Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Debug(SWD/UART/Trace) over SDC2 enabling #309

Open
fxsheep opened this issue Oct 4, 2023 · 3 comments
Open

Debug(SWD/UART/Trace) over SDC2 enabling #309

fxsheep opened this issue Oct 4, 2023 · 3 comments

Comments

@fxsheep
Copy link

fxsheep commented Oct 4, 2023

According to the TRM(lm80-p0436-100_d_snapdragon_410e_apq8016e_tech_reference_manual_revd.pdf, page 3357), msm8916 supports NIDnT(Narrow Interface for Debug and Test) feature, implemented in a QDSD(Qualcomm Debug over SD?) block inside TLMM.

Basically, this means that SWD, UART and Trace signals can be routed to microSD slot. On an unfused device, SWD is especially useful for debugging purposes. This is potentionally quite helpful for people who want to contribute msm8916-mainline and relevant low-level projects, but only have a regular OEM device(which normally doesn't have convenient access to JTAG and UART) that has secure boot disabled.

After some trial and error I found the following procedure work for me:

  • 1.Connect a microSD pinout/extender board to the slot(can be made of PCB, or for situation like wt88047 where slot is blocked by the battery, made of FPC cable).
  • 2.Connect a card into the extender, and remove it later. This step is necessary for Linux/Android kernel on some devices that implement card detect GPIO to enable the SDC2 power domain.
    1. Write 0x3c5 to 0x0119e000(TLMM_QDSD_CONFIG_CTL) , e.g. devmem 0x0119e000 32 0x3c5. (This switches to SWD+UART mode)
    1. Connect a SWD adapter to the pinout board, note that SDC2 has either 2.8V or 1.8V voltage levels, and the adapter Vtref has to support them.
    1. Try to connect to CoreSight/QDSS DAP via openocd or other host tools.

and I've got Debug ROM table via openocd:

> msm8916.dap info 0
AP ID register 0x14770004
	Type is MEM-AP AXI3 or AXI4
MEM-AP BASE 0x00000002
	No ROM table present

> msm8916.dap info 1
AP ID register 0x44770002
	Type is MEM-AP APB2 or APB3
MEM-AP BASE 0x80000000
	ROM table in legacy format
		Component base address 0x80000000
		Peripheral ID 0x00500f0070
		Designer is 0x070, Qualcomm
		Part is 0x070, Unrecognized 
		Component class is 0x1, ROM table
		MEMTYPE system memory not present: dedicated debug bus
	ROMTABLE[0x0] = 0x1003
		Component base address 0x80001000
		Peripheral ID 0x00001f0440
		Designer is 0x070, Qualcomm
		Part is 0x440, Qualcomm QDSS Component v1 (Qualcomm Designed CoreSight Component v1)
		Component class is 0x9, CoreSight component
		Type is 0x04, Debug Control, other
	ROMTABLE[0x4] = 0x2003
		Component base address 0x80002000
		Peripheral ID 0x04001bb962
		Designer is 0x23b, ARM Ltd
		Part is 0x962, CoreSight STM (System Trace Macrocell)
		Component class is 0x9, CoreSight component
		Type is 0x63, Trace Source, Software
	ROMTABLE[0x8] = 0x10003
		Component base address 0x80010000
		Peripheral ID 0x04004bb906
		Designer is 0x23b, ARM Ltd
		Part is 0x906, CoreSight CTI (Cross Trigger)
		Component class is 0x9, CoreSight component
		Type is 0x14, Debug Control, Trigger Matrix
	ROMTABLE[0xc] = 0x11003
		Component base address 0x80011000
		Peripheral ID 0x04004bb906
		Designer is 0x23b, ARM Ltd
		Part is 0x906, CoreSight CTI (Cross Trigger)
		Component class is 0x9, CoreSight component
		Type is 0x14, Debug Control, Trigger Matrix
	ROMTABLE[0x10] = 0x12003
		Component base address 0x80012000
		Peripheral ID 0x04004bb906
		Designer is 0x23b, ARM Ltd
		Part is 0x906, CoreSight CTI (Cross Trigger)
		Component class is 0x9, CoreSight component
		Type is 0x14, Debug Control, Trigger Matrix
	ROMTABLE[0x14] = 0x13003
		Component base address 0x80013000
		Peripheral ID 0x04004bb906
		Designer is 0x23b, ARM Ltd
		Part is 0x906, CoreSight CTI (Cross Trigger)
		Component class is 0x9, CoreSight component
		Type is 0x14, Debug Control, Trigger Matrix
	ROMTABLE[0x18] = 0x14003
		Component base address 0x80014000
		Peripheral ID 0x04004bb906
		Designer is 0x23b, ARM Ltd
		Part is 0x906, CoreSight CTI (Cross Trigger)
		Component class is 0x9, CoreSight component
		Type is 0x14, Debug Control, Trigger Matrix
	ROMTABLE[0x1c] = 0x15003
		Component base address 0x80015000
		Peripheral ID 0x04004bb906
		Designer is 0x23b, ARM Ltd
		Part is 0x906, CoreSight CTI (Cross Trigger)
		Component class is 0x9, CoreSight component
		Type is 0x14, Debug Control, Trigger Matrix
	ROMTABLE[0x20] = 0x16003
		Component base address 0x80016000
		Peripheral ID 0x04004bb906
		Designer is 0x23b, ARM Ltd
		Part is 0x906, CoreSight CTI (Cross Trigger)
		Component class is 0x9, CoreSight component
		Type is 0x14, Debug Control, Trigger Matrix
	ROMTABLE[0x24] = 0x17003
		Component base address 0x80017000
		Peripheral ID 0x04004bb906
		Designer is 0x23b, ARM Ltd
		Part is 0x906, CoreSight CTI (Cross Trigger)
		Component class is 0x9, CoreSight component
		Type is 0x14, Debug Control, Trigger Matrix
	ROMTABLE[0x28] = 0x18003
		Component base address 0x80018000
		Peripheral ID 0x04004bb906
		Designer is 0x23b, ARM Ltd
		Part is 0x906, CoreSight CTI (Cross Trigger)
		Component class is 0x9, CoreSight component
		Type is 0x14, Debug Control, Trigger Matrix
	ROMTABLE[0x2c] = 0x20003
		Component base address 0x80020000
		Peripheral ID 0x04004bb912
		Designer is 0x23b, ARM Ltd
		Part is 0x912, CoreSight TPIU (Trace Port Interface Unit)
		Component class is 0x9, CoreSight component
		Type is 0x11, Trace Sink, Port
	ROMTABLE[0x30] = 0x21003
		Component base address 0x80021000
		Peripheral ID 0x04002bb908
		Designer is 0x23b, ARM Ltd
		Part is 0x908, CoreSight CSTF (Trace Funnel)
		Component class is 0x9, CoreSight component
		Type is 0x12, Trace Link, Funnel, router
	ROMTABLE[0x34] = 0x24003
		Component base address 0x80024000
		Peripheral ID 0x04001bb909
		Designer is 0x23b, ARM Ltd
		Part is 0x909, CoreSight ATBR (Advanced Trace Bus Replicator)
		Component class is 0x9, CoreSight component
		Type is 0x22, Trace Link, Filter
	ROMTABLE[0x38] = 0x25003
		Component base address 0x80025000
		Peripheral ID 0x04001bb961
		Designer is 0x23b, ARM Ltd
		Part is 0x961, CoreSight TMC (Trace Memory Controller)
		Component class is 0x9, CoreSight component
		Type is 0x32, Trace Link, FIFO, buffer
	ROMTABLE[0x3c] = 0x26003
		Component base address 0x80026000
		Peripheral ID 0x04001bb961
		Designer is 0x23b, ARM Ltd
		Part is 0x961, CoreSight TMC (Trace Memory Controller)
		Component class is 0x9, CoreSight component
		Type is 0x21, Trace Sink, Buffer
	ROMTABLE[0x40] = 0x30003
		Component base address 0x80030000
		Invalid CID 0x00000000
	ROMTABLE[0x44] = 0x34003
		Component base address 0x80034000
		Invalid CID 0x00000000
	ROMTABLE[0x48] = 0x35003
		Component base address 0x80035000
		Invalid CID 0x00000000
	ROMTABLE[0x4c] = 0x38003
		Component base address 0x80038000
		Peripheral ID 0x04004bb906
		Designer is 0x23b, ARM Ltd
		Part is 0x906, CoreSight CTI (Cross Trigger)
		Component class is 0x9, CoreSight component
		Type is 0x14, Debug Control, Trigger Matrix
	ROMTABLE[0x50] = 0x3c003
		Component base address 0x8003c000
		Peripheral ID 0x04004bb906
		Designer is 0x23b, ARM Ltd
		Part is 0x906, CoreSight CTI (Cross Trigger)
		Component class is 0x9, CoreSight component
		Type is 0x14, Debug Control, Trigger Matrix
	ROMTABLE[0x54] = 0x40003
		Component base address 0x80040000
		Peripheral ID 0x04000bb4a3
		Designer is 0x23b, ARM Ltd
		Part is 0x4a3, Cortex-A53 ROM (v7 Memory Map ROM Table)
		Component class is 0x1, ROM table
		MEMTYPE system memory not present: dedicated debug bus
	[L01] ROMTABLE[0x0] = 0x10003
		Component base address 0x80050000
		Peripheral ID 0x04000bbd03
		Designer is 0x23b, ARM Ltd
		Part is 0xd03, Cortex-A53 Debug (Debug Unit)
		Component class is 0x9, CoreSight component
		Type is 0x15, Debug Logic, Processor
	[L01] ROMTABLE[0x4] = 0x11003
		Component base address 0x80051000
		Peripheral ID 0x04000bb9d3
		Designer is 0x23b, ARM Ltd
		Part is 0x9d3, Cortex-A53 PMU (Performance Monitor Unit)
		Component class is 0x9, CoreSight component
		Type is 0x16, Performance Monitor, Processor
	[L01] ROMTABLE[0x8] = 0x12003
		Component base address 0x80052000
		Peripheral ID 0x04000bbd03
		Designer is 0x23b, ARM Ltd
		Part is 0xd03, Cortex-A53 Debug (Debug Unit)
		Component class is 0x9, CoreSight component
		Type is 0x15, Debug Logic, Processor
	[L01] ROMTABLE[0xc] = 0x13003
		Component base address 0x80053000
		Peripheral ID 0x04000bb9d3
		Designer is 0x23b, ARM Ltd
		Part is 0x9d3, Cortex-A53 PMU (Performance Monitor Unit)
		Component class is 0x9, CoreSight component
		Type is 0x16, Performance Monitor, Processor
	[L01] ROMTABLE[0x10] = 0x14003
		Component base address 0x80054000
		Peripheral ID 0x04000bbd03
		Designer is 0x23b, ARM Ltd
		Part is 0xd03, Cortex-A53 Debug (Debug Unit)
		Component class is 0x9, CoreSight component
		Type is 0x15, Debug Logic, Processor
	[L01] ROMTABLE[0x14] = 0x15003
		Component base address 0x80055000
		Peripheral ID 0x04000bb9d3
		Designer is 0x23b, ARM Ltd
		Part is 0x9d3, Cortex-A53 PMU (Performance Monitor Unit)
		Component class is 0x9, CoreSight component
		Type is 0x16, Performance Monitor, Processor
	[L01] ROMTABLE[0x18] = 0x16003
		Component base address 0x80056000
		Peripheral ID 0x04000bbd03
		Designer is 0x23b, ARM Ltd
		Part is 0xd03, Cortex-A53 Debug (Debug Unit)
		Component class is 0x9, CoreSight component
		Type is 0x15, Debug Logic, Processor
	[L01] ROMTABLE[0x1c] = 0x17003
		Component base address 0x80057000
		Peripheral ID 0x04000bb9d3
		Designer is 0x23b, ARM Ltd
		Part is 0x9d3, Cortex-A53 PMU (Performance Monitor Unit)
		Component class is 0x9, CoreSight component
		Type is 0x16, Performance Monitor, Processor
	[L01] ROMTABLE[0x20] = 0x18003
		Component base address 0x80058000
		Peripheral ID 0x04000bb9a8
		Designer is 0x23b, ARM Ltd
		Part is 0x9a8, Cortex-A53 CTI (Cross Trigger)
		Component class is 0x9, CoreSight component
		Type is 0x14, Debug Control, Trigger Matrix
	[L01] ROMTABLE[0x24] = 0x19003
		Component base address 0x80059000
		Peripheral ID 0x04000bb9a8
		Designer is 0x23b, ARM Ltd
		Part is 0x9a8, Cortex-A53 CTI (Cross Trigger)
		Component class is 0x9, CoreSight component
		Type is 0x14, Debug Control, Trigger Matrix
	[L01] ROMTABLE[0x28] = 0x1a003
		Component base address 0x8005a000
		Peripheral ID 0x04000bb9a8
		Designer is 0x23b, ARM Ltd
		Part is 0x9a8, Cortex-A53 CTI (Cross Trigger)
		Component class is 0x9, CoreSight component
		Type is 0x14, Debug Control, Trigger Matrix
	[L01] ROMTABLE[0x2c] = 0x1b003
		Component base address 0x8005b000
		Peripheral ID 0x04000bb9a8
		Designer is 0x23b, ARM Ltd
		Part is 0x9a8, Cortex-A53 CTI (Cross Trigger)
		Component class is 0x9, CoreSight component
		Type is 0x14, Debug Control, Trigger Matrix
	[L01] ROMTABLE[0x30] = 0x1c003
		Component base address 0x8005c000
		Peripheral ID 0x04000bb95d
		Designer is 0x23b, ARM Ltd
		Part is 0x95d, Cortex-A53 ETM (Embedded Trace)
		Component class is 0x9, CoreSight component
		Type is 0x13, Trace Source, Processor
	[L01] ROMTABLE[0x34] = 0x1d003
		Component base address 0x8005d000
		Peripheral ID 0x04000bb95d
		Designer is 0x23b, ARM Ltd
		Part is 0x95d, Cortex-A53 ETM (Embedded Trace)
		Component class is 0x9, CoreSight component
		Type is 0x13, Trace Source, Processor
	[L01] ROMTABLE[0x38] = 0x1e003
		Component base address 0x8005e000
		Peripheral ID 0x04000bb95d
		Designer is 0x23b, ARM Ltd
		Part is 0x95d, Cortex-A53 ETM (Embedded Trace)
		Component class is 0x9, CoreSight component
		Type is 0x13, Trace Source, Processor
	[L01] ROMTABLE[0x3c] = 0x1f003
		Component base address 0x8005f000
		Peripheral ID 0x04000bb95d
		Designer is 0x23b, ARM Ltd
		Part is 0x95d, Cortex-A53 ETM (Embedded Trace)
		Component class is 0x9, CoreSight component
		Type is 0x13, Trace Source, Processor
	[L01] ROMTABLE[0x40] = 0x0
	[L01] 	End of ROM table
	ROMTABLE[0x58] = 0x41003
		Component base address 0x80041000
		Peripheral ID 0x04002bb908
		Designer is 0x23b, ARM Ltd
		Part is 0x908, CoreSight CSTF (Trace Funnel)
		Component class is 0x9, CoreSight component
		Type is 0x12, Trace Link, Funnel, router
	ROMTABLE[0x5c] = 0x50003
		Component base address 0x80050000
		Peripheral ID 0x04000bbd03
		Designer is 0x23b, ARM Ltd
		Part is 0xd03, Cortex-A53 Debug (Debug Unit)
		Component class is 0x9, CoreSight component
		Type is 0x15, Debug Logic, Processor
	ROMTABLE[0x60] = 0x51003
		Component base address 0x80051000
		Peripheral ID 0x04000bb9d3
		Designer is 0x23b, ARM Ltd
		Part is 0x9d3, Cortex-A53 PMU (Performance Monitor Unit)
		Component class is 0x9, CoreSight component
		Type is 0x16, Performance Monitor, Processor
	ROMTABLE[0x64] = 0x52003
		Component base address 0x80052000
		Peripheral ID 0x04000bbd03
		Designer is 0x23b, ARM Ltd
		Part is 0xd03, Cortex-A53 Debug (Debug Unit)
		Component class is 0x9, CoreSight component
		Type is 0x15, Debug Logic, Processor
	ROMTABLE[0x68] = 0x53003
		Component base address 0x80053000
		Peripheral ID 0x04000bb9d3
		Designer is 0x23b, ARM Ltd
		Part is 0x9d3, Cortex-A53 PMU (Performance Monitor Unit)
		Component class is 0x9, CoreSight component
		Type is 0x16, Performance Monitor, Processor
	ROMTABLE[0x6c] = 0x54003
		Component base address 0x80054000
		Peripheral ID 0x04000bbd03
		Designer is 0x23b, ARM Ltd
		Part is 0xd03, Cortex-A53 Debug (Debug Unit)
		Component class is 0x9, CoreSight component
		Type is 0x15, Debug Logic, Processor
	ROMTABLE[0x70] = 0x55003
		Component base address 0x80055000
		Peripheral ID 0x04000bb9d3
		Designer is 0x23b, ARM Ltd
		Part is 0x9d3, Cortex-A53 PMU (Performance Monitor Unit)
		Component class is 0x9, CoreSight component
		Type is 0x16, Performance Monitor, Processor
	ROMTABLE[0x74] = 0x56003
		Component base address 0x80056000
		Peripheral ID 0x04000bbd03
		Designer is 0x23b, ARM Ltd
		Part is 0xd03, Cortex-A53 Debug (Debug Unit)
		Component class is 0x9, CoreSight component
		Type is 0x15, Debug Logic, Processor
	ROMTABLE[0x78] = 0x57003
		Component base address 0x80057000
		Peripheral ID 0x04000bb9d3
		Designer is 0x23b, ARM Ltd
		Part is 0x9d3, Cortex-A53 PMU (Performance Monitor Unit)
		Component class is 0x9, CoreSight component
		Type is 0x16, Performance Monitor, Processor
	ROMTABLE[0x7c] = 0x58003
		Component base address 0x80058000
		Peripheral ID 0x04000bb9a8
		Designer is 0x23b, ARM Ltd
		Part is 0x9a8, Cortex-A53 CTI (Cross Trigger)
		Component class is 0x9, CoreSight component
		Type is 0x14, Debug Control, Trigger Matrix
	ROMTABLE[0x80] = 0x59003
		Component base address 0x80059000
		Peripheral ID 0x04000bb9a8
		Designer is 0x23b, ARM Ltd
		Part is 0x9a8, Cortex-A53 CTI (Cross Trigger)
		Component class is 0x9, CoreSight component
		Type is 0x14, Debug Control, Trigger Matrix
	ROMTABLE[0x84] = 0x5a003
		Component base address 0x8005a000
		Peripheral ID 0x04000bb9a8
		Designer is 0x23b, ARM Ltd
		Part is 0x9a8, Cortex-A53 CTI (Cross Trigger)
		Component class is 0x9, CoreSight component
		Type is 0x14, Debug Control, Trigger Matrix
	ROMTABLE[0x88] = 0x5b003
		Component base address 0x8005b000
		Peripheral ID 0x04000bb9a8
		Designer is 0x23b, ARM Ltd
		Part is 0x9a8, Cortex-A53 CTI (Cross Trigger)
		Component class is 0x9, CoreSight component
		Type is 0x14, Debug Control, Trigger Matrix
	ROMTABLE[0x8c] = 0x5c003
		Component base address 0x8005c000
		Peripheral ID 0x04000bb95d
		Designer is 0x23b, ARM Ltd
		Part is 0x95d, Cortex-A53 ETM (Embedded Trace)
		Component class is 0x9, CoreSight component
		Type is 0x13, Trace Source, Processor
	ROMTABLE[0x90] = 0x5d003
		Component base address 0x8005d000
		Peripheral ID 0x04000bb95d
		Designer is 0x23b, ARM Ltd
		Part is 0x95d, Cortex-A53 ETM (Embedded Trace)
		Component class is 0x9, CoreSight component
		Type is 0x13, Trace Source, Processor
	ROMTABLE[0x94] = 0x5e003
		Component base address 0x8005e000
		Peripheral ID 0x04000bb95d
		Designer is 0x23b, ARM Ltd
		Part is 0x95d, Cortex-A53 ETM (Embedded Trace)
		Component class is 0x9, CoreSight component
		Type is 0x13, Trace Source, Processor
	ROMTABLE[0x98] = 0x5f003
		Component base address 0x8005f000
		Peripheral ID 0x04000bb95d
		Designer is 0x23b, ARM Ltd
		Part is 0x95d, Cortex-A53 ETM (Embedded Trace)
		Component class is 0x9, CoreSight component
		Type is 0x13, Trace Source, Processor
	ROMTABLE[0x9c] = 0x68003
		Component base address 0x80068000
		Peripheral ID 0x04002bb908
		Designer is 0x23b, ARM Ltd
		Part is 0x908, CoreSight CSTF (Trace Funnel)
		Component class is 0x9, CoreSight component
		Type is 0x12, Trace Link, Funnel, router
	ROMTABLE[0xa0] = 0x69003
		Component base address 0x80069000
		Peripheral ID 0x04002bb908
		Designer is 0x23b, ARM Ltd
		Part is 0x908, CoreSight CSTF (Trace Funnel)
		Component class is 0x9, CoreSight component
		Type is 0x12, Trace Link, Funnel, router
	ROMTABLE[0xa4] = 0x6c003
		Component base address 0x8006c000
		Peripheral ID 0x00001f0440
		Designer is 0x070, Qualcomm
		Part is 0x440, Qualcomm QDSS Component v1 (Qualcomm Designed CoreSight Component v1)
		Component class is 0x9, CoreSight component
		Type is 0x04, Debug Control, other
	ROMTABLE[0xa8] = 0x6d003
		Component base address 0x8006d000
		Peripheral ID 0x00001f0440
		Designer is 0x070, Qualcomm
		Part is 0x440, Qualcomm QDSS Component v1 (Qualcomm Designed CoreSight Component v1)
		Component class is 0x9, CoreSight component
		Type is 0x04, Debug Control, other
	ROMTABLE[0xac] = 0x0
		End of ROM table

> msm8916.dap info 2
AP ID register 0x24760010
	Type is JTAG-AP

> msm8916.dap info 3
AP ID register 0x24770011
	Type is MEM-AP AHB3
MEM-AP BASE 0xe00ff003
	Valid ROM table present
		Component base address 0xe00ff000
		Peripheral ID 0x04000bb4c3
		Designer is 0x23b, ARM Ltd
		Part is 0x4c3, Cortex-M3 ROM (ROM Table)
		Component class is 0x1, ROM table
		MEMTYPE system memory present on bus
	ROMTABLE[0x0] = 0xfff0f003
		Component base address 0xe000e000
		Peripheral ID 0x04000bb000
		Designer is 0x23b, ARM Ltd
		Part is 0x000, Cortex-M3 SCS (System Control Space)
		Component class is 0xe, Generic IP component
	ROMTABLE[0x4] = 0xfff02003
		Component base address 0xe0001000
		Peripheral ID 0x04003bb002
		Designer is 0x23b, ARM Ltd
		Part is 0x002, Cortex-M3 DWT (Data Watchpoint and Trace)
		Component class is 0xe, Generic IP component
	ROMTABLE[0x8] = 0xfff03003
		Component base address 0xe0002000
		Peripheral ID 0x04002bb003
		Designer is 0x23b, ARM Ltd
		Part is 0x003, Cortex-M3 FPB (Flash Patch and Breakpoint)
		Component class is 0xe, Generic IP component
	ROMTABLE[0xc] = 0xfff01003
		Component base address 0xe0000000
		Peripheral ID 0x04003bb001
		Designer is 0x23b, ARM Ltd
		Part is 0x001, Cortex-M3 ITM (Instrumentation Trace Module)
		Component class is 0xe, Generic IP component
	ROMTABLE[0x10] = 0xfff41002
		Component not present
	ROMTABLE[0x14] = 0xfff42003
		Component base address 0xe0041000
		Peripheral ID 0x04003bb924
		Designer is 0x23b, ARM Ltd
		Part is 0x924, Cortex-M3 ETM (Embedded Trace)
		Component class is 0x9, CoreSight component
		Type is 0x13, Trace Source, Processor
	ROMTABLE[0x18] = 0x0
		End of ROM table

> msm8916.dap info 4
AP ID register 0x00000000
No AP found at this ap 0x4

QDSS needs some weird options to work, but with current mainline OpenOCD support, it's possible to debug:

  • APSS(Cortex-A53, debug registers directly exposed via MEM-AP)
  • RPM(Cortex-M3, similar to above)

While it's not yet possible to debug:

  • WCNSS(ARM926EJ-S, requires direct JTAG instructions, so it's behind JTAG-AP, not yet supported by OpenOCD)
  • VENUS(ARM926EJ-S, same as above)
  • Modem+Audio DSP(QDSP6v5, same as above + debug spec not public)
  • Modem-??? (Cortex-M3, ???????)
  • maybe more cores

This may deserve a project on its own(adapters & devices list, openocd configurations), but it would also be great to have an 'enabler' implemented in lk2nd as a oneliner oem command. (Requires TZ to have no memory protection enabled, e.g. using ATF)

The usage of QDSD/NIDnT registers are documented in downstream kernel:
https://github.com/LineageOS/android_kernel_wingtech_msm8916/blob/beb5692ed25808aebce7b57e318cf8bd33e645d8/drivers/coresight/coresight-nidnt.h#L21
https://github.com/LineageOS/android_kernel_wingtech_msm8916/blob/beb5692ed25808aebce7b57e318cf8bd33e645d8/drivers/coresight/coresight-nidnt.c#L155

@stephan-gh
Copy link
Member

Nice work figuring this out!

This may deserve a project on its own(adapters & devices list, openocd configurations), but it would also be great to have an 'enabler' implemented in lk2nd as a oneliner oem command.

I guess you can use fastboot oem writel 0x0119e000 0x3c5 as one liner? :D

It would be great to document this properly somewhere, also together with instructions for OpenOCD etc.

@fxsheep
Copy link
Author

fxsheep commented Oct 5, 2023

Yeah, the actual part of toggling QDSD registers can be done easily, but since QDSD documentation in the TRM is rather scarce, how it actually works is still not clear. I've got varying successibility on different devices. My assumption is that SDC2 power has to be enabled(which means this can be device specific), along with some clocks. Meanwhile, a look at CoreSight driver in downstream kernel seems to imply that NIDnT actually support automatic switching(maybe with a special GPIO like card detect?), but again there's no clear document about this.

I'm going to document this once I got stuff clearer.

@stephan-gh
Copy link
Member

My assumption is that SDC2 power has to be enabled(which means this can be device specific)

FWIW: The regulators for SDC2 are typically powered up by default during boot on MSM8916. We have SD card support in lk2nd without turning on any regulators. The regulators may turn off any time though once Linux is started (if no SD card is inserted).

along with some clocks

Not sure about the boot up state for those, they are probably off by default. But it seems a bit strange that the debug logic would receive the clock intended for the SDC2 SDHCI controller. Looks like downstream references the regulators typically used for SDC2 and the QDSS clocks managed by RPM: https://github.com/msm8916-mainline/linux-downstream/blob/b20608408caff817ec874f325127b07609fbaeb8/arch/arm/boot/dts/qcom/msm8916-coresight.dtsi#L55-L64

There is also pinctrl (mainly configuring pull up or pull down on the SDC pins). Downstream suggests this should be set depending on the selected mode: https://github.com/msm8916-mainline/linux-downstream/blob/b20608408caff817ec874f325127b07609fbaeb8/arch/arm/boot/dts/qcom/msm8916-qrd.dtsi#L184-L205

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

No branches or pull requests

2 participants