Ticket Name: TDA2 Initialisation via JTAG

Query Text:
Other Parts Discussed in Thread: TDA2 Hello, We are having issues finding any information on how to access a TDA2 device (specifically TDA2HGBRAQ) via JTAG. We don't use a 3rd party tool, but are building the JTAG communications ourselves. The steps we would follow are: 1. Physically connect to JTAG pins on TDA2 device. 2. Trigger TDA2 reset (or JTAG reset) and initialise the device via JTAG (halt core(s), setup memory, etc.). 3. Upload a boot loader to the RAM of the device and execute it. Steps 1 and 3 aren't really the issue, but we need help with step 2. We can access this same target device with a Lauterbach, so the information for how to do this initialisation via JTAG must be available. As of yet, we haven't been able to find the right contact and/or documentation for this. If someone can help us find the correct contact and/or documentation, that would be very helpful.

Responses:
To use the correct terminology, I am looking for the JTAG scan path details for third party programming support.

Hello Daniel, How about refering to the CCS device scan chain tree (attached) for example. The xml clearly shows processor sub-paths. TDA2x.xml You may also refer to "30.6 Power, Reset, and Clock Management Debug Support" in the device TRM and in general to the "Chapter 30 On-Chip Debug Support" for additional JTAG debug support details. Hope it helps, thanks, Alex

Hello Alex, Thank you for this information. We've tried to use it, but still encounter some issues. Primarily, we need to know how to navigate to IcePick-D so that we can access the Cortex core. Currently we can't find any information on the correct TAP states or flow we need to reach this goal. We've "guessed" some values to shift and seem to get some limited data when we clock out in the shift state, but this is just trail and error with no real understanding of what the commands we send and receive really are. Do you know where we can find the information to access the Cortex via IcePick-D? TAP states, Shift-IR commands, Shift-DR data, etc? Once we have access to the Cortex, the reading/wring of RAM (and registers) becomes trivial. Thanks in advance, Daniel.

Hello Daniel, Could you please also refer to the following doc then. Looks like it has enough information to enable a third party debugger on the processor JTAG test access ports (TAPs) connected to the ICEPick-D. Let me know thanks, Alex

Hello Alex, Thanks for this. We use this sequence with a P value of 15 and Q value of 0. The P value we estimated based on ADAS reference manuals, the Q is just taken from practice. Are these correct? After we do these initialisation steps, we try to setup the Cortex-A15. However, at this point, we have really no information. Currently we are trying to perform similar commands as we did for Cortex-A9, but even the A9 commands were a kind of guess work. Are you able to provide any documentation at this point, so that we can ensure proper access to the Cortex and read/write the RAM. Thanks, Daniel.

Hi Daniel, I think you are correct: P = 15 (dec); Q = 0 (dec); P is for tap number, Q for Core number, and referring to TRM debug chapter, your values look correct (see attached screenshot) Thanks, Alex

Hi Alex, The attached screenshot didn't work, but thanks for clarifying. Regarding the point about setting up the Cortex-A15 after the ICEPick-D initialisation; do you have any documents or contacts who could support us?

Hi Daniel, Reattached screenshot. Moreover, I received feedback that the Emulation developer community has this information and you should have access to the below url. Could you please check there if more docs are available for you to clarify your questions? https://www.ti.com/securesoftware/docs/securesoftwarehome.tsp Thanks, Alex

Hello Alex, Thanks for the help. We'll look through the documentation in the Emulation Developer Community and see what we can find. Regards, Daniel.