79 TOCVMEM rro dadas 79 restart arm i i4adeswracadadaludaquddis uus 39 restartCOELe iesaerd nada us o Ho s eens 39 restartCpu i vieccusou radi uoc vb es 40 restartthumb 45c28 passera gd d wea RR Ra 39 restore arm niiaki was erasa ddddcuaagus Dad aud 39 restorethumnb i2229 a E EA aed ee dE 39 a de ENEE 23 86 S EE 69 Sectab s aie dates can baie acted gee Shes 66 SOCCOMN sh rebecca nied ated he bee ee 66 SELATS POCO a eee ey e eae dd 25 SMA ite Heth eu
71. line These are following glossary description lines Most MPE manuals are now written using the DocGen literate programming tool available and documented with all VFX Forths for Windows Linux and DOS DocGen extracts documentation lines ones that start X X from the source code and produces HTML or PDF manuals 2 2 Stack notation before after where before means the stack parameters before execution and after means stack parameters after execution In this notation the top of the stack is to the right Words may also be shown in context when appropriate Unless otherwise noted all stack notations describe the action of the word at execution time If it applies at compile time the stack action is preceded by C or followed by compiling An action on the return stack whill be shown R before after Similarly actions on the separate float stack are marked by F and on an exception stack by E The definition of gt R would have the stack notation S795 Jee x Defining words such as VARIABLE usually indicate the stack action of the defining word VARIABLE itself and the stack action of the child word This is indicated by two stack ac tions separated by a character where the second action is that of the child word VARIABLE 3 addr In cases where confusion may occur you may also see the following notation VARIABLE NV 3 addr child Unless otherwise stated all references to nu
72. lt software The MPE PowerForth system provided with the JTAG widget contains a Forth compiler and interpreter multitasker timebase comms utilities flash utilities and maintenance tools as well as the J TAG software 1 2 2 Widget Software The J TAG Widget software provides all the routines required for JTAG access to ARM7 and ARM9 CPUs Because the software is based around a Forth interpreter you can write your own debugging scripts using the in built commands called words in Forth parlance The JTAG Widget is fast An experiment using another device to program the Flash gave the following results Wiggler 120 seconds Widget 15 seconds All our Flash and CPU drivers are supplied as source code Using the supplied AIDE software or a terminal emulator such as HyperTerm you can download these drivers and compile them on the JTAG Widget itself You can write new Flash and CPU drivers yourself When you have programmed the Flash on your target board you can use the JTAG Widget s debugging facilities to test your application As with the Flash and CPU drivers you can keep the code in a text file on your PC and compile it on the JTAG Widget There is a spare serial port and several I O pins on the JTAG Widget are available on the JTAG IN and other connectors These can be used with your test code to provide signals to and from the board under test The JTAG Widget uses the kernel software of the MPE USB Stamp This is documented in the f
73. mbers apply to native signed integers These will be 32 bits on 32 bit CPUs and 16 bits on embedded Forths for 8 and 16 bit CPUs The implied range of values is shown as from to Braces show the content of an address particularly for the contents of variables e g BASE 2 72 The native size of an item on the Forth stack is referred to as a CELL This is a 32 bit item on a 32 bit Forth and on a byte addressed CPU the vast majority most DSP chips excluded this is a four byte item On many CPUs these must be stored in memory on a four byte address Chapter 2 How Forth is documented 11 boundary for hardware or performance reasons On 16 bit systems this is a two byte item and may also be aligned The following are the stack parameter abbreviations and types of numbers used in the documen tation for 32 bit systems On 16 bit systems the generic types will have a 16 bit range These abbreviations may be suffixed with a digit to differentiate multiple parameters of the same type G Stack Number Range Field Abbreviation Type Decimal Bits flag boolean O false nz true 32 true boolean 1 as a result 32 false boolean 0 32 char character 0 255 8 b byte 0 255 8 W word 0 65535 16 here word means a 16 bit item not a Forth word n number 1 2 147 483 648 32 2 147 483 647 x 32 bits N A 32 n ve int 0 2 147 483 647 32 u unsigned 0 4 294 967 295 32 addr address 0 4 294 967 295 32 a addr address 0 4
74. mp board but we normally set it to 115200 Note that the USB COM port is not available until the board has been connected On the Properties Server and XMODEM page ensure that the Enable File Server box is checked and that Xmodem is configured for 1024 byte blocks and CRC checking When AIDE is closed these settings will become the defaults next time The board communicates to the host using the USB COM port mechanism provided by the F TDI drivers Connect the board to a USB port which also provides the power for it You may need to use a powered USB hub with some boards Press the Connect button on the PowerTerm toolbar Reset the board using the little button on the side PowerForth will sign on Commands typed directly into the Forth interpreter do not execute until the ENTER CR key is pressed Write a simple Forth word e g hello N cr cr Hello world cr Execute it It will run You can put the same code in a text file conventionally with a F TH extension such as hello fth Compile the file using AIDE and PowerTerm with inciude hello fth The file will be compiled on the board and you can execute the word by typing HELLO again 1 3 3 Selecting your CPU The CPUs folder contains configuration code for several ARM devices You can write new ones 4 MPE J TAG Widget as required Supported devices include the Philips LPC2xxx family and Atmel AT91 devices For families which i
75. n parts of the Flash programming system to be common to all Flash types and CPUs Writing a Flash driver can be approached by by copying and converting an existing file in the Flash folder 66 MPE JTAG Widget Flash programming is based on three values which contain pointers to the start of the Flash in the target the start of RAM in the target and a sector table in the JTAG Widget that describes the Flash sector layout 02000000 value RAMbase addr Returns the base adress of the target RAM used to hold the flash programming code The initial value can be overriden as required 01000000 value FlashBase addr Returns the base address of the current Flash device required The initial value can be overriden as O value Sectab NX addr Gives the address of a table containing the number of sectors and starting offset of each sector plus a dummy start address which enables the size of the last sector to be calculated The following example is for an Atmel AT49BV1614 7 create FL29BV1614 addr 39 00000000 00002000 00004000 00006000 00008000 0000A000 0000C000 0000E000 00010000 00020000 00030000 00040000 00050000 00060000 00070000 00080000 00090000 000A0000 000B0000 000C0000 000D0000 000E0000 000F0000 00100000 00110000 00120000 00130000 00140000 00150000 00160000 00170000 00180000 00190000 001A0000 001B0000 001C0000 001D0000 001E0000 001F0000 00200000
76. nclude on chip Flash such as the Philips LPC2xxx these files will include the Flash programming code Before compiling the selected CPU file edit it to select the required family member crystal and programming clock speeds The following example shows how to set up and program a Philips LPC2xxx device You need not include the comments in what you type va include CPUs LPC2xxx fth compile the code 2214 selectLPC select family device AllReset reset JTAG and target initLPC set up target O 3D000 ProgLPC program whole device M If you want to program a batch of devices you can define your own function 7 program NX 2214 selectLPC AllReset initLPC O 3D000 ProgLPC To save having to reload and retype this code you can use turnkey to make it available at powerup If you need help writing a CPU driver contact MPE technical support Please note that we will need a hardware example for testing 1 3 4 Programming external Flash The Flash folder contains drivers for several Flash devices You can modify these or write your own for other devices After you have compiled the CPU configuration file compile a suitable Flash driver and program the device Later chapters describe the facilities available for writing your own drivers If you need help writing a Flash driver contact MPE technical support Please note that we will need a hardware example for testing 1 3 5 Optimising programing
77. nd to force the action ReadChipID N id Read the chip ID from scan chain 2 6 5 Scan chain 1 This chain is used to force instructions and data into the instruction pipeline at debug speed aor to run instructions memory access or branch at system speed ARMT A 33 bit register Chapter 6 ARM debug chains 35 TDI Data bus 0 31 D31 scanned out first MSatTDO BREAKPT bit first to appear TDO ARMO A 67 bit register 32 value 32 instruction 3 control 7 TDI Instruction data 31 0 bit 31 first MSatTDO SYSSPEED bit BREAKPT bit DDEN bit Data bus 0 31 DO scanned out first LSatTDO TDO M StepARM7 opcode mode data Perform a single ARM7 instruction at debug mode 0 or system mode 1 speed returning the data read back StepARM9 opcode mode data data Perform a single ARM9 instruction at debug mode 0 or system mode 1 speed returning the data read back StepCore opcode mode data Perform a single instruction at debug mode 0 or system mode 1 speed returning the data read back The TAP is left in RTI state SystemStep opcode Perform a single instruction at the current speed Whether previous current or next instruction runs at system speed depends on the core type The TAP is left in RTI state DebugStep opcode Perform a single instruction at debug speed The TAP is left in RTI state DebugStepRead opcode data Perform a
78. ng files to RAM and from memory 0000 c cece eee ete eee eee 79 14 Further information E EC REENEN ees 81 ISL MPE Courses der EORR id Een eed Reds 81 14 2 MPE consultancy 0 EE es ER EENS 81 14 8 Recommended r adiNg eee nnn 82 MPE JTAG Widget Chapter 1 Introduction 1 1 Introduction This manual documents the MPE JTAG Widget software for ARM supplied with your JTAG Widget The underlying MPE ROM PowerForth software and the JTAG Widget hardware are documented separately PDF files in the DOCS folder are provided for the circuit diagram component layout and the default CPLD schematic 1 1 What does it do The MPE JTAG Widget provides hardware and scripting software for debugging application software and hardware The hardware has a USB connection to the host computer and a JTAG interface using the standard ARM 20 pin format to connect to the target device at data rates up to 8M bps The JTAG Widget has a 60MHz ARM CPU which you can control interactively through the USB connection On the host computer it is presented as another serial port so that you can talk to the JTAG widget using a terminal emulator Additional I O lines and a serial port can be connected to the target device and manipulated by the JTAG widget so allowing the JTAG widget to be used as a test stimulus generator This is extremely useful when narrowing down on faults that occur only very occasionally in the field If you write test scripts as tasks t
79. not already running The task can be stopped at any time by pressing lt ESC gt character 0x1B DCCio X Stop the DCC console task 46 MPE JTAG Widget Chapter 7 Target memory words 4T 7 Target memory words The target memory interface has been generalised to permit the system software to support more than one CPU type 7 1 Big endian host operations Note that these functions have to be capable of fetching 32 bit cells from 16 bit aligned addresses not just from 32 bit aligned addresses Note also that these routines assume a byte addressed CPU w n addr ui16 Network order 16 bit fetch w n NV u16 addr Network order 16 bit store n addr u32 Network order 32 bit fetch n u32 addr Network order 32 bit store w n Xu Network order W n oem Network order version of comma 7 2 Target memory and debug interface Each target CPU type is described by a table in the host using the target data structure below The memory functions are for CPUs with native data of that size If the target CPU does not support 32 or 64 bit operations or they are not simulated by the host software fill in the table with the xt of BADMEMOP below struct target size Describes the target memory data The counted name string is not included in the returned size int options holds target options int tsize target cell register size in address units int taligne
80. o pins on the CPU It can transfer up to 32 bits at a time and can be accessed by the host through the ICE registers and by the target CPU using coprocessor instructions 6 15 1 Host Access These words are present on the host The following section contains code that can be used as the basis of ARM target code DCChKey NE M Returns non zero when the Widget can read data from the CPU DCChKey N x Waits until DCC data is available and returns it DCChEmit N n Returns non zero when the DCC is ready to receive a new character DCChEmit cc 44 MPE JTAG Widget Waits until the target CPU is ready to read new data and then sends the given data from the Widget DCChType haddr len Writes a byte string from the Widget to the CPU via the DCC one byte at a time DCChCR A E Write a CR LF pair via the DCC create ConsoleDCC X addr OUT managed by upper driver JTAG Widget Generic I O device for comms via the DCC CONSOLEDCC can be used as a device used by the Forth Widget for interaction The device used may be changed by a phrase of the form device dup opvec ipvec 6 15 2 Target code These words are present in MPE Forth systems on ARM targets C code readDCCcr x X Read the DCC control register and return the value read Biti The W bit is 0 if the DCC write register can accept data N from the CPU X BitO The R bit is O if the DCC read register is empty str tos psp 4 mrc
81. o x2 staying in Shift xR state This word must not be used for the last bit gRxchg x1 n after x2 Read write n bits out from x1 and in to x2 followed by after BYPASS unused bits ending in Update xR state DRxchg xi n x2 Read write n bits out from x1 and in to x2 followed by any unused bits ending in Update DR state IRxchg xi n x2 Read write n bits out from x1 and in to x2 followed by any unused bits ending in Update IR state xRout xn Write n bits from x staying in Shift xR state This word must not be used for the last bit gRout x n after Write n bits from x followed by after BYPASS unused bits ending in Update xR state DRout xn Write n bits from x followed by any unused bits ending in Update DR state IRout xn Write n bits from x followed by any BYPASS bits ending in Update IR state 28 MPE JTAG Widget 5 7 Read and write IR and DR This section provides words to read and write the JTAG Instruction and Data registers DRread n x n bits 32 max are read from TDO and returned as x The TAP is moved to Select DR Scan before starting and is left in Update DR IRread n x n bits 32 max are read from TDO and returned as x The TAP is moved to Select IR Scan before starting and is left in Update DR DRwrite Nxn Write the n 32 max least significant bits of x to the data register The TAP is moved to Select DR Scan before starting and is left in Update D
82. oes Vete uua ceti ae etd 67 Setbreak iscsi naw tig ir sale E mept aes 42 SOC ws indeed chad dolia da 34 Setepustata inicios arc acne enel eb initi 39 GE EEGEN 74 sethwbDpi censenda ker rad ead 41 setidcode ess sos dom ae pr e e erba 34 Set3hntost iii rd E eh ae ea 34 setjtagspeed ii ee e e een 22 SHOW CPU 40 showjtagstate ccr a as 25 ShoWreps sensere rere kun Paene ta p eg 40 singlest p i EELER e er Rae one Ed 41 o RR EERE I ERR ERR 41 hai RUPEE 23 iras 41 SsbreaK l usgasecuec bgedrecrsacpa pede des 40 SS cesbtep uirte pee twr Ras Hex T adden 41 Steparmf i ross en EPE A cc deeds 35 steparmD c cle By B de ao 35 SCEPC Esee aea aa a daa a E EE EE E E E RRN 35 StCpLTOM ene ic a eked 41 SEPSA il e 41 SOPLO a lo areis 39 e ONE 40 stopreaSoni ocuoiisga oa BORED ad 38 Stopstatus ici ie n n ar ee E Rp Yu rd 3T systemstep coic asc xe sdb o n ebd Ea a 35 T tlinofff ilic dessdeescsdeecc ened pieces 38 EE EE 39 Largetisa it doe d on eae eet 48 Target ici 3e m a Pp E e RUD BERS Mes 48 TALES MM ear a ac hoe sa Ra a Rs 50 targetreset cbord eror e eret e aras 25 btckactivehl lc ucl bdo tibus 21 tekhi ie beer h 23 Fc iiio kae i dg Pe ee ere 23 tCkpulse ze beh Eu grits ang pe p Ree 23 tdeb gstepwrite EELER REES 35 Edilicia a eb a Dd bad ong 22 Ed denge d era acet quen da DOLO Eo Iq auro cp ees 22 EE 23 24 n EE 23 A sire dte dae Rete des 23 tdoread so ee ie 23 tdstept2 b celeris a wa
83. on is held here See CONTEXT above N addr CPUstate cf RO constant hRO CPUstate cf Ri constant hR1 CPUstate cf R2 constant hR2 CPUstate cf R3 constant hR3 CPUstate cf R4 constant hR4 CPUstate cf R5 constant hR5 CPUstate cf R6 constant hR6 CPUstate cf R7 constant hR7 CPUstate cf R8 constant hR8 CPUstate cf R9 constant hR9 CPUstate cf R10 constant hR10 CPUstate cf R11 constant hR11 CPUstate cf R12 constant hR12 CPUstate cf R13 constant hR13 CPUstate cf R14 constant hR14 CPUstate cf R15 constant hR15 CPUstate cf CPSR constant hCPSR CPUstate cf SPSR constant hSPSR 6 9 CPU halt restart and context 4 5 cells value Ri5fix offset The offset in bytes added to R15 PC after reading the CPU state In ARM state the result is to leave PC 8 pointing to the next instruction to execute O value StopReason n Returns 0 if the CPU entered debug from a breakpoint or 1 for a watchpoint A forced stop is through a breakpoint GetStopCodes NX Perform a debug NOP storing the reason for the stop in STOPREASON This the first thing done by GetCPUstate GetARMstate context Read the CPU state into a CONTEXT structure in Widget memory at context Performed when the CPU is in ARM state 414 equ T1In0ff7 N n Chapter 6 ARM debug chains 39 ARM7 Value to subtract from PC on entry from Thumb state to point to next instruction to execute 16 equ T1InOff9 N n ARMS Value to subtract from PC on entry from Thumb state
84. oned before each instruction and its operands are encoded as a single 32 bit value on the ARM Some of the 32 bits are given over to the instruction type suffices and destination register etc leaving only 12 bits to represent the constant These 12 bits do not allow all immediate values to be used so the 12 bits are split into two fields One 8 bits wide specifies the constant while the other 4 bit wide field specifies a value to shift the constant by this is actually a rotate right by the shift value times two places This widens the range of immediate constants that can be used but has the restriction that not every number in the full 32 bit range can be used Note that the range of negative immediate constants that can be represented is very limited as these appear to the ARM to be very large numbers i c 1 FFFFFFFF and the larger a number is the harder it is to represent using the method described above Judicial use of instructions such as CMN compare negative MVN move inverted data not negated and RSB reverse subtract can get around this problem 9 7 Shift operations Most data processing instructions allow operand two the second source operand to be specified as a shifted register Here the contents of the register can be shifted at run time by either a fixed amount or by the contents of another register This can be done with one of the ARM s shift instructions e g Chapter 9 ARM Assembler 59 ADD RO R2 R7 LSL
85. or because these words may change or may not exist in later versions Documentation is like sex when it is good it is very very good and when it is bad it is better than nothing Dick Brandon 2 1 Forth words Word names in the text are capitalised or shown in a bold fixed point font e g SWAP or SWAP Forth program examples are shown in a Courier font thus NEW WORD Nab ab OVER DROP If you see a word of the form name it usually means that name is a placeholder for a name you will provide The notation for the glossary entries in this manual have two major parts e The definition line e The description The definition line varies depending on the definition type For instance a normal Forth word will look like and ni n2 n3 6 1 0720 The left most column describes the word NAME and type colon the center column describes the stack effect of the word and the far right column if it exists will specify either the ANS language reference number or an MPE reference to distinguish between ANS standard and MPE extension words The stack effect may be followed by an informal comment separated from the stack effect by a 7 character f and x1 x2 x3 bitwise and 10 MPE JTAG Widget This is a quick reference comment When you read MPE source code you will see that most words are written in the style foo ni n2 n3 G This is the first glossary description
86. ording to the CPSR SkipNext Ke Skip do not perform the next instruction EnableIRQ Enable the IRQ by clearing the CPSR I bit The CPU is halted and restarted if running DisableIRQ Disable the IRQ by clearing the CPSR I bit The CPU is halted and restarted if running EnableFIQ Enable the FIQ by clearing the CPSR F bit The CPU is halted and restarted if running DisableFIQ Disable the FIQ by clearing the CPSR F bit The CPU is halted and restarted if running 6 12 Breakpoints SetHWBP addri leni addr2 len2 Sets a hardware breakpoint The CPU s Watchpoint unit 0 is always used and Watchpoint unit 1 is used if len2 is non zero Addri Len1 represents the range of addresses in which a breakpoint will occur lenl must be a power of two 4 for a single ARM instruction or 2 for a single Thumb instruction Addr2 Len2 represents the range of addresses in which a breakpoint will not occur len2 must be a power of two If len2 is zero no exclusion range is set addr2 is ignored and Watchpoint unit 1 is not used The Addr values must be on a multiple of the len ranges SetHWBP addri leni addr2 len2 If the CPU is running stops it applies a hardware breakpoint using the target CPU s debug unit releases the INTDIS debug signal and restarts the CPU Addri Len1 represents the range of addresses in which a breakpoint will occur lenl must be a power of two 4 for a single ARM instruction
87. ov s r7 rO R7 loopcount b eq spin if zero indicates last block begin bl L 2 DCCkey for 32 bit data str r0 r5 4 sub s 17 17 1 eq until mov rO r8 error count bl 1 1 DCCemit for error count again mov pc link keeps disassembler happy EndProc here RAMwriter constant RWlen image length to copy to target 78 MPE JTAG Widget 13 1 2 Reading memory Proc MemReader do not execute this on host ahead forward unconditional branch DCCemit in R0 x32 destroys R1 1 1 begin mrc 14 0 ri crO0 cr0 O N read DCC control reg and s ri ri 02 test bit 1 W eq until 0 for ready to write mcr 14 0 rO cri crO 0 write DCC data reg mov pc link return DCCkey out RO x32 destroys R1 1 2 begin mrc 14 0 ri cr0cr00 N read DCC control reg and s ri ri 01 test bit 0 R ne until 1 for ready to read mrc 14 0 rO cri crO 0 read DCC data reg mov pc link return Main in R4 FlashBase R5 src uses R7 count R8 terrs then patch up AHEAD mrc 14 0 rO cri crO 0 read DCC data reg to discard junk begin main loop mov r8 4 0 clear error counter bl L 2 DCCkey for block size in cells mov s r7 rO R7 loopcount b eq spin if zero indicates last block begin ldr rO r5 4 bl L 1 X DCCemit for 32 bit data sub s 17 17 1 eq until mov rO r8 error count bl 1 1 X DCCemit for error count again mov pc link keeps disassembler
88. pproach The file FlashNAT49bv1614 fth contains driver source code which can be used as the basis of a new driver To improve compilation speed you can remove the coments if you trust your understanding of the code The next chapter describes the file FlashXAT49bv1614 fth but there is no substitute for reading the source code The overall sequence is e Erase the Flash using direct access to target memory This is usually satisfactory because of time taken for the sectors to erase e Copy programming code into target RAM The programming code is later run and fed with data to be programed e The host programming code links the programming code into into the file transfer facilities on the JTAG Widget e Set up the initial conditions in target CPU registers so that R4 contains the base address of the Flash and R5 contains the first address to be programed e Execute the programming code in target RAM The JTAG Widget feeds it with data from the file transfer tools and receives error counts back e When the file transfer and programming have finished stop the target CPU You may also have to switch the Flash back normal operation mode The following words are provided for copying code to ARM targets using the DCC comms channel SendDCC haddr len Send len bytes from haddr to the target Haddr and Len must be four byte aligned SendDCC haddr len Send the length len as a count of four byte units len bytes from haddr into
89. r the JTAG Widget are case insensitive The JTAG Widget initialises itself when it is first powered up for a little endian ARM 7 You can confirm this by typing target If you need to repeat the initialisation of the J TAG Widget type cold If you have connected and powered up the target after the JTAG Widget has been powered up you may need to reset the target s J TAG system and maybe the CPU itself Not all ARMs have separate JTAG TRST and CPU SRST signals Type AllReset to reset the JTAG widget and the target CPU The target should start executing whatever code it contains 3 4 Stopping Stepping and Restarting the CPU Many operations such as register inspection can only be performed in debug mode with the CPU stopped The command to stop the CPU is StopCpu Va stopcpu RO A000 001F 8200 E9FF 0200 3744 0000 0001 R4 0200 EE00 5000 0000 0000 0020 0000 0004 R8 0200 585C 0000 0006 0200 COFO 0200 FFOO R12 0200 FEFO 0200 FDEO 0200 52AC 0200 5298 CPSR A000 001F N C ___ SYS SPSR A000 001F N_C__ ___ SYS 0200 5290 101400EB k bl 200A2D8 ok The status registers CPSR and SPSR are shown with the flag I F and T bits displayed if set The mode bits are also decoded You can now single step the CPU using SingleStep or its synonym SS Disassembly will switch automatically between ARM and Thumb modes as required Chapter 3 First steps in debugging ARM code 15 va
90. respectively If transferring just the status flags then use 58 MPE J TAG Widget CPSR c x s f where the valid field definers are _C X S E _CXSF FSXC ALL Standard ARM names are also available SP refers to R13 commonly used as a stack pointer LINK refers to R14 the link register and PC refers to R15 the program counter Forth register names can be used in place of the standard register names These are TOS LP UP RSP and PSP These can be assigned to different ARM registers All register names can be used with or without a trailing comma This makes for code that is more readable to the seasoned ARM programmer Character case is not important 9 6 Immediate constants Rather then specify the name of a register whose contents are to be used in an operation it is possible with many instructions to specify a numeric value which is encoded with the opcode mnemonic at assembly time When the word is encountered the assembler recognises that the following input is to be interpreted as a numeric value The value itself can be prefixed with the usual number base selectors such as for decimal for hexadecimal 96 for binary and for octal ADD R2 R3 32 X Add 32 to contents of R3 and place result in R2 Note that in the UK there may be confusion with some printers between the hash symbol and the pound symbol There are restrictions regarding the range of immediate constants that can be used As men ti
91. ressing are actually converted into pre indexed ad dresses that load from the program counter R15 plus or minus an immediate constant This means that the address of the desired memory location has to lie within 4096 bytes of the address of the instruction referencing it The assembler will take into account the effects of pipelining on the program counter when calculating the value of the offset 9 8 4 Byte and half word addressing The instructions LDRB and STRB plus LDRH and STRH on later ARM architectures can be Chapter 9 ARM Assembler 61 used to transfer bytes or half words between memory and registers Byte loads and stores only utilise the bottom 8 bits of the destination register and half words only the bottom 16 bits The contents of the rest of the register are ignored on a store and zeroed on a load from memory Unlike word memory transfers byte loads and stores do not have to be aligned but half word transfers should be aligned to a two byte boundary 9 8 5 Register lists Multiple registers can be loaded from and stored to memory using the LDM and STM instruc tions The format is LDMxx Rd 4 Ra Rb Rx Ry STMxx Rd 4 Ra PC LINK Re Rf Rd contains the base address to where registers are stored or loaded from followed by an optional to indicate that write back is required A register list enclosed by and follows The order of the registers to be stored is of no significance they are always stor
92. set out of range 8 bit offset out of range Same a Chapter 9 ARM Assembler 10B 10C 10D 10E 10F 111 112 113 114 115 116 117 118 119 114 11B 11C invalid register invalid for this CPU variant internal software error report to MPE unconsumed reference stack depth changed error if not in range 32768 32767 invalid forward reference type report to MPE not enough registers defined register not of right type immediate shift count out of range shift must be immediate invalid addressing mode registers needed here invalid register range bad addressing mode before register list R15 not permitted here 24 26 bit branch range exceeded 63 64 MPE JTAG Widget Chapter 10 Flash programming harness 65 10 Flash programming harness When using the JTAG Widget for production programming you should take care to initialise the CPU before running Flash programming code Some ARM CPUs boot from a 32kHz or other relatively low speed crystal and must be initialised for the best programming speeds Examples files for different CPU files are in the CPUs folder Note that Flash support for ARM microcontrollers with internal Flash may also be found in the CPU specific files in thein the CPUs folder for example CPUsXLP C2xzz fth 10 1 Using supplied Flash drivers The supplied drivers are in the Flash folder While talking to the J TAG Widget using AIDE type include Flash AT49bv1614 fth to comp
93. st 1024 bytes to allow for Xmodem 1k transfers FlashBuff buffer FlashBuff addr Buffer for assembling packets destined for Flash FlashBuff FlashBuff constant FlashBuffEnd addr End 1 of buffer FlashBuff value pFlashBuff addr pointer into assembly buffer FlashBase value Tptr addr Target address at which FlashBuff will next be programmed initXbuff X Initialise pointers FlushXbuff N Output to SAM7x and reset buffer FlushLast N Write remaining buffered input to target XtoBuff N Transfer the required number of bytes bytes from X BUFFER into target memory or the Flash buffer See the XModem chapter for more details WriteSAM7 tdest Initialise and start the target s RAM writing routine Flashbase and RAMbase must already have been set up The required parameter is the start address in target Flash WriteSAM7 NE Stop the target s RAM writing routine ProgSAM7 addr len Given the address and maximum length of the target memory to be programed erase the target Flash and read and program the target memory from a host file in binary image format The file is uploaded into the JTAG Widget using the XMODEM 1k byte block protocol See BIN UP in the XMODEM chapter of the manual for more details 76 12 9 User instructions decimal cr cr Set up for settings cr Edit this file to change the defaults cr To change part selection use for exampl
94. th experience MPE staff have considerable knowledge of embedded hardware design Windows Linux and DOS Our software orbits the earth will land on comets runs construction companies laundries vending machines payment terminals access control systems theatre and concert rigging anaes thetic ventilators art installations trains newspaper presses and bomb disposal machines We have done projects ranging from a few days to major international projects covering several years continents and many countries We can operate to fixed price and fixed term contracts Projects by MPE cover topics such as e Custom compiler developments including language extensions such as SNMP and new CPU implementations e Custom hardware design and compiler installations e Portable binary system for smart card payment systems e Machinery controllers e Connecting instrumentation to web sites e Virtual memory systems e Code porting to new hardware or operating systems We also have a range of outside consultants covering but not limited to e Communications protocols 82 MPE JTAG Widget Windows device drivers All aspects of Linux Safety critical systems e Project management including international 14 3 Recommended reading A current list of books on Forth may be found at http www mpeforth com books htm For an introduction to Forth and all available in PDF or HTML e Programming Forth by Stephen Pelc About modern Forth
95. the current target memory address held in target R5 and receive the error count which is added to PrgErrs Haddr and Len must be four byte aligned XbuffToDCC N Send the required number of bytes bytes from X BUFFER into the memory pointed to by target R5 See the XModem chapter for more details Xresult len status Display the results returned by RecvXmodem See the XModem chapter for more details Stopped N Display message to say CPU is stopped WriteTarget tdest hproc hlen 68 MPE JTAG Widget Initialise and start the targets RAM writing routine Flashbase and RAMbase must already have been set up The required parameters are tdest Start address to program in Flash hproc Start of the routine to copy to target RAM hlen Length of the routine to copy to target RAM DefTarget gt TargetMem Force transfers to target HaltCPU 10 ms halt CPU cr Copying write code to target RAM PrgErrs off no errors yet RAMbase swap CopyMem0ut NV tdest copy code to RAM assign XbuffToDCC to do From Buffer A 10 ms CpuState tuck cf r5 Flashbase over cf r4 CO swap cf cpsr or cr Starting target write code RAMbase goFrom 10 ms WriteTarget Stop the target s RAM writing routine HaltCPU Stopped set Xmodem routine haddr set tdest disable FIQ and IRQ start target program Chapter 11 AT49BV1614 Flash programming 69 11 AT49BV1614 Flash programming This code is
96. to point to next instruction to execute GetThumbState context Read the CPU state into a CONTEXT structure in Widget memory at context Performed when the CPU is in Thumb state leaving it in ARM mode for debug operations GetCPUstate context Read the CPU state into a CONTEXT structure in Widget memory at context This must be the first thing done after stopping the core WriteMaskData context mask Set multiple registers from Widget memory Mask is a bit map with bit 0 corresponding to RO and bit 15 corresponding to R15 PC Context is the address of Widget memory containg RO R15 in that order RO is used as the index register RestoreARM context From ARM mode write back R0 R15 and stay in ARM mode RestoreThumb context From ARM mode write back R0 R15 and switch to Thumb mode SetCPUstate context Write back the CPU state from a CONTEXT structure in Widget memory at context StopCore N Stop the CPU by a debug request Used to to halt a normally running program Sets StopSta tus B_ 7ins equ ARestartIns7 opcode The ARM7 branch instruction used to return from debug into ARM mode B_ 6ins equ ARestartIns9 opcode The ARM9 branch instruction used to return from debug into ARM mode RestartARM Restart the CPU by filling the pipe The required CPU state must have been set by SETCPUSTATE above ISSUERESTART is not performed The CPU is already in ARM mode as a de
97. u will lose some facilities Set HyperTerm or another terminal emulator to 115200 baud 8 data bits no parity 1 or 2 stop bits Select the relevant COM port for the JTAG Widget and reset the Widget which will then sign on If all else fails reflash the system as described elswhere in this manual Please be aware that the standard Windows version of HyperTerm is very slow A nuch faster alternative is HyperTerminal Personal Edition from http www hilgraeve com 1 3 9 Using Linux and Macs The JTAG Widget s USB interface is through an FTDI device and a driver that simulates a serial device Any operating system that can provide these facilities can be used with the JTAG Widget The software you will need is a terminal emulator with XModem file transfer utilities 6 MPE JTAG Widget 1 4 About Forth Forth is an interactive programming language widely used for embedded systems ranging from bomb disposal machines to embedded web servers seismic data loggers and safety critical medical equipment The DOCS folder on the CD includes the book Programing Forth in PDF format ProgramForth pdf and a Forth primer fprimer pdf Also included on the CD is an evaluation version of MPE s VFX Forth for Windows The latest version is available for free download from http www mpeforth com To run VFX Forth for Windows send an email with your name address and contact details to mailto vfxtrialOmpeforth com An installation key will th
98. used by the JTAG Widget to write to the Flash for storing applications The code is designed for use with an Atmel AT49BV1614 device on a 16 bit bus The size of each sector is given by the sector table This code is hardware and CPU dependent because of bus width and cache considerations This code was tested on an Atmel EB55 board 11 1 Configuration This section configures the base address of the target Flash the start address of the RAM that holds the target Flash programming routine and disables cacheing of the Flash Edit this file before compiling it so that the target hardware is used correctly 01000000 to FlashBase Define the default base address of the current Flash device 02000000 to RAMbase Define the default base address of the RAM used for the programing code Some CPUs e g MIPS and some ARMs use a particular address range to determine whether the access should be cached or uncached During Flash programming all accesses to the Flash should be uncached and write buffers should be turned off The following is for for a Samsung S3C4510B CPU ForceUncached addr addr bit26 or If your CPU does not have a cache or if caching is never enabled for Flash access use the following code ForceUncached addr addr ForceUncached addr addr Convert a target address into its uncached form Defaults to NOOP 11 2 Flash Access routines create FL49bv1614 addr Table containing t
99. word at target addr count j addr addr len Get the address and length of a byte counted string at target addr 6 14 Target CPU selection create ARM7le addr Table describing target memory accesses for a little endian ARMT create ARM7be addr Table describing target memory accesses for a big endian ARMT create ARM9le addr Chapter 6 ARM debug chains 43 Table describing target memory accesses for a little endian ARM9 create ARM9be addr Table describing target memory accesses for a big endian ARM9 create ARM9Ele NX addr Table describing target memory accesses for a little endian ARMO9E create ARM9Ebe NX addr Table describing target memory accesses for a big endian ARMO9E setCPU addr Set the active pointers to a CPU type table set ARM7 s Set generic ARM7 parameters setARM9 Set generic ARM9 parameters CPU ARM7le X Select little endian ARMT7 as the current target This is the power up default for the JTAG Widget CPU ARM7be X Select big endian ARM as the current target CPU ARM9le N Select target memory accesses for a little endian ARMO CPUZARM9be N Select target memory accesses for a big endian ARM9 CPU ARM9Ele N Select target memory accesses for a little endian ARMO9E CPU ARM9Ebe Amm Select target memory accesses for a big endian ARM9E 6 15 Debug Comms Channel The Debug Comms Channel acts as UART that takes n

Download Pdf Manuals

Related Search

Related Contents

Avaya 2007 IP Deskphone Getting Started Manual  Manual Montagem KFGS.pub    VAPORETTO GO MODIFICATO7:FEV 1000-950.qxd.qxd  Bonnes Vacances !!!! - Communauté de Communes de Racan  

Copyright © All rights reserved. Failed to retrieve file