RTEMS | TI TMS570LC43x launchpad: openOCD+GDB development, no flash (#5537)

[Armaan Chowfin (@ar-in0)]

Armaan Chowfin created an issue: https://gitlab.rtems.org/rtems/rtos/rtems/-/issues/5537



# Summary

RTEMS has support for the following MCUs in the TMS570 family, both are ARM Cortex-R:

* TMS570LS31x: RTEMS upstream has code to build binaries for both internal SRAM and external SDRAM.
* TMS570LC43x: Binaries can be built only for the HDK version of the board with external SDRAM. **No current workflow to run binaries from internal SRAM.** Below I describe my setup, tested on ubuntu24.04.

  ![image.png](/uploads/1cefbe8b2bd64f1ac6a2234f5b75ae03/image.png){width=907 height=416}

Workflow requires some upstream fixes (step 1). Request suggestions/corrections. See [gdb script](https://github.com/ar-in0/notes.d/blob/main/tms570-sram.gdb) comments for more details.

# Workflow

1. Add a custom config to openOCD: [`usr/share/openocd/board/ti_launchxl2_570lc43.cfg`](https://github.com/ar-in0/notes.d/blob/main/ti_launchxl2_570lc43x.cfg)

   ```bash
   # connect openOCD gdb server to launchpad debugger
   # -d3 for debug logs
   openocd -d3 -f board/ti_launchxl2_570lc43.cfg
   ```
2. Link all ELF sections to RAM_INT: Replace current `tms570lc4357_hdk.linkcmds` contents with `tms570ls3137_hdk_intram.linkcmds`

   ```bash
   # config.ini
   [arm/tms570lc4357_hdk]
   
   # bugfix in arm/shared/start.S: `bsp_start_hook_0`
   # without this change, code will jump to tms570_memory_init() at runtime
   # and clear the SRAM region where we loaded our rtems binary.
   cmp r1, r0 # change to cmp r0, r1
   blt xx # change to blo xx (blt xx works, but might break flash, external sdram builds)
   
   # configure and build
   ./waf configure --prefix=<path> --rtems-config=<path>
   ./waf build
   ```
3. Connect gdb to debug server using [gdb script](https://github.com/ar-in0/notes.d/blob/main/tms570-sram.gdb): Recommend copying it to the same directory as test executables.

   ```bash
   # connects to openOCD, loads to SRAM, ARM register setup. 
   # See comments in gdb script.
   arm-rtems7-gdb -x tms570-sram.gdb hello.exe
   
   # run the program from RAM
   (gdb) c
   ```

To observe uart output, use picocom/minicom and listen at tty/acm0 with baud 115200. Do this before step 3.

# Additional Info, Debugging

Some arm cortex-R core registers are not memory mapped like cortex-M and need different commands:

* `mrc`: read register, `mcr`: write register.

```bash
# https://developer.arm.com/documentation/ddi0363/g/System-Control/About-system-control/MPU-control-and-configuration?lang=en 
monitor arm mrc 15 0 6 0 2 # read IFAR: address of faulting instruction

# see https://developer.arm.com/documentation/ddi0363/g/System-Control/Register-descriptions/Fault-Status-and-Address-Registers?lang=en 
monitor arm mrc 15 0 5 0 1 # ifsr: cause of fault

# ARM organizes memory into regions with certain memory types, each has some default permissions
# To modify region permissions we must select region -> check base address of region -> modify permissions. See https://developer.arm.com/documentation/ddi0363/g/Memory-Protection-Unit/About-the-MPU/Memory-regions?lang=en
monitor arm mrc 15 0 6 2 0 2 # select region 2 in "memory region number regiser"
monitor arm mrc 15 0 6 1 0  # get region base address of selected region

# For tms570 launchpad internal SRAM, returns 4875 i.e. 0b0001 0011 0000 1011: bit 12 is set; region 2 is an XN region by default ("execute never", no instruction fetch allowed). See https://developer.arm.com/documentation/ddi0363/g/System-Control/Register-descriptions/c6--MPU-memory-region-programming-registers?lang=en
monitor arm mrc 15 0 6 1 4 # get selected region perms from "region control access register". 

# See https://developer.arm.com/documentation/ddi0363/g/Memory-Protection-Unit/MPU-interaction-with-memory-system?lang=en
# We want 0000 0011 0000 1011 i.e. 779
monitor arm mcr 15 0 6 1 4 779 # Modify memory permissions of selected region.
```

Setting breakpoints

* use `hbreak` and not `break`

```bash
(gdb) hbreak _start
(gdb) hbreak bsp_start_hook_0_done
(gdb) hbreak rtems_initialize_executive
(gdb) c
etc...
```

To debug sysinit handler initialization:

* These are initialized via function pointers. Name+call order of the functions is not clear from source.

```
# Function pointers are placed in elf in call order
arm-rtems7-nm hello.exe | grep _Sysinit | sort

hbreak <unmangled-symbol>
```

Processor states

* These are useful to track faults due to stale state from previous runs.
* I use the PORRST button on launchpad/unplug replug, start from supervisor mode at every run.

```bash
(gdb) info reg cpsr

# cpsr must end with 0b1 0011
Supervisor Mode (clean start state, breakpoint halt): 0x80000313, 0x20000313, 0x60000313, 0x800003b3
Abort Mode (ex. Ctrl+C halt): 0x80000397,
# bit 7,6 = 1 -> IRQ, FIQ disabled
External IRQ Mode (ex. spurious interrupt, pending interrupt): 0x20000392,
```

-- 
View it on GitLab: https://gitlab.rtems.org/rtems/rtos/rtems/-/issues/5537
You're receiving this email because of your account on gitlab.rtems.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rtems.org/pipermail/bugs/attachments/20260329/1515a144/attachment-0001.htm>