SAM7

Connectivity

ID Target Interface Description Initial state Input Expected output Actual output Pass/Fail
CON001 AT91FR40162 ZY1000 Telnet connection Power on, jtag target attached On console, type
telnet ip port
Open On-Chip Debugger
>
Open On-Chip Debugger
>
PASS
CON002 AT91FR40162 ZY1000 GDB server connection Power on, jtag target attached On GDB console, type
target remote ip:port
Remote debugging using 10.0.0.73:3333 (gdb) tar remo 10.0.0.138:3333
Remote debugging using 10.0.0.138:3333
0x000155b8 in ?? ()
PASS

Reset

ID Target Interface Description Initial state Input Expected output Actual output Pass/Fail
RES001 AT91FR40162 ZY1000 Reset halt on a blank target Erase all the content of the flash Connect via the telnet interface and type
reset halt
Reset should return without error and the output should contain
target state: halted
> mdw 0x01000000 32
0x01000000: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff
0x01000020: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff
0x01000040: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff
0x01000060: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff
> reset halt
JTAG tap: zy1000.cpu tap/device found: 0x1f0f0f0f (mfg: 0x787, part: 0xf0f0, ver: 0x1)
srst pulls trst - can not reset into halted mode. Issuing halt after reset.
target state: halted
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x600000d3 pc: 0x00008a70
>
PASS
RES002 AT91FR40162 ZY1000 Reset init on a blank target Erase all the content of the flash Connect via the telnet interface and type
reset init
Reset should return without error and the output should contain
executing reset script 'name_of_the_script'
> reset init
JTAG tap: zy1000.cpu tap/device found: 0x1f0f0f0f (mfg: 0x787, part: 0xf0f0, ver: 0x1)
srst pulls trst - can not reset into halted mode. Issuing halt after reset.
target state: halted
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x600000d3 pc: 0x00008ea4
>
PASS
NOTE! Even if there is no message, the reset script is being executed (proved by side effects)
RES003 AT91FR40162 ZY1000 Reset after a power cycle of the target Reset the target then power cycle the target Connect via the telnet interface and type
reset halt after the power was detected
Reset should return without error and the output should contain
target state: halted
Sensed nSRST asserted
Sensed power dropout.
target state: halted
target halted in ARM state due to debug request, current mode: Supervisor
cpsr: 0xf00000d3 pc: 0xd5dff7e6
Sensed power restore.
Sensed nSRST deasserted
> reset halt
JTAG device found: 0x3f0f0f0f (Manufacturer: 0x787, Part: 0xf0f0, Version: 0x3)
srst pulls trst - can not reset into halted mode. Issuing halt after reset.
target state: halted
target halted in ARM state due to debug request, current mode: Supervisor
cpsr: 0xf00000d3 pc: 0x0000072c
>
PASS
RES004 AT91FR40162 ZY1000 Reset halt on a blank target where reset halt is supported Erase all the content of the flash Connect via the telnet interface and type
reset halt
Reset should return without error and the output should contain
target state: halted
pc = 0
> reset halt
JTAG tap: zy1000.cpu tap/device found: 0x1f0f0f0f (mfg: 0x787, part: 0xf0f0, ver: 0x1)
srst pulls trst - can not reset into halted mode. Issuing halt after reset.
target state: halted
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0xf00000d3 pc: 0x00008b38
>
PASS
RES005 AT91FR40162 ZY1000 Reset halt on a blank target using return clock Erase all the content of the flash, set the configuration script to use RCLK Connect via the telnet interface and type
reset halt
Reset should return without error and the output should contain
target state: halted
N/A, At91EB40A does NOT have support for RCLK N/A

JTAG Speed

ID Target ZY1000 Description Initial state Input Expected output Actual output Pass/Fail
SPD001 AT91FR40162 ZY1000 16MHz on normal operation Reset init the target according to RES002 Change speed and exercise a memory access over the JTAG, for example
mdw 0x0 32
The command should run without any errors. If any JTAG checking errors happen, the test failed > reset halt
JTAG tap: zy1000.cpu tap/device found: 0x1f0f0f0f (mfg: 0x787, part: 0xf0f0, ver: 0x1)
srst pulls trst - can not reset into halted mode. Issuing halt after reset.
target state: halted
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0xf00000d3 pc: 0x00008ae8
> jtag_khz 16000
jtag_speed 4 => JTAG clk=16.000000
16000 kHz
> mdw 0 32
0x00000000: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff
0x00000020: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff
0x00000040: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff
0x00000060: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff
PASS
SPD002 AT91FR40162 ZY1000 8MHz on normal operation Reset init the target according to RES002 Change speed and exercise a memory access over the JTAG, for example
mdw 0x0 32
The command should run without any errors. If any JTAG checking errors happen, the test failed > reset halt
JTAG tap: zy1000.cpu tap/device found: 0x1f0f0f0f (mfg: 0x787, part: 0xf0f0, ver: 0x1)
srst pulls trst - can not reset into halted mode. Issuing halt after reset.
target state: halted
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0xf00000d3 pc: 0x00008c14
> jtag_khz 8000
jtag_speed 8 => JTAG clk=8.000000
8000 kHz
> mdw 0 32
0x00000000: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff
0x00000020: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff
0x00000040: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff
0x00000060: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff
>
PASS
SPD003 AT91FR40162 ZY1000 4MHz on normal operation Reset init the target according to RES002 Change speed and exercise a memory access over the JTAG, for example
mdw 0x0 32
The command should run without any errors. If any JTAG checking errors happen, the test failed > reset halt
JTAG tap: zy1000.cpu tap/device found: 0x1f0f0f0f (mfg: 0x787, part: 0xf0f0, ver: 0x1)
srst pulls trst - can not reset into halted mode. Issuing halt after reset.
target state: halted
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0xf00000d3 pc: 0x00008bc4
> jtag_khz 4000
jtag_speed 16 => JTAG clk=4.000000
4000 kHz
> mdw 0 32
0x00000000: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff
0x00000020: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff
0x00000040: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff
0x00000060: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff
>
PASS
SPD004 AT91FR40162 ZY1000 2MHz on normal operation Reset init the target according to RES002 Change speed and exercise a memory access over the JTAG, for example
mdw 0x0 32
The command should run without any errors. If any JTAG checking errors happen, the test failed > reset halt
JTAG tap: zy1000.cpu tap/device found: 0x1f0f0f0f (mfg: 0x787, part: 0xf0f0, ver: 0x1)
srst pulls trst - can not reset into halted mode. Issuing halt after reset.
target state: halted
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0xf00000d3 pc: 0x00009678
> jtag_khz 2000
jtag_speed 32 => JTAG clk=2.000000
2000 kHz
> mdw 0 32
0x00000000: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff
0x00000020: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff
0x00000040: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff
0x00000060: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff
>
PASS
SPD005 AT91FR40162 ZY1000 RCLK on normal operation Reset init the target according to RES002 Change speed and exercise a memory access over the JTAG, for example
mdw 0x0 32
The command should run without any errors. If any JTAG checking errors happen, the test failed > jtag_khz 0
RCLK - adaptive
RCLK timeout
N/A for this target
N/A for this target

Debugging

ID Target Interface Description Initial state Input Expected output Actual output Pass/Fail
DBG001 AT91FR40162 ZY1000 Load is working Reset init is working, RAM is accesible, GDB server is started On the console of the OS:
$ arm-none-eabi-gdb redboot_ram.elf
(gdb) target remote ip:port
(gdb) load
Load should return without error, typical output looks like:
Loading section .text, size 0x14c lma 0x0
Start address 0x40, load size 332
Transfer rate: 180 bytes/sec, 332 bytes/write.
(gdb) load
Loading section .rom_vectors, size 0x40 lma 0xc000
Loading section .text, size 0x103e8 lma 0xc040
Loading section .rodata, size 0x1a84 lma 0x1c428
Loading section .data, size 0x3ec lma 0x1deac
Start address 0xc040, load size 74392
Transfer rate: 572 KB/sec, 9299 bytes/write.
(gdb)
PASS
DBG002 AT91FR40162 ZY1000 Software breakpoint Load the redboot_ram.elf application, use instructions from GDB001 In the GDB console:
(gdb) monitor arm7_9 dbgrq enable
software breakpoints enabled
(gdb) break cyg_start
Breakpoint 1 at 0xec: file src/main.c, line 71.
(gdb) continue
Continuing.
The software breakpoint should be reached, a typical output looks like:
Breakpoint 1, main () at src/main.c:69
69 DWORD a = 1;
(gdb) monitor arm7_9 dbgrq enable
use of EmbeddedICE dbgrq instead of breakpoint for target halt enabled
(gdb) break cyg_start

Breakpoint 1 at 0x155b8: file /home/edgar/temp/ecosboard/packages/redboot/current/src/main.c, line 264.
(gdb) continue
Continuing.

Breakpoint 1, cyg_start ()
at /home/edgar/temp/ecosboard/packages/redboot/current/src/main.c:264
264 CYGACC_CALL_IF_MONITOR_VERSION_SET(RedBoot_version);
(gdb)
PASS
DBG003 AT91FR40162 ZY1000 Single step in a RAM application Load the test_ram.elf application, use instructions from GDB001, break in main using the instructions from GDB002 In GDB, type
(gdb) step
The next instruction should be reached, typical output:
(gdb) step
70 DWORD b = 2;
(gdb) step
266 CYGACC_CALL_IF_MONITOR_RETURN_SET(return_to_redboot);
(gdb)
PASS
DBG004 AT91FR40162 ZY1000 Software break points are working after a reset Load the test_ram.elf application, use instructions from GDB001, break in main using the instructions from GDB002 In GDB, type
(gdb) monitor reset init
(gdb) load
(gdb) continue
The breakpoint should be reached, typical output:
Breakpoint 1, main () at src/main.c:69
69 DWORD a = 1;
(gdb) moni reset init
JTAG tap: zy1000.cpu tap/device found: 0x1f0f0f0f (mfg: 0x787, part: 0xf0f0, ver: 0x1)
srst pulls trst - can not reset into halted mode. Issuing halt after reset.
target state: halted
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x600000d3 pc: 0x00008ae8
(gdb) load
Loading section .rom_vectors, size 0x40 lma 0xc000
Loading section .text, size 0x103e8 lma 0xc040
Loading section .rodata, size 0x1a84 lma 0x1c428
Loading section .data, size 0x3ec lma 0x1deac
Start address 0xc040, load size 74392
Transfer rate: 576 KB/sec, 9299 bytes/write.
(gdb) c
Continuing.

Breakpoint 1, cyg_start ()
at /home/edgar/temp/ecosboard/packages/redboot/current/src/main.c:264
264 CYGACC_CALL_IF_MONITOR_VERSION_SET(RedBoot_version);
(gdb)
PASS
DBG005 AT91FR40162 ZY1000 Hardware breakpoint Flash the redboot_rom.elf application. Make this test after FLA004 has passed Be sure that gdb_memory_map and gdb_flash_program are enabled. In GDB, type
(gdb) monitor reset init
(gdb) load
Loading section .text, size 0x194 lma 0x100000
Start address 0x100040, load size 404
Transfer rate: 179 bytes/sec, 404 bytes/write.
(gdb) monitor arm7_9 force_hw_bkpts enable
force hardware breakpoints enabled
(gdb) break main
Breakpoint 1 at 0x100134: file src/main.c, line 69.
(gdb) continue
The breakpoint should be reached, typical output:
Continuing.

Breakpoint 1, main () at src/main.c:69
69 DWORD a = 1;
(gdb) load
Loading section .rom_vectors, size 0x40 lma 0x1000000
Loading section .text, size 0x10638 lma 0x1000040
Loading section .rodata, size 0x1a84 lma 0x1010678
Loading section .data, size 0x428 lma 0x10120fc
Start address 0x1000040, load size 75044
Transfer rate: 33 KB/sec, 9380 bytes/write.
(gdb) break cyg_start
Breakpoint 1 at 0x100979c: file /home/edgar/temp/ecosboard/packages/redboot/current/src/main.c, line 264.
(gdb) c
Continuing.
Note: automatically using hardware breakpoints for read-only addresses.

Breakpoint 1, cyg_start () at /home/edgar/temp/ecosboard/packages/redboot/current/src/main.c:264
264 CYGACC_CALL_IF_MONITOR_VERSION_SET(RedBoot_version);
(gdb)
PASS
DBG006 AT91FR40162 ZY1000 Hardware breakpoint is set after a reset Follow the instructions to flash and insert a hardware breakpoint from DBG005 In GDB, type
(gdb) monitor reset
(gdb) monitor reg pc 0x100000
pc (/32): 0x00100000
(gdb) continue

where the value inserted in PC is the start address of the application
The breakpoint should be reached, typical output:
Continuing.

Breakpoint 1, main () at src/main.c:69
69 DWORD a = 1;
(gdb) moni reset init
JTAG tap: zy1000.cpu tap/device found: 0x1f0f0f0f (mfg: 0x787, part: 0xf0f0, ver: 0x1)
srst pulls trst - can not reset into halted mode. Issuing halt after reset.
target state: halted
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x200000d3 pc: 0x01000200
(gdb) moni reg pc 0x1000000
pc (/32): 0x01000000
(gdb) c
Continuing.

Breakpoint 1, cyg_start () at /home/edgar/temp/ecosboard/packages/redboot/current/src/main.c:264
264 CYGACC_CALL_IF_MONITOR_VERSION_SET(RedBoot_version);
(gdb)
PASS
DBG007 AT91FR40162 ZY1000 Single step in ROM Flash the test_rom.elf application and set a breakpoint in main, use DBG005. Make this test after FLA004 has passed Be sure that gdb_memory_map and gdb_flash_program are enabled. In GDB, type
(gdb) monitor reset
(gdb) load
Loading section .text, size 0x194 lma 0x100000
Start address 0x100040, load size 404
Transfer rate: 179 bytes/sec, 404 bytes/write.
(gdb) monitor arm7_9 force_hw_bkpts enable
force hardware breakpoints enabled
(gdb) break main
Breakpoint 1 at 0x100134: file src/main.c, line 69.
(gdb) continue
Continuing.

Breakpoint 1, main () at src/main.c:69
69 DWORD a = 1;
(gdb) step
The breakpoint should be reached, typical output:
target state: halted
target halted in ARM state due to single step, current mode: Supervisor
cpsr: 0x60000013 pc: 0x0010013c
70 DWORD b = 2;
Breakpoint 1, cyg_start () at /home/edgar/temp/ecosboard/packages/redboot/current/src/main.c:264
264 CYGACC_CALL_IF_MONITOR_VERSION_SET(RedBoot_version);
(gdb) step
266 CYGACC_CALL_IF_MONITOR_RETURN_SET(return_to_redboot);
PASS

RAM access

Note: these tests are not designed to test/debug the target, but to test functionalities!
ID Target Interface Description Initial state Input Expected output Actual output Pass/Fail
RAM001 AT91FR40162 ZY1000 32 bit Write/read RAM Reset init is working On the telnet interface
> mww ram_address 0xdeadbeef 16
> mdw ram_address 32
The commands should execute without error. A clear failure is a memory access exception. The result of running the commands should be a list of 16 locations 32bit long containing 0xdeadbeef.
> mww 0x0 0xdeadbeef 16
> mdw 0x0 32
0x00000000: deadbeef deadbeef deadbeef deadbeef deadbeef deadbeef deadbeef deadbeef
0x00000020: deadbeef deadbeef deadbeef deadbeef deadbeef deadbeef deadbeef deadbeef
0x00000040: e1a00000 e59fa51c e59f051c e04aa000 00080017 00009388 00009388 00009388
0x00000060: 00009388 0002c2c0 0002c2c0 000094f8 000094f4 00009388 00009388 00009388
> mww 0 0xdeadbeef 16
> mdw 0x0 32
0x00000000: deadbeef deadbeef deadbeef deadbeef deadbeef deadbeef deadbeef deadbeef
0x00000020: deadbeef deadbeef deadbeef deadbeef deadbeef deadbeef deadbeef deadbeef
0x00000040: 15aadc6d 425b6f33 e789f955 d390dcc2 00080017 010067b4 010067b4 010067b4
0x00000060: 010067b4 00006e74 00006e74 010067b4 010067b4 010067b4 010067b4 010067b4
PASS
RAM002 AT91FR40162 ZY1000 16 bit Write/read RAM Reset init is working On the telnet interface
> mwh ram_address 0xbeef 16
> mdh ram_address 32
The commands should execute without error. A clear failure is a memory access exception. The result of running the commands should be a list of 16 locations 16bit long containing 0xbeef.
> mwh 0x0 0xbeef 16
> mdh 0x0 32
0x00000000: beef beef beef beef beef beef beef beef beef beef beef beef beef beef beef beef
0x00000020: 00e0 0000 021c 0000 0240 0000 026c 0000 0288 0000 0000 0000 0388 0000 0350 0000
>
> mwh 0 0xbeef 16
> mdh 0x0 32
0x00000000: beef beef beef beef beef beef beef beef beef beef beef beef beef beef beef beef
0x00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
PASS
There is a problem with the formatting of the output
RAM003 AT91FR40162 ZY1000 8 bit Write/read RAM Reset init is working On the telnet interface
> mwb ram_address 0xab 16
> mdb ram_address 32
The commands should execute without error. A clear failure is a memory access exception. The result of running the commands should be a list of 16 locations 8bit long containing 0xab.
> mwb ram_address 0xab 16
> mdb ram_address 32
0x00000000: ab ab ab ab ab ab ab ab ab ab ab ab ab ab ab ab 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>
> mwb 0x0 0xab 16
> mdb 0x0 32
0x00000000: ab ab ab ab ab ab ab ab ab ab ab ab ab ab ab ab 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
PASS

Flash access

ID Target Interface Description Initial state Input Expected output Actual output Pass/Fail
FLA001 AT91FR40162 ZY1000 Flash probe Reset init is working On the telnet interface:
> flash probe 0
The command should execute without error. The output should state the name of the flash and the starting address. An example of output:
flash 'ecosflash' found at 0x01000000
> flash probe 0 flash 'ecosflash' found at 0x01000000 PASS
FLA002 AT91FR40162 ZY1000 flash fillw Reset init is working, flash is probed On the telnet interface
> flash fillw 0x100000 0xdeadbeef 16
The commands should execute without error. The output looks like:
wrote 64 bytes to 0x0100000 in 11.610000s (0.091516 kb/s)
To verify the contents of the flash:
> mdw 0x100000 32
0x0100000: deadbeef deadbeef deadbeef deadbeef deadbeef deadbeef deadbeef deadbeef
0x0100020: deadbeef deadbeef deadbeef deadbeef deadbeef deadbeef deadbeef deadbeef
0x0100040: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff
0x0100060: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff
> flash fillw 0x01000000 0xdeadbeef 16
wrote 64 bytes to 0x01000000 in 0.010000s (6.250 kb/s)
> mdw 0x1000000 32
0x01000000: deadbeef deadbeef deadbeef deadbeef deadbeef deadbeef deadbeef deadbeef
0x01000020: deadbeef deadbeef deadbeef deadbeef deadbeef deadbeef deadbeef deadbeef
0x01000040: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff
0x01000060: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff
>
PASS
FLA003 AT91FR40162 ZY1000 Flash erase Reset init is working, flash is probed On the telnet interface
> flash erase_address 0x100000 0x2000
The commands should execute without error.
erased address 0x0100000 length 8192 in 4.970000s To check that the flash has been erased, read at different addresses. The result should always be 0xff. > mdw 0x100000 32
0x0100000: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff
0x0100020: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff
0x0100040: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff
0x0100060: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff
> flash erase_address 0x1000000 0x10000
erased address 0x01000000 (length 65536) in 0.840000s (76.190 kb/s)
> mdw 0x1000000 32
0x01000000: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff
0x01000020: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff
0x01000040: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff
0x01000060: ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff
PASS
FLA004 AT91FR40162 ZY1000 Loading to flash from GDB Reset init is working, flash is probed, connectivity to GDB server is working Start GDB using a ROM elf image, eg: arm-elf-gdb test_rom.elf.
(gdb) target remote ip:port
(gdb) monitor reset halt
(gdb) load
Loading section .text, size 0x194 lma 0x100000
Start address 0x100040, load size 404
Transfer rate: 179 bytes/sec, 404 bytes/write.
(gdb) monitor verify_image path_to_elf_file
The output should look like:
verified 404 bytes in 5.060000s
The failure message is something like:
Verify operation failed address 0x00200000. Was 0x00 instead of 0x18
(gdb) load
Loading section .rom_vectors, size 0x40 lma 0x1000000
Loading section .text, size 0x10638 lma 0x1000040
Loading section .rodata, size 0x1a84 lma 0x1010678
Loading section .data, size 0x428 lma 0x10120fc
Start address 0x1000040, load size 75044
Transfer rate: 34 KB/sec, 9380 bytes/write.
(gdb) moni verify_image /tftp/10.0.0.190/redboot_rom.elf
keep_alive() was not invoked in the 1000ms timelimit. GDB alive packet not sent! (1820). Workaround: increase "set remotetimeout" in GDB
verified 75044 bytes in 1.960000s (37.390 kb/s)
PASS