AnsweredAssumed Answered

Issues using JTAG and SJC on the i.MX RT1020 EVK

Question asked by Henrique Nogueira on Sep 4, 2019
Latest reply on Sep 19, 2019 by Kerry Zhou

Hi!

 

My main goal is to test out the secure JTAG features with the i.MX RT1020 EVK board. I'm currently using the JLink Base debugging probe with the 20 pin JTAG connector, and I also disconnected the J28 and J27 jumpers.

I started by setting the 
DAP_SJC_SWD_SEL fuse (0x460[19]) to set the debug access port (DAP) to JTAG mode, and keeping the JTAG_MOD line pulled down as default. After that, the JTAG interface appeared not to work until I reduced the interface speed by a lot (around 200kHz).

This is what I get when I try to connect using Jlink.exe at different speeds:

 

at 4000 kHz (./jlink.exe -device MIMXRT1021DAG5A -if JTAG -speed 4000 -autoconnect 1 -JTAGConf -1,-1)


Connecting to target via JTAG
TotalIRLen = ?, IRPrint = 0x..FFFFFFFFFFFFFF80000003FF
TotalIRLen = ?, IRPrint = 0x..FFFFFFFFFFFFFF80000003FF
TotalIRLen = ?, IRPrint = 0x..FFFFFFFFFFFFFF000000007F
TotalIRLen = ?, IRPrint = 0x..FFFFFFFFFFFFFF80000003FF
Cannot connect to target.

 

at 400kHz (./jlink.exe -device MIMXRT1021DAG5A -if JTAG -speed 400 -autoconnect 1 -JTAGConf -1,-1)

   

Connecting to target via JTAG
TotalIRLen = 4, IRPrint = 0x03
JTAG chain detection found 1 devices:
#0 Id: 0x0FA024FF, IRLen: 04, Unknown device
TotalIRLen = 4, IRPrint = 0x03
JTAG chain detection found 1 devices:
#0 Id: 0x0FA024FF, IRLen: 04, Unknown device

****** Error: CPU-TAP not found in JTAG chain

TotalIRLen = 4, IRPrint = 0x03
JTAG chain detection found 1 devices:
#0 Id: 0x0FA024FF, IRLen: 04, Unknown device
TotalIRLen = 4, IRPrint = 0x03
JTAG chain detection found 1 devices:
#0 Id: 0x0FA024FF, IRLen: 04, Unknown device

****** Error: CPU-TAP not found in JTAG chain

Cannot connect to target.

 

at 100kHz (./jlink.exe -device MIMXRT1021DAG5A -if JTAG -speed 100 -autoconnect 1 -JTAGConf -1,-1)

 

Connecting to target via JTAG
TotalIRLen = 4, IRPrint = 0x01
JTAG chain detection found 1 devices:
#0 Id: 0x0BA02477, IRLen: 04, CoreSight JTAG-DP
Scanning AP map to find all available APs
AP[1]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x04770041)
Iterating through AP map to find AHB-AP to use
AP[0]: Core found
AP[0]: AHB-AP ROM base: 0xE00FD000
CPUID register: 0x411FC271. Implementer code: 0x41 (ARM)
Found Cortex-M7 r1p1, Little endian.
FPUnit: 8 code (BP) slots and 0 literal slots
CoreSight components:
ROMTbl[0] @ E00FD000
ROMTbl[0][0]: E00FE000, CID: B105100D, PID: 000BB4C8 ROM Table
ROMTbl[1] @ E00FE000
ROMTbl[1][0]: E00FF000, CID: B105100D, PID: 000BB4C7 ROM Table
ROMTbl[2] @ E00FF000
ROMTbl[2][0]: E000E000, CID: B105E00D, PID: 000BB00C SCS-M7
ROMTbl[2][1]: E0001000, CID: B105E00D, PID: 000BB002 DWT
ROMTbl[2][2]: E0002000, CID: B105E00D, PID: 000BB00E FPB-M7
ROMTbl[2][3]: E0000000, CID: B105E00D, PID: 000BB001 ITM
ROMTbl[1][1]: E0041000, CID: B105900D, PID: 001BB975 ETM-M7
ROMTbl[1][2]: E0042000, CID: B105900D, PID: 004BB906 CTI
ROMTbl[0][1]: E0040000, CID: B105900D, PID: 000BB9A9 TPIU-M7
ROMTbl[0][2]: E0043000, CID: B105F00D, PID: 001BB101 TSG
Cache: Separate I- and D-cache.
I-Cache L1: 16 KB, 256 Sets, 32 Bytes/Line, 2-Way
D-Cache L1: 16 KB, 128 Sets, 32 Bytes/Line, 4-Way
Cortex-M7 identified.

 

 

However, at lower interface speeds, the debugger is running visibly slow and it's much less effective than SWD used to be. My first question is: does anyone have any idea why JTAG needs to run much slower than the SWD interface on this evk board?

 

Afterwords, I tried testing the secure JTAG features, in particular, the Secure JTAG debug authentication protocol. As mentioned in the application note AN12419, I started by burning the JTAG_SMODE efuses (0x460[23:22]) to 0b01, to set the Secure JTAG mode, and the KTE efuse to 1 (0x460[26]). Then, I ran the jlinkscript mentioned in the application note and everything seems to be working as intended: I run it once to authenticate the device and then use JTAG freely.

 

I would like to try and streamline the approach by running the script directly from the MCUXpresso IDE. For that, I added the authentication script path to my project's "...Debug.Launch" configuration file (at Debugger>Additional Options>Script). Now, when I try to run a debugging session from the IDE, the script is called, I pull the MOD pin high and then low again as indicated by the pop up windows, and I get the following error:

 

Error in final launch sequence
Failed to execute MI command:
-target-select remote localhost:2331

Error message from debugger back end:
Remote replied unexpectedly to 'vMustReplyEmpty': PacketSize=4000;qXfer:memory-map:read-;QStartNoAckMode+;hwbreak+;qXfer:features:read+
Remote replied unexpectedly to 'vMustReplyEmpty': PacketSize=4000;qXfer:memory-map:read-;QStartNoAckMode+;hwbreak+;qXfer:features:read+

 

So the second question is: Any ideas on how to make the automated Jlink authentication script work here?

Thank you all very much for your time

Henrique

Outcomes