1 /***************************************************************************
2 * Copyright (C) 2005 by Dominic Rath *
3 * Dominic.Rath@gmx.de *
5 * Copyright (C) 2007,2008 Øyvind Harboe *
6 * oyvind.harboe@zylin.com *
8 * This program is free software; you can redistribute it and/or modify *
9 * it under the terms of the GNU General Public License as published by *
10 * the Free Software Foundation; either version 2 of the License, or *
11 * (at your option) any later version. *
13 * This program is distributed in the hope that it will be useful, *
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
16 * GNU General Public License for more details. *
18 * You should have received a copy of the GNU General Public License *
19 * along with this program; if not, write to the *
20 * Free Software Foundation, Inc., *
21 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
22 ***************************************************************************/
27 #include "binarybuffer.h"
33 #ifdef _DEBUG_JTAG_IO_
34 #define DEBUG_JTAG_IO(expr ...) LOG_DEBUG(expr)
36 #define DEBUG_JTAG_IO(expr ...)
39 #ifndef DEBUG_JTAG_IOZ
40 #define DEBUG_JTAG_IOZ 64
45 * Tap states from ARM7TDMI-S Technical reference manual.
46 * Also, validated against several other ARM core technical manuals.
48 * N.B. tap_get_tms_path() was changed to reflect this corrected
49 * numbering and ordering of the TAP states.
51 * DANGER!!!! some interfaces care about the actual numbers used
52 * as they are handed off directly to hardware implementations.
55 typedef enum tap_state
58 /* These are the old numbers. Leave as-is for now... */
59 TAP_RESET = 0, TAP_IDLE = 8,
60 TAP_DRSELECT = 1, TAP_DRCAPTURE = 2, TAP_DRSHIFT = 3, TAP_DREXIT1 = 4,
61 TAP_DRPAUSE = 5, TAP_DREXIT2 = 6, TAP_DRUPDATE = 7,
62 TAP_IRSELECT = 9, TAP_IRCAPTURE = 10, TAP_IRSHIFT = 11, TAP_IREXIT1 = 12,
63 TAP_IRPAUSE = 13, TAP_IREXIT2 = 14, TAP_IRUPDATE = 15,
65 TAP_NUM_STATES = 16, TAP_INVALID = -1,
67 /* Proper ARM recommended numbers */
85 TAP_NUM_STATES = 0x10,
91 typedef struct tap_transition_s
97 //extern tap_transition_t tap_transitions[16]; /* describe the TAP state diagram */
100 /*-----<Cable Helper API>-------------------------------------------*/
102 /* The "Cable Helper API" is what the cable drivers can use to help implement
103 * their "Cable API". So a Cable Helper API is a set of helper functions used by
104 * cable drivers, and this is different from a Cable API. A "Cable API" is what
105 * higher level code used to talk to a cable.
109 /** implementation of wrapper function tap_set_state() */
110 void tap_set_state_impl(tap_state_t new_state);
113 * Function tap_set_state
114 * sets the state of a "state follower" which tracks the state of the TAPs connected to the
115 * cable. The state follower is hopefully always in the same state as the actual
116 * TAPs in the jtag chain, and will be so if there are no bugs in the tracking logic within that
117 * cable driver. All the cable drivers call this function to indicate the state they think
118 * the TAPs attached to their cables are in. Because this function can also log transitions,
119 * it will be helpful to call this function with every transition that the TAPs being manipulated
120 * are expected to traverse, not just end points of a multi-step state path.
121 * @param new_state is the state we think the TAPs are currently in or are about to enter.
123 #if defined(_DEBUG_JTAG_IO_)
124 #define tap_set_state(new_state) \
126 LOG_DEBUG( "tap_set_state(%s)", tap_state_name(new_state) ); \
127 tap_set_state_impl(new_state); \
130 static inline void tap_set_state(tap_state_t new_state)
132 tap_set_state_impl(new_state);
138 * Function tap_get_state
139 * gets the state of the "state follower" which tracks the state of the TAPs connected to
142 * @return tap_state_t - The state the TAPs are in now.
144 tap_state_t tap_get_state(void);
147 * Function tap_set_end_state
148 * sets the state of an "end state follower" which tracks the state that any cable driver
149 * thinks will be the end (resultant) state of the current TAP SIR or SDR operation. At completion
150 * of that TAP operation this value is copied into the state follower via tap_set_state().
151 * @param new_end_state is that state the TAPs should enter at completion of a pending TAP operation.
153 void tap_set_end_state(tap_state_t new_end_state);
156 * Function tap_get_end_state
157 * @see tap_set_end_state
158 * @return tap_state_t - The state the TAPs should be in at completion of the current TAP operation.
160 tap_state_t tap_get_end_state(void);
163 * Function tap_get_tms_path
164 * returns a 7 bit long "bit sequence" indicating what has to be done with TMS
165 * during a sequence of seven TAP clock cycles in order to get from
166 * state \a "from" to state \a "to".
167 * @param from is the starting state
168 * @param to is the resultant or final state
169 * @return int - a 7 bit sequence, with the first bit in the sequence at bit 0.
171 int tap_get_tms_path(tap_state_t from, tap_state_t to);
174 * Function tap_move_ndx
175 * when given a stable state, returns an index from 0-5. The index corresponds to a
176 * sequence of stable states which are given in this order: <p>
177 * { TAP_RESET, TAP_IDLE, TAP_DRSHIFT, TAP_DRPAUSE, TAP_IRSHIFT, TAP_IRPAUSE }
179 * This sequence corresponds to look up tables which are used in some of the
181 * @param astate is the stable state to find in the sequence. If a non stable
182 * state is passed, this may cause the program to output an error message
184 * @return int - the array (or sequence) index as described above
186 int tap_move_ndx(tap_state_t astate);
189 * Function tap_is_state_stable
190 * returns true if the \a astate is stable.
192 bool tap_is_state_stable(tap_state_t astate);
195 * Function tap_state_transition
196 * takes a current TAP state and returns the next state according to the tms value.
197 * @param current_state is the state of a TAP currently.
198 * @param tms is either zero or non-zero, just like a real TMS line in a jtag interface.
199 * @return tap_state_t - the next state a TAP would enter.
201 tap_state_t tap_state_transition(tap_state_t current_state, bool tms);
204 * Function tap_state_name
205 * Returns a string suitable for display representing the JTAG tap_state
207 const char* tap_state_name(tap_state_t state);
209 #ifdef _DEBUG_JTAG_IO_
211 * @brief Prints verbose TAP state transitions for the given TMS/TDI buffers.
212 * @param tms_buf must points to a buffer containing the TMS bitstream.
213 * @param tdi_buf must points to a buffer containing the TDI bitstream.
214 * @param tap_len must specify the length of the TMS/TDI bitstreams.
215 * @param start_tap_state must specify the current TAP state.
216 * @returns the final TAP state; pass as @a start_tap_state in following call.
218 tap_state_t jtag_debug_state_machine(const void *tms_buf, const void *tdi_buf,
219 unsigned tap_len, tap_state_t start_tap_state);
221 static inline tap_state_t jtag_debug_state_machine(const void *tms_buf,
222 const void *tdi_buf, unsigned tap_len, tap_state_t start_tap_state)
224 return start_tap_state;
226 #endif // _DEBUG_JTAG_IO_
228 /*-----</Cable Helper API>------------------------------------------*/
231 extern tap_state_t cmd_queue_end_state; /* finish DR scans in dr_end_state */
232 extern tap_state_t cmd_queue_cur_state; /* current TAP state */
234 typedef void* error_handler_t; /* Later on we can delete error_handler_t, but keep it for now to make patches more readable */
237 typedef int (*in_handler_t)(u8* in_value, void* priv, struct scan_field_s* field);
239 /// @brief calculates number of bytes required to hold @a n TAP scan bits
240 #define TAP_SCAN_BYTES(n) (((n) / 8) + !!((n) % 8))
242 typedef struct scan_field_s
244 jtag_tap_t* tap; /* tap pointer this instruction refers to */
245 int num_bits; /* number of bits this field specifies (up to 32) */
246 u8* out_value; /* value to be scanned into the device */
247 u8* out_mask; /* only masked bits care */
248 u8* in_value; /* pointer to a 32-bit memory location to take data scanned out */
249 /* in_check_value/mask, in_handler_error_handler, in_handler_priv can be used by the in handler, otherwise they contain garbage */
250 u8* in_check_value; /* used to validate scan results */
251 u8* in_check_mask; /* check specified bits against check_value */
252 in_handler_t in_handler; /* process received buffer using this handler */
253 void* in_handler_priv; /* additional information for the in_handler */
257 /* IN: from device to host, OUT: from host to device */
258 SCAN_IN = 1, SCAN_OUT = 2, SCAN_IO = 3
261 typedef struct scan_command_s
263 int ir_scan; /* instruction/not data scan */
264 int num_fields; /* number of fields in *fields array */
265 scan_field_t* fields; /* pointer to an array of data scan fields */
266 tap_state_t end_state; /* TAP state in which JTAG commands should finish */
269 typedef struct statemove_command_s
271 tap_state_t end_state; /* TAP state in which JTAG commands should finish */
272 } statemove_command_t;
274 typedef struct pathmove_command_s
276 int num_states; /* number of states in *path */
277 tap_state_t* path; /* states that have to be passed */
278 } pathmove_command_t;
280 typedef struct runtest_command_s
282 int num_cycles; /* number of cycles that should be spent in Run-Test/Idle */
283 tap_state_t end_state; /* TAP state in which JTAG commands should finish */
287 typedef struct stableclocks_command_s
289 int num_cycles; /* number of clock cycles that should be sent */
290 } stableclocks_command_t;
293 typedef struct reset_command_s
295 int trst; /* trst/srst 0: deassert, 1: assert, -1: don't change */
299 typedef struct end_state_command_s
301 tap_state_t end_state; /* TAP state in which JTAG commands should finish */
302 } end_state_command_t;
304 typedef struct sleep_command_s
306 u32 us; /* number of microseconds to sleep */
309 typedef union jtag_command_container_u
311 scan_command_t* scan;
312 statemove_command_t* statemove;
313 pathmove_command_t* pathmove;
314 runtest_command_t* runtest;
315 stableclocks_command_t* stableclocks;
316 reset_command_t* reset;
317 end_state_command_t* end_state;
318 sleep_command_t* sleep;
319 } jtag_command_container_t;
321 enum jtag_command_type {
329 JTAG_STABLECLOCKS = 8
332 typedef struct jtag_command_s
334 jtag_command_container_t cmd;
335 enum jtag_command_type type;
336 struct jtag_command_s* next;
339 extern jtag_command_t* jtag_command_queue;
341 /* forward declaration */
342 typedef struct jtag_tap_event_action_s jtag_tap_event_action_t;
344 /* this is really: typedef jtag_tap_t */
345 /* But - the typedef is done in "types.h" */
346 /* due to "forward decloration reasons" */
351 const char* dotted_name;
352 int abs_chain_position;
354 int ir_length; /* size of instruction register */
355 u32 ir_capture_value;
356 u8* expected; /* Capture-IR expected value */
358 u8* expected_mask; /* Capture-IR expected mask */
359 u32 idcode; /* device identification code */
360 u32* expected_ids; /* Array of expected identification codes */
361 u8 expected_ids_cnt; /* Number of expected identification codes */
362 u8* cur_instr; /* current instruction */
363 int bypass; /* bypass register selected */
365 jtag_tap_event_action_t* event_action;
367 jtag_tap_t* next_tap;
369 extern jtag_tap_t* jtag_AllTaps(void);
370 extern jtag_tap_t* jtag_TapByPosition(int n);
371 extern jtag_tap_t* jtag_TapByPosition(int n);
372 extern jtag_tap_t* jtag_TapByString(const char* dotted_name);
373 extern jtag_tap_t* jtag_TapByJimObj(Jim_Interp* interp, Jim_Obj* obj);
374 extern jtag_tap_t* jtag_TapByAbsPosition(int abs_position);
375 extern int jtag_NumEnabledTaps(void);
376 extern int jtag_NumTotalTaps(void);
378 static __inline__ jtag_tap_t* jtag_NextEnabledTap(jtag_tap_t* p)
382 /* start at the head of list */
387 /* start *after* this one */
406 enum reset_line_mode {
407 LINE_OPEN_DRAIN = 0x0,
408 LINE_PUSH_PULL = 0x1,
411 typedef struct jtag_interface_s
415 /* queued command execution
417 int (*execute_queue)(void);
419 /* interface initalization
421 int (*speed)(int speed);
422 int (*register_commands)(struct command_context_s* cmd_ctx);
426 /* returns JTAG maxium speed for KHz. 0=RTCK. The function returns
427 * a failure if it can't support the KHz/RTCK.
429 * WARNING!!!! if RTCK is *slow* then think carefully about
430 * whether you actually want to support this in the driver.
431 * Many target scripts are written to handle the absence of RTCK
432 * and use a fallback kHz TCK.
434 int (*khz)(int khz, int* jtag_speed);
436 /* returns the KHz for the provided JTAG speed. 0=RTCK. The function returns
437 * a failure if it can't support the KHz/RTCK. */
438 int (*speed_div)(int speed, int* khz);
440 /* Read and clear the power dropout flag. Note that a power dropout
441 * can be transitionary, easily much less than a ms.
443 * So to find out if the power is *currently* on, you must invoke
444 * this method twice. Once to clear the power dropout flag and a
445 * second time to read the current state.
447 * Currently the default implementation is never to detect power dropout.
449 int (*power_dropout)(int* power_dropout);
451 /* Read and clear the srst asserted detection flag.
453 * NB!!!! like power_dropout this does *not* read the current
454 * state. srst assertion is transitionary and *can* be much
457 int (*srst_asserted)(int* srst_asserted);
464 extern char* jtag_event_strings[];
466 enum jtag_tap_event {
467 JTAG_TAP_EVENT_ENABLE,
468 JTAG_TAP_EVENT_DISABLE
471 extern const Jim_Nvp nvp_jtag_tap_event[];
473 struct jtag_tap_event_action_s
475 enum jtag_tap_event event;
477 jtag_tap_event_action_t* next;
480 extern int jtag_trst;
481 extern int jtag_srst;
483 typedef struct jtag_event_callback_s
485 int (*callback)(enum jtag_event event, void* priv);
487 struct jtag_event_callback_s* next;
488 } jtag_event_callback_t;
490 extern jtag_event_callback_t* jtag_event_callbacks;
492 extern jtag_interface_t* jtag; /* global pointer to configured JTAG interface */
494 extern int jtag_speed;
495 extern int jtag_speed_post_reset;
499 RESET_HAS_TRST = 0x1,
500 RESET_HAS_SRST = 0x2,
501 RESET_TRST_AND_SRST = 0x3,
502 RESET_SRST_PULLS_TRST = 0x4,
503 RESET_TRST_PULLS_SRST = 0x8,
504 RESET_TRST_OPEN_DRAIN = 0x10,
505 RESET_SRST_PUSH_PULL = 0x20,
508 extern enum reset_types jtag_reset_config;
510 /* initialize interface upon startup. A successful no-op
511 * upon subsequent invocations
513 extern int jtag_interface_init(struct command_context_s* cmd_ctx);
515 /* initialize JTAG chain using only a RESET reset. If init fails,
518 extern int jtag_init(struct command_context_s* cmd_ctx);
520 /* reset, then initialize JTAG chain */
521 extern int jtag_init_reset(struct command_context_s* cmd_ctx);
522 extern int jtag_register_commands(struct command_context_s* cmd_ctx);
524 /* JTAG interface, can be implemented with a software or hardware fifo
526 * TAP_DRSHIFT and TAP_IRSHIFT are illegal end states. TAP_DRSHIFT/IRSHIFT as end states
527 * can be emulated by using a larger scan.
529 * Code that is relatively insensitive to the path(as long
530 * as it is JTAG compliant) taken through state machine can use
531 * endstate for jtag_add_xxx_scan(). Otherwise the pause state must be
532 * specified as end state and a subsequent jtag_add_pathmove() must
536 extern void jtag_add_ir_scan(int num_fields, scan_field_t* fields, tap_state_t endstate);
537 extern int interface_jtag_add_ir_scan(int num_fields, scan_field_t* fields, tap_state_t endstate);
538 extern void jtag_add_dr_scan(int num_fields, scan_field_t* fields, tap_state_t endstate);
539 extern int interface_jtag_add_dr_scan(int num_fields, scan_field_t* fields, tap_state_t endstate);
540 extern void jtag_add_plain_ir_scan(int num_fields, scan_field_t* fields, tap_state_t endstate);
541 extern int interface_jtag_add_plain_ir_scan(int num_fields, scan_field_t* fields, tap_state_t endstate);
542 extern void jtag_add_plain_dr_scan(int num_fields, scan_field_t* fields, tap_state_t endstate);
543 extern int interface_jtag_add_plain_dr_scan(int num_fields, scan_field_t* fields, tap_state_t endstate);
545 /* run a TAP_RESET reset. End state is TAP_RESET, regardless
548 extern void jtag_add_tlr(void);
549 extern int interface_jtag_add_tlr(void);
551 /* Do not use jtag_add_pathmove() unless you need to, but do use it
554 * DANGER! If the target is dependent upon a particular sequence
555 * of transitions for things to work correctly(e.g. as a workaround
556 * for an errata that contradicts the JTAG standard), then pathmove
557 * must be used, even if some jtag interfaces happen to use the
558 * desired path. Worse, the jtag interface used for testing a
559 * particular implementation, could happen to use the "desired"
560 * path when transitioning to/from end
563 * A list of unambigious single clock state transitions, not
564 * all drivers can support this, but it is required for e.g.
565 * XScale and Xilinx support
567 * Note! TAP_RESET must not be used in the path!
569 * Note that the first on the list must be reachable
570 * via a single transition from the current state.
572 * All drivers are required to implement jtag_add_pathmove().
573 * However, if the pathmove sequence can not be precisely
574 * executed, an interface_jtag_add_pathmove() or jtag_execute_queue()
575 * must return an error. It is legal, but not recommended, that
576 * a driver returns an error in all cases for a pathmove if it
577 * can only implement a few transitions and therefore
578 * a partial implementation of pathmove would have little practical
581 extern void jtag_add_pathmove(int num_states, tap_state_t* path);
582 extern int interface_jtag_add_pathmove(int num_states, tap_state_t* path);
584 /* go to TAP_IDLE, if we're not already there and cycle
585 * precisely num_cycles in the TAP_IDLE after which move
586 * to the end state, if it is != TAP_IDLE
588 * nb! num_cycles can be 0, in which case the fn will navigate
589 * to endstate via TAP_IDLE
591 extern void jtag_add_runtest(int num_cycles, tap_state_t endstate);
592 extern int interface_jtag_add_runtest(int num_cycles, tap_state_t endstate);
594 /* A reset of the TAP state machine can be requested.
596 * Whether tms or trst reset is used depends on the capabilities of
597 * the target and jtag interface(reset_config command configures this).
599 * srst can driver a reset of the TAP state machine and vice
602 * Application code may need to examine value of jtag_reset_config
603 * to determine the proper codepath
605 * DANGER! Even though srst drives trst, trst might not be connected to
606 * the interface, and it might actually be *harmful* to assert trst in this case.
608 * This is why combinations such as "reset_config srst_only srst_pulls_trst"
611 * only req_tlr_or_trst and srst can have a transition for a
612 * call as the effects of transitioning both at the "same time"
613 * are undefined, but when srst_pulls_trst or vice versa,
614 * then trst & srst *must* be asserted together.
616 extern void jtag_add_reset(int req_tlr_or_trst, int srst);
618 /* this drives the actual srst and trst pins. srst will always be 0
619 * if jtag_reset_config & RESET_SRST_PULLS_TRST != 0 and ditto for
622 * the higher level jtag_add_reset will invoke jtag_add_tlr() if
625 extern int interface_jtag_add_reset(int trst, int srst);
626 extern void jtag_add_end_state(tap_state_t endstate);
627 extern int interface_jtag_add_end_state(tap_state_t endstate);
628 extern void jtag_add_sleep(u32 us);
629 extern int interface_jtag_add_sleep(u32 us);
633 * Function jtag_add_stable_clocks
634 * first checks that the state in which the clocks are to be issued is
635 * stable, then queues up clock_count clocks for transmission.
637 void jtag_add_clocks(int num_cycles);
638 int interface_jtag_add_clocks(int num_cycles);
642 * For software FIFO implementations, the queued commands can be executed
643 * during this call or earlier. A sw queue might decide to push out
644 * some of the jtag_add_xxx() operations once the queue is "big enough".
646 * This fn will return an error code if any of the prior jtag_add_xxx()
647 * calls caused a failure, e.g. check failure. Note that it does not
648 * matter if the operation was executed *before* jtag_execute_queue(),
649 * jtag_execute_queue() will still return an error code.
651 * All jtag_add_xxx() calls that have in_handler!=NULL will have been
652 * executed when this fn returns, but if what has been queued only
653 * clocks data out, without reading anything back, then JTAG could
654 * be running *after* jtag_execute_queue() returns. The API does
655 * not define a way to flush a hw FIFO that runs *after*
656 * jtag_execute_queue() returns.
658 * jtag_add_xxx() commands can either be executed immediately or
659 * at some time between the jtag_add_xxx() fn call and jtag_execute_queue().
661 extern int jtag_execute_queue(void);
663 /* can be implemented by hw+sw */
664 extern int interface_jtag_execute_queue(void);
665 extern int jtag_power_dropout(int* dropout);
666 extern int jtag_srst_asserted(int* srst_asserted);
668 /* JTAG support functions */
669 extern void jtag_set_check_value(scan_field_t* field, u8* value, u8* mask, error_handler_t* in_error_handler);
670 extern enum scan_type jtag_scan_type(scan_command_t* cmd);
671 extern int jtag_scan_size(scan_command_t* cmd);
672 extern int jtag_read_buffer(u8* buffer, scan_command_t* cmd);
673 extern int jtag_build_buffer(scan_command_t* cmd, u8** buffer);
675 extern void jtag_sleep(u32 us);
676 extern int jtag_call_event_callbacks(enum jtag_event event);
677 extern int jtag_register_event_callback(int (* callback)(enum jtag_event event, void* priv), void* priv);
679 extern int jtag_verify_capture_ir;
681 void jtag_tap_handle_event(jtag_tap_t* tap, enum jtag_tap_event e);
684 * JTAG subsystem uses codes between -100 and -199 */
686 #define ERROR_JTAG_INIT_FAILED (-100)
687 #define ERROR_JTAG_INVALID_INTERFACE (-101)
688 #define ERROR_JTAG_NOT_IMPLEMENTED (-102)
689 #define ERROR_JTAG_TRST_ASSERTED (-103)
690 #define ERROR_JTAG_QUEUE_FAILED (-104)
691 #define ERROR_JTAG_NOT_STABLE_STATE (-105)
692 #define ERROR_JTAG_DEVICE_ERROR (-107)
695 /* this allows JTAG devices to implement the entire jtag_xxx() layer in hw/sw */
696 #ifdef HAVE_JTAG_MINIDRIVER_H
697 /* Here a #define MINIDRIVER() and an inline version of hw fifo interface_jtag_add_dr_out can be defined */
698 #include "jtag_minidriver.h"
699 #define MINIDRIVER(a) notused ## a
701 #define MINIDRIVER(a) a
703 /* jtag_add_dr_out() is a faster version of jtag_add_dr_scan()
705 * Current or end_state can not be TAP_RESET. end_state can be TAP_INVALID
707 * num_bits[i] is the number of bits to clock out from value[i] LSB first.
709 * If the device is in bypass, then that is an error condition in
710 * the caller code that is not detected by this fn, whereas jtag_add_dr_scan()
711 * does detect it. Similarly if the device is not in bypass, data must
714 * If anything fails, then jtag_error will be set and jtag_execute() will
715 * return an error. There is no way to determine if there was a failure
716 * during this function call.
718 * Note that this jtag_add_dr_out can be defined as an inline function.
720 extern void interface_jtag_add_dr_out(jtag_tap_t* tap, int num_fields, const int* num_bits, const u32* value,
721 tap_state_t end_state);
725 static __inline__ void jtag_add_dr_out(jtag_tap_t* tap, int num_fields, const int* num_bits, const u32* value,
726 tap_state_t end_state)
728 if (end_state != TAP_INVALID)
729 cmd_queue_end_state = end_state;
730 cmd_queue_cur_state = cmd_queue_end_state;
731 interface_jtag_add_dr_out(tap, num_fields, num_bits, value, cmd_queue_end_state);