AnsweredAssumed Answered

Debugging iMX8QM6 with OpenOCD: TAPID mismatch and proper mapping of targets

Question asked by Teodor Robas on Aug 19, 2019
Latest reply on Aug 29, 2019 by Teodor Robas

Hello,

I have a iMX8QM6 (4 x A53; 2 x A72; 2 x M4) that I would like to debug with OpenOCD and J-Link.

An OpenOCD compiled from sources shows:

 

$ ./src/openocd.exe -f tcl/interface/jlink.cfg -f imx8m_local-2.cfg
Open On-Chip Debugger 0.10.0+dev-00924-g16496488-dirty (2019-08-09-11:20)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.org/doc/doxygen/bugs.html
Info : auto-selecting first available session transport "jtag". To override use 'transport select <transport>'.
adapter speed: 4000 kHz

Info : Listening on port 6666 for tcl connections
Info : Listening on port 4444 for telnet connections
Info : J-Link Pro V4 compiled Feb 2 2018 18:13:08
Info : Hardware version: 4.00
Info : VTarget = 1.798 V
Info : clock speed 4000 kHz
Info : JTAG tap: imx8m.cpu tap/device found: 0x1890101d (mfg: 0x00e (Freescale (Motorola)), part: 0x8901, ver: 0x1)
Warn : JTAG tap: imx8m.cpu UNEXPECTED: 0x1890101d (mfg: 0x00e (Freescale (Motorola)), part: 0x8901, ver: 0x1)
Error: JTAG tap: imx8m.cpu expected 1 of 1: 0x5ba00477 (mfg: 0x23b (ARM Ltd.), part: 0xba00, ver: 0x5)
Error: Trying to use configured scan chain anyway...
Warn : Bypassing JTAG setup events due to errors
Info : imx8m.a53.0: hardware has 6 breakpoints, 4 watchpoints
Info : imx8m.a72.0: hardware has 6 breakpoints, 4 watchpoints
Info : imx8m.a72.1: hardware has 6 breakpoints, 4 watchpoints
Info : imx8m.m4.0: hardware has 6 breakpoints, 4 watchpoints
Info : imx8m.m4.1: hardware has 6 breakpoints, 4 watchpoints
Info : Listening on port 3333 for gdb connections
Info : Listening on port 3334 for gdb connections
Info : Listening on port 3335 for gdb connections
Info : Listening on port 3336 for gdb connections
Info : Listening on port 3337 for gdb connections

 

The TAPID does not match with the expected one. In the manual (i.MX 8QuadMax Applications Processor Reference Manual, Rev. E, 06/2018, Chapter 6.2.1) also TAP ID 0x5ba00477 is mentioned but 0x1890101d is found by OpenOCD.

 

This is what OpenOCD shows:

> dap info 0
AP ID register 0x44770004
Type is MEM-AP AXI
MEM-AP BASE 0x00000002
No ROM table present

> dap info 1
AP ID register 0x24770011
Type is MEM-AP AHB3
MEM-AP BASE 0xe00ff003
Valid ROM table present
Component base address 0xe00ff000
Peripheral ID 0x04000bb4c4
Designer is 0x4bb, ARM Ltd.
Part is 0x4c4, Cortex-M4 ROM (ROM Table)
Component class is 0x1, ROM table
MEMTYPE system memory present on bus
ROMTABLE[0x0] = 0xfff0f003
Component base address 0xe000e000
Peripheral ID 0x04000bb00c
Designer is 0x4bb, ARM Ltd.
Part is 0xc, Cortex-M4 SCS (System Control Space)
Component class is 0xe, Generic IP component
ROMTABLE[0x4] = 0xfff02003
Component base address 0xe0001000
Peripheral ID 0x04003bb002
Designer is 0x4bb, ARM Ltd.
Part is 0x2, Cortex-M3 DWT (Data Watchpoint and Trace)
Component class is 0xe, Generic IP component
ROMTABLE[0x8] = 0xfff03003
Component base address 0xe0002000
Peripheral ID 0x04002bb003
Designer is 0x4bb, ARM Ltd.
Part is 0x3, Cortex-M3 FPB (Flash Patch and Breakpoint)
Component class is 0xe, Generic IP component
ROMTABLE[0xc] = 0xfff01003
Component base address 0xe0000000
Peripheral ID 0x04003bb001
Designer is 0x4bb, ARM Ltd.
Part is 0x1, Cortex-M3 ITM (Instrumentation Trace Module)
Component class is 0xe, Generic IP component
ROMTABLE[0x10] = 0xfff41002
Component not present
ROMTABLE[0x14] = 0xfff42003
Component base address 0xe0041000
Peripheral ID 0x04000bb925
Designer is 0x4bb, ARM Ltd.
Part is 0x925, Cortex-M4 ETM (Embedded Trace)
Component class is 0x9, CoreSight component
Type is 0x13, Trace Source, Processor
ROMTABLE[0x18] = 0xfff43002
Component not present
ROMTABLE[0x1c] = 0xfff44003
Component base address 0xe0043000
Peripheral ID 0x04001bb908
Designer is 0x4bb, ARM Ltd.
Part is 0x908, CoreSight CSTF (Trace Funnel)
Component class is 0x9, CoreSight component
Type is 0x12, Trace Link, Funnel, router
ROMTABLE[0x20] = 0x0
End of ROM table

> scan_chain
TapName Enabled IdCode Expected IrLen IrCap IrMask
-- ------------------- -------- ---------- ---------- ----- ----- ------
0 imx8m.cpu Y 0x1890101d 0x5ba00477 4 0x01 0x0f

> targets
TargetName Type Endian TapName State
-- ------------------ ---------- ------ ------------------ ------------
0 imx8m.a53.0 aarch64 little imx8m.cpu running
1 imx8m.a53.1 aarch64 little imx8m.cpu examine deferred
2 imx8m.a53.2 aarch64 little imx8m.cpu examine deferred
3 imx8m.a53.3 aarch64 little imx8m.cpu examine deferred
4 imx8m.a72.0 aarch64 little imx8m.cpu running
5 imx8m.a72.1 aarch64 little imx8m.cpu running
6* imx8m.m4.0 cortex_m little imx8m.cpu halted
7 imx8m.m4.1 cortex_m little imx8m.cpu halted
8 imx8m.ahb mem_ap little imx8m.cpu running

 

The config file:

#
# configuration file for NXP i.MX8M family of SoCs
#
if { [info exists CHIPNAME] } {
set _CHIPNAME $CHIPNAME
} else {
set _CHIPNAME imx8m
}

if { [info exists CHIPCORES] } {
set _cores $CHIPCORES
} else {
set _cores 4
}

# CoreSight Debug Access Port
if { [info exists DAP_TAPID] } {
set _DAP_TAPID $DAP_TAPID
} else {
set _DAP_TAPID 0x5ba00477
# set _DAP_TAPID 0x1890101d
}

# the DAP tap
jtag newtap $_CHIPNAME cpu -irlen 4 -ircapture 0x01 -irmask 0x0f -expected-id $_DAP_TAPID

dap create $_CHIPNAME.dap -chain-position $_CHIPNAME.cpu

set _TARGETNAME_A53 $_CHIPNAME.a53
set _TARGETNAME_A72 $_CHIPNAME.a72
set _TARGETNAME_M4F $_CHIPNAME.m4f

set _CTINAME_A53 $_TARGETNAME_A53.cti
set _CTINAME_A72 $_TARGETNAME_A72.cti
set _CTINAME_M4F $_TARGETNAME_M4F.cti

set DBGBASE_A53 {0x80410000 0x80510000 0x80610000 0x80710000}
set CTIBASE_A53 {0x80420000 0x80520000 0x80620000 0x80720000}

set DBGBASE_A72 {0x80C10000 0x80D10000}
set CTIBASE_A72 {0x80C20000 0x80D20000}

set DBGBASE_M4F {0x80910000 0x80920000}
set CTIBASE_M4F {0x80918000 0x80928000}

for { set _core 0 } { $_core < 4 } { incr _core } {

cti create $_CTINAME_A53.$_core -dap $_CHIPNAME.dap -ap-num 1 \
-ctibase [lindex $CTIBASE_A53 $_core]

set _command "target create $_TARGETNAME_A53.$_core aarch64 -dap $_CHIPNAME.dap \
-dbgbase [lindex $DBGBASE_A53 $_core] -cti $_CTINAME_A53.$_core"

if { $_core != 0 } {
# non-boot core examination may fail
set _command "$_command -defer-examine"
set _smp_command "$_smp_command $_TARGETNAME_A53.$_core"
} else {
set _smp_command "target smp $_TARGETNAME_A53.$_core"
}

eval $_command
}

eval $_smp_command

for { set _core 0 } { $_core < 2 } { incr _core } {

cti create $_CTINAME_A72.$_core -dap $_CHIPNAME.dap -ap-num 1 \
-ctibase [lindex $CTIBASE_A72 $_core]

set _command "target create $_TARGETNAME_A72.$_core aarch64 -dap $_CHIPNAME.dap \
-dbgbase [lindex $DBGBASE_A72 $_core] -cti $_CTINAME_A72.$_core"

set _smp_command "target smp $_TARGETNAME_A72.$_core"

eval $_command
}

# declare the auxiliary Cortex-M4-0 core on AP #1
target create ${_CHIPNAME}.m4.0 cortex_m -dap ${_CHIPNAME}.dap -ap-num 1

# declare the auxiliary Cortex-M4-1 core on AP #1
target create ${_CHIPNAME}.m4.1 cortex_m -dap ${_CHIPNAME}.dap -ap-num 1

# AHB-AP for direct access to soc bus
target create ${_CHIPNAME}.ahb mem_ap -dap ${_CHIPNAME}.dap -ap-num 0

# default target is A53 core 0
targets $_TARGETNAME_A53.0

adapter_khz 4000

 

I can halt, and step instructions from a Cortex M4 core (with some ugly kernel dumps on the application cores). Still I am not sure what core is this one - it could be the System Controller.

As for aarch64 cores GDB complains:

./aarch64-linux-gnu-gdb.exe

...

Remote debugging using 127.0.0.1:3334
warning: Architecture rejected target-supplied description

 

And there comes questions:

 

1) Is it possible that the TAPID mismatch is a problem ?

and

1a) Is it possible that OpenOCD shows SJC TAP ID instead ?


2) OpenOCD targets listed above may very well be in the wrong order or missing.

Would there be a target for each of the eight cores ?

and

2a) Any idea from where targets proper order might be revealed ?

 

3) The missing CTIBASE and DBGBASE registers are from various forum posts.

Is it possible that the values for M4 and A72 are wrong ?

 

 

Best Regards,

Teodor

Outcomes