ekko's blog

rk3568.cfg#

[!/usr/local/share/openocd/scripts/target/rk3568.cfg]

Copy

# SPDX-License-Identifier: GPL-2.0-or-later
reset_config trst_and_srst separate
if { [info exists CHIPNAME] } {
  set _CHIPNAME $CHIPNAME
} else {
  set _CHIPNAME rk3568
}

#
# Main DAP
#
if { [info exists DAP_TAPID] } {
   set _DAP_TAPID $DAP_TAPID
} else {
   set _DAP_TAPID 0x2ba01477
}

adapter driver jlink
adapter speed 12000
transport select swd

# declare the one SWD tap to access the DAP
swd newdap $_CHIPNAME cpu -expected-id $_DAP_TAPID -ignore-version
# create the DAP
dap create $_CHIPNAME.dap -chain-position $_CHIPNAME.cpu
target create $_CHIPNAME.ahb mem_ap -dap $_CHIPNAME.dap -ap-num 0
set _TARGETNAME $_CHIPNAME.lcore
# declare the 6 main application cores
set _smp_command ""

set $_TARGETNAME.base(0) 0x81004000
set $_TARGETNAME.base(1) 0x81005000
set $_TARGETNAME.base(2) 0x81006000
set $_TARGETNAME.base(3) 0x81007000
set $_TARGETNAME.cti(0) 0x81014000
set $_TARGETNAME.cti(1) 0x81015000
set $_TARGETNAME.cti(2) 0x81016000
set $_TARGETNAME.cti(3) 0x81017000


set _cores 4
for { set _core 0 } { $_core < $_cores } { incr _core 1 } {

    set _TARGETNAME $_CHIPNAME.lcore

    cti create cti$_core -dap $_CHIPNAME.dap -baseaddr [set $_TARGETNAME.cti($_core)] -ap-num 0

    target create \${_TARGETNAME}$_core aarch64 -dap $_CHIPNAME.dap -coreid  $_core -cti cti\$_core -dbgbase [set $_TARGETNAME.base($_core)]

    if { $_core != 0 } {
        ${_TARGETNAME}$_core configure -defer-examine
    } else {
        # uncomment to use hardware threads pseudo rtos
        # ${_TARGETNAME}$_core configure -rtos hwthread"
        ${_TARGETNAME}$_core configure -work-area-size 0x30000 -work-area-phys 0xff8c0000 \
                                -work-area-backup 0
    }
    set _smp_command "$_smp_command ${_TARGETNAME}$_core"
}
# Add the second flash bank.

#set QUADSPI 1
#set _FLASHNAME $_CHIPNAME.flash1
#flash bank $_FLASHNAME stmqspi 0 0x4000000 2 2 ${_TARGETNAME}0
#flash bank $_FLASHNAME fespi 0 0 0 0 ${_TARGETNAME}0 0xfe610000

target smp $_smp_command
targets rk3568.lcore0

本文主要以上述配置文件为例，讲解 [[openocd]] 每条配置命令的作用。

reset_config#

reset_config trst_and_srst separate

Command: reset_config mode_flag ...

This command displays or modifies the reset configuration of your combination of JTAG board and target in target configuration scripts.
该命令在目标配置脚本中显示或修改 JTAG 板和目标组合的复位配置。

Information earlier in this section describes the kind of problems the command is intended to address (see SRST and TRST Issues). As a rule this command belongs only in board config files, describing issues like board doesn’t connect TRST; or in user config files, addressing limitations derived from a particular combination of interface and board. (An unlikely example would be using a TRST-only adapter with a board that only wires up SRST.)
本节前面的信息描述了该命令要解决的问题类型（参见 SRST 和 TRST 问题）。一般来说，该命令仅适用于电路板配置文件，用于描述 board doesn't connect TRST 等问题；或适用于用户配置文件，用于解决接口和电路板的特定组合所带来的限制。(一个不太可能的例子是将仅连接 TRST 的适配器与仅连接 SRST 的电路板一起使用）。

The mode_flag options can be specified in any order, but only one of each type – signals, combination, gates, trst_type, srst_type and connect_type – may be specified at a time. If you don’t provide a new value for a given type, its previous value (perhaps the default) is unchanged. For example, this means that you don’t need to say anything at all about TRST just to declare that if the JTAG adapter should want to drive SRST, it must explicitly be driven high (srst_push_pull).
模式标志（mode_flag）选项可以任意顺序指定，但信号、组合、门、trst_type、srst_type 和 connect_type 每种类型一次只能指定一个。如果不为给定类型提供新值，其先前值（可能是默认值）将保持不变。例如，这意味着如果 JTAG 适配器要驱动 SRST，则必须明确地将其驱动为高电平（srst_push_pull），而无需对 TRST 做任何说明。

• signals can specify which of the reset signals are connected. For example, If the JTAG interface provides SRST, but the board doesn’t connect that signal properly, then OpenOCD can’t use it. Possible values are none (the default), trst_only, srst_only and trst_and_srst.
• 信号可以指定连接哪些复位信号。例如，如果 JTAG 接口提供 SRST，但电路板没有正确连接该信号，则 OpenOCD 无法使用它。可能的值有：无（默认值）、trst_only、srst_only 和 trst_and_srst。

> **Tip:** If your board provides SRST and/or TRST through the JTAG connector, you must declare that so those signals can be used.

• The combination is an optional value specifying broken reset signal implementations. The default behaviour if no option given is separate, indicating everything behaves normally. srst_pulls_trst states that the test logic is reset together with the reset of the system (e.g. NXP LPC2000, "broken" board layout), trst_pulls_srst says that the system is reset together with the test logic (only hypothetical, I haven’t seen hardware with such a bug, and can be worked around). combined implies both srst_pulls_trst and trst_pulls_srst.

• 该组合是一个可选值，指定损坏的复位信号实现。如果没有给出任何选项，则默认行为是单独的，表示一切正常。 srst_pulls_trst 表示测试逻辑与系统重置一起重置（例如 NXP LPC2000，“损坏的” 电路板布局），trst_pulls_srst 表示系统与测试逻辑一起重置（仅假设，我还没有看到硬件与这样的错误，并且可以解决）。组合意味着 srst_pulls_trst 和 trst_pulls_srst。

• The gates tokens control flags that describe some cases where JTAG may be unavailable during reset. srst_gates_jtag (default) indicates that asserting SRST gates the JTAG clock. This means that no communication can happen on JTAG while SRST is asserted. Its converse is srst_nogate, indicating that JTAG commands can safely be issued while SRST is active.

• SRST_gates_jtag （默认）表示断定 SRST 时，JTAG 时钟将被门控。这意味着当 SRST 被断言时，JTAG 上不会发生任何通信。其反义词是 srst_nogate，表示在 SRST 处于活动状态时，可以安全地发出 JTAG 命令。

• The connect_type tokens control flags that describe some cases where SRST is asserted while connecting to the target. srst_nogate is required to use this option. connect_deassert_srst (default) indicates that SRST will not be asserted while connecting to the target. Its converse is connect_assert_srst, indicating that SRST will be asserted before any target connection. Only some targets support this feature, STM32 and STR9 are examples. This feature is useful if you are unable to connect to your target due to incorrect options byte config or illegal program execution.

• connect_type 标记控制描述 SRST 在连接目标时被断言的某些情况的标志。 connect_deassert_srst（默认）表示 SRST 在连接目标时不会被断言。与之相反的 connect_assert_srst，表示 SRST 将在任何目标连接之前被断言。只有部分目标支持该功能，例如 STM32 和 STR9。如果由于不正确的选项字节配置或非法程序执行导致无法连接目标，该功能将非常有用。

The optional trst_type and srst_type parameters allow the driver mode of each reset line to be specified. These values only affect JTAG interfaces with support for different driver modes, like the Amontec JTAGkey and JTAG Accelerator. Also, they are necessarily ignored if the relevant signal (TRST or SRST) is not connected.
可选的 trst_type 和 srst_type 参数允许指定每条复位线的驱动模式。这些值仅影响支持不同驱动模式的 JTAG 接口，如 Amontec JTAGkey 和 JTAG Accelerator。此外，如果未连接相关信号（TRST 或 SRST），这些值必然会被忽略。

• Possible trst_type driver modes for the test reset signal (TRST) are the default trst_push_pull, and trst_open_drain. Most boards connect this signal to a pulldown, so the JTAG TAPs never leave reset unless they are hooked up to a JTAG adapter.
• 测试复位信号 (TRST) 可能的 trst_type 驱动模式有默认的 trst_push_pull 和 trst_open_drain。大多数电路板将该信号连接到下拉，因此 JTAG TAP 除非连接到 JTAG 适配器，否则永远不会离开复位。
• Possible srst_type driver modes for the system reset signal (SRST) are the default srst_open_drain, and srst_push_pull. Most boards connect this signal to a pullup, and allow the signal to be pulled low by various events including system power-up and pressing a reset button.
• 系统复位信号 (SRST) 的 srst_type 驱动模式有默认的 srst_open_drain 和 srst_push_pull。大多数电路板将该信号连接至上拉器，并允许通过各种事件（包括系统上电和按下复位按钮）将该信号拉低。

info exit#

Config File Guidelines (OpenOCD User’s Guide)

if { [info exists CHIPNAME] } {
   set  _CHIPNAME $CHIPNAME
} else {
   set  _CHIPNAME sam7x256
}
# ONLY use ENDIAN with targets that can change it.
if { [info exists ENDIAN] } {
   set  _ENDIAN $ENDIAN
} else {
   set  _ENDIAN little
}
# TAP identifiers may change as chips mature, for example with
# new revision fields (the "3" here). Pick a good default; you
# can pass several such identifiers to the "jtag newtap" command.
if { [info exists CPUTAPID ] } {
   set _CPUTAPID $CPUTAPID
} else {
   set _CPUTAPID 0x3f0f0f0f
}

set _TARGETNAME $_CHIPNAME.cpu
target create $_TARGETNAME arm7tdmi -chain-position $_TARGETNAME

set#

set _CHIPNAME rk3568
set _DAP_TAPID 0x2ba01477
set _TARGETNAME $_CHIPNAME.lcore
set _smp_command ""
set $_TARGETNAME.base(0) 0x81004000
set $_TARGETNAME.base(1) 0x81005000
set $_TARGETNAME.base(2) 0x81006000
set $_TARGETNAME.base(3) 0x81007000
set $_TARGETNAME.cti(0) 0x81014000
set $_TARGETNAME.cti(1) 0x81015000
set $_TARGETNAME.cti(2) 0x81016000
set $_TARGETNAME.cti(3) 0x81017000
set _cores 4

set 为变量赋值命令，参数可以是字符串，数字，其他变量

adapter#

adapter driver jlink
adapter speed 12000

Debug Adapter Configuration (OpenOCD User’s Guide)

Config Command: adapter driver name

Use the adapter driver name to connect to the target.
名称列表详见 Interface-Drivers
Command: adapter speed max_speed_kHz

A non-zero speed is in KHZ. Hence: 3000 is 3mhz. JTAG interfaces usually support a limited number of speeds. The speed actually used won’t be faster than the speed specified.

Chip data sheets generally include a top JTAG clock rate. The actual rate is often a function of a CPU core clock, and is normally less than that peak rate. For example, most ARM cores accept at most one sixth of the CPU clock.

Speed 0 (khz) selects RTCK method. See FAQ RTCK. If your system uses RTCK, you won’t need to change the JTAG clocking after setup. Not all interfaces, boards, or targets support “rtck”. If the interface device can not support it, an error is returned when you try to use RTCK.

transport select and swd newdap#

transport select swd
swd newdap $_CHIPNAME cpu -expected-id $_DAP_TAPID -ignore-version

Transport-Configuration

SWD (Serial Wire Debug) is an ARM-specific transport which exposes one Debug Access Point (DAP, which must be explicitly declared. (SWD uses fewer signal wires than JTAG.) SWD is debug-oriented, and does not support boundary scan testing. Flash programming support is built on top of debug support. (Some processors support both JTAG and SWD.)

SWD transport is selected with the command transport select swd. Unless your adapter uses either the hla interface driver (in which case the command is transport select hla_swd) or the st-link interface driver (in which case the command is transport select dapdirect_swd).

Config Command: swd newdap ...

Declares a single DAP which uses SWD transport. Parameters are currently the same as "jtag newtap" but this is expected to change.

The newer SWD devices (SW-DP v2 or SWJ-DP v2) support the multi-drop extension of SWD protocol: two or more devices can be connected to one SWD adapter. SWD transport works in multi-drop mode if DAP is configured with both -dp-id and -instance-id parameters regardless how many DAPs are created.

Not all adapters and adapter drivers support SWD multi-drop. Only the following adapter drivers are SWD multi-drop capable: cmsis_dap (use an adapter with CMSIS-DAP version 2.0), ftdi, all bitbang based.

TAP-Declaration-Commands

Config Command: jtag newtap chipname tapname configparams...
Declares a new TAP with the dotted name chipname.tapname, and configured according to the various configparams.

The chipname is a symbolic name for the chip. Conventionally target config files use $_CHIPNAME, defaulting to the model name given by the chip vendor but overridable.

The tapname reflects the role of that TAP, and should follow this convention:

• bs – For boundary scan if this is a separate TAP;
• cpu – The main CPU of the chip, alternatively arm and dsp on chips with both ARM and DSP CPUs, arm1 and arm2 on chips with two ARMs, and so forth;
• etb – For an embedded trace buffer (example: an ARM ETB11);
• flash – If the chip has a flash TAP, like the str912;
• jrc – For JTAG route controller (example: the ICEPick modules on many Texas Instruments chips, like the OMAP3530 on Beagleboards);
• tap – Should be used only for FPGA- or CPLD-like devices with a single TAP;
• unknownN – If you have no idea what the TAP is for (N is a number);
• when in doubt – Use the chip maker’s name in their data sheet. For example, the Freescale i.MX31 has a SDMA (Smart DMA) with a JTAG TAP; that TAP should be named sdma.

Every TAP requires at least the following configparams:

• -irlen NUMBER
  The length in bits of the instruction register, such as 4 or 5 bits.

A TAP may also provide optional configparams:

• -disable (or -enable)
  Use the -disable parameter to flag a TAP which is not linked into the scan chain after a reset using either TRST or the JTAG state machine’s RESET state. You may use -enable to highlight the default state (the TAP is linked in). See Enabling and Disabling TAPs.

• -expected-id NUMBER
  A non-zero number represents a 32-bit IDCODE which you expect to find when the scan chain is examined. These codes are not required by all JTAG devices. Repeat the option as many times as required if more than one ID code could appear (for example, multiple versions). Specify number as zero to suppress warnings about IDCODE values that were found but not included in the list.

  Provide this value if at all possible, since it lets OpenOCD tell when the scan chain it sees isn’t right. These values are provided in vendors’ chip documentation, usually a technical reference manual. Sometimes you may need to probe the JTAG hardware to find these values. See Autoprobing.

• -ignore-version
  Specify this to ignore the JTAG version field in the -expected-id option. When vendors put out multiple versions of a chip, or use the same JTAG-level ID for several largely-compatible chips, it may be more practical to ignore the version field than to update config files to handle all of the various chip IDs. The version field is defined as bit 28-31 of the IDCODE.

• -ignore-bypass
  Specify this to ignore the ’bypass’ bit of the idcode. Some vendor put an invalid idcode regarding this bit. Specify this to ignore this bit and to not consider this tap in bypass mode.

• -ircapture NUMBER
  The bit pattern loaded by the TAP into the JTAG shift register on entry to the IRCAPTURE state, such as 0x01. JTAG requires the two LSBs of this value to be 01. By default, -ircapture and -irmask are set up to verify that two-bit value. You may provide additional bits if you know them, or indicate that a TAP doesn’t conform to the JTAG specification.

• -irmask NUMBER
  A mask used with -ircapture to verify that instruction scans work correctly. Such scans are not used by OpenOCD except to verify that there seems to be no problems with JTAG scan chain operations.

• -ignore-syspwrupack
  Specify this to ignore the CSYSPWRUPACK bit in the ARM DAP DP CTRL/STAT register during initial examination and when checking the sticky error bit. This bit is normally checked after setting the CSYSPWRUPREQ bit, but some devices do not set the ack bit until sometime later.

dap create#

dap create $_CHIPNAME.dap -chain-position $_CHIPNAME.cpu

dap declaration

Command: dap create dap_name -chain-position dotted.name configparams...

Declare a DAP instance named dap_name linked to the JTAG tap dotted.name. This also creates a new command (dap_name) which is used for various purposes including additional configuration. There can only be one DAP for each JTAG tap in the system.

A DAP may also provide optional configparams:

• -adiv5 Specify that it’s an ADIv5 DAP. This is the default if not specified.
• -adiv6 Specify that it’s an ADIv6 DAP.
• -ignore-syspwrupack Specify this to ignore the CSYSPWRUPACK bit in the ARM DAP DP CTRL/STAT register during initial examination and when checking the sticky error bit. This bit is normally checked after setting the CSYSPWRUPREQ bit, but some devices do not set the ack bit until sometime later.
• -dp-id number
  Debug port identification number for SWD DPv2 multidrop. The number is written to bits 0..27 of DP TARGETSEL during DP selection. To find the id number of a single connected device read DP TARGETID: device.dap dpreg 0x24 Use bits 0..27 of TARGETID.
• -instance-id number
  Instance identification number for SWD DPv2 multidrop. The number is written to bits 28..31 of DP TARGETSEL during DP selection. To find the instance number of a single connected device read DP DLPIDR: device.dap dpreg 0x34 The instance number is in bits 28..31 of DLPIDR value.

target create and ${_TARGETNAME}$_core configure -defer-examine#

target create $_CHIPNAME.ahb mem_ap -dap $_CHIPNAME.dap -ap-num 0
target create ${_TARGETNAME}$_core aarch64 -dap $_CHIPNAME.dap -coreid $_core -cti cti$_core -dbgbase [set $_TARGETNAME.base($_core)]
${_TARGETNAME}$_core configure -defer-examine
${_TARGETNAME}$_core configure -work-area-size 0x30000 -work-area-phys 0xff8c0000 -work-area-backup 0

Config Command: target create target_name type configparams...

This command creates a GDB debug target that refers to a specific JTAG tap. It enters that target into a list, and creates a new command (target_name) which is used for various purposes including additional configuration.

• target_name ... is the name of the debug target. By convention this should be the same as the dotted.name of the TAP associated with this target, which must be specified here using the -chain-position dotted.name configparam.

  This name is also used to create the target object command, referred to here as $target_name, and in other places the target needs to be identified.

• type ... specifies the target type. See target types.

• configparams ... all parameters accepted by $target_name configure are permitted. If the target is big-endian, set it here with -endian big.

  You must set the -chain-position dotted.name or -dap dap_name here.

Command: $target_name configure configparams...

The options accepted by this command may also be specified as parameters to target create. Their values can later be queried one at a time by using the $target_name cget command.

Warning: changing some of these after setup is dangerous. For example, moving a target from one TAP to another; and changing its endianness.

• -chain-position dotted.name – names the TAP used to access this target.

• -dap dap_name – names the DAP used to access this target. See DAP declaration, on how to create and manage DAP instances.

• -endian (big|little) – specifies whether the CPU uses big or little endian conventions

• -event event_name event_body – See Target Events. Note that this updates a list of named event handlers. Calling this twice with two different event names assigns two different handlers, but calling it twice with the same event name assigns only one handler.

  Current target is temporarily overridden to the event issuing target before handler code starts and switched back after handler is done.

• -work-area-backup (0|1) – says whether the work area gets backed up; by default, it is not backed up. When possible, use a working_area that doesn’t need to be backed up, since performing a backup slows down operations. For example, the beginning of an SRAM block is likely to be used by most build systems, but the end is often unused.

• -work-area-size size – specify work are size, in bytes. The same size applies regardless of whether its physical or virtual address is being used.

• -work-area-phys address – set the work area base address to be used when no MMU is active.

• -work-area-virt address – set the work area base address to be used when an MMU is active. Do not specify a value for this except on targets with an MMU. The value should normally correspond to a static mapping for the -work-area-phys address, set up by the current operating system.

• -rtos rtos_type – enable rtos support for target, rtos_type can be one of auto, none, eCos, ThreadX, FreeRTOS, linux, ChibiOS, embKernel, mqx, uCOS-III, nuttx, RIOT, Zephyr, rtkernel See RTOS Support.

• -defer-examine – skip target examination at initial JTAG chain scan and after a reset. A manual call to arp_examine is required to access the target for debugging.

• -ap-num ap_number – set DAP access port for target. On ADIv5 DAP ap_number is the numeric index of the DAP AP the target is connected to. On ADIv6 DAP ap_number is the base address of the DAP AP the target is connected to. Use this option with systems where multiple, independent cores are connected to separate access ports of the same DAP.

• -cti cti_name – set Cross-Trigger Interface (CTI) connected to the target. Currently, only the aarch64 target makes use of this option, where it is a mandatory configuration for the target run control. See ARM Cross-Trigger Interface, for instruction on how to declare and control a CTI instance.

• -gdb-port number – see command gdb_port for the possible values of the parameter number, which are not only numeric values. Use this option to override, for this target only, the global parameter set with command gdb_port. See command gdb_port.

• -gdb-max-connections number – EXPERIMENTAL: set the maximum number of GDB connections that are allowed for the target. Default is 1. A negative value for number means unlimited connections. See See Using GDB as a non-intrusive memory inspector.

但是上述内容中没有关于-coreid和-dbgbase选项的说明，在 SMP 相关章节有提到一点：
Define-CPU-targets-working-in-SMP

set _TARGETNAME_1 $_CHIPNAME.cpu1
set _TARGETNAME_2 $_CHIPNAME.cpu2
target create $_TARGETNAME_1 cortex_a -chain-position $_CHIPNAME.dap \
-coreid 0 -dbgbase $_DAP_DBG1
target create $_TARGETNAME_2 cortex_a -chain-position $_CHIPNAME.dap \
-coreid 1 -dbgbase $_DAP_DBG2
#define 2 targets working in smp.
target smp $_CHIPNAME.cpu2 $_CHIPNAME.cpu1

cortex_a smp_gdb
gdb coreid  0 -> -1
#0 : coreid 0 is displayed to GDB ,
#-> -1 : next resume triggers a real resume
cortex_a smp_gdb 1
gdb coreid  0 -> 1
#0 :coreid 0 is displayed to GDB ,
#->1  : next resume displays coreid 1 to GDB
resume
cortex_a smp_gdb
gdb coreid  1 -> 1
#1 :coreid 1 is displayed to GDB ,
#->1 : next resume displays coreid 1 to GDB
cortex_a smp_gdb -1
gdb coreid  1 -> -1
#1 :coreid 1 is displayed to GDB,
#->-1 : next resume triggers a real resume

上述例子中除了 target create 之外，以及 target smp 命令也有涉及到

cti create#

cti create cti$_core -dap $_CHIPNAME.dap -baseaddr [set $_TARGETNAME.cti($_core)] -ap-num 0

ARM-Cross_002dTrigger-Interface

Command: cti create cti_name -dap dap_name -ap-num apn -baseaddr base_address

Creates a CTI instance cti_name on the DAP instance dap_name on MEM-AP apn. On ADIv5 DAP apn is the numeric index of the DAP AP the CTI is connected to. On ADIv6 DAP apn is the base address of the DAP AP the CTI is connected to. The base_address must match the base address of the CTI on the respective MEM-AP. All arguments are mandatory. This creates a new command $cti_name which is used for various purposes including additional configuration.

targets#

targets rk3568.lcore0

All targets that have been set up are part of a list, where each member has a name. That name should normally be the same as the TAP name. You can display the list with the targets (plural!) command. This display often has only one CPU; here’s what it might look like with more than one:

One member of that list is the current target, which is implicitly referenced by many commands. It’s the one marked with a * near the target name. In particular, memory addresses often refer to the address space seen by that current target. Commands like mdw (memory display words) and flash erase_address (erase NOR flash blocks) are examples; and there are many more.

Several commands let you examine the list of targets:

Command: target current

Returns the name of the current target.

Command: target names

Lists the names of all current targets in the list.

foreach t [target names] {
puts [format "Target: %s\n" $t]
}

Command: targets [name]

Note: the name of this command is plural. Other target command names are singular.

With no parameter, this command displays a table of all known targets in a user friendly form.

With a parameter, this command sets the current target to the given target with the given name; this is only relevant on boards which have more than one target.
在有参数的情况下，该命令会将当前目标设置为指定名称的目标；这只适用于有多个目标的电路板。