macoy
Posts: 20
Joined: Sat Nov 04, 2023 8:53 pm

Raspberry Pi 5 JTAG configuration

Sat Dec 23, 2023 8:02 pm

UPDATE: See my article for complete steps.

Hi,

I have the Adafruit FT232H for JTAG debugging my Pi 4. I got my Pi 5 out and tried plugging it in the same as my 4, but it seems to be behaving differently. Rather than powering on normally, the Pi power LED flashes in sync with the FT232H red LED connected to ACBUS8.

My guess is this is a feature of JTAG where I can have the debugger power on the Pi when I am ready, but I'm not sure. If I unplug power to the FT232H, the Pi starts up normally.

I was wondering if anyone here has an OpenOCD configuration for the Pi 5 for JTAG.

Here is how I have it wired:

Code: Select all

| Function | FT232h Pin |        Pi Pin |       Pi GPIO |
|----------+------------+---------------+---------------|
| TCK      | D0         |            22 |            25 |
| TDI      | D1         |            37 |            26 |
| TDO      | D2         |            18 |            24 |
| TMS      | D3         |            13 |            27 |
| TRST     | D4         |            15 |            22 |
| SRST     | D5         | Not connected | Not connected |
| RTCK     | D7         |            16 |            23 |
| GND      | GND        |            39 |           GND |
Last edited by macoy on Mon Jan 15, 2024 6:48 pm, edited 2 times in total.

trejan
Posts: 7204
Joined: Tue Jul 02, 2019 2:28 pm

Re: Raspberry Pi 5 JTAG configuration

Sat Dec 23, 2023 8:05 pm

It isn't on the GPIO header now. Pi 5 uses SWD on the UART connector for debug. Enable it with enable_jtag_gpio=1

macoy
Posts: 20
Joined: Sat Nov 04, 2023 8:53 pm

Re: Raspberry Pi 5 JTAG configuration

Sat Dec 23, 2023 8:16 pm

Are you saying I put

Code: Select all

enable_jtag_gpio=1
in my config.txt in order to enable SWD, then I wire to the UART connector between the HDMI connectors?
Is there a OpenOCD configuration for this? I would greatly appreciate any more information you might have!

trejan
Posts: 7204
Joined: Tue Jul 02, 2019 2:28 pm

Re: Raspberry Pi 5 JTAG configuration

Sat Dec 23, 2023 8:28 pm

macoy wrote:
Sat Dec 23, 2023 8:16 pm
Are you saying I put

Code: Select all

enable_jtag_gpio=1
in my config.txt in order to enable SWD, then I wire to the UART connector between the HDMI connectors?
Yes but you need to use whatever wiring/config is needed for SWD on your adapter. https://datasheets.raspberrypi.com/debu ... cation.pdf has the pinout for UART and SWD modes.

I used a Pi Debug Probe and the included cable plugs straight in. The cable does need to be moved between the Debug Probe sockets depending on if you want SWD or UART though.
macoy wrote:
Sat Dec 23, 2023 8:16 pm
Is there a OpenOCD configuration for this? I would greatly appreciate any more information you might have!
This is the OpenOCD config I made for BCM2712. I've not extensively tested it. I altered it for SWD and updated the base addresses using the ROM table.

Code: Select all

# SPDX-License-Identifier: GPL-2.0-or-later

# The Broadcom BCM2712 used in Raspberry Pi 5
# No documentation was found on Broadcom website

# Partial information is available in Raspberry Pi website:
# https://www.raspberrypi.com/documentation/computers/processors.html#bcm2712

# v1.0 initial revision - trejan on forums.raspberrypi.com

if { [info exists CHIPNAME] } {
        set  _CHIPNAME $CHIPNAME
} else {
        set  _CHIPNAME bcm2712
}

if { [info exists CHIPCORES] } {
        set _cores $CHIPCORES
} else {
        set _cores 4
}

if { [info exists USE_SMP] } {
        set _USE_SMP $USE_SMP
} else {
        set _USE_SMP 0
}

if { [info exists DAP_TAPID] } {
        set _DAP_TAPID $DAP_TAPID
} else {
        set _DAP_TAPID 0x4ba00477
}

transport select swd

swd newdap $_CHIPNAME cpu -expected-id $_DAP_TAPID -irlen 4
adapter speed 4000

dap create $_CHIPNAME.dap -chain-position $_CHIPNAME.cpu

# MEM-AP for direct access
target create $_CHIPNAME.ap mem_ap -dap $_CHIPNAME.dap -ap-num 0

# these addresses are obtained from the ROM table via 'dap info 0' command
set _DBGBASE {0x80010000 0x80110000 0x80210000 0x80310000}
set _CTIBASE {0x80020000 0x80120000 0x80220000 0x80320000}

set _smp_command "target smp"

for { set _core 0 } { $_core < $_cores } { incr _core } {
        set _CTINAME $_CHIPNAME.cti$_core
        set _TARGETNAME $_CHIPNAME.cpu$_core

        cti create $_CTINAME -dap $_CHIPNAME.dap -ap-num 0 -baseaddr [lindex $_CTIBASE $_core]
        target create $_TARGETNAME aarch64 -dap $_CHIPNAME.dap -ap-num 0 -dbgbase [lindex $_DBGBASE $_core] -cti $_CTINAME

        set _smp_command "$_smp_command $_TARGETNAME"
}

if {$_USE_SMP} {
        eval $_smp_command
}

# default target is cpu0
targets $_CHIPNAME.cpu0

Code: Select all

AP # 0x0
                AP ID register 0x24770002
                Type is MEM-AP APB2 or APB3
MEM-AP BASE 0x80080003
                Valid ROM table present
                Component base address 0x80080000
                Peripheral ID 0x01000bfa97
                Designer is 0x0bf, Broadcom
                Part is 0xa97, Unrecognized 
                Component class is 0x1, ROM table
                MEMTYPE system memory not present: dedicated debug bus
        ROMTABLE[0x0] = 0xfff80003
                Component base address 0x80000000
                Peripheral ID 0x04007bb4e4
                Designer is 0x23b, ARM Ltd
                Part is 0x4e4, Cortex-A76 ROM (ROM Table)
                Component class is 0x9, CoreSight component
                Type is 0x00, Miscellaneous, other
                Dev Arch is 0x47700af7, ARM Ltd "CoreSight ROM architecture" rev.0
                Type is ROM table
                MEMTYPE system memory not present: dedicated debug bus
        [L01] ROMTABLE[0x0] = 0x00010003
                Component base address 0x80010000
                Peripheral ID 0x04005bbd0b
                Designer is 0x23b, ARM Ltd
                Part is 0xd0b, Cortex-A76 Debug (Debug Unit)
                Component class is 0x9, CoreSight component
                Type is 0x15, Debug Logic, Processor
                Dev Arch is 0x47708a15, ARM Ltd "Processor debug architecture (v8.2-A)" rev.0
        [L01] ROMTABLE[0x4] = 0x00020003
                Component base address 0x80020000
                Peripheral ID 0x04007bbd0b
                Designer is 0x23b, ARM Ltd
                Part is 0xd0b, Cortex-A76 Debug (Debug Unit)
                Component class is 0x9, CoreSight component
                Type is 0x14, Debug Control, Trigger Matrix
                Dev Arch is 0x47701a14, ARM Ltd "Cross Trigger Interface (CTI) architecture" rev.0
        [L01] ROMTABLE[0x8] = 0x00030003
                Component base address 0x80030000
                Peripheral ID 0x04005bbd0b
                Designer is 0x23b, ARM Ltd
                Part is 0xd0b, Cortex-A76 Debug (Debug Unit)
                Component class is 0x9, CoreSight component
                Type is 0x16, Performance Monitor, Processor
                Dev Arch is 0x47702a16, ARM Ltd "Processor Performance Monitor (PMU) architecture" rev.0
        [L01] ROMTABLE[0xc] = 0x00040003
                Component base address 0x80040000
                Peripheral ID 0x04005bbd0b
                Designer is 0x23b, ARM Ltd
                Part is 0xd0b, Cortex-A76 Debug (Debug Unit)
                Component class is 0x9, CoreSight component
                Type is 0x13, Trace Source, Processor
                Dev Arch is 0x47724a13, ARM Ltd "Embedded Trace Macrocell (ETM) architecture" rev.2
        [L01] ROMTABLE[0x10] = 0x000c0002
                Component not present
        [L01] ROMTABLE[0x14] = 0x000d0006
                Component not present
        [L01] ROMTABLE[0x18] = 0x000e0006
                Component not present
        [L01] ROMTABLE[0x1c] = 0x00110003
                Component base address 0x80110000
                Peripheral ID 0x04005bbd0b
                Designer is 0x23b, ARM Ltd
                Part is 0xd0b, Cortex-A76 Debug (Debug Unit)
                Component class is 0x9, CoreSight component
                Type is 0x15, Debug Logic, Processor
                Dev Arch is 0x47708a15, ARM Ltd "Processor debug architecture (v8.2-A)" rev.0
        [L01] ROMTABLE[0x20] = 0x00120003
                Component base address 0x80120000
                Peripheral ID 0x04007bbd0b
                Designer is 0x23b, ARM Ltd
                Part is 0xd0b, Cortex-A76 Debug (Debug Unit)
                Component class is 0x9, CoreSight component
                Type is 0x14, Debug Control, Trigger Matrix
                Dev Arch is 0x47701a14, ARM Ltd "Cross Trigger Interface (CTI) architecture" rev.0
        [L01] ROMTABLE[0x24] = 0x00130003
                Component base address 0x80130000
                Peripheral ID 0x04005bbd0b
                Designer is 0x23b, ARM Ltd
                Part is 0xd0b, Cortex-A76 Debug (Debug Unit)
                Component class is 0x9, CoreSight component
                Type is 0x16, Performance Monitor, Processor
                Dev Arch is 0x47702a16, ARM Ltd "Processor Performance Monitor (PMU) architecture" rev.0
        [L01] ROMTABLE[0x28] = 0x00140003
                Component base address 0x80140000
                Peripheral ID 0x04005bbd0b
                Designer is 0x23b, ARM Ltd
                Part is 0xd0b, Cortex-A76 Debug (Debug Unit)
                Component class is 0x9, CoreSight component
                Type is 0x13, Trace Source, Processor
                Dev Arch is 0x47724a13, ARM Ltd "Embedded Trace Macrocell (ETM) architecture" rev.2
        [L01] ROMTABLE[0x2c] = 0x001c0002
                Component not present
        [L01] ROMTABLE[0x30] = 0x00210003
                Component base address 0x80210000
                Peripheral ID 0x04005bbd0b
                Designer is 0x23b, ARM Ltd
                Part is 0xd0b, Cortex-A76 Debug (Debug Unit)
                Component class is 0x9, CoreSight component
                Type is 0x15, Debug Logic, Processor
                Dev Arch is 0x47708a15, ARM Ltd "Processor debug architecture (v8.2-A)" rev.0
        [L01] ROMTABLE[0x34] = 0x00220003
                Component base address 0x80220000
                Peripheral ID 0x04007bbd0b
                Designer is 0x23b, ARM Ltd
                Part is 0xd0b, Cortex-A76 Debug (Debug Unit)
                Component class is 0x9, CoreSight component
                Type is 0x14, Debug Control, Trigger Matrix
                Dev Arch is 0x47701a14, ARM Ltd "Cross Trigger Interface (CTI) architecture" rev.0
        [L01] ROMTABLE[0x38] = 0x00230003
                Component base address 0x80230000
                Peripheral ID 0x04005bbd0b
                Designer is 0x23b, ARM Ltd
                Part is 0xd0b, Cortex-A76 Debug (Debug Unit)
                Component class is 0x9, CoreSight component
                Type is 0x16, Performance Monitor, Processor
                Dev Arch is 0x47702a16, ARM Ltd "Processor Performance Monitor (PMU) architecture" rev.0
        [L01] ROMTABLE[0x3c] = 0x00240003
                Component base address 0x80240000
                Peripheral ID 0x04005bbd0b
                Designer is 0x23b, ARM Ltd
                Part is 0xd0b, Cortex-A76 Debug (Debug Unit)
                Component class is 0x9, CoreSight component
                Type is 0x13, Trace Source, Processor
                Dev Arch is 0x47724a13, ARM Ltd "Embedded Trace Macrocell (ETM) architecture" rev.2
        [L01] ROMTABLE[0x40] = 0x002c0002
                Component not present
        [L01] ROMTABLE[0x44] = 0x00310003
                Component base address 0x80310000
                Peripheral ID 0x04005bbd0b
                Designer is 0x23b, ARM Ltd
                Part is 0xd0b, Cortex-A76 Debug (Debug Unit)
                Component class is 0x9, CoreSight component
                Type is 0x15, Debug Logic, Processor
                Dev Arch is 0x47708a15, ARM Ltd "Processor debug architecture (v8.2-A)" rev.0
        [L01] ROMTABLE[0x48] = 0x00320003
                Component base address 0x80320000
                Peripheral ID 0x04007bbd0b
                Designer is 0x23b, ARM Ltd
                Part is 0xd0b, Cortex-A76 Debug (Debug Unit)
                Component class is 0x9, CoreSight component
                Type is 0x14, Debug Control, Trigger Matrix
                Dev Arch is 0x47701a14, ARM Ltd "Cross Trigger Interface (CTI) architecture" rev.0
        [L01] ROMTABLE[0x4c] = 0x00330003
                Component base address 0x80330000
                Peripheral ID 0x04005bbd0b
                Designer is 0x23b, ARM Ltd
                Part is 0xd0b, Cortex-A76 Debug (Debug Unit)
                Component class is 0x9, CoreSight component
                Type is 0x16, Performance Monitor, Processor
                Dev Arch is 0x47702a16, ARM Ltd "Processor Performance Monitor (PMU) architecture" rev.0
        [L01] ROMTABLE[0x50] = 0x00340003
                Component base address 0x80340000
                Peripheral ID 0x04005bbd0b
                Designer is 0x23b, ARM Ltd
                Part is 0xd0b, Cortex-A76 Debug (Debug Unit)
                Component class is 0x9, CoreSight component
                Type is 0x13, Trace Source, Processor
                Dev Arch is 0x47724a13, ARM Ltd "Embedded Trace Macrocell (ETM) architecture" rev.2
        [L01] ROMTABLE[0x54] = 0x003c0002
                Component not present
        [L01] ROMTABLE[0x58] = 0x00000000
        [L01]   End of ROM table
        ROMTABLE[0x4] = 0x00000000
                End of ROM table

macoy
Posts: 20
Joined: Sat Nov 04, 2023 8:53 pm

Re: Raspberry Pi 5 JTAG configuration

Sun Dec 24, 2023 4:14 pm

Thank you! I will try this once I get a cable for the UART connector.

macoy
Posts: 20
Joined: Sat Nov 04, 2023 8:53 pm

Re: Raspberry Pi 5 JTAG configuration

Mon Jan 15, 2024 6:48 pm

I got it working. I wrote an article to combine all the needed steps to get debugging on both the 4 and 5. Thanks!

cleverca22
Posts: 8824
Joined: Sat Aug 18, 2012 2:33 pm

Re: Raspberry Pi 5 JTAG configuration

Mon Jan 15, 2024 7:31 pm

2 other details that may be useful:

https://github.com/raspberrypi/openocd/issues/93

Code: Select all

adapter driver linuxgpiod
adapter gpio swclk 20 -chip 4
adapter gpio swdio 21 -chip 4
with this, openocd can use the gpiod interface to bit-bang SWD, in this case for targeting the pico, from the main gpio array

however, given that the debug header can mux between uart and a76-swd
i would assume the debug header is just normal gpio on the bcm2712 itself
if we can find those pin numbers, then you can just substitute it into the openocd config
swd is just gpio, so it can deal with a simple JST link between a pair of 5's or even a pi5 and pico

but uart wont work, it would be tx<->tx, and would need a null-modem jst cable

trejan
Posts: 7204
Joined: Tue Jul 02, 2019 2:28 pm

Re: Raspberry Pi 5 JTAG configuration

Tue Jan 16, 2024 1:53 am

cleverca22 wrote:
Mon Jan 15, 2024 7:31 pm
however, given that the debug header can mux between uart and a76-swd
i would assume the debug header is just normal gpio on the bcm2712 itself
It is on the BCM2712 but its not the old GPIO peripheral. It is connected to the new always-on GPIO peripheral at 107d517c00. It uses the same brcmstb GPIO driver.

Code: Select all

        line   0:    "RP1_SDA"       unused   input  active-high 
        line   1:    "RP1_SCL"       unused   input  active-high 
        line   2:    "RP1_RUN" "RP1 RUN pin" output active-high [used]
        line   3: "SD_IOVDD_SEL" "vdd-sd-io" output active-high [used]
        line   4:  "SD_PWR_ON" "sd_vcc_reg"  output  active-high [used]
        line   5:  "SD_CDET_N"       unused   input  active-high 
        line   6:   "SD_FLG_N"       unused   input  active-high 
        line   7:          "-"       unused   input  active-high 
        line   8:  "2712_WAKE"       unused   input  active-high 
        line   9: "2712_STAT_LED" "ACT" output active-low [used]
        line  10:          "-"       unused   input  active-high 
        line  11:          "-"       unused   input  active-high 
        line  12:   "PMIC_INT"       unused   input  active-high 
        line  13: "UART_TX_FS"       unused   input  active-high 
        line  14: "UART_RX_FS"       unused   input  active-high 
        line  15:          "-"       unused   input  active-high 
        line  16:          "-"       unused   input  active-high

cleverca22
Posts: 8824
Joined: Sat Aug 18, 2012 2:33 pm

Re: Raspberry Pi 5 JTAG configuration

Tue Jan 16, 2024 2:27 am

trejan wrote:
Tue Jan 16, 2024 1:53 am
It is on the BCM2712 but its not the old GPIO peripheral. It is connected to the new always-on GPIO peripheral at 107d517c00. It uses the same brcmstb GPIO driver.
ah, i was thinking thats what the aon meant
i also see that you have rp1_run, and 2712_WAKE listed in that block

and there is also a 2712_WAKE on the RP1's gpio


i suspect that the 2712 can go into a suspend2ram state
but the always-on gpio, will remain on, and the RP1_RUN state persists, so the RP1 can stay up
and the RP1 can wiggle 2712_WAKE to wake the 2712 back up

from what i can see, the RP1 firmware could possibly also drive the ethernet, so wake-on-lan might be possible

Return to “Bare metal, Assembly language”