6.1 KiB
JTAG boards:
- RasPi3
- Segger J-Link V9
- TinCanTools Flyswatter
- OpenMoko DebugBoard_v3 - one i have
RPi3 to RPi3 jtag
Helpful RPi3 GPIO header pinouts from element14 for Model B and here for Model B+ (which is the same).
Host configuration:
These are regular GPIO functions, which we specify in OpenOCD interface configuration to enable driving JTAG interface.
FUNC | GPIO | PIN #
------+--------+-------
TCK | GPIO11 | 23
TMS | GPIO25 | 22
TDI | GPIO10 | 19
TDO | GPIO9 | 21
TRST* | GPIO7 | 26
GND | GND | 20
RPi doesn't expose SRST so we ignore it.
Target configuration:
These are real JTAG pins of bcm2837, enabled on target RPi via config.txt options (see below).
FUNC | GPIO | PIN # | MODE
------+--------+---------+------
TCK | GPIO25 | 22 | Alt4
TMS | GPIO27 | 13 | Alt4
TDI | GPIO26 | 37 | Alt4
TDO | GPIO24 | 18 | Alt4
TRST | GPIO22 | 15 | Alt4
RTCK | GPIO23 | 16 | Alt4
GND | GND | 20 |
Connecting TDI to pin 7 (GPIO4) did not work!
Source (section 6.2 Alternative Function Assignments)
In config.txt:
# Set GPIO pins for JTAG debugger connection on rpi3
gpio=22-27=a4
Alternatively, just specify @todo - verify this works with all alt4 pins
enable_jtag_gpio=1
Connection between boards
Func | Host Pin | Wire color | Target pin
-----+----------+------------+-----------
TCK | 23 | yellow | 22
TMS | 22 | brown | 13
TDI | 19 | green | 37
TDO | 21 | orange | 18
TRST | 26 | red | 15
GND | 20 | black | 20
OpenOCD configuration on the host
You need two files: interface file for driving the host GPIO correctly, and target file for detecting the JTAG circuitry on the target RPi.
Interface configuration: rpi3_interface.cfg
Source, source #2 - rpi3 speed_coeffs
Target configuration: rpi3_target.cfg
Source #1, source #2, source #3, source #4, source #5, source #6 - proper rpi3 ocd config, source #7 - simpler rpi3 ocd config, source #8 - explanations about SRST, source #9 - example RPi target config, source #10 - some JTAG debug hints on rpi, source #11 - jtag vs swd and CoreSight info links
If an SoC provides a JTAG debug interface and contains any CoreSight debug components (including any Cortex processor) you should expect to see the standard JTAG IDCODE of a single CoreSight SWJ-DP as one TAP on the JTAG chain.
Run OpenOCD, GDB and attach to target
Need to verify if the following bug is still valid:
There is a bug in OpenOCD that will prevent Raspberry PI from continuing correctly after a stop unless the initialization is done twice. Close OpenOCD with Ctrl-C and re-run it again. Now the debugging will be usable.
Run openocd -f rpi3_interface.cfg -f rpi3_target.cfg
Run gdb kernel.elf and connect to device:
target remote :5555
x/10i $pc
stepi
x/2i $pc
If stepi command causes CPU to make one instruction step, everything is working.
Source, source #2, source #3 - monitor reset halt
I got RPi3-to-RPi3 JTAG working and even debugged a bit directly on the CPU, but a few things impeded my happiness:
- RPi is a bit too slow for bitbanging and oftentimes opening a browser window, or running some other command caused OpenOCD to spew JTAG synchronization errors.
- To properly debug my kernel from RPi I would need to compile it locally (otherwise all the paths in the debug info are wrong and GDB will not find the source files, I did not want to mess around with symlinks).
Fortunately, at this point a Segger J-Link 9 arrived and I went to use it.
J-Link to RPi3 jtag
https://www.segger.com/downloads/jlink/ https://habr.com/ru/post/259205/
JTAG pinout on segger is in UM08001_JLink.pdf distributed with the J-Link software kit, in section 17.1.1.
This adds VTref for target voltage detection.
Pinout:
J-Link and connection to Raspi3:
Func | J-Link Pin | Wire color | Target pin
------+--------------+-------------+-----------
VTref | 1 | white | 1
TCK | 9 | yellow | 22
TMS | 7 | brown | 13
TDI | 5 | green | 37
TDO | 13 | orange | 18
nTRST | 3 | red | 15
RTCK | 11 | magenta | 16
GND | 4 | black | 20
Rebuild openocd from git and voila, it works with
openocd -f interface/jlink.cfg -f rpi3_jtag.cfg