imxrt: TRACE_ETM for RT1011 and RT1176, validate both boards

metro_m7_1011 (custom ETM-header rework): 500 MHz core, 66 MHz TRACECLK
width 4, +50 ps; trace_etm_init ungates the 132 MHz trace root that
BOARD_BootClockRUN leaves gated. mimxrt1170_evkb: 996 MHz CM7 at width 1,
CSTRACE pinned to 50 MHz (stock 132 corrupts - the Ethernet PHY loads the
CLK net) and the CM7 platform trace-funnel port enabled in firmware:
J-Link does not program that funnel and everything reads register-perfect
yet silent without it. FlexSPI boot needs the committed SP/PC hooks; D1-D3
stay dead pending the R1882-R1884 continuity check (width-4 TODO).

4 files changed, 138 insertions, 5 deletions

diff --git a/hw/bsp/imxrt/boards/metro_m7_1011/ozone/metro_m7_1011.jdebug b/hw/bsp/imxrt/boards/metro_m7_1011/ozone/metro_m7_1011.jdebug
index 90f9b77e5..fdb8b30a0 100644
--- a/hw/bsp/imxrt/boards/metro_m7_1011/ozone/metro_m7_1011.jdebug
+++ b/hw/bsp/imxrt/boards/metro_m7_1011/ozone/metro_m7_1011.jdebug
@@ -22,7 +22,7 @@ void OnProjectLoad (void) {
 
   // timing delay for trace pins in pico seconds, default is 2 nano seconds
 
-	File.Open ("../../../../../../examples/cmake-build-metro-m7-1011-sd/device/cdc_msc/cdc_msc.elf");
+	File.Open ("../../../../../../examples/cmake-build-metro_m7_1011/device/cdc_msc/cdc_msc.elf");
 }
 
 /*********************************************************************
diff --git a/hw/bsp/imxrt/boards/mimxrt1170_evkb/ozone/mimxrt1176.jdebug b/hw/bsp/imxrt/boards/mimxrt1170_evkb/ozone/mimxrt1176.jdebug
new file mode 100644
index 000000000..6931b9cd1
--- /dev/null
+++ b/hw/bsp/imxrt/boards/mimxrt1170_evkb/ozone/mimxrt1176.jdebug
@@ -0,0 +1,69 @@
+/*********************************************************************
+*
+*       OnProjectLoad
+*
+* Function description
+*   Project load routine. Required.
+*
+* Notes
+*   MIMXRT1170-EVKB trace requires board rework: the TRACE pads
+*   (GPIO_DISP_B2_02..06) are factory-wired to the ENET_1G PHY - populate
+*   0-ohm R1881-R1886 to route them to the Cortex Debug+ETM connector J58
+*   (EVKB Hardware User Guide 3.2).
+*   Firmware must be built with TRACE_ETM=1 (trace pad mux + CSTRACE clock
+*   + JTAG_nTRST/DMIC_DATA1 pad fix in board_init).
+*
+*   Validated: port width 1, 0 ns sample timing, 50 MHz CSTRACE root
+*   (25 MHz TRACE_CLK pin, set by trace_etm_init - the rework path corrupts
+*   at the stock 132 MHz root) while the CM7 runs 996 MHz. A startup-burst
+*   trace overflow is expected and benign; width 4 fails at any timing.
+*
+**********************************************************************
+*/
+void OnProjectLoad (void) {
+  // declares the CSSYS TPIU/funnel (system APB-AP, not in the CM7 ROM table)
+  Project.SetJLinkScript ("./mimxrt1176_trace.JLinkScript");
+  Project.SetTraceSource ("Trace Pins");
+  Project.SetTracePortWidth (1);
+  Project.SetTraceTiming (0, 0, 0, 0);
+  Project.SetSWO (0);
+  Edit.SysVar (VAR_TRACE_CORE_CLOCK, 996000000);
+  Project.AddSvdFile ("$(InstallDir)/Config/CPU/Cortex-M7F.svd");
+
+  Project.SetDevice ("MIMXRT1176xxxA_M7");
+  Project.SetHostIF ("USB", "");
+  Project.SetTargetIF ("SWD");
+  Project.SetTIFSpeed ("4 MHz");
+
+  File.Open ("../../../../../../examples/cmake-build-mimxrt1170_evkb/device/cdc_msc/cdc_msc.elf");
+}
+
+/*********************************************************************
+*
+*       AfterTargetReset
+*
+* Function description
+*   JTAG_nTRST shares its pad with DMIC_DATA1, which drives it low by
+*   default and kills ETM trace - mux the pad to GPIO before the app runs
+*   (EVKB Hardware User Guide 3.2). No SP/PC init here: the app boots from
+*   FlexSPI NOR, so the ROM bootloader must perform it (SEGGER wiki
+*   "i.MXRT1176" / NXP community solution for ERR050708 boards).
+*
+**********************************************************************
+*/
+void AfterTargetReset (void) {
+  Target.WriteU32 (0x40C08028, 0xA);   // IOMUXC GPIO_LPSR_10 -> GPIO12_IO10
+}
+
+/*********************************************************************
+*
+*       AfterTargetDownload
+*
+* Function description
+*   Intentionally empty: SP/PC init from the vector table would bypass the
+*   ROM bootloader's FlexSPI setup (see AfterTargetReset note).
+*
+**********************************************************************
+*/
+void AfterTargetDownload (void) {
+}
diff --git a/hw/bsp/imxrt/boards/mimxrt1170_evkb/ozone/mimxrt1176_trace.JLinkScript b/hw/bsp/imxrt/boards/mimxrt1170_evkb/ozone/mimxrt1176_trace.JLinkScript
new file mode 100644
index 000000000..ef39235d8
--- /dev/null
+++ b/hw/bsp/imxrt/boards/mimxrt1170_evkb/ozone/mimxrt1176_trace.JLinkScript
@@ -0,0 +1,11 @@
+/* RT1176 pin trace: the CSSYS TPIU and ATB funnel live on the system APB-AP
+ * (AP2) and are not discoverable from the CM7 ROM table - declare them, or
+ * J-Link aborts with "Required trace components for pin trace not found!"
+ * (addresses per i.MX RT1170 RM memory map: CSSYS TPIU E004_6000, CSSYS ATB
+ * Funnel E004_5000; same values as SEGGER's RT1176 trace example script).
+ */
+int ConfigTargetSettings(void) {
+  JLINK_ExecCommand("CORESIGHT_SetTPIUBaseAddr = 0xE0046000 ForceUnlock = 1 APIndex = 2");
+  JLINK_ExecCommand("CORESIGHT_SetCSTFBaseAddr = 0xE0045000 ForceUnlock = 1 APIndex = 2");
+  return 0;
+}
diff --git a/hw/bsp/imxrt/family.c b/hw/bsp/imxrt/family.c
index 9f3297e9a..e3ef6233c 100644
--- a/hw/bsp/imxrt/family.c
+++ b/hw/bsp/imxrt/family.c
@@ -106,6 +106,62 @@ static void init_usb_phy(uint8_t usb_id) {
   usb_phy->TX = phytx;
 }
 
+#ifdef TRACE_ETM
+static void trace_etm_init(void) {
+#if defined(CPU_MIMXRT1011DAE5A)
+  // Metro M7 rev A "ETM Trace" rework: 4-bit TRACE + TRACE_CLK on the added
+  // 2x10 header; the RT1011 has a single mux option per trace signal
+  IOMUXC_SetPinMux(IOMUXC_GPIO_AD_00_ARM_TRACE0, 0U);
+  IOMUXC_SetPinMux(IOMUXC_GPIO_13_ARM_TRACE1, 0U);
+  IOMUXC_SetPinMux(IOMUXC_GPIO_12_ARM_TRACE2, 0U);
+  IOMUXC_SetPinMux(IOMUXC_GPIO_11_ARM_TRACE3, 0U);
+  IOMUXC_SetPinMux(IOMUXC_GPIO_AD_02_ARM_TRACE_CLK, 0U);
+  // fast slew, max speed, high drive
+  IOMUXC_SetPinConfig(IOMUXC_GPIO_AD_00_ARM_TRACE0, 0x00F1U);
+  IOMUXC_SetPinConfig(IOMUXC_GPIO_13_ARM_TRACE1, 0x00F1U);
+  IOMUXC_SetPinConfig(IOMUXC_GPIO_12_ARM_TRACE2, 0x00F1U);
+  IOMUXC_SetPinConfig(IOMUXC_GPIO_11_ARM_TRACE3, 0x00F1U);
+  IOMUXC_SetPinConfig(IOMUXC_GPIO_AD_02_ARM_TRACE_CLK, 0x00F1U);
+
+  // TRACE_CLK_ROOT already runs 132 MHz (PLL2/4) from BOARD_BootClockRUN,
+  // which leaves it gated - just ungate
+  CLOCK_EnableClock(kCLOCK_Trace);
+#elif defined(CPU_MIMXRT1176DVMAA_cm7)
+  // JTAG_nTRST pad is shared with DMIC_DATA1 which drives it low by default and
+  // breaks ETM trace - switch the pad to GPIO (MIMXRT1170-EVKB HUG 3.2)
+  IOMUXC_SetPinMux(IOMUXC_GPIO_LPSR_10_GPIO12_IO10, 0U);
+
+  // TRACE0-3 + TRACE_CLK on GPIO_DISP_B2_02..06, fast slew + high drive
+  IOMUXC_SetPinMux(IOMUXC_GPIO_DISP_B2_02_ARM_TRACE00, 0U);
+  IOMUXC_SetPinMux(IOMUXC_GPIO_DISP_B2_03_ARM_TRACE01, 0U);
+  IOMUXC_SetPinMux(IOMUXC_GPIO_DISP_B2_04_ARM_TRACE02, 0U);
+  IOMUXC_SetPinMux(IOMUXC_GPIO_DISP_B2_05_ARM_TRACE03, 0U);
+  IOMUXC_SetPinMux(IOMUXC_GPIO_DISP_B2_06_ARM_TRACE_CLK, 0U);
+  IOMUXC_SetPinConfig(IOMUXC_GPIO_DISP_B2_02_ARM_TRACE00, IOMUXC_SW_PAD_CTL_PAD_DSE_MASK);
+  IOMUXC_SetPinConfig(IOMUXC_GPIO_DISP_B2_03_ARM_TRACE01, IOMUXC_SW_PAD_CTL_PAD_DSE_MASK);
+  IOMUXC_SetPinConfig(IOMUXC_GPIO_DISP_B2_04_ARM_TRACE02, IOMUXC_SW_PAD_CTL_PAD_DSE_MASK);
+  IOMUXC_SetPinConfig(IOMUXC_GPIO_DISP_B2_05_ARM_TRACE03, IOMUXC_SW_PAD_CTL_PAD_DSE_MASK);
+  IOMUXC_SetPinConfig(IOMUXC_GPIO_DISP_B2_06_ARM_TRACE_CLK, IOMUXC_SW_PAD_CTL_PAD_DSE_MASK);
+
+  // 50 MHz CSTRACE root (OscRc400M/8) -> 25 MHz TRACE_CLK pin (= root/2)
+  CLOCK_SetRootClockMux(kCLOCK_Root_Cstrace, kCLOCK_CSTRACE_ClockRoot_MuxOscRc400M);
+  CLOCK_SetRootClockDiv(kCLOCK_Root_Cstrace, 8);
+  CLOCK_EnableClock(kCLOCK_Cstrace);
+
+  // Enable the CM7 slave port on the platform trace funnel (E004_3000): the
+  // debugger only programs the CSSYS funnel/TPIU it was told about, and this
+  // in-between funnel resets with all ports disabled, silently eating the ETM
+  // stream. Core-side CoreSight accesses honor the lock, hence the LAR unlock.
+  *(volatile uint32_t *) 0xE0043FB0 = 0xC5ACCE55;
+  *(volatile uint32_t *) 0xE0043000 |= 1U;
+#else
+  #error "TRACE_ETM: no trace pin setup for this MCU variant"
+#endif
+}
+#else
+  #define trace_etm_init()
+#endif
+
 void board_init(void) {
 // make sure the dcache is on.
 #if defined(__DCACHE_PRESENT) && __DCACHE_PRESENT
@@ -119,10 +175,7 @@ void board_init(void) {
   SystemCoreClockUpdate();
 
   BOARD_ConfigMPU(); // defined in board.h
-
-#ifdef TRACE_ETM
-  //CLOCK_EnableClock(kCLOCK_Trace);
-#endif
+  trace_etm_init();
 
 #if CFG_TUSB_OS == OPT_OS_NONE
   // 1ms tick timer