topic Re: Debugging iMX8QM6 with OpenOCD: TAPID mismatch and proper mapping of targets in i.MX Processors

Debugging iMX8QM6 with OpenOCD: TAPID mismatch and proper mapping of targets

teodor_robas — Mon, 19 Aug 2019 12:13:31 GMT

Hello,

I have a iMX8QM6 (4 x A53; 2 x A72; 2 x M4) that I would like to debug with OpenOCD and J-Link.

An OpenOCD compiled from sources shows:

$ ./src/openocd.exe -f tcl/interface/jlink.cfg -f imx8m_local-2.cfg
Open On-Chip Debugger 0.10.0+dev-00924-g16496488-dirty (2019-08-09-11:20)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.org/doc/doxygen/bugs.html
Info : auto-selecting first available session transport "jtag". To override use 'transport select <transport>'.
adapter speed: 4000 kHz

Info : Listening on port 6666 for tcl connections
Info : Listening on port 4444 for telnet connections
Info : J-Link Pro V4 compiled Feb 2 2018 18:13:08
Info : Hardware version: 4.00
Info : VTarget = 1.798 V
Info : clock speed 4000 kHz
Info : JTAG tap: imx8m.cpu tap/device found: 0x1890101d (mfg: 0x00e (Freescale (Motorola)), part: 0x8901, ver: 0x1)
Warn : JTAG tap: imx8m.cpu UNEXPECTED: 0x1890101d (mfg: 0x00e (Freescale (Motorola)), part: 0x8901, ver: 0x1)
Error: JTAG tap: imx8m.cpu expected 1 of 1: 0x5ba00477 (mfg: 0x23b (ARM Ltd.), part: 0xba00, ver: 0x5)
Error: Trying to use configured scan chain anyway...
Warn : Bypassing JTAG setup events due to errors
Info : imx8m.a53.0: hardware has 6 breakpoints, 4 watchpoints
Info : imx8m.a72.0: hardware has 6 breakpoints, 4 watchpoints
Info : imx8m.a72.1: hardware has 6 breakpoints, 4 watchpoints
Info : imx8m.m4.0: hardware has 6 breakpoints, 4 watchpoints
Info : imx8m.m4.1: hardware has 6 breakpoints, 4 watchpoints
Info : Listening on port 3333 for gdb connections
Info : Listening on port 3334 for gdb connections
Info : Listening on port 3335 for gdb connections
Info : Listening on port 3336 for gdb connections
Info : Listening on port 3337 for gdb connections

The TAPID does not match with the expected one. In the manual (i.MX 8QuadMax Applications Processor Reference Manual, Rev. E, 06/2018, Chapter 6.2.1) also TAP ID 0x5ba00477 is mentioned but 0x1890101d is found by OpenOCD.

This is what OpenOCD shows:

> dap info 0
AP ID register 0x44770004
Type is MEM-AP AXI
MEM-AP BASE 0x00000002
No ROM table present

> dap info 1
AP ID register 0x24770011
Type is MEM-AP AHB3
MEM-AP BASE 0xe00ff003
Valid ROM table present
Component base address 0xe00ff000
Peripheral ID 0x04000bb4c4
Designer is 0x4bb, ARM Ltd.
Part is 0x4c4, Cortex-M4 ROM (ROM Table)
Component class is 0x1, ROM table
MEMTYPE system memory present on bus
ROMTABLE[0x0] = 0xfff0f003
Component base address 0xe000e000
Peripheral ID 0x04000bb00c
Designer is 0x4bb, ARM Ltd.
Part is 0xc, Cortex-M4 SCS (System Control Space)
Component class is 0xe, Generic IP component
ROMTABLE[0x4] = 0xfff02003
Component base address 0xe0001000
Peripheral ID 0x04003bb002
Designer is 0x4bb, ARM Ltd.
Part is 0x2, Cortex-M3 DWT (Data Watchpoint and Trace)
Component class is 0xe, Generic IP component
ROMTABLE[0x8] = 0xfff03003
Component base address 0xe0002000
Peripheral ID 0x04002bb003
Designer is 0x4bb, ARM Ltd.
Part is 0x3, Cortex-M3 FPB (Flash Patch and Breakpoint)
Component class is 0xe, Generic IP component
ROMTABLE[0xc] = 0xfff01003
Component base address 0xe0000000
Peripheral ID 0x04003bb001
Designer is 0x4bb, ARM Ltd.
Part is 0x1, Cortex-M3 ITM (Instrumentation Trace Module)
Component class is 0xe, Generic IP component
ROMTABLE[0x10] = 0xfff41002
Component not present
ROMTABLE[0x14] = 0xfff42003
Component base address 0xe0041000
Peripheral ID 0x04000bb925
Designer is 0x4bb, ARM Ltd.
Part is 0x925, Cortex-M4 ETM (Embedded Trace)
Component class is 0x9, CoreSight component
Type is 0x13, Trace Source, Processor
ROMTABLE[0x18] = 0xfff43002
Component not present
ROMTABLE[0x1c] = 0xfff44003
Component base address 0xe0043000
Peripheral ID 0x04001bb908
Designer is 0x4bb, ARM Ltd.
Part is 0x908, CoreSight CSTF (Trace Funnel)
Component class is 0x9, CoreSight component
Type is 0x12, Trace Link, Funnel, router
ROMTABLE[0x20] = 0x0
End of ROM table

> scan_chain
TapName Enabled IdCode Expected IrLen IrCap IrMask
-- ------------------- -------- ---------- ---------- ----- ----- ------
0 imx8m.cpu Y 0x1890101d 0x5ba00477 4 0x01 0x0f

> targets
TargetName Type Endian TapName State
-- ------------------ ---------- ------ ------------------ ------------
0 imx8m.a53.0 aarch64 little imx8m.cpu running
1 imx8m.a53.1 aarch64 little imx8m.cpu examine deferred
2 imx8m.a53.2 aarch64 little imx8m.cpu examine deferred
3 imx8m.a53.3 aarch64 little imx8m.cpu examine deferred
4 imx8m.a72.0 aarch64 little imx8m.cpu running
5 imx8m.a72.1 aarch64 little imx8m.cpu running
6* imx8m.m4.0 cortex_m little imx8m.cpu halted
7 imx8m.m4.1 cortex_m little imx8m.cpu halted
8 imx8m.ahb mem_ap little imx8m.cpu running

The config file:

#
# configuration file for NXP i.MX8M family of SoCs
#
if { [info exists CHIPNAME] } {
 set _CHIPNAME $CHIPNAME
} else {
 set _CHIPNAME imx8m
}

if { [info exists CHIPCORES] } {
 set _cores $CHIPCORES
} else {
 set _cores 4
}

# CoreSight Debug Access Port
if { [info exists DAP_TAPID] } {
 set _DAP_TAPID $DAP_TAPID
} else {
 set _DAP_TAPID 0x5ba00477
 # set _DAP_TAPID 0x1890101d
}

# the DAP tap
jtag newtap $_CHIPNAME cpu -irlen 4 -ircapture 0x01 -irmask 0x0f -expected-id $_DAP_TAPID

dap create $_CHIPNAME.dap -chain-position $_CHIPNAME.cpu

set _TARGETNAME_A53 $_CHIPNAME.a53
set _TARGETNAME_A72 $_CHIPNAME.a72
set _TARGETNAME_M4F $_CHIPNAME.m4f

set _CTINAME_A53 $_TARGETNAME_A53.cti
set _CTINAME_A72 $_TARGETNAME_A72.cti
set _CTINAME_M4F $_TARGETNAME_M4F.cti

set DBGBASE_A53 {0x80410000 0x80510000 0x80610000 0x80710000}
set CTIBASE_A53 {0x80420000 0x80520000 0x80620000 0x80720000}

set DBGBASE_A72 {0x80C10000 0x80D10000}
set CTIBASE_A72 {0x80C20000 0x80D20000}

set DBGBASE_M4F {0x80910000 0x80920000}
set CTIBASE_M4F {0x80918000 0x80928000}

for { set _core 0 } { $_core < 4 } { incr _core } {

cti create $_CTINAME_A53.$_core -dap $_CHIPNAME.dap -ap-num 1 \
 -ctibase [lindex $CTIBASE_A53 $_core]

set _command "target create $_TARGETNAME_A53.$_core aarch64 -dap $_CHIPNAME.dap \
 -dbgbase [lindex $DBGBASE_A53 $_core] -cti $_CTINAME_A53.$_core"

if { $_core != 0 } {
 # non-boot core examination may fail
 set _command "$_command -defer-examine"
 set _smp_command "$_smp_command $_TARGETNAME_A53.$_core"
 } else {
 set _smp_command "target smp $_TARGETNAME_A53.$_core"
 }

eval $_command
}

eval $_smp_command

for { set _core 0 } { $_core < 2 } { incr _core } {

cti create $_CTINAME_A72.$_core -dap $_CHIPNAME.dap -ap-num 1 \
 -ctibase [lindex $CTIBASE_A72 $_core]

set _command "target create $_TARGETNAME_A72.$_core aarch64 -dap $_CHIPNAME.dap \
 -dbgbase [lindex $DBGBASE_A72 $_core] -cti $_CTINAME_A72.$_core"

set _smp_command "target smp $_TARGETNAME_A72.$_core"

eval $_command
}

# declare the auxiliary Cortex-M4-0 core on AP #1
target create ${_CHIPNAME}.m4.0 cortex_m -dap ${_CHIPNAME}.dap -ap-num 1

# declare the auxiliary Cortex-M4-1 core on AP #1
target create ${_CHIPNAME}.m4.1 cortex_m -dap ${_CHIPNAME}.dap -ap-num 1

# AHB-AP for direct access to soc bus
target create ${_CHIPNAME}.ahb mem_ap -dap ${_CHIPNAME}.dap -ap-num 0

# default target is A53 core 0
targets $_TARGETNAME_A53.0

adapter_khz 4000

I can halt, and step instructions from a Cortex M4 core (with some ugly kernel dumps on the application cores). Still I am not sure what core is this one - it could be the System Controller.

As for aarch64 cores GDB complains:

./aarch64-linux-gnu-gdb.exe

...

Remote debugging using 127.0.0.1:3334
warning: Architecture rejected target-supplied description

And there comes questions:

1) Is it possible that the TAPID mismatch is a problem ?

and

1a) Is it possible that OpenOCD shows SJC TAP ID instead ?

2) OpenOCD targets listed above may very well be in the wrong order or missing.

Would there be a target for each of the eight cores ?

and

2a) Any idea from where targets proper order might be revealed ?

3) The missing CTIBASE and DBGBASE registers are from various forum posts.

Is it possible that the values for M4 and A72 are wrong ?

Best Regards,

Teodor

Re: Debugging iMX8QM6 with OpenOCD: TAPID mismatch and proper mapping of targets

AldoG — Mon, 19 Aug 2019 19:51:41 GMT

Hello,

Unfortunately as you may know the i.MX8 family it is not released yet (pre-production stage) , all the required support/documentation should be requested through your distributor(DFAE).

I apologize for the inconvenience and for any problem this may cause.

Thank you for your understanding,

Best regards,

Aldo

Re: Debugging iMX8QM6 with OpenOCD: TAPID mismatch and proper mapping of targets

teodor_robas — Fri, 30 Aug 2019 06:24:59 GMT

Thank you but the issues I had were more ARM and OpenOCD related.

In the meantime I solved some of them.

Here are a few things that might be useful:

TAP ID mismatch is not important for JLink/OpenOCD. Probably a version update...
The M4 core I was debugging was indeed the SCU. There was a unknown problem that I could only solve by using another board. When the other two M4 cores are turned on they can be seen with 'dap info 2' or 'dap info 3' commands. In my case, this cores were not powered on so the commands returned a message like 'Can't read component, the corresponding core might be turned off'. This has changed now with the new board.
There is a mention in OpenOCD code that hardware breakpoints only work if M4 core is running from TCML memory region (up to 0x1fffffff). That is because the installed revision of FPB (Flash Patch and Breakpoint) does not support hardware breakpoints in the upper part of the memory region.
Using software breakpoints to debug in DDR at address 0x88000000 does not work neither with JLink nor with OpenOCD. With OpenOCD, '(gdb) si' would appear to step over an instruction but it will not halt after the instruction was executed.
The previous OpenOCD config file was wrong. Here is a more proper one:

#
# configuration file for NXP i.MX8QM6 SoC
#
# @20190903
# guessed, updated and extended from imx8m.cfg
#
# The iMX8QM6 SoC has the folowing cores that can be debug targets:
#    AP cluster 0: 4 x Cortex-A53
#    AP cluster 1: 2 x Cortex-A72
#    2 x Cortex-M4
#    1 x Cortex-M4 - the SCU (System Control Unit)
#
# This configuration file considers that all 6 Application Processors (AP) are 
# running in Hybrid Multiprocessing (HMP) mode.
#
# With this configuration the following 4 targets are available in GDB:
# port 3333 - imx8qm6.aX       <--- AP cores (all 6 of them in HMP mode)
# port 3334 - imx8qm6.m4.scu   <--- SCU
# port 3335 - imx8qm6.m4.0
# port 3336 - imx8qm6.m4.1
#
# '-defer-examine' may be used for targets that are not powered up

if { [info exists CHIPNAME] } {
 set _CHIPNAME $CHIPNAME
} else {
 set _CHIPNAME imx8qm6
}

if { [info exists CHIPCORES_A53] } {
 set _cores_a53 $CHIPCORES_A53
} else {
 set _cores_a53 4
}

if { [info exists CHIPCORES_A72] } {
 set _cores_a72 $CHIPCORES_A72
} else {
 set _cores_a72 2
}

# CoreSight Debug Access Port
if { [info exists DAP_TAPID] } {
 set _DAP_TAPID $DAP_TAPID
} else {
 set _DAP_TAPID 0x1890101d
}

# the DAP tap
jtag newtap $_CHIPNAME cpu -irlen 4 -ircapture 0x01 -irmask 0x0f \
 -expected-id $_DAP_TAPID

dap create $_CHIPNAME.dap -chain-position $_CHIPNAME.cpu

set _CTINAME $_CHIPNAME.cti

set _hmp_command "target smp"

# create a53 targets in CTI cluster 0
set DBGBASE_A53 {0x80410000 0x80510000 0x80610000 0x80710000}
set CTIBASE_A53 {0x80420000 0x80520000 0x80620000 0x80720000}

for { set _core_a53 0 } { $_core_a53 < $_cores_a53 } { incr _core_a53 } {

 cti create $_CTINAME.a53.$_core_a53 -dap $_CHIPNAME.dap -ap-num 6 \
 -ctibase [lindex $CTIBASE_A53 $_core_a53]

 target create $_CHIPNAME.a53.$_core_a53 aarch64 -coreid $_core_a53 \
 -dap $_CHIPNAME.dap -dbgbase [lindex $DBGBASE_A53 $_core_a53] \
 -cti $_CTINAME.a53.$_core_a53

 set _hmp_command "$_hmp_command $_CHIPNAME.a53.$_core_a53"
}

# create a72 targets in CTI cluster 1
set DBGBASE_A72 {0x80210000 0x80310000}
set CTIBASE_A72 {0x80220000 0x80320000}

for { set _core_a72 0 } { $_core_a72 < $_cores_a72 } { incr _core_a72 } {
 cti create $_CTINAME.a72.$_core_a72 -dap $_CHIPNAME.dap -ap-num 6 \
 -ctibase [lindex $CTIBASE_A72 $_core_a72]

 target create $_CHIPNAME.a72.$_core_a72 aarch64 -coreid $_core_a72 \
 -dap $_CHIPNAME.dap -dbgbase [lindex $DBGBASE_A72 $_core_a72] \
 -cti $_CTINAME.a72.$_core_a72

 set _hmp_command "$_hmp_command $_CHIPNAME.a72.$_core_a72"
}

eval $_hmp_command

# create SCU Cortex-M4 SCU core on AP #1
target create ${_CHIPNAME}.m4.scu cortex_m -dap ${_CHIPNAME}.dap -ap-num 1

# create SCU Cortex-M4-0 core on AP #2
target create ${_CHIPNAME}.m4.0 cortex_m -dap ${_CHIPNAME}.dap -ap-num 2

# create SCU Cortex-M4-1 core on AP #3
# did not tried this one
target create ${_CHIPNAME}.m4.1 cortex_m -dap ${_CHIPNAME}.dap -ap-num 3 \
 -defer-examine

# AHB-AP for direct access to soc bus
target create ${_CHIPNAME}.ahb mem_ap -dap ${_CHIPNAME}.dap -ap-num 0

# default target
if { [info exists TARGETNAME] } {
 set _TARGETNAME $TARGETNAME
} else {
 set _TARGETNAME $_CHIPNAME.a53.0
}
targets $_TARGETNAME

adapter_khz 4000

reset_config trst_and_srst