Accessing JTAG

To begin, we need to access the JTAG port on the MIRROR board. After examining the board, we found that there are two JTAG ports: JTAG WIFI and JTAG MCU. We require the JTAG MCU for our purposes.

Step 1: Soldering a Connector To connect to the JTAG MCU, we need to solder a 0.05” connector to the JTAG pins on the board. Note that the silkscreen is on the wrong side, which was a challenge to figure out initially. The schematic below helped clarify things.

Step 2: Hooking up the JTAG Interface We will use a JTAG interface board, such as Tigard, to connect to the device.

Step 3: Configuring OpenOCD To access the device using OpenOCD, we need to provide a configuration file for the Tigard board (tigard-jtag.cfg) and create another configuration file for the MIRROR board (mirror-jtag.cfg). The mirror-jtag.cfg file is crucial for our purposes.

Here’s an example of what the mirror-jtag.cfg file might look like:

adapter driver ftdi
transport select jtag
ftdi vid_pid 0x0403 0x6010
ftdi channel 1
adapter speed 2000
ftdi layout_init 0x0038 0x003b
ftdi layout_signal nTRST -data 0x0010
ftdi layout_signal nSRST -data 0x0020
set CHIPNAME mimx8mm6dvtlzaa
set CHIPCORES 4     ;# adjust based on the silicon
source [find target/imx8m.cfg]
reset_config srst_only srst_pulls_trst

Step 4: Running OpenOCD To start, we need to turn on the board and run:

openocd -f tigard-jtag.cfg -f mirror-jtag.cfg

We then connect to the OpenOCD server using telenet 127.0.0.1 4444.

You can run targets command to see which available JTAG targets are there.

> targets
TargetName         Type       Endian TapName            State      
--  ------------------ ---------- ------ ------------------ ------------
 0* mimx8mm6dvtlzaa.a53.0 aarch64    little mimx8mm6dvtlzaa.cpu running
 1  mimx8mm6dvtlzaa.a53.1 aarch64    little mimx8mm6dvtlzaa.cpu examine deferred
 2  mimx8mm6dvtlzaa.a53.2 aarch64    little mimx8mm6dvtlzaa.cpu examine deferred
 3  mimx8mm6dvtlzaa.a53.3 aarch64    little mimx8mm6dvtlzaa.cpu examine deferred
 4  mimx8mm6dvtlzaa.m4 cortex_m   little mimx8mm6dvtlzaa.cpu examine deferred
 5  mimx8mm6dvtlzaa.ahb mem_ap     little mimx8mm6dvtlzaa.cpu running

Step 5: Dumping Memory Once connected we need to select the target: targets mimx8mm6dvtlzaa.ahb the ahb is a bridge to access the memory on the processor. Then we can dump memory using dump_image syntax is as follows:

dump_image ahb.dump 0x80000000 100

This will write the 100 bytes of dumped memory starting from 0x80000000 to a file named ahb.dump. Note that this process can be slow for large memory chunks.