[SOLVED] Can't debug LPC4088 because of Boot ROM

This site uses cookies. By continuing to browse this site, you are agreeing to our Cookie Policy.

  • [SOLVED] Can't debug LPC4088 because of Boot ROM

    I am trying to upload this simple assembly program:

    .global _start
    .text _start:

    mov r0, #0
    mov r1, #1

    increase:
    add r0, r0, r1
    cmp r0, #10
    bne increase
    decrease:

    sub r0, r0, r1
    cmp r0, #0
    bne decrease

    b increase
    stop: b stop


    to my LPC4088 (I am using Embedded artists LPC4088 QSB) via JLink so I could later debug it. First I compiled my sources with all the debugging symbols using GCC toolchain:

    arm-none-eabi-as -g -gdwarf-2 -o program.o program.s
    arm-none-eabi-ld -Ttext=0x0 -o program.elf program.o
    arm-none-eabi-objcopy -O binary program.elf program.bin


    I then opened application JLinkExe. In application's terminal I powered on my board using power on, I connected to the Cortex-M4 using command connect and uploaded my binaries using loadbin program.bin 0x0 which should download this into target's FLASH memory located at 0x0. At last I set the program counter to start at the beginning SetPC 0x4.

    But when I start debugging using step command s I get commands that I haven't even used in my source file...

    This is the whole procedure inside JLinkExe terminal:

    J-Link>power on
    J-Link>connect
    Device "CORTEX-M4" selected.

    Connecting to target via JTAG
    TotalIRLen = 4, IRPrint = 0x01
    JTAG chain detection found 1 devices:
    #0 Id: 0x4BA00477, IRLen: 04, CoreSight JTAG-DP
    Scanning AP map to find all available APs
    AP[1]: Stopped AP scan as end of AP map has been reached
    AP[0]: AHB-AP (IDR: 0x24770011)
    Iterating through AP map to find AHB-AP to use
    AP[0]: Core found
    AP[0]: AHB-AP ROM base: 0xE00FF000
    CPUID register: 0x410FC241. Implementer code: 0x41 (ARM)
    Found Cortex-M4 r0p1, Little endian.
    FPUnit: 6 code (BP) slots and 2 literal slots
    CoreSight components:
    ROMTbl[0] @ E00FF000
    ROMTbl[0][0]: E000E000, CID: B105E00D, PID: 000BB00C SCS-M7
    ROMTbl[0][1]: E0001000, CID: B105E00D, PID: 003BB002 DWT
    ROMTbl[0][2]: E0002000, CID: B105E00D, PID: 002BB003 FPB
    ROMTbl[0][3]: E0000000, CID: B105E00D, PID: 003BB001 ITM
    ROMTbl[0][4]: E0040000, CID: B105900D, PID: 000BB9A1 TPIU
    ROMTbl[0][5]: E0041000, CID: B105900D, PID: 000BB925 ETM
    Cortex-M4 identified.
    J-Link>loadbin program.bin 0x0
    Halting CPU for downloading file.
    Downloading file [program.bin]...
    O.K.
    J-Link>SetPC 0x4
    J-Link>s
    00000004: 1D 00 MOVS R5, R3
    J-Link>s
    00000006: FF 1F SUBS R7, R7, #7
    J-Link>s
    00000008: E1 00 LSLS R1, R4, #3
    J-Link>s
    0000000A: FF 1F SUBS R7, R7, #7
    J-Link>s
    0000000C: E3 00 LSLS R3, R4, #3
    J-Link>s
    0000000E: FF 1F SUBS R7, R7, #7
    J-Link>s
    00000010: E5 00 LSLS R5, R4, #3
    J-Link>s
    00000012: FF 1F SUBS R7, R7, #7
    J-Link>s
    00000014: E7 00 LSLS R7, R4, #3
    J-Link>


    So this code must have come from somewhere and it may be the LPC4088's Boot ROM which is remapped to 0x0 at boot time as is stated on page 907 of the LPC4088 user manual :

    [img]https://i.stack.imgur.com/3hkhH.png[/img]


    Do you have any idea on how to overcome this Boot ROM problem, so I could debug my program normally? Is it possible to somehow use register MEMMAP described above?

    The post was edited 4 times, last by 71GA ().

  • Hello,

    Does the issue resolve when you specify the actual target device LPC4088 instead of Cortex-M4?

    Do you have any idea on how to overcome this Boot ROM problem, so I could debug my program normally? Is it possible to somehow use register MEMMAP described above?

    You can directly write to the SFR any value you want with J-Link commander using the write and read functions described in the J-Link user manual.

    A JLinkScript can be used as well if you need such a write directly after reset or similar.

    For debugging and application maintenance we recommend using our cross platform IDE Embedded Studio which can be used for free for educational and home usage.
    segger.com/products/development-tools/embedded-studio/

    For the LPC4000 series we offer CPU Support Packages in Embedded Studio so you can get started with an example project within a couple of minutes.

    Best regards,
    Nino
    Please read the forum rules before posting.

    Keep in mind, this is *not* a support forum.
    Our engineers will try to answer your questions between their projects if possible but this can be delayed by longer periods of time.
    Should you be entitled to support you can contact us via our support system: segger.com/ticket/

    Or you can contact us via e-mail.
  • I found out this in the LPC4088's user manual , p. 876:
    The reserved Cortex-M4 exception vector location 7 (offset 0x001C in the vector table)
    should contain the 2’s complement of the check-sum of table entries 0 through 6. This
    causes the checksum of the first 8 table entries to be 0. The boot loader code checksums
    the first 8 locations in sector 0 of the flash. If the result is 0, then execution control is
    transferred to the user code.
    So I added a vector table in my assembly program:


    .global _start
    .text


    reset: b _start
    undefined: b undefined
    software_interrupt: b software_interrupt
    prefetch_abort: b prefetch_abort
    data_abort: b data_abort
    nop
    interrupt_request: b interrupt_request
    fast_interrupt_request: b fast_interrupt_request



    _start:


    mov r0, #0
    mov r1, #1

    increase:

    add r0, r0, r1
    cmp r0, #10
    bne increase


    decrease:


    sub r0, r0, r1
    cmp r0, #0
    bne decrease
    b increase


    stop: b stop

    then I compiled my program using GCC toolchain like this:

    arm-none-eabi-as -g -gdwarf-2 -o program.o program.s
    arm-none-eabi-ld -Ttext=0x0 -o program.elf program.o
    arm-none-eabi-objcopy -O binary program.elf program.bin



    and I made sure that I wrote the checksum to my binary as instructed in this article. Now this should
    be ready but it looks like there are some problems with JLinkExe:

    SEGGER J-Link Commander V6.30a (Compiled Jan 31 2018 18:14:21)
    DLL version V6.30a, compiled Jan 31 2018 18:14:14


    Connecting to J-Link via USB...O.K.
    Firmware: J-Link V9 compiled Jan 29 2018 15:41:50
    Hardware version: V9.30
    S/N: 269300437
    License(s): FlashBP, GDB
    OEM: SEGGER-EDU
    VTref = 3.291V




    Type "connect" to establish a target connection, '?' for help
    J-Link>connect
    Please specify device / core. : LPC4088
    Type '?' for selection dialog
    Device>
    Please specify target interface:
    J) JTAG (Default)
    S) SWD
    TIF>
    Device position in JTAG chain (IRPre,DRPre) : -1,-1 => Auto-detect
    JTAGConf>
    Specify target interface speed [kHz]. : 4000 kHz
    Speed>
    Device "LPC4088" selected.




    Connecting to target via JTAG
    TotalIRLen = 4, IRPrint = 0x01
    JTAG chain detection found 1 devices:
    #0 Id: 0x4BA00477, IRLen: 04, CoreSight JTAG-DP
    Scanning AP map to find all available APs
    AP[1]: Stopped AP scan as end of AP map has been reached
    AP[0]: AHB-AP (IDR: 0x24770011)
    Iterating through AP map to find AHB-AP to use
    AP[0]: Core found
    AP[0]: AHB-AP ROM base: 0xE00FF000
    CPUID register: 0x410FC241. Implementer code: 0x41 (ARM)
    Found Cortex-M4 r0p1, Little endian.
    FPUnit: 6 code (BP) slots and 2 literal slots
    CoreSight components:
    ROMTbl[0] @ E00FF000
    ROMTbl[0][0]: E000E000, CID: B105E00D, PID: 000BB00C SCS-M7
    ROMTbl[0][1]: E0001000, CID: B105E00D, PID: 003BB002 DWT
    ROMTbl[0][2]: E0002000, CID: B105E00D, PID: 002BB003 FPB
    ROMTbl[0][3]: E0000000, CID: B105E00D, PID: 003BB001 ITM
    ROMTbl[0][4]: E0040000, CID: B105900D, PID: 000BB9A1 TPIU
    ROMTbl[0][5]: E0041000, CID: B105900D, PID: 000BB925 ETM
    Cortex-M4 identified.
    J-Link>h
    PC = 000001A8, CycleCnt = 5CD09A47
    R0 = 00000000, R1 = 20098038, R2 = 2009803C, R3 = 0008D5BB
    R4 = 00000000, R5 = 00000000, R6 = 12345678, R7 = 00000000
    R8 = 6C2030C3, R9 = 0430D364, R10= 10000000, R11= 00000000
    R12= 899B552C
    SP(R13)= 1000FFF0, MSP= 1000FFF0, PSP= 6EBAA808, R14(LR) = 00000205
    XPSR = 21000000: APSR = nzCvq, EPSR = 01000000, IPSR = 000 (NoException)
    CFBP = 00000000, CONTROL = 00, FAULTMASK = 00, BASEPRI = 00, PRIMASK = 00


    FPS0 = 92350E50, FPS1 = 454D1594, FPS2 = 01BA2FC2, FPS3 = E8513EEC
    FPS4 = C937E8F4, FPS5 = A2BD7BE2, FPS6 = 0F16C263, FPS7 = 90E88039
    FPS8 = 302C0AB8, FPS9 = 8807BC9C, FPS10= 9A1A2667, FPS11= 76CDDDFE
    FPS12= B6FFFA20, FPS13= B577863B, FPS14= 2175F736, FPS15= 5D35EC5F
    FPS16= 98917B32, FPS17= C964EEB6, FPS18= FEDDA501, FPS19= 1703B47B
    FPS20= 2FB78232, FPS21= 97BC40E3, FPS22= 928C911C, FPS23= 20A1BF55
    FPS24= 4AE3AD0C, FPS25= 4F47CC1E, FPS26= C7B418D5, FPS27= 3EAF9244
    FPS28= 73C795D0, FPS29= 23D9C85E, FPS30= 823AFA80, FPS31= EC9CBCD5
    FPSCR= 00000000
    J-Link>erase
    Erasing device (LPC4088)...
    J-Link: Flash download: Only internal flash banks will be erased.
    To enable erasing of other flash banks like QSPI or CFI, it needs to be enabled via "exec EnableEraseAllFlashBanks"
    Comparing flash [100%] Done.
    Erasing flash [100%] Done.
    Verifying flash [100%] Done.
    J-Link: Flash download: Total time needed: 3.359s (Prepare: 0.053s, Compare: 0.000s, Erase: 3.302s, Program: 0.000s, Verify: 0.000s, Restore: 0.002s)
    Erasing done.
    J-Link>loadbin program.bin 0x0
    Downloading file [program.bin]...
    Comparing flash [100%] Done.
    Erasing flash [100%] Done.
    Programming flash [100%] Done.
    Verifying flash [100%] Done.
    J-Link: Flash download: Bank 0 @ 0x00000000: 1 range affected (4096 bytes)
    J-Link: Flash download: Total time needed: 0.077s (Prepare: 0.057s, Compare: 0.001s, Erase: 0.000s, Program: 0.005s, Verify: 0.000s, Restore: 0.012s)
    O.K.
    J-Link>SetPC 0x4
    J-Link>s


    **************************
    WARNING: T-bit of XPSR is 0 but should be 1. Changed to 1.
    **************************


    J-Link>s


    ****** Error: Failed to read current instruction.
    J-Link>
  • I finally had some success! I took the same assembly code as in my post #4. But I compiled it with additional flags which should translate my UAL (Universal assembly language) to Thumb encoding instead of ARM encoding as previously. This is important as Cortex-M4 can only execute Thumb instructions and not ARM.

    arm-none-eabi-as -g -gdwarf-2 -mcpu=cortex-m0 -mthumb -mfpu=fpv4-sp-d16 -mfloat-abi=softfp -o program.o program.s
    arm-none-eabi-ld -Ttext=0x0 -o program.elf program.o
    arm-none-eabi-objcopy -O binary program.elf program.bin


    I made sure that I wrote the checksum value to my binary file program.bin as instructed in this article and now it should really work! Well it does... partially! Now let me make something clear here. If I directly uploaded program.bin through MBED interface, later in JLinkExe I couldn't connect to the LPC4088 at all! So I first uploaded the working binary file which was supplied together with my LPC4088 PCB and I upload it to via MBED interface to the LPC4088. Now this is the moment I fire up my JLinkExe, halt the mcpu, erase entire FLASH, transfer my program.bin to FLASH (0x0), set my PC to 0x0 and start stepping through my program.


    It works fine but weird thing is that MOV / SUB instructions are shown as MOVS / SUBS instructions and after first substraction program goes insane (at 0x0000001C) and starts executing LDRB and LDR commands that aren't in my source code... Take a look:


    J-Link>s
    00000000: 06 E0 B #+0x0C
    J-Link>s
    00000010: 00 20 MOVS R0, #0
    J-Link>s
    00000012: 01 21 MOVS R1, #1
    J-Link>s
    00000014: 40 18 ADDS R0, R0, R1
    J-Link>s
    00000016: 0A 28 CMP R0, #10
    J-Link>s
    00000018: FC D1 BNE #-0x08
    J-Link>s
    00000014: 40 18 ADDS R0, R0, R1
    J-Link>s
    00000016: 0A 28 CMP R0, #10
    J-Link>s
    00000018: FC D1 BNE #-0x08
    J-Link>s
    00000014: 40 18 ADDS R0, R0, R1
    J-Link>s
    00000016: 0A 28 CMP R0, #10
    J-Link>s
    00000018: FC D1 BNE #-0x08
    J-Link>s
    00000014: 40 18 ADDS R0, R0, R1
    J-Link>s
    00000016: 0A 28 CMP R0, #10
    J-Link>s
    00000018: FC D1 BNE #-0x08
    J-Link>s
    00000014: 40 18 ADDS R0, R0, R1
    J-Link>s
    00000016: 0A 28 CMP R0, #10
    J-Link>s
    00000018: FC D1 BNE #-0x08
    J-Link>s
    00000014: 40 18 ADDS R0, R0, R1
    J-Link>s
    00000016: 0A 28 CMP R0, #10
    J-Link>s
    00000018: FC D1 BNE #-0x08
    J-Link>s
    00000014: 40 18 ADDS R0, R0, R1
    J-Link>s
    00000016: 0A 28 CMP R0, #10
    J-Link>s
    00000018: FC D1 BNE #-0x08
    J-Link>s
    00000014: 40 18 ADDS R0, R0, R1
    J-Link>s
    00000016: 0A 28 CMP R0, #10
    J-Link>s
    00000018: FC D1 BNE #-0x08
    J-Link>s
    00000014: 40 18 ADDS R0, R0, R1
    J-Link>s
    00000016: 0A 28 CMP R0, #10
    J-Link>s
    00000018: FC D1 BNE #-0x08
    J-Link>s
    00000014: 40 18 ADDS R0, R0, R1
    J-Link>s
    00000016: 0A 28 CMP R0, #10
    J-Link>s
    00000018: FC D1 BNE #-0x08
    J-Link>s
    0000001A: 40 1A SUBS R0, R0, R1
    J-Link>s
    0000001C: C4 5D LDRB R4, [R0, R7]
    J-Link>s
    0000001E: F6 9D LDR R5, [SP, #+0x3D8]
    **************************
    WARNING: T-bit of XPSR is 0 but should be 1. Changed to 1.
    **************************
    J-Link>s
    ****** Error: Failed to read current instruction.
    J-Link>
  • Hello,

    For reference could you try out the attached example project for LPC4088 with our IDE Embedded Studio.
    It uses the gcc compiler as well so you can use the gcc calls there for reference.
    Does that project work on your target device?

    Best regards,
    Nino
    Files
    • lpc4088.zip

      (375.29 kB, downloaded 368 times, last: )
    Please read the forum rules before posting.

    Keep in mind, this is *not* a support forum.
    Our engineers will try to answer your questions between their projects if possible but this can be delayed by longer periods of time.
    Should you be entitled to support you can contact us via our support system: segger.com/ticket/

    Or you can contact us via e-mail.