[OpenOCD-user] em357 debugging

[Ed B. <be...@mi...>]

I have a custom design using an EM357 and would like to be able to use OpenOCD both for debugging and also for a boundary scan.  I see in the source code that there is some support for the NOR flash within the em357, but strangely, there doesn't seem to be a corresponding target file so I've attempted to create my own.  At the moment I'm using the luminary-icdi dongle.  I'm using OpenOCD version 0.7.0 on Linux (Fedora 20) but could move to 0.8 if there's a relevant difference.  Here's what I get with autoscan:

Open On-Chip Debugger 0.7.0 (2013-09-07-16:51)
Licensed under GNU GPL v2
For bug reports, read
	http://openocd.sourceforge.net/doc/doxygen/bugs.html
Info : only one transport option; autoselect 'jtag'
adapter speed: 3000 kHz
Info : clock speed 3000 kHz
Warn : There are no enabled taps.  AUTO PROBING MIGHT NOT WORK!!
Warn : AUTO auto0.tap - use "jtag newtap auto0 tap -expected-id 0x3ba00477 ..."
Warn : AUTO auto1.tap - use "jtag newtap auto1 tap -expected-id 0x069aa62b ..."
Warn : AUTO auto0.tap - use "... -irlen 5"
Warn : AUTO auto1.tap - use "... -irlen 2"
Error: auto1.tap: IR capture error; saw 0x0003 not 0x0001
Warn : Bypassing JTAG setup events due to errors
Warn : gdb services need one or more targets defined

I get the same thing with slower adapter speeds, e.g. 10 kHz.  The first tap seems to be the ARM core, so it seems to me that the reported irlen of 5 is rather strange.  I'm guessing that the second tap is for the boundary scan, but I've not yet been successful in getting any relevant information from Silicon Labs (formerly Ember).  Here's is the em357.cfg file that I've created and am attempting to use:

# script for em357 family

if { [info exists CHIPNAME] } {
   set _CHIPNAME $CHIPNAME
} else {
   set _CHIPNAME em357
}

if { [info exists ENDIAN] } {
   set _ENDIAN $ENDIAN
} else {
   set _ENDIAN little
}

if { [info exists WORKAREASIZE] } {
   set _WORKAREASIZE $WORKAREASIZE
} else {
   set _WORKAREASIZE 0x4000
}

if { [info exists CPUTAPID] } {
   set _CPUTAPID $CPUTAPID
} else {
   set _CPUTAPID 0x3ba00477
}

if { [info exists BSTAPID] } {
   set _BSTAPID $BSTAPID
} else {
  set _BSTAPID 0x069aa62b
}

jtag newtap $_CHIPNAME cpu -irlen 4 -expected-id $_CPUTAPID
jtag newtap $_CHIPNAME bs -irlen 2 -expected-id $_BSTAPID -ircapture 0x2

set _TARGETNAME $_CHIPNAME.cpu
target create $_TARGETNAME cortex_m -endian $_ENDIAN -chain-position $_TARGETNAME

$_TARGETNAME configure -work-area-phys 0x20000000 -work-area-size $_WORKAREASIZE -work-area-backup 0

# shouldn't flash size be probed?
set _FLASHNAME $_CHIPNAME.flash
#flash bank $_FLASHNAME em357 0x08000000 0 0 0 $_TARGETNAME
flash bank $_FLASHNAME em357 0x08000000 0x40000 0 0 $_TARGETNAME

#cortex_m reset_config sysresetreq
cortex_m reset_config vectreset

This seems to work, in that it sets up a target for the ARM core, but I can't halt it or read registers or do much of anything useful.  Example session:

Open On-Chip Debugger 0.7.0 (2013-09-07-16:51)
Licensed under GNU GPL v2
For bug reports, read
	http://openocd.sourceforge.net/doc/doxygen/bugs.html
Info : only one transport option; autoselect 'jtag'
adapter speed: 10 kHz
trst_only separate trst_push_pull
Warn : em357.bs: nonstandard IR value
cortex_m3 reset_config vectreset
trst_only separate trst_push_pull
adapter_nsrst_delay: 100
jtag_ntrst_delay: 100
Info : clock speed 10 kHz
Info : JTAG tap: em357.cpu tap/device found: 0x3ba00477 (mfg: 0x23b, part: 0xba00, ver: 0x3)
Info : JTAG tap: em357.bs tap/device found: 0x069aa62b (mfg: 0x315, part: 0x69aa, ver: 0x0)
Info : em357.cpu: hardware has 0 breakpoints, 0 watchpoints
Info : accepting 'telnet' connection from 4444
Warn : target was in unknown state when halt was requested
Info : Halt timed out, wake up GDB.
Error: timed out while waiting for target halted
in procedure 'halt'

Note that I've set the clock speed to 10kHz and my custom board file includes this:

proc init_targets {} {
    reset_config trst_only
    adapter_nsrst_delay 100
    jtag_ntrst_delay 100
}

Any clue as to why this doesn't work?  Has anyone successfully done debugging with an em357 yet?  How would I troubleshoot further?

Ed