倾家荡产求解决 eboot跑飞 ATMEL芯片 (AEM926EJ-S)

[running_flying_safe]

在eboot的startup.s中添加点灯操作来判断程序执行情况，可是在 b OALStartUp 上一句添加点灯时可以顺利执行，在进入 OALStartUp 函数里面第一句添加点灯就无法实现
然后尝试在程序中添加死循环语句，使用jlink来判断程序执行位置，我认为如果顺利执行的话，会看到pc值停留在一个数值上，可是目前pc也老是=0x00000010.
移植官方提供的代码，对比了几个芯片的代码 (AEM926EJ-S)，关于这一部分都是一样实现的

上代码

[falloutmx]

可以用gdb配合jlink调试uboot，这样可以单步执行。

[xqhrs232]

有没开发板？把你自己编译的代码放开发板上跑跑看

[running_flying_safe]

引用 1 楼 falloutmx 的回复:

可以用gdb配合jlink调试uboot，这样可以单步执行。

我是一步步执行了，在BUILDTTB 函数第一句就执行有问题，请看代码 [code=c]; INCLUDE kxarm.h IMPORT main IMPORT OALVAtoPA EXPORT StartUp EXPORT Launch Mode_SVC EQU 0x13 NoIntsMask EQU 0x000000C0 ;AT91C_WDTC_WDMR EQU (0xFFFFFE44);(0xFFFFFD44) ;- (WDTC) Watchdog Mode Register ;AT91C_WDTC_WDDIS EQU (0x1:SHL:15) ;- (WDTC) Watchdog Disable MACRO CPWAIT $Rd mrc p15, 0, $Rd, c2, c0, 0 ; arbitrary read of CP15 mov $Rd, $Rd ; wait for it (foward dependency) sub pc, pc, #4 ; branch to next instruction MEND ;------------------------------------------------------------------------------ ;- Area Definition ;----------------- ;- Must be defined as function to put first in the code as it must be mapped ;- at offset 0 of the flash EBI_CSR0, ie. at address 0 before remap. ;------------------------------------------------------------------------------ AREA reset, CODE, READONLY STARTUPTEXT ;******************************************************************************* ; ; StartUp() is the entry point on Reset (all forms of Reset) ; ; Desription: StartUp is the first routine executed when powering on ; the system. ; Regardless of the build type, we disable the MMU and caches ; immediately and flush them. ; ;******************************************************************************* LEAF_ENTRY StartUp ;(1)入口 ; Put the CPU in Supervisor mode (SVC) and disable IRQ and FIQ interrupts. ldr r0, =(Mode_SVC :OR: NoIntsMask) msr cpsr_c, r0 ; Disable watchdog ; ldr r0, =AT91C_WDTC_WDMR ;0xFFFFFD08 ; ldr r1, =AT91C_WDTC_WDDIS ; str r1,[r0] ; Disable the MMU, caches, and write-buffer and flush. ; ldr r0, =0x2043 ; enable access to all coprocessors;允许访问所有的协处理器 mcr p15, 0, r0, c15, c1, 0 ; CPWAIT r0 ; ldr r0, =0x00000078 ; get a zero to turn things off (must write bits[6:3] as 1s) mcr p15, 0, r0, c1, c0, 0 ; turn off MMU, I&D caches, and write buffer CPWAIT r0 ; ;ldr r0, =0x00000000 ; get a zero to turn things off ;mcr p15, 0, r0, c8, c7, 0 ; flush (invalidate) I/D TLBs ;mcr p15, 0, r0, c7, c7, 0 ; flush (invalidate) I/D caches ;mcr p15, 0, r0, c7, c10, 4 ; drain the write buffer;排空写缓冲 ;nop ; ;nop ; ;nop ; mvn r0, #0 ; grant manager access to all domains；允许访问所有域 mcr p15, 0, r0, c3, c0, 0 ; ; Icache enable and asynchronous clocking mode mrc p15,0,r6,c1,c0,0 orr r6,r6,#0xC0000000 orr r6,r6,#0x1000 mcr p15,0,r6,c1,c0,0 b OALStartUp ; Included within the text section in order that a relative offset can be ; computed in the code below. ; INCLUDE cfg.inc ;The stack begins at the end of the SRAM and goes top-down AT91SAM9G45M10EK_SRAM_SIZE EQU (32*1024) ;0x8000 ;(64*1024)0x10000 AT91SAM9G45M10EK_BOOTLOADER_STACK_BASE EQU (AT91SAM9G45M10EK_BASE_SRAM + AT91SAM9G45M10EK_SRAM_SIZE - 4) AT91SAM9G45M10EK_BOOTLOADER_STACK_VA_BASE EQU (AT91SAM9G45M10EK_VA_BASE_SRAM + AT91SAM9G45M10EK_SRAM_SIZE - 4) ;This defines the area where the MMU descriptors are stored. Somehow if the stack is too big, the two will overlap and the sytem'll trap AT91SAM9G45M10EK_BASE_MMU_CFG EQU (AT91SAM9G45M10EK_BASE_SRAM) ;0x00300000 ;------------------------------------------------------------------------------- ; ; OALStartUp: OEM bootloader startup code. This routine will: ; ; * Copy the image to RAM if it's not already running there. ; ; * Set up the MMU and Dcache for the bootloader. ; ; * Initialize the first-level page table based up the contents ; of the MemoryMap array and enable the MMU and caches. ; ; Inputs: None. ; ; On return: N/A. ; ; Register used: ; ;------------------------------------------------------------------------------- ; ALIGN LEAF_ENTRY OALStartUp ;(2) ; Set up a supervisor mode stack. ldr sp, =AT91SAM9G45M10EK_BOOTLOADER_STACK_BASE ;; Copy the bootloader image from flash to SDRAM if needed ;; Here, not need because ROM Boot doing that ;; So, go to next step b BUILDTTB mov pc, r0 ; Now that we're running out of RAM, construct the first-level Section descriptors ; to create 1MB mapped regions from the addresses defined in the OEMAddressTable. ; This will allow us to enable the MMU and use a virtual address space that matches ; the mapping used by the OS image. ; ; We'll create two different mappings from the addresses specified: ; [8000 0000 --> 9FFF FFFF] = Cacheable, Bufferable ; [A000 0000 --> BFFF FFFF] = NonCacheable, nonBufferable ; BUILDTTB ;在上面程序添加死循环，h下后，PC值正常 ;在这里添加死循环，程序运行一会，h下(halt) PC指针已经飞了PC=0x00000010 ;为什么呢？？ LOOP b LOOP ;;;; ;;;; add r11, pc, #g_oalAddressTable - (. + 8) ; Pointer to OEMAddressTable. ; Set the TTB. ; ldr r9, =AT91SAM9G45M10EK_BASE_MMU_CFG ; Physical address of the first-level table 0x00300000 ldr r0, =0xFFFFC000 ; and r9, r9, r0 ; Mask off TTB[31:0] (must be 0's). mcr p15, 0, r9, c2, c0, 0 ; Set the TTB. ; ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ; ~~~~~~~~~~ MAP CACHED and BUFFERED SECTION DESCRIPTORS ~~~~~~~~~~~~~~~~~~ ; ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ mov r0, #0x0E ; Section (1MB) descriptor; (C=B=1: write-back, read-allocate). orr r0, r0, #0x400 ; Set AP. 20 mov r1, r11 ; Pointer to OEMAddressTable. ; Start Crunching through the OEMAddressTable[]: ; ; r2 temporarily holds OEMAddressTable[VA] ; r3 temporarily holds OEMAddressTable[PHY] ; r4 temporarily holds OEMAddressTable[#MB] ; 25 ldr r2, [r1], #4 ; Virtual (cached) address to map physical address to. ldr r3, [r1], #4 ; Physical address to map from. ldr r4, [r1], #4 ; Number of MB to map. cmp r4, #0 ; End of table? beq %F29 ; r2 holds the descriptor address (virtual address) ; r0 holds the actual section descriptor ; ; Create descriptor address. ; ldr r6, =0xFFF00000 and r2, r2, r6 ; Only VA[31:20] are valid. orr r2, r9, r2, LSR #18 ; Build the descriptor address: r2 = (TTB[31:14} | VA[31:20] >> 18) ; Create the descriptor. ; ldr r6, =0xFFF00000 and r3, r3, r6 ; Only PA[31:20] are valid for the descriptor and the rest will be static. orr r0, r3, r0 ; Build the descriptor: r0 = (PA[31:20] | the rest of the descriptor) ; Store the descriptor at the proper (physical) address ; 28 str r0, [r2], #4 add r0, r0, #0x00100000 ; Section descriptor for the next 1MB mapping (just add 1MB). sub r4, r4, #1 ; Decrement number of MB left. cmp r4, #0 ; Done? bne %B28 ; No - map next MB. bic r0, r0, #0xF0000000 ; Clear section base address field. bic r0, r0, #0x0FF00000 ; Clear section base address field. b %B25 ; Get and process the next OEMAddressTable element. ; ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ; ~~~~~~~~~~ MAP UNCACHED and UNBUFFERED SECTION DESCRIPTORS ~~~~~~~~~~~~~~ ; ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 29 tst r0, #8 ; ; bic r0, r0, #0x0C ; add r9, r9, #0x0800 ; bne %B20 ; ACTIVATEMMU ; The 1st Level Section Descriptors are setup. Initialize the MMU and turn it on. ; mov r1, #1 mcr p15, 0, r1, c3, c0, 0 ; Set up access to domain 0. mcr p15, 0, r0, c8, c7, 0 ; Flush the instruction and data TLBs. mcr p15, 0, r1, c7, c10, 4 ; Drain the write and fill buffers. mov r1, #0x78 ; Bits [6:3] must be written as 1's. orr r1, r1, #0x1 ; Enable MMU. orr r1, r1, #0x1000 ; Enable IC. orr r1, r1, #0x0800 ; Enable BTB. orr r1, r1, #0x4 ; Enable DC. ldr r2, =VirtualStart ; Get virtual address of 'VirtualStart' label. cmp r2, #0 ; Make sure no stall on "mov pc,r2" below. beq STALL2 ; Enable the MMU. ; mcr p15, 0, r1, c1, c0, 0 ; MMU ON: All memory accesses are now virtual. ; Jump to the virtual address of the 'VirtualStart' label. ; mov pc, r2 ; nop nop nop ; ************************************************************************* ; ************************************************************************* ; The MMU and caches are now enabled and we're running in a virtual ; address space. ; ALIGN VirtualStart ; Set up a supervisor mode stack. ; ; NOTE: These values must match the OEMAddressTable and .bib file entries for ; the bootloader. ; ldr sp,=AT91SAM9G45M10EK_BOOTLOADER_STACK_VA_BASE ; Jump to the C entrypoint. ; bl main ; Jump to main.c::main(), never to return... nop nop nop STALL2 b STALL2

[running_flying_safe]

引用 2 楼 xqhrs232 的回复:

有没开发板？把你自己编译的代码放开发板上跑跑看

跑了 用jlink调试了 能详细说说吗

[91program]

移植官方提供的代码，改动大嘛？是不是空间或其它有限制啊？ 在应用中，调到函数、但跑飞，一般是堆栈溢出了。

[一介布衣萧萧]

跑飞？每次跑的位置一样吗？会不会出现跑的位置不一样？ 如果出现每次跑的语句多少不一样，那么90%可以肯定是硬件的问题。可以看看RAM的走线，是不是合理，有没有干扰存在

[alien75]

没有用过jlink调试裸程序，不过启动程序的前7个word也是应该存放ARM的异常向量地址吗？pc一直是0x10，是否进入了dataabort异常？