Hi again,

following up on my other message, I split them up into seperate messages, as I think there are different reasons.

When I start the target from the BDI shell with "RESET RUN" and wait until the "Hit any key to stop autoboot" message appears, I can then attach to the target :

Remote debugging using jtag:3333 0x1ff731ec in ?? ()

I then discard the symbols:

(gdb) symb Discard symbol table from `...uboot/u-boot-2009.08/u-boot'? (y or n) y No symbol file now.

Then, I calculate the RAM address for the symbols as described in DULG-10.1.2.:

RAM is 512 MB --> 0x2000 0000 Monitor Len according to board specific file is 256k --> 0x0004 0000 This yields address 0x1FFC 0000.

(gdb) add-symbol-file u-boot 0x1FFC0000 add symbol table from file "u-boot" at .text_addr = 0x1FFC0000 (y or n) y Reading symbols from ...uboot/u-boot-2009.08/u-boot...done.

I then apply a breakpoint to TftpStart, which is definitely up next:

(gdb) b TftpStart Breakpoint 1 at 0x1ffc6314: file tftp.c, line 474.

looks like an appropriate address, anyway saying

(gdb) c Continuing.

never stops in TftpStart. The kernel is loaded by TFTP and the target can only be halted by pressing Ctrl-C.

On the other hand, calculating the address the other way yields

(gdb) print/x ((gd_t *)$r2)->reloc_off $4 = 0x1fff0000

adding this to TEXT_BASE which is

./board/freescale/mpc8568mds/config.mk:TEXT_BASE = 0xfff80000

results in something above 32 bit.

What am I doing wrong here?

Cheers Matthias