JTAG issues with STM32F4 WLCSP target

Embedded Security ChipWhisperer Hardware
1

I’m trying to get JTAG / SWD to work with the new STM32F4 WLCSP UFO target daughter board and I am running into some issues:

Programming and verifying works fine, however when OpenOCD tries to run the reset command it fails (see logs below).

At first I was suspecting my JTAG adapter (FT232H), however I now also tried with a ST-LINK V2 and get the same result.

As a sanity check I also tried one of the STM32F3 targets, there it works fine, so I’m pretty sure its not a config or adapter issue.

I’m a bit lost now what could be the cause. I saw that on the bottom of the WLCSP target board there is a Jumper that bridges PA0(WKUP) to nRST. I was wondering whether this might be the cause, but removing it makes OpenOCD already fail at the init phase.

@coflynn Did you try JTAG or SWD programming for the new STM32F4 WLCSP targets yet?

OpenOCD Config and logs

OpenOCD board config

(I reduced the jtag clock because I though it might help, but it doesn’t)

source [find interface/stlink-v2.cfg]

source [find target/stm32f4x.cfg]

reset_config srst_only

adapter_khz 180

OpenOCD log:

(I also have a debug log, but I can’t attach files yet as a new user, and its too long for the post body)

openocd.exe -f cw308.cfg -c "program simpleserial-aes-CW308_STM32F3.elf" -c reset -c shutdown
Open On-Chip Debugger 0.10.0
Licensed under GNU GPL v2
For bug reports, read
        http://openocd.org/doc/doxygen/bugs.html
Info : auto-selecting first available session transport "hla_swd". To override use 'transport select <transport>'.
Info : The selected transport took over low-level target control. The results might differ compared to plain JTAG/SWD
adapter speed: 2000 kHz
adapter_nsrst_delay: 100
none separate
srst_only separate srst_nogate srst_open_drain connect_deassert_srst
adapter speed: 180 kHz
Info : Unable to match requested speed 180 kHz, using 125 kHz
Info : Unable to match requested speed 180 kHz, using 125 kHz
Info : clock speed 125 kHz
Info : STLINK v2 JTAG v37 API v2 SWIM v7 VID 0x0483 PID 0x3748
Info : using stlink api v2
Info : Target voltage: 3.643450
Info : stm32f4x.cpu: hardware has 6 breakpoints, 4 watchpoints
Info : Unable to match requested speed 2000 kHz, using 1800 kHz
Info : Unable to match requested speed 2000 kHz, using 1800 kHz
adapter speed: 1800 kHz
in procedure 'program'
in procedure 'reset' called at file "embedded:startup.tcl", line 500
in procedure 'ocd_bouncer'

embedded:startup.tcl:476: Error: ** Unable to reset target **
in procedure 'program'
in procedure 'program_error' called at file "embedded:startup.tcl", line 501
at file "embedded:startup.tcl", line 476
2

Hi Stefan,

I was using J-Link for them - I thought they were tested with that, but I’ll double-check here what settings we are using. I admit I’m terrible at FOSS-usage myself for dev-tools and almost exclusively use the $$$ Seggers…

Do you mean programming/verifying with the bootloader (serial), or programming/verifying with the JTAG works but then debug doesn’t work?

I’ve got an STLink/V2 here I can try with. I’ve got an OpenOCD HW too but it’s always a bit to bring up… so if I can test with STLink/V2 is easier.

-Colin

3

PS - let me know if you can do the test on more than 1 unit too, as with the WLCSP soldering could be an issue so want to make sure it’s not something random, can swap it if so

4

Hmm so J-Link + Ozone works for attaching to a program (“Attach to Running Program” option) & debugging it, either single-step or go seem to work just fine:

image
image2089×1505 355 KB

This is with SWD @ 500khz.

However downloading the program via Ozone (“Download & Reset Program”) give me an error:

Found Cortex-M4 r0p1, Little endian.
FPUnit: 6 code (BP) slots and 2 literal slots
CoreSight components:
ROMTbl[0] @ E00FF000
ROMTbl[0][0]: E000E000, CID: B105E00D, PID: 000BB00C SCS-M7
ROMTbl[0][1]: E0001000, CID: B105E00D, PID: 003BB002 DWT
ROMTbl[0][2]: E0002000, CID: B105E00D, PID: 002BB003 FPB
ROMTbl[0][3]: E0000000, CID: B105E00D, PID: 003BB001 ITM
ROMTbl[0][4]: E0040000, CID: B105900D, PID: 000BB9A1 TPIU
ROMTbl[0][5]: E0041000, CID: B105900D, PID: 000BB925 ETM
Connected to target device.
Reset: Halt core after reset via DEMCR.VC_CORERESET.
Reset: Reset device via AIRCR.SYSRESETREQ.
Elf.GetBaseAddr(); // returns 0x8000000
Target.ReadU32 (0x08000000); // returns 0x20003000
Target.SetReg ("SP", 0x20003000);
Elf.GetEntryPointPC(); // returns 0x8001134
Target.SetReg ("PC", 0x8001134);
Timeout while checking target RAM, RAMCode did not respond in time. (PC = 0x00000001, CPSR = x40021000, LR = 0x21000000)!
Failed to prepare for programming.
Failed to execute RAMCode for RAM check!
Download failed: J-Link reports an unspecified download error

However - shorting the jumper J16 on the UFO base-board such that SH+ and SH- are routed together (the UFO should come with some spare 2-pin jumpers) allowed programming to work.

Sometimes we find the shunt just has too much loss for certain operations - normally programming can be an issue, but perhaps the debug core is also sensitive. If you haven’t try jumping that and see if it helps.

Otherwise if you can get a J-Link it might be worth trying too.

Thanks,

-Colin

5

I mean programming/verifying with JTAG (or SWD, both works). (In the above debug log its not visible because I disabled the programming and verification steps there, I wanted a minimal log.)
The debug then fails because at the start of the debug session it tries to execute a Reset, which then fails (as can be seen in the log).

I also tried the second WLCSP target board that I have, but same result.

For the Shunt: All attempts so far were done with a jumper bridging SH- and SH+

I can also try and get a JLink from the office next week and see whether that works better.

6

Thanks for verifying that it should work. I’ll try with a J-Link then.