ESP32-S3-WROOM-2-N32R8V JTAG failure

[kyle-rhds]

Hello, I am trying to utilize the JTAG debugging features of the ESP32-S3-WROOM-2-N32R8V module and unable to do so. I believe I am doing everything right as the exact same steps works on the ESP32-S3-WROOM-1-N16R8 module, so I'm questioning if this is a bug. I am able to load code over the the standard debug serial port, and code does execute correctly. Trying to load the same code over the JTAG port or USB-JTAG interface results in an error that the flash maps can't be read. See below for my setup and steps to recreate what I'm seeing.

Software Versions:
openocd version: v0.11.0-esp32-20211220 (2021-12-20-15:43)
esptool: 3.3-dev
idf version: release 4.4
IDF git commit tag: c29343eb94d2f2ca17b3a5b38c82452e556147f2
Espressif IDE Version: 2.4.2
Espressif IDE Build id: 20220308-1406

All software was reinstalled on 3/30/2022 with esp-idf-tools-setup-online-2.14 for verification.

Hardware tested on:
ESP32-S3-WROOM-2-N32R8V
ESP32-S3-DEVKITC-1-N32R8V

How to recreate the issue:

To start, I attempted debug directly to the JTAG interface of a standalone ESP32-S3-WROOM-2-N32R8V. Following the guide in the JTAG select directions from the datasheet on page 10 (JTAG Signal Source Selection) - https://www.espressif.com/sites/default ... eet_en.pdf

1. Connect to module port pins to ESP_PROG:
- JTAG pins TMS (IO42), TDI (IO41), TDO (IO40), and TCK (IO39) to ESP_PROG 10-pin interface.
- PROG pins TXDO, RXDO, IO0 (strap pin), and esp_en to ESP_PROG 6-pin interface.
- Power is supplied from a separate 3.3V power supply (the power is measured and confirmed clean/accurate).

2. Using the espefuse.py tool to burn the DIS_USB_JTAG fuse bit to 1 to enable direct JTAG pads over ESP_PROG serial interace with the following command:

Code: Select all

espefuse.py -p COMxx burn_efuse DIS_USB_JTAG 1

This is verified with the dump command -

Code: Select all

C:\Espressif\frameworks\esp-idf-v4.4>espefuse.py -p com18 dump
Connecting...
Failed to get PID of a device on com18, using standard reset sequence.
.
Detecting chip type... ESP32-S3
BLOCK0          (                ) [0 ] read_regs: 00000000 00000000 0000d1d5 00400000 80000300 00000000
MAC_SPI_8M_0    (BLOCK1          ) [1 ] read_regs: a1e12424 00007cdf 00000000 02040000 5c891348 8c04cc74
BLOCK_SYS_DATA  (BLOCK2          ) [2 ] read_regs: b99f980e 69626950 9b0c9800 288d0a7e d40d2251 9161b69b d700eea9 407af300
BLOCK_USR_DATA  (BLOCK3          ) [3 ] read_regs: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
BLOCK_KEY0      (BLOCK4          ) [4 ] read_regs: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
BLOCK_KEY1      (BLOCK5          ) [5 ] read_regs: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
BLOCK_KEY2      (BLOCK6          ) [6 ] read_regs: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
BLOCK_KEY3      (BLOCK7          ) [7 ] read_regs: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
BLOCK_KEY4      (BLOCK8          ) [8 ] read_regs: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
BLOCK_KEY5      (BLOCK9          ) [9 ] read_regs: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
BLOCK_SYS_DATA2 (BLOCK10         ) [10] read_regs: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000

BLOCK0          (                ) [0 ] err__regs: 00000000 00000000 00000000 00000000 00000000 00000000
EFUSE_RD_RS_ERR0_REG        0x00000000
EFUSE_RD_RS_ERR1_REG        0x00000000
espefuse.py v3.3-dev

=== Run "dump" command ===

And the summary command -

Code: Select all

C:\Espressif\frameworks\esp-idf-v4.4>espefuse.py -p com18 summary
Connecting...
Failed to get PID of a device on com18, using standard reset sequence.
.
Detecting chip type... ESP32-S3
espefuse.py v3.3-dev

=== Run "summary" command ===
EFUSE_NAME (Block) Description  = [Meaningful Value] [Readable/Writeable] (Hex Value)
----------------------------------------------------------------------------------------
Config fuses:
DIS_ICACHE (BLOCK0)                                Disables ICache                                    = False R/W (0b0)
DIS_DCACHE (BLOCK0)                                Disables DCache                                    = False R/W (0b0)
DIS_DOWNLOAD_ICACHE (BLOCK0)                       Disables Icache when SoC is in Download mode       = False R/W (0b0)
DIS_DOWNLOAD_DCACHE (BLOCK0)                       Disables Dcache when SoC is in Download mode       = False R/W (0b0)
DIS_FORCE_DOWNLOAD (BLOCK0)                        Disables forcing chip into Download mode           = False R/W (0b0)
DIS_CAN (BLOCK0)                                   Disables the TWAI Controller hardware              = False R/W (0b0)
DIS_APP_CPU (BLOCK0)                               Disables APP CPU                                   = False R/W (0b0)
FLASH_TPUW (BLOCK0)                                Configures flash startup delay after SoC power-up, = 0 R/W (0x0)
                                                    unit is (ms/2). When the value is 15, delay is 7.
                                                   5 ms
DIS_LEGACY_SPI_BOOT (BLOCK0)                       Disables Legacy SPI boot mode                      = False R/W (0b0)
UART_PRINT_CHANNEL (BLOCK0)                        Selects the default UART for printing boot msg     = UART0 R/W (0b0)
FLASH_ECC_MODE (BLOCK0)                            Configures the ECC mode for SPI flash
   = 16-byte to 18-byte mode R/W (0b0)
DIS_USB_DOWNLOAD_MODE (BLOCK0)                     Disables USB OTG download feature in UART download = False R/W (0b0)
                                                    boot mode
UART_PRINT_CONTROL (BLOCK0)                        Sets the default UART boot message output mode     = Enabled R/W (0b00)
FLASH_TYPE (BLOCK0)                                Selects SPI flash type                             = 8 data lines R/W (0b1)
FLASH_PAGE_SIZE (BLOCK0)                           Sets the size of flash page                        = 0 R/W (0b00)
FLASH_ECC_EN (BLOCK0)                              Enables ECC in Flash boot mode                     = False R/W (0b0)
FORCE_SEND_RESUME (BLOCK0)                         Forces ROM code to send an SPI flash resume comman = False R/W (0b0)
                                                   d during SPI boot
BLOCK_USR_DATA (BLOCK3)                            User data
   = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 R/W

Efuse fuses:
WR_DIS (BLOCK0)                                    Disables programming of individual eFuses          = 0 R/W (0x00000000)
RD_DIS (BLOCK0)                                    Disables software reading from BLOCK4-10           = 0 R/W (0b0000000)

Identity fuses:
SECURE_VERSION (BLOCK0)                            Secure version (used by ESP-IDF anti-rollback feat = 0 R/W (0x0000)
                                                   ure)
MAC (BLOCK1)                                       Factory MAC Address
   = 7c:df:a1:e1:24:24 (OK) R/W
WAFER_VERSION (BLOCK1)                             WAFER version                                      = 1 R/W (0b001)
PKG_VERSION (BLOCK1)                               ??? Package version                                = ESP32-S3 R/W (0x0)
BLOCK1_VERSION (BLOCK1)                            ??? BLOCK1 efuse version                           = 1 R/W (0b001)
OPTIONAL_UNIQUE_ID (BLOCK2)                        ??? Optional unique 128-bit ID
   = 0e 98 9f b9 50 69 62 69 00 98 0c 9b 7e 0a 8d 28 R/W
BLOCK2_VERSION (BLOCK2)                            ??? Version of BLOCK2                              = 5 R/W (0b101)
CUSTOM_MAC (BLOCK3)                                Custom MAC Address
   = 00:00:00:00:00:00 (OK) R/W

Security fuses:
SOFT_DIS_JTAG (BLOCK0)                             Software disables JTAG by programming odd number o = 0 R/W (0b000)
                                                   f 1 bit(s). JTAG can be re-enabled via HMAC periph
                                                   eral
HARD_DIS_JTAG (BLOCK0)                             Hardware disables JTAG permanently                 = False R/W (0b0)
DIS_DOWNLOAD_MANUAL_ENCRYPT (BLOCK0)               Disables flash encryption when in download boot mo = False R/W (0b0)
                                                   des
SPI_BOOT_CRYPT_CNT (BLOCK0)                        Enables encryption and decryption, when an SPI boo = Disable R/W (0b000)
                                                   t mode is set. Enabled when 1 or 3 bits are set,di
                                                   sabled otherwise
SECURE_BOOT_KEY_REVOKE0 (BLOCK0)                   Revokes use of secure boot key digest 0            = False R/W (0b0)
SECURE_BOOT_KEY_REVOKE1 (BLOCK0)                   Revokes use of secure boot key digest 1            = False R/W (0b0)
SECURE_BOOT_KEY_REVOKE2 (BLOCK0)                   Revokes use of secure boot key digest 2            = False R/W (0b0)
KEY_PURPOSE_0 (BLOCK0)                             KEY0 purpose                                       = USER R/W (0x0)
KEY_PURPOSE_1 (BLOCK0)                             KEY1 purpose                                       = USER R/W (0x0)
KEY_PURPOSE_2 (BLOCK0)                             KEY2 purpose                                       = USER R/W (0x0)
KEY_PURPOSE_3 (BLOCK0)                             KEY3 purpose                                       = USER R/W (0x0)
KEY_PURPOSE_4 (BLOCK0)                             KEY4 purpose                                       = USER R/W (0x0)
KEY_PURPOSE_5 (BLOCK0)                             KEY5 purpose                                       = USER R/W (0x0)
SECURE_BOOT_EN (BLOCK0)                            Enables secure boot                                = False R/W (0b0)
SECURE_BOOT_AGGRESSIVE_REVOKE (BLOCK0)             Enables aggressive secure boot key revocation mode = False R/W (0b0)
STRAP_JTAG_SEL (BLOCK0)                            Enable selection between usb_to_jtagor pad_to_jtag = False R/W (0b0)
                                                    through GPIO3
DIS_DOWNLOAD_MODE (BLOCK0)                         Disables all Download boot modes                   = False R/W (0b0)
ENABLE_SECURITY_DOWNLOAD (BLOCK0)                  Enables secure UART download mode (read/write flas = False R/W (0b0)
                                                   h only)
BLOCK_KEY0 (BLOCK4)
  Purpose: USER
               Encryption key0 or user data
   = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 R/W
BLOCK_KEY1 (BLOCK5)
  Purpose: USER
               Encryption key1 or user data
   = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 R/W
BLOCK_KEY2 (BLOCK6)
  Purpose: USER
               Encryption key2 or user data
   = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 R/W
BLOCK_KEY3 (BLOCK7)
  Purpose: USER
               Encryption key3 or user data
   = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 R/W
BLOCK_KEY4 (BLOCK8)
  Purpose: USER
               Encryption key4 or user data
   = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 R/W
BLOCK_KEY5 (BLOCK9)
  Purpose: USER
               Encryption key5 or user data
   = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 R/W
BLOCK_SYS_DATA2 (BLOCK10)                          System data (part 2)
   = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 R/W

Spi_Pad_Config fuses:
SPI_PAD_CONFIG_CLK (BLOCK1)                        SPI CLK pad                                        = 0 R/W (0b000000)
SPI_PAD_CONFIG_Q (BLOCK1)                          SPI Q (D1) pad                                     = 0 R/W (0b000000)
SPI_PAD_CONFIG_D (BLOCK1)                          SPI D (D0) pad                                     = 0 R/W (0b000000)
SPI_PAD_CONFIG_CS (BLOCK1)                         SPI CS pad                                         = 0 R/W (0b000000)
SPI_PAD_CONFIG_HD (BLOCK1)                         SPI HD (D3) pad                                    = 0 R/W (0b000000)
SPI_PAD_CONFIG_WP (BLOCK1)                         SPI WP (D2) pad                                    = 0 R/W (0b000000)
SPI_PAD_CONFIG_DQS (BLOCK1)                        SPI DQS pad                                        = 0 R/W (0b000000)
SPI_PAD_CONFIG_D4 (BLOCK1)                         SPI D4 pad                                         = 0 R/W (0b000000)
SPI_PAD_CONFIG_D5 (BLOCK1)                         SPI D5 pad                                         = 0 R/W (0b000000)
SPI_PAD_CONFIG_D6 (BLOCK1)                         SPI D6 pad                                         = 0 R/W (0b000000)
SPI_PAD_CONFIG_D7 (BLOCK1)                         SPI D7 pad                                         = 0 R/W (0b000000)

Usb Config fuses:
DIS_USB (BLOCK0)                                   Disables the USB OTG hardware                      = False R/W (0b0)
USB_EXCHG_PINS (BLOCK0)                            Exchanges USB D+ and D- pins                       = False R/W (0b0)
EXT_PHY_ENABLE (BLOCK0)                            Enables external USB PHY                           = False R/W (0b0)
BTLC_GPIO_ENABLE (BLOCK0)                          Enables BTLC GPIO                                  = 0 R/W (0b00)
DIS_USB_JTAG (BLOCK0)                              Disable usb_serial_jtag-to-jtag function           = True R/W (0b1)
DIS_USB_SERIAL_JTAG (BLOCK0)                       Disable usb_serial_jtag module                     = False R/W (0b0)
USB_PHY_SEL (BLOCK0)                               Select internal/external PHY for USB OTGand usb_se = False R/W (0b0)
                                                   rial_jtag

Vdd_Spi Config fuses:
VDD_SPI_XPD (BLOCK0)                               The VDD_SPI regulator is powered on                = True R/W (0b1)
VDD_SPI_TIEH (BLOCK0)                              The VDD_SPI power supply voltage at reset          = Connect to 1.8V LDO R/W (0b0)
VDD_SPI_FORCE (BLOCK0)                             Force using VDD_SPI_XPD and VDD_SPI_TIEH to config = True R/W (0b1)
                                                   ure VDD_SPI LDO
PIN_POWER_SELECTION (BLOCK0)                       Sets default power supply for GPIO33..37           = VDD_SPI R/W (0b1)

Wdt Config fuses:
WDT_DELAY_SEL (BLOCK0)                             Selects RTC WDT timeout threshold at startup       = 0 R/W (0b00)

Flash voltage (VDD_SPI) set to 1.8V by efuse.

3. With the DIS_USB_JTAG fuse burned, the JTAG port should now be active and ready for debugging and code loading. Using the Espressif IDE (version noted above) setup a debug target, following target notes from the following documentation, https://docs.espressif.com/projects/esp ... ure-target.

Code: Select all

-s ${openocd_path}/share/openocd/scripts -f interface/ftdi/esp32_devkitj_v1.cfg -f target/esp32s3.cfg

4. Import the 'Blink' example project into the Espresssif IDE, and initiate a JTAG debug environment.

The following errors are seen in the openocd debugging console -

Code: Select all

Open On-Chip Debugger  v0.11.0-esp32-20211220 (2021-12-20-15:43)
Licensed under GNU GPL v2
For bug reports, read
	http://openocd.org/doc/doxygen/bugs.html
adapter speed: 20000 kHz

Flashing C:/esp-project/blink/build/partition_table/partition-table.bin at 0x8000
Error: libusb_open() failed with LIBUSB_ERROR_NOT_SUPPORTED
Info : ftdi: if you experience problems at higher adapter clocks, try the command "ftdi_tdo_sample_edge falling"
Info : clock speed 20000 kHz
Info : JTAG tap: esp32s3.cpu0 tap/device found: 0x120034e5 (mfg: 0x272 (Tensilica), part: 0x2003, ver: 0x1)
Info : JTAG tap: esp32s3.cpu1 tap/device found: 0x120034e5 (mfg: 0x272 (Tensilica), part: 0x2003, ver: 0x1)
Info : esp32s3.cpu0: Target halted, PC=0x40000400, debug_reason=00000001
Info : esp32s3.cpu1: Target halted, PC=0x40000400, debug_reason=00000000
Info : starting gdb server for esp32s3.cpu0 on 3333
Info : Listening on port 3333 for gdb connections
Info : JTAG tap: esp32s3.cpu0 tap/device found: 0x120034e5 (mfg: 0x272 (Tensilica), part: 0x2003, ver: 0x1)
Info : JTAG tap: esp32s3.cpu1 tap/device found: 0x120034e5 (mfg: 0x272 (Tensilica), part: 0x2003, ver: 0x1)
Info : esp32s3.cpu0: Debug controller was reset.
Info : esp32s3.cpu0: Core was reset.
Info : esp32s3.cpu0: Target halted, PC=0x500000EF, debug_reason=00000000
Info : Set GDB target to 'esp32s3.cpu0'
Info : esp32s3.cpu0: Core was reset.
Info : esp32s3.cpu0: Target halted, PC=0x40000400, debug_reason=00000000
Info : esp32s3.cpu1: Debug controller was reset.
Info : esp32s3.cpu1: Core was reset.
Info : esp32s3.cpu1: Target halted, PC=0x40000400, debug_reason=00000000
Info : esp32s3.cpu0: Target halted, PC=0x403B2412, debug_reason=00000001
Error: Failed to get flash maps (4294967295)!
Warn : Failed to get flash mappings (-4)!
Info : esp32s3.cpu0: Target halted, PC=0x403B2412, debug_reason=00000001
Error: Failed to get flash size!
Info : esp32s3.cpu0: Target halted, PC=0x403B2412, debug_reason=00000001
Error: Failed to get flash size!
Error: Failed to probe flash, size 0 KB
Error: auto_probe failed
Error: Failed to find bank 'esp32s3.cpu0.flash'!
** Flashing Failed **
-1
Started by GNU MCU Eclipse
Info : Listening on port 6666 for tcl connections
Info : Listening on port 4444 for telnet connections
Info : accepting 'gdb' connection on tcp/3333
Warn : No symbols for FreeRTOS!
Info : esp32s3.cpu0: Target halted, PC=0x403B2412, debug_reason=00000001
Error: Failed to get flash maps (4294967295)!
Warn : Failed to get flash mappings (-4)!
Info : esp32s3.cpu0: Target halted, PC=0x403B2412, debug_reason=00000001
Error: Failed to get flash size!
Info : esp32s3.cpu0: Target halted, PC=0x403B2412, debug_reason=00000001
Error: Failed to get flash size!
Error: Failed to probe flash, size 0 KB
Error: auto_probe failed
Error: Connect failed. Consider setting up a gdb-attach event for the target to prepare target for GDB connect, or use 'gdb_memory_map disable'.
Error: attempted 'gdb' connection rejected
shutdown command invoked

I've attached the verbose (-d3) debug log as a file because it's too big to contain inline here.

A little after connecting to the cores, the error 'Failed to get flash maps (4294967295)!' is printed and the connection is terminated shortly after. I've recreated this setup also using an off the shelf ESP32-S3-DEVKITC-1-N32R8V which uses the ESP32-S3-WROOM-2-N32R8V. As well, to try and confirm if this was some issue with the direct JTAG port, I tried to utilize the USB-JTAG interface and load the same standard blink example project and I get the same error. Changing nothing else, I swapped in an ESP32-WROOM-1-N16R8 board and tried the same environment and I am able to arbitrarily load and debug code without error with JTAG. As a side note, I recreated everything here with the ESP-IDF master branch and got the same errors.

Could someone confirm if this is an error or I am doing something wrong? I've tried it a dozen different ways and it all seems to work on everything but the S3-N32-R8V.

[kyle-rhds]

Could someone from Espressif at least address this issue and confirm if this is a bug or if I am doing something wrong? I'm seeing this issue with off the shelf development kits with no modifications on my part. I'm trying to investigate the ESP32-S3-WROOM-2 for a potential production run, but if the device isn't production ready then I need to know so I can replace it as the main processor in my design with something else.

[ESP_Sprite]

I've asked a colleague to see if he has time to look at this.

[ESP-erhankur]

Looks like the same issue. https://github.com/espressif/openocd-esp32/issues/218

[kyle-rhds]

Looks like the same issue. https://github.com/espressif/openocd-esp32/issues/218

Yea, I didn't see that before but it looks to be of a similar or same issue. Would you happen to have the windows binaries with the fix in place? I'm trying to compile from source but I'm waiting on our internal IT to give me the go-ahead to be able to install the tools necessary to compile from source.

[ESP-erhankur]

Attached in to the https://github.com/espressif/openocd-esp32/issues/218

[kyle-rhds]

Attached in to the https://github.com/espressif/openocd-esp32/issues/218

Thanks! I had to fudge the version string in the openocd binary to get it to play nice with esp-idf but it seems to have worked as I was able to flash over JTAG. Connecting standalone to the target shows no issues as far as I can perceive, though.

For those that run into this post with the same issue and want to run through the espressif IDE as well, I did a simple string substitution in the bin file to trick the IDF start scripts to not yell at me about the version being wrong. Using notepad++ or similar search for the following -"v0.11.0-esp32-20211220-1338-g554a6c26", and replace "-1338-g554a6c26" part with equivalent length of all space characters in the openocd.exe binary (don't change total length, the exe will break). I assume it would be easier to just break the scripts where they check the version string, but I didn't see where this was happening so I found it easier to just poke at the bin file.

Also note, trying to use it with the Espressif IDE seems to always result in openocd timing out during JTAG debugging events if you let eclipse start openocd internally. Changing the debug launch config to not starting openocd internally, and instead start it externally beforehand from a cmd prompt lets you get past this. Increasing the timeout options in the Espressif menu doesn't seem to make a difference. I'm not sure if this is because I was poking at the binary strings or something else...

Either way, I think I can limp by with this and not have to go backwards to the WROOM-1, so thanks for looking into it, I appreciate it.