1 /***************************************************************************
2 * Copyright (C) 2005 by Dominic Rath *
3 * Dominic.Rath@gmx.de *
5 * Copyright (C) 2007,2008 Øyvind Harboe *
6 * oyvind.harboe@zylin.com *
8 * Copyright (C) 2008 Peter Hettkamp *
9 * peter.hettkamp@htp-tel.de *
11 * Copyright (C) 2009 SoftPLC Corporation. http://softplc.com *
12 * Dick Hollenbeck <dick@softplc.com> *
14 * This program is free software; you can redistribute it and/or modify *
15 * it under the terms of the GNU General Public License as published by *
16 * the Free Software Foundation; either version 2 of the License, or *
17 * (at your option) any later version. *
19 * This program is distributed in the hope that it will be useful, *
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
22 * GNU General Public License for more details. *
24 * You should have received a copy of the GNU General Public License *
25 * along with this program; if not, write to the *
26 * Free Software Foundation, Inc., *
27 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
28 ***************************************************************************/
30 /* The specification for SVF is available here:
31 * http://www.asset-intertech.com/support/svf.pdf
32 * Below, this document is refered to as the "SVF spec".
34 * The specification for XSVF is available here:
35 * http://www.xilinx.com/support/documentation/application_notes/xapp503.pdf
36 * Below, this document is refered to as the "XSVF spec".
44 #include <jtag/jtag.h>
47 /* XSVF commands, from appendix B of xapp503.pdf */
48 #define XCOMPLETE 0x00
56 #define XSETSDRMASKS 0x0A
71 /* XWAITSTATE is not in the xilinx XSVF spec, but the svf2xsvf.py translator
72 * generates this. Arguably it is needed because the XSVF XRUNTEST command
73 * was ill conceived and does not directly flow out of the SVF RUNTEST command.
74 * This XWAITSTATE does map directly from the SVF RUNTEST command.
76 #define XWAITSTATE 0x18
78 /* Lattice has extended the SVF file format, and Dick Hollenbeck's python based
79 * SVF2XSVF converter supports these 3 additional XSVF opcodes, LCOUNT, LDELAY, LSDR.
80 * Here is an example of usage of the 3 lattice opcode extensions:
82 ! Set the maximum loop count to 25.
84 ! Step to DRPAUSE give 5 clocks and wait for 1.00e + 000 SEC.
85 LDELAY DRPAUSE 5 TCK 1.00E-003 SEC;
86 ! Test for the completed status. Match means pass.
87 ! Loop back to LDELAY line if not match and loop count less than 25.
98 /* XSVF valid state values for the XSTATE command, from appendix B of xapp503.pdf */
99 #define XSV_RESET 0x00
100 #define XSV_IDLE 0x01
101 #define XSV_DRSELECT 0x02
102 #define XSV_DRCAPTURE 0x03
103 #define XSV_DRSHIFT 0x04
104 #define XSV_DREXIT1 0x05
105 #define XSV_DRPAUSE 0x06
106 #define XSV_DREXIT2 0x07
107 #define XSV_DRUPDATE 0x08
108 #define XSV_IRSELECT 0x09
109 #define XSV_IRCAPTURE 0x0A
110 #define XSV_IRSHIFT 0x0B
111 #define XSV_IREXIT1 0x0C
112 #define XSV_IRPAUSE 0x0D
113 #define XSV_IREXIT2 0x0E
114 #define XSV_IRUPDATE 0x0F
116 /* arguments to XTRST */
120 #define XTRST_ABSENT 3
122 #define XSTATE_MAX_PATH 12
126 /* map xsvf tap state to an openocd "tap_state_t" */
127 static tap_state_t xsvf_to_tap(int xsvf_state)
131 switch (xsvf_state) {
181 LOG_ERROR("UNKNOWN XSVF STATE 0x%02X", xsvf_state);
188 static int xsvf_read_buffer(int num_bits, int fd, uint8_t *buf)
192 for (num_bytes = (num_bits + 7) / 8; num_bytes > 0; num_bytes--) {
193 /* reverse the order of bytes as they are read sequentially from file */
194 if (read(fd, buf + num_bytes - 1, 1) < 0)
195 return ERROR_XSVF_EOF;
201 COMMAND_HANDLER(handle_xsvf_command)
203 uint8_t *dr_out_buf = NULL; /* from host to device (TDI) */
204 uint8_t *dr_in_buf = NULL; /* from device to host (TDO) */
205 uint8_t *dr_in_mask = NULL;
208 int xruntest = 0; /* number of TCK cycles OR *microseconds */
209 int xrepeat = 0; /* number of retries */
211 tap_state_t xendir = TAP_IDLE; /* see page 8 of the SVF spec, initial
212 *xendir to be TAP_IDLE */
213 tap_state_t xenddr = TAP_IDLE;
217 long file_offset = 0;
220 tap_state_t loop_state = TAP_IDLE;
226 int tdo_mismatch = 0;
230 bool collecting_path = false;
231 tap_state_t path[XSTATE_MAX_PATH];
232 unsigned pathlen = 0;
234 /* a flag telling whether to clock TCK during waits,
235 * or simply sleep, controled by virt2
237 int runtest_requires_tck = 0;
239 /* use NULL to indicate a "plain" xsvf file which accounts for
240 * additional devices in the scan chain, otherwise the device
241 * that should be affected
243 struct jtag_tap *tap = NULL;
246 return ERROR_COMMAND_SYNTAX_ERROR;
248 /* we mess with CMD_ARGV starting point below, snapshot filename here */
249 const char *filename = CMD_ARGV[1];
251 if (strcmp(CMD_ARGV[0], "plain") != 0) {
252 tap = jtag_tap_by_string(CMD_ARGV[0]);
254 command_print(CMD_CTX, "Tap: %s unknown", CMD_ARGV[0]);
259 xsvf_fd = open(filename, O_RDONLY);
261 command_print(CMD_CTX, "file \"%s\" not found", filename);
265 /* if this argument is present, then interpret xruntest counts as TCK cycles rather than as
267 if ((CMD_ARGC > 2) && (strcmp(CMD_ARGV[2], "virt2") == 0)) {
268 runtest_requires_tck = 1;
273 if ((CMD_ARGC > 2) && (strcmp(CMD_ARGV[2], "quiet") == 0))
276 LOG_USER("xsvf processing file: \"%s\"", filename);
278 while (read(xsvf_fd, &opcode, 1) > 0) {
279 /* record the position of this opcode within the file */
280 file_offset = lseek(xsvf_fd, 0, SEEK_CUR) - 1;
282 /* maybe collect another state for a pathmove();
283 * or terminate a path.
285 if (collecting_path) {
290 /* ignore/show comments between XSTATE ops */
293 /* try to collect another transition */
294 if (pathlen == XSTATE_MAX_PATH) {
295 LOG_ERROR("XSVF: path too long");
300 if (read(xsvf_fd, &uc, 1) < 0) {
305 mystate = xsvf_to_tap(uc);
306 path[pathlen++] = mystate;
308 LOG_DEBUG("XSTATE 0x%02X %s", uc,
309 tap_state_name(mystate));
311 /* If path is incomplete, collect more */
312 if (!svf_tap_state_is_stable(mystate))
315 /* Else execute the path transitions we've
318 * NOTE: Punting on the saved path is not
319 * strictly correct, but we must to do this
320 * unless jtag_add_pathmove() stops rejecting
321 * paths containing RESET. This is probably
322 * harmless, since there aren't many options
323 * for going from a stable state to reset;
324 * at the worst, we may issue extra clocks
325 * once we get to RESET.
327 if (mystate == TAP_RESET) {
328 LOG_WARNING("XSVF: dodgey RESET");
334 /* Execute the path we collected
336 * NOTE: OpenOCD requires something that XSVF
337 * doesn't: the last TAP state in the path
338 * must be stable. In practice, tools that
339 * create XSVF seem to follow that rule too.
341 collecting_path = false;
343 if (path[0] == TAP_RESET)
346 jtag_add_pathmove(pathlen, path);
348 result = jtag_execute_queue();
349 if (result != ERROR_OK) {
350 LOG_ERROR("XSVF: pathmove error %d", result);
360 LOG_DEBUG("XCOMPLETE");
362 result = jtag_execute_queue();
363 if (result != ERROR_OK) {
370 LOG_DEBUG("XTDOMASK");
372 (xsvf_read_buffer(xsdrsize, xsvf_fd, dr_in_mask) != ERROR_OK))
378 uint8_t xruntest_buf[4];
380 if (read(xsvf_fd, xruntest_buf, 4) < 0) {
385 xruntest = be_to_h_u32(xruntest_buf);
386 LOG_DEBUG("XRUNTEST %d 0x%08X", xruntest, xruntest);
394 if (read(xsvf_fd, &myrepeat, 1) < 0)
398 LOG_DEBUG("XREPEAT %d", xrepeat);
405 uint8_t xsdrsize_buf[4];
407 if (read(xsvf_fd, xsdrsize_buf, 4) < 0) {
412 xsdrsize = be_to_h_u32(xsdrsize_buf);
413 LOG_DEBUG("XSDRSIZE %d", xsdrsize);
422 dr_out_buf = malloc((xsdrsize + 7) / 8);
423 dr_in_buf = malloc((xsdrsize + 7) / 8);
424 dr_in_mask = malloc((xsdrsize + 7) / 8);
428 case XSDR: /* these two are identical except for the dr_in_buf */
435 const char *op_name = (opcode == XSDR ? "XSDR" : "XSDRTDO");
437 if (xsvf_read_buffer(xsdrsize, xsvf_fd, dr_out_buf) != ERROR_OK) {
442 if (opcode == XSDRTDO) {
443 if (xsvf_read_buffer(xsdrsize, xsvf_fd,
444 dr_in_buf) != ERROR_OK) {
453 LOG_DEBUG("%s %d", op_name, xsdrsize);
455 for (attempt = 0; attempt < limit; ++attempt) {
456 struct scan_field field;
459 /* perform the XC9500 exception handling sequence shown in xapp067.pdf and
460 * illustrated in psuedo code at end of this file. We start from state
466 * go to Run-Test/Idle
468 * This sequence should be harmless for other devices, and it
469 * will be skipped entirely if xrepeat is set to zero.
472 static tap_state_t exception_path[] = {
480 jtag_add_pathmove(ARRAY_SIZE(exception_path), exception_path);
483 LOG_USER("%s mismatch, xsdrsize=%d retry=%d",
489 field.num_bits = xsdrsize;
490 field.out_value = dr_out_buf;
491 field.in_value = calloc(DIV_ROUND_UP(field.num_bits, 8), 1);
494 jtag_add_plain_dr_scan(field.num_bits,
499 jtag_add_dr_scan(tap, 1, &field, TAP_DRPAUSE);
501 jtag_check_value_mask(&field, dr_in_buf, dr_in_mask);
503 free(field.in_value);
505 /* LOG_DEBUG("FLUSHING QUEUE"); */
506 result = jtag_execute_queue();
507 if (result == ERROR_OK) {
514 LOG_USER("%s mismatch", op_name);
519 /* See page 19 of XSVF spec regarding opcode "XSDR" */
521 result = svf_add_statemove(TAP_IDLE);
522 if (result != ERROR_OK)
525 if (runtest_requires_tck)
526 jtag_add_clocks(xruntest);
528 jtag_add_sleep(xruntest);
529 } else if (xendir != TAP_DRPAUSE) {
530 /* we are already in TAP_DRPAUSE */
531 result = svf_add_statemove(xenddr);
532 if (result != ERROR_OK)
539 LOG_ERROR("unsupported XSETSDRMASKS");
544 LOG_ERROR("unsupported XSDRINC");
549 LOG_ERROR("unsupported XSDRB");
554 LOG_ERROR("unsupported XSDRC");
559 LOG_ERROR("unsupported XSDRE");
564 LOG_ERROR("unsupported XSDRTDOB");
569 LOG_ERROR("unsupported XSDRTDOC");
574 LOG_ERROR("unsupported XSDRTDOE");
582 if (read(xsvf_fd, &uc, 1) < 0) {
587 mystate = xsvf_to_tap(uc);
589 LOG_DEBUG("XSTATE 0x%02X %s", uc, tap_state_name(mystate));
591 if (mystate == TAP_INVALID) {
592 LOG_ERROR("XSVF: bad XSTATE %02x", uc);
597 /* NOTE: the current state is SVF-stable! */
599 /* no change == NOP */
600 if (mystate == cmd_queue_cur_state
601 && mystate != TAP_RESET)
604 /* Hand off to SVF? */
605 if (svf_tap_state_is_stable(mystate)) {
606 result = svf_add_statemove(mystate);
607 if (result != ERROR_OK)
613 * A sequence of XSTATE transitions, each TAP
614 * state adjacent to the previous one. Start
617 collecting_path = true;
625 if (read(xsvf_fd, &uc, 1) < 0) {
630 /* see page 22 of XSVF spec */
634 xendir = TAP_IRPAUSE;
636 LOG_ERROR("illegial XENDIR argument: 0x%02X", uc);
641 LOG_DEBUG("XENDIR 0x%02X %s", uc, tap_state_name(xendir));
646 if (read(xsvf_fd, &uc, 1) < 0) {
651 /* see page 22 of XSVF spec */
655 xenddr = TAP_DRPAUSE;
657 LOG_ERROR("illegial XENDDR argument: 0x%02X", uc);
662 LOG_DEBUG("XENDDR %02X %s", uc, tap_state_name(xenddr));
668 uint8_t short_buf[2];
671 tap_state_t my_end_state = xruntest ? TAP_IDLE : xendir;
673 if (opcode == XSIR) {
674 /* one byte bitcount */
675 if (read(xsvf_fd, short_buf, 1) < 0) {
679 bitcount = short_buf[0];
680 LOG_DEBUG("XSIR %d", bitcount);
682 if (read(xsvf_fd, short_buf, 2) < 0) {
686 bitcount = be_to_h_u16(short_buf);
687 LOG_DEBUG("XSIR2 %d", bitcount);
690 ir_buf = malloc((bitcount + 7) / 8);
692 if (xsvf_read_buffer(bitcount, xsvf_fd, ir_buf) != ERROR_OK)
695 struct scan_field field;
697 field.num_bits = bitcount;
698 field.out_value = ir_buf;
700 field.in_value = NULL;
703 jtag_add_plain_ir_scan(field.num_bits,
704 field.out_value, field.in_value, my_end_state);
706 jtag_add_ir_scan(tap, &field, my_end_state);
709 if (runtest_requires_tck)
710 jtag_add_clocks(xruntest);
712 jtag_add_sleep(xruntest);
715 /* Note that an -irmask of non-zero in your config file
716 * can cause this to fail. Setting -irmask to zero cand work
717 * around the problem.
720 /* LOG_DEBUG("FLUSHING QUEUE"); */
721 result = jtag_execute_queue();
722 if (result != ERROR_OK)
731 unsigned int ndx = 0;
735 if (read(xsvf_fd, &uc, 1) < 0) {
740 if (ndx < sizeof(comment)-1)
745 comment[sizeof(comment)-1] = 0; /* regardless, terminate */
747 LOG_USER("# %s", comment);
753 /* expected in stream:
754 XWAIT <uint8_t wait_state> <uint8_t end_state> <uint32_t usecs>
759 uint8_t delay_buf[4];
761 tap_state_t wait_state;
762 tap_state_t end_state;
765 if (read(xsvf_fd, &wait_local, 1) < 0
766 || read(xsvf_fd, &end, 1) < 0
767 || read(xsvf_fd, delay_buf, 4) < 0) {
772 wait_state = xsvf_to_tap(wait_local);
773 end_state = xsvf_to_tap(end);
774 delay = be_to_h_u32(delay_buf);
776 LOG_DEBUG("XWAIT %s %s usecs:%d", tap_state_name(
777 wait_state), tap_state_name(end_state), delay);
779 if (runtest_requires_tck && wait_state == TAP_IDLE)
780 jtag_add_runtest(delay, end_state);
782 /* FIXME handle statemove errors ... */
783 result = svf_add_statemove(wait_state);
784 if (result != ERROR_OK)
786 jtag_add_sleep(delay);
787 result = svf_add_statemove(end_state);
788 if (result != ERROR_OK)
796 /* expected in stream:
797 * XWAITSTATE <uint8_t wait_state> <uint8_t end_state> <uint32_t clock_count>
801 uint8_t clock_buf[4];
802 uint8_t usecs_buf[4];
805 tap_state_t wait_state;
806 tap_state_t end_state;
810 if (read(xsvf_fd, &wait_local, 1) < 0
811 || read(xsvf_fd, &end, 1) < 0
812 || read(xsvf_fd, clock_buf, 4) < 0
813 || read(xsvf_fd, usecs_buf, 4) < 0) {
818 wait_state = xsvf_to_tap(wait_local);
819 end_state = xsvf_to_tap(end);
821 clock_count = be_to_h_u32(clock_buf);
822 usecs = be_to_h_u32(usecs_buf);
824 LOG_DEBUG("XWAITSTATE %s %s clocks:%i usecs:%i",
825 tap_state_name(wait_state),
826 tap_state_name(end_state),
829 /* the following states are 'stable', meaning that they have a transition
830 * in the state diagram back to themselves. This is necessary because we will
831 * be issuing a number of clocks in this state. This set of allowed states is also
832 * determined by the SVF RUNTEST command's allowed states.
834 if (!svf_tap_state_is_stable(wait_state)) {
835 LOG_ERROR("illegal XWAITSTATE wait_state: \"%s\"",
836 tap_state_name(wait_state));
838 /* REVISIT "break" so we won't run? */
841 /* FIXME handle statemove errors ... */
842 result = svf_add_statemove(wait_state);
843 if (result != ERROR_OK)
846 jtag_add_clocks(clock_count);
847 jtag_add_sleep(usecs);
849 result = svf_add_statemove(end_state);
850 if (result != ERROR_OK)
857 /* expected in stream:
858 * LCOUNT <uint32_t loop_count>
860 uint8_t count_buf[4];
862 if (read(xsvf_fd, count_buf, 4) < 0) {
867 loop_count = be_to_h_u32(count_buf);
868 LOG_DEBUG("LCOUNT %d", loop_count);
874 /* expected in stream:
875 * LDELAY <uint8_t wait_state> <uint32_t clock_count> <uint32_t usecs_to_sleep>
878 uint8_t clock_buf[4];
879 uint8_t usecs_buf[4];
881 if (read(xsvf_fd, &state, 1) < 0
882 || read(xsvf_fd, clock_buf, 4) < 0
883 || read(xsvf_fd, usecs_buf, 4) < 0) {
888 /* NOTE: loop_state must be stable! */
889 loop_state = xsvf_to_tap(state);
890 loop_clocks = be_to_h_u32(clock_buf);
891 loop_usecs = be_to_h_u32(usecs_buf);
893 LOG_DEBUG("LDELAY %s clocks:%d usecs:%d", tap_state_name(
894 loop_state), loop_clocks, loop_usecs);
898 /* LSDR is more like XSDRTDO than it is like XSDR. It uses LDELAY which
899 * comes with clocks !AND! sleep requirements.
903 int limit = loop_count;
909 if (xsvf_read_buffer(xsdrsize, xsvf_fd, dr_out_buf) != ERROR_OK
910 || xsvf_read_buffer(xsdrsize, xsvf_fd, dr_in_buf) != ERROR_OK) {
918 for (attempt = 0; attempt < limit; ++attempt) {
919 struct scan_field field;
921 result = svf_add_statemove(loop_state);
922 if (result != ERROR_OK)
924 jtag_add_clocks(loop_clocks);
925 jtag_add_sleep(loop_usecs);
927 field.num_bits = xsdrsize;
928 field.out_value = dr_out_buf;
929 field.in_value = calloc(DIV_ROUND_UP(field.num_bits, 8), 1);
931 if (attempt > 0 && verbose)
932 LOG_USER("LSDR retry %d", attempt);
935 jtag_add_plain_dr_scan(field.num_bits,
940 jtag_add_dr_scan(tap, 1, &field, TAP_DRPAUSE);
942 jtag_check_value_mask(&field, dr_in_buf, dr_in_mask);
944 free(field.in_value);
947 /* LOG_DEBUG("FLUSHING QUEUE"); */
948 result = jtag_execute_queue();
949 if (result == ERROR_OK) {
956 LOG_USER("LSDR mismatch");
967 if (read(xsvf_fd, &trst_mode, 1) < 0) {
974 jtag_add_reset(1, 0);
978 jtag_add_reset(0, 0);
983 LOG_ERROR("XTRST mode argument (0x%02X) out of range", trst_mode);
990 LOG_ERROR("unknown xsvf command (0x%02X)", uc);
994 if (do_abort || unsupported || tdo_mismatch) {
995 LOG_DEBUG("xsvf failed, setting taps to reasonable state");
997 /* upon error, return the TAPs to a reasonable state */
998 result = svf_add_statemove(TAP_IDLE);
999 if (result != ERROR_OK)
1001 result = jtag_execute_queue();
1002 if (result != ERROR_OK)
1009 command_print(CMD_CTX,
1010 "TDO mismatch, somewhere near offset %lu in xsvf file, aborting",
1017 off_t offset = lseek(xsvf_fd, 0, SEEK_CUR) - 1;
1018 command_print(CMD_CTX,
1019 "unsupported xsvf command (0x%02X) at offset %jd, aborting",
1020 uc, (intmax_t)offset);
1025 command_print(CMD_CTX, "premature end of xsvf file detected, aborting");
1040 command_print(CMD_CTX, "XSVF file programmed successfully");
1045 static const struct command_registration xsvf_command_handlers[] = {
1048 .handler = handle_xsvf_command,
1049 .mode = COMMAND_EXEC,
1050 .help = "Runs a XSVF file. If 'virt2' is given, xruntest "
1051 "counts are interpreted as TCK cycles rather than "
1052 "as microseconds. Without the 'quiet' option, all "
1053 "comments, retries, and mismatches will be reported.",
1054 .usage = "(tapname|'plain') filename ['virt2'] ['quiet']",
1056 COMMAND_REGISTRATION_DONE
1059 int xsvf_register_commands(struct command_context *cmd_ctx)
1061 return register_commands(cmd_ctx, NULL, xsvf_command_handlers);
1066 PSUEDO-Code from Xilinx Appnote XAPP067.pdf :
1068 the following pseudo code clarifies the intent of the xrepeat support.The
1069 flow given is for the entire processing of an SVF file, not an XSVF file.
1070 No idea if this is just for the XC9500/XL/XV devices or all Xilinx parts.
1072 "Pseudo-Code Algorithm for SVF-Based ISP"
1074 1. Go to Test-Logic-Reset state
1075 2. Go to Run-Test Idle state
1078 4. if SIR record then
1079 go to Shift-IR state
1082 5. else if SDR record then
1083 set <repeat count> to 0
1084 store <TDI value> as <current TDI value>
1085 store <TDO value> as <current TDO value>
1086 6. go to Shift-DR state
1087 scan in <current TDI value>
1088 if < current TDO value > is specified then
1089 if < current TDO value > does not equal <actual TDO value> then
1090 if < repeat count > > 32 then
1092 go to Run-Test Idle state
1101 increment <repeat count> by 1
1102 pause <current pause time> microseconds
1106 go to Run-Test Idle state
1109 else if RUNTEST record then
1110 pause tester for < TCK value > microseconds
1111 store <TCK value> as <current pause time>