Cannot access JTAG debug mode

[adevries]

Hello,

I have an i.MX 8M Mini on a custom CCA that I have been trying to debug via the JTAG port with no luck so far. I've probably read the "System Debug" section of the reference manual about 10 times and I must be missing something.

I have BOOT_MODE0 and BOOT_MODE1 pulled high, I have TEST_MODE pulled high. When JTAG_MOD is pulled low, there is some degree of communication, and I can do some boundary scanning commands, but the chain is too short. I can only talk to the SJC module (IR length = 5, DR length = 453). Also, in this mode, I always get the DFT_TAP ID 0x1cf80553.

When JTAG_MOD is pulled high, there is no communication and I'm only getting 1's clocked out on TDO.

I've also tried changing BOOT_MODE to low and TEST_MODE to low, but that isn't helping me either. I'm feeling pretty stumped.

I don't think any fuses disabling debug access have been set, but I'm happy to double-check that if someone knows of a specific fuse setting that could cause this behavior.

So, does anyone have any advice on how I can see the entire JTAG chain, access the DAPs, and make progress on enabling JTAG debug?

[adevries]

Update: I've discovered that setting the Instruction Register to 0x05 causes a new 32 bit number to be output from the Data Register. I don't know what this 32-bit number is (it's different from the ID code you get when IR is set to 0x04), and I can't figure out how to change the number at all.

I'm still hoping someone who has experience with JTAG debugging can help point me in the right direction.

[jimmychan]

What jtag debugger are you using?

[adevries]

Hi Jimmy,

Right now I'm using OpenOCD software with an XDS110 debugger from TI.

Can you confirm what TEST_MODE, BOOT_MODE0, BOOT_MODE1, and JTAG_MOD should be set to in order to enable JTAG debugging? Is it the same settings as boundary scan mode?

Also, can you confirm if JTAG_TRSTB is internally connected? The reference manual has diagrams that show it being used, but the hardware design guide says for that signal: "No connection from JTAG to processor". Also, JTAG_TRSTB is disconnected on the eval board JTAG header.

[jimmychan · Accepted solution]

FYI.

https://community.nxp.com/t5/i-MX-Processors/JTAG-Debuger-Selection-For-i-MX-8M-Mini/m-p/1177295

[adevries]

Hi Jimmy,

That is useful to know, thanks for sharing that. Can you help me figure out what these lines in the JLinkScript are doing?

JLINK_CORESIGHT_WriteAP(AHBAP_REG_ADDR, 0x007E0000);
JLINK_CORESIGHT_WriteAP(AHBAP_REG_DATA, 0x20008000);
JLINK_CORESIGHT_WriteAP(AHBAP_REG_ADDR, 0x007E0004);
JLINK_CORESIGHT_WriteAP(AHBAP_REG_DATA, 0x1FFE0009);
JLINK_CORESIGHT_WriteAP(AHBAP_REG_ADDR, 0x007E0008);
JLINK_CORESIGHT_WriteAP(AHBAP_REG_DATA, 0xE7FEE7FE);

Specifically, what is located at address 0x007E0000? I can't find that address in the reference manual anywhere. Are those modifying the MDM-AP?

[jimmychan]

According to the memory map in RM, 007E_0000 is TCM.

[adevries]

Hi Jimmy,

Have you been able to find out any more information about those registers? Do you know if there's a document that can tell me more about them?

Also, I was looking at the different Access Ports (AP) in the JTAG-DP, and whenever I try to get information on AP 1, it seems to crash. I'm wondering if I need to enable a clock to that module, but I need to learn some more information about the different APs and which module they each map to. Besides the reference manual (I've already read that), do you know where I can learn more about the debug capabilities of the 8M Mini?

[jimmychan]

unfortunately, we don't have much information about jtag debugging as we seldom use it to debug the program on Linux. For the jtag debugging information, please contact the debugger's company. They have their IDE, scripts and user's guide. e.g. Lauterbach (https://www.lauterbach.com/). 

[adevries]

Hi Jimmy,

I can reach out to a debugger company about general debugging questions, but why would I ask them about the registers/memory map on an i.MX 8M Mini? That's an NXP processor. NXP knows what is at the memory locations in the processors that NXP makes.

[jimmychan]

I told you that the address in the memory map is TCM.

And this may useful for you.

https://developer.arm.com/documentation/ihi0031/latest/

[adevries]

Hi Jimmy,
Thanks for the link, I've been reading it and it has been helping me understand the debug process better.

I also looked more into memory location 0x007E0000. I no longer think there are undocumented registers there. Is 0x007E0000 the first location in memory that the Cortex-M4 runs code from? If so, what document would tell me that? The reference manual just says it's part of TCM, nothing about being the start of program execution.

[adevries]

This forum post and the reference to application note AN5317 was able to answer my question about where the M4 boots code from.

[adevries]

Hi Jimmy,

Yes, I saw that as well, but that doesn't really answer my question. I'm assuming that part of the JLinkScript is writing to those locations in memory, and I'm assuming it's doing that to change some settings or enable debug mode, but I would like to know what registers are at those addresses, and what does each bit control in the register control? That information isn't in the reference manual, so I'm hoping you can help me find this out.