BeagleBoardOpenOCD

This page is about how to use open source OpenOCD JTAG software with BeagleBoard. With this, it will be possible to have OMAP3 JTAG debug using cheap JTAG hardware, e.g. Flyswatter.

'''As of September 2009, OpenOCD has basic support for OMAP3 and ARM Cortex A8 on Beagle Board. Cortex A8 support is in early alpha stage, a lot is still missing. But e.g. processor halt, resume, step, breakpoints and ARM disassembly of non-Cache and non-MMU (e.g. U-Boot) applications seem to work.

Status:


 * You need at least OpenOCD revision 2697 (using svn) with some additional patches. With this revision you will have basic access to OMAP3 and Cortex A8 can be basically controlled. This does mean, that OpenOCD is able to configure scan chain correctly to access ARM TAP ("JTAG controller"), explore CoreSight AccessPoints and halt, resume, step, breakpoints and ARM disassembly on Cortex A8.
 * Recent status as of September 2009:
 * OpenOCD >= 2697 can and halt, resume, step, breakpoints and ARM disassembly Cortex A8 (ARM) processor on Beagle.
 * This works for non-MMU and non-Cache applications (e.g U-Boot).
 * Linux debugging doesn't work yet.

=Hardware=

To be able to use OpenOCD with OMAP3 based BeagleBoard, make sure that your JTAG Dongle supports:


 * 1.8V devices. Many JTAG dongles are 3.3V only! Verify that your dongle supports 1.8V! Else the dongle will overpowering the input to OMAP3 and may cause damage.
 * Your JTAG dongle is able to switch EMU0 & EMU1 pins high.

Flyswatter dongle supports both requirements. If you use BeagleBoard Adapter Kit with Flyswatter, make sure you plug the JTAG adapter the correct way. There are several possible ways, though. See connection picture how to do it the right way. In contrast to the picture EMU0 & EMU1 jumpers at JTAG adapter should be both at 1-2 position (touching J2).

=Build OpenOCD=

OpenOCD build instructions describe how to build OpenOCD. For questions you can use OpenOCD Mailing list.

Get OpenOCD code via svn:

> svn checkout svn://svn.berlios.de/openocd/trunk openocd

For Flyswatter you additionally need libftd2xx or libFTDI. While libFTDI is available in source, libftd2xx is supposed to be 50% faster than libFTDI. The libtfd2xx binaries are available booth as shared library or linkable archive.

If you downloaded OpenOCD svn and have libftd2xx or libFTDI, build OpenOCD (assuming you extracted/built FTDI library already): > cd openocd > ./bootstrap > ./configure --enable-ft2232_ftd2xx --with-ftd2xx-linux-tardir=/libftd2xx0.4.16 --prefix=/home/user/bin/openOCD or (depending which FTDI library you use, see above) > ./configure --enable-ft2232_libftdi --prefix=/home/user/bin/openOCD > make > make install

Note: By default (make & make install) only .info documentation is installed. You can get PDF or HTML documentation by

make pdf

or

make html

Resulting documentation can be found in openocd/doc, then.

Note: If you like to save some disk space and don't plan to debug OpenOCD binary itself, you can strip this (remove unneeded debug symbols):

> cd /bin > strip openocd

(e.g. with OpenOCD 1.0 this reduced binary size from ~3MB to ~700kB)

Note: If you don't have libftdi in standard path, you might like to extend library search path:

export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/lib

if you e.g. get

> ./openocd ./openocd: error while loading shared libraries: libftdi.so.1: cannot open shared object file: No such file or directory

=Starting OpenOCD=

OpenOCD runtime is controlled by several configuration files. OpenOCD comes with basic configuration files for BeagleBoard (board/ti_beagleboard.cfg) and OMAP3 (target/omap3530.cfg).

Assuming that you use Flyswatter and it is switched on (attached to USB), you can now start OpenOCD with:

openocd -s   // e.g. /lib/openocd -f  -f 

This should result in

> openocd -s lib/openocd/ -f interface/flyswatter.cfg -f board/ti_beagleboard.cfg Open On-Chip Debugger 0.3.0-in-development (2009-09-12-07:43) svn:2697 $URL: svn://svn.berlios.de/openocd/trunk/src/openocd.c $ For bug reports, read http://svn.berlios.de/svnroot/repos/openocd/trunk/BUGS RCLK - adaptive Warn : huge IR length 38 Info : RCLK (adaptive clock speed) not supported - fallback to 6000 kHz Info : JTAG tap: omap3530.jrc tap/device found: 0x0b7ae02f (mfg: 0x017, part: 0xb7ae, ver: 0x0)

This shows that your (Flyswatter) JTAG dongle basically works and that you are able to see OMAP3 JRC. OpenOCD now runs as deamon.

=Controlling OpenOCD=

Once OpenOCD runs as daemon like above, you can connect using telnet or GDB

telnet
Connect to OpenOCD daemon. Assuming you do it on your local machine, open a second terminal window and do (assuming port 4444 as configured in above openocd.cfg):

> telnet localhost 4444 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. Open On-Chip Debugger >

This should give you

Info:  accepting 'telnet' connection from 0

in window where OpenOCD daemon is started.

At OpenOCDs telnet prompt you can now issue OpenOCD commands. E.g. help should result in

> help bp                       list or set breakpoint [  [hw]] cpu                      - prints out target options and a comment on CPU which matches name debug_level              adjust debug level <0-3> drscan                   execute DR scan   ...                         dump_image                dump_image exit                     exit telnet session fast                     fast  - place at beginning of                               config files. Sets defaults to fast and dangerous. fast_load                loads active fast load image to current target - mainly for profiling purposes fast_load_image          same args as load_image, image stored in memory - mainly for profiling purposes find                     - print full path to file according to                                OpenOCD search rules flush_count              returns number of times the JTAG queue has been flushed ft2232_device_desc       the USB device description of the FTDI FT2232 device ft2232_latency           set the FT2232 latency timer to a new value ft2232_layout            the layout of the FT2232 GPIO signals used to                                control output-enables and reset signals ft2232_serial            the serial number of the FTDI FT2232 device ft2232_vid_pid           the vendor ID and product ID of the FTDI FT2232 device gdb_breakpoint_override  hard/soft/disable - force breakpoint type for gdb 'break' commands. gdb_detach               resume/reset/halt/nothing - specify behavior when GDB detaches from the target gdb_flash_program        enable or disable flash program gdb_memory_map           enable or disable memory map gdb_port                 daemon configuration command gdb_port gdb_report_data_abort    enable or disable reporting data aborts halt                     halt target help                     Tcl implementation of help command init                     initializes target and servers - nop on subsequent invocations interface                try to configure interface interface_list           list all built-in interfaces irscan                   execute IR scan  [dev2] [instr2] ...                                                jtag                      perform jtag tap actions jtag_device              (DEPRECATED) jtag_device    jtag_khz                 set maximum jtag speed (if supported); parameter is maximum khz, or 0 for adaptive clocking (RTCK). jtag_nsrst_delay         jtag_nsrst_delay  - delay after deasserting srst in ms                                         jtag_ntrst_delay          jtag_ntrst_delay  - delay after deasserting trst in ms                                         jtag_rclk                 fallback_speed_khz - set JTAG speed to RCLK or use fallback speed jtag_reset               toggle reset lines jtag_speed               (DEPRECATED) set jtag speed (if supported) load_image               load_image ['bin'|'ihex'|'elf'|'s19'] [min_address] [max_length] log_output               redirect logging to (default: stderr) mdb                      display memory bytes [count] mdh                      display memory half-words [count] mdw                      display memory words [count] mwb                      write memory byte  [count] mwh                      write memory half-word  [count] mww                      write memory word  [count] ocd_array2mem            convert a TCL array to memory locations and write the values  <WIDTH = 32/16/8> <ADDRESS> <COUNT> ocd_flash_banks          return information about the flash banks ocd_mem2array            read memory and return as a TCL array for script processing <ARRAYNAME> <WIDTH = 32/16/8> <ADDRESS> <COUNT> pathmove                 move JTAG to state1 then to state2, state3, etc. ,, ...                       poll                      poll target state power_restore            Overridable procedure run when power restore is                               detected. Runs 'reset init' by default. production               - Runs production procedure. Throws exception if procedure failed. Prints progress messages. Implement this procedure in the target script. production               Runs test procedure. Throws exception if procedure failed. Prints progress messages. Implement in                               target script. production_info          Displays information on production procedure for target script. Implement this procedure in target script. profile                  profiling samples the CPU PC                        rbp                       remove breakpoint reg                      display or set a register reset                    reset target [run | halt | init] - default is run reset_config             [none/trst_only/srst_only/trst_and_srst] [srst_pulls_trst/trst_pulls_srst] [combined/separate] [trst_push_pull/trst_open_drain] [srst_push_pull/srst_open_drain] resume                   resume target [addr] runtest                  move to Run-Test/Idle, and execute <num_cycles> rwp                      remove watchpoint scan_chain               print current scan chain configuration script                   - filename of OpenOCD script (tcl) to                              run shutdown                 shut the server down sleep                    <n> [busy] - sleep for n milliseconds. "busy" means busy wait soft_reset_halt          halt the target and do a soft reset srst_deasserted          Overridable procedure run when srst deassert is                               detected. Runs 'reset init' by default. step                     step one instruction from current PC or [addr] svf                      run svf target                   configure target targets                  change the current command line target (one                                   parameter) or lists targets (with no parameter) tcl_port                 port on which to listen for incoming TCL syntax telnet_port              port on which to listen for incoming telnet connections test_image               test_image [offset] [type] tms_sequence             choose short(default) or long tms_sequence <short | long> verify_image             verify_image [offset] [type] verify_ircapture         verify value captured during Capture-IR <enable | disable> verify_jtag              verify value capture <enable | disable> version                  show OpenOCD version virt2phys                translate a virtual address into a physical address wait_halt                wait for target halt [time (s)] wp                       list or set watchpoint [  <r/w/a> [value] [mask]] xsvf                     run xsvf [virt2] [quiet] armv4_5 core_state       display/change ARM core state <arm | thumb> armv4_5 disassemble      disassemble instructions [ ['thumb']] armv4_5 reg              display ARM core registers cortex_a8 cache_info     display information about target caches dap apid                 return id reg from AP [num], default currently selected AP dap apsel                select a different AP [num] (default 0) dap baseaddr             return debug base address from AP [num], default currently selected AP dap info                 dap info for ap [num], default currently selected AP dap memaccess            set/get number of extra tck for mem-ap memory bus access [0-255] flash bank               flash bank   <chip_width> <bus_width> [driver_options ...] mflash bank              mflash bank  <RST pin> <target #> nand device pld device target_request debugmsgs enable/disable reception of debug messages from target trace history            display trace history, ['clear'] history or set [size] trace point              display trace points, ['clear'] list of trace points, or add new tracepoint at [address]

Example session
Now, we can try to basically halt and resume OMAP3 (assuming U-Boot is running at U-Boot's prompt):

> omap3_dbginit JTAG tap: omap3530.jrc tap/device found: 0x0b7ae02f (mfg: 0x017, part: 0xb7ae, ver: 0x0) JTAG Tap/device matched AHBAP Cached values: dp_select 0x10, ap_csw 0xa2000002, ap_tar 0x54011080 SWJ-DP STICKY ERROR Read MEM_AP_CSW 0x80000042, MEM_AP_TAR 0x54011080 TargetName        Type       Endian TapName            State -- -- -- -- --  0* omap3.cpu          cortex_a8  little omap3530.dap       unknown 0x54011314 00000003                           .... 0x54011314 00000001                            .... > scan_chain TapName           | Enabled |   IdCode      Expected    IrLen IrCap  IrMask Instr ---||-|||--|--|--|- 0 | omap3530.dsp       |    n    | 0x00000000 | 0x00000000 | 0x26 | 0x25 | 0x3f | 0xffffffff 1 | omap3530.dap      |    Y    | 0x00000000 | 0x0b6d602f | 0x04 | 0x01 | 0x0f | 0x0a 2 | omap3530.jrc      |    Y    | 0x0b7ae02f | 0x0b7ae02f | 0x06 | 0x01 | 0x3f | 0x3f > halt target state: halted target halted in ARM state due to debug-request, current mode: Supervisor spsr_svc: 0x400001d3 pc: 0x80e87dcc MMU: disabled, D-Cache: disabled, I-Cache: enabled > poll background polling: on TAP: omap3530.dap (enabled) target state: halted target halted in ARM state due to debug-request, current mode: Supervisor spsr_svc: 0x400001d3 pc: 0x80e87dcc MMU: disabled, D-Cache: disabled, I-Cache: enabled > resume > poll background polling: on TAP: omap3530.dap (enabled) target state: running > soft_reset_halt requesting target halt and executing a soft reset Target omap3.cpu does not support soft_reset_halt > cortex_a8 cache_info cache type: 0x0, unified cache D-Cache: linelen 8, associativity 2, nsets 64, cachesize 0x400 I-Cache: linelen 8, associativity 2, nsets 64, cachesize 0x400 > halt target state: halted target halted in ARM state due to debug-request, current mode: Supervisor spsr_svc: 0x400001d3 pc: 0x80e88158 MMU: disabled, D-Cache: disabled, I-Cache: enabled > armv4_5 disassemble 0x80e88158 10 0x80e88158     0xe3130001      TST r3, #0x1 0x80e8815c     0x0afffffc      BEQ 0x80e88154 0x80e88160     0xe5d00000      LDRB r0, [r0] 0x80e88164     0xe12fff1e      BX r14 0x80e88168     0xe5d00014      LDRB r0, [r0, #0x14] 0x80e8816c     0xe2000001      AND r0, r0, #0x1 0x80e88170     0xe12fff1e      BX r14 0x80e88174     0xe1a02001      MOV r2, r1 0x80e88178      0xe1a01000      MOV r1, r0 0x80e8817c      0xe59f0000      LDR r0, [r15] > step target state: halted target halted in ARM state due to breakpoint, current mode: Supervisor spsr_svc: 0x400001d3 pc: 0x80e8815c MMU: disabled, D-Cache: disabled, I-Cache: enabled > step target state: halted target halted in ARM state due to breakpoint, current mode: Supervisor spsr_svc: 0x400001d3 pc: 0x80e88154 MMU: disabled, D-Cache: disabled, I-Cache: enabled > bp 0x80e88160 4 hw breakpoint set at 0x80e88160 > resume ... type anything in U-Boot until breakpoint is hit ... target state: halted target halted in ARM state due to breakpoint, current mode: Supervisor spsr_svc: 0x000001d3 pc: 0x80e88160 MMU: disabled, D-Cache: disabled, I-Cache: enabled > bp 0x80e88160, 0x4, 1 > rbp 0x80e88160 > resume

=GDB ARM=

To debug an ARM target with GNU debugger (GDB), you need a GDB understanding ARM processor. If your ARM cross compilation tool chain doesn't include a GDB, you can easily build it your self.

Build

 * Download latest GDB sources. OpenOCD docu recommends to use GDB 6.7 or newer. Here, we use GDB 6.8 which is the recent version while writing this.


 * Extract, configure and build GDB for ARM. Afterwards remove temporary stuff. Options are:
 * <path_where_ARM_gdb_shall_be_installed_to> : Directory where you want to install the resulting tool to. E.g. /home/user/arm-gdb/
 * <ARM_toolchain_prefix> : The prefix of your ARM GCC toolchain, e.g. arm-linux or arm-none-linux-gnueabi (CodeSourcery tool chain).

> tar xfj gdb-6.8.tar.bz2 > mkdir build-gdb > cd build-gdb/ build-gdb > ../gdb-6.8/configure --prefix=<path_where_ARM_gdb_shall_be_installed_to> --target=<ARM_toolchain_prefix> i686-pc-linux-gnu build-gdb > make -j4 build-gdb > make install build-gdb > cd .. > rm -rf gdb-6.8 build-gdb > export PATH=$PATH:<path_where_ARM_gdb_shall_be_installed_to>/bin

Test:

bin> ./arm-none-linux-gnueabi-gdb GNU gdb 6.8 Copyright (C) 2008 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "--host=i686-pc-linux-gnu --target=arm-none-linux-gnueabi". (gdb)

Example session
To use gdb, you have to connect to running OpenOCD using remote command. E.g.:

> arm-none-linux-gnueabi-gdb GNU gdb 6.8 Copyright (C) 2008 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "--host=i686-pc-linux-gnu --target=arm-none-linux-gnueabi". (gdb) target remote localhost:3333 Remote debugging using localhost:3333 0x00000000 in ?? (gdb) monitor omap3_dbginit JTAG tap: omap3530.jrc tap/device found: 0x0b7ae02f (mfg: 0x017, part: 0xb7ae, ver: 0x0) AHBAP Cached values: dp_select 0x10, ap_csw 0xa2000002, ap_tar 0x54011080 SWJ-DP STICKY ERROR Read MEM_AP_CSW 0x80000042, MEM_AP_TAR 0x54011080 TargetName        Type       Endian TapName            State -- -- -- -- --                   0* omap3.cpu          cortex_a8  little omap3530.dap       unknown 0x54011314 00000003                           ....                                      0x54011314 00000001                            ....         (gdb) monitor scan_chain TapName           | Enabled |   IdCode      Expected    IrLen IrCap  IrMask Instr ---||-|||--|--|--|-  0 | omap3530.dsp       |    n    | 0x00000000 | 0x00000000 | 0x26 | 0x25 | 0x3f | 0xffffffff 1 | omap3530.dap      |    Y    | 0x00000000 | 0x0b6d602f | 0x04 | 0x01 | 0x0f | 0x0a 2 | omap3530.jrc      |    Y    | 0x0b7ae02f | 0x0b7ae02f | 0x06 | 0x01 | 0x3f | 0x3f (gdb) info registers r0            0x0      0 r1            0x60a    1546 r2            0x80000100       2147483904 r3            0x706    1798 r4            0xc00081b8       3221258680 r5            0x0      0 r6            0x80026960       2147641696 r7            0xc00081b8       3221258680 r8            0x0      0 r9            0x411fc082       1092599938 r10           0x800268f8       2147641592 r11           0xf731c8f9       4147235065 r12           0x80796ae0       2155440864 sp            0x8051a900       0x8051a900 lr            0x80008018       2147516440 pc            0x8000815c       0x8000815c fps           0x0      0 cpsr          0x0      0 (gdb) p/x $pc $2 = 0x8000815c (gdb) x/i $pc 0x8000815c:    nop                     (mov r0,r0) (gdb) x 0x80008160:    b       0x8000815c

LED blink example
Magnus Lundin has a simple standalone LED blink test program which can be used for tests.


 * LED blink test program.
 * README
 * Example .gdbinit file

Clone the code by git, goto cortex_a8/standalone/LEDblink directory, build the example using provided Makefile and then in that directory start gdb (so that .gdbinit is executed):

> arm-none-linux-gnueabi-gdb GNU gdb 6.8 Copyright (C) 2008 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "--host=i686-pc-linux-gnu --target=arm-none-linux-gnueabi". Setting up the environment for debugging gdb. 0x00000000 in ?? The target may not be able to correctly handle a memory-write-packet-size of 1024 bytes. Change the packet size? (y or n) [answered Y; input not from terminal] JTAG tap: omap3530.jrc tap/device found: 0x0b7ae02f (mfg: 0x017, part: 0xb7ae, ver: 0x0) AHBAP Cached values: dp_select 0x10, ap_csw 0xa2000002, ap_tar 0x54011080 SWJ-DP STICKY ERROR Read MEM_AP_CSW 0x80000042, MEM_AP_TAR 0x54011080 TargetName        Type       Endian TapName            State -- -- -- -- --   0* omap3.cpu          cortex_a8  little omap3530.dap       unknown 0x54011314 00000003                           .... 0x54011314 00000001                            .... Loading section .text, size 0xe0 lma 0x82000000 Start address 0x82000000, load size 224 Transfer rate: 36 KB/sec, 224 bytes/write. Current language: auto; currently asm (gdb) hb main Hardware assisted breakpoint 1 at 0x8200003c: file LEDblink.c, line 22. (gdb) cont Continuing. Breakpoint 1, main at LEDblink.c:22 22                     LEDbrightness++; Current language: auto; currently c (gdb) cont

This should let Beagle's LEDs blink.

Note: At the moment, we have to set hardware break point ("hb"). Normal break points still don't work due to missing I-Cache support.

=Development internals=

The sections below give some datails if you are interested in developing OpenOCD for OMAP3 and Cortex A8 used on Beagle. If you like to help to improve OpenOCD support for Beagle, this might help you.

Introduction
Magnus Lundin wrote a very nice introduction on the basic Cortex A8 (OMAP3) debug architecture.

Cortex A8 support
As mentioned above, OpenOCD has initial experimental Cortex A8 support. Rick Altherr wrote (thanks!) a nice intro how to help with Cortex A8 support for OpenOCD:

''The Cortex-M3 support is very similar to Cortex-A8 up to a certain layer. The ARM debug interface is designed as a set of layers that build on each other and can do automatic discovery. The cortex-swjdp support in OpenOCD is a good start, but it assumes which AHB and APB ports are available. The first item would be to verify the cortex-swjdp portion against the documents for the CoreSight debug interface.''

To really get started, familiarize yourself with the following docs:
 * ARM IHI 0031A (ARM Debug Interface v5) - only available to registered ARM customers
 * ARM IHI 0029B (CoreSight v1.0) - only available to registered ARM customers
 * ARM DDI 0316D (CoreSight DAP-Lite)
 * ARM DDI 0314F (CoreSight Components TRM)
 * ARM DDI 0344H (Cortex-A8 TRM, primarily chapter 12)

''These should be listed in the right order for getting up to speed. Basically the Cortex-A8 debug registers are accessed externally via CoreSight. CoreSight is an implementation of the ARM Debug Interface v5.''

''The cortex-swjdp implementation in OpenOCD deals with CoreSight but makes some assumptions about which CoreSight components are available. For Cortex-A8, that will likely need to change a bit as the set of components will be different.''

After cortex-swjdp is patched to handle the new components, a cortex-a8 target implementation can be started by using the cortex-swjdp layer to access the various debug registers and memory locations.

For discussion about this, see mail #1, mail #2 and mail #3.

Note: With revision ~1570 the cortex-swjdp module in OpenOCD has been renamed to arm_adi_v5 and updated to remove all dependencies on Cortex-M3 specific features and as far as possible only use the ARM Debug Interface v5 features. The Cortex-M3 specifics has been moved to cortex_m3 module. This is a step in preparing OpenOCD for full Cortex-A8 support.

Using recent OpenOCD versions, you can examine CoreSight APs:

> version Open On-Chip Debugger 0.3.0-in-development (2009-08-30-19:54) svn:2643M

> omap3_dbginit JTAG tap: omap3530.jrc tap/device found: 0x0b7ae02f (mfg: 0x017, part: 0xb7ae, ver: 0x0) JTAG Tap/device matched AHBAP Cached values: dp_select 0x10, ap_csw 0xa2000002, ap_tar 0x54011080 SWJ-DP STICKY ERROR Read MEM_AP_CSW 0x80000042, MEM_AP_TAR 0x54011080 TargetName        Type       Endian TapName            State -- -- -- -- -- 0* omap3.cpu          cortex_a8  little omap3530.dap       unknown 0x54011314 00000003                           .... 0x54011314 00000001                           ....

> scan_chain TapName           | Enabled |   IdCode      Expected    IrLen IrCap  IrMask Instr ---||-|||--|--|--|- 0 | omap3530.dsp      |    n    | 0x00000000 | 0x00000000 | 0x26 | 0x25 | 0x3f | 0xffffffff 1 | omap3530.dap      |    Y    | 0x00000000 | 0x0b6d602f | 0x04 | 0x01 | 0x0f | 0x0a 2 | omap3530.jrc      |    Y    | 0x00000000 | 0x0b7ae02f | 0x06 | 0x01 | 0x3f | 0x3f

> dap apsel 0 ap 0 selected, identification register 0x14770001

> dap info 0 ap identification register 0x14770001 Type is mem-ap AHB ap debugbase 0xffffffff No ROM table present

> dap info 1 ap identification register 0x04770002 Type is mem-ap APB ap debugbase 0x80000000 ROM table in legacy format CID3 0xb1, CID2 0x5, CID1 0x10, CID0, 0xd MEMTYPE system memory not present. Dedicated debug bus ROMTABLE[0x0] = 0xd4010003 Component base address 0x54010000, pid4 0x4, start address 0x54010000 Component cid1 0x90, class is CoreSight component CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd PID3 0x10, PID2 0x2b, PID1 0xb9, PID0, 0x21 ROMTABLE[0x4] = 0xd4011003 Component base address 0x54011000, pid4 0x4, start address 0x54011000 Component cid1 0x90, class is CoreSight component CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd PID3 0x10, PID2 0x2b, PID1 0xbc, PID0, 0x8 ROMTABLE[0x8] = 0xd4012003 Component base address 0x54012000, pid4 0x0, start address 0x54012000 Component cid1 0x90, class is CoreSight component CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd PID3 0x0, PID2 0x9, PID1 0x71, PID0, 0x13 ROMTABLE[0xc] = 0xd4013002 Component not present ROMTABLE[0x10] = 0xd4019003 Component base address 0x54019000, pid4 0x4, start address 0x54019000 Component cid1 0x90, class is CoreSight component CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd PID3 0x0, PID2 0x1b, PID1 0xb9, PID0, 0x12 ROMTABLE[0x14] = 0xd401b003 Component base address 0x5401b000, pid4 0x4, start address 0x5401b000 Component cid1 0x90, class is CoreSight component CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd PID3 0x0, PID2 0xb, PID1 0xb9, PID0, 0x7 ROMTABLE[0x18] = 0xd401d003 Component base address 0x5401d000, pid4 0x0, start address 0x5401d000 Component cid1 0xf0, class is Non standard layout CID3 0xb1, CID2 0x5, CID1 0xf0, CID0, 0xd PID3 0x0, PID2 0x9, PID1 0x73, PID0, 0x43 ROMTABLE[0x1c] = 0xd4500003 Component base address 0x54500000, pid4 0x0, start address 0x54500000 Component cid1 0x90, class is CoreSight component CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd PID3 0x0, PID2 0x19, PID1 0x71, PID0, 0x20 ROMTABLE[0x20] = 0x0 End of ROM table

> dap apsel 1 ap 1 selected, identification register 0x04770002

> dap apsel 2 ap 2 selected, identification register 0x14760010

> dap info 2 ap identification register 0x14760010 Type is jtag-ap ap debugbase 0x00000000 No ROM table present

> dap apsel 3 ap 3 selected, identification register 0x00000000

> dap info 3 ap identification register 0x00000000 No AP found at this apsel 0x3 No ROM table present

>

ROMTable
To interpret content of above ROMTable, have a look to


 * OMAP35x Technical Reference Manual (Rev. B) (spruf98b.pdf, 39622 Kbytes), Table 5-105
 * CoreSight Components TRM (ARM DDI 0314F), Table 2-3
 * Cortex-A8 TRM (ARM DDI 0344H)

With this, we get (first three entries are in the MPU SS Module, address range 0x54010000 - 0x54018000, part number is given by PID1[3-0] and PID0[7-0]):

ROMTABLE[0x0] = 0xd4010003 Component base address 0x54010000, pid4 0x4, start address 0x54010000 Component cid1 0x90, class is CoreSight component CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd PID3 0x10, PID2 0x2b, PID1 0xb9, PID0, 0x21


 * Part number is 0x921: ETM module. See Cortex-A8 TRM chapter 14.

ROMTABLE[0x4] = 0xd4011003 Component base address 0x54011000, pid4 0x4, start address 0x54011000 Component cid1 0x90, class is CoreSight component CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd PID3 0x10, PID2 0x2b, PID1 0xbc, PID0, 0x8


 * Part number is 0xC08: This is the Debug Register Interface. See table 12-3 in the Cortex-A8 TRM.

ROMTABLE[0x8] = 0xd4012003 Component base address 0x54012000, pid4 0x0, start address 0x54012000 Component cid1 0x90, class is CoreSight component CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd PID3 0x0, PID2 0x9, PID1 0x71, PID0, 0x13


 * Part number 0x113: This is ????

ROMTABLE[0x10] = 0xd4019003 Component base address 0x54019000, pid4 0x4, start address 0x54019000 Component cid1 0x90, class is CoreSight component CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd PID3 0x0, PID2 0x1b, PID1 0xb9, PID0, 0x12


 * Part number 0x912: TPIU Module.

ROMTABLE[0x14] = 0xd401b003 Component base address 0x5401b000, pid4 0x4, start address 0x5401b000 Component cid1 0x90, class is CoreSight component CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd PID3 0x0, PID2 0xb, PID1 0xb9, PID0, 0x7


 * Part number 0x907: ETB Module.

ROMTABLE[0x18] = 0xd401d003 Component base address 0x5401d000, pid4 0x0, start address 0x5401d000 Component cid1 0xf0, class is Non standard layout CID3 0xb1, CID2 0x5, CID1 0xf0, CID0, 0xd PID3 0x0, PID2 0x9, PID1 0x73, PID0, 0x43


 * Part number 0x343: DAP CTL Module.

ROMTABLE[0x1c] = 0xd4500003 Component base address 0x54500000, pid4 0x0, start address 0x54500000 Component cid1 0x90, class is CoreSight component CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd PID3 0x0, PID2 0x19, PID1 0x71, PID0, 0x20


 * Part number 0x120: SDTI Module.

Debug Register Interface
With above info about debug register interface and table 12-3 in the Cortex-A8 TRM we are able to access this interface using OpenOCDs mdw command:

> omap3.cpu mdw 0x54011000 0x54011000 15141012

This is the debug ID register. See table 12-11 of Cortex-A8 TRM:

> omap3.cpu mdw 0x54011FF0 0x54011ff0 0000000d > omap3.cpu mdw 0x54011FF4 0x54011ff4 00000090 > omap3.cpu mdw 0x54011FF8 0x54011ff8 00000005 > omap3.cpu mdw 0x54011FFC 0x54011ffc 000000b1

These are the component identification registers. See table 12-51 of Cortex-A8 TRM.