AEROFLEX GAISLER GRMON Debug Monitor User’s Manual
GRMON is a general debug monitor for the LEON processor, and for SOC designs based on the GRLIB IP library. GRMON includes the following functions: read/write access to all system registers and memory, built-in disassembler and trace buffer management, downloading and execution of LEON applications, breakpoint and watchpoint management, remote connection to GNU debugger (GDB) and support for USB, JTAG, RS232, PCI, Ethernet and SpaceWire debug links.
Advertisement
Advertisement
GRMON
GRMON User’s Manual
Version 1.1.61
Dec 2013
AEROFLEX GAISLER AB
GRMON User’s Manual
- 2 -
AEROFLEX GAISLER AB
- 3 -
GRMON User’s Manual
Copyright 2004-2013 Aeroflex Gaisler AB.
Permission is granted to make and distribute verbatim copies of this manual provided the copyright notice and this permission notice are preserved on all copies.
Permission is granted to copy and distribute modified versions of this manual under the conditions for verbatim copying, provided also that the entire resulting derived work is distributed under the terms of a permission notice identical to this one.
Permission is granted to copy and distribute translations of this manual into another language, under the above conditions for modified versions.
AEROFLEX GAISLER AB
- 4 -
GRMON User’s Manual
Supported platforms and system requirements...............................................
GRMON Evaluation version ..........................................................................
GRMON command-line interface .................................................................. 16
Inserting breakpoints and watchpoints ........................................................... 19
Attaching to a target system without initialization ......................................... 23
Using EDAC protected memory..................................................................... 24
Executing GRMON commands in GDB ........................................................ 27
AEROFLEX GAISLER AB
- 5 -
GRMON User’s Manual
Xilinx Platform USB Cable (Linux and Windows)........................................ 34
FTDI FT2232 MPSSE-JTAG-emulation mode.............................................. 35
Direct USB debug interface (Linux and Windows) ....................................... 36
LEON2, LEON3 and LEON4 debug support unit (DSU) drivers.................. 41
On-chip logic analyser driver (LOGAN)........................................................ 44
AMBA wrapper for Xilinx System Monitor .................................................. 46
DDR memory controller (DDRSPA).............................................................. 47
DDR2 memory controller (DDR2SPA).......................................................... 47
C-master (I2CMST)..................................................................................... 48
GRCLKGATE clock gating unit .................................................................... 49
GRPCI master/target (PCI_MTF)................................................................... 49
AEROFLEX GAISLER AB
- 6 -
GRMON User’s Manual
On-chip PCI trace buffer driver (PCITRACE) ............................................... 51
SPI Memory Controller (SPIMCTRL) ........................................................... 52
SVGA Frame buffer (SVGACTRL)............................................................... 53
USB Host Controller (GRUSBHC) ................................................................ 53
AMBA AHB trace buffer driver (AHBTRACE)............................................ 54
10/100 Mbit/s Ethernet Controller (GRETH)................................................. 55
USB 2.0 Device Controller (GRUSBDC) ...................................................... 56
MIL-STD-1553B Interface (GR1553B) ......................................................... 57
LEON4 Statistics Unit (L4STAT) .................................................................. 59
I/O Memory Management Unit (GRIOMMU)............................................... 62
Memory Scrubber (MEMSCRUB)................................................................. 63
Multi-processor interrupt controller (IRQMP/IRQ(A)MP)............................ 64
AEROFLEX GAISLER AB
- 7 -
GRMON User’s Manual
Custom DSU communications module .......................................................... 71
APPENDIX A: GRMON Command description....................................................... 73
GRMON built-in commands ............................................................ 73
LEON2/3/4 DSU commands ............................................................ 74
FLASH programming commands .................................................... 75
Installing HASP Device Driver ........................................................ 76
Node-locked license file ................................................................... 76
APPENDIX E: USB-Blaster Driver setup for Linux................................................. 79
Driver Setup on Linux ...................................................................... 79
AEROFLEX GAISLER AB
- 8 -
GRMON User’s Manual
1 Introduction
1.1 Overview
GRMON is a general debug monitor for the LEON processor, and for SOC designs based on the GRLIB IP library. GRMON includes the following functions:
• Read/write access to all system registers and memory
• Built-in disassembler and trace buffer management
• Downloading and execution of LEON applications
• Breakpoint and watchpoint management
• Remote connection to GNU debugger (GDB)
• Support for USB, JTAG, RS232, PCI, Ethernet and SpaceWire debug links
1.2 Supported platforms and system requirements
GRMON is currently provided for four platforms: Linux-x86, Solaris-2.x, Windows (2K/XP) and Windows with cygwin.
1.3 Obtaining GRMON
The primary site for GRMON is http://www.gaisler.com/, where the latest version of GRMON can be ordered and evaluation versions downloaded.
1.4 Installation
GRMON can be installed anywhere on the host computer - for convenience the installation directory should be added to the search path. The commercial versions use a HASP license key on Intel hosts (linux/windows) and
1.5 GRMON Evaluation version
The evaluation version of GRMON can be downloaded from www.gaisler.com. The evaluation version may be used during a period of 21 days without purchasing a license. After this period, any commercial use of
GRMON is not permitted without a valid license. The following features are not available in the evaluation version:
• Support for LEON2, LEON2-FT, LEON3-FT, LEON4-FT
• Loadable modules
• Custom JTAG configuration files
• Error injection
AEROFLEX GAISLER AB
- 9 -
GRMON User’s Manual
1.6 GrmonRCP
GrmonRCP is a graphical user interface (GUI) for GRMON, based on the Eclipse Rich Client Platform. It provides a graphical interface to all GRMON functions. GrmonRCP is available as a separate package from http:/
/www.gaisler.com/. Below is a screenshot of GrmonRCP in action.
Read more in the online manual at: http://www.gaisler.com/doc/grmonrpc/html/toc.html
1.7 Problem reports
Please send problem reports or comments to [email protected].
AEROFLEX GAISLER AB
- 10 -
GRMON User’s Manual
2 Debugging concept
2.1 Overview
The GRMON debug monitor is intended to debug system-on-chip (SOC) designs based on the LEON processor. The monitor connects to a dedicated debug interface on the target hardware, through which it can perform read and write cycles on the on-chip bus (AHB). The debug interface can be of various types: the LEON2 processor supports debugging over a serial UART and 32-bit PCI, while LEON3 also supports JTAG, ethernet and spacewire (using the GRESB ethernet to spacewire bridge) debug interfaces. On the target system, all debug interfaces are realized as AHB masters with the debug protocol implemented in hardware. There is thus no software support necessary to debug a LEON system, and a target system does in fact not even need to have a processor present.
Command layer
IP Debug drivers
Debug interface drivers
Terminal GDB (port 2222)
USB
GRMON
Basic commands GDB protocol
Serial I/F
GRLIB Debug Drivers
PCI JTAG Ethernet GRESB
Debug interfaces
GRESB
LEON SOC
TARGET SYSTEM
USB debug link
Serial debug link
PCI debug link
JTAG debug link
Ethernet debug link
SpW
RMAP link
AHB
LEON
Processor
Memory
Controller
APB
Bridge
Custom
IP core
GRMON can operate in two modes: command-line mode and GDB mode. In command-line mode, GRMON commands are entered manually through a terminal window. In GDB mode, GRMON acts as a GDB gateway and translates the GDB extended-remote protocol to debug commands on the target system.
GRMON is implemented using three functional layers: command layer, debug driver layer, and debug interface layer. The command layer consist of a general command parser which implements commands that are indepen-
AEROFLEX GAISLER AB
- 11 -
GRMON User’s Manual dent of the used debug interface or target system. These commands include program downloading and flash programming.
The debug driver layer implements custom commands which are related to the configuration of the target system. GRMON scans the target system at startup, and detects which IP cores are present and how they are configured. For each supported IP core, a debug driver is enabled which implements additional debug commands for the specific core. Such commands can consist of memory detection routines for memory controllers, or program debug commands for the LEON processors.
The debug interface layer implements the debug link protocol for each supported debug interface. Which interface to use for a debug session is specified through commandline options during the start of GRMON. Only interfaces based on JTAG supports 8-/16-bit accesses, all other interfaces access subwords using read-modify-
write. 32-bit accesses are supported by all interfaces. See more information in section 4.1.
2.2 Target initialization
When GRMON first connects to the target system, it scans the system to detect which IP cores are present.
This is done by reading the plug&play information which is normally located at address 0xfffff000 on the AHB bus. A debug driver for each recognized IP core is then initialized, and performs a core-specific initialization sequence if required. For a memory controller, the initialization sequence would typically consist of a memory probe operation to detect the amount of attached RAM. For a UART, it could consist of initializing the baud rate generator and flushing the FIFOs. After the initialization is complete, the system configuration is printed:
GRMON LEON debug monitor v1.1
Copyright (C) 2004,2005 Gaisler Research - all rights reserved.
For latest updates, go to http://www.gaisler.com/
Comments or bug-reports to [email protected]
using port /dev/ttyS0 @ 115200 baud
initialising ..............
detected frequency: 40 MHz
Component Vendor
Leon3 SPARC V8 Processor Gaisler Research
AHB Debug UART Gaisler Research
AHB Debug JTAG TAP Gaisler Research
Simple 32-bit PCI Target Gaisler Research
AHB interface for 10/100 Mbit MA Gaisler Research
LEON2 Memory Controller European Space Agency
AHB/APB Bridge Gaisler Research
Leon3 Debug Support Unit Gaisler Research
AHB interface for 10/100 Mbit MA Gaisler Research
Generic APB UART Gaisler Research
Multi-processor Interrupt Ctrl Gaisler Research
Modular Timer Unit Gaisler Research
Generic APB UART Gaisler Research
Use command ’info sys’ to print a detailed report of attached cores grmon>
AEROFLEX GAISLER AB
- 12 -
GRMON User’s Manual
More detailed system information can be printed using the ‘info sys’ command: grmon> inf sys
00.01:003 Gaisler Research Leon3 SPARC V8 Processor (ver 0)
ahb master 0
02.01:007 Gaisler Research AHB Debug UART (ver 0)
ahb master 2
apb: 80000700 - 80000800
baud rate 115200, ahb frequency 40.00
03.01:01c Gaisler Research AHB Debug JTAG TAP (ver 0)
ahb master 3
04.01:012 Gaisler Research Simple 32-bit PCI Target (ver 0)
ahb master 4
05.01:005 Gaisler Research AHB interface for 10/100 Mbit MA (ver 0)
ahb master 5
00.04:00f European Space Agency LEON2 Memory Controller (ver 0)
ahb: 00000000 - 20000000
ahb: 20000000 - 40000000
ahb: 40000000 - 80000000
apb: 80000000 - 80000100
32-bit prom @ 0x00000000
64-bit sdram: 2 * 128 Mbyte @ 0x40000000, col 9, cas 2, ref 15.6 us
01.01:006 Gaisler Research AHB/APB Bridge (ver 0)
ahb: 80000000 - 80100000
02.01:004 Gaisler Research Leon3 Debug Support Unit (ver 0)
ahb: 90000000 - a0000000
AHB trace 128 lines, stack pointer 0x4ffffff0
CPU#0 win 8, hwbp 2, itrace 128, V8 mul/div, srmmu, lddel 1
icache 2 * 16 kbyte, 32 byte/line lrr
dcache 2 * 16 kbyte, 32 byte/line lrr
05.01:005 Gaisler Research AHB interface for 10/100 Mbit MA (ver 0)
irq 12
ahb: fffb0000 - fffb1000
01.01:00c Gaisler Research Generic APB UART (ver 1)
irq 2
apb: 80000100 - 80000200
baud rate 38400
02.01:00d Gaisler Research Multi-processor Interrupt Ctrl (ver 3)
apb: 80000200 - 80000300
03.01:011 Gaisler Research Modular Timer Unit (ver 0)
irq 8
apb: 80000300 - 80000400
8-bit scaler, 2 * 32-bit timers, divisor 40
09.01:00c Gaisler Research Generic APB UART (ver 1)
irq 3
apb: 80000900 - 80000a00
baud rate 38400
The detailed system view also provides information about address mapping, interrupt allocation and IP core configuration.
AEROFLEX GAISLER AB
- 13 -
GRMON User’s Manual
2.3 LEON2 target systems
The plug&play information was introduced in the LEON3 processor (GRLIB), and is not available in LEON2.
If GRMON is not able to detect the plug&play area, it will switch to a LEON2 legacy mode. LEON2 mode can also be forced by starting GRMON with the -leon2 switch. A LEON2 system has a fixed set of IP cores and address mapping, and GRMON will use an internal plug&play table that describes this configuration:
GRMON LEON debug monitor v1.1
using port /dev/ttyUSB1 @ 115200 baud
GRLIB plug&play not found, switching to LEON2 legacy mode
initialising .........
detected frequency: 40 MHz
Component Vendor
LEON2 Memory Controller European Space Agency
LEON2 SPARC V8 processor European Space Agency
LEON2 Configuration register European Space Agency
LEON2 Timer Unit European Space Agency
LEON2 UART European Space Agency
LEON2 UART European Space Agency
LEON2 Interrupt Ctrl European Space Agency
AHB Debug UART Gaisler Research
LEON2 Debug Support Unit Gaisler Research
Use command ’info sys’ to print a detailed report of attached cores grmon[grlib]> inf sys
00.04:00f European Space Agency LEON2 Memory Controller (ver 0)
ahb: 00000000 - 20000000
ahb: 20000000 - 40000000
ahb: 40000000 - 80000000
apb: 80000000 - 80000010
8-bit prom @ 0x00000000
32-bit sdram: 1 * 64 Mbyte @ 0x40000000, col 9, cas 2, ref 15.6 us
01.04:002 European Space Agency LEON2 SPARC V8 processor (ver 0)
apb: 80000014 - 80000018
02.04:008 European Space Agency LEON2 Configuration register (ver 0)
apb: 80000024 - 80000028
val: 6877bf00
03.04:006 European Space Agency LEON2 Timer Unit (ver 0)
apb: 80000040 - 80000070
04.04:007 European Space Agency LEON2 UART (ver 0)
apb: 80000070 - 80000080
baud rate 38400
05.04:007 European Space Agency LEON2 UART (ver 0)
apb: 80000080 - 80000090
baud rate 38400
06.04:005 European Space Agency LEON2 Interrupt Ctrl (ver 0)
apb: 80000090 - 800000a0
07.01:007 Gaisler Research AHB Debug UART (ver 0)
apb: 800000c0 - 800000d0
baud rate 115200, ahb frequency 40.00
08.01:002 Gaisler Research LEON2 Debug Support Unit (ver 0)
ahb: 90000000 - a0000000
trace buffer 512 lines, stack pointer 0x43fffff0
CPU#0 win 8, hwbp 2, V8 mul/div, lddel 1
icache 1 * 8 kbyte, 32 byte/line
dcache 1 * 8 kbyte, 32 byte/line grmon[grlib]>
AEROFLEX GAISLER AB
- 14 -
GRMON User’s Manual
The plug&play table used for LEON2 is fixed, and no automatic detection of present cores is attempted. Only those cores that need to be initialized by GRMON are included in the table, so the listing might not correspond to the actual target. It is however possible to load a custom configuration file that describes the target system configuration using the -cfg startup option:
./grmon -cfg leon2.cfg
GRMON LEON debug monitor v1.1
using port /dev/ttyS0 @ 115200 baud
reading configuration from leon2.cfg
initialising ......
detected frequency: 40 MHz
Component Vendor
AHB Debug UART Gaisler Research
Generic APB UART Gaisler Research
LEON2 Interrupt Ctrl European Space Agency
LEON2 Timer Unit European Space Agency
LEON2 Memory Controller European Space Agency
LEON2 Debug Support Unit Gaisler Research
Use command ’info sys’ to print a detailed report of attached cores grmon[grlib]> inf sys
00.01:007 Gaisler Research AHB Debug UART (ver 0)
apb: 800000c0 - 800000d0
baud rate 115200, ahb frequency 40.00
01.01:00c Gaisler Research Generic APB UART (ver 0)
apb: 80000070 - 80000080
baud rate 38400
02.04:005 European Space Agency LEON2 Interrupt Ctrl (ver 0)
apb: 80000090 - 800000a0
03.04:006 European Space Agency LEON2 Timer Unit (ver 0)
apb: 80000040 - 80000070
04.04:00f European Space Agency LEON2 Memory Controller (ver 0)
ahb: 00000000 - 20000000
ahb: 20000000 - 40000000
ahb: 40000000 - 80000000
apb: 80000000 - 80000010
8-bit prom @ 0x00000000
32-bit sdram: 1 * 64 Mbyte @ 0x40000000, col 9, cas 2, ref 15.6 us
05.01:002 Gaisler Research LEON2 Debug Support Unit (ver 0)
ahb: 90000000 - a0000000
trace buffer 512 lines, stack pointer 0x43fffff0
CPU#0 win 1, lddel 1
icache 4 * 1 kbyte, 4 byte/line lru
dcache 4 * 1 kbyte, 4 byte/line lru grmon[grlib]>
LEON3 and LEON2 systems. An example configuration file is also supplied with the GRMON-PRO distribution in src/cfg/leon2.cfg .
AEROFLEX GAISLER AB
- 15 -
GRMON User’s Manual
3 Operation
3.1 General
A GRMON debug session typically consists of the following steps:
• Attaching to the target system and examining the configuration
• Uploading application program and executing using GRMON commands
• Attaching to GDB and debugging through the GDB protocol
The following sections will describe how the various steps are performed.
3.2 Starting GRMON
GRMON is started by giving the GRMON command in a terminal window. Without options, GRMON will try to connect to the target using the serial debug link. UART1 of the host (ttyS0 or COM1) will be used, with a default baud rate of 115200 baud. On windows hosts, GRMON can be started in a command window (command.com) or in a cygwin shell. Below is the syntax and the accepted command line options:
grmon [options]
Options:
-abaud baudrate
Set application baudrate for UART 1 & 2. By default, 38400 baud is used.
-altcable nr Choose which Altera cable to connect to if multiple cables are connected. Connect without
-altcable to see the cable numbers.
-altjtag Connect to the JTAG Debug Link using Altera USB Blaster or Byte Blaster.
-baud brate Use brate for the DSU serial link. By default, 115200 baud is used. Possible baud rates are
9600, 19200, 38400, 57600, 115200, 230400, 460800. Rates above 115200 need special uart hardware on both host and target.
-c batch_file Run the commands in the batch file at start-up.
-dsudelay val Delay the DSU polling val ms. Normally GRMON will poll the DSU as fast as possible.
-edac
-eth
Enable EDAC operation in memory controllers that support it.
Connect using ethernet. Requires the EDCL core to be present in the target system.
-freq sysclk Overrides the detected system frequency. The frequency is specified in MHz.
-gdb Listen for GDB connection directly at start-up.
-gresb Connect through the GRESB bridge. The target needs SpW core with RMAP.
-ioarea addr Specify the location of the I/O area. (Default is 0xFFF00000)
-jtag Connect to the JTAG Debug Link using Xilinx Parallel Cable III or IV.
-jtagcfg file Read custom JTAG Configuration file.
-jtagdevice nr Choose which JTAG device to debug.
-leon2 Force LEON2 legacy mode.
-at697
-log file
Force AT697 mode. Same at -leon2 but with supports for AT697 PCI core.
Log session to the specified file. If the file already exists the new session is appended.
This should be used when requesting support.
AEROFLEX GAISLER AB
- 16 -
GRMON User’s Manual
-nb
-nswb
Don’t break on error traps.
Don’t break on software breakpoints.
-ni Attach to running program without target initialisation.
-nothreads Disable thread support.
-nobridge Disable plug&play scanning over bridges (AHB2AHB, L2 cache).
-pci vid:did[:i]Connect to target using PCI. The board is identified by vendor id, device id and optionally instance number.
-port gdbport Set the port number for GDB communications. Default is 2222.
-rtems ver Override autodetected RTEMS version for thread support. ver should be 46, 48, 48-edisoft or 410.
-stack val Set val as stack pointer for applications, overriding the auto-detected value.
-u [device] Put UART 1 in FIFO debug mode if hardware supports it, else put it in loop-back mode.
Debug mode will enable both reading and writing to the UART from the monitor console.
put in debug mode. The device parameter is an index starting with 0 for the first UART and then increasing with one in the order they are found in the busscan. If the device parameter is not used the first UART is selected.
-uart device By default, GRMON communicates with the target using the first uart port of the host. This can be overridden by specifying an alternative device. Device names depend on the host operating system.
-ucmd file Load a user command module.
-usb Connect to target using USB (GRUSB IP core).
-wildcard
-xilusb
Connect to a WildCard PC Card via CardBus (Windows only).
Connect to the JTAG Debug Link using Xilinx Platform USB cable.
In addition, the debug drivers can also accept command line options.
3.3 GRMON command-line interface
GRMON dynamically loads libreadline.so if available on your host system, and uses readline() to enter and edit monitor commands. Short forms of the commands are allowed, e.g c, co, or con, are all interpreted as cont.
Tab completion is available for commands, text-symbols and filenames. If libreadline.so is not found, fgets() is used instead (no history, poor editing capabilities and no tab-completion). Below is a description of some of the more common commands that are available regardless of loaded debug drivers. For the full list of com-
batch file_name
disas <addr> [length] execute a batch file of GRMON commands disassemble memory
dump <addr> <addr> [file] dump target memory to file in srecord format echo echo string in monitor window
eeload <file> [delay] [addr] Load PROM file using the delay in milliseconds between each word.
Suitable for loading PROM files to 32 or 39 bit wide E
2
PROM. addr indicates an optional load address for binary files.
AEROFLEX GAISLER AB
- 17 -
GRMON User’s Manual help show available commands or usage for specific command info [drivers | libs | reg | sys] show available debug drivers, system registers or system configuration
load<file_name>
log <file_name> load a file into target memory (elf32 or srecord).
Open a logfile and output some system information to it then continue to log the current session to it. This command or the -log start-up option should be used when requesting support. If the start-up option -log is given then file_name can be omitted.
mem[addr] [length] symbols quit
wmem <addr> <data> display memory show symbols or load symbols from file exit GRMON write aword to memory
wmemh <addr> <data>
wmemb <addr> <data> write a halfword to memory
1 wrrite a byte to memory
Below is a list of some of commands provided by the LEON debug support unit (DSU) debug driver. These commands are available when a LEON processor and associated debug support unit is present in the target sys-
tem. See appendix A.2 for a full list of DSU commands.
break <addr> print or add breakpoint
bwatch <addr> [delay] [break] add bus watchpoint cont dcache continue execution show data cache
delete <bpnum> detach float
gdb [port] delete breakpoint(s) resume execution with grmon detached from processor display FPU registers connect to GDB debugger
go [addr] hbreak icache
profile [0 | 1] start execution without initialization print breakpoints or add hardware breakpoint (if available) show instruction cache enable/disable/show simple profiling register
run [addr] show/set integer registers reset and start execution at last entry point, or at addr tmode [none|ahb|cpu|both] enable instruction and AHB trace buffers
stack [val] show/set the stack pointer
step [n] wash
watch [addr] single step one or [n] times clear all SRAM/SDRAM memory print or add data watchpoint
1. Only supported by JTAG debug link. All other debug links will do a read-modify-write.
AEROFLEX GAISLER AB
- 18 -
GRMON User’s Manual
3.4 Common debug operations
3.4.1 Loading of files to target memory
A LEON software application can be uploaded to the target system memory using the load command: grmon> load stanford_leon section: .text at 0x40000000, size 54368 bytes section: .data at 0x4000d460, size 2064 bytes section: .jcr at 0x40024e68, size 4 bytes total size: 56436 bytes (90.9 kbit/s) read 196 symbols entry point: 0x40000000
The supported file format is elf32-sparc and srecord. Each section is loaded to its link address. The program entry point of the file is use to set the %pc when the application is later started with run. It is also possible to verify that the file has been loaded correctly using the verify command: grmon> veri stanford_leon section: .text at 0x40000000, size 54368 bytes section: .data at 0x4000d460, size 2064 bytes section: .jcr at 0x40024e68, size 4 bytes total size: 56436 bytes (64.9 kbit/s) entry point: 0x40000000
Any discrepancies will be reported in the GRMON console.
3.4.2 Running applications
To run a program, first use the load command to download the application and the run to start it. The program should have been compiled with either the BCC, RCC or sparc-linux tool-chain.
grmon> lo stanford_leon section: .text at 0x40000000, size 54368 bytes section: .data at 0x4000d460, size 2064 bytes section: .jcr at 0x40024e68, size 4 bytes total size: 56436 bytes (90.8 kbit/s) read 196 symbols entry point: 0x40000000 grmon> run
Starting
Perm Towers Queens Intmm Mm Puzzle Quick Bubble Tree FFT
34 67 33 117 1117 367 50 50 250 1133
Nonfloating point composite is 144
Floating point composite is 973
Program exited normally.
grmon>
The output from the application normally appears on the LEON UARTs and thus not in the GRMON console.
However, if GRMON is started with the -u switch, the UART output is looped back to its own receiver and printed on the console by GRMON. The application must be reloaded before it can be executed again, in order to restore the .data segment. If the application uses the LEON MMU (e.g. linux-2.6) or installs data exception handlers (e.g. eCos), the GRMON should be started with -nb to avoid going into break mode on a page-fault or data exception. Note that the -u option does not work for snapgear linux applications. Instead, a terminal emulator should be connected to UART 1 of the target system. When running a debugger on the target the "ta 0x01"
AEROFLEX GAISLER AB
- 19 -
GRMON User’s Manual instruction will be used to set a breakpoint. To prevent GRMON from interpreting it as it’s own breakpoints and stop use the -nswb switch.
3.4.3 Inserting breakpoints and watchpoints
Instruction breakpoints are inserted using the break or hbreak commands. The break command inserts a software breakpoint (ta 1), while hbreak will insert a hardware breakpoint using one of the IU watchpoint registers. To debug code in read-only memories, only hardware breakpoints can be used. Note that it is possible to debug any RAM-based code using software breakpoints, even where traps are disabled such as in trap handlers.
Data write watchpoints are inserted using the watch command. A watchpoint can only cover one word address, block watchpoints are not supported by GRMON.
The bwatch command inserts bus watchpoints that will freeze the trace buffer when hit. The processor can optionally be put in debug mode whan the bus watchpoint is hit. This is controlled using the tmode command:
tmode ahbbre n
If n = 0, the processor will not be halted when the watchpoint is hit. A value > 0 will break the processor and set the AHB trace buffer delay counter to the same value.
3.4.4 Displaying processor registers
The current register window of a LEON processor can be displayed using the reg command: grmon> reg
INS LOCALS OUTS GLOBALS
0: 00000008 0000000C 00000008 00000000
1: 80000070 00000020 80000070 00000008
2: 0000000D 43FFFDF0 0000000D 43FFF6F8
3: FFFFFFFF 00000003 FFFFFFFF 4000D010
4: 43FFF7B8 00000001 43FFF7B8 00000001
5: 4000D008 00000004 4000D008 00000000
6: 43FFF618 00000000 43FFF618 00000000
7: 00000001 00000010 00000001 4000633C
psr: F20000E2 wim: 00000080 tbr: 40000060 y: 00000000
pc: 40003e44 be 0x40003fb8
npc: 40003e48 mov %i1, %i3
Other register windows can be displayed using reg wn, when n denotes the window number. Use the float command to show the FPU registers (if present).
3.4.5 Displaying memory contents
Any memory location can be displayed using the mem (or x) command. The command requires an address and an optional length. If a length argument is provided, that is interpreted as the number of bytes to display. If a program has been loaded, text symbols can be used instead of a numeric address. The memory content is displayed hexa-decimal format, grouped in 32-bit words. The ASCII equivalent is printed at the end of the line.
grmon> mem 0x40000000
40000000 a0100000 29100004 81c52000 01000000 ...)....Å .....
40000010 91d02000 01000000 01000000 01000000 . .............
40000020 91d02000 01000000 01000000 01000000 . .............
40000030 91d02000 01000000 01000000 01000000 . .............
AEROFLEX GAISLER AB
- 20 -
GRMON User’s Manual grmon> mem 0x40000000 16
40000000 a0100000 29100004 81c52000 01000000 ...)....Å .....
grmon> mem main 48
40003278 9de3bf98 2f100085 31100037 90100000 .ã¿./...1..7....
40003288 d02620c0 d025e178 11100033 40000b4b & À%á[email protected]
40003298 901223b0 11100033 40000af4 901223c0 ..#Ëš...3@..ô..#À
If the memory contents is SPARC machine code, the contents can be displayed in assembly code using the
disas command: grmon> dis 0x40000000 10
40000000 a0100000 clr %l0
40000004 29100004 sethi %hi(0x40001000), %l4
40000008 81c52000 jmp %l4
4000000c 01000000 nop
40000010 91d02000 ta 0x0
40000014 01000000 nop
40000018 01000000 nop
4000001c 01000000 nop
40000020 91d02000 ta 0x0
40000024 01000000 nop grmon> dis main
40003278 9de3bf98 save %sp, -104, %sp
4000327c 2f100085 sethi %hi(0x40021400), %l7
40003280 31100037 sethi %hi(0x4000dc00), %i0
40003284 90100000 clr %o0
40003288 d02620c0 st %o0, [%i0 + 0xc0]
4000328c d025e178 st %o0, [%l7 + 0x178]
40003290 11100033 sethi %hi(0x4000cc00), %o0
40003294 40000b4b call 0x40005fc0
40003298 901223b0 or %o0, 0x3b0, %o0
4000329c 11100033 sethi %hi(0x4000cc00), %o0
400032a0 40000af4 call 0x40005e70
400032a4 901223c0 or %o0, 0x3c0, %o0
3.4.6 Using the trace buffer
The LEON processor and associated debug support unit (DSU) can be configured with trace buffers to store both the latest executed instructions and the latest AHB bus transfers. The trace buffers are automatically enabled by GRMON during startup, but can also be individually enabled and disabled using tmode command.
The commands ahb, inst and hist are used to display the contents of the buffers. Below is an example debug session that shows the usage of breakpoints, watchpoints and the trace buffer: grmon> load samples/stanford section: .text at 0x40000000, size 41168 bytes section: .data at 0x4000a0d0, size 1904 bytes total size: 43072 bytes (94.2 kbit/s) read 158 symbols grmon> tm both combined processor/AHB tracing grmon> break Fft grmon> watch 0x4000a500 grmon> bre
AEROFLEX GAISLER AB
- 21 -
GRMON User’s Manual num address type
1 : 0x40003608 (soft)
2 : 0x4000a500 (watch) grmon> run watchpoint 2 free + 0x1c8 (0x400042d0) grmon> ahh
time address type data trans size burst mst lock resp tt pil irl
239371467 400042d8 read 38800002 3 2 1 0 0 0 06 0 0
239371469 400042dc read d222a100 3 2 1 0 0 0 06 0 0
239371472 4000a4fc read 00000000 2 2 0 0 0 0 06 0 0
239371480 4000a4fc write 000005d0 2 2 0 0 0 0 06 0 0
239371481 90000000 read 000055f9 2 2 0 3 0 0 06 0 0 grmon> inst
time address instruction result
239371473 400042bc ld [%o2 + 0xfc], %o0 [00000000]
239371475 400042c0 cmp %o1, %o0 [000005d0]
239371476 400042c4 bgu,a 0x400042cc [00000000]
239371478 400042c8 st %o1, [%o2 + 0xfc] [4000a4fc 000005d0]
239371479 400042cc sethi %hi(0x4000a400), %o2 [4000a400] grmon> del 2 grmon> break num address type
1 : 0x40003608 (soft) grmon> cont breakpoint 1 Fft (0x40003608) grmon> hist
254992755 40003870 sethi %hi(0x4001f800), %l0 [4001f800]
254992759 ahb read, mst=0, size=2 [40003880 94146198]
254992760 40003874 mov 19, %i0 [00000013]
254992761 ahb read, mst=0, size=2 [40003884 961423cc]
254992762 40003878 mov 256, %o0 [00000100]
254992763 ahb read, mst=0, size=2 [40003888 190fec00]
254992764 4000387c or %l2, 0x28c, %o1 [40014e8c]
254992765 ahb read, mst=0, size=2 [4000388c 7fffff5f]
254992766 40003880 or %l1, 0x198, %o2 [40014598]
254992767 ahb read, mst=0, size=2 [40003890 9a102000]
254992769 ahb read, mst=0, size=2 [40003894 b0863fff]
254992771 40003884 or %l0, 0x3cc, %o3 [4001fbcc]
254992772 40003888 sethi %hi(0x3fb00000), %o4 [3fb00000]
254992773 4000388c call 0x40003608 [4000388c]
254992774 40003890 mov 0, %o5 [00000000]
When printing executed instructions, the value within brackets denotes the instruction result, or in the case of store instructions the store address and store data. The value in the first column displays the relative time, equal to the DSU timer. The time is taken when the instruction completes in the last pipeline stage (write-back) of the processor. In a mixed instruction/AHB display, AHB address and read or write value appear within brackets.
The time indicates when the transfer completed, i.e. when HREADY was asserted. Note: when switching between tracing modes the contents of the trace buffer will not be valid until execution has been resumed and the buffer refilled.
3.4.7 Profiling
GRMON supports profiling of LEON applications when run on real hardware. The profiling function collects
(statistical) information on the amount of execution time spend in each function. Due to its non-intrusive nature, the profiling data does not take into consideration if the current function is called from within another procedure. Even so, it still provides useful information and can be used for application tuning.
AEROFLEX GAISLER AB
- 22 -
GRMON User’s Manual grmon> profile 1
Profiling enabled grmon> run resuming at 0x40000000
Starting
Perm Towers Queens Intmm Mm Puzzle Quick Bubble Tree FFT
50 33 17 116 1100 217 33 34 266 934
Nonfloating point composite is 126
Floating point composite is 862
Program exited normally.
grmon> prof function samples ratio(%)
__unpack_f 23627 16.92
__mulsf3 22673 16.24
__pack_f 17051 12.21
__divdi3 14162 10.14
.umul 8912 6.38
Fit 7594 5.44
__muldi3 6453 4.62
_window_overflow 3779 2.70
Insert 3392 2.42
__addsf3 3327 2.38
_window_underflow 2734 1.95
__subsf3 2409 1.72
Fft 2207 1.58
start 2165 1.55
Innerproduct 2014 1.44
Bubble 1767 1.26
rInnerproduct 1443 1.03
Place 1371 0.98
Remove 1335 0.95
Try 1275 0.91
Permute 1125 0.80
NOTE: profiling is not supported in systems based on the first-generation LEON2-FT processors, such as
LEON2FT-UMC and AT697E.
3.4.8 Forwarding application console I/O
If GRMON is started with -u, the LEON UART1 will be placed in FIFO debug mode if supported by the hardware. If not loop-back mode will be used instead. In both modes flow-control will be enabled.
Debug mode was added in GRLIB 1.0.17-b2710, and will be reported by info sys in GRMON as DSU mode
(FIFO debug) .
Both in loop-back mode and in FIFO debug mode the UART will be polled regularly during execution of an application and all console output will be printed on the GRMON console. It is then not necessary to connect a separate terminal to UART1 to see the application output.
With FIFO debug mode it will also be possible to enter text in GRMON which will be inserted into the UART receive FIFO. These insertions will trigger interrupts if receiver FIFO interrupts are enabled. This makes it possible to use GRMON as a terminal when running an O/S such as Linux.
AEROFLEX GAISLER AB
- 23 -
GRMON User’s Manual
The following restrictions must be met by the application to support either loop-back mode or FIFO debug mode:
• The UART control register must not be modified such that neither loop-back nor FIFO debug mode is disabled
• In loop-back mode the UART data register must not be read
This means that -u cannot be used with PROM images created by MKPROM. Also loop-back mode can not be used in kernels using interrupt driven UART consoles (e.g. linux).
Note: RXVT must be disabled for debug mode to work in a MSYS console on Windows. This can be done by deleting or renaming the file rxvt.exe inside the bin directory, e.g., C:\msys\1.0\bin. Starting with MSYS-
1.0.11 this will be the default.
3.4.8.1 UART debug mode
When the application is running with UART debug mode enabled the following key sequences will be available.
Ctrl+A B - Toggle delete to backspace conversion
Ctrl+A C - Send break (Ctrl+C) to the running application
Ctrl+A D - Toggle backspace to delete conversion
Ctrl+A E - Toggle local echo on/off
Ctrl+A H - Show a help message
Ctrl+A N - Enable/disable newline insertion on carriage return
Ctrl+A S - Show current settings
Theese can be used to adjust the input to what the target system expects.
3.4.9 Attaching to a target system without initialization
When GRMON connects to a target system, it probes the configuration and initializes memory and registers.
To determine why a target has crashed, or resume debugging without reloading the application, it might be desirable to connect to the target without performing a (destructive) initialization. This can be done by specifying the -ni switch during the start-up of GRMON. The system information print-out (info sys) will then however not be able to display the correct memory settings. The use of the -stack option is also necessary in case the application is later restarted.
3.4.10 Multi-processor support
In systems with more than one LEON3 processors, the cpu command can be used to control the state and debugging focus of the processors. In MP systems, the processors are enumerated with 0 - n-1, where n is the number of processors. Each processor can be in two states; enabled or disabled. When enabled, the processor will be started when any of the run, cont or go commands are given. When disabled, the processor will remain halted regardless of which command that are given. In addition, one of the enabled processor will also be
active. All debugging commands such as displaying registers or adding break points will be directed to the active processor only. Switching of active processor can be done using the ‘cpu act n’ command
At start-up, processor 0 is enabled and active while remaining processors are disabled. This allows non-MP software to execute on MP systems. Additional processors can be enabled using the ‘cpu enable n’ command:
AEROFLEX GAISLER AB
- 24 -
GRMON User’s Manual grmon[grlib]> cpu
cpu 0: enabled active
cpu 1: disabled grmon[grlib]> cpu en 1
cpu 0: enabled active
cpu 1: enabled grmon[grlib]> cpu act 1
cpu 0: enabled
cpu 1: enabled active
If GRMON is started with the -mp switch, all processors will be enabled by default.
Breakpoints are maintained on processor basis. When executing, only the breakpoints of the active processor are enabled, the breakpoints of the other processors are not enabled or inserted into the main memory.
It is possible to debug MP systems using GDB. When GDB is attached, it is the currently active processor that will receive the GDB commands. Switching of processor can only be done by detaching GDB, selecting a different processor to become active, and the re-attaching GDB. Note that GDB remembers the breakpoints between detach and re-attachment.
3.4.11 Using EDAC protected memory
Some versions of LEON2FT or LEON3FT might use EDAC protected memory. To enable the memory EDAC during execution, start GRMON with the -edac switch. Before any application is loaded, issue the wash command to write all RAM memory locations and thereby initialize the EDAC checksums.
$ grmon -ramws 1 -edac grlib> wash clearing 191 kbyte SRAM: 40000000 - 4002fffc clearing 1024 kbyte SDRAM: 60000000 - 60100000 grlib>
By default wash writes to the whole memory area which has been detected or forced with a command line switch. A parameter can also be given which sets the amount of memory in bytes to be washed for SRAM
(SDRAM always uses the detected size of the memory).
$ grmon -ramws 1 -edac grlib> wash 65536 clearing 64 kbyte SRAM: 40000000 - 40010000 clearing 1024 kbyte SDRAM: 60000000 - 60100000 grlib>
If the memory controller has support for EDAC with 8-bit wide SRAM memory, the upper part of the memory will consist of checkbits. In this case the wash will only write to the data area (the checkbits will automatically be written by the memory controller). The amount of memory written will be displayed in GRMON.
GRMON will not automatically write the checkbits for flash PROMs. For 8-bit flash PROMs, the checkbits can be generated by the mkprom2 utility and included in the image. But for 32-bit flash PROMs the checkbits must be written by the user via the TCB field in MCFG3.
3.5 Symbolic debug information
3.5.1 Symbol table
GRMON will automatically extract the symbol information from elf-files. The symbols can be used where an address is expected:
AEROFLEX GAISLER AB
- 25 -
GRMON User’s Manual grmon> break main grmon> run breakpoint 1 main (0x40001ac8) grmon> disas strlen 3
40001e4c 808a2003 andcc %o0, 0x3, %g0
40001e50 12800016 bne 0x40001ea8
40001e54 96100008 mov %o0, %o3
The symbols command can be used to display all symbols, or to read in symbols from an alternate (elf) file: grmon[dsu]> symbols samples/hello read 71 symbols grmon[dsu]> symbols
0x40000000 L _trap_table
0x40000000 L start
0x4000102c L _window_overflow
0x40001084 L _window_underflow
0x400010dc L _fpdis
0x400011a4 T _flush_windows
0x400011a4 T _start
0x40001218 L fstat
Reading symbols from alternate files is necessary when debugging self-extracting applications, such as bootproms created with mkprom or linux/uClinux.
AEROFLEX GAISLER AB
- 26 -
GRMON User’s Manual
3.6 GDB interface
3.6.1 Attaching to GDB
GRMON can act as a remote target for GDB, allowing symbolic debugging of target applications. To initiate
GDB communications, start the monitor with the -gdb switch or use the GRMON gdb command:
$ grmon -gdb
using port /dev/ttyS0 @ 115200 baud gdb interface: using port 2222
Then, start GDB in a different window and connect to GRMON using the extended-remote protocol. By default, GRMON listens on port 2222 for the GDB connection:
(gdb) target extended-remote pluto:2222
Remote debugging using pluto:2222
0x40000800 in start ()
(gdb)
3.6.2 Running application in GDB
To load and start an application, use the GDB load and run command.
$ gdb stanford
(gdb) target extended-remote pluto:2222
Remote debugging using pluto:2222
0x40000800 in start ()
(gdb) load
Loading section .text, size 0xcb90 lma 0x40000000
Loading section .data, size 0x770 lma 0x4000cb90
Start address 0x40000000, load size 54016
Transfer rate: 61732 bits/sec, 278 bytes/write.
(gdb) bre main
Breakpoint 1 at 0x400039c4: file stanford.c, line 1033.
(gdb) run
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/john/samples/stanford
Breakpoint 1, main () at stanford.c:1033
1033 fixed = 0.0;
(gdb)
To interrupt execution, Ctrl-C can be typed in both GDB and GRMON windows. The program can be restarted using the GDB run command but the program image needs to be reloaded first using the load command. Software trap 1 (ta 1) is used by GDB to insert breakpoints and should not be used by the application.
AEROFLEX GAISLER AB
- 27 -
GRMON User’s Manual
3.6.3 Executing GRMON commands in GDB
While GDB is attached to GRMON, normal GRMON commands can be executed using the GDB monitor command. Output from the GRMON commands is then displayed in the GDB console:
(gdb) monitor hist
time address instruction result
4484188 40001e90 add %g2, %o2, %g3 [6e1f766e]
4484194 40001e94 andn %g3, %g2, %g2 [001f0000]
4484195 40001e98 andcc %g2, %o0, %g0 [00000000]
4484196 40001e9c be,a 0x40001e8c [40001e3c]
4484197 40001ea0 add %o1, 4, %o1 [40003818]
4484198 40001e8c ld [%o1], %g2 [726c6421]
4484200 40001e90 add %g2, %o2, %g3 [716b6320]
4484201 40001e94 andn %g3, %g2, %g2 [01030300]
4484202 40001e98 andcc %g2, %o0, %g0 [00000000]
4484203 40001e9c be,a 0x40001e8c [40001e3c]
3.6.4 Detaching
If GDB is detached using the detach command, the monitor returns to the command prompt, and the program can be debugged using the standard GRMON commands. The monitor can also be re-attached to GDB by issuing the gdb command to the monitor (and the target command to GDB).
GRMON translates SPARC traps into (UNIX) signals which are properly communicated to GDB. If the application encounters a fatal trap, execution will be stopped exactly before the failing instruction. The target memory and register values can then be examined in GDB to determine the error cause.
3.6.5 Specific GDB optimisation
GRMON detects GDB access to register window frames in memory which are not yet flushed and only reside in the processor register file. When such a memory location is read, GRMON will read the correct value from the register file instead of the memory. This allows GDB to form a function trace-back without any (intrusive) modification of memory. This feature is disabled during debugging of code where traps are disabled, since no valid stack frame exist at that point.
GRMON detects the insertion of GDB breakpoints, in form of the ‘ta 1’ instruction. When a breakpoint is inserted, the corresponding instruction cache tag is examined, and if the memory location was cached the tag is cleared to keep memory and cache synchronized.
3.6.6 Limitations of GDB interface
For optimal operation, GDB 6.4 configured for GRMON should be used (provided with RCC and BCC compilers).
Do not use the GDB where command in parts of an application where traps are disabled (e.g.trap handlers).
Since the stack pointer is not valid at this point, GDB might go into an infinite loop trying to unwind false stack frames.
AEROFLEX GAISLER AB
- 28 -
GRMON User’s Manual
3.7 Thread support
GRMON has thread support for the RTEMS, VXWORKS and eCos operating systems. The GDB interface of
GRMON is also thread aware and the related GDB commands are described later.
3.7.1 GRMON thread commands
thread info - lists all known threads. The currently running thread is marked with an asterisk.
grlib> thread info
Name | Type | Id | Prio | Ticks | Entry point | PC | State
----------------------------------------------------------------------------------------------------------------------------------
Int. | internal | 0x09010001 | 255 | 138 | _CPU_Thread_Idle_body | 0x4002f760 _Thread_Dispatch + 0x11c | READY
----------------------------------------------------------------------------------------------------------------------------------
UI1 | classic | 0x0a010001 | 120 | 290 | Init | 0x4002f760 _Thread_Dispatch + 0x11c | READY
----------------------------------------------------------------------------------------------------------------------------------
ntwk | classic | 0x0a010002 | 100 | 11 | rtems_bsdnet_schedneti | 0x4002f760 _Thread_Dispatch + 0x11c | READY
----------------------------------------------------------------------------------------------------------------------------------
DCrx | classic | 0x0a010003 | 100 | 2 | rtems_bsdnet_schedneti | 0x4002f760 _Thread_Dispatch + 0x11c | Wevnt
----------------------------------------------------------------------------------------------------------------------------------
DCtx | classic | 0x0a010004 | 100 | 4 | rtems_bsdnet_schedneti | 0x4002f760 _Thread_Dispatch + 0x11c | Wevnt
----------------------------------------------------------------------------------------------------------------------------------
FTPa | classic | 0x0a010005 | 10 | 1 | split_command | 0x4002f760 _Thread_Dispatch + 0x11c | Wevnt
----------------------------------------------------------------------------------------------------------------------------------
FTPD | classic | 0x0a010006 | 10 | 1 | split_command | 0x4002f760 _Thread_Dispatch + 0x11c | Wevnt
----------------------------------------------------------------------------------------------------------------------------------
* HTPD | classic | 0x0a010007 | 40 | 79 | rtems_initialize_webse | 0x40001b60 console_outbyte_polled + 0x34 | READY
----------------------------------------------------------------------------------------------------------------------------------
thread bt <id> - do a backtrace of a thread.
Backtrace of inactive thread: grlib> thread bt 0x0a010003
%pc
#0 0x4002f760 _Thread_Dispatch + 0x11c
#1 0x40013ed8 rtems_event_receive + 0x88
#2 0x40027824 rtems_bsdnet_event_receive + 0x18
#3 0x4000b664 websFooter + 0x484
#4 0x40027708 rtems_bsdnet_schednetisr + 0x158
A backtrace of the current thread (equivalent to normal bt command): grlib> thread bt 0x0a010007
%pc %sp
#0 0x40001b60 0x43fea130 console_outbyte_polled + 0x34
#1 0x400017fc 0x43fea130 console_write_support + 0x18
#2 0x4002dde8 0x43fea198 rtems_termios_puts + 0x128
#3 0x4002df60 0x43fea200 rtems_termios_puts + 0x2a0
#4 0x4002dfe8 0x43fea270 rtems_termios_write + 0x70
#5 0x400180a4 0x43fea2d8 rtems_io_write + 0x48
#6 0x4004eb98 0x43fea340 device_write + 0x2c
#7 0x40036ee4 0x43fea3c0 write + 0x90
#8 0x4001118c 0x43fea428 trace + 0x38
#9 0x4000518c 0x43fea498 websOpenListen + 0x108
#10 0x40004fb4 0x43fea500 websOpenServer + 0xc0
#11 0x40004b0c 0x43fea578 rtems_initialize_webserver + 0x204
#12 0x40004978 0x43fea770 rtems_initialize_webserver + 0x70
#13 0x40053380 0x43fea7d8 _Thread_Handler + 0x10c
#14 0x40053268 0x43fea840 __res_mkquery + 0x2c8
AEROFLEX GAISLER AB
- 29 -
GRMON User’s Manual
3.7.2 GDB thread commands
GRMON needs the symbolic information of the image that is being debugged to be able to check for thread information. Therefor the symbols needs to be read from the image using the symbol command before issuing the gdb command.
When a program running in GDB stops GRMON reports which thread it is in. The command info threads can be used in GDB to list all known threads.
Program received signal SIGINT, Interrupt.
[Switching to Thread 167837703]
0x40001b5c in console_outbyte_polled (port=0, ch=113 ’q’) at ../../../../../../../../../rtems-4.6.5/c/src/lib/ libbsp/sparc/leon3/console/debugputs.c:38
38 while ( (LEON3_Console_Uart[LEON3_Cpu_Index+port]->status & LEON_REG_UART_STATUS_THE) == 0 );
(gdb) info threads
8 Thread 167837702 (FTPD Wevnt) 0x4002f760 in _Thread_Dispatch () at ../../../../../../rtems-4.6.5/cpukit/score/ src/threaddispatch.c:109
7 Thread 167837701 (FTPa Wevnt) 0x4002f760 in _Thread_Dispatch () at ../../../../../../rtems-4.6.5/cpukit/score/ src/threaddispatch.c:109
6 Thread 167837700 (DCtx Wevnt) 0x4002f760 in _Thread_Dispatch () at ../../../../../../rtems-4.6.5/cpukit/score/ src/threaddispatch.c:109
5 Thread 167837699 (DCrx Wevnt) 0x4002f760 in _Thread_Dispatch () at ../../../../../../rtems-4.6.5/cpukit/score/ src/threaddispatch.c:109
4 Thread 167837698 (ntwk ready) 0x4002f760 in _Thread_Dispatch () at ../../../../../../rtems-4.6.5/cpukit/score/ src/threaddispatch.c:109
3 Thread 167837697 (UI1 ready) 0x4002f760 in _Thread_Dispatch () at ../../../../../../rtems-4.6.5/cpukit/score/ src/threaddispatch.c:109
2 Thread 151060481 (Int. ready) 0x4002f760 in _Thread_Dispatch () at ../../../../../../rtems-4.6.5/cpukit/score/ src/threaddispatch.c:109
* 1 Thread 167837703 (HTPD ready ) 0x40001b5c in console_outbyte_polled (port=0, ch=113 ’q’)
at ../../../../../../../../../rtems-4.6.5/c/src/lib/libbsp/sparc/leon3/console/debugputs.c:38
Using the thread command a specified thread can be selected:
(gdb) thread 8
[Switching to thread 8 (Thread 167837702)]#0 0x4002f760 in _Thread_Dispatch () at ../../../../../../rtems-4.6.5/ cpukit/score/src/threaddispatch.c:109
109 _Context_Switch( &executing->Registers, &heir->Registers );
Then a backtrace of the selected thread can be printed using the bt command:
(gdb) bt
#0 0x4002f760 in _Thread_Dispatch () at ../../../../../../rtems-4.6.5/cpukit/score/src/threaddispatch.c:109
#1 0x40013ee0 in rtems_event_receive (event_in=33554432, option_set=0, ticks=0, event_out=0x43fecc14)
at ../../../../leon3/lib/include/rtems/score/thread.inl:205
#2 0x4002782c in rtems_bsdnet_event_receive (event_in=33554432, option_set=2, ticks=0, event_out=0x43fecc14)
at ../../../../../../rtems-4.6.5/cpukit/libnetworking/rtems/rtems_glue.c:641
#3 0x40027548 in soconnsleep (so=0x43f0cd70) at ../../../../../../rtems-4.6.5/cpukit/libnetworking/rtems/ rtems_glue.c:465
#4 0x40029118 in accept (s=3, name=0x43feccf0, namelen=0x43feccec) at ../../../../../../rtems-4.6.5/cpukit/ libnetworking/rtems/rtems_syscall.c:215
#5 0x40004028 in daemon () at ../../../../../../rtems-4.6.5/c/src/libnetworking/rtems_servers/ftpd.c:1925
#6 0x40053388 in _Thread_Handler () at ../../../../../../rtems-4.6.5/cpukit/score/src/threadhandler.c:123
#7 0x40053270 in __res_mkquery (op=0, dname=0x0, class=0, type=0, data=0x0, datalen=0, newrr_in=0x0, buf=0x0, buflen=0)
at ../../../../../../../rtems-4.6.5/cpukit/libnetworking/libc/res_mkquery.c:199
#8 0x00000008 in ?? ()
#9 0x00000008 in ?? ()
Previous frame identical to this frame (corrupt stack?)
AEROFLEX GAISLER AB
- 30 -
GRMON User’s Manual
It is possible to use the frame command to select a stack frame of interest and examine the registers using the
info registers command. Note that the info registers command only can see the following registers for an inactive task: g0-g7, l0-l7, i0-i7, o0-o7, pc and psr. The other registers will be displayed as 0:
(gdb) frame 5
#5 0x40004028 in daemon () at ../../../../../../rtems-4.6.5/c/src/libnetworking/rtems_servers/ftpd.c:1925
1925 ss = accept(s, (struct sockaddr *)&addr, &addrLen);
(gdb) info reg g0 0x0 0 g1 0x0 0 g2 0xffffffff -1 g3 0x0 0 g4 0x0 0 g5 0x0 0 g6 0x0 0 g7 0x0 0 o0 0x3 3 o1 0x43feccf0 1140772080 o2 0x43feccec 1140772076 o3 0x0 0 o4 0xf34000e4 -213909276 o5 0x4007cc00 1074252800 sp 0x43fecc88 0x43fecc88 o7 0x40004020 1073758240 l0 0x4007ce88 1074253448 l1 0x4007ce88 1074253448 l2 0x400048fc 1073760508 l3 0x43feccf0 1140772080 l4 0x3 3 l5 0x1 1 l6 0x0 0 l7 0x0 0 i0 0x0 0 i1 0x40003f94 1073758100 i2 0x0 0 i3 0x43ffafc8 1140830152 i4 0x0 0 i5 0x4007cd40 1074253120 fp 0x43fecd08 0x43fecd08 i7 0x40053380 1074082688 y 0x0 0 psr 0xf34000e0 -213909280 wim 0x0 0 tbr 0x0 0 pc 0x40004028 0x40004028 <daemon+148> npc 0x4000402c 0x4000402c <daemon+152> fsr 0x0 0 csr 0x0 0
It is not supported to set thread specific breakpoints. All breakpoints are global and stops the execution of all threads. It is not possible to change the value of registers other than those of the current thread.
AEROFLEX GAISLER AB
- 31 -
GRMON User’s Manual
4 Debug interfaces
4.1 Overview
The default communications interface between GRMON and the target system is the host’s serial port connected to the AHB uart of the target system. Connecting using USB, JTAG, PCI or ethernet can be performed using the switches listed below:
-eth Connect using ethernet. Requires the EDCL core to be present in the target system.
-pci vid:did[:i]Connect through PCI. Board is identified by vendor id, device id and optionanlly instance number. Requires a supported PCI core.
-jtag
-altjtag
-gresb
-xilusb
Connect to the JTAG Debug Link using Xilinx Parallel Cable III or IV.
Connect to the JTAG Debug Link using Altera download cable (USB or parallel).
Connect through the GRESB bridge. The target needs a SpW core with RMAP.
Connect to the JTAG Debug Link using Xilinx Platform USB cable.
-usb
-wildcard
-ftdi
-amontec
-fpro
Connect to the USB debug link. Requires the USBDCL core to be present in the target.
Connect to WildCard PC Card. Requires the WILD2AHB core to be present in target.
Connect to FTDI FT2232 chip in MPSSE-JTAG-emulation mode (linux only).
Connect to JTAG using the Amontec USB/JTAG key.
Connect to JTAG using the Actel FlashPro cable. (Windows only)
8-/16-bit access to the target system is only supported by the JTAG debug links, all other interfaces access subwords using read-modify-write. All links supports 32-bit accesses. 8-bit access is gene ally not needed. An example of when it is needed is when programming a 8 or 16-bit flash memory on a target system witout a
LEON cpu available. Another example is when one is trying to access cores that have byte-registers, for example the CAN_OC core, but allmost all GRLIB cores have word-registers and can be accessed by any debug link.
4.2 Serial debug interface
To successfully attach GRMON using the AHB uart, first connect the serial cable between the uart connectors on target board and the host system. Then power-up and reset the target board and start GRMON. Use the
-uart option in case the target is not connected to the first uart port of your host. Below is a list of start-up switches applicable for the AHB uart interface:
-baud baudrateUse baudrate for the DSU serial link. By default, 115200 baud is used. Possible baud rates are 9600, 19200, 38400, 57600, 115200, 230400, 460800. Rates above 115200 need special uart hardware on both host and target.
-ibaud baudrateUse baudrate to determine the target processor frequency. Lower rate means higher accuracy. The detected frequency is printed on the console during startup. By default, 115200 baud is used.
-uart device By default, GRMON communicates with the target using the first uart port of the host. This can be overridden by specifying an alternative device. Device names depend on the host
AEROFLEX GAISLER AB
- 32 -
GRMON User’s Manual operating system. On unix systems (and cygwin), serial devices are named as /dev/ttyXX.
On windows, use com1 - 4.
When GRMON connects to the target with the serial interface, the system clock frequency is calculated by comparing the setting in the AHB uart baud rate generator to the used communications baud rate. This detection has limited accuracy, but can be improved by selecting a lower detection baud rate using the -ibaud switch. On some hosts, it might be necessary to lower the baud rate in order to achieve a stable connection to the target. In this case, use the -baud switch with the 57600 or 38400 options.
AEROFLEX GAISLER AB
- 33 -
GRMON User’s Manual
4.3 Ethernet debug interface
If the target system uses the EDCL ethernet communication link core, GRMON can connect to the system using ethernet. In this case, start GRMON with -eth. The default network parameters can be set through additional switches:
-emem <size> Use size for the target system’s EDCL packet buffer. Default is 2 (kbytes)
-ip <ipnum> Use ipnum for the target system IP number. Default is 192.168.0.51.
-udp <port> Use port for the target systemUDP port. Default is 8000.
The IP address of the EDCL is determined at synthesis time, but can be changed using the edcl command: grlib> edcl
edcl ip 192.168.0.51, buffer 2 kbyte grlib> edcl 192.168.0.56
edcl ip 192.168.0.56, buffer 2 kbyte
Note that if the target is reset using the reset signal (or power-cycled), the default IP address is restored. The
edcl command can be given when GRMON is attached to the target with any interface (serial, JTAG, PCI ...), allowing to change the IP address to a value compatible with the network type, and then attach GRMON using the EDCL with the new IP number. If the edcl command is issued through the EDCL interface, GRMON must
: be re-started using the new IP address of the EDCL interface. The current IP number is also visible in ‘info sys’ grlib> info sys
.
.
03.01:01d Gaisler Research GR Ethernet MAC (ver 0)
ahb master 3
apb: 80000b00 - 80000c00
edcl ip 192.168.0.52, buffer 2 kbyte
If the EDCL IP is set to 0.0.0.0 then the EDCL will be disabled, for other values the EDCL will be enabled (if supported by the Ethernet core).
4.4 JTAG debug interfaces
The subsections below describe how to connect to a design that contains a JTAG AHB debug interface (AHB-
JTAG). The JTAG interface has in the past been unreliable in systems with very high bus loads, or extremely slow AMBA AHB slaves, that lead to GRMON reading out AHB read data before the access had actually completed on the AHB bus. Read failures have been seen in systems where the debug interface needed to wait hundreds of cycles for an AHB access to complete. With version 1 of the JTAG AHB debug interface the reliability of the debug link has been improved.
In order to be backward compatible with earlier versions of the debug interface, GRMON cannot use all the features of AHBJTAG version 1 before the debug monitor has established that the design in fact contains a core with this version number. In order to do so, GRMON scans the plug’n’play area. However, in systems that have the characteristics described above, the scanning of the plug’n’play area may fail. For such systems the AHB-
JTAG version assumed by GRMON during plug’n’play scanning can be set with the switch -fjtagcomver
<version>. This will enable GRMON to keep reading data from the JTAG AHB debug interface until the AHB access completes and valid data is returned. Specifying -fjtagcomver in systems that have AHBJTAG version
0 has no benefit and may lead to erroneous behavior.
AEROFLEX GAISLER AB
- 34 -
GRMON User’s Manual
4.4.1 Xilinx Parallel Cable III or IV
If target system has the JTAG AHB debug interface, GRMON can connect to the system through Xilinx Parallel Cable III or IV. The cable should be connected to the host computers parallel port, and GRMON should be started with the -jtag switch. On linux systems, the GRMON binary has to be owned by the superuser (root) and have ‘s’ (set user or group ID on execution) permission bit set (chmod +s grmon). GRMON will report the devices in the JTAG chain. If an unknown device is found, initialization of the JTAG chain will fail and
GRMON will report the JTAG ID of the unknown device. In this case, use JTAG configuration file to describe the unknown device (see appendix D). If you report the device ID and corresponding JTAG instruction register length to Aeroflex Gaisler and the device will be supported in a future release of GRMON. Following switch can be used with the JTAG debug interface:
-pport <1,2> Use parallel port 1 or 2 (default is 1).
$ grmon -jtag -u
using JTAG cable on parallel port
JTAG chain: xc3s1500 xcf04s xcf04s
4.4.2 Altera USB Blaster or Byte Blaster
For GRLIB systems implemented on Altera devices GRMON can use USB blaster or Byte Blaster cable to connect to the system. GRMON is started with -altjtag switch. GRMON will automatically detect cable connected to the host computer. On Linux systems, the path to Quartus shared libraries has to be defined in the
LD_LIBRARY_PATH environment variable, e.g.:
$ export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/local/quartus/linux
$ grmon -altjtag
GRMON LEON debug monitor v1.1.16c
Note that the automatic frequency detection over USB is not always working due to unpredictable communication latencies. It is recommneded to use the -freq xx option to define the target frequency when using the Altera
USB cable.
4.4.3 Xilinx Platform USB Cable (Linux and Windows)
JTAG debugging using the Xilinx USB Platform cable is supported on Linux and Windows systems. The platform cable models DLC9G and DLC10 are supported. The legacy model DLC9 is not supported. GRMON should be started with -xilusb switch, e.g.:
$ grmon -xilusb -u
GRMON LEON debug monitor v1.1.35
Xilinx cable: Cable type/rev : 0x3
JTAG chain: xc2v6000 xc18v04 xc18v04 xc18v04 xc18v04 xc18v04 xc18v04
GRLIB build version: 2384
initialising .............
On Linux systems, the Xilinx USB drivers must be installed by executing ’./setup_pcusb’ in the ISE bin/lin directory (see ISE documentation). Also, the program fxload must be available in /sbin on the used host.
AEROFLEX GAISLER AB
- 35 -
GRMON User’s Manual
On Windows hosts, the USB cable drivers should be installed from ISE or ISE-Webpack. Xilinx ISE 9.2i or later is required. Then, the filter driver from the libusb project (http://libusb-win32.sourceforge.net, version
0.1.12.1 or later is recommended) should be installed.
Certain FPGA boards have a USB platform cable logic implemented directly on the board, using a Cypress
USB device and a dedicated Xilinx CPLD. GRMON can also connect to these boards, using the -xilusb switch.
Tested boards are Digilent XUP and XC3S1600E Development boards. Feed-back on other boards is welcome.
Extra options to the Xilinx Platform USB cable:
-xilmhz <mhz> Set the frequency of the JTAG. Valid values are 0.75, 1.5, 3 or 6. The default frequency is 3 MHz
-xilport <num>
-xillist
If multiple Xilinx Platform USB Cables are connected the hostm this swich can be added to select one, where <num> is an index starting from 0.
By adding -xillist you can get a list of connected USB devices and the -xilport <num> combination to use.
4.4.4 FTDI FT2232 MPSSE-JTAG-emulation mode
JTAG debugging using a FTDI FT2232/FT4232 chip in MPSSE-JTAG-emulation mode is supported in Linux and Windows, but using different commandline switches.
In Linux, GRMON is started with the -ftdi switch. As with parallel port JTAG cables, the GRMON binary has to be owned by the superuser (root) and have ‘s’ (set user or group ID on execution) permission bit set (chmod
+s grmon).
Extra options to the FTDI interface:
-ftdifreq <value> Set the JTAG frequency divider. <value> can be in the range of 0-0xffff. The JTAG frequency will be approximately 6 MHz / (value + 1). Default is 0x05 (1 MHz).
-ftdipid <hex> Specify the device ID (DID) of the chip to use. Default is 0x6010 (FT2232H in the
Gaisler/Pender USB/JTAG cable). In linux you can lookup the VID:DID pair by typing /sbin/lsusb. The VID is FTDI’s 0x0403. Other supported device are FT2232L
(0xcff8) and FT4232H (0x6011).
-ftdicable <num> Specify wich cable to use if more then one is connected to the computer. If only one cable is connected to the host computer, then it will automatically be selected.
When using Windows, GRMON is started with the -d2xx switch. FTDI’s D2XX driver must be installed. Drivers and installation guides can be found at http://www.ftdichip.com.
Extra options to the FTDI interface:
-d2xxfreq <value> Set the JTAG frequency divider. <value> can be in the range of 0-0xffff. The JTAG frequency will be 12 MHz / ((value + 1)*2). Default is 0x05 (1 MHz).
-d2xxlist If more than one cable is connected to the host computer it is possible to list all cables.
-d2xxcable <num> Specify wich cable to use if more then one is connected to the computer. If only one cable is connected to the host computer, then it will automatically be selected.
AEROFLEX GAISLER AB
- 36 -
GRMON User’s Manual
4.4.5 Amontec USB/JTAG key
In Linux, the Amontec USB/JTAG key can be used with the option -amontec. The key is using the FTDI device, and the -amontec option is in fact equivalent to -ftdi -ftdipid 0xcff8.
Amontec instead. The drivers and installation guide can be found at http://www.amontec.com.
4.4.6 Actel FlashPro 3/3x/4 (Windows)
JTAG debugging using the Actel FlashPro 3/3x/4 cable is only possible for GRLIB systems implemented on
Actel devices, and on windows hosts This also requires FlashPro 9.1 SP1 software or later to be installed on the host computer (to be downloaded from www.actel.com). Windows support is detailed at www.actel.com.
GRMON is started with the -fpro switch. If only one cable is connected to the host computer, then it will automatically be detected. If more than one cable is connected to the host computer it is possible to list all cables with -fprolist and then choose a cable with -fprocable <number>.
The -fpro switch is only implemented for the professional GRMON version. Technical support is provided through Aeroflex Gaisler only via [email protected].
4.4.7 Digilent HS1
JTAG debugging using a Digilent JTAG HS1 requires the Digilent Adept System software to be installed on the host computer. Start GRMON with the -digilent switch to use this interface .
Extra options to the Digilent interface:
-digifreq <hz> Set the JTAG frequency in Hz. Default is 1 MHz.
-digicable <num> Specify wich cable to use if more then one is connected to the computer. If only one cable is connected to the host computer, then it will automatically be selected.
-digilist List all available cables.
4.4.8 Choosing JTAG device
If the JTAG device chain contains more than one FPGA GRMON will not know which device to debug. To choose device manually use the option -jtagdevice X where X is the device number to connect to.
4.5 Direct USB debug interface (Linux and Windows)
GRMON can connect to targets equipped with the USBDCL core using the USB bus. To do so start GRMON with the -usb switch. Both USB 1.1 and 2.0 are supported. Several target systems can be connected to a single host at the same time. GRMON scans all the USB busses and claims the first free USBDCL interface. If the first target system encountered is already connected to another GRMON instance, the interface cannot be claimed and the bus scan continues.
On Linux the GRMON binary has to be owned by the superuser (root) and have ‘s’ (set user or group ID on execution) permission bit set (chmod +s grmon).
On Windows a driver has to be installed. The first the time the device is plugged in it should be automatically detected as seen in figure below.
AEROFLEX GAISLER AB
GRMON User’s Manual
- 37 -
Then the new device can be found in the Device Manager. Press the right mouse button over the unknown device and choose update driver in the menu.
Select "No, not this time" in the next window and click next.
AEROFLEX GAISLER AB
Select "Install from a list or specific location".
- 38 -
GRMON User’s Manual
In the last step choose to search for the best driver and include the path "GRMON_ROOT\libusb\bin" where
GRMON_ROOT is the root directory of the GRMON installation, usually ’C:\opt\grmon-eval’ or
’C:\opt\grmon-pro’. Then click next and Windows should detect the driver. Click on "finish" when its done and then it should be possible to connect with GRMON using the -usb switch.
4.6 PCI debug interface
If target system has a PCI interface, GRMON can connect to the system using the PCI bus. Start GRMON with the -pci vendor_id:device_id[:instance] option and specify vendor id and device id in hexadecimal (with or without ‘0x’ prefix):
.$ grmon -pci 16e3:1e0f
AEROFLEX GAISLER AB
- 39 -
GRMON User’s Manual
The default is to use the first instance of the board. If there are more than one board with the same vendor and device id the different boards can be selected with the instance number:
$ grmon -pci 16e3:1e0f:2
GRMON supports the Aeroflex Gaisler PCI cores inside GRLIB (pci_gr, pci_target, pci_mtf, pcidma) and the
Insilicon PCI core (pci_is) on the AT697 (LEON2-FT) device.
On Linux GRMON needs root privelege to be able to access PCI memory and I/O ports. This can be accomplished by letting the GRMON binary be owned by root (chown root grmon) and setting the ’s’ (set user or group ID on execution) permission bit (chmod +s grmon).
On Windows a special PCI driver must installed. It is available as an installer ’GRPCISetup.exe’ in the folder
’pci’. It is a standard Windows installer which will install everthing that is needed for PCI to work with
GRMON.
4.7 GRESB debug interface
Targets equipped with a Spacewire core with RMAP support can be debugged through the GRESB debug interface using the GRESB Ethernet to Spacewire bridge. To do so start GRMON with the -gresb switch and use the following switches to set the needed parameters:
-ip <ipnum>
-link <linknum>
-dna <dna>
-sna <sna>
-dpa <dpa1>,<dpa2>
-spa <spa1>,<spa2>
-dkey <key>
-clkdiv <div>
-gresbtimeout <n>
-gresbretry <n>
Connect to the bridge using the IP address ipnum . Default is 192.168.0.51.
Use link linknum on the bridge. Defaults to 0.
The destination node address of the target. Defaults to 0xFE.
The SpW node address for the link used on the bridge. Defaults to 32.
The destination path address. Comma separated list of addresses.
The source path address. Comma separated list of addresses.
The destination key used by the targets RMAP interface. Defaults to 0.
Divide the tx bit rate by div. If not specified, the current setting is used.
Timeout period in seconds for RMAP replies. Defaults is 8.
Number of retries for each timeout. Defaults to 0.
Example grmon -gresb -ip 192.168.0.55 -dna 0xfe -sna 32 -link 0 -clkdiv 1 -u
In this case the routing table of the GRESB must be set up to route 0xFE to the appropriate SpaceWire link and
32 to TCP link 0.
Path address grmon -gresb -ip 192.168.0.55 -dna 0xfe -sna 32 -dpa 5 -spa 1
In this case the routing table of the GRESB must be set up to route 5 to the appropriate SpaceWire link and 32 to TCP link 0.
For further information about the GRESB bridge see the GRESB manual.
AEROFLEX GAISLER AB
- 40 -
GRMON User’s Manual
4.8 WildCard debug interface
The WildCard™ is a development board from Annapolis Micro Systems, Inc. It contains a 32-bit CardBus interface, programmable clock generator, a Processing Element (Virtex™ XCV300E -6 FPGA), two SSRAM memory ports and two I/O ports.
The necessary Windows drivers and API are delivered with the card. The wcapi.dll file should be in the search path. For more information, visit http://www.annapmicro.com
For GRMON to communicate with the WildCard, the GRLIB WILD2AHB - WildCard Debug Interface IP core must be present in the Processing Element FPGA design. The WildCard debug interface supports only 32bit AMBA accesses. GRMON and the WILD2AHB IP core have been tested on Windows XP with the following WildCard software and hardware versions:
• API version 1.8
• Driver version 1.8
• Firmware version 2.4
• Hardware version 4.0, Rev. D:
• XCV300E-BG352-6
• 2 x 256kByte SSRAM, 10 ns
Below is a list of start-up switches applicable to the WildCard debug interface:
-wildmhz mhz
-wildfile file
-wilddev device
-wildstat
Set the frequency of the F_CLK clock from the clock generator on the Wild-
Card. The default is 20 MHz (see WildCard documentation for minimum and maximum values).
Set the name of the WildCard programming file. The default is “wildcard-
xcv300e.bin”, as generated by GRLIB.
Set the WildCard device number. The default is 0.
Enable WildCard version and hardware information printout.
AEROFLEX GAISLER AB
- 41 -
GRMON User’s Manual
5 Debug drivers
5.1 LEON2, LEON3 and LEON4 debug support unit (DSU) drivers
The DSU debug drivers for LEON2 and LEON3 processors handle most of the functions regarding application debugging, processor register access and trace buffer handling. Since the DSU for LEON2 and LEON3 are not identical, two separate drivers are used.
5.1.1 Internal commands
The driver for the LEON2/3 debug support unit provides the following internal commands:
ahb [length]
ahb force [0|1]
ahb timer [0|1] ahb status
Print the AHB trace buffer. The length AHB transfers will be printed, default is 10.
Enable or disable the AHB trace buffer even when the processor is en debug mode.
Enable the timetag counter when in debug mode.
Print AHB trace buffer settings.
ahb filter [addresses|reads|writes] [0|1]
Enable or disable filtering options if supported by the DSU core. When enabling the addresses filter, the second AHB breakpoint register will be used to define the range of the filter. (Only available in some DSU4 implementations).
ahb filter range addr mask
Set the base address and mask that the AHB trace buffer will include if the address filtering is enabled. (Only available in some DSU4 implementations).
ahb filter mmask mask Set which AHB masters connected to the bus to exclude. (See above)
ahb filter smask mask Set which AHB slaves connected to the bus to exclude. (See above)
ahb filter performance [0|1]
Enable or disable the filter on the signals connected to the performance
counters, see “LEON4 Statistics Unit (L4STAT)” on page 59. (See above)
break <addr> print or add breakpoint
bwatch [addr] [mask value] [read | write] [delay value] [break]
Add a buswatch at address addr with an optional mask. The watchpoint will have read and write attributes set be default, if one of the read/write keywords are specified then the watchpoint will only have that attribute. It’s also optional to set the delay and if the CPU should enter debug mode on hit. If addr is left out, then only break and delay will have any effect.
cpu [enable | disable | act] cpuid
Control processors in LEON3 multi-processor (MP) systems.
Without parameters, the cpu command prints the processor status.
dcache[0 | 1]
delete <bpnum> float
gdb [port]
go [addr]
hbreak[mask value] show, enable or disable data cache delete breakpoint(s) display FPU registers connect to GDB debugger start execution without initialization print breakpoints or add hardware breakpoint with and optionl mask (if available)
AEROFLEX GAISLER AB
- 42 -
GRMON User’s Manual
hist [length]
icache [0 | 1]
inst [length]
Print the trace buffer. The length last executed instructions or
AHB transfers will be printed, default is 10.
show, enable or disable instruction cache
Print the instruction trace buffer. The length last executed instructions will be printed, default is 10.
inst filter [filt] Print/set the instruction trace buffer filter. See DSU manual for values of filt.
(Only available in some DSU4 implementations).
mmu print the SRMMU registers (see also the -srmmu <cpunum> switch)
mmu [mctrl|ctxp|ctx] val write value to mmu register
profile [0 | 1] register
run [addr]
stack [val] enable/disable/show simple profiling show/set integer registers reset and start execution at last entry point, or at addr show/set the initial stack pointer
step [n] thread info single step one or [n] times show thread information (RTEMS only)
tmode [proc | ahb | both | none]
Select tracing mode between none, processor-only, AHB only or both.
walk [address] wash do address translation for a virtual address
Clear all SRAM and SDRAM memory
watch [addr][mask value] [read | write]
Print or add data watchpoint at address addr with an optional mask. The watchpoint will have read and write attributes set be default, if one of the read/write keywords are specified then the watchpoint will only have that attribute.
5.1.2 Command line switches
The following command line switches are accepted:
-mp Start-up in MP mode (all processors enabled)
-srmmu <cpunum>Specifies that cpu <cpunum> has a SRMMU present. This will enable the SRMMU commands as well as virtual address translation if SRMMU is enabled.
5.2 Memory controller driver
The memory controller debug driver provides functions for memory probing and waitstate control. These switched are applicable to the LEON2 memory controller (MCTRL), and the FTMCTRL, SRCTRL and
FTSRCTRL memory controller cores.
5.2.1 Internal commands
mcfg1 [value] Set the default value for memory configuration register 1. When the ‘run’ or ’load’ command is given, MCFG1, 2&3 are initialized with their default values to provide the application with a clean startup environment. If no value is give, the current default value is printed.
mcfg2 [value] As mcfg1 above, but setting the default value of the MCFG2 register.
mcfg3 [value] As mcfg1 above, but setting the default value of the MCFG3 register.
AEROFLEX GAISLER AB
- 43 -
GRMON User’s Manual
5.2.2 Command line switches
The following start-up switches are recognized:
-rambanks ram_banksOverrides the auto-probed number of populated ram banks.
-cas delay Programs SDRAM to either 2 or 3 cycles CAS delay. Default is 2.
-mcfg1, -mcfg2, -mcfg3
Set the default value for memory configuration register 1, 2 or 3 respectively.
-noflash
-nosram
Do not probe for flash memory at start-up
Disable sram and map sdram from address 0x40000000
-ram ram_size Overrides the auto-probed amount of static ram. Size is given in Kbytes.
-romrws waitstates Set waitstates number of waitstates for rom reads.
-romwws waitstates Set waitstates number of waitstates for rom writes.
-romws waitstates Set waitstates number of waitstates for both rom reads and writes.
-ramrws waitstates Set waitstates number of waitstates for ram reads.
-ramwws waitstates Set waitstates number of waitstates for ram writes.
-ramws waitstates
-trp3
-trfc val
Set waitstates number of waitstates for both ram reads and writes.
Programs the SDRAM trp timing to 3 (sets bit 30 in mcfg2). Default is 2.
Programs the SDRAM trcf field in mcfg2 to represent val ns.
AEROFLEX GAISLER AB
- 44 -
GRMON User’s Manual
5.3 On-chip logic analyser driver (LOGAN)
The LOGAN debug driver contains commands to control the LOGAN on-chip logic analyzer core. It allows to set various triggering conditions, and to generate VCD waveform files from trace buffer data. All logic analyzer commands are prefixed with la.
5.3.1 Internal commands
la status la arm
Reports status of logan (equivalent with writing just la).
Arms the logan. Begins the operation of the analyzer and sampling starts.
la reset Stop the operation of the logan. Logic Analyzer returns to idle state.
la pm [trig level] [pattern] [mask]
Sets/displays the complete pattern and mask of the specified trig level. If not fully specified the input is zero-padded from the left. Decimal notation only possible for widths less than or equal to 64 bits.
la pat [trig level] [bit] [0 | 1]
Sets/displays the specified bit in the pattern of the specified trig level to 0/1.
la mask [trig level] [bit] [0 | 1]
Sets/displays the specified bit in the mask of the specified trig level to 0/1.
la trigctrl [trig level] [match counter] [trig condition]
Sets/displays the match counter and the trigger condition (1 = trig on equal, 0 = trig on not equal) for the specified trig level.
la count [value]Set/displays the trigger counter. The value should be between zero and depth-1 and specifies how many samples that should be taken after the triggering event.
la div [value] Sets/displays the sample frequency divider register. If you specify e.g. “la div 5” the logic analyzer will only sample a value every 5th clock cycle.
la qual [bit] [value]Sets/displays which bit in the sampled pattern that will be used as qualifier and what value it shall have for a sample to be stored.
la dump [filename]This dumps the trace buffer in VCD format to the file specified (default is log.vcd).
la view [start index] [stop index] [filename]
Prints the specified range of the trace buffer in list format. If no filename is specified the commands prints to the screen.
la page [page] Sets/prints the page register of the logan. Normally the user doesn’t have to be concerned with this because dump and view sets the page automatically. Only useful if accessing the trace buffer manually via the GRMON mem command.
The LOGAN driver can create a VCD waveform file using the ‘la dump’ command. The file setup.logan is used to define which part of the trace buffer belong to which signal. The file is read by the debug driver before a VCD file is generated. An entry in the file consists of a signal name followed by its size in bits separated by white-space. Rows not having these two entries as well as rows beginning with an # are ignored.
AEROFLEX GAISLER AB
- 45 -
GRMON User’s Manual
Example: count31_16 16 count15_6 10 count5_0 6
This configuration has a total of 32 traced signals and they will be displayed as three different signals being 16,
10 and 6 bits wide. The first signal in the configuration file maps to the most significant bits of the vector with the traced signals. The created VCD file can be opened by waveform viewers such as GTKWave or Dinotrace.
Below is an example trace displayed in GTKWave.
To simplify the operation of the logic analyzer, a graphical GUI is available. The GUI is written in Tcl/Tk and can be connected to GRMON using the GDB interface. To use the GUI, enter the gdb command in GRMON and then launch the tcl file logan.tcl.
The left side of the GUI window has the settings for the different trig levels, i.e. pattern, mask, match counter and trigger condition. Which trig level the settings apply to is chosen from an option menu. The “Download conf” button transfers the values to the on-chip logic analyzer. The pattern and mask is padded with zeroes from the left if not fully specified. They can be entered either in hexadecimal or decimal but there is a limitation that no signal can be wider than 64 bits.
The right side of the window shows the status the settings which control the trace buffer. These settings are sent to the logic analyzer when the user presses enter. The ‘armed’ and ‘triggered’ fields of the status can be re-read by pressing the “Update status” button.
There are also buttons to arm and reset the logic analyzer as well as to dump the vcd-file and launch GTK-
Wave. Any GRMON command can be issued from the entry below these buttons.
From the file menu the current configuration can be saved and a new one can be loaded. The GUI defaults to the same configuration file as the GRMON debug driver. If the configuration is saved it adds information about the setup which is ignored by GRMON. When saving/loading any filename may be specified but during startup the GUI reads the “setup.logan” file. Only files previously saved by the GUI can be loaded from this menu option.
AEROFLEX GAISLER AB
- 46 -
GRMON User’s Manual
5.4 AMBA wrapper for Xilinx System Monitor
The debug driver driver for the AMBA wrapper for Xilinx System Monitor allows reading of device temperature and voltages. The debug driver does not perform any calibration of the System Monitor.
5.4.1 Internal commands
grsysmon calibrate grsysmon temperature grsysmon voltage
Initialize and calibrate out any offset and gain errors
Displays temperature readings
Displays voltage readings
5.5 ATA/IDE controller
The ATA/IDE controller is used when the target system contains the ATACTRL core. The driver implements one command, ata, which displays the types of disk drives that are attached the IDE controller. Attached disks are not automatically probed when GRMON is started, but probing can be forced by starting GRMON with -
ata. The command ‘info sys’ will then display the attached disks.
AEROFLEX GAISLER AB
- 47 -
GRMON User’s Manual
5.6 DDR memory controller (DDRSPA)
The driver for the DDRSPA memory controller performs the DDR initialization sequence, and probes the amount of available memory. To skip the probing and use the pre-configured values, add -nosdinit at start up.
The ’info sys’ command will show the DDR timing and the amount of detected memory:
04.01:025 Gaisler Research DDR266 Controller (ver 0)
ahb: 40000000 - 50000000
ahb: fff00100 - fff00200
16-bit DDR : 1 * 64 Mbyte @ 0x40000000
100 MHz, col 10, ref 7.8 us
5.6.1 Command line switches
The following start-up switches are recognized:
-trp3
-trcd val
-trfc val
-nosdinit
Programs the SDRAM trp timing to 3 (sets bit 30 in ddrcfg1). Default is 2.
Programs the SDRAM trcd timing to val - 2 (sets bit 26 in ddrcfg1). Default is 2.
Programs the SDRAM trcf field in ddrcfg1 to represent val ns.
To skip memory probing and use pre-configured values.
5.7 DDR2 memory controller (DDR2SPA)
The driver for the DDR2SPA memory controller performs the DDR2 initialization sequence, and probes the amount of available memory. To skip the probing and use the pre-configured values, add -nosdinit at start up.
The ’info sys’ command will show the DDR2 timing and the amount of detected memory:
00.01:02e Gaisler Research DDR2 Controller (ver 0x0)
ahb: 40000000 - 60000000
ahb: fff00100 - fff00200
64-bit DDR2 : 1 * 256 Mbyte @ 0x40000000
200 MHz, col 10, ref 7.8 us
5.7.1 Internal commands
ddr2cfg1 [value] ddr2cfg2
ddr2cfg3 [value]
ddr2cfg4 [value]
Set the default value for DDR2 control register 1.
Print the value of DDR2 control register 2.
Set the default value for DDR2 control register 3.
Set the default value for DDR2 control register 4, if available.
ddr2cfg5 [value]
ddr2ftcfg [value]
Set the default value for DDR2 control register 5, if available.
Set the default value for DDR2 FT control register, if available.
ddr2delay [inc | dec | reset | scan | value] Change read data input delay. Use inc to increment the delay with one tap-delay for all data bytes. Use dec to decrement all delays.
Reset will set the delay to default value. A value can be specified to calibrate each data byte separately. The value is written to the 16 LSb of the DDR2 control register 3.
The scan subcommand will run a calibration routine that searches over all tap delays and read delay values to find working settings. Supports only Xilinx Virtex currently, and may overwrite beginning of memory.
AEROFLEX GAISLER AB
- 48 -
GRMON User’s Manual
ddr2skew [inc <steps> | dec <steps> | reset] Change read skew. Use inc to increment the delay with one step. Use dec to decrement the delay with one step. reset will set the skew to the default value. inc and dec can optionally be given the number of steps to increment/decrement as an argument.
5.7.2 Command line switches
The following start-up switches are recognized:
-trp3
-trcd val
-trfc val
-twr val
-regmem
-nosdinit
-ddr2cal
Programs the SDRAM trp timing to 3 (sets bit 28 in ddrcfg3). Default is 2.
Programs the SDRAM trcd timing to val - 2 (sets bit 26 in ddrcfg1). Default is 2.
Programs the SDRAM trcf field in ddrcfg3 to represent val ns.
Programs the SDRAM twr field in ddrcfg3 to represent val ns.
Sets the SDRAM reg field to 1 (for registered memory). Default is 0.
To skip memory probing and use pre-configured values.
Run delay calibration routine on start-up before probing memory (see "ddr2delay scan" command).
5.8 I
2
C-master (I2CMST)
The I
2
C-master debug driver initializes the core’s prescale register for operation in normal mode (100 kb/s).
The driver supplies commands that allow read and write transactions on the I
2
C-bus. The debug driver automatically enables the core when a read or write command is issued.
5.8.1 Internal commands
i2c bitrate[normal | fast]
i2c filter [value] i2c enable i2c disable i2c dvi
Initializes the prescale register for Normal or Fast operaion
Shows/Sets filter register (not available in all implementations)
Enables core
Disables core
i2c read [i2cadd]
Interaction with DVI transmitters. Issue i2c dvi help for further info.
Performs a simple read from slave with I
2
C-address i2cadd
i2c read [i2cadd] [addr] Reads memory location addr from slave with I
2
C-address i2cadd
i2c read [i2cadd] [addr] [cnt] Performs cnt sequential reads starting at addr from slave with i2cadd i2c scan i2c status
Scans the bus for devices.
Displays some status information about the core and the bus.
i2c write [i2cadd] [data] Writes data to slave with I
2
C-address i2cadd
i2c write [i2cadd] [addr] [data] Writes data to memory location addr on slave with address i2cadd
AEROFLEX GAISLER AB
- 49 -
GRMON User’s Manual
5.9 GRCLKGATE clock gating unit
The GRCLKGATE debug driver provides an interface to interact with a GRCLKGATE clock gating unit. A command line switch can be specified to automatically reset and enable all clocks, controlled by clock gating units, during GRMON system initialization. Example output of ’info sys’ is:
0a.01:02c Gaisler Research Clock gating unit (ver 0x0)
apb: f010a000 - f010a100
GRMON did NOT enable clocks during initialization
5.9.1 Command line switches
The following start-up switches are recognized:
-cginit Reset and enable all cores controlled by GRCLKGATE during initialization
5.9.2 Internal commands
grcg clkinfo
grcg enable[all, <num>]
grcg disable[all, <num>]
Displays status information of lock, clock and reset register
Enable all cores, or enable one core specified by index
Disable all cores, or enable one core specified by index
5.10 GRPCI master/target (PCI_MTF)
The debug driver for the GRPCI is mainly useful for PCI host systems. The ’grpci init’ command initialises the host BAR1 to point to RAM (PCI address 0x40000000 -> AHB address 0x4000000) and enables PCI memory space and bus masterering. Commands are provided for initializing the bus, scanning the bus, configuring the found resources, disabling byte twisting and displaying information. Note that on non-host systems only the
info command has any effect.
5.10.1 Internal commands
grpci init grpci info grpci scan grpci conf grpci disable bt
Initialises the GRPCI core as described above
Displays information about the GRPCI core
Scans all PCI slots for available devices
Configures the BARs of the found devices
Disables the GRPCI byte twisting
The grpci conf command can fail to configure all found devices if the PCI address space addressable by the
GRPCI core is smaller than the amount of memory needed by the devices.
5.11 GRPCI2 master/target
The debug driver for the GRPCI is mainly useful for PCI host systems. The ’grpci2 init’ command initialises the host’s AHB to PCI memory address translation 1:1, and AHB to PCI I/O address translation 1:1. The PCI I/
O and PCI Memory windows are printed using ’info sys’ or ’grpci2 info’. The GRPCI2 target BARs are not configured. PCI memory space. Commands are provided for initializing the bus, scanning the bus, configuring the found resources, disabling/enabling byte twisting and displaying information. Note that on non-host systems only the info command has any effect.
AEROFLEX GAISLER AB
- 50 -
GRMON User’s Manual
5.11.1 Internal commands
grpci2 init grpci2 info grpci2 scan grpci2 conf grpci2 disable bt grpci2 enable bt grpci2 trace grpci2 trace arm
Initialises the GRPCI2 core as described above
Displays information about the GRPCI2 core
Scans all PCI slots for available devices
Configures the BARs of the found devices
Disables the GRPCI2 byte twisting
Enables the GRPCI2 byte twisting
Reports current trace buffer settings and status
Arms the trace buffer and starts sampling.
grpci2 trace start grpci2 trace stop
Arms the trace buffer and starts sampling.
Stops the trace buffer sampling.
grpci2 trace log[len][offset] Prints the trace buffer data.
grpci2 trace address[val] Get/set the address pattern register.
grpci2 trace amask[val] grpci2 trace sig[val] grpci2 trace smask[val] grpci2 trace tcount[val]
Get/set the address mask register.
Get/set the signal pattern register.
Get/set the signal mask register.
Get/set the trigger count register.
grpci2 trace tpoint[val] grpci2 trace state
Get/set the trigger point register.
Prints the state of the PCI bus.
grpci2 trace dbif[on/off] Switch to and from the PCI trace debug interface.
grpci2 trace dbif_regbase Set the register base address for PCI trace debug interface.
grpci2 trace dbif_database Set the trace data base address for the PCI trace debug interface.
The grpci2 conf command can fail to configure all found devices if the PCI address space addressable by the
GRPCI core is smaller than the amount of memory needed by the devices.
5.12 PCIF master/target (PCIF)
The debug driver for the PCIF core is mainly useful for PCI host systems. The ’apcif init’ command initializes the host BAR1 to point to RAM (PCI address 0x40000000 -> AHB address 0x4000000) and enables PCI memory space and the PCI bus master. Commands are provided for scanning the bus, configuring the found resources, and displaying information. Note that on non-host systems only the info command has any effect.
5.12.1 Internal commands
apcif init apcif info apcif scan apcif conf
Initializes the PCIF core as described above
Displays information about the PCIF core
Scans all PCI slots for available devices
Configures the BARs of the found devices
AEROFLEX GAISLER AB
- 51 -
GRMON User’s Manual
The apcif conf command can fail to configure all found devices if the PCI address space addressable by the
PCIF core is smaller than the amount of memory needed by the devices.
5.13 AT697 PCI master/target
The debug driver for the AT697 PCI core is mainly useful for PCI host systems. The ’at697pci init’ command initializes the host BAR0 to point to RAM (PCI address 0x40000000 -> AHB address 0x4000000) and enables
PCI memory space and the PCI bus master. Commands are provided for scanning the bus, configuring the found resources, and displaying information. Note that on non-host systems only the info command has any effect.
5.13.1 Internal commands
at697pci init at697pci info at697pci scan at697pci conf
Initializes the core as described above
Displays information about the core
Scans all PCI slots for available devices
Configures the BARs of the found devices
The at697ci conf command can fail to configure all found devices if the PCI address space addressable by the
PCI core is smaller than the amount of memory needed by the devices.
5.14 On-chip PCI trace buffer driver (PCITRACE)
The PCITRACE debug driver contains commands to control the PCI trace buffer core. It allows to set various triggering conditions, and to generate VCD waveform files from trace buffer data. All PCI trace buffer commands are prefixed with pci : pci pci arm
Reports current trace buffer settings and status
Arms the trace buffer and starts sampling.
pci log Prints the trace buffer data and saves the VCD data to ‘log.vcd’
pci address[val] Get/set the address pattern register
pci amask[val] Get/set the address mask register
pci sig[val] Get/set the signal pattern register
pci smask[val]
pci tcount[val]
Get/set the signal mask register
Get/set the trigger count register
pci tpoint[val] Get/set the trigger point register
The pci log command save the current trace buffer data in VCD format to the file log.vcd. The data can then be displayed in a VCD viewer such as GTKWave.
AEROFLEX GAISLER AB
- 52 -
GRMON User’s Manual
5.15 SPI Controller (SPICTRL)
The SPICTRL debug driver provides commands to configure the SPI controller core. The driver also enables the user to perform simple data transfers. The info sys command displays the core’s FIFO depth and the number of available slave select signals:
0a.01:029 Gaisler Research SPI Controller (ver 0x0)
irq 10
apb: 80000a00 - 80000b00
FIFO depth: 2, 3 slave select signals
The following commands are supported by the driver: spi am Commands for automated transfers, issue spi help am for more information.
spi aslvsel <value> Set automatic slave select register spi disable spi enable
Disable core
Enable core spi rx spi selftest spi set <field> spi slvsel <value>
Read Receive register
Place the core in loop mode and perform a simple self test.
Set specified field in the Mode register. See comments below.
Set slave select register spi status spi tx <data>
Display core status information
Write data to Transmit register. GRMON aligns the written data.
spi unset <field> Unset specified field in the Mode register. Se comments below.
The spi set command takes one or more field names as arguments and modifies the Mode register accordingly.
Valid arguments to the set command are; cg <value>, cpol, cpha, div16, len <value>, amen, loop, ms, pm
<value>, tw, asel, fact, od, tac, tto and rev. To configure the core for master operation, with a clock phase of
1, 8 bit word length and MSb first transmission the arguments to set are: spi set ms cpha len 7 rev
The spi unset command sets the specified field to zero, valid arguments to the unset command are; cpol, cpha,
div16, amen, loop, ms, tw, asel, fact, od, tac, tto and rev. Note that the unset command can not be used to modify the CG, LEN or PM fields.
The debug driver has bindings to the SPI memory device layer. These commands are accessed via spi flash.
Please see appendix 6.2 for more information.
5.16 SPI Memory Controller (SPIMCTRL)
The SPIMCTRL debug driver provides commands to perform basic communication with the core. The driver also provides functionality to read the CSD register from SD Card and a command to reinitialize SD Cards.
The following commands are supported by the driver: spim altscaler spim reset spim status spim tx <data> spim sd csd
Toggle use of alternate scaler
Core reset
Displays core status information
Shift a byte to the memory device
Displays and decodes CSD register of SD Card
AEROFLEX GAISLER AB
- 53 -
GRMON User’s Manual spim sd reinit Re-initializes SD Card
The debug driver has bindings to the SPI memory device layer. These commands are accessed via spim flash.
Please see appendix 6.2 for more information.
5.17 SVGA Frame buffer (SVGACTRL)
The SVGACTRL debug driver implements functions to report the available video clocks in the SVGA frame buffer, and to display screen patters for testing. The info sys command will display the available video clocks:
03.01:063 Gaisler Research SVGA frame buffer (ver 0)
ahb master 3
apb: 80000600 - 80000700
clk0: 25.00 MHz clk1: 50.00 MHz clk2: 65.00 MHz
The driver implements the following commands: svga custom Show/set custom format, see description below.
svga draw test_screen <format> <bitdepth> Draw test screen
svga draw <file> <bitdepth> Display file in ASCII (PPM) format svga frame <address> Show or set start address of framebuffer memory svga formats svga formatsdetailed
Show available display formats
Show detailed view of available display formats svga help Show available commands
The svga draw test_screen command will show a simple grid in the resolution specified via the format selection. The color depth can be either 16 or 32 bits.
The svga draw <file> command will determine the resolution of the specified picture and select an appropriate format (resolution and refresh rate) based on the video clocks available to the core. The required file format is
ASCII PPM which must have a suitable amount of pixels. For instance, to draw a screen with resolution
640x480, a PPM file which is 640 pixels wide and 480 pixels high must be used. ASCII PPM files can be created with, for instance, the GNU Image Manipulation Program (The GIMP).
The svga custom <period> <horizontal active video> <horizontal front porch> <horizontal sync> <hori- zontal back porch> <vertical active video> <vertical front porch> <vertical sync> <vertical back porch> command can be used to specify a custom format. The custom format will have precedence when using the
svga draw command.
5.18 USB Host Controller (GRUSBHC)
The GRUSBHC host controller consists of two host controller types. GRMON provides a debug driver for each type. The info sys command displays the number of ports and the register setting for the enhanced host controller:
02.01:026 Gaisler Research USB EHCI controller (ver 0x0)
ahb master 2, irq 9
apb: 80000e00 - 80000f00
1 ports, byte swapped registers
GRMON enumerates the universal host controllers present in the system and info sys will, in addition to number of ports and register setting, display the number assigned to the universal host controller:
AEROFLEX GAISLER AB
- 54 -
GRMON User’s Manual
03.01:027 Gaisler Research USB UHCI controller (ver 0x0)
ahb master 3, irq 10
ahb: fffa0000 - fffa0100
cc#: 1, 1 ports, byte swapped registers
5.18.1 Internal commands
The enhanced host controller’s debug driver provides the following internal commands: ehci endian ehci capregs ehci opregs ehci reset
Displays the endian conversion setting
Displays contents of the capability registers
Displays contents of the operational registers
Performs a Host Controller Reset
The internal commands provided by the universal host controller’s debug driver are:
uhci endian[cc#]
uhci ioregs[cc#]
Displays the endian conversion setting
Displays contents of the I/O registers
uhci reset [cc#] Performs a Global reset
The cc# argument is only processed if there is more than one universal host controller present in the system.
5.18.2 Command line switches
Both the debug driver for the enhanced host controller and the universal host controller support the following command line switch:
-nousbrst Do not perform a host controller reset when GRMON is started
5.19 AMBA AHB trace buffer driver (AHBTRACE)
The AHBTRACE debug driver contains commands to control the AHBTRACE buffer core. It is possible to record AHB transactions without interfering with the processor. With the commands it is possible to set up triggers formed by an address and an address mask indicating what bits in the address that must match to set the trigger off. When the triggering condition is matched the AHBTRACE stops the recording of the AHB bus and the log is available for inspection using the at command. The at delay command can be used to delay the stop of the trace recording after a trigging match.
Note that this is an stand alone AHB trace buffer it is not to be confused with the DSU AHB trace facility.
When a break point is hit the processor will not stop its execution.
5.19.1 Internal Commands
at [entries] at log at reg at enable
Prints [entries] of the current trace buffer log
Prints all entries of the current trace buffer log
Reports current trace buffer settings and status
Arms the trace buffer and starts recording at disable
at delay [val]
Stops the trace buffer recording
Delay the stops the trace buffer recording after match
at bp1 address mask Sets break point 1, address and mask
at bp2 address mask Sets break point 2, address and mask
AEROFLEX GAISLER AB
- 55 -
GRMON User’s Manual
at bsel [val] Selects bus to trace (not available in all implementations)
at filter [addresses|reads|writes] [0|1]
Enable or disable filtering options if supported by the core. When enabling the addresses filter, the second AHB breakpoint register will be used to define the range of the flilter.
at filter range addr mask
Set the base address and mask that the AHB trace buffer will include if the address filtering is enabled.
at filter mmask mask Set which AHB masters connected to the bus to exclude.
at filter smask mask Set which AHB slaves connected to the bus to exclude.
5.20 10/100 Mbit/s Ethernet Controller (GRETH)
The GRETH debug driver provides commands to configure the GRETH 10/100 Mbit/s Ethernet controller core. The driver also enables the user to read and write ethernet PHY registers. The info sys command displays the core’s configuration settings:
02.01:01d Gaisler Research GR Ethernet MAC (ver 0x0)
ahb master 2, irq 12
apb: c0100100 - c0100200
Device index: dev0
edcl ip 192.168.0.201, buffer 2 kbyte
If more then one GRETH core excists in the system, it is possible to specify which core the internal commands should operate on. This is achived by appending a dev# parameter to the command, where the # is the GRETH device index. If the dev# parameter is omitted, the command will operate on device 0. The device index is listed in the info sys information.
5.20.1 Internal commands
edcl [ip][dev#] Show or set the EDCL IP number.
mdio <paddr <raddr> [dev#] Show PHY register. paddr = PHY address, raddr = register address
wmdio <paddr> <raddr> [dev#]Write PHY address. paddr = PHY address, raddr = register address
phyaddr <addr> [dev#] Set the default PHY address to <addr>
When setting the EDCL IP number using the edcl command, the IP number whould have the numeric format:
edcl 192.168.0.66
5.20.2 Command line switches
The following command line switches are accepted:
-10m Start-up in 10 Mbit/s mode
-phyaddr <addr> Program the GRETH MDIO register to use the PHY with adddress <addr>.
AEROFLEX GAISLER AB
- 56 -
GRMON User’s Manual
5.21 USB 2.0 Device Controller (GRUSBDC)
The info sys command displays the core’s number of IN and OUT endpoints. If the core is configured with separate interrupts then the three different interrupt numbers will be displayed as well.
04.01:021 Gaisler Research GR USB 2.0 Device Controller (ver 0x0)
ahb master 4, irq 9
ahb: fff00400 - fff00800
2 IN endpts, 2 OUT endpts
5.21.1 Internal commands
The debug driver provides the following internal command: usbdc info Prints information about AHB interface, number of IN and OUT endpoints, interrupt configuration, and endpoint buffer sizes.
5.22 L2-Cache Controller (L2C)
The info sys command displays the cache configuration.
01.01:04b Gaisler Research L2-Cache Controller (ver 0x0)
ahb master 1
ahb: 40000000 - 80000000
ahb: ff400000 - ff800000
ahb: f0000000 - f0100000
L2C: 2-ways, setsize = 256kbytes
5.22.1 Internal commands
The debug driver provides the following internal command: l2cache lookupaddr Prints the data and status of a cache line if addr generates a cache hit.
l2cache showdata [way] [count] [start] Prints the data of count cache line starting at cache line start.
l2cache showtag [count] [start] Prints the tag of count cache line starting at cache line start.
l2cache [enable|disable] l2cache wt [enable|disable] l2cache hprot [enable|disable] l2cache ft [enable|disable] l2cache flushall [mode] l2cache flushmem [addr] [mode]
To enable or disable the cache.
To enable or disable write-through.
To enable or disable support for the HPROT signal.
To enable or disable the EDAC protection.
Perform a cache flush to all cache lines using a flush mode.
Perform a cache flush to the cache lines with a cache hit for
addr using a flush mode.
l2cache flushdirect [addr] [mode] l2cache invalidate l2cache flushinvalidate l2cache hit l2cache status
Perform a cache flush to the cache lines addressed with addr using a flush mode.
Invalidate all cache lines.
Flush all data to memory and invalidate all cache lines.
Prints the hit rate statistics.
Prints the status and configuration register.
AEROFLEX GAISLER AB
l2cache checktag l2cache checkdata [dirty] l2cache mtrr [register] [value] l2cache error l2cache error reset l2cache error inject l2cache error [wcb|wtcb] [value]
- 57 -
GRMON User’s Manual
Perform a check for illegal tags.
Perform a check for unmatched data in cache and memory.
With the dirty switch, all dirty cache lines is printed.
Show and set the MTRR registers.
Show error status
Reset error status
Inject error on next suitable access
Set EDAC checkbits for data or tag
5.23 MIL-STD-1553B Interface (GR1553B)
The info sys command displays the enabled parts of the core, and the configured codec clock frequency:
05.01:04d Gaisler Research MIL-STD-1553B Interface (ver 0x0)
ahb master 5, irq 3
apb: 80000a00 - 80000b00
features: BC RT BM, codec clock: 20 MHz
5.23.1 Internal commands
The debug driver for GR1553B provides the following internal commands: mil status
mil bcx addr [count]
mil bmx addr [count]
mil bmlog [count] [logaddr]
Displays core status
Prints BC descriptor contents and result values.
Prints BM log entries from the given memory address.
Prints latest entries from currently running BM log.
mil get rtaddr subaddr [count] Perform an RT-to-BC transfer and display the result
mil getm rtaddr subaddr count memad Perform an RT-to-BC transfer and store the resulting data
mil put rtaddr subaddr count word [word ...]Perform a BC-to-RT transfer
mil putm rtaddr subaddr count memaddr Perform a BC-to-RT transfer from memory
mil buf bufaddr [coreaddr]
mil bufmode [ keep | restore ] mil halt mil resume
Set address of temporary buffer
Select if temporary buffer should be kept or restored
Stop the BC,RT and BM
Resume core operation after mil halt
mil lbtest rt rtaddr[bufaddr] [coreaddr] Runs RT part of loop-back test
mil lbtest bc rtaddr[bufaddr] [coreaddr] Runs BC part of loop-back test
5.23.2 Examining data structures
The mil bcx and mil bmx commands prints the contents of memory interpreted as BC descriptors or BM entries, in human readable form: grlib> mil bcx 0x40000400 10
Addr TType RTAddr:SA WC Bus Tries SlTime TO Options Result Stat BufPtr
AEROFLEX GAISLER AB
- 58 -
GRMON User’s Manual
========== ===== =========== == === ======= ====== == ======= ======= ==== ========
0x40000400 BC-RT 01:30 29 A 01:Same 0 14 s [Not written] 40000000
0x40000410 RT-BC 01:30 29 A 01:Same 0 14 s [Not written] 40000040
0x40000420 BC-RT 01:30 30 A 01:Same 0 14 s [Not written] 40000000
0x40000430 RT-BC 01:30 30 A 01:Same 0 14 s [Not written] 40000040
0x40000440 BC-RT 01:30 31 A 01:Same 0 14 s [Not written] 40000000
0x40000450 RT-BC 01:30 31 A 01:Same 0 14 s [Not written] 40000040
0x40000460 BC-RT 01:30 32 A 01:Same 0 14 s [Not written] 40000000
0x40000470 RT-BC 01:30 32 A 01:Same 0 14 s [Not written] 40000040
0x40000480 : SUSPEND
0x40000490 [Invalid transfer ] A 01:Same 0 14 OK 0 0000
5.23.3 Data transfers
If the GR1553B core is BC capable, you can perform data transfers directly from the GRMON command line.
The commands exist in two variants: mil get and mil put that specify the data directly on the command line and through the terminal, and mil getm and mil putm that sends/receives data to an address in RAM.
In order to perform BC data transfers, you must have a temporary buffer in memory to store descriptors and data, see mil buf.
These commands use the asynchronous scheduling feature of the core, which means that the command can be performed even if a regular BC schedule is running in parallel. The transfer will be performed while the primary schedule is idle without affecting the schedule. In most cases it can even be run with BC software active in the background.
If the primary schedule blocks the asynchronous transfer for more than two seconds, the transfer will be aborted and an error message is printed. This can happen if the running schedule does not have any slack, or if it is stuck in suspended state or waiting for a sync pulse with no previous slot time left. In this case, you need to stop the ordinary processing (see mil halt) and retry the transfer.
5.23.4 Temporary data buffer
Many of the mil subcommands need a temporary data buffer in order to do their work. The address of this buffer is set using the mil buf command and defaults to 0x40000000.
By default the driver will read out the existing contents and write it back after the command is done, this can be changed using the mil bufmode command.
If the core is on a different bus where the RAM is at another address range, the scratch area address in the core’s address space should be given as an additional coreaddr argument to the mil buf command.
5.23.5 Halting and resuming
The mil halt command will stop and disable the RT,BC and BM parts of the core, preventing them from creating further DMA and 1553 bus traffic during debugging. Before this is done, the current enable state is stored, which allows it to later be restored using mil resume. The core is halted gracefully and the command will wait for current ongoing transfers to finish.
The state preserved between mil halt and mil resume are:
• BC schedules’ (both primary and async) states and next positions. If schedule is not stopped, the last transfer status is also preserved (as explained below)
• BC IRQ ring position
AEROFLEX GAISLER AB
- 59 -
GRMON User’s Manual
• RT address, enable status, subaddress table location, mode code control register, event log size and position
• BM enable status, BM filters, BM ringbuffer pointers, time tag setup.
State that is not preserved is:
• IRQ set/clear status
• BC schedule time register and current slot time left.
• RT bus words and sync register
• RT and BM timer values
• Memory contents, descriptors, etc.
For the BC, some extra handling is necessary as the last transfer status is not directly accessible via the register interface. In some cases, the BC must be probed for the last transfer status by running a schedule with conditional suspends. This requires a temporary buffer, and the address setup with mil buf will be used for this purpose.
5.23.6 Loop-back test
The debug driver contains a loop-back test command mil lbtest for testing 1553 transmission on both buses between two devices. In this test, one of the devices is configured as RT with a loop-back subaddress 30. The other device is configured as BC, sends and receives back data with increasing transfer size up to the maximum of 32 words.
The mil lbtest command needs a 16K RAM scratch area, which is either given as extra argument or selected using the mil buf command as described in the above section.
Before performing the loop-back test, the routine performs a test of the core’s internal time base, by reading out the timer value at a time interval, and displays the result. This is to quickly identify if the clock provided to the core has the wrong frequency.
In the RT case, the command first configures the RT to the address given and enables subaddress 30 in loopback mode with logging. The RT event log is then polled and events arriving are printed out to the console. The command exits after 60 seconds of inactivity.
In the BC case, the command sets up a descriptor list with alternating BC-to-RT and RT-to-BC transfers of increasing size. After running through the list, the received and transmitted data are compared. This is looped twice, for each bus.
If the BM is available in the core, it is setup before the test starts to run in parallel and log the 1553 traffic into the scratch area, offset 0x1000-0x3FFF. The BM is disabled when the command exits. Note that in order to inspect the logs after the tests mil bufmode needs to be set to keep.
5.24 LEON4 Statistics Unit (L4STAT)
The debug driver for L4STAT provides commands for reading and configuring the counters available in a
L4STAT core. The L4STAT core can be implemented with two APB interfaces. GRMON treats a core with dual interfaces the same way as it would treat a system with multiple instances of L4STAT cores. If several
L4STAT APB interfaces are found the l4stat command must be followed by an interface index reported by info
sys. The info sys command displays also displays information about the number of counters available and the number of processor cores supported:
02.01:047 Gaisler Research LEON4 Statistic Module (ver 0x0)
apb: e4080100 - e4080200
AEROFLEX GAISLER AB
- 60 -
GRMON User’s Manual
cpus: 4, counters: 4, i/f index: 2
If the core is connected to the DSU it is possible to count several different AHB events. In addition it is possible to apply filter to the signals connected to the L4STAT (if the DSU supports filter), see ’ahb filter perfor-
mance’ in “LEON2, LEON3 and LEON4 debug support unit (DSU) drivers” on page 41.
5.24.1 Internal commands
The debug driver for L4STAT provides the internal commands listed below. All commands must be prefixed with l4stat, for instance l4stat status. If several L4STAT interfaces are present in the system, the command must also include the interface index, for instance l4stat 2 status to select the interface in the info sys output listed above.
l4stat [ifc]
1
events
l4stat [ifc]
help
Displays all events that can be selected/counted
Displays available commands
l4stat [ifc]
status
l4stat [ifc]
status cnt
Displays status of all available counters
Clear specified counter
l4stat [ifc]
duration cnt1 lvl Enable the counter to save the maximum time the selected event has been at lvl.
l4stat [ifc]
duration cnt 0 Disable the duration count.
l4stat [ifc]
poll st sp int hold
Poll counters. See documentation in section 5.24.2.
l4stat [ifc]
runpoll st sp int
Poll counters when ’run’ command is issued, see section 5.24.2.
l4stat [ifc]
set cnt cpu event en Count event using counter cnt on processor cpu. The en argument is optional. If en is left out or set to 1 the counter will be enabled.
The ’set’ command is used to set up counting for a specific event. All allowed values for the event parameters are listed with ’l4stat events’. The number and types of events may vary between systems. Below is an example using counter one to count instruction cache misses on processor 0: grlib> l4stat 2 events
... events are listed ...
grlib> l4stat 2 set 1 0 icmiss
cnt2: icache miss on cpu/AHB 0 grlib> l4stat 2 status
0: counter disabled
1: cpu0 icache miss 0
5.24.2 Polling
The L4STAT debug driver provides two modes that are used to continuously sample L4STAT counters. The driver will print out the latest read value(s) together with total accumulated amount(s) of events while polling.
A poll operation can either be started directly or be deferred until the run command is issued. In both cases,
1. The ’ifc’ (interface index) should only be specified when more then one L4STAT APB interface is present on the system.
AEROFLEX GAISLER AB
- 61 -
GRMON User’s Manual counters should first be configured with the type of event to count. When this is done, one of the two following commands can be issued: l4stat poll st sp int hold -or- l4stat runpoll st sp int
The behaviour of the first command, l4stat poll, depends on the hold argument. If hold is 0 or not specified, the specified counter(s) (st - sp) will be enabled and configured to be cleared on read. These counters will then be polled with an interval of int seconds. After each read, the core will print out the current and accumulated values for all counters. If the hold argument is 1, GRMON will not initialize the counters. Instead the first specified counter (st) will be polled. When counter st is found to be enabled the polling operating will begin. This functionality can be used to, for instance, let software signal when measurements should take place.
Polling ends when at least one of the following is true: User pressed CTRL+C (SIGINT) or counter st becomes disabled. When polling stops, the debug driver will disable the selected counter(s) and also disable the automatic clear feature.
The second command, l4stat runpoll, is used to couple the poll operation with the run command. When l4stat
runpoll st sp int has been issued, counters st - sp will be polled after the run command is given. The interval argument in this case does not specify the poll interval seconds but rather in terms of iterations when GRMON polls the Debug Support Unit to monitor execution. A suitable value for the int argument in this case depends on the speed of the host computer, debug link and target system.
Below is an transcript from a GRMON session where a Linux image is loaded and run: grlib> l4stat 2 set 0 0 icmiss 0
cnt0: Configuring icache miss on cpu/AHB 0 grlib> l4stat 2 set 1 0 dcmiss 0
cnt1: Configuring dcache miss on cpu/AHB 0 grlib> l4stat 2 set 2 1 icmiss 0
cnt2: Configuring icache miss on cpu/AHB 1 grlib> l4stat 2 set 3 1 dcmiss 0
cnt3: Configuring dcache miss on cpu/AHB 1 grlib> l4stat 2 st
0: cpu0 icache miss counter disabled
1: cpu0 dcache miss counter disabled
2: cpu1 icache miss counter disabled
3: cpu1 dcache miss counter disabled grlib> l4stat 2 runpoll 0 3 5000
Setting up callbacks so that polling will be performed during 'run' grlib> load ~/image_ngmp1_ipi13_nfs2.ram
section: .stage2 at 0x0, size 10240 bytes section: .vmlinux at 0x4000, size 4209312 bytes total size: 4219552 bytes (1.5 Mbit/s) read 13545 symbols entry point: 0x00000000 grlib> run
Configuring counters 0 to 3 to be cleared on read
Clearing and restarting counter..
AEROFLEX GAISLER AB
- 62 -
GRMON User’s Manual
Polling...
time counter current read current rate total total rate
5 0 280388 57219 280388 57219
5 1 4640030 946892 4640030 946891
5 2 109183 22281 109183 22281
5 3 549011 112037 549011 112037
10 0 188913 37911 469301 47484
10 1 8156888 1636930 12796918 1294799
10 2 56010 11240 165193 16714
10 3 8996 1805 558007 56459
<output removed>
50 0 132558 26208 1466882 29257
50 1 10653 2106 16652288 332129
50 2 11849 2343 352783 7036
50 3 2503 495 1381366 27551
^C
Interrupt!
stopped at 0xf0015cbc grlib>
And alternative to coupling polling to the run command is to break execution, issue detach and then use the
l4stat poll command.
There are a few items that may be worth considering when using poll and runpoll:
• All counters are not read in the same clock cycle. Depending on the debug link used there may be a significant delay between the read of the first and the last counter.
• Measurements are timed on the host computer and reads experience jitter from several sources.
• A counter may overflow after 2
32
target clock cycles. The poll period (interval) should take this into account so that counters are read (and thereby cleared) before an overflow can occur.
• Counters are disabled when polling stops
• l4stat runpoll is only supported for uninterrupted run. break and cont may disrupt measurements.
• If the L4STAT core has two APB interfaces, initialize it via the interface to which traffic causes the least disturbance to other system bus traffic.
5.25 I/O Memory Management Unit (GRIOMMU)
The debug driver for GRIOMMU provides commands for configuring the core, reading core status information, diagnostic cache accesses and error injection to the core’s internal cache (if implemented). The debug driver also has support for building, modifying and decoding Access Protection Vectors and page table structures located in system memory.
The info sys command displays information about available protection modes and cache configuration:
04.01:04f Gaisler Research IOMMU (ver 0x0)
ahb master 4, irq 1
ahb: f0720000 - f0720200
Protection mode: Access Protection Vector
msts: 12, grps: 4, accsz: 128 bits
APV cache lines: 16, line size: 16 bytes
AEROFLEX GAISLER AB
- 63 -
GRMON User’s Manual
5.25.1 Internal commands
The debug driver for GRIOMMU provides the internal commands listed below. All commands must be prefixed with iommu, for instance iommu disable.
apv allow <base> <start> <stop>
apv build <base> <prot>
apv decode <base>
apv deny <base> <start> <stop>
cache addr <addr> <grp>
cache errinj <addr> d [byte]
cache errinj <addr> t [byte] cache flush
cache show <line> [cnt]
cache write <line> <[data]> <tag> disable enable group
group <num>
group <num> <base> <p> <ag> info
Modifies APV at address base to allow accesses to [start:stop]
Build APV at address base with all bits set to prot
Decodes APV at address base
Modifies APV at address base to deny accesses to [start:stop]
Looks up I/O address addr belonging to group grp in cache
Injects data parity error for byte byte in cache line addr
Injects tag parity error for tag byte byte in tag RAM at addr
Performs cache flush
Shows cnt cache lines, starting at line
Writes cache line with specified data and tag
Disables core
Enables core
Displays group configuration registers
Displays selected group configuration register
Assigns selected group configuration register
Displays core configuration information mstbmap
mstbmap<num>
mstbmap <mst> <ahb> mstmap
mstmap<num>
mstmap <mst> <grp>
pagetable build <base> <w> <v>
Displays master AHB interface assignmens
Displays AHB interface assignment for specified master
Assigns selected master mst to AHB interface ahb
Displays master group assignments
Displays group assignment for specified master
Assigns selected master mst to group grp
Create PT starting at base with writeable set to w and valid bit set to v.
pagetable lookup <base> <io> Look up IO address io in PT starting at base
pagetable modify <b> <i> <p> <w> <v> Modify existing PT at b, translate address i to p.
set <field> status
unset <field>
Writable bit set to w, Valid bit set to v
Sets fields in Control register, issue help set for more info
Displays core status information
Unsets fields in Control register, issue help unset for more info
5.26 Memory Scrubber (MEMSCRUB)
The info sys command displays information on the configured burst length of the scrubber.
01.01:057 Gaisler Research AHB memory scrubber (ver 0x0)
ahb master 1, irq 28
AEROFLEX GAISLER AB
- 64 -
GRMON User’s Manual
ahb: ffe01000 - ffe01100
burst length: 32 bytes
5.26.1 Internal commands
The debug driver for the Memory Scrubber core (MEMSCRUB) provides commands for reading the core’s status, and performing some basic operations such as clearing memory.
scrub scrub status scrub ack
scrub clear start end [value]
Alias for scrub status
Display status and configuration
Clear error and done status and then display
Set scrubber to clear a memory area to a 32-bit value (default 0)
scrub pattern word1 [word2 ...] Write pattern into scrubber’s initialiazation register
scrub init start end Set scrubber to initialize a memory area scrub rst Clear status and restore config as after reset
5.27 Multi-processor interrupt controller (IRQMP/IRQ(A)MP)
The debug driver for IRQMP provides commands for forcing interrupts and reading core status information.
The debug driver also supports ASMP and other extension provided in the IRQ(A)MP core.
The info sys command displays information about the core’s memory map:
04.01:00d Gaisler Research Multi-processor Interrupt Ctrl (ver 0x3)
apb: f0004000 - f0008000
5.27.1 Internal commands
The debug driver for IRQMP/IRQ(A)MP provides the internal commands listed below.
irq boot <mask>
irq ctrl <n>
irq force <n> irq help irq reg
irq route <p> <n> irq routing irq tstamp irq wdog
Boot CPUs specified by mask (for IRQ(A)MP)
Show/select controller register interface to use (for IRQ(A)MP)
Force interrupt n
Print help message
Display some of the core registers
Route processor p to internal controller n (for IRQ(A)MP)
Decode controller routing (for IRQ(A)MP)
Show timestamp registers (for IRQ(A)MP)
Decode Watchdog control register (for IRQ(A)MP)
AEROFLEX GAISLER AB
- 65 -
GRMON User’s Manual
6 FLASH programming
6.1 CFI compatible Flash PROM
GRMON supports programming of CFI compatible flash PROM attached to the external memory bus of
LEON2 and LEON3 systems. Flash programming is only supported if the target system contains one of the following memory controllers MCTRL, FTMCTRL, FTSRCTRL or SSRCTRL. The PROM bus width can be 8-,
16- or 32-bit. It is imperative that the prom width in the MCFG1 register correctly reflects the width of the external prom. To program 8-bit and 16-bit PROMs, the target system must also have at least one working
SRAM or SDRAM bank.
The following flash programming commands are provided: flash
flash blank [addr | all]
flash erase [addr | all]
flash load <file>
Print the on-board flash memory configuration
Check that the flash memory is blank, i.e. can be re-programmed. The complete flash memory (all) can be checked, or an address range can be given
(e.g. ‘flash erase 0x1000 0x8000’).
Erase a flash block at address addr, or the complete flash memory (all). An address range is also support,e.g. ‘flash erase 0x1000 0x8000’.
Program the flash memory with the contents file. Recognized file formats are
ELF and srecord.
flash lock [addr | all] Lock a flash block at address addr, or the complete flash memory (all). An address range is also support, e.g. ‘flash lock 0x1000 0x8000’.
flash lockdown [addr | all] Lock-down a flash block at address addr, or the complete flash memory
(all). An address range is also support, e.g. ‘flash lockdown 0x1000
0x8000’. Work only on Intel-style devices which supports lock-down.
flash query flash status
Print the flash query registers
Print the flash lock status register
flash unlock [addr | all] Unlock a flash block at address addr, or the complete flash memory (all). An address range is also support, e.g. ‘flash unlock 0x1000 0x8000’.
flash write <addr> <data> Write a 32-bit data word to the flash at address addr.
A typical command sequence to erase and re-program a flash memory could be: flash unlock all flash erase all flash load file.exe
flash lock all
6.2 SPI memory device
GRMON supports programming of SPI memory devices that are attached to a SPICTRL or SPIMCTRL core.
The flash programming commands are available through the cores’ debug drivers. To issue a SPI flash command the commands listed below must be prefixed with the core debug driver name. If the memory device is attached to a SPICTRL core, all flash commands start with spi flash. If the memory device is attached to a
SPIMCTRL core, all flash commands start with spim flash, see below for examples.
AEROFLEX GAISLER AB
- 66 -
GRMON User’s Manual flash flash detect
flash dump <addr> <len> <file> Dumps len bytes starting at addr to a file. addr is the address presented to the device and does not correspond to a possible AMBA mapping of the memory device.
flash erase flash fast
Erases all of memory device. All devices do not require/support an erase operation.
Enables or disables FAST READ command (memory device may not support this).
flash load <file>
flash select [ index | ]
Prints a list of available commands.
Tries to auto detect type of SPI memory device
Load the contents of file into the memory device. Any address ranges in the file are fed used to directly address the memory device.
Selects memory device type. If index is not specified, a list of the supported devices is displayed.
flash set [...] flash show flash status
flash ssval [value]
flash strict [on|off]
flash verify <file> flash wrdi flash wren
flash help <command>
Specifies custom set of parameters for memory device. Issue flash set to see a list of the required parameters.
Displays current memory device configuration
Show memory device status
Show/set slave select value to be used when communicating via SPICTRL.
Show/set strict communication mode. Set to "on" if programming fails.
Verifies that data in file file matches data in memory device.
Issue write disable instruction
Issue write enable instruction
Displays command list or additional information about a specific command.
When interacting with a memory device via SPICTRL the driver assumes that the clock scaler settings have been initialized to attain a frequency that is suitable for the memory device. When interacting with a memory device via SPIMCTRL all commands are issued with the normal scaler setting unless the alternate scaler has been enabled.
A command sequence to dump the data of a SPI memory device connected via SPICTRL could be: spi set div16 spi flash select 1 spi flash dump 0 32 32bytes.srec
The first command initializes the SPICTRL clock scaler. The second command selects a SPI memory device configuration and the third command dumps the first 32 bytes of the memory device to the file 32bytes.srec. A command sequence to dump the data of a SPI memory device connected via SPIMCTRL could be: spim flash detect
spim flash dump 0 128 128bytes.srec
The first command tries to auto-detect the type of memory device. If auto-detection is successful GRMON will report the device selected. The second command dumps the first 128 bytes of the memory device to the file
128bytes.srec.
AEROFLEX GAISLER AB
- 67 -
GRMON User’s Manual
7 Error injection
All RAM blocks (cache and register-file memory) in LEON3-FT are Single Event Upset (SEU) protected.
Error injection function emulates SEU in LEON3-FT memory blocks and lets the user test the fault-tolerant operation of LEON3-FT by inserting random bit errors in LEON3-FT memory blocks during program execution. An injected error flips a randomly chosen memory bit in a one of the memory blocks, effectively emulating an SEU. The user defines error rate and chooses between two error distribution modes. GRMON can also perform error correction monitoring and report error injection statistics including number of detected and injected errors and error coverage.
Error injection is available when GRMON is connected using JTAG, PCI or Ethernet communication interface and can not be used together with “-u” switch (UART1 in loop-back mode). Error injection function is only available in the professional version of GRMON.
Following error injection commands are available: ei un nr t ei av r
Enable error injection, uniform error distribution mode. nr errors are inserted during the time period of t minutes. Errors are uniformly distributed over the time period.
Enable error injection, average error rate mode. Errors will be inserted during the whole program execution. Average error rate is r errors per second.
ei dis Disable error injection.
ei log log_file Enable error injection. The error injection log is saved in file log_file.
ei stat ei stat en ei stat dis
Show error injection statistics.
Enable error injection statistics. When enabled, the SEU correction counters are modified.
This option should not be used with software which itself monitors SEU error counters.
Disable error injection statistics.
jupiter:/tmp>grmon -i -grlib -jtag
GRMON LEON debug monitor v1.1.3
Copyright (C) 2004,2005 Gaisler Research - all rights reserved.
For latest updates, go to http://www.gaisler.com/
Comments or bug-reports to [email protected]
using JTAG cable on parallel port
JTAG chain: ETH-PHY xc2v3000 xc2v3000 xc18v04 xc18v04 xc18v04
initialising .........
detected frequency: 41 MHz
Component Vendor
LEON3 SPARC V8 Processor Gaisler Research
AHB Debug UART Gaisler Research
AHB Debug JTAG TAP Gaisler Research
LEON2 Memory Controller European Space Agency
AHB/APB Bridge Gaisler Research
LEON3 Debug Support Unit Gaisler Research
Generic APB UART Gaisler Research
Multi-processor Interrupt Ctrl Gaisler Research
AEROFLEX GAISLER AB
- 68 -
Modular Timer Unit Gaisler Research
Use command ’info sys’ to print a detailed report of attached cores grmon> lo rtems-tasks section: .text at 0x40000000, size 116640 bytes section: .data at 0x4001c7a0, size 2720 bytes total size: 119360 bytes (310.6 kbit/s) read 520 symbols entry point: 0x40000000 grmon> ei un 100 1
Error injection enabled
100 errors will be injected during 1.0 min grmon> ei stat en
Error injection statistics enabled grmon> run
Program exited normally.
grmon> ei stat
itag : 5/ 5 (100.0%) idata: 5/ 18 ( 27.8%)
dtag : 1/ 1 (100.0%) ddata: 4/ 22 ( 18.2%)
IU RF : 4/ 10 ( 25.0%)
FPU RF: 0/ 4 ( 0.0%)
Total : 19/ 60 ( 31.7%) grmon>
GRMON User’s Manual
AEROFLEX GAISLER AB
- 69 -
GRMON User’s Manual
8 SVF programming
GRMON can be used to replay Xilinx-Impact generated .svf files. Because jtag reading is currently slow in
GRMON you might want to avoid the "verify" option when generating the .svf file.
svfparse <file> Parse a .svf file into the internal buffer.
svfexecute Execute the previously parsed .svf file.
svfinfo Print out the previously parsed .svf file.
To start GRMON on a board that is not currently programmed, use the -leon2 option to get a fake setup. After that program the board and restart.
Note: To program the Spartan FPGA of the gr-xc3s-1500 board the "Configuration Option" "Use HIGH instead of BYPASS" has to be enabled in the preferences menu.
AEROFLEX GAISLER AB
- 70 -
GRMON User’s Manual
9 Extending GRMON
9.1 Loadable command module
GRMON can be extended with custom commands by creating a loadable command module. This module will have read and write access to the AHB bus and registers. The module should export a pointer of type
UserCmd_T, called UserCommands, e.g.:
UserCmd_T *UserCommands = &CommandExtension;
UserCmd_T is defined as: typedef struct
{
void *lib;
/* Functions exported by grmon */ int (*MemoryRead) (void *lib, unsigned int addr, unsigned char *data, unsigned int length); int (*MemoryWrite)(void *lib, unsigned int addr, unsigned char *data, unsigned int length);
void (*GetRegisters)(void *lib, unsigned int registers[]);
void (*SetRegisters)(void *lib, unsigned int registers[]);
void (*dprint)(char *string);
/* Functions provided by user */
int (*Init)();
int (*Exit)();
int (*CommandParser)(int argc, char *argv[]);
char **Commands;
int NumCommands;
} UserCmd_T;
The first five entries are function pointers that are provided by GRMON when loading the module
• MemoryRead implements an AHB read on the target system. The AHB address is passed in addr, while the read data is returned in the *data pointer. The length parameter defines the number of bytes to read.
• MemoryWrite implements an AHB write on the target system. The AHB address is passed in addr, while *data should point to the data to be written. The length parameter defines the number of bytes to be written. The write length should be a multiple of 4.
• GetRegisters gets the processor registers. See thet grmon.h include file for register definitions.
• SetRegisters sets the processor registers. See thet grmon.h include file for register definitions.
• dprint prints a string to the GRMON console
The void pointer argument should be supplied with the pointer lib
CommandExtension.MemoryWrite(CommandExtension.lib, ...);
The five last entries are to be implemented by the user:
• Init and Exit are called when entering and leaving a GRMON target.
• CommandParser are called from GRMON before any internal parsing is done. This means that you can override internal GRMON commands. On success CommandParser should return 0 and on error the return value should be > 200. On error, GRMON will print out the error number for diagnostics.
argv[0] is the command itself and argc is the number of tokens, including the command, that is supplied.
• Commands should be a list of available commands. (used for command completion)
AEROFLEX GAISLER AB
- 71 -
GRMON User’s Manual
• NumCommands should be the number of entries in Commands. It is crucial that this number matches the number of entries in Commands. If NumCommands is set to zero, no command completion will be done.
Compile the command module to a library as follows gcc -fPIC -c commands.c
gcc -shared commands.o -o commands.so
Load the command module with the -ucmd option grmon -ucmd commands.so
A simple example of a command module is supplied with the professional version of GRMON.
9.2 Custom DSU communications module
In addition to the supported DSU communication interfaces (Serial, JTAG, ETH and PCI), it is possible for the user to add a custom interface using a loadable module. The custom DSU interface must provide functions to read and write data on the target system’s AHB bus. The custom interface exports a structure with the following definition: struct ioif {
int (*wmem) (unsigned int addr, const unsigned int *data, int len);
int (*gmem) (unsigned int addr, unsigned int *data, int len);
int (*open) (char *device, int baudrate, int port);
int (*close) ();
int (*setbaud) (int baud, int pp);
int (*init) (char* arg);
};
The loadable module should export a variable called DsuUserBackend of the type ioif: struct ioif my_io = {my_wmem, my_gmem, my_open, my_close, my_baud, my_init}; struct ioif *DsuUserBackend = &my_io;
When GRMON is started, the start-up switch ‘-dback my_io.so’ should be used to load the module with the custom interface. The DsuUserBackend structure will then replace the built-in DSU communications interfaces. The members in the ioif structure are defined as follows:
int (*wmem) (unsigned int addr, const unsigned int *data, int len);
Pointer to a function that performs one or more 32-bit writes on the AHB bus. The parameters indicate the
AHB (start) address, a pointer to the data to be written, and the number of words to be written. If the len parameter is zero, no data should be written. The return value should be the number of words written.
int (*gmem) (unsigned int addr, unsigned int *data, int len);
Pointer to a function that reads one or more 32-bit words from the AHB bus. The parameters indicate the AHB
(start) address, a pointer to where the read data should be stored, and the number of words to be read. If the len parameter is zero, no data should be read. The return value should be the number of words read.
int (*open) (char *device, int baudrate, int port);
Not used, provided only for backwards compatibility.
int (*close) ();
Called on GRMON exit.
AEROFLEX GAISLER AB
- 72 -
GRMON User’s Manual
int (*setbaud) (int baud, int pp);
Called when the GRMON ‘baud’ command is given. The baud parameter indicates the new baud rate. Can be ignored if not applicable.
int (*init) (char* arg);
Called on GRMON start-up. The parameter arg is set using the GRMON start-up switch ‘-dbackarg arg’. This allows to send arbitrary parameters to the DSU interface during start-up.
The loadable module should be compiled into a library as follows: gcc -fPIC -c my_io.c
gcc -shared my_io.o -o my_io.so
GRMON can the be started with: grmon -dback my_io.so -dbackarg XXX
An example module (my_io.c) is provided with the professional version of GRMON.
AEROFLEX GAISLER AB
- 73 -
APPENDIX
APPENDIX A: GRMON Command description
A.1
GRMON built-in commands
Command Description batch [-echo] <batchfile>
Execute a batch file of GRMON commands from <batchfile>. Echo commands if -echo is specified.
Change DSU baud rate.
baud <rate> disassemble [addr [cnt]] Disassemble [cnt] instructions at [addr].
dump <start> <end> [filename] Dump target memory in address range [start,end] to srecord file.
echo exit help [cmd] info [drv | libs | reg | sys]
Echo string in monitor window.
Alias for ‘quit’, exits monitor.
Show available commands or usage for specific command.
Show debug drivers, libraries, system register or system configuration load <file> mem [addr] [count] shell <command> symbols [symbol_file] quit verify <file> version wmem <addr> <data>
Load a file into memory. The file should be in ELF32, srecords or a.out
format.
Examine memory at [addr] for [count] bytes.
Execute a shell command.
Show symbols or load symbols from file.
Exit GRMON and return to invoker (the shell).
Verify memory contents against file.
Show version.
Write <data> to memory at address <addr>.
Table 1: GRMON built-in commands
AEROFLEX GAISLER AB
- 74 -
APPENDIX
A.2
LEON2/3/4 DSU commands
Command Description ahb [trace_length] break [addr] bwatch <addr> [delay] [break] bt cont cp dcache delete <bp> detach float gdb [port] go hbreak [addr] hist [trace_length] icache inst [trace_length] inst filter inst filter [selection] leon mmu profile [0|1] register [reg|win] [val] run stack <addr> step [n] tm [ahb | proc | both | none]
Table 2: LEON2/3/4 DSU commands
Show AHB trace.
Print breakpoints or add breakpoint if addr is supplied. Text symbols can be used instead of an address.
Add a buswatch at address or symbol addr, with optional delay. Break will stop execution when buswatch is hit.
Print backtrace.
Continue execution.
Show registers in co-processor (if present).
Show data cache.
Delete breakpoint ‘bp’.
Resume execution but disconnect grmon from peocessor.
Display FPU registers.
Connect to the GNU debugger (GDB).
Start execution at <addr> without initialisation.
Print breakpoints or add hardware breakpoint.
Show trace history.
Show instruction cache
Show traced instructions.
Show instruction trace buffer filter settings (only available in some DSU4 implementations).
Set instruction trace buffer filter settings (only available in some DSU4 implementations).
Show LEON registers.
Print mmu registers.
Enable/disable simple profiling. No arguments shows current profiling statistics.
Show/set integer registers (or windows, e.g. ’re w2’)
Run loaded application.
Set stack pointer for next run.
Single step one or [n] times.
Select trace mode.
AEROFLEX GAISLER AB
- 75 -
APPENDIX
Command Description va <addr> version watch [addr]
Performs a virtual-to-physical translation of address.
Show version.
Print or add watchpoint.
Table 2: LEON2/3/4 DSU commands
A.3
FLASH programming commands
Command Description flash flash disable flash enable flash erase [addr]|all flash load <file> flash lock [addr]|all flash lockdown [addr]|all flash query flash status flash unlock [addr]|all flash write [addr] [data]
Table 3: FLASH programming commands
Print the detected flash memory configuration.
Disable writes to flash memory.
Enable writes to flash memory.
Erase flash memory blocks.
Program file into flash memory
Lock flash memory blocks.
Lockdown flash memory blocks.
Print the flash memory query register contents.
Print the flash memory block lock status.
Unlock flash memory blocks.
Write single data value to flash address.
AEROFLEX GAISLER AB
- 76 -
APPENDIX
APPENDIX B: License key installation
B.1
Installing HASP Device Driver
GRMON is licensed using a HASP USB hardware key. Before use, a device driver for the key must be installed. The latest drivers can be found at www.aladdin.com or www.gaisler.com. The installation is described below.
B.1.1
On a Windows NT/2000/XP host
The HASP device driver is installed using the installer HASPUserSetup.exe located in hasp/windows/driver directory on the GRMON CD. It will automatically install the required files.
Note: Administrator privileges are required to install the HASP device driver under Windows NT/2000/XP.
B.1.2
On a Linux host
The linux HASP driver consists of aksusbd daemon. It is contained in the hasp/linux/driver on the GRMON
CD. The driver comes in form of RPM packages for Redhat and Suse linux distributions. The packages should be installed as follows:
Suse systems: rpm -i aksusbd-suse-1.8.1-2.i386.rpm
Redhat systems: rpm -i aksusbd-redhat-1.8.1-2.i386.rpm
The driver daemon can then be started by re-booting the most, or executing:
/etc/rc.d/init.d/aksusbd start
Note: All described action should be executed as root.
On other linux distributions, the driver daemon will have to be started manually. This can be done using the
HDD_Linux_dinst.tar.gz, which also contains instruction on how to install and start the daemon.
B.2
Node-locked license file
TSIM can also be licensed using a license file (node-locked license). If a node-locked license is used, the license file should be ~/license.dat, or ./license.dat, or it should be pointed to by the environment variable
GRMON_LICENSE_FILE.
AEROFLEX GAISLER AB
- 77 -
APPENDIX
APPENDIX C: Fixed Configuration file format
A fixed configuration file can be used to describe the target system instead of probing the plug&play information. The configuration file describes which IP cores are present on the target, and on which addresses they are mapped. The file contains one 11-column row per target IP core. The columns in each row define the following parameters: vendor ID, device ID, start address of AHB area 1, end address of AHB area1, start address of
AHB area 2, end address of AHB area 2, start address of AHB area 3, end address of AHB area 3, start address of APB area, end address of APB area, assigned interrupt.
The vendor and device ID for the various LEON2 and LEON3 IP cores can be found in grcommon.h which is supplied with the GRMON package.
Below is an example configuration file for a typical LEON2 system. To use a fixed configuration file, GRMON should be started with
-cfg <file>
.
# GRMON LEON2 config file
#vendor dev ahbstart ahbend apbstart apbend irq
4 f 0 20000000 20000000 40000000 40000000 80000000 80000000 80000010 0
4 2 0 0 0 0 0 0 80000014 80000014 0
4 8 0 0 0 0 0 0 80000024 80000028 0
4 6 0 0 0 0 0 0 80000040 80000070 0
4 7 0 0 0 0 0 0 80000070 80000080 3
4 7 0 0 0 0 0 0 80000080 80000090 2
4 5 0 0 0 0 0 0 80000090 800000A0 0
4 9 0 0 0 0 0 0 800000A0 800000AC 0
1 7 0 0 0 0 0 0 800000c0 800000d0 0
1 2 90000000 A0000000 0 0 0 0 0 0 0
AEROFLEX GAISLER AB
- 78 -
GRMON User’s Manual
APPENDIX D: JTAG Configuration File
Unknown JTAG devices causing GRMON JTAG chain initialization to fail can be defined in JTAG Configuration File. GRMON is started with -jtagcfg <JTAG configuration file> switch. JTAG Configuration file can not be used with Altera download cable (-altjtag). An example of JTAG configuration file is shown below:
# JTAG Configuration file
# Device name Device id Device id mask Instr. reg. length Dbg Interface Instr. 1 Instr. 2
xc2v3000 0x01040093 0x0fffffff 6 1 0x2 0x3
xc18v04 0x05036093 0x0ffeffff 8 0
ETH 0x103cb0fd 0x0fffffff 16 0
Each line consists of device name, device id, device id mask, instruction register length, debug interface and user instruction 1 and 2 fields, where:
• Device name
• Device id
String with device name
Device identification code
• Device id mask Device id mask is anded with the device id before comparing with the identification codes obtained from the JTAG chain. Device id mask allows user to define a range of identification codes on a single line, e.g. mask 0x0fffffff will define all versions of a certain device.
• Instruction register length
Length of the instruction register in bits
• Debug interface Set to 1 if the device implements JTAG Debug Link, otherwise 0.
• User Instr 1 Code of the instruction used to access JTAG Debug Link Address/Command
register (default is 0x2). Used only if Debug interface is set to 1.
• User Instr 2 Code of the instruction used to access JTAG Debug Link Data register (default is
0x3). Used only if Debug interface is set to 1.
AEROFLEX GAISLER AB
- 79 -
GRMON User’s Manual
APPENDIX E: USB-Blaster Driver setup for Linux
The Altera Quartus® II software uses the built-in USB drivers (usbfs) on Linux to access the USB-Blaster download cable. By default, root is the only user allowed to use usbfs. You must change the permissions on the ports before you can use the USB-Blaster download cable to access the JTAG DSU port via GRMON.
You must have system administration (root) privileges to configure the USB-Blaster download cable drivers.
E.1
Driver Setup on Linux
1. Add the following lines to the /etc/hotplug/usb.usermap file.
#
# Altera USB-Blaster
# usbblaster 0x03 0x09fb 0x6001 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 usbblaster 0x03 0x09fb 0x6002 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 usbblaster 0x03 0x09fb 0x6003 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0
2. Create a file named /etc/hotplug/usb/usbblaster and add the following lines to it.
#!/bin/sh
# USB-Blaster hotplug script
# Allow any user to access the cable chmod 666 $DEVICE
3. Make the /etc/hotplug/usb/usbblaster file executable.
$ chmod a+rx /etc/hotplug/usb/usbblaster
AEROFLEX GAISLER AB
Advertisement
Key features
- Read/write access to all system registers and memory
- Built-in disassembler and trace buffer management
- Downloading and execution of LEON applications
- Breakpoint and watchpoint management
- Remote connection to GNU debugger (GDB)
- Support for USB, JTAG, RS232, PCI, Ethernet and SpaceWire debug links
