1 /***************************************************************************
2 * Copyright (C) 2005 by Dominic Rath *
3 * Dominic.Rath@gmx.de *
5 * Copyright (C) 2007,2008 Øyvind Harboe *
6 * oyvind.harboe@zylin.com *
8 * This program is free software; you can redistribute it and/or modify *
9 * it under the terms of the GNU General Public License as published by *
10 * the Free Software Foundation; either version 2 of the License, or *
11 * (at your option) any later version. *
13 * This program is distributed in the hope that it will be useful, *
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
16 * GNU General Public License for more details. *
18 * You should have received a copy of the GNU General Public License *
19 * along with this program; if not, write to the *
20 * Free Software Foundation, Inc., *
21 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
22 ***************************************************************************/
27 #include "binarybuffer.h"
33 #ifdef _DEBUG_JTAG_IO_
34 #define DEBUG_JTAG_IO(expr ...) LOG_DEBUG(expr)
36 #define DEBUG_JTAG_IO(expr ...)
39 #ifndef DEBUG_JTAG_IOZ
40 #define DEBUG_JTAG_IOZ 64
45 * Tap states from ARM7TDMI-S Technical reference manual.
46 * Also, validated against several other ARM core technical manuals.
48 * N.B. tap_get_tms_path() was changed to reflect this corrected
49 * numbering and ordering of the TAP states.
51 typedef enum tap_state
70 TAP_NUM_STATES = 0x10,
75 typedef struct tap_transition_s
81 //extern tap_transition_t tap_transitions[16]; /* describe the TAP state diagram */
84 /*-----<Cable Helper API>-------------------------------------------*/
86 /* The "Cable Helper API" is what the cable drivers can use to help implement
87 * their "Cable API". So a Cable Helper API is a set of helper functions used by
88 * cable drivers, and this is different from a Cable API. A "Cable API" is what
89 * higher level code used to talk to a cable.
93 /** implementation of wrapper function tap_set_state() */
94 void tap_set_state_impl(tap_state_t new_state);
97 * Function tap_set_state
98 * sets the state of a "state follower" which tracks the state of the TAPs connected to the
99 * cable. The state follower is hopefully always in the same state as the actual
100 * TAPs in the jtag chain, and will be so if there are no bugs in the tracking logic within that
101 * cable driver. All the cable drivers call this function to indicate the state they think
102 * the TAPs attached to their cables are in. Because this function can also log transitions,
103 * it will be helpful to call this function with every transition that the TAPs being manipulated
104 * are expected to traverse, not just end points of a multi-step state path.
105 * @param new_state is the state we think the TAPs are currently in or are about to enter.
107 #if defined(_DEBUG_JTAG_IO_)
108 #define tap_set_state(new_state) \
110 LOG_DEBUG( "tap_set_state(%s)", tap_state_name(new_state) ); \
111 tap_set_state_impl(new_state); \
114 static inline void tap_set_state(tap_state_t new_state)
116 tap_set_state_impl(new_state);
122 * Function tap_get_state
123 * gets the state of the "state follower" which tracks the state of the TAPs connected to
126 * @return tap_state_t - The state the TAPs are in now.
128 tap_state_t tap_get_state(void);
131 * Function tap_set_end_state
132 * sets the state of an "end state follower" which tracks the state that any cable driver
133 * thinks will be the end (resultant) state of the current TAP SIR or SDR operation. At completion
134 * of that TAP operation this value is copied into the state follower via tap_set_state().
135 * @param new_end_state is that state the TAPs should enter at completion of a pending TAP operation.
137 void tap_set_end_state(tap_state_t new_end_state);
140 * Function tap_get_end_state
141 * @see tap_set_end_state
142 * @return tap_state_t - The state the TAPs should be in at completion of the current TAP operation.
144 tap_state_t tap_get_end_state(void);
147 * Function tap_get_tms_path
148 * returns a 7 bit long "bit sequence" indicating what has to be done with TMS
149 * during a sequence of seven TAP clock cycles in order to get from
150 * state \a "from" to state \a "to".
151 * @param from is the starting state
152 * @param to is the resultant or final state
153 * @return int - a 7 bit sequence, with the first bit in the sequence at bit 0.
155 int tap_get_tms_path(tap_state_t from, tap_state_t to);
158 * Function tap_move_ndx
159 * when given a stable state, returns an index from 0-5. The index corresponds to a
160 * sequence of stable states which are given in this order: <p>
161 * { TAP_RESET, TAP_IDLE, TAP_DRSHIFT, TAP_DRPAUSE, TAP_IRSHIFT, TAP_IRPAUSE }
163 * This sequence corresponds to look up tables which are used in some of the
165 * @param astate is the stable state to find in the sequence. If a non stable
166 * state is passed, this may cause the program to output an error message
168 * @return int - the array (or sequence) index as described above
170 int tap_move_ndx(tap_state_t astate);
173 * Function tap_is_state_stable
174 * returns true if the \a astate is stable.
176 bool tap_is_state_stable(tap_state_t astate);
179 * Function tap_state_transition
180 * takes a current TAP state and returns the next state according to the tms value.
181 * @param current_state is the state of a TAP currently.
182 * @param tms is either zero or non-zero, just like a real TMS line in a jtag interface.
183 * @return tap_state_t - the next state a TAP would enter.
185 tap_state_t tap_state_transition(tap_state_t current_state, bool tms);
188 * Function tap_state_name
189 * Returns a string suitable for display representing the JTAG tap_state
191 const char* tap_state_name(tap_state_t state);
193 /*-----</Cable Helper API>------------------------------------------*/
196 extern tap_state_t cmd_queue_end_state; /* finish DR scans in dr_end_state */
197 extern tap_state_t cmd_queue_cur_state; /* current TAP state */
199 typedef void* error_handler_t; /* Later on we can delete error_handler_t, but keep it for now to make patches more readable */
202 typedef int (*in_handler_t)(u8* in_value, void* priv, struct scan_field_s* field);
204 typedef struct scan_field_s
206 jtag_tap_t* tap; /* tap pointer this instruction refers to */
207 int num_bits; /* number of bits this field specifies (up to 32) */
208 u8* out_value; /* value to be scanned into the device */
209 u8* out_mask; /* only masked bits care */
210 u8* in_value; /* pointer to a 32-bit memory location to take data scanned out */
211 /* in_check_value/mask, in_handler_error_handler, in_handler_priv can be used by the in handler, otherwise they contain garbage */
212 u8* in_check_value; /* used to validate scan results */
213 u8* in_check_mask; /* check specified bits against check_value */
214 in_handler_t in_handler; /* process received buffer using this handler */
215 void* in_handler_priv; /* additional information for the in_handler */
219 /* IN: from device to host, OUT: from host to device */
220 SCAN_IN = 1, SCAN_OUT = 2, SCAN_IO = 3
223 typedef struct scan_command_s
225 int ir_scan; /* instruction/not data scan */
226 int num_fields; /* number of fields in *fields array */
227 scan_field_t* fields; /* pointer to an array of data scan fields */
228 tap_state_t end_state; /* TAP state in which JTAG commands should finish */
231 typedef struct statemove_command_s
233 tap_state_t end_state; /* TAP state in which JTAG commands should finish */
234 } statemove_command_t;
236 typedef struct pathmove_command_s
238 int num_states; /* number of states in *path */
239 tap_state_t* path; /* states that have to be passed */
240 } pathmove_command_t;
242 typedef struct runtest_command_s
244 int num_cycles; /* number of cycles that should be spent in Run-Test/Idle */
245 tap_state_t end_state; /* TAP state in which JTAG commands should finish */
249 typedef struct stableclocks_command_s
251 int num_cycles; /* number of clock cycles that should be sent */
252 } stableclocks_command_t;
255 typedef struct reset_command_s
257 int trst; /* trst/srst 0: deassert, 1: assert, -1: don't change */
261 typedef struct end_state_command_s
263 tap_state_t end_state; /* TAP state in which JTAG commands should finish */
264 } end_state_command_t;
266 typedef struct sleep_command_s
268 u32 us; /* number of microseconds to sleep */
271 typedef union jtag_command_container_u
273 scan_command_t* scan;
274 statemove_command_t* statemove;
275 pathmove_command_t* pathmove;
276 runtest_command_t* runtest;
277 stableclocks_command_t* stableclocks;
278 reset_command_t* reset;
279 end_state_command_t* end_state;
280 sleep_command_t* sleep;
281 } jtag_command_container_t;
283 enum jtag_command_type {
291 JTAG_STABLECLOCKS = 8
294 typedef struct jtag_command_s
296 jtag_command_container_t cmd;
297 enum jtag_command_type type;
298 struct jtag_command_s* next;
301 extern jtag_command_t* jtag_command_queue;
303 /* forward declaration */
304 typedef struct jtag_tap_event_action_s jtag_tap_event_action_t;
306 /* this is really: typedef jtag_tap_t */
307 /* But - the typedef is done in "types.h" */
308 /* due to "forward decloration reasons" */
313 const char* dotted_name;
314 int abs_chain_position;
316 int ir_length; /* size of instruction register */
317 u32 ir_capture_value;
318 u8* expected; /* Capture-IR expected value */
320 u8* expected_mask; /* Capture-IR expected mask */
321 u32 idcode; /* device identification code */
322 u32* expected_ids; /* Array of expected identification codes */
323 u8 expected_ids_cnt; /* Number of expected identification codes */
324 u8* cur_instr; /* current instruction */
325 int bypass; /* bypass register selected */
327 jtag_tap_event_action_t* event_action;
329 jtag_tap_t* next_tap;
331 extern jtag_tap_t* jtag_AllTaps(void);
332 extern jtag_tap_t* jtag_TapByPosition(int n);
333 extern jtag_tap_t* jtag_TapByPosition(int n);
334 extern jtag_tap_t* jtag_TapByString(const char* dotted_name);
335 extern jtag_tap_t* jtag_TapByJimObj(Jim_Interp* interp, Jim_Obj* obj);
336 extern jtag_tap_t* jtag_TapByAbsPosition(int abs_position);
337 extern int jtag_NumEnabledTaps(void);
338 extern int jtag_NumTotalTaps(void);
340 static __inline__ jtag_tap_t* jtag_NextEnabledTap(jtag_tap_t* p)
344 /* start at the head of list */
349 /* start *after* this one */
368 enum reset_line_mode {
369 LINE_OPEN_DRAIN = 0x0,
370 LINE_PUSH_PULL = 0x1,
373 typedef struct jtag_interface_s
377 /* queued command execution
379 int (*execute_queue)(void);
381 /* interface initalization
383 int (*speed)(int speed);
384 int (*register_commands)(struct command_context_s* cmd_ctx);
388 /* returns JTAG maxium speed for KHz. 0=RTCK. The function returns
389 * a failure if it can't support the KHz/RTCK.
391 * WARNING!!!! if RTCK is *slow* then think carefully about
392 * whether you actually want to support this in the driver.
393 * Many target scripts are written to handle the absence of RTCK
394 * and use a fallback kHz TCK.
396 int (*khz)(int khz, int* jtag_speed);
398 /* returns the KHz for the provided JTAG speed. 0=RTCK. The function returns
399 * a failure if it can't support the KHz/RTCK. */
400 int (*speed_div)(int speed, int* khz);
402 /* Read and clear the power dropout flag. Note that a power dropout
403 * can be transitionary, easily much less than a ms.
405 * So to find out if the power is *currently* on, you must invoke
406 * this method twice. Once to clear the power dropout flag and a
407 * second time to read the current state.
409 * Currently the default implementation is never to detect power dropout.
411 int (*power_dropout)(int* power_dropout);
413 /* Read and clear the srst asserted detection flag.
415 * NB!!!! like power_dropout this does *not* read the current
416 * state. srst assertion is transitionary and *can* be much
419 int (*srst_asserted)(int* srst_asserted);
426 extern char* jtag_event_strings[];
428 enum jtag_tap_event {
429 JTAG_TAP_EVENT_ENABLE,
430 JTAG_TAP_EVENT_DISABLE
433 extern const Jim_Nvp nvp_jtag_tap_event[];
435 struct jtag_tap_event_action_s
437 enum jtag_tap_event event;
439 jtag_tap_event_action_t* next;
442 extern int jtag_trst;
443 extern int jtag_srst;
445 typedef struct jtag_event_callback_s
447 int (*callback)(enum jtag_event event, void* priv);
449 struct jtag_event_callback_s* next;
450 } jtag_event_callback_t;
452 extern jtag_event_callback_t* jtag_event_callbacks;
454 extern jtag_interface_t* jtag; /* global pointer to configured JTAG interface */
456 extern int jtag_speed;
457 extern int jtag_speed_post_reset;
461 RESET_HAS_TRST = 0x1,
462 RESET_HAS_SRST = 0x2,
463 RESET_TRST_AND_SRST = 0x3,
464 RESET_SRST_PULLS_TRST = 0x4,
465 RESET_TRST_PULLS_SRST = 0x8,
466 RESET_TRST_OPEN_DRAIN = 0x10,
467 RESET_SRST_PUSH_PULL = 0x20,
470 extern enum reset_types jtag_reset_config;
472 /* initialize interface upon startup. A successful no-op
473 * upon subsequent invocations
475 extern int jtag_interface_init(struct command_context_s* cmd_ctx);
477 /* initialize JTAG chain using only a RESET reset. If init fails,
480 extern int jtag_init(struct command_context_s* cmd_ctx);
482 /* reset, then initialize JTAG chain */
483 extern int jtag_init_reset(struct command_context_s* cmd_ctx);
484 extern int jtag_register_commands(struct command_context_s* cmd_ctx);
486 /* JTAG interface, can be implemented with a software or hardware fifo
488 * TAP_DRSHIFT and TAP_IRSHIFT are illegal end states. TAP_DRSHIFT/IRSHIFT as end states
489 * can be emulated by using a larger scan.
491 * Code that is relatively insensitive to the path(as long
492 * as it is JTAG compliant) taken through state machine can use
493 * endstate for jtag_add_xxx_scan(). Otherwise the pause state must be
494 * specified as end state and a subsequent jtag_add_pathmove() must
498 extern void jtag_add_ir_scan(int num_fields, scan_field_t* fields, tap_state_t endstate);
499 extern int interface_jtag_add_ir_scan(int num_fields, scan_field_t* fields, tap_state_t endstate);
500 extern void jtag_add_dr_scan(int num_fields, scan_field_t* fields, tap_state_t endstate);
501 extern int interface_jtag_add_dr_scan(int num_fields, scan_field_t* fields, tap_state_t endstate);
502 extern void jtag_add_plain_ir_scan(int num_fields, scan_field_t* fields, tap_state_t endstate);
503 extern int interface_jtag_add_plain_ir_scan(int num_fields, scan_field_t* fields, tap_state_t endstate);
504 extern void jtag_add_plain_dr_scan(int num_fields, scan_field_t* fields, tap_state_t endstate);
505 extern int interface_jtag_add_plain_dr_scan(int num_fields, scan_field_t* fields, tap_state_t endstate);
507 /* run a TAP_RESET reset. End state is TAP_RESET, regardless
510 extern void jtag_add_tlr(void);
511 extern int interface_jtag_add_tlr(void);
513 /* Do not use jtag_add_pathmove() unless you need to, but do use it
516 * DANGER! If the target is dependent upon a particular sequence
517 * of transitions for things to work correctly(e.g. as a workaround
518 * for an errata that contradicts the JTAG standard), then pathmove
519 * must be used, even if some jtag interfaces happen to use the
520 * desired path. Worse, the jtag interface used for testing a
521 * particular implementation, could happen to use the "desired"
522 * path when transitioning to/from end
525 * A list of unambigious single clock state transitions, not
526 * all drivers can support this, but it is required for e.g.
527 * XScale and Xilinx support
529 * Note! TAP_RESET must not be used in the path!
531 * Note that the first on the list must be reachable
532 * via a single transition from the current state.
534 * All drivers are required to implement jtag_add_pathmove().
535 * However, if the pathmove sequence can not be precisely
536 * executed, an interface_jtag_add_pathmove() or jtag_execute_queue()
537 * must return an error. It is legal, but not recommended, that
538 * a driver returns an error in all cases for a pathmove if it
539 * can only implement a few transitions and therefore
540 * a partial implementation of pathmove would have little practical
543 extern void jtag_add_pathmove(int num_states, tap_state_t* path);
544 extern int interface_jtag_add_pathmove(int num_states, tap_state_t* path);
546 /* go to TAP_IDLE, if we're not already there and cycle
547 * precisely num_cycles in the TAP_IDLE after which move
548 * to the end state, if it is != TAP_IDLE
550 * nb! num_cycles can be 0, in which case the fn will navigate
551 * to endstate via TAP_IDLE
553 extern void jtag_add_runtest(int num_cycles, tap_state_t endstate);
554 extern int interface_jtag_add_runtest(int num_cycles, tap_state_t endstate);
556 /* A reset of the TAP state machine can be requested.
558 * Whether tms or trst reset is used depends on the capabilities of
559 * the target and jtag interface(reset_config command configures this).
561 * srst can driver a reset of the TAP state machine and vice
564 * Application code may need to examine value of jtag_reset_config
565 * to determine the proper codepath
567 * DANGER! Even though srst drives trst, trst might not be connected to
568 * the interface, and it might actually be *harmful* to assert trst in this case.
570 * This is why combinations such as "reset_config srst_only srst_pulls_trst"
573 * only req_tlr_or_trst and srst can have a transition for a
574 * call as the effects of transitioning both at the "same time"
575 * are undefined, but when srst_pulls_trst or vice versa,
576 * then trst & srst *must* be asserted together.
578 extern void jtag_add_reset(int req_tlr_or_trst, int srst);
580 /* this drives the actual srst and trst pins. srst will always be 0
581 * if jtag_reset_config & RESET_SRST_PULLS_TRST != 0 and ditto for
584 * the higher level jtag_add_reset will invoke jtag_add_tlr() if
587 extern int interface_jtag_add_reset(int trst, int srst);
588 extern void jtag_add_end_state(tap_state_t endstate);
589 extern int interface_jtag_add_end_state(tap_state_t endstate);
590 extern void jtag_add_sleep(u32 us);
591 extern int interface_jtag_add_sleep(u32 us);
595 * Function jtag_add_stable_clocks
596 * first checks that the state in which the clocks are to be issued is
597 * stable, then queues up clock_count clocks for transmission.
599 void jtag_add_clocks(int num_cycles);
600 int interface_jtag_add_clocks(int num_cycles);
604 * For software FIFO implementations, the queued commands can be executed
605 * during this call or earlier. A sw queue might decide to push out
606 * some of the jtag_add_xxx() operations once the queue is "big enough".
608 * This fn will return an error code if any of the prior jtag_add_xxx()
609 * calls caused a failure, e.g. check failure. Note that it does not
610 * matter if the operation was executed *before* jtag_execute_queue(),
611 * jtag_execute_queue() will still return an error code.
613 * All jtag_add_xxx() calls that have in_handler!=NULL will have been
614 * executed when this fn returns, but if what has been queued only
615 * clocks data out, without reading anything back, then JTAG could
616 * be running *after* jtag_execute_queue() returns. The API does
617 * not define a way to flush a hw FIFO that runs *after*
618 * jtag_execute_queue() returns.
620 * jtag_add_xxx() commands can either be executed immediately or
621 * at some time between the jtag_add_xxx() fn call and jtag_execute_queue().
623 extern int jtag_execute_queue(void);
625 /* can be implemented by hw+sw */
626 extern int interface_jtag_execute_queue(void);
627 extern int jtag_power_dropout(int* dropout);
628 extern int jtag_srst_asserted(int* srst_asserted);
630 /* JTAG support functions */
631 extern void jtag_set_check_value(scan_field_t* field, u8* value, u8* mask, error_handler_t* in_error_handler);
632 extern enum scan_type jtag_scan_type(scan_command_t* cmd);
633 extern int jtag_scan_size(scan_command_t* cmd);
634 extern int jtag_read_buffer(u8* buffer, scan_command_t* cmd);
635 extern int jtag_build_buffer(scan_command_t* cmd, u8** buffer);
637 extern void jtag_sleep(u32 us);
638 extern int jtag_call_event_callbacks(enum jtag_event event);
639 extern int jtag_register_event_callback(int (* callback)(enum jtag_event event, void* priv), void* priv);
641 extern int jtag_verify_capture_ir;
643 void jtag_tap_handle_event(jtag_tap_t* tap, enum jtag_tap_event e);
646 * JTAG subsystem uses codes between -100 and -199 */
648 #define ERROR_JTAG_INIT_FAILED (-100)
649 #define ERROR_JTAG_INVALID_INTERFACE (-101)
650 #define ERROR_JTAG_NOT_IMPLEMENTED (-102)
651 #define ERROR_JTAG_TRST_ASSERTED (-103)
652 #define ERROR_JTAG_QUEUE_FAILED (-104)
653 #define ERROR_JTAG_NOT_STABLE_STATE (-105)
654 #define ERROR_JTAG_DEVICE_ERROR (-107)
657 /* this allows JTAG devices to implement the entire jtag_xxx() layer in hw/sw */
658 #ifdef HAVE_JTAG_MINIDRIVER_H
659 /* Here a #define MINIDRIVER() and an inline version of hw fifo interface_jtag_add_dr_out can be defined */
660 #include "jtag_minidriver.h"
661 #define MINIDRIVER(a) notused ## a
663 #define MINIDRIVER(a) a
665 /* jtag_add_dr_out() is a faster version of jtag_add_dr_scan()
667 * Current or end_state can not be TAP_RESET. end_state can be TAP_INVALID
669 * num_bits[i] is the number of bits to clock out from value[i] LSB first.
671 * If the device is in bypass, then that is an error condition in
672 * the caller code that is not detected by this fn, whereas jtag_add_dr_scan()
673 * does detect it. Similarly if the device is not in bypass, data must
676 * If anything fails, then jtag_error will be set and jtag_execute() will
677 * return an error. There is no way to determine if there was a failure
678 * during this function call.
680 * Note that this jtag_add_dr_out can be defined as an inline function.
682 extern void interface_jtag_add_dr_out(jtag_tap_t* tap, int num_fields, const int* num_bits, const u32* value,
683 tap_state_t end_state);
687 static __inline__ void jtag_add_dr_out(jtag_tap_t* tap, int num_fields, const int* num_bits, const u32* value,
688 tap_state_t end_state)
690 if (end_state != TAP_INVALID)
691 cmd_queue_end_state = end_state;
692 cmd_queue_cur_state = cmd_queue_end_state;
693 interface_jtag_add_dr_out(tap, num_fields, num_bits, value, cmd_queue_end_state);