Cortex M55/adiv6 support

[dragonmux]

Discussed in #1969

^{Originally posted by florg-32 October 18, 2024}
Hey guys,

I have a Cortex M55 chip I'd like to debug with my BMP. Should this be supported already (on nightly builds)?

My gdb monitor jtag_scan does not find the device, voltage is detected correctly though and resetting works. The debug app outputs the following, which I don't really understand; shouldn't it be ADIv6?

❯ blackmagic -tjv8
Black Magic Debug App d896778
 for Black Magic Probe, ST-Link v2 and v3, CMSIS-DAP, J-Link and FTDI (MPSSE)
Using 1d50:6018 81D749A3 Black Magic Debug
 Black Magic Probe d896778
Running in Test Mode
Target voltage: 1.8V
Speed set to 1.951MHz for JTAG
Resetting TAP
Change state to Shift-DR
Scanning out ID codes
Return to Run-Test/Idle
Change state to Shift-IR
Scanning out IRs
Return to Run-Test/Idle
Change state to Shift-DR
Return to Run-Test/Idle
ID code 0x4ba06477: ADIv5 JTAG-DP port.
Abort: 00000004
Failed to read DPIDR
Given target number 1 not available max 0

Thanks,
Florian

[dragonmux]

Following on from the discussion, could we please have you re-run your JTAG scan with a higher verbosity level - 8 only turns on PROTO diagnostics which isn't especially useful here unfortunately. For this we're going to need INFO + TARGET + PROBE, which is (1 + 4 + 16) or in other words, 21 for blackmagic -tjv 21. Hopefully that provides some more information on what actually came back from trying to do that DPIDR read and gives much needed additional information for interpreting the spec and part behaviour.

[florg-32]

There you go

❯ blackmagic -tjv21
Black Magic Debug App d896778
 for Black Magic Probe, ST-Link v2 and v3, CMSIS-DAP, J-Link and FTDI (MPSSE)
Using 1d50:6018 81D749A3 Black Magic Debug
 Black Magic Probe d896778
Remote is Black Magic Probe d896778
Running in Test Mode
Target voltage: 1.8V
Speed set to 1.951MHz for JTAG
Resetting TAP
remote_jtag_init
Change state to Shift-DR
Scanning out ID codes
Return to Run-Test/Idle
Change state to Shift-IR
Scanning out IRs
Return to Run-Test/Idle
Change state to Shift-DR
Return to Run-Test/Idle
ID code 0x4ba06477: ADIv5 JTAG-DP port.
Enumerated 1 devices
0: IR length = 4, ID 4ba06477
-> IR prescan: 0, postscan: 0
-> DR prescan: 0, postscan: 0
Failed to read DPIDR
Given target number 1 not available max 0

---

The SWD scan fails as well unfortunately

❯ blackmagic -tv21
Black Magic Debug App d896778
 for Black Magic Probe, ST-Link v2 and v3, CMSIS-DAP, J-Link and FTDI (MPSSE)
Using 1d50:6018 81D749A3 Black Magic Debug
 Black Magic Probe d896778
Remote is Black Magic Probe d896778
Running in Test Mode
Target voltage: 1.8V
Speed set to 1.951MHz for SWD
remote_swd_init
Switching out of dormant state into SWD
remote_v0_swd_seq_out 32 clock_cycles: ffffffff
remote_v0_swd_seq_out 28 clock_cycles: 0fffffff
remote_v0_swd_seq_out 32 clock_cycles: 6209f392
remote_v0_swd_seq_out 32 clock_cycles: 86852d95
remote_v0_swd_seq_out 32 clock_cycles: e3ddafe9
remote_v0_swd_seq_out 32 clock_cycles: 19bc0ea2
remote_v0_swd_seq_out 12 clock_cycles: 000001a0
remote_v0_swd_seq_out 32 clock_cycles: ffffffff
remote_v0_swd_seq_out 32 clock_cycles: 0fffffff
remote_v0_swd_seq_out 8 clock_cycles: 000000a5
remote_v0_swd_seq_in 3 clock_cycles: 00000007
remote_v0_swd_seq_in_parity 32 clock_cycles: ffffffff ERR
remote_v0_swd_seq_out 8 clock_cycles: 00000000
Deprecated JTAG to SWD sequence
remote_v0_swd_seq_out 32 clock_cycles: ffffffff
remote_v0_swd_seq_out 28 clock_cycles: 0fffffff
remote_v0_swd_seq_out 16 clock_cycles: 0000e79e
remote_v0_swd_seq_out 32 clock_cycles: ffffffff
remote_v0_swd_seq_out 32 clock_cycles: 0fffffff
remote_v0_swd_seq_out 8 clock_cycles: 000000a5
remote_v0_swd_seq_in 3 clock_cycles: 00000007
remote_v0_swd_seq_in_parity 32 clock_cycles: ffffffff ERR
remote_v0_swd_seq_out 8 clock_cycles: 00000000
No usable DP found
No target found

[dragonmux]

Ack, the SWD side might well need #1959 to work then if this part implements dormant state. We'll try and get that PR reviewed today to check it's inserting a fully correct JTAG -> DS sequence and that it runs through the JTAG-or-SWD state machine correctly.

With regards to the JTAG side of this, that didn't produce as much output as we were expecting, so could you please crank the debug output further to -v 45 (ie blackmagic -tjv 45)? This should detail the exact DPIDR traffic that got generated. Unfortunately it will also make the JTAG chain scan very verbose.

[florg-32]

Next try ;)

blackmagic -tjv 45

Black Magic Debug App d896778
 for Black Magic Probe, ST-Link v2 and v3, CMSIS-DAP, J-Link and FTDI (MPSSE)
Using 1d50:6018 81D749A3 Black Magic Debug
 Black Magic Probe d896778
+#!GA#
       KBlack Magic Probe d896778
!HC#
       K4
!HA#
       K9
!GP0#
       K0
!GZ0#
       K0
Running in Test Mode
 !GV#
       K1.8V
Target voltage: 1.8V
!GF003d0900#
       K0
!Gf#
       KD9C81D00
Speed set to 1.951MHz for JTAG
Resetting TAP
+#!JS#
       K0
+#!JR#
       K0
Change state to Shift-DR
!JT031#
       K0
Scanning out ID codes
!Jd20ffffffff#
       K4BA06477
!Jd20ffffffff#
       KFFFFFFFF
Return to Run-Test/Idle
!JN11#
       K1
!JT021#
       K0
Change state to Shift-IR
!JT043#
       K0
Scanning out IRs
!JN01#
       K1
!JN01#
       K0
!JN01#
       K0
!JN01#
       K0
!JN01#
       K1
!JN01#
       K1
Return to Run-Test/Idle
!JN11#
       K1
!JT021#
       K0
Change state to Shift-DR
!JT031#
       K0
!JN01#
       K0
!JN01#
       K1
Return to Run-Test/Idle
!JN11#
       K1
!JT021#
       K0
!HJ000000040000ffffffff#
       K0
ID code 0x4ba06477: ADIv5 JTAG-DP port.
Abort: 00000004
!JT043#
       K0
!JD048#
       K1
!JT021#
       K0
!JT031#
       K0
!Jd2020#
       K4
!JD030#
       K0
!JT021#
       K0
!AR0001000000000000#
       E104
Failed to read DPIDR
Given target number 1 not available max 0

I'll give #1959 a try tomorrow as well.

Thanks, I really appreciate the effort!

[dragonmux]

Thank you very much! We'll dig into the logs in a bit and go decoding E104 (in before this turns out we need to do dormant-to-JTAG sequences or something) and use this information to really dig into the ADIv6 spec sections on JTAG DP's. We'll update this issue to let you know how we're getting on and you'll probably see a new branch created aimed at fixing this.

[dragonmux]

Okay, so - it turns out that we were correct to think there would need to be some low-level changes for ADIv6 JTAG - they split out the OK/FAULT codes for the ACK and BMD is interpreting the OK ACK code as an invalid ACK here. Hence E104 which is indicating the firmware threw an exception in response. A fix for that is now available on feature/adiv6-jtag-support though we are certain that branch will not work correctly yet as we didn't yet get past the low-level aspects. Hopefully it get significantly further though. You will need to upgrade your probe's firmware for this to work.

[florg-32]

Here are the logs from feature/adiv6-jtag-support, looks quite the same unfortunately.

build/blackmagic -tjv45

Black Magic Debug App v1.10.0-1366-g9c69fbd8
 for Black Magic Probe, ST-Link v2 and v3, CMSIS-DAP, J-Link and FTDI (MPSSE)
Using 1d50:6018 81D749A3 Black Magic Debug
 Black Magic Probe v1.10.0-1366-g9c69fbd8
+#!GA#
       KBlack Magic Probe v1.10.0-1366-g9c69fbd8
!HC#
       K4
!HA#
       K9
!GP0#
       K0
!GZ0#
       K0
Running in Test Mode
 !GV#
       K1.8V
Target voltage: 1.8V
!GF003d0900#
       K0
!Gf#
       KD9C81D00
Speed set to 1.951MHz for JTAG
Resetting TAP
+#!JS#
       K0
+#!JR#
       K0
Change state to Shift-DR
!JT031#
       K0
Scanning out ID codes
!Jd20ffffffff#
       K4BA06477
!Jd20ffffffff#
       KFFFFFFFF
Return to Run-Test/Idle
!JN11#
       K1
!JT021#
       K0
Change state to Shift-IR
!JT043#
       K0
Scanning out IRs
!JN01#
       K1
!JN01#
       K0
!JN01#
       K0
!JN01#
       K0
!JN01#
       K1
!JN01#
       K1
Return to Run-Test/Idle
!JN11#
       K1
!JT021#
       K0
Change state to Shift-DR
!JT031#
       K0
!JN01#
       K0
!JN01#
       K1
Return to Run-Test/Idle
!JN11#
       K1
!JT021#
       K0
!HJ000000040000ffffffff#
       K0
ID code 0x4ba06477: ADIv5 JTAG-DP port.
Abort: 00000004
!JT043#
       K0
!JD048#
       K1
!JT021#
       K0
!JT031#
       K0
!Jd2020#
       K4
!JD030#
       K0
!JT021#
       K0
!AR0001000000000000#
       E104
Failed to read DPIDR
Given target number 1 not available max 0

[dragonmux]

Interesting.. given that's still using the high-level API to drive what it's doing, could we please ask you to pass -H to BMDA as well as in blackmagic -Htjv 45 please? This will use only the JTAG remote protocol directly and not the ADI acceleration protocol, which might well show why DPIDR is reading badly.

Edit: Turns out that in trying to correct the missing ACK handling, we broke a core part of adiv5_jtag_raw_access() - we have just pushed a fix for this to the branch along with the SWD->DS->JTAG sequence logic to make things work if the device implements Dormant State.

[florg-32]

Next try

./build/blackmagic -Htjv 45

Black Magic Debug App v1.10.0-1370-g51ddc057
 for Black Magic Probe, ST-Link v2 and v3, CMSIS-DAP, J-Link and FTDI (MPSSE)
Using 1d50:6018 81D749A3 Black Magic Debug
 Black Magic Probe v1.10.0-1370-g51ddc057
+#!GA#
       KBlack Magic Probe v1.10.0-1370-g51ddc057
!HC#
       K4
!HA#
       K9
!GP0#
       K0
!GZ0#
       K0
Running in Test Mode
 !GV#
       K1.8V
Target voltage: 1.8V
!GF003d0900#
       K0
!Gf#
       KD9C81D00
Speed set to 1.951MHz for JTAG
Resetting TAP
+#!JS#
       K0
+#!JR#
       K0
Change state to Shift-DR
!JT031#
       K0
Scanning out ID codes
!Jd20ffffffff#
       K4BA06477
!Jd20ffffffff#
       KFFFFFFFF
Return to Run-Test/Idle
!JN11#
       K1
!JT021#
       K0
Change state to Shift-IR
!JT043#
       K0
Scanning out IRs
!JN01#
       K1
!JN01#
       K0
!JN01#
       K0
!JN01#
       K0
!JN01#
       K1
!JN01#
       K1
Return to Run-Test/Idle
!JN11#
       K1
!JT021#
       K0
Change state to Shift-DR
!JT031#
       K0
!JN01#
       K0
!JN01#
       K1
Return to Run-Test/Idle
!JN11#
       K1
!JT021#
       K0
!HJ000000040000ffffffff#
       K0
ID code 0x4ba06477: ADIv5 JTAG-DP port.
Abort: 00000004
!JT043#
       K0
!JD048#
       K1
!JT021#
       K0
!JT031#
       K0
!Jd2020#
       K4
!JD030#
       K0
!JT021#
       K0
Not using ADIv5 acceleration commands
!JT043#
       K0
!JD04a#
       K1
!JT021#
       K0
!JT031#
       K0
!Jd201#
       K4
!JD030#
       K0
!JT021#
       K0
!Jc0000000008#
       K0
Read DPIDR: 0x00000000
Failed to read DPIDR
Given target number 1 not available max 0

[dragonmux]

Thank you for the update and re-try - there's something really odd going on here which looks like it's going to take some additional debugging to figure out. If we decode the DPIDR request-response cycle, we get this as the result:

!JT043# ; 4 cycles, TMS sequence, 0x3 -> Idle -> Select-DR -> Select-IR -> Capture-IR -> Shift-IR
       K0
!JD04a# ; 4 cycles, TDI-TDO w/ final TMS high, 0xa (DPACC), Shift-IR -> Exit1-IR
       K1
!JT021# ; 2 cycles, TMS sequence, 0x1 -> Exit1-IR -> Update-IR -> Idle
       K0
!JT031# ; 3 cycles, TMS sequence, 0x1 -> Idle -> Select-DR -> Capture-DR -> Shift-DR
       K0
!Jd201# ; 32 cycles, TDI-TDO w/ final TMS low, 0x00000001, Shift-DR
       K4 ; Result: 0x00000004
!JD030# ; 3 cycles, TDI-TDO w/ final TMS high, 0x0, Shift-DR -> Exit1-DR
       K0 ; Result: 0x0
!JT021# ; 2 cycles, TMS sequence, 0x1 -> Exit1-DR -> Update-DR -> Idle
       K0
!Jc0000000008# ; 8 cycles, TDI low, TMS low -> Idle * 8
       K0

DPIDR should be reading something more like 0x4ba03477 for this part, not 0x00000004. That ack value of 0 is also very off
We're going to make an adjustment that causes the firmware to write SELECT before the DPIDR request in case there's some whacky state in the DP, noting that line reset / JTAG reset does not reset the DP state.

Edit: Ah, part of the PDIDR read routine assumes SWD right now, which means the RDBUFF read to actually get the response to the request is never done.. fixing that too.

[dragonmux]

We have just pushed a couple of changes to the branch that follow up on SELECT's value being questionable before the read, and the DPIDR read assuming SWD. We've tested it as best we can on the parts we have here, and it appears like it is working better (LPC4370 has a couple of JTAG-DP's that have IDCode 0x0ba01477 and when we remove the errata workaround for those, their DPIDR's read out a semi-sensical value of 0x0bb11477 now which is considerably better behaviour than before).

[florg-32]

blackmagic -Htjv45

blackmagic -Htv45

blackmagic -Hjtv16

Now we're getting somewhere, output is to large to paste as text ;)