Radxa Zero and JTAG

#1

Hi,

I’ve been trying to write bare metal code for the Radxa Zero and rather quickly realized that JTAG would be very beneficial. I looked at the schematics and saw that JTAG_B is exposed via the SD card slot.

So I wired up and connected an Olimex ARM-USB-OCD:
TDO -> SDCARD_D0 aka GPIOC_0
TDI -> SDCARD_D1 aka GPIOC_1
TCK -> SDCARD_CLK aka GPIOC_4
TMS -> SDCARD_CMD aka GPIOC_5

I used the datasheet of S905X3 to figure out what registers are available controlling the gpio pins, as I couldn’t find the complete datasheet for S905Y2. Most things seem to match the S905Y2. This way I managed to select functions, output enable, output, input, pull-up/down enable of each GPIO pin. This I’ve used so far to write to/read from UART and GPIO pins.

I selected function 2 on these pins (writing 0x00221122 to 0xFF6346E4, aka PERIPHS_PIN_MUX_9, aka 0xff634400+0xb9*4) then I also made sure that TDO, TDI and TMS were pull-up while TCK was pull-down (writing 0x000000ff to 0xFF634524, aka PAD_PULL_UP_EN_REG1, aka 0xff634400+0x49*4, and 0x000000ef to 0xFF6344EC, aka PAD_PULL_UP_REG1).

Then I’ve been attempting to connect with OpenOCD in many different configurations, either assuming a TAP of 0x5ba00477 (used in another openocd config for a S905-based SBC I found online) or 0x4ba00477 (same as RPi3), or attempting to have OpenOCD autoprobe the TAP, all ending with this error message:

Error: JTAG scan chain interrogation failed: all ones

Connecting an oscilloscope, TMS, TCK and TDI all have activity when I attempt to connect via OpenOCD, but as the above error suggests, there is absolutely no activity on TDO.

Any suggestions on what more to try, or anything obvious I’m doing wrong?

I’ve used the same JTAG debugger to successfully connect to an RPi3. One interesting note about that is that for the RPi3 it’s been necessary to tell OpenOCD to use TRST using “reset_config trst_only”, otherwise it fails to connect in the same way as with the Radxa Zero. I haven’t seen TRST be available anywhere on the Radxa Zero, is that correct?

#2

No success yet, but I found something interesting. There’s a so-called Secure Monitor Call for enabling JTAG. Here’s some info:


https://elixir.bootlin.com/arm-trusted-firmware/latest/source/plat/amlogic/common/aml_scpi.c#L91

Invoking SMC 0x82000040 with 2 as argument in x1 produces:

WARNING! efuse bits is disabled
Enable A53 JTAG

My hope is that this would manipulate the registers in the secure JTAG registers somehow, AO_SEC_JTAG_SP_CNTL etc as described in the S905X3 datasheet. It at least seems to activate the JTAG_A pinmuxes. I want JTAG_B as that’s what’s exposed on the SD card pins, so I disabled JTAG_A in the pinmux reg afterwards and made sure JTAG_B was enabled. Unfortunately, this didn’t make JTAG_B work.

In addition to enabling AO M3 (x1=0) and AO A53 (x1=2) JTAG, the SMC API enables you to enable the AO M4 JTAG with x1=8. Neat. It doesn’t allow you to enable JTAG in the EE domain, for example with x1=1:

Enable JTAGPIN Sel Not Support: 1
WARNING! efuse bits is disabled
Enable M3 JTAG

This also doesn’t enable any JTAG pinmux, while the calls that seem “successful” (x1=0, x1=2, x1=8) enable JTAG_A in 0xff800014 and 0xff800018. Probably this doesn’t work as there seems to be no JTAG connected to the EE domain on the S905Y2, bot JTAG_A and JTAG_B seem to be in the AO domain.

Not sure what the “efuse bits is disabled” warning means, in the worst case that could perhaps mean that JTAG is disabled with the efuses described in the schema on page 1063 in the S905X3 datasheet.

I experimented with different values to x1 when invoking SMC 0x82000040, thinking that perhaps some bit would select between JTAG_A and JTAG_B, but no success so far.

I also tried modifying trusted-firmware-a, compiling and replacing bl31.img in u-boot to try to access AO_SEC_JTAG_SP_CNTL from EL3, but it doesn’t seem to be accessible from there either. I’m not very familiar with ARM, probably it would require some kind of secure mode as suggested by the name of the register. It would also be possible that the register addresses differ in this regard between S905Y2 and S905X3, the S905X3 has an A55 instead of an A53.

#3

I figured out how to enable JTAG_B. AO_SEC_JTAG_SCP_CNTL is the key, and it is not accessible on the main A53 CPU, you need to write it on the M3 CPU. You need to patch bl30.bin, see the code and instructions at https://github.com/alexandertoresson/radxa-fip-zero-jtag .

In addition, as described, you need to call the SMC to enabled JTAG for A53 and set the correct pin mux functions in PERIPHS_PIN_MUX_9.