urjtag
I've submitted patches to urtag to add support for our Phytec pcm030's. The Phytec cards have a multiplexed address and data bus. I had to modify urjtag to first latch the address and then do data operations. The patches should appear in the urtag SVN repository in a few days.
We don't have access to the on-chip debugger for the mpc5200. Apparently the specs for the PowerPC on-chip debugger are considered super secret and you have to sign piles of NDAs and agree to never show your source code. Contrast that with ARM where the specs are total open. There's a reason why ARM debuggers cost $50 and PowerPC ones are $3,000. If I really wanted to access on-chip debug I could buy a $3,000 debugger. Meanwhile printf() is free.
Even though the on-chip debugger is closed the rest of JTAG is standardized. We can still use the mpc5200 JTAG controller with open source software to control the pins on the mpc5200. That's where ujtag comes in.
First I bought one of these ARM JTAG devices from Sparkfun.
They also have a cheaper model.
The Phytec card has a Freescale/Motorola 16-pin COP/BDM layout. The standard ARM layout supported by these Olimex JTAGs is 20 pins. I cut my 20 pin cable in half and made a 16-pin connector for it. So mess around for a while and get urjtag compiled. urtag and these Olimex devices work on both Linux and Windows. I'm using Linux.
I have the first JTAG device and Tyler has the second one. I wanted the first one because it integrates a serial port with the debugger. I run the JTAG cable and a serial cable from the debugger to my board. Then a single USB cable back to my host. Note that the kernel driver for the FTDI FT2232C chip used in the dual port JTAG was broken in Linux 2.6.28, it is fixed in 2.6.29. You also need to set the permissions on the USB /dev device so that you can access the device.
Start up urjtag and set the cable.
root@terra:/home/jonsmirl# jtag UrJTAG 0.9 #1460-jds Copyright (C) 2002, 2003 ETC s.r.o. Copyright (C) 2007, 2008 Kolja Waschk and the respective authors UrJTAG is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. There is absolutely no warranty for UrJTAG. WARNING: UrJTAG may damage your hardware! Type "quit" to exit, "help" for help. jtag> cable ARM-USB-OCD Connected to libftdi driver. jtag>
If it can't find your JTAG device the permissions on the /dev device are wrong.
Now detect the devices present on the JTAG chain.
jtag> detect IR length: 6 Chain length: 1 Device Id: 00010000000000010001000000011101 (0x000000001001101D) Manufacturer: Freescale (Motorola) Part(0): mpc5200 Stepping: B Filename: /usr/local/share/urjtag/freescale/mpc5200/mpc5200 Non-MUXed 24b address, 8b data bus Initialized bus 0, active bus 0 jtag>
It finds the mpc5200 CPU. urjtag defaults to a 24b address and 8b non-multiplex bus. Change this to the 25b address 16b data multiplexed bus on the Phytex card.
jtag> initbus mpc5200 mux MUXed 25b address, 16b data bus Initialized bus 1, active bus 0 jtag>
This initializes a second bus definition which matches the bus multiplexer hardware on a pcm030.
jtag> print bus *0: Freescale MPC5200 compatible bus driver via BSR (JTAG part No. 0) 1: Freescale MPC5200 compatible bus driver via BSR (JTAG part No. 0) jtag> bus 1 jtag> print bus 0: Freescale MPC5200 compatible bus driver via BSR (JTAG part No. 0) *1: Freescale MPC5200 compatible bus driver via BSR (JTAG part No. 0) jtag>
Switch to the new bus.
jtag> print No. Manufacturer Part Stepping Instruction Register ------------------------------------------------------------------------------------------------------------------ 0 Freescale (Motorola) mpc5200 B BYPASS BR Active bus: *1: Freescale MPC5200 compatible bus driver via BSR (JTAG part No. 0) start: 0x00000000, length: 0x0C000000, data width: 16 bit, (LocalPlus Bus) jtag>
Search for the flash chip. The flash chip used by Phytec is a CFI type.
jtag> detectflash 0 Query identification string: Primary Algorithm Command Set and Control Interface ID Code: 0x0001 (Intel/Sharp Extended Command Set) Alternate Algorithm Command Set and Control Interface ID Code: 0x0000 (null) Query system interface information: Vcc Logic Supply Minimum Write/Erase or Write voltage: 2700 mV Vcc Logic Supply Maximum Write/Erase or Write voltage: 3600 mV Vpp [Programming] Supply Minimum Write/Erase voltage: 0 mV Vpp [Programming] Supply Maximum Write/Erase voltage: 0 mV Typical timeout per single byte/word program: 64 us Typical timeout for maximum-size multi-byte program: 128 us Typical timeout per individual block erase: 1024 ms Typical timeout for full chip erase: 0 ms Maximum timeout for byte/word program: 256 us Maximum timeout for multi-byte program: 1024 us Maximum timeout per individual block erase: 4096 ms Maximum timeout for chip erase: 0 ms Device geometry definition: Device Size: 16777216 B (16384 KiB, 16 MiB) Flash Device Interface Code description: 0x0002 (x8/x16) Maximum number of bytes in multi-byte program: 32 Number of Erase Block Regions within device: 1 Erase Block Region Information: Region 0: Erase Block Size: 131072 B (128 KiB) Number of Erase Blocks: 128 jtag>
It found our 16MB flash chip. Now before you mess your board up, make a copy of u-boot and save it. An x86 is a little endian machine, our PowerPC is big endian. Tell urjtag that the byte sex is opposite. Don't forget the endian command in each session. Without this the files you save and restore won't work.
jtag> endian big jtag>
The default flash partitions of the Phytec card look like this.
partition@0 {
label = "ubootl";
reg = <0x00000000 0x00040000>;
};
partition@40000 {
label = "kernel";
reg = <0x00040000 0x001c0000>;
};
partition@200000 {
label = "jffs2";
reg = <0x00200000 0x00D00000>;
};
partition@f00000 {
label = "uboot";
reg = <0x00f00000 0x00040000>;
};
partition@f40000 {
label = "oftree";
reg = <0x00f40000 0x00040000>;
};
partition@f80000 {
label = "space";
reg = <0x00f80000 0x00080000>;
};
You want to copy the second flash image and save it to a backup file. Flash looks like normal memory so use the readmem command. This takes a couple of minutes. JTAG is much slower than using a program to write the flash. JTAG arranges all of the pins on the mpc5200 chip as a big shift register. By shifting different values into the pins we can make it look like the CPU is running and manipulating the flash chip when it really is not. But this process is slow. You have to shift in 250 pin values to set ALE high, then another 250 pin values to set ALE low and so on. But the process does work and it lets you get an image into a blank flash chip. Use the eraseflash and flashmem commands to do this.
jtag> readmem 0x00f00000 0x00040000 /home/jonsmirl/saveme address: 0x00F00000 length: 0x00040000 reading: addr: 0x00F40000 Done. jtag>
The dr command shows you all those bits being shifted around.
jtag> dr 0010010010010100101011101010100011010100110011110100010100010100 0101010110110110011000100010100000000000010000001001000001001001 0000000000000010101000000011010000011110100011011101010011011011 0110110110110110110111010100110110111010100110110110110110110110 1101101101101100101101110100101010100101000101010101001000111011 0110110110110110010110101010100000100100100100100100100100010100 1001001000101111001001111110101110101111001111111001001001001001 0001010010010010010011101110001010010000110110001000100100111111 0001001001001001001001000001000000100100000001001000000000001001 001010010000001101101001001001001001100 jtag>
JTAG is also very useful for testing the board. The JTAG device lets you set and read the state of the signal pins on the device.
jtag> get signal LP_ALE_B LP_ALE_B = 0 jtag> set signal LP_ALE_B out 1 jtag> shift dr jtag> shift dr jtag> get signal LP_ALE_B LP_ALE_B = 1 jtag>
Tyler's going to post more about this later when he demo's his fancy new 34-channel logic analyzer.
Urjtag has a nice manual that describes all of these commands in much more detail.
- jonsmirl's blog
- Login to post comments