Skip to content

Recovering a locked TM4C

Jump to bottom
Peter Wittich edited this page Mar 1, 2022 · 18 revisions

The TM4C Tina microcontroller on the CM can lock up under certain circumstances, in such a way that the JTAG interface is no longer accessible for anything except the most basic boundary scan. You cannot use this to reload the board, for instance, nor can you debug the application. It’s not exactly clear to me how one gets into this situation, but it has happened numerous times.

How to recognize a locked TM4C

The symptom is as follows. Launch JLinkExe, type connect and follow the prompts. For a locked TM4C the output looks as follows.

Connecting to target via JTAG
TotalIRLen = 4, IRPrint = 0x01
JTAG chain detection found 1 devices:
 #0 Id: 0x4BA00477, IRLen: 04, CoreSight JTAG-DP
Scanning AP map to find all available APs
AP[0]: Stopped AP scan as end of AP map seems to be reached
Iterating through AP map to find AHB-AP to use
Scanning AP map to find all available APs
AP[0]: Stopped AP scan as end of AP map seems to be reached
Iterating through AP map to find AHB-AP to use
TotalIRLen = 4, IRPrint = 0x01
JTAG chain detection found 1 devices:
 #0 Id: 0x4BA00477, IRLen: 04, CoreSight JTAG-DP

****** Error: Could not find core in Coresight setup
TotalIRLen = 4, IRPrint = 0x01
JTAG chain detection found 1 devices:
 #0 Id: 0x4BA00477, IRLen: 04, CoreSight JTAG-DP
TotalIRLen = 4, IRPrint = 0x01
JTAG chain detection found 1 devices:
 #0 Id: 0x4BA00477, IRLen: 04, CoreSight JTAG-DP
Cannot connect to target.
J-Link>q

If instead you get something that says that the JTAG output is not changing this suggests that the FPGAs are in the chain and they are not powered or the JTAG chain is interrupted for another reason.

Recovery steps

The recovery is outlined in the TM4C1290NCPDT is described in section 4.3.4.3 of the data sheet, 'Recovering a "Locked" Microcontroller.' The board needs to be held in reset the entire time.

How to recover the board when it's paired with a SM

One can recover the board with the SEGGER JTAG programmer with the following steps. This assumes you are using a mated SM+CM.

  1. Connect the segger to the front panel JTAG connector.
  2. Ensure that the SM does not automatically power on the CM/release it from reset. As of 2/2020 this is achieved by editing the /etc/sm_boot configuration file on the Zynq. This means that the MCU is held in reset since power-on.
  3. Open the JLinkExe program.
  4. Type unlock LM3Sxxx 1. Don’t yet power cycle.
  5. Repeat previous step.
  6. From BUTool.exe, write 1 to the MCU to take it out of reset (write CM.CM_1.CTRL.ENABLE_UC 1)
  7. From BUTool.exe, write 0 to the MCU to return the MCU to reset (write CM.CM_1.CTRL.ENABLE_UC 0)
  8. Turn off the power on the Apollo via a hard reset. Via the ipmitool command this is achieved via ipmitool -H 192.168.10.171 -P "" -t 0x86 mc reset cold, where -H needs the IP address of the shelf manager and 0x86 is the address of the board you want to power cycle. Beware this is not a graceful reboot but just cuts the power.
  9. Reprogram the board as described below, after ensuring that the board is not held in reset.

At this point the board should be recovered. You will have to reprogram the flash. Note that this will likely also wipe the internal eeprom.

What about the JTAG jumpers? REV 1 ONLY

When the MCU is really hosed the FPGAs have no power, and as such they won’t even respond to the JTAG boundary scan instruction. At this point you need to set the jumpers to take the FPGAs out of the chain and reprogram via JLinkExe.

FORCE_JTAG REV 1 ONLY

The SEGGER programmer requires the FORCE_JTAG jumper to be set when the CM is mated to a SM. Remember to remove this jumper when you are done.

Power the FPGAs

if you can, power up the FPGAs before trying to do anything (assuming they are in the JTAG chain.)

Re-programming via JLinkExe

The command-line programmer can be invoked to program the main program and the boot loader. To call a command file you need to run JLinkExe with the -CommandFile option, e.g.,

% JLinkExe -CommandFile script.cmd

CAUTION: You must reprogram the main program before the boot loader

The relevant scripts are shown below, first, for the main program, then for the boot loader. In each case you need to set the JTagConf option, depending on which parts are in the JTAG chain. The two arguments are the length of the combined length of the IR chain before the MCU and the number of devices before the MCU. The IR register length is 12 bits for the VUXP class and 6 bits for the KUXP class of Xilinx FPGAs, and the MCU is the last device in the JTAG chain.

On Rev2 the MCU is on its own JTAG chain so you always have it by itself (no need to modify JTagConf).

[wittich@axion v012]$ cat jlinkload.cmd 
// this is a command file for JLINK

log loadlog.txt
exitonerror 1

usb 
device TM4C1290NCPDT
speed auto
si jtag
//JTagConf 18,2 // KU + VU
JTagConf 0,0 // MCU only
//JTagConf 6,1 // KU only
connect
loadbin ./cm_mcu.bin,0x4000
exit

For the boot loader:

[wittich@axion v012]$ cat jlinkloadbl.cmd 
// this is a command file for JLINK

log loadbllog.txt
exitonerror 1

usb 
device TM4C1290NCPDT
speed auto
si jtag
//JTagConf 18,2 // KU + VU
JTagConf 0,0 // MCU only
//JTagConf 6,1 // KU only
connect
loadbin ./bl_main.bin,0x0
exit

Resetting the MCU via JLinkExe

To reset the MCU from the JLinkExe command line, type r (reset) followed by g (go). Without the "go" nothing will happen.

Clone this wiki locally