RP2350 XIP Cache not re-enabled after flash loader

    This site uses cookies. By continuing to browse this site, you are agreeing to our Cookie Policy.

    • RP2350 XIP Cache not re-enabled after flash loader

      J-Link Version info:

      Source Code

      1. SEGGER J-Link Commander V8.24 (Compiled Mar 26 2025 15:34:49)
      2. DLL version V8.24, compiled Mar 26 2025 15:33:55
      4. Connecting to J-Link via USB...O.K.
      5. Firmware: J-Link V11 compiled Feb 20 2025 16:24:17
      6. Hardware version: V11.00

      Hardware used: Raspberry Pi Pico 2 (ARM mode)

      I noticed a drastic loss of performance when debugging with J-Link that went away if I simply reset the MCU after flashing and attached to the running program.
      I eventually narrowed it down to the XIP Cache being disabled and I think the following shows the problem using just J-Link Commander.

      Given the following JLinkScript:

      C Source Code: testxip.jlinkscript

      1. __constant U32 XIP_CTRL = 0x400C8000;
      3. void XIPCheck(void)
      4. {
      5. U32 value;
      6. value = JLINK_MEM_ReadU32(XIP_CTRL);
      7. JLINK_SYS_Report1("XIP_CTRL = ", value);
      8. }
      10. int HandleBeforeFlashProg(void) { XIPCheck(); return 0; }
      11. int HandleAfterFlashProg(void) { XIPCheck(); return 0; }
      12. int AfterResetTarget(void) { XIPCheck(); return 0; }
      Display All
      Connecting to the board after powering it up, you can see this register isn't reset to the power on default after the flash program has finished:

      Source Code

      1. Type "connect" to establish a target connection, '?' for help
      2. J-Link>con
      3. Please specify device / core. <Default>: RP2350_M33_0
      4. Type '?' for selection dialog
      5. Device>
      6. Please specify target interface:
      7. J) JTAG (Default)
      8. S) SWD
      9. T) cJTAG
      10. TIF>s
      11. Specify target interface speed [kHz]. <Default>: 4000 kHz
      12. Speed>
      13. Device "RP2350_M33_0" selected.
      16. Connecting to target via SWD
      17. ConfigTargetSettings() start
      18. ConfigTargetSettings() end - Took 44us
      19. InitTarget() start
      20. InitTarget() end - Took 12.6ms
      21. Found SW-DP with ID 0x4C013477
      22. DPIDR: 0x4C013477
      23. CoreSight SoC-600 or later (DPv3 detected)
      24. AP map detection skipped. User specified AP map and usage.
      25. AP[0]: Core found
      26. AP[0]: AHB-AP ROM base: 0xE00FF000
      27. CPUID register: 0x411FD210. Implementer code: 0x41 (ARM)
      28. Feature set: Mainline
      29. Cache: No cache
      30. Found Cortex-M33 r1p0, Little endian.
      31. FPUnit: 8 code (BP) slots and 0 literal slots
      32. Security extension: implemented
      33. Secure debug: enabled
      34. CoreSight components:
      35. ROMTbl[0] @ E00FF000
      36. [0][0]: E000E000 CID B105900D PID 000BBD21 DEVARCH 47702A04 DEVTYPE 00 Cortex-M33
      37. [0][1]: E0001000 CID B105900D PID 000BBD21 DEVARCH 47701A02 DEVTYPE 00 DWT
      38. [0][2]: E0002000 CID B105900D PID 000BBD21 DEVARCH 47701A03 DEVTYPE 00 FPB
      39. [0][3]: E0000000 CID B105900D PID 000BBD21 DEVARCH 47701A01 DEVTYPE 43 ITM
      40. [0][5]: E0041000 CID B105900D PID 002BBD21 DEVARCH 47724A13 DEVTYPE 13 ETM
      41. [0][6]: E0042000 CID B105900D PID 000BBD21 DEVARCH 47701A14 DEVTYPE 14 CSS600-CTI
      42. Memory zones:
      43. Zone: "Default" Description: Default access mode
      44. Cortex-M33 identified.
      45. J-Link>reset
      46. Reset delay: 0 ms
      47. Reset type: NORMAL (https://wiki.segger.com/J-Link_Reset_Strategies)
      48. Reset: ARMv8M core with Security Extension enabled detected. Switch to secure domain.
      49. Reset: Halt core after reset via DEMCR.VC_CORERESET.
      50. Reset: Reset device via AIRCR.SYSRESETREQ.
      51. AfterResetTarget() start
      52. XIP_CTRL = 0x00000083
      53. AfterResetTarget() end - Took 2.04ms
      54. J-Link>erase
      55. No address range specified, 'Erase Chip' will be executed
      56. 'erase': Performing implicit reset & halt of MCU.
      57. Reset type: NORMAL (https://wiki.segger.com/J-Link_Reset_Strategies)
      58. Reset: ARMv8M core with Security Extension enabled detected. Switch to secure domain.
      59. Reset: Halt core after reset via DEMCR.VC_CORERESET.
      60. Reset: Reset device via AIRCR.SYSRESETREQ.
      61. AfterResetTarget() start
      62. XIP_CTRL = 0x00000083
      63. AfterResetTarget() end - Took 2.55ms
      64. Erasing device...
      65. HandleBeforeFlashProg() start
      66. XIP_CTRL = 0x00000083
      67. HandleBeforeFlashProg() end - Took 2.80ms
      68. J-Link: Flash download: Total time needed: 1.752s (Prepare: 0.173s, Compare: 0.000s, Erase: 1.486s, Program: 0.000s, Verify: 0.000s, Restore: 0.092s)
      69. HandleAfterFlashProg() start
      70. XIP_CTRL = 0x00000000
      71. HandleAfterFlashProg() end - Took 2.72ms
      72. Erasing done.
      Display All
      Here's where the SDK defines the reset value for this register:

      C Source Code: pico-sdk\src\rp2350\hardware_regs\include\hardware\regs\xip.h

      1. // Register : XIP_CTRL
      2. // Description : Cache control register. Read-only from a Non-secure context.
      3. #define XIP_CTRL_OFFSET _u(0x00000000)
      4. #define XIP_CTRL_BITS _u(0x00000ffb)
      5. #define XIP_CTRL_RESET _u(0x00000083)
      See also section 4.4.5 of the RP2350 datasheet.

      I did notice a few other peripheral registers didn't match their power on defaults.
      Apart from the XIP Cache control register, the differences seem benign but I'm listing them for completeness.
      Peripheral
      		 Register
      		 Address
      		 Value after power on
      		 Value after download
      		 Notes
      PPB
      		 FP_CTRL
      		 0xE0002000
      		 0x10000080
      		 0x10000081
      		 Enable flag
      OTP
      		 INTR
      		 0x40120164
      		 0x00000000
      		 0x00000010
      		 Inconsistent repro
      POWMAN
      		 STATE
      		 0x40100038
      		 0x00000000
      		 0x00000100
      		 Req ignored
      POWMAN
      		 INTR
      		 0x401000E0
      		 0x00000000
      		 0x00000004
      		 Req ignored
      WATCHDOG
      		 CTRL
      		 0x400D8000
      		 0x07000000
      		 0x07FFFFFF
      		 Timer value, harmless?
      XIP_CTRL
      		 CTRL
      		 0x400C8000
      		 0x00000083
      		 0x00000000
      		 See above



      These were found by running a simple "while(1);" firmware, dumping all the registers with Ozone, comparing and filtering out the non-deterministic registers.

      Please let me know if you need more information!