1 /***************************************************************************
2 * Copyright (C) 2005 by Dominic Rath *
3 * Dominic.Rath@gmx.de *
5 * Copyright (C) 2007,2008 Øyvind Harboe *
6 * oyvind.harboe@zylin.com *
8 * This program is free software; you can redistribute it and/or modify *
9 * it under the terms of the GNU General Public License as published by *
10 * the Free Software Foundation; either version 2 of the License, or *
11 * (at your option) any later version. *
13 * This program is distributed in the hope that it will be useful, *
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
16 * GNU General Public License for more details. *
18 * You should have received a copy of the GNU General Public License *
19 * along with this program; if not, write to the *
20 * Free Software Foundation, Inc., *
21 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
22 ***************************************************************************/
26 #include "binarybuffer.h"
30 #ifdef _DEBUG_JTAG_IO_
31 #define DEBUG_JTAG_IO(expr ...) LOG_DEBUG(expr)
33 #define DEBUG_JTAG_IO(expr ...)
36 #ifndef DEBUG_JTAG_IOZ
37 #define DEBUG_JTAG_IOZ 64
40 /*-----<Macros>--------------------------------------------------*/
43 * When given an array, compute its DIMension; in other words, the
44 * number of elements in the array
46 #define DIM(x) (sizeof(x)/sizeof((x)[0]))
48 /** Calculate the number of bytes required to hold @a n TAP scan bits */
49 #define TAP_SCAN_BYTES(n) CEIL(n, 8)
51 /*-----</Macros>-------------------------------------------------*/
54 * Defines JTAG Test Access Port states.
56 * These definitions were gleaned from the ARM7TDMI-S Technical
57 * Reference Manual and validated against several other ARM core
58 * technical manuals. tap_get_tms_path() is sensitive to this numbering
59 * and ordering of the TAP states; furthermore, some interfaces require
60 * specific numbers be used, as they are handed-off directly to their
61 * hardware implementations.
63 typedef enum tap_state
66 /* These are the old numbers. Leave as-is for now... */
67 TAP_RESET
= 0, TAP_IDLE
= 8,
68 TAP_DRSELECT
= 1, TAP_DRCAPTURE
= 2, TAP_DRSHIFT
= 3, TAP_DREXIT1
= 4,
69 TAP_DRPAUSE
= 5, TAP_DREXIT2
= 6, TAP_DRUPDATE
= 7,
70 TAP_IRSELECT
= 9, TAP_IRCAPTURE
= 10, TAP_IRSHIFT
= 11, TAP_IREXIT1
= 12,
71 TAP_IRPAUSE
= 13, TAP_IREXIT2
= 14, TAP_IRUPDATE
= 15,
73 TAP_NUM_STATES
= 16, TAP_INVALID
= -1,
75 /* Proper ARM recommended numbers */
93 TAP_NUM_STATES
= 0x10,
100 * Function tap_state_name
101 * Returns a string suitable for display representing the JTAG tap_state
103 const char* tap_state_name(tap_state_t state
);
105 /// The current TAP state of the pending JTAG command queue.
106 extern tap_state_t cmd_queue_cur_state
;
109 * This structure defines a single scan field in the scan. It provides
110 * fields for the field's width and pointers to scan input and output
113 * In addition, this structure includes a value and mask that is used by
114 * jtag_add_dr_scan_check() to validate the value that was scanned out.
116 * The allocated, modified, and intmp fields are internal work space.
118 typedef struct scan_field_s
120 /// A pointer to the tap structure to which this field refers.
123 /// The number of bits this field specifies (up to 32)
125 /// A pointer to value to be scanned into the device
127 /// A pointer to a 32-bit memory location for data scanned out
130 /// The value used to check the data scanned out.
131 uint8_t* check_value
;
132 /// The mask to go with check_value
135 /// in_value has been allocated for the queue
137 /// Indicates we modified the in_value.
139 /// temporary storage for performing value checks synchronously
143 typedef struct jtag_tap_event_action_s jtag_tap_event_action_t
;
145 /* this is really: typedef jtag_tap_t */
146 /* But - the typedef is done in "types.h" */
147 /* due to "forward decloration reasons" */
152 const char* dotted_name
;
153 int abs_chain_position
;
154 /// Is this TAP disabled after JTAG reset?
155 bool disabled_after_reset
;
156 /// Is this TAP currently enabled?
158 int ir_length
; /**< size of instruction register */
159 uint32_t ir_capture_value
;
160 uint8_t* expected
; /**< Capture-IR expected value */
161 uint32_t ir_capture_mask
;
162 uint8_t* expected_mask
; /**< Capture-IR expected mask */
164 /**< device identification code */
166 /// Array of expected identification codes */
167 uint32_t* expected_ids
;
168 /// Number of expected identification codes
169 uint8_t expected_ids_cnt
;
171 /// current instruction
173 /// Bypass register selected
176 jtag_tap_event_action_t
*event_action
;
178 jtag_tap_t
* next_tap
;
181 void jtag_tap_init(jtag_tap_t
*tap
);
182 void jtag_tap_free(jtag_tap_t
*tap
);
184 extern jtag_tap_t
* jtag_all_taps(void);
185 extern const char *jtag_tap_name(const jtag_tap_t
*tap
);
186 extern jtag_tap_t
* jtag_tap_by_string(const char* dotted_name
);
187 extern jtag_tap_t
* jtag_tap_by_jim_obj(Jim_Interp
* interp
, Jim_Obj
* obj
);
188 extern jtag_tap_t
* jtag_tap_next_enabled(jtag_tap_t
* p
);
189 extern unsigned jtag_tap_count_enabled(void);
190 extern unsigned jtag_tap_count(void);
194 * There are three cases when JTAG_TRST_ASSERTED callback is invoked. The
195 * event is invoked *after* TRST is asserted(or queued rather). It is illegal
196 * to communicate with the JTAG interface during the callback(as there is
197 * currently a queue being built).
203 * TAP activation/deactivation is currently implemented outside the core
204 * using scripted code that understands the specific router type.
208 JTAG_TAP_EVENT_ENABLE
,
209 JTAG_TAP_EVENT_DISABLE
,
212 struct jtag_tap_event_action_s
214 enum jtag_event event
;
216 jtag_tap_event_action_t
* next
;
220 * Defines the function signature requide for JTAG event callback
221 * functions, which are added with jtag_register_event_callback()
222 * and removed jtag_unregister_event_callback().
223 * @param event The event to handle.
224 * @param prive A pointer to data that was passed to
225 * jtag_register_event_callback().
226 * @returns Must return ERROR_OK on success, or an error code on failure.
228 * @todo Change to return void or define a use for its return code.
230 typedef int (*jtag_event_handler_t
)(enum jtag_event event
, void* priv
);
232 extern int jtag_register_event_callback(jtag_event_handler_t f
, void *x
);
233 extern int jtag_unregister_event_callback(jtag_event_handler_t f
, void *x
);
235 extern int jtag_call_event_callbacks(enum jtag_event event
);
238 /// @returns The current JTAG speed setting.
239 int jtag_get_speed(void);
241 * Given a @a speed setting, use the interface @c speed_div callback to
242 * adjust the setting.
243 * @param speed The speed setting to convert back to readable KHz.
244 * @returns ERROR_OK if the interface has not been initialized or on success;
245 * otherwise, the error code produced by the @c speed_div callback.
247 int jtag_get_speed_readable(int *speed
);
249 * Set the JTAG speed. This routine will call the underlying
250 * interface @c speed callback, if the interface has been initialized.
251 * @param speed The new speed setting.
252 * @returns ERROR_OK during configuration or on success, or an error
253 * code returned from the interface @c speed callback.
255 int jtag_set_speed(int speed
);
258 /// Attempt to configure the interface for the specified KHz.
259 int jtag_config_khz(unsigned khz
);
260 /// Set the clock speed of the JTAG interface in KHz.
261 void jtag_set_speed_khz(unsigned speed
);
262 /// Retreives the clock speed of the JTAG interface in KHz.
263 unsigned jtag_get_speed_khz(void);
268 RESET_HAS_TRST
= 0x1,
269 RESET_HAS_SRST
= 0x2,
270 RESET_TRST_AND_SRST
= 0x3,
271 RESET_SRST_PULLS_TRST
= 0x4,
272 RESET_TRST_PULLS_SRST
= 0x8,
273 RESET_TRST_OPEN_DRAIN
= 0x10,
274 RESET_SRST_PUSH_PULL
= 0x20,
277 enum reset_types
jtag_get_reset_config(void);
278 void jtag_set_reset_config(enum reset_types type
);
280 void jtag_set_nsrst_delay(unsigned delay
);
281 unsigned jtag_get_nsrst_delay(void);
283 void jtag_set_ntrst_delay(unsigned delay
);
284 unsigned jtag_get_ntrst_delay(void);
286 /// @returns The current state of TRST.
287 int jtag_get_trst(void);
288 /// @returns The current state of SRST.
289 int jtag_get_srst(void);
291 /// Enable or disable data scan verification checking.
292 void jtag_set_verify(bool enable
);
293 /// @returns True if data scan verification will be performed.
294 bool jtag_will_verify(void);
296 /// Enable or disable verification of IR scan checking.
297 void jtag_set_verify_capture_ir(bool enable
);
298 /// @returns True if IR scan verification will be performed.
299 bool jtag_will_verify_capture_ir(void);
302 * Initialize interface upon startup. Return a successful no-op upon
303 * subsequent invocations.
305 extern int jtag_interface_init(struct command_context_s
* cmd_ctx
);
307 /// Shutdown the JTAG interface upon program exit.
308 extern int jtag_interface_quit(void);
311 * Initialize JTAG chain using only a RESET reset. If init fails,
314 extern int jtag_init(struct command_context_s
* cmd_ctx
);
316 /// reset, then initialize JTAG chain
317 extern int jtag_init_reset(struct command_context_s
* cmd_ctx
);
318 extern int jtag_register_commands(struct command_context_s
* cmd_ctx
);
322 * The JTAG interface can be implemented with a software or hardware fifo.
324 * TAP_DRSHIFT and TAP_IRSHIFT are illegal end states; however,
325 * TAP_DRSHIFT/IRSHIFT can be emulated as end states, by using longer
328 * Code that is relatively insensitive to the path taken through state
329 * machine (as long as it is JTAG compliant) can use @a endstate for
330 * jtag_add_xxx_scan(). Otherwise, the pause state must be specified as
331 * end state and a subsequent jtag_add_pathmove() must be issued.
335 * Generate an IR SCAN with a list of scan fields with one entry for
338 * If the input field list contains an instruction value for a TAP then
339 * that is used otherwise the TAP is set to bypass.
341 * TAPs for which no fields are passed are marked as bypassed for
342 * subsequent DR SCANs.
345 extern void jtag_add_ir_scan(int num_fields
, scan_field_t
* fields
, tap_state_t endstate
);
347 * The same as jtag_add_ir_scan except no verification is performed out
350 extern void jtag_add_ir_scan_noverify(int num_fields
, const scan_field_t
*fields
, tap_state_t state
);
352 * Duplicate the scan fields passed into the function into an IR SCAN
353 * command. This function assumes that the caller handles extra fields
356 extern void jtag_add_plain_ir_scan(int num_fields
, const scan_field_t
* fields
, tap_state_t endstate
);
360 * Set in_value to point to 32 bits of memory to scan into. This
361 * function is a way to handle the case of synchronous and asynchronous
364 * In the event of an asynchronous queue execution the queue buffer
365 * allocation method is used, for the synchronous case the temporary 32
366 * bits come from the input field itself.
368 extern void jtag_alloc_in_value32(scan_field_t
*field
);
371 * Generate a DR SCAN using the fields passed to the function.
372 * For connected TAPs, the function checks in_fields and uses fields
373 * specified there. For bypassed TAPs, the function generates a dummy
374 * 1-bit field. The bypass status of TAPs is set by jtag_add_ir_scan().
376 extern void jtag_add_dr_scan(int num_fields
, const scan_field_t
* fields
, tap_state_t endstate
);
377 /// A version of jtag_add_dr_scan() that uses the check_value/mask fields
378 extern void jtag_add_dr_scan_check(int num_fields
, scan_field_t
* fields
, tap_state_t endstate
);
380 * Duplicate the scan fields passed into the function into a DR SCAN
381 * command. Unlike jtag_add_dr_scan(), this function assumes that the
382 * caller handles extra fields for bypassed TAPs.
384 extern void jtag_add_plain_dr_scan(int num_fields
, const scan_field_t
* fields
, tap_state_t endstate
);
387 * Defines the type of data passed to the jtag_callback_t interface.
388 * The underlying type must allow storing an @c int or pointer type.
390 typedef intptr_t jtag_callback_data_t
;
393 * Defines a simple JTAG callback that can allow conversions on data
394 * scanned in from an interface.
396 * This callback should only be used for conversion that cannot fail.
397 * For conversion types or checks that can fail, use the more complete
398 * variant: jtag_callback_t.
400 typedef void (*jtag_callback1_t
)(jtag_callback_data_t data0
);
402 /// A simpler version of jtag_add_callback4().
403 extern void jtag_add_callback(jtag_callback1_t
, jtag_callback_data_t data0
);
408 * Defines the interface of the JTAG callback mechanism.
410 * @param in the pointer to the data clocked in
411 * @param data1 An integer big enough to use as an @c int or a pointer.
412 * @param data2 An integer big enough to use as an @c int or a pointer.
413 * @param data3 An integer big enough to use as an @c int or a pointer.
414 * @returns an error code
416 typedef int (*jtag_callback_t
)(jtag_callback_data_t data0
, jtag_callback_data_t data1
, jtag_callback_data_t data2
, jtag_callback_data_t data3
);
420 * This callback can be executed immediately the queue has been flushed.
422 * The JTAG queue can be executed synchronously or asynchronously.
423 * Typically for USB, the queue is executed asynchronously. For
424 * low-latency interfaces, the queue may be executed synchronously.
426 * The callback mechanism is very general and does not make many
427 * assumptions about what the callback does or what its arguments are.
428 * These callbacks are typically executed *after* the *entire* JTAG
429 * queue has been executed for e.g. USB interfaces, and they are
430 * guaranteeed to be invoked in the order that they were queued.
432 * If the execution of the queue fails before the callbacks, then --
433 * depending on driver implementation -- the callbacks may or may not be
434 * invoked. @todo Can we make this behavior consistent?
436 * The strange name is due to C's lack of overloading using function
439 * @param f The callback function to add.
440 * @param data0 Typically used to point to the data to operate on.
441 * Frequently this will be the data clocked in during a shift operation.
442 * @param data1 An integer big enough to use as an @c int or a pointer.
443 * @param data2 An integer big enough to use as an @c int or a pointer.
444 * @param data3 An integer big enough to use as an @c int or a pointer.
447 extern void jtag_add_callback4(jtag_callback_t f
, jtag_callback_data_t data0
,
448 jtag_callback_data_t data1
, jtag_callback_data_t data2
,
449 jtag_callback_data_t data3
);
453 * Run a TAP_RESET reset where the end state is TAP_RESET,
454 * regardless of the start state.
456 extern void jtag_add_tlr(void);
459 * Application code *must* assume that interfaces will
460 * implement transitions between states with different
461 * paths and path lengths through the state diagram. The
462 * path will vary across interface and also across versions
463 * of the same interface over time. Even if the OpenOCD code
464 * is unchanged, the actual path taken may vary over time
465 * and versions of interface firmware or PCB revisions.
467 * Use jtag_add_pathmove() when specific transition sequences
470 * Do not use jtag_add_pathmove() unless you need to, but do use it
473 * DANGER! If the target is dependent upon a particular sequence
474 * of transitions for things to work correctly(e.g. as a workaround
475 * for an errata that contradicts the JTAG standard), then pathmove
476 * must be used, even if some jtag interfaces happen to use the
477 * desired path. Worse, the jtag interface used for testing a
478 * particular implementation, could happen to use the "desired"
479 * path when transitioning to/from end
482 * A list of unambigious single clock state transitions, not
483 * all drivers can support this, but it is required for e.g.
484 * XScale and Xilinx support
486 * Note! TAP_RESET must not be used in the path!
488 * Note that the first on the list must be reachable
489 * via a single transition from the current state.
491 * All drivers are required to implement jtag_add_pathmove().
492 * However, if the pathmove sequence can not be precisely
493 * executed, an interface_jtag_add_pathmove() or jtag_execute_queue()
494 * must return an error. It is legal, but not recommended, that
495 * a driver returns an error in all cases for a pathmove if it
496 * can only implement a few transitions and therefore
497 * a partial implementation of pathmove would have little practical
500 * If an error occurs, jtag_error will contain one of these error codes:
501 * - ERROR_JTAG_NOT_STABLE_STATE -- The final state was not stable.
502 * - ERROR_JTAG_STATE_INVALID -- The path passed through TAP_RESET.
503 * - ERROR_JTAG_TRANSITION_INVALID -- The path includes invalid
506 extern void jtag_add_pathmove(int num_states
, const tap_state_t
* path
);
509 * jtag_add_statemove() moves from the current state to @a goal_state.
511 * @param goal_state The final TAP state.
512 * @return ERROR_OK on success, or an error code on failure.
514 * Moves from the current state to the goal \a state.
516 * This needs to be handled according to the xsvf spec, see the XSTATE
517 * command description. From the XSVF spec, pertaining to XSTATE:
519 * For special states known as stable states (Test-Logic-Reset,
520 * Run-Test/Idle, Pause-DR, Pause- IR), an XSVF interpreter follows
521 * predefined TAP state paths when the starting state is a stable state
522 * and when the XSTATE specifies a new stable state. See the STATE
523 * command in the [Ref 5] for the TAP state paths between stable
526 * For non-stable states, XSTATE should specify a state that is only one
527 * TAP state transition distance from the current TAP state to avoid
528 * undefined TAP state paths. A sequence of multiple XSTATE commands can
529 * be issued to transition the TAP through a specific state path.
531 * @note Unless @c tms_bits holds a path that agrees with [Ref 5] in the
532 * above spec, then this code is not fully conformant to the xsvf spec.
533 * This puts a burden on tap_get_tms_path() function from the xsvf spec.
534 * If in doubt, you should confirm that that burden is being met.
536 * Otherwise, @a goal_state must be immediately reachable in one clock
537 * cycle, and does not need to be a stable state.
539 extern int jtag_add_statemove(tap_state_t goal_state
);
542 * Goes to TAP_IDLE (if we're not already there), cycle
543 * precisely num_cycles in the TAP_IDLE state, after which move
544 * to @a endstate (unless it is also TAP_IDLE).
546 * @param num_cycles Number of cycles in TAP_IDLE state. This argument
547 * may be 0, in which case this routine will navigate to @a endstate
549 * @param endstate The final state.
551 extern void jtag_add_runtest(int num_cycles
, tap_state_t endstate
);
554 * A reset of the TAP state machine can be requested.
556 * Whether tms or trst reset is used depends on the capabilities of
557 * the target and jtag interface(reset_config command configures this).
559 * srst can driver a reset of the TAP state machine and vice
562 * Application code may need to examine value of jtag_reset_config
563 * to determine the proper codepath
565 * DANGER! Even though srst drives trst, trst might not be connected to
566 * the interface, and it might actually be *harmful* to assert trst in this case.
568 * This is why combinations such as "reset_config srst_only srst_pulls_trst"
571 * only req_tlr_or_trst and srst can have a transition for a
572 * call as the effects of transitioning both at the "same time"
573 * are undefined, but when srst_pulls_trst or vice versa,
574 * then trst & srst *must* be asserted together.
576 extern void jtag_add_reset(int req_tlr_or_trst
, int srst
);
580 * Function jtag_set_end_state
582 * Set a global variable to \a state if \a state != TAP_INVALID.
584 * Return the value of the global variable.
587 extern tap_state_t
jtag_set_end_state(tap_state_t state
);
589 * Function jtag_get_end_state
591 * Return the value of the global variable for end state
594 extern tap_state_t
jtag_get_end_state(void);
595 extern void jtag_add_sleep(uint32_t us
);
599 * Function jtag_add_stable_clocks
600 * first checks that the state in which the clocks are to be issued is
601 * stable, then queues up clock_count clocks for transmission.
603 void jtag_add_clocks(int num_cycles
);
607 * For software FIFO implementations, the queued commands can be executed
608 * during this call or earlier. A sw queue might decide to push out
609 * some of the jtag_add_xxx() operations once the queue is "big enough".
611 * This fn will return an error code if any of the prior jtag_add_xxx()
612 * calls caused a failure, e.g. check failure. Note that it does not
613 * matter if the operation was executed *before* jtag_execute_queue(),
614 * jtag_execute_queue() will still return an error code.
616 * All jtag_add_xxx() calls that have in_handler != NULL will have been
617 * executed when this fn returns, but if what has been queued only
618 * clocks data out, without reading anything back, then JTAG could
619 * be running *after* jtag_execute_queue() returns. The API does
620 * not define a way to flush a hw FIFO that runs *after*
621 * jtag_execute_queue() returns.
623 * jtag_add_xxx() commands can either be executed immediately or
624 * at some time between the jtag_add_xxx() fn call and jtag_execute_queue().
626 extern int jtag_execute_queue(void);
628 /// same as jtag_execute_queue() but does not clear the error flag
629 extern void jtag_execute_queue_noclear(void);
631 /// @returns the number of times the scan queue has been flushed
632 int jtag_get_flush_queue_count(void);
635 /* can be implemented by hw + sw */
636 extern int jtag_power_dropout(int* dropout
);
637 extern int jtag_srst_asserted(int* srst_asserted
);
639 /* JTAG support functions */
642 * Execute jtag queue and check value with an optional mask.
643 * @param field Pointer to scan field.
644 * @param value Pointer to scan value.
645 * @param mask Pointer to scan mask; may be NULL.
646 * @returns Nothing, but calls jtag_set_error() on any error.
648 extern void jtag_check_value_mask(scan_field_t
*field
, uint8_t *value
, uint8_t *mask
);
650 extern void jtag_sleep(uint32_t us
);
653 * The JTAG subsystem defines a number of error codes,
654 * using codes between -100 and -199.
656 #define ERROR_JTAG_INIT_FAILED (-100)
657 #define ERROR_JTAG_INVALID_INTERFACE (-101)
658 #define ERROR_JTAG_NOT_IMPLEMENTED (-102)
659 #define ERROR_JTAG_TRST_ASSERTED (-103)
660 #define ERROR_JTAG_QUEUE_FAILED (-104)
661 #define ERROR_JTAG_NOT_STABLE_STATE (-105)
662 #define ERROR_JTAG_DEVICE_ERROR (-107)
663 #define ERROR_JTAG_STATE_INVALID (-108)
664 #define ERROR_JTAG_TRANSITION_INVALID (-109)
667 * jtag_add_dr_out() is a version of jtag_add_dr_scan() which
668 * only scans data out. It operates on 32 bit integers instead
669 * of 8 bit, which makes it a better impedance match with
670 * the calling code which often operate on 32 bit integers.
672 * Current or end_state can not be TAP_RESET. end_state can be TAP_INVALID
674 * num_bits[i] is the number of bits to clock out from value[i] LSB first.
676 * If the device is in bypass, then that is an error condition in
677 * the caller code that is not detected by this fn, whereas
678 * jtag_add_dr_scan() does detect it. Similarly if the device is not in
679 * bypass, data must be passed to it.
681 * If anything fails, then jtag_error will be set and jtag_execute() will
682 * return an error. There is no way to determine if there was a failure
683 * during this function call.
685 * This is an inline fn to speed up embedded hosts. Also note that
686 * interface_jtag_add_dr_out() can be a *small* inline function for
689 * There is no jtag_add_dr_outin() version of this fn that also allows
690 * clocking data back in. Patches gladly accepted!
692 extern void jtag_add_dr_out(jtag_tap_t
* tap
,
693 int num_fields
, const int* num_bits
, const uint32_t* value
,
694 tap_state_t end_state
);
698 * Set the current JTAG core execution error, unless one was set
699 * by a previous call previously. Driver or application code must
700 * use jtag_error_clear to reset jtag_error once this routine has been
701 * called with a non-zero error code.
703 void jtag_set_error(int error
);
704 /// @returns The current value of jtag_error
705 int jtag_get_error(void);
707 * Resets jtag_error to ERROR_OK, returning its previous value.
708 * @returns The previous value of @c jtag_error.
710 int jtag_error_clear(void);