Cannot access JTAG debug mode

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Cannot access JTAG debug mode

Jump to solution
1,473 Views
adevries
Contributor V

Hello,

I have an i.MX 8M Mini on a custom CCA that I have been trying to debug via the JTAG port with no luck so far. I've probably read the "System Debug" section of the reference manual about 10 times and I must be missing something.

I have BOOT_MODE0 and BOOT_MODE1 pulled high, I have TEST_MODE pulled high. When JTAG_MOD is pulled low, there is some degree of communication, and I can do some boundary scanning commands, but the chain is too short. I can only talk to the SJC module (IR length = 5, DR length = 453). Also, in this mode, I always get the DFT_TAP ID 0x1cf80553.

When JTAG_MOD is pulled high, there is no communication and I'm only getting 1's clocked out on TDO.

I've also tried changing BOOT_MODE to low and TEST_MODE to low, but that isn't helping me either. I'm feeling pretty stumped.

I don't think any fuses disabling debug access have been set, but I'm happy to double-check that if someone knows of a specific fuse setting that could cause this behavior.

So, does anyone have any advice on how I can see the entire JTAG chain, access the DAPs, and make progress on enabling JTAG debug?

adevries_0-1704470455370.png

 

 

Labels (1)
0 Kudos
1 Solution
13 Replies
1,442 Views
adevries
Contributor V

Update: I've discovered that setting the Instruction Register to 0x05 causes a new 32 bit number to be output from the Data Register. I don't know what this 32-bit number is (it's different from the ID code you get when IR is set to 0x04), and I can't figure out how to change the number at all.

I'm still hoping someone who has experience with JTAG debugging can help point me in the right direction.

0 Kudos
1,438 Views
jimmychan
NXP TechSupport
NXP TechSupport

What jtag debugger are you using?

0 Kudos
1,427 Views
adevries
Contributor V

Hi Jimmy,

Right now I'm using OpenOCD software with an XDS110 debugger from TI.

Can you confirm what TEST_MODE, BOOT_MODE0, BOOT_MODE1, and JTAG_MOD should be set to in order to enable JTAG debugging? Is it the same settings as boundary scan mode?

Also, can you confirm if JTAG_TRSTB is internally connected? The reference manual has diagrams that show it being used, but the hardware design guide says for that signal: "No connection from JTAG to processor". Also, JTAG_TRSTB is disconnected on the eval board JTAG header.

0 Kudos
1,405 Views
adevries
Contributor V

Hi Jimmy,

That is useful to know, thanks for sharing that. Can you help me figure out what these lines in the JLinkScript are doing?

JLINK_CORESIGHT_WriteAP(AHBAP_REG_ADDR, 0x007E0000);
JLINK_CORESIGHT_WriteAP(AHBAP_REG_DATA, 0x20008000);
JLINK_CORESIGHT_WriteAP(AHBAP_REG_ADDR, 0x007E0004);
JLINK_CORESIGHT_WriteAP(AHBAP_REG_DATA, 0x1FFE0009);
JLINK_CORESIGHT_WriteAP(AHBAP_REG_ADDR, 0x007E0008);
JLINK_CORESIGHT_WriteAP(AHBAP_REG_DATA, 0xE7FEE7FE);

 

Specifically, what is located at address 0x007E0000? I can't find that address in the reference manual anywhere. Are those modifying the MDM-AP?

0 Kudos
1,376 Views
jimmychan
NXP TechSupport
NXP TechSupport

According to the memory map in RM, 007E_0000 is TCM.

0 Kudos
1,289 Views
adevries
Contributor V

Hi Jimmy,

Have you been able to find out any more information about those registers? Do you know if there's a document that can tell me more about them?

Also, I was looking at the different Access Ports (AP) in the JTAG-DP, and whenever I try to get information on AP 1, it seems to crash. I'm wondering if I need to enable a clock to that module, but I need to learn some more information about the different APs and which module they each map to. Besides the reference manual (I've already read that), do you know where I can learn more about the debug capabilities of the 8M Mini?

0 Kudos
1,283 Views
jimmychan
NXP TechSupport
NXP TechSupport

unfortunately, we don't have much information about jtag debugging as we seldom use it to debug the program on Linux. For the jtag debugging information, please contact the debugger's company. They have their IDE, scripts and user's guide. e.g. Lauterbach (https://www.lauterbach.com/). 

0 Kudos
1,269 Views
adevries
Contributor V
Hi Jimmy,

I can reach out to a debugger company about general debugging questions, but why would I ask them about the registers/memory map on an i.MX 8M Mini? That's an NXP processor. NXP knows what is at the memory locations in the processors that NXP makes.
0 Kudos
1,206 Views
jimmychan
NXP TechSupport
NXP TechSupport

I told you that the address in the memory map is TCM.

And this may useful for you.

https://developer.arm.com/documentation/ihi0031/latest/

0 Kudos
1,189 Views
adevries
Contributor V
Hi Jimmy,
Thanks for the link, I've been reading it and it has been helping me understand the debug process better.

I also looked more into memory location 0x007E0000. I no longer think there are undocumented registers there. Is 0x007E0000 the first location in memory that the Cortex-M4 runs code from? If so, what document would tell me that? The reference manual just says it's part of TCM, nothing about being the start of program execution.
0 Kudos
1,051 Views
adevries
Contributor V

This forum post and the reference to application note AN5317 was able to answer my question about where the M4 boots code from.

0 Kudos
1,362 Views
adevries
Contributor V

Hi Jimmy,

Yes, I saw that as well, but that doesn't really answer my question. I'm assuming that part of the JLinkScript is writing to those locations in memory, and I'm assuming it's doing that to change some settings or enable debug mode, but I would like to know what registers are at those addresses, and what does each bit control in the register control? That information isn't in the reference manual, so I'm hoping you can help me find this out.

0 Kudos