ESP32-P4 support

[orsolic]

I am trying to port BMP to use with ESP32-P4 target. I am using STM32F401CC as hardware probe and my work is based on esp32-c3-support branch.
It doesn't work with ESP32-P4, it fails early in jtag_scan().

Currently there is no full reference manual for ESP32-P4, but one which is available, states:

ESP32-P4 features two DTMs interconnected in a daisy-chain configuration. Specifically, TAP0 connects to the HP CPU, while TAP1 is dedicated to the LP CPU.
The HP DM supports multicore debugging according to the specification RISC-V External Debug Support
Version 0.13. It can simultaneously control both cores of the HP CPU. In contrast, the LP DM is designed for
debugging the single-core LP CPU.

(ESP32-P4 has 2 HP cores and 1 LP core).

I am sure that my hardware and connections are OK (P4 JTAG works with OpenOCD-esp32 official fork and FT2232H).
This is output from OpenOCD:

openocd -f board/esp32p4-ftdi.cfg -c "init; reset; exit"
Open On-Chip Debugger v0.12.0-eol-8078-g4071bf78-dirty (2024-12-27-18:08)
Licensed under GNU GPL v2
For bug reports, read
        http://openocd.org/doc/doxygen/bugs.html
Info : auto-selecting first available session transport "jtag". To override use 'transport select <transport>'.
Info : clock speed 10000 kHz
Info : JTAG tap: esp32p4.tap0 tap/device found: 0x00012c25 (mfg: 0x612 (Espressif Systems), part: 0x0012, ver: 0x0)
Info : JTAG tap: esp32p4.tap1 tap/device found: 0x00012c25 (mfg: 0x612 (Espressif Systems), part: 0x0012, ver: 0x0)
Info : [esp32p4.hp.cpu0] datacount=1 progbufsize=2
Info : [esp32p4.hp.cpu0] Core 0 made part of halt group 1.
Info : [esp32p4.hp.cpu0] Examined RISC-V core; found 2 harts
Info : [esp32p4.hp.cpu0]  XLEN=32, misa=0x40901125
Info : [esp32p4.hp.cpu0] Examination succeed
Info : [esp32p4.hp.cpu1] datacount=1 progbufsize=2
Info : [esp32p4.hp.cpu1] Core 1 made part of halt group 1.
Info : [esp32p4.hp.cpu1] Examined RISC-V core; found 2 harts
Info : [esp32p4.hp.cpu1]  XLEN=32, misa=0x40901125
Info : [esp32p4.hp.cpu1] Examination succeed
Info : [esp32p4.hp.cpu0] starting gdb server on 3333
Info : Listening on port 3333 for gdb connections

This is output from my BMP:

>>> mon jtag_scan
Target voltage: Unknown
jtag_devs[0].jd_idcode: 0x12c25
jtag_devs[1].jd_idcode: 0x12c25
jtag_dev_count: 2
jtag_scan: IR (0) does not match the expected value (1), bailing out, device:1
jtag_scan():107 error
JTAG device scan failed!
Failed

If I comment that check, it will proceed further, but it won't work, things like vendorid, archid, implid will be all zero.

Do you have idea where to look to fix the issue? If needed, I can bring out scope and logic analyzer for some even lower layer debugging.

[dragonmux]

ESP32-P4 is not supported at all - ESP32-C3 is a RISC-V target which has some funky needs and, more importantly, we could never quite get the post-Flash i-cache configuration going for properly. Unless Espressif has done a better job (which it definitely does not sound like they have) with the P4, then it's likely there are some fundamental things that need working around.

In regards to JTAG scan at least though, IR issues are what the IR quirks system exists for. Define the exact ID code in (jtag_devs.c after the existing RISC-V block)[https://github.com/blackmagic-debug/blackmagic/blob/593b906487cf2e1e51d55d19d376cf9b41b03112/src/target/jtag_devs.c#L407-L416], and then define a quirk that describes the IR length and scan value for the TAP.

You can use BMDA and enable DEBUG_PROBE and DEBUG_WIRE diagnostics to aid looking into the process (along with INFO and TARGET to see how scan is going) with -v 45. We recommend doing this so you can see how exactly the target is responding and BMD is interpreting what it sees. This also means being able to iterate without constantly having to re-flash your probe.

[orsolic]

Thanks for the BMDA - it was indeed much faster to use that than to reflash probe. Also, when used with FTDI adapter there is no need to rewire it before experimenting with BMD.

I did define ID codes and IR quirks. I am now working on main branch. According to OpenOCD, both TAPs have same idcode and IR length:

Info : JTAG tap: esp32p4.tap0 tap/device found: 0x00012c25 (mfg: 0x612 (Espressif Systems), part: 0x0012, ver: 0x0)
Info : JTAG tap: esp32p4.tap1 tap/device found: 0x00012c25 (mfg: 0x612 (Espressif Systems), part: 0x0012, ver: 0x0)

But it seems they have different ir_value (5 and 1), at least according to printed "next_bit" inside jtag_read_irs().

After patching jtag_device_get_quirks() to return ir_value of 1 for 2nd tap it proceed a little bit futher.

Some things seems to work:

ID code 0x00012c25: RISC-V debug v0.13. ESP32-P4 HP
ID code 0x00012c25: RISC-V debug v0.13. ESP32-P4 HP
RISC-V debug v0.13/v1.0 DMIjourney
riscv_dm_version() status: 0x30a2 version: 0x2
RISC-V debug v0.13 DM

GDB:

>>> target extended-remote :2000
Remote debugging using :2000
>>> mon jtag_scan
Target voltage: Unknown
Available Targets:
No. Att Driver
 1      RISC-V rv32imafc
 2      RISC-V rv32imafc

Continuing with BMD RISC-V journey