JTAG

[SSinyagin] I'm trying to get use of JTAG for U-Boot debugging and probably FPGA debugging in the future. This page is not yet finished, and the work is in progress.

Page under construction... Informations on this page are not guaranteed !!

Building a JTAG connector for apf27Dev board

First you need a decent JTAG connector. The description below produces a 20-pin male JTAG connectior with standard ARM pinout.

List of material and part numbers at Conrad:

• 2x20-pin header, 2.54mm pitch (Conrad: 741973)
• ATA/IDE cable (Conrad: 971742)
• 2x10-pin IDC low profile header, 2.54mm pitch (Conrad: 743534)
• 20-way flat cable, 1.27mm pitch (Conrad: 609463)

Assembling it all together:

1. Solder the 40-pin header onto the J19 connector on the apf27dev board
2. Cut off a ~10cm piece from the ATA cable with the 40pin plug at the end.
3. Cut off ~10cm from 20-way flat cable
4. Carefully attach the 20-pin header to the flat cable. The thing is easy to break and it requires some forcing. Better buy a spare piece in advance.
5. Use a knife and a cutting pad and dissect the cable endings, ~3cm long. Dissect the whole width of the 20-way cable and only pins 40 to 31 on the 40-way ATA cable.
6. Strip the cable endings
7. Solder the two cables together, as specified below:

ARM JTAG 20-pin cable	apf27dev J19 40-pin cable
1 - VREF (+2.8v)	J9 pin 2 OR J19 pin 39 with a 68 ohm resistor inline
2 - Vddh (+3.3v)	39
3 - nTRST	33
4, 6, 8, 10, 12, 14, 16, 18, 20 - Vss (ground)	31, 34, 40
5 - TDI	35
7 - TMS	36
9 - TCK	37
13 –TDO	38
15 – nRST	(optional) wired to apf27 R76 on cpu side: http://www.armadeus.com/_downloads/apf27/hardware/apf27_V1.2_top_assembly.pdf

JTAG Adapter

I'm using the Amontec JTAGkey adapter. It has a male 20-pin plug and a 20-way female-to-female cable which fits directly into the cable as described above. A cheaper solution would be to use the Amontec JTAGkey-Tiny and install a 20-pin female plug on on the connector cable for apf27dev.

Configuring OpenOCD

yet to be done. Basic tests show that cable works as expected, but board-specific settings need some more time to figure out.

telnet_port 4444
gdb_port 3333
# GDB can also flash my flash!
gdb_memory_map enable
gdb_flash_program enable


interface ft2232
ft2232_device_desc "Amontec JTAGkey"
ft2232_layout jtagkey
ft2232_vid_pid 0x0403 0xcff8
jtag_khz 6000


# The APF27 board has a IMX27 chip and one fpga spartan3 200k
#source [find board/apf27.cfg]
#source [find target/imx27.cfg]
reset_config trst_and_srst

set  _CHIPNAME imx27
set  _ENDIAN little

# The bs tap
set _BSTAPID 0x1b900f0f
jtag newtap $_CHIPNAME bs \
  -irlen 4 -ircapture 0x1 -irmask 0xf -expected-id $_BSTAPID

# The CPU tap
set _CPUTAPID 0x07926121
jtag newtap $_CHIPNAME cpu \
  -irlen 4 -ircapture 0x1 -irmask 0xf -expected-id $_CPUTAPID

set _TARGETNAME [format "%s.cpu" $_CHIPNAME]
target create $_TARGETNAME arm926ejs \
    -endian $_ENDIAN -chain-position $_TARGETNAME -variant arm926ejs

$_TARGETNAME configure \
  -work-area-virt 0xffff4c00 -work-area-phys 0xffff4c00 \
  -work-area-size  0x8000 -work-area-backup 1


arm7_9 dcc_downloads enable
#endof target/imx27.cfg

jtag newtap xc3s200a.fpga fpga \
	-irlen 6 \
	-irmask 0x3f \
	-ircapture 0x9 \
	-expected-id 0x2218093

$_TARGETNAME configure -event gdb-attach { reset init }
$_TARGETNAME configure -event reset-init { apf27_init }

proc apf27_init { } {
	# This setup puts RAM at 0xA0000000

	# reset the board correctly
	reset run
	reset halt

	mww 0x10000000 0x20040304
	mww 0x10020000 0x00000000
	mww 0x10000004 0xDFFBFCFB
	mww 0x10020004 0xFFFFFFFF

	sleep 100

	# ========================================
	#  Configure DDR on CSD0 -- initial reset
	# ========================================
	mww 0x10027818 0x0000080F 
	mww 0xD8001010 0x0000000C 

	# ========================================
	#  Configure DDR on CSD0 -- wait 5000 cycle 
	# ========================================
	mww 0x10027828 0x55555555 
	mww 0x10027830 0x55555555 
	mww 0x10027834 0x55555555 
	mww 0x10027838 0x00005005 
	mww 0x1002783C 0x15555555 

	mww 0xD8001004 0x00695728

	mww 0xD8001000 0x92100000 
	mww 0xA0000F00 0x0

	mww 0xD8001000 0xA2100000 
	mww 0xA0000F00 0x0
	mww 0xA0000F00 0x0
	mww 0xA0000F00 0x0
	mww 0xA0000F00 0x0

	mww 0xD8001000 0xA2100000 
	mww 0xA0000F00 0x0
	mww 0xA0000F00 0x0
	mww 0xA0000F00 0x0
	mww 0xA0000F00 0x0

	mww 0xD8001000 0xB2100000 
	mwb 0xA0000033 0xDA
	mwb 0xA1000000 0x00

	mww 0xD8001000 0x82126080 
}

Working with BDI2000

Here is a configuration file I use. It does not work yet but some settings are already right. More informations will be added later, as soon as it works.

; bdiGDB configuration for ARMadeus APF27 board
; ---------------------------------------------
; Jonathan ILIAS-PILLET
; These settings do not work yet
[INIT]
; to be done

[TARGET]
CPUTYPE     ARM926E             ; processor core
CLOCK       6                   ; JTAG clock 3 = 4 MHz, 6 = 200KHz (setting used for testing)
WAKEUP	    500	                ; millisecond to wait after a reset to let target start
SCANPRED    1 6                 ; JTAG chain starts with FGPA (spartan3), it has a 6 bits Instruction Register
;SCANSUCC    1 3                 ; i.MX27 JTAG Controller, not used but present in the JTAG chain (I'm not sure if it is needed)
TRST        OPENDRAIN           ; pullup provided by iMX27 (§7.4 JTAG Controller Pin List)
RESET	    HARD 200            ;
ENDIAN      LITTLE              ; memory model is little endian
;VECTOR      CATCH 0x1f          ; not used now
BREAKMODE   HARD	        ; hardware breakpoints
;BREAKMODE   SOFT 0xDFFFDFFF     ;SOFT or HARD, ARM / Thumb break code
BDIMODE     AGENT

[HOST]
DEBUGPORT   2001                ; TCP port to connect GDB to
;FORMAT      ELF                 ; format of image files
;LOAD        MANUAL              ; load code manually after reset
PROMPT      APF27> 

[FLASH]
; to be done

[REGS]
;FILE	$reg926e.def   ; disabled while testing

Open issues

• TRST does not stop the CPU
• FPGA chip is not visible when OpenOCD detcts the TAPs.

most probably pull-up resistors are needed.