mspdebug (1) - Linux Manuals

mspdebug: debugging tool for MSP430 MCUs

NAME

MSPDebug - debugging tool for MSP430 MCUs

SYNOPSIS

mspdebug [options] driver [command ...]

DESCRIPTION

MSPDebug is a command-line tool designed for debugging and programming the MSP430 family of MCUs. It supports the eZ430-F2013, eZ430-RF2500, FET430UIF and Olimex MSP-JTAG-TINY programming tools, as well as a simulation mode.

When started with appropriate options, MSPDebug will attempt to connect to the debugging tool specified and identify the device under test. Once connected, the user is presented with a command prompt which can be used to reflash the device memory, inspect memory and registers, set registers, and control the CPU (single step, run and run to breakpoint).

It supports ELF32, Intel HEX and BSD-style symbol tables (such as the output produced by nm(1)). It can also be used as a remote stub for gdb(1).

On startup, MSPDebug will look for a file called .mspdebug in the user's home directory. If it exists, commands will be read and executed from this file before executing any other commands or starting the interactive reader.

OPTIONS

Command-line options accepted by MSPDebug are described below. If commands are specified on the end of the command-line, then they are executed after connecting to the device, and the interactive prompt is not started. See the section labelled COMMANDS for more information.

-v voltage

Set the programming voltage. The voltage should be specified as an integer in millivolts. It defaults to 3000 (3.0 V).

-j

Use JTAG instead of Spy-Bi-Wire to communicate with the MSP430. This option only works on FET430UIF devices.

-d device

Specify that the driver should connect via a tty device rather than USB. The supported connection methods vary depending on the driver. See the section DRIVERS below for details.

-U bus:device

Specify a particular USB device to connect to. Without this option, the first device of the appropriate type is opened.

-n

Do not process the startup file (~/.mspdebug).

--help

Display a brief help message and exit.

--fet-list

Display a list of devices supported by the FET driver (the driver used for -R and -u operating modes).

--fet-force-id string

When using a FET device, force the connected chip to be recognised by MSPDebug as one of the given type during initialization. This overrides the device ID returned by the FET.

--usb-list

List available USB devices and exit.

DRIVERS

A driver name must be specified on the command line for MSPDebug to connect to. Valid driver names are listed here.

rf2500

Connect to an eZ430-RF2500 device. Only USB connection is supported.

olimex

Connect to an Olimex MSP-JTAG-TINY device. Both USB and tty access are supported.

sim

Do not connect to any hardware device, but instead start in simulation mode. A 64k buffer is allocated to simulate the device memory. The CPU core alone is emulated (no peripheral emulation).

During simulation, addresses below 0x0200 are assumed to be IO memory. When data is written to an IO memory address, a message is displayed on the console showing the program counter location, address written to, and data. The data value is also written to simulated RAM at the relevant address.

When data is read from IO memory, the user is notified similarly and prompted to supply the data. At this prompt, address expressions can be entered. If no value is entered, the value is read from simulated RAM. The user can press Ctrl+C to abort an IO request and stop execution.

This mode is intended for testing of changes to MSPDebug, and for aiding the disassembly of MSP430 binaries (as all binary and symbol table formats are still usable in this mode).

uif

Connect to an eZ430-F2013 or a FET430UIF device. The device argument should be the filename of the appropriate tty device. The TI serial converter chips on these devices are supported by newer versions of the Linux kernel, and should appear as /dev/ttyXX when attached.

USB connection is not supported for this driver.

uif-bsl

Connect to the bootloader on a FET430UIF device. These devices contain MSP430F419 chips. By sending a special command sequence, you can obtain access to the bootloader and inspect memory on the MSP430F419 in the programming device itself.

Currently, only memory inspection is supported. CPU control via the bootloader is not possible. Memory erase and write is possible, but is currently not implemented, for lack of ability to test it. If implemented, this would allow firmware updates to FET430UIF devices.

USB connection is not supported for this driver.

COMMANDS

MSPDebug can accept commands either through an interactive prompt, or non-interactively when specified on the command line. The supported commands are listed below.

Commands take arguments separated by spaces. Any text string enclosed in double-quotation marks is considered to be a single argument, even if it contains space characters. Within a quoted string, the usual C-style backslash substitutions can be used.

= expression

Evaluate an address expression and show both its value, and the result when the value is looked up in reverse in the current symbol table. This result is of the form symbol+offset, where symbol is the name of the nearest symbol not past the address in question.

See the section marked ADDRESS EXPRESSIONS for more information on the syntax of expressions.

break

Show a list of active breakpoints. Breakpoints can be added and removed with the setbreak and delbreak commands. Each breakpoint is numbered with an integer index starting at 0.

cgraph address length [address]

Construct the call graph of all functions contained or referenced in the given range of memory. If a particular function is specified, then details for that node of the graph are displayed. Otherwise, a summary of all nodes is displayed.

Information from the symbol table is used for hinting at the possible locations of function starts. Any symbol which does not contain a "." is considered a possible function start.

Callers and callee names are shown prefixed by a "*" where the transition is a tail-call type transition.

delbreak [index]

Delete one or all breakpoints. If an index is given, the selected breakpoint is deleted. Otherwise, all breakpoints are cleared.

dis address [length]

Dissassemble a section of memory. Both arguments may be address expressions. If no length is specified, a section of the default length (64 bytes) is disassembled and shown.

If symbols are available, then all addresses used as operands are translated into symbol+offset form.

erase

Erase the device under test. All code memory is erased (but not information or boot memory).

gdb [port]

Start a GDB remote stub, optionally specifying a TCP port to listen on. If no port is given, the default port is 2000.

MSPDebug will wait for a connection on this port, and then act as a GDB remote stub until GDB disconnects. The basic GDB protocol is supported, plus the monitor commands "erase" and "reset".

help [command]

Show a brief listing of available commands. If an argument is specified, show the syntax for the given command. The help text shown when no argument is given is also shown when MSPDebug starts up.

hexout address length filename

Read the specified section of the device memory and save it to an Intel HEX file. The address and length arguments may both be address expressions.

If the specified file already exists, then it will be overwritten. If you need to dump memory from several disjoint memory regions, you can do this by saving each section to a separate file. The resulting files can then be concatenated together to form a single valid HEX file.

isearch address length [options ...]

Search over the given range for an instruction which matches the specified search criteria. The search may be narrowed by specifying one or more of the following terms:

opcode opcode

Match the specified opcode. Byte/word specifiers are not recognised, as they are specified with other options.

byte

Match only byte operations.

word

Match only word operations.

jump

Match only jump instructions (conditional and unconditional jumps, but not instructions such as BR which load the program counter explicitly).

single

Match only single-operand instructions.

double

Match only double-operand instructions.

noarg

Match only instructions with no arguments.

src address

Match instructions with the specified value in the source operand. The value may be given as an address expression. Specifying this option implies matching of only double-operand instructions.

dst address

Match instructions with the specified value in the destination operand. This option implies that no-argument instructions are not matched.

srcreg register

Match instructions using the specified register in the source operand. This option implies matching of only double-operand instructions.

dstreg register

Match instructions using the specified register in the destination operand. This option implies that no-argument instructions are not matched.

srcmode mode

Match instructions using the specified mode in the source operand. See below for a list of modes recognised. This option implies matching of only double-operand instructions.

dstmode mode

Match instructions using the specified mode in the destination operand. See below for a list of modes. This option implies that no-argument instructions are not matched.

For single-operand instructions, the operand is considered to be the destination operand.

The seven addressing modes used by the MSP430 are represented by single characters, and are listed here:

R

Register mode.

I

Indexed mode.

S

Symbolic mode.

&

Absolute mode.

@

Register-indirect mode.

+

Register-indirect mode with auto-increment.

#

Immediate mode.

md address [length]

Read the specified section of device memory and display it as a canonical-style hexdump. Both arguments may be address expressions. If no length is specified, a section of the default length (64 bytes) is shown.

The output is split into three columns. The first column shows the starting address for the line. The second column lists the hexadecimal values of the bytes. The final column shows the ASCII characters corresponding to printable bytes, and . for non-printing characters.

mw address bytes ...

Write a sequence of bytes at the given memory address. The address given may be an address expression. Bytes values are two-digit hexadecimal numbers separated by spaces.

Unless used in the simulation mode, this command can only be used for programming flash memory.

opt [name] [value]

Query, set or list option variables. MSPDebug's behaviour can be configured using option variables, described below in the section OPTIONS.

Option variables may be of three types: boolean, numeric or text. Numeric values may be specified as address expressions.

With no arguments, this command displays all available option variables. With just an option name as its argument, it displays the current value of that option.

prog filename

Erase and reprogram the device under test using the binary file supplied. The file format will be auto-detected and may be either Intel HEX or ELF32.

In the case of an ELF32 file, symbols will be automatically loaded from the file into the symbol table (discarding any existing symbols), if they are present.

The CPU is reset and halted before and after programming.

read filename

Read commands from the given file, line by line and process each one. Any lines whose first non-space character is # are ignored. If an error occurs while processing a command, the rest of the file is not processed.

regs

Show the current value of all CPU registers in the device under test.

reset

Reset (and halt) the CPU of the device under test.

run

Start running the CPU. The interactive command prompt is blocked when the CPU is started and the prompt will not appear again until the CPU halts. The CPU will halt if it encounters a breakpoint, or if Ctrl-C is pressed by the user.

After the CPU halts, the current register values are shown as well as a disassembly of the first few instructions at the address selected by the program counter.

set register value

Alter the value of a register. Registers are specified as numbers from 0 through 15. Any leading non-numeric characters are ignored (so a register may be specified as, for example, "R12"). The value argument is an address expression.

setbreak address [index]

Add a new breakpoint. The breakpoint location is an address expression. An optional index may be specified, indicating that this new breakpoint should overwrite an existing slot. If no index is specified, then the breakpoint will be stored in the next unused slot.

step [count]

Step the CPU through one or more instructions. After stepping, the new register values are displayed, as well as a disassembly of the instructions at the address selected by the program counter.

An optional count can be specified to step multiple times. If no argument is given, the CPU steps once.

sym clear

Clear the symbol table, deleting all symbols.

sym set name value

Set or alter the value of a symbol. The value given may be an address expression.

sym del name

Delete the given symbol from the symbol table.

sym import filename

Load symbols from the specified file and add them to the symbol table. The file format will be auto-detected and may be either ELF32 or a BSD-style symbol listing (like the output from nm(1)).

Symbols can be combined from many sources, as the syms command adds to the existing symbol table without discarding existing symbols.

sym import+ filename

This command is similar to sym import, except that the symbol table is not cleared first. By using this command, symbols from multiple sources can be combined.

sym export filename

Save all symbols currently defined to the given file. The symbols are saved as a BSD-style symbol table. Note that symbol types are not stored by MSPDebug, and all symbols are saved as type t.

sym find [regex]

Search for symbols. If a regular expression is given, then all symbols matching the expression are printed. If no expression is specified, then the entire symbol table is listed.

sym rename regex string

Rename symbols by searching for those matching the given regular expression and substituting the given string for the matched portion. The symbols renamed are displayed, as well as a total count of all symbols renamed.

ADDRESS EXPRESSIONS

Any command which accepts a memory address, length or register value as an argument may be given an address expression. An address expression consists of an algebraic combination of values.

An address value may be either a decimal value, a hexadecimal value preceeded by the prefix 0x, or a symbol name.

The operators recognised are the usual algebraic operators: +, -, *, /, %, ( and ). Operator precedence is the same as in C-like languages, and the - operator may be used as a unary negation operator.

The following are all valid examples of address expressions:

2+2
table_start + (elem_size + elem_pad)*4
main+0x3f
__bss_end-__bss_start

OPTIONS

MSPDebug's behaviour can be configured via the following variables:

color (boolean)

If true, MSPDebug will colorize debugging output.

gdb_loop (boolean)

Automatically restart the GDB server after disconnection. If this option is set, then the GDB server keeps running until an error occurs, or the user interrupts with Ctrl+C.

BUGS

If you find any bugs, you should report them to the author at daniel [at] tortek.co.nz. It would help if you could include a transcript of an MSPDebug session illustrating the program, as well as any relevant binaries or other files. Below, known bugs in the current version of MSPDebug are described.

Memory addresses above 0x10000 (in devices with more than 64k of memory) are not accessible. All other memory in these devices is accessible as normal.

When using the GDB remote stub in simulation and an IO read request occurs, any request to interrupt from GDB will not be acknowledged until the IO request is either completed or aborted.

COPYRIGHT

Copyright (C) 2009, 2010 Daniel Beer <daniel [at] tortek.co.nz>

MSPDebug is free software, distributed under the terms of the GNU General Public license (version 2 or later). See the file COPYING included with the source code for more details.