read mem ory
w rite memory
layout
When writing to flash
j-Link MAY cache the writes.
When reading the cache is queried
This causes the application and other
debuggers, for example nrfjprog , to continue to see the original contents of the flash.
This behavior can be changed using:
exec SetEnableMemCache = 0
See ProjectFile
exec SetAllowStopMode 1 ???
| mem[8|16|32|64][Zone:]Addr[,ngroups(in hex)
w1|w2|w4|w4 [Zone:]Addr[ xData …]
Zone Name of memory zone to access.
w4 10001080 FFFF541C (looks like SHTC) FLASH:Change 1 to 0 OK , 0 to 1 needes erase(J-Link does that!)
mem32 10001080 4
10001080 = FFFF541C FFFFFFFF FFFFFFFF FFFFFFFF
w4 10001080 01020304
mem32 10001080 1
10001080 = 01020304
mem 10001080 4
10001080 = 04 03 02 01 gawk!
mem16 10001080 2
10001080 = 0304 0102 (int16s)
mem 48760,10 with text
00048760 = 6D 61 69 6E 20 63 61 6C 6C 69 6E 67 20 74 65 73 main calling tes
mem8 48760,10 no text
00048760 = 6D 61 69 6E 20 63 61 6C 6C 69 6E 67 20 74 65 73
mem 10001080 4
10001080 = FF FF FF FF
w1 10001083 FE
Writing FE -> 10001083
mem 10001080 4
10001080 = FF FF FF FE
mem32 10001080 1
10001080 = FEFFFFFF it only looks bad
w4 10001081 0A0B0C0D
Writing 0A0B0C0D -> 10001081
Mis-aligned memory write: Address: 0x10001081, NumBytes: 4, Alignment: 4 (Word-aligned)
mem32 10001080 2
10001080 = 0B0C0DFF FFFFFF0A
mem 10001080 8
10001080 = FF 0D 0C 0B 0A FF FF FF
mem8 10001080 8
10001080 = 03 0D 0C 0B 0A FF FF FF
Get the address of a static global from the map
grep -A1 vbat *.map |\
sed "s/0x00000000\(........\)/mem16 \1,1/; s/ 0x2//"
.bss.vbat mem16 20004486,1 _build/ruuvi_firmware_main.c.o
mem16 20004486,1
20004486 = ADC
Use: echo 'ibase=16;ADC' |bc to see 2780 millivolts.
Interrupt Service Routine table
mem32 000,40 all A bytes apart
000 20000400 A81 715 A61 (execution address +1)
010 = 71F 729 733 0
020 = 0 0 0 AA5
030 = 73D 0 747 751
040 = 75B 765 76F 779
050 = 783 78D 797 7A1
060 = 7AB 7B5 7BF 7C9
070 = 7D3 7DD 7E7 7F1
080 = 7FB 805 80F 819
090 = 823 82D 837 841
0A0 = 84B 855 85F 869
0B0 = 873 87D 887 891
0C0 = 89B 8A5 8AF 8B9
0D0 = 8C3 8CD 8D7 8E1
0E0 = 8EB 8F5 8FF 909
0F0 = 913 91D 927 931
Example: ( A bytes)
73C: 30 20 MOV R0, #48 decimal ( 8,16,20 24, 48, 56, … 252, 93B:100)
73E: 85 49 LDR R1, [PC, #+0x214]
740: 09 68 LDR R1, [R1]
742: 09 58 LDR R1, [R1, R0]
744: 08 47 BX R1
C004: 0C 4A LDR R2, [PC, #+0x30] All end up here!
C006: 12 68 LDR R2, [R2]
C008: 0A 4B LDR R3, [PC, #+0x28]
C00A: 9A 42 CMP R2, R3
C00C: 06 D1 BNE #+0x0C
C01C: 07 49 LDR R1, [PC, #+0x1C]
C01E: 09 68 LDR R1, [R1]
C020: 09 58 LDR R1, [R1, R0]
C022: 08 47 BX R1
000:
mem64 2000,4 (4 64bit quad(?)words)
00002000 = D0032D1278A5BBBC E7B8DFFFD0042D13
00002010 = F7FFE001FF6FF7FF F006D1B12800FF55
w4 10001080 00010203 04050607 NRF_UICR->CUSTOMERWriting 00010203 -> 10001080
Writing 04050607 -> 10001084
mem32 10001080,20
10001080 = 00010203 04050607 FFFF0908 FFFFFFFF
10001090 = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
…
100010FF = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
Fill stack (where local dynamic variables are allocated) with C0FFEE:
w4 2000FF00 C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE
w4 2000FFC0 C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE
w4 2000FF80 C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE
w4 2000FF40 C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE
w4 2000FF00 C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE
w4 2000FEC0 C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE
w4 2000FE80 C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE
w4 2000FE40 C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE
w4 2000FE00 C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE
w4 2000FDC0 C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE
w4 2000FD80 C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE
w4 2000FD40 C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE
w4 2000FD00 C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE
w4 2000FCC0 C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE
w4 2000FC00 C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE
w4 2000FC40 C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE
w4 2000FC80 C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE
w4 2000FBC0 C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE
w4 2000FB80 C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE
w4 2000FB40 C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE
w4 2000FB00 C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE
w4 2000FAC0 C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE
w4 2000FA80 C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE
w4 2000FA40 C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE
w4 2000FA00 C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE C0FFEE
There's not much point in filling the top (i.e. FFFF )
Stack is used for local variables.
Display stack:
mem32 2000FA00,180 or less mem32 2000FF00,40
2000FA40 = 00C0FFEE 00C0FFEE 00C0FFEE 00C0FFEE
2000FA50 = 00C0FFEE 00C0FFEE 00000000 00C00106 ← deepest usage
2000FA70 = 00C0FFEE 00C00106 00000000 00C0FF00 what are these 2 sets of entries?
2000FA80 = 00C0FFEE 00C0FFEE 00C0FFEE 00C0FFEE
2000FA90 = 00C0FFEE 00000000 00000016 00000000
2000FAA0 = 000000FF 20000106 2000167C 2000167C 31EF8 app_on_error
2000FE50 = 00000000 00000048 00000000 00031EF9 ← 2000FE58 next word to use
2000FE60 = 00043D71 000000D5 00000001 0000122F 43CF4 main
2000FE70 = 0003A389 00000000 00100000 20006E9D 3A374 nrf_pwr_mgmt_run 20006E9d m_nrf_sdh_enabled
2000FE80 = 00000000 0003A2CB 00000000 0002FF39 3A2C8 sd_app_evt_wait
2000FE90 = 00000000 0002FFBF 00000002 00031F45 2FF68 ri_delay_ms +.57 31f80 show_code
2000FEA0 = 00043D71 000000D5 70612D2D 6E6F5F70 43CF4 84 main pa--no_p
Use mem 2000FEA0 64 to display the text
2000FEA0 = 2D 2D 61 70 70 5F 6F 6E --app_on
2000FEB0 = 5F 65 72 72 6F 72 20 66 61 74 61 6C 20 61 30 30 _error fatal a00
2000FEC0 = 20 61 66 74 65 72 20 6D 61 69 6E 2E 63 3A 32 31 after main.c:21
2000FED0 = 33 20 0A 20 43 68 65 63 6B 20 74 68 65 20 73 74 3 . Check the st
2000FEE0 = 61 63 6B 0A 20 00 00 00 ack....
2000FEB0 = 7272655F 6620726F 6C617461 30306120
2000FEC0 = 74666120 6D207265 2E6E6961 31323A63
2000FED0 = 200A2033 63656843 6874206B 74732065
2000FEE0 = 0A6B6361 00000020 00043D71 000000D5 43CF4 main
2000FEF0 = 00000045 0002DCEB 00000A00 000315C7 2dcd8 ri_log_flush
2000FF00 = 000000D5 00000000 6E69616D 323A632E niam 2:c. main
2000FF10 = 46203331 4C415441 554E203A 0A0D4C4C F 31 LATA UN : \r\nLL
2000FF20 = 00000000 0003A2CB 00000000 0002FF39
2000FF30 = 00000000 0002FFBF 00000091 00031FA7
2000FF40 = 00000000 10001000 20202323 20202020 ##
2000FF50 = 20202020 65682020 62747261 20746165 ch btra tae
2000FF60 = 30303030 0B00000A 00000000 00007127
2000FF70 = 00000000 10001000 00000000 0003AE1B
2000FF80 = 20004008 0002FD6B 00000A00 00000000
2000FF90 = 10001000 00000000 00000000 00032107
2000FFA0 = 00000000 000321B5 75520A0A 20697675 er\n\n ivu
2000FFB0 = 20205746 31332E33 4220312E 746C6975 WF 13.3 B 1. tliiu
2000FFC0 = 6365443A 20332020 33323032 3A383020 ceD: 3 3202 :80
2000FFD0 = 353A3233 20000A30 00000000 200029B0 5:D23
2000FFE0 = 00000000 200029AC 00026225 0003FE39
2000FFF0 = 00000000 00000000 10001000 0002628F
2000FFF0 = 00000000 20000000 00000000 0001F4AB ← first word pushed
rreg 13 (SP)
R13 (SP) = 0x2000FE58
Spill some COFFEE into flash too.
J-Link> w4 00065000 C0FFEE C0FFEE C0FFEE C0FFEE
Writing 00C0FFEE -> 00065000
J-Link>mem32 00065000 4
00065000 = 00C0FFEE 00C0FFEE 00C0FFEE 00C0FFEE
J-Link>q
J-Link: Flash download: Bank 0 @ 0x00000000: 1 range affected (4096 bytes)
J-Link: Flash download: Total: 0.340s (Prepare: 0.183s, Compare: 0.099s, Erase: 0.006s,
Program & Verify: 0.040s, Restore: 0.011s)
J-Link: Flash download: Program & Verify speed: 100 KB/s
Data RAM System | Code RAM
| 2000 F000 0800 FFFF
| mem 20000000,800 0800 0000
|
80..FC customer
mem 10001080,80 UICR
10000000 FICR:
14..7C Nordic Firmware NRFFW[0..11]
8 0000 .. 80 ffff, code ram
0000 .. 7 FFFF, flash
FICR->DEVICEID not MAC
mem 10000060,8
10000060 = 1A 04 D7 6E 04 BA FA D1
FICR->DEVICEADDRTYPE FE public, FF random
mem 100000a0,4
FICR->DEVICEADDR
mem 100000a4,6 displayed as MAC
1A 1E 4A 74 FA 37 ; F7:FA:74:4A:1E:1A
03 AD 43 C6 C0 B2 ; F2:C0:C6:43:AD:03
0E 23 6C 9C 8B 14 ; D4:8B:9C:6C:23:0E
BC 20 DD 3F 38 A9 ; E9:38:3F:DD:20:BC | | |
| Load data file | loadfile filename.
hex | mot | bin | rec [,addr] for bin
Halts the CPU then loads the file.
After the load completes, a r eset MUST be issued manually to set the PC to the Start Address.loadfile test_v3.28.13_full.hex
Downloading file [test_v3.28.13_full.hex]...
Comparing flash [100%] Done.
Erasing flash [100%] Done.
Programming flash [100%] Done.
Verifying flash [100%] Done.
J-Link: Flash download: Bank 0 @ 0x00000000: 3 ranges affected (319488 bytes)
J-Link: Flash download: Total time needed: 5.759s
(Prepare: 0.119s,
Compare: 0.045s, Erase: 0.000s, Program: 5.492s, Verify: 0.015s, Restore: 0.086s)
O.K.
A reset command must be issued before go .
File is of unknown / supported format.
The file extension should be .hex or
Failed to open file.
File cannot be read from current directory or the file may have a checksum error or other format problem.
[TAB][TAB] lists the current directory.
a [TAB] lists all files and directories beginning with a ( as with name completion.)
d [TAB] completes the directory name beginning with d .
Replacing the trailing space with a / [TAB]
lists all files and directories under dir .
../ [TAB] lists items in the parent directory.
| Reset | r[x DelayAfterReset ]
sets ALL regs=0,
Then starts bootloader setting up SP and PC
This does NOT causes the static variables to be initalized which WILL be initalized before main is entered.
SetBP aaaaa (main) then g .
When break point is hit static variables have been initalized and can be viewed or changed.
Reset delay: 0 ms
Reset type NORMAL: Resets core & peripherals via SYSRESETREQ & VECTRESET bit.
Reset: Halt core after reset via DEMCR.VC_CORERESET.
Reset: Reset device via AIRCR.SYSRESETREQ.
J-Link>regs
PC = 00000A80, CycleCnt = 00000000
If PC = FFFFFFFE there probably isn't an image loaded (with a valid start address)!
reset types
| Erase erase [Saddr,Eaddr] i.e. set flash to x'FFFFFFFF'
erase 0 65000 # up to bottom on start_storage_flash on nRF52832.
Erasing selected range...
J-Link: Flash download: Total time needed: 0.598s
(Prepare: 0.178s, Compare: 0.000s, Erase: 0.285s, Program: 0.000s, Verify: 0.000s, Restore: 0.134s)
J-Link: Flash download:
Flash sectors within Range [0x00000000 - 0x00065000] deleted.
Erasing done.
Without Saddr,Eaddr performs erase chip including NRF_UICR->CUSTOMER
erase
Without any give address range, Erase Chip will be executed
Erasing device...
J-Link: Flash download: Total time needed: 0.341s
(Prepare: 0.178s, Compare: 0.000s, Erase: 0.026s, Program: 0.000s, Verify: 0.000s, Restore: 0.135s)
Erasing done.
J-Link> mem32 10001080,4 // CUSTOMER
00000000 = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
J-Link> mem32 7FFE0,8 // top of FLASH
0007FFE0 = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
0007FFF0 = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
00800000 = 00000000 00000000 00000000 00000000 Code RAM begins??
00800010 = 00000000 00000000 00000000 00000000
| Save memory
layout
see nrfjprog --readuicr file.hex
--readcode , --readram
| savebin filename, addr, NumBytes
in mem format i.e. 03 02 01 00 07 06 05 04
where mem32 shows 00010203 04050607
> savebin 1a96hungRAM.bin 20000000 0xFFFF
Opening binary file for writing... [1a96hungRAM.bin]
Reading ... bytes from addr 0x20000000 into file...O.K.
> /usr/bin/hexdump -C 1a96hungRAM.bin > 1a96hungRAM.txt
> savebin FICRUICR.bin 10001000 0x100 bytes
Opening binary file for writing... [FICRUICR.bin]
Reading 256 bytes from addr 0x10001000 into file...O.K.
> /usr/bin/hexdump -e '"%07 _ax" 4/4 " %08X" "\n"' FICRUICR.bin
# format with 7 digits of address, 4 groups of 4 bytes per group 8digit HEX end each set with nl.
savebin FlashDataStorage.bin 65000 15000
| Load *.bin file | loadbin filename.bin, addr
Verfy binary in memory | verifybin filename, addr
Single step | s [NumSteps (decimal)]
Instruction displayed has already been executed!
WatchDog timer WILL expire during step and WDOG_HANDLER will be invoked after entering g
J-Link>s
00024AFC: 4F F6 FF 72 MOVW R2, #0xFFFF
J-Link>s 3
000784AC: 7A 4A LDR R2, [PC, #+0x1E8]
000784AE: 1B 68 LDR R3, [R3]
000784B0: C3 F3 42 33 UBFX R3, R3, #13, #3
J-Link>regs
PC = 00024B00, CycleCnt = 014A8587
R0 = 00000000, R1 = 00000000, R2 = 0000FFFF, R3 = 00000000 …
0001F832: 01 38 SUBS R0, #1
J-Link>s
0001F834: C3 D1 BNE #-0x7A
J-Link>s
000008E4: 06 4B LDR R3, [PC, #+0x18]
…
0000031C: 4F F0 10 24 MOV R4, #0x10001000 Config area
00000320: A0 69 LDR R0, [R4, #+0x18]
00000322: 40 1C ADDS R0, R0, #1
00000324: 05 D0 BEQ #+0x0A
00000326: A5 69 LDR R5, [R4, #+0x18]
00000328: A6 69 LDR R6, [R4, #+0x18]
0000032A: 80 35 ADDS R5, #128
0000032C: 30 79 LDRB R0, [R6, #+0x04]
0000032E: AA 28 CMP R0, #170
00000330: 08 D0 BEQ #+0x10
00000332: 60 69 LDR R0, [R4, #+0x14]
00000334: 40 1C ADDS R0, R0, #1
00000336: 2D D0 BEQ #+0x5A
00000338: 60 69 LDR R0, [R4, #+0x14]
0000033A: 00 68 LDR R0, [R0]
0000033C: 40 1C ADDS R0, R0, #1
0000033E: 29 D0 BEQ #+0x52
00000340: 60 69 LDR R0, [R4, #+0x14]
00000342: 2C E0 B #+0x58
0000039E: 00 F0 A3 FA BL #+0x546
000008E8: 06 4A LDR R2, [PC, #+0x18]
000008EA: 10 60 STR R0, [R2]
000008EC: 01 68 LDR R1, [R0]
000008EE: 81 F3 08 88 MSR MSP, R1
000008F2: 40 68 LDR R0, [R0, #+0x04]
000008F4: 00 47 BX R0
00009A9E: 20 BF WFE
00009AA0: D4 F8 04 01 LDR R0, [R4, #+0x104]
00009AA4: 00 28 CMP R0, #0
00009AA6: FA D0 BEQ #-0x0C
00009A9E: 20 BF WFE
00009AA0: D4 F8 04 01 LDR R0, [R4, #+0x104]
00009AA4: 00 28 CMP R0, #0
00079E18: 06 49 LDR R1, [PC, #+0x18]
00079E1A: 07 4A LDR R2, [PC, #+0x1C]
| DisAssemble | disassemble [addr] CPU must be halted.
no abbreviation
Caution: Using an arbitrary addr
Will produce incorrect results if not an instruction boundry.
disassemble 416
00000416: 40 F6 FC 74 MOVW R4, #0xFFC
0000041A: 20 68 LDR R0, [R4]
0000041C: 4F F0 10 26 MOV R6, #0x10001000
00000420: 40 1C ADDS R0, R0, #1
00000422: 23 D0 BEQ #+0x46
00000424: 20 68 LDR R0, [R4]
00000426: 40 1C ADDS R0, R0, #1
00000428: 0C D0 BEQ #+0x18
0000042A: 20 68 LDR R0, [R4]
0000042C: 40 1C ADDS R0, R0, #1
| instruction BreakPoint
| SetBP aaaaa [A|T] [S|H]
A RM mode: 2xxxx | T humb mode: 0xAB S oft|h ard
ClrBP handleID
Example:
Use grep to find startup.main from the LoaD map
grep -A1 .text.main *.map
.text.startup.main
0x000000000357f8 0x518 _build/ruuvi_firmware_main.c.o
Call to ri_log(levl,msg)
LDR R1, [PC, #+28] / string
MOVS R0, #3 level ?
BL #-50D0 ri_log 002f4f8
PUSH {R3,LR} LR/
CBZ R1, #+A
MOV r2, R1 / string
LDR R3, [PC, #+30] / 03
LDRB R3, [R3]
CMP R3, R0
BHI #+10
POP {r3,PC}
BL #+1B8
PUSH {R3,LR}
BL #-7A
PUSH {R3,LR}
LDR R1, [PC, #+3C]
LDR R0, [PC, #+3C]
BL #-2FFA
PUSH {R4-R5,LR}
SUB SP, SP, #20 open up stack
setBP 24aec
Breakpoint set @ addr 0x00024AEC (Handle = 5)
When breakpoint is encountered a simple J-Link> prompt is presented.
Use moe to determine what happened.
CPU halted due to code breakpoint match.
s executes next instruction.
Display breakpoints (i.e. FPB :(?) mem32 E0002000,10
E0002000 = 00000261 20000000 4003454D 4002F4F9
E0002010 = 40034589 00000000 00000000 00000000
ARM instructions
| Set the reset type. | RSetType type
Affects core & peripherals unless noted. See j-Link section 7.9.2 (Ruuvi / nRF52832 is Cortes-M4)
RSetType 0Normal | via VC_CORERESET and SYSRESETREQ. initial setting.
- Make sure that the device halts immediately after reset
(before it can execute any instruction of the application) by
setting the VC_CORERESET in the DEMCR.
- Reset the core and peripherals by setting the SYSRESETREQ bit in the AIRCR.
- Wait for the S_RESET_ST bit in the DHCSR to first become high(resetactive)and then
low (reset no longer active) afterwards.
- ClearVC_CORERESET
| RSetType 2ResetPin | using RESET pin. CPU does not start execution.J-Link> RSetType 2
Reset type RESETPIN: Resets core & peripherals using RESET pin.
J-Link>r
Reset delay: 0 ms
Reset type RESETPIN: Resets core & peripherals using RESET pin.
Reset: Halt core after reset via DEMCR.VC_CORERESET.
Reset: Reset device via reset pin
Reset: VC_CORERESET did not halt CPU. (Debug logic also reset by reset pin?).
Reset: Reconnecting and manually halting CPU.
Found SW-DP with ID 0x2BA01477
DPIDR: 0x2BA01477
AP map detection skipped. Manually configured AP map found.
AP[0]: AHB-AP (IDR: Not set)
AP[0]: Core found
AP[0]: AHB-AP ROM base: 0xE00FF000
CPUID register: 0x410FC241. Implementer code: 0x41 (ARM)
Found Cortex-M4 r0p1, Little endian.
Reset: Halt core after reset via DEMCR.VC_CORERESET.
Reset: Reset device via AIRCR.VECTRESET.
| RSetType 3Connect under Reset | connect to target keeping RESETactive.
| RSetType 5Halt Before BTL | as with 8 halts CPU before the bootloader.
| 6Kinetis | via strategy NORMAL. Watchdog disabled after reset
| 7ADI† Halt after kernel | halts CPU after the ADI kernel.
J-Link>RSetType 7
Reset type ADI HALT AFTER KERNEL:
Resets core & peripherals, halts CPU after the ADI kernel.
J-Link>r
Reset delay: 0 ms
Reset type ADI HALT AFTER KERNEL:
Resets core & peripherals, halts CPU after the ADI kernel.
Core did not halt after reset, manually halting CPU...
J-Link>moe
CPU halted because DBGRQ was asserted.
J-Link>regs
PC = 00000A80, CycleCnt = 00000000
| 8Core
and Peripherals | via SYSRESETREQ bit only.
| 1Core | not recommended. Core only ( via VECTRESET bit, CPU does not start execution)
| 9LPC1200 | via strategy normal. Watchdog disabled after reset
| 10S3FN60D | via strategy normal. Watchdog disabled after reset
| 11LPC11A | Performs some special handling which is needed by some LPC11A bootloaders.
| | | | | | | | | | | |
| data WatchPoint | SetWP|ClrWP Addr [R|W] [Data [D-Mask] [A-Mask]]
SetWP 20002da2
Watchpoint set @ addr 0x20002DA2 (Handle = 0x00000004)
When breakpoint is encountered a simple J-Link> prompt is presented.
Use moe to determine what happened.moe
CPU halted due to data breakpoint unit 3 match
| Wait until CPU halts or timeout exceeded. | WaitHalt TimeoutMs Default 1000
| Wait | Sleep ms
hardware status | st VTref=3.300V
ITarget=0mA
TCK=0 TDI=1 TDO=1 TMS=1 TRES=1 TRST=1
Supported target interface speeds:
- 10 MHz/n, (n=10). = 1000kHz, 909kHz, 833kHz, ...
| hardware info | hwinfo /
HWInfo[00] = Target power is disabled
HWInfo[02] = 0mA (ITarget)
HWInfo[03] = 0mA (ITargetPeak)
HWInfo[04] = 0mA (ITargetPeakOperation)
HWInfo[10] = 0ms (ITargetMaxTime0)
HWInfo[11] = 0ms (ITargetMaxTime1)
HWInfo[12] = 0ms (ITargetMaxTime2)
HWInfo[13] = 0000000
| Write vector catch. | VCatch Value
Unlock a device. | unlock DeviceName
list of supported device names. LM3Sxxx [Auto]
Kinetis
EFM32Gxxx
LPC5460x
nRESET has to be connected
| Test command to visualize printf output from the target device, term using DCC (SEGGER DCC handler running on target)
| CoreSight register
| ReadAP
ReadDP J-Link>readap 2
Reading AP register 1 = 0x20002007 (0 read repetitions needed)
J-Link>readap 2
Reading AP register 2 = 0x00000000 (0 read repetitions needed)
J-Link>readap 3
Reading AP register 3 = 0xA044E7D5 (0 read repetitions needed)
J-Link>readap 4
Reading AP register 4 = 0x23000052 (0 read repetitions needed)
J-Link>readap 5
Reading AP register 5 = 0x20006000 (0 read repetitions needed)
J-Link>readap 6
Reading AP register 6 = 0x00000000 (0 read repetitions needed)
J-Link>readap 7
Reading AP register 7 = 0xF203BEDA (0 read repetitions needed)
J-Link>readap 8
Reading AP register 8 = 0x23000052 (0 read repetitions needed)
J-Link>readap 9
Reading AP register 9 = 0x20003000 (0 read repetitions needed)
J-Link>readap 1
Reading AP register 1 = 0x20002000 (0 read repetitions needed)
J-Link>readap 1
Reading AP register 1 = 0x20004000 (0 read repetitions needed)
J-Link>readap 1
Reading AP register 1 = 0x20002000 (0 read repetitions needed)
J-Link>readap 1
Reading AP register 1 = 0x20000000 (0 read repetitions needed)
J-Link>readap 1
Reading AP register 1 = 0x20006000 (0 read repetitions needed)
J-Link>readap 1
Reading AP register 1 = 0x20004000 (0 read repetitions needed)
J-Link>readap 1
Reading AP register 1 = 0x20002007 (0 read repetitions needed)
J-Link>readap 1
Reading AP register 1 = 0x20005000 (0 read repetitions needed)
First read returns the data of the previous read. An additional read of DP reg 3 is necessary to get the data.
For SWD, data is returned immediately.
For JTAG the data of the previous read is returned.
An additional read of DP reg 3 is necessary to get the data.
WriteAP WriteDP
CoreSight register via SWD.
| SWDReadDP
J-Link>SWDReadDP 1
Read DP register 1 = 0xF0000040
J-Link>SWDReadDP 2
Read DP register 2 = 0xE000ED34
Read DP register 3 = 0xE000ED34
Read DP register 4 = 0xE000ED34
Read DP register 5 = 0x23000052
Read DP register 6 = 0xE000ED34
SWDReadAPM
First read returns the data of the previous read.
An additional read of DP reg 3 is necessary to get the data.
Note: Correct data is returned immediately.
SWDWriteAP SWDWriteDP
Export device names from the DLL internal device list | ExpDevList[XML] Filename
Opening text file for writing... [DLL-list] DLLs
…
"Nordic Semi", "nRF52832_xxAA", "Cortex-M4", { {0x00000000, 0x00080000}, {0x10001000, 0x00001000} }, {0x20000000, 0x00010000}
"Nordic Semi", "nRF52832_xxAB", "Cortex-M4", { {0x00000000, 0x00040000}, {0x10001000, 0x00001000} }, {0x20000000, 0x00008000}
"Nordic Semi", "nRF52840_xxAA", "Cortex-M4", { {0x00000000, 0x00100000}, {0x10001000, 0x00001000} }, {0x20000000, 0x00040000}
"Nordic Semi", "nRF9160", "Cortex-M33", {0x00000000, 0x00100000}, {0x20000000, 0x00040000}
|
power trace | PowerTrace LogFile
[ChannelMask RefCountSel]
LogFile: File to store power trace data to
ChannelMask : 32-bit mask to specify what channels shall be enabled
SampleFreq : Sampling frequency in Hz (0 == max)
RefCountSel : 0: No reference count
1: Number of bytes transmitted on SWOERROR: POWERTRACE is not supported by connected J-Link.
|
Measure length of scan chain. | ms Scan chain
Identify length of scan chain select register | is JTAG scan length: 0
| Measure RTCK react time. | mr
Write test words. | wm NumWords
CP15
| Read |Write CP15 | rce | wce Op1, CRn, CRm, Op2 [, data
ICE
| state of the embedded ice macrocell (ICE breaker) | Ice
Read | write Ice reg. | ri | wi RegIndex [, Data(hex)]
Trace
| | TClear
| TStart | TStop Trace could not be started, no trace clock.
| | TSetSize sizeX
Trace Buffer has been set to 0x0 Bytes (0kBytes)
| | TSetFormat 4|8|8
| Regions (and analyze trace buffer) | TSR Trace buffer size: 0KB (0KB Min, 0KB Max)
Trace format not selected.
0 Samples in 0 region(s)
|
File I/O
| Read|Write file to emulator | fread|fwrite
Read and display file from emulator | fshow FileName [Offset [NumBytes]]
Delete file on emulator | fdelete FileName
Display size of file on emulator | fsize FileName
List directory on emulator | flist This File I/O command is not supported by the connected probe
|
SecureArea Creates/Removes secure area on probe
| Test
| Run go/halt 1000 times | TestHaltGo ................................
Completed. 8420ms required
Run step 1000 times | TestStep TestStep
Test single stepJ-Link: Flash download: Bank 0 @ 0x00000000: 1 range affected (65536 bytes)
J-Link: Flash download: Total: 1.563s
(Prepare: 0.182s, Compare: 0.089s, Erase: 0.045s, Program & Verify: 1.236s, Restore: 0.008s)
J-Link: Flash download: Program & Verify speed: 52 KB/s
....................................................................................................
Completed. 1630ms required second runCompleted. 53ms required
| Measure CPU speed. | TestCSpeed
[RAMAddr] TestCSpeed 20000100
Testing CPU clock frequency @ address 0x20000100...
CPU running at 63806 kHz
| Measure download speed into target memory. | TestWSpeed [Addr [Size]] Speed test: Writing 8 * 64kb into memory @ address 0x00000000 ........
64 kByte written in 0ms ! (524288 KByte/sec)
| Measure upload speed from target memory. | TestRSpeed : [Addr [Size] [NumBlocks]]
Measure network speed: download(write)/up(read) | TestNWSpeed: [NumBytes [NumReps]]
TestNRSpeed: [NumBytes [NumReps]] Using defaults
Transferring 32768 KBytes (512 * 64 KBytes)
................................................................
12638.20 KBytes/sec (aka 12 MB/s)
192 Blocks/sec
--again--
Using defaults
Transferring 32768 KBytes (512 * 64 KBytes)
................................................................
13888.42 KBytes/sec (aka 13 MB/s)
211 Blocks/sec
| JTAG
| Set number of IR/DR bits before ARM device. | Config IRpre, DRpre
Set interface speed. | speed freq|auto|adaptive, e.g. speed 2000, speed a
Read JTAG Id (Host CPU) | i JTAG Id: 0x2BA01477 Version: 0x2 Part no: 0xba01 Man. Id: 023B
| Write JTAG command (IR). | wjc xData
Write JTAG data (DR). | wjd xData64, NumBits(dec)
Write Raw JTAG data. | wjraw NumBits(dec), tms, tdi
RTAP Reset TAP Controller using state machine (111110)
| Reset TA0P Controller (nTRST) | rt
JTAG-Hardware
| Create clock with
TDI = TMS = 0m | c00
Clock ====== see 16.1.1 | c Data: 1
| TCK Clear | set | tck0|tck1 test clock input provides the clock for the test logic.
TDI clear | set | 0|1 (really) Serial test instructions and data are received by the test logic at test data input
TMS clear | set | t0 | t1 signal received at test mode select is decoded by the TAP controller to control test operations.
TRST clear | set | trst0 | trst1 Test Data Output is the serial output for test instructions and data from the test logic.
RESET clear | set | r0 |r1 (sic?
| Connection
|
Connect ARM Pro or J-Link TCP/IP Server via TCP/IP. | ip ip_addr
Connecting to J-Link via IP...
FAILED: Can not connect to J-Link via TCP/IP (192.168.1.1, port 19020)
| Show/Assign IP address and subnetmask of/to the connected J-Link. | ipaddr Disconnecting from J-Link...O.K.
Disconnecting from J-Link...O.K.
Connecting to J-Link via IP...FAILED: Can not connect to J-Link via TCP/IP. No emulator found.
| Show/Assign network gateway . | gwaddr
Show/Assign network DNS server . | dnsaddr
| | | Configuration
| Switch power supply for target. | power on|off [perm] The connected debug probe does not support this command.
| Read/Write configuration byte | rconf|wconf offset [, data]
rconf 0,80
Total size of config area: 0x100 bytes
00000000 = 00 01 FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00000010 = FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00000020 = FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00000030 = FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00000040 = FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00000050 = 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00000060 = FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00000070 = FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
| Configuration of the connected J-Link. | [show]conf USB-Address: 0
Enum. type: Real-SN is used
KS-Power: Off (Default)
| SWO Single Wire Output
| supported speeds | SWOSpeed Supported speeds:
- 12000 kHz/n, (n>=1). => 12000kHz, 6000kHz, 4000kHz, ...
| | SWOStart| SWOStop
Display SWO status | SWOStat after logging but not displayed vi RTviewerclient1, MAIN:INFO:LEDs init J-Link>SWOStat
0 bytes in host buffer However SWOread showed data and SWOstat
| Read and display SWO data | SWORead
SWOStat
0 bytes in host buffer
J-Link>SWORead
256 bytes read (0 bytes in host buffer)
00000000 = 00 00 00 00 00 00 00 90 00 00 00 00 00 00 00 90
00000010 = 37 00 00 00 A3 59 00 8B 70 A0 16 0C 01 00 00 00
00000020 = 50 62 59 54 FF 7F 00 00 02 00 00 00 00 00 07 00
00000030 = 00 00 00 00 00 00 00 90 00 00 00 00 00 00 00 90
00000040 = 4F 00 00 00 00 00 00 00 10 00 10 00 10 00 00 00
00000050 = 00 00 00 00 00 00 00 00 00 00 00 2C 06 00 16 00 16 00 21 see SWOshow PC
00000060 = 21 00 00 00 40 00 00 00 41 00 00 00 42 00 00 00
00000070 = 43 00 00 00 44 00 00 00 45 00 00 00 46 00 00 00
…
000000F0 = 4F 00 00 00 50 00 00 00 51 00 00 00 52 00 00 00
Read and analyze SWO data | SWOShow
J-Link>SWOShow
256 bytes read (0 bytes in host buffer)
Offset Data Meaning
-----------------------------------------------
001E-0020 16 00 21 PC = 0x00002100
0024-0024 40 Timestamp sync. ITM/DWT (4)
0028-0029 41 00 SWIT(8): 00
002C-002E 42 00 16 SWIT(8): 00 16
0034-0035 01 00 SWIT(0): 00
0038-003A 02 00 00 SWIT(0): 00 00
003C-0040 03 00 00 00 04 SWIT(0): 00 00 00 04
0044-0045 05 00 Event counter ()
0048-.... 06 Unknown packet
| Flush data | SWOFlush
View terminal data | SWOView Receiving SWO data @ 6000 kHz.
Data from stimulus port 0:
-----------------------------------------------
| Calibrate the target current measurement. | calibrate Please disconnect emulator from target.
Press any key to start the calibration...
Calibrating...Emulator calibrated.
Min=-1mA Max=-1mA Avg=-1mA Offs=-1mA...DONE
| Change endian mode | le be little | big
Select a emulator to communicate | selemu [Interface0 Interface1 ...]
list all emulators which are connected to the host. | ShowEmuList [Interface0 Interface1 ...] J-Link[0]: Connection: USB, Serial number: 682930364, ProductName: J-Link OB-SAM3U128-V2-NordicSem
| Set value for VTref | VTREF ValuemV 15.4 Reference voltage (VTref)
| log actions
This is usually only useful for the j-link development team
| log filename
| list license commands | license
license add Store a custom license on J-Link. Syntax: LicAdd LicName
license erase Erase all custom licenses on J-Link.
license show Show all licenses stored on J-Link.
J-Link>license show
Built-in licenses:
No installable licenses.
| Firmware info | f
Firmware: J-Link OB-SAM3U128-V2-NordicSemi compiled Jan 12 2018 16:05:20
Hardware: V1.00
| Select device | Device
Allows use of the J-Link flash programming as well as using unlimited breakpoints in flash memory.
mandatory For some devices to allow the DLL to perform special handling.
Select target interface. | si SWD | JTAG | ICSP | FINE | …
Select SWD as interface and outputs the JTAG - SWD switching sequence. | SWDSelect
current CPU state | IsHalted CPU is not halted.
| Quit and Close connection | qc
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |