1 /*! \file jtagarm7tdmi.h
2 \author Matthew Carpenter <matt@inguardians.com>
3 \brief JTAG handler functions for the ARM7TDMI family of processors
9 #define JTAGSTATE_ARM 0 // bit 4 on dbg status reg is low
10 #define JTAGSTATE_THUMB 1
12 #define ARMTCKTOCK CLRTCK; PLEDOUT^=PLEDPIN; SETTCK; PLEDOUT^=PLEDPIN;
13 // ASSUME RUN-TEST/IDLE STATE
14 #define SHIFT_IR SETTMS;TCKTOCK;TCKTOCK;CLRTMS;TCKTOCK;TCKTOCK;
15 #define SHIFT_DR SETTMS;TCKTOCK;CLRTMS;TCKTOCK;TCKTOCK;
19 unsigned long registers[16]; // constant array
20 unsigned char current_chain;
21 unsigned char last_halt_debug_state = -1;
22 unsigned long last_halt_pc = -1;
23 unsigned long count_dbgspd_instr_since_debug = 0;
24 unsigned long count_sysspd_instr_since_debug = 0;
27 void jtag_goto_shift_ir();
28 void jtag_goto_shift_dr();
29 void jtag_reset_to_runtest_idle();
30 void jtag_arm_tcktock();
33 // JTAGARM7TDMI Commands
35 //! Write data to address.
36 unsigned long jtagarm7tdmi_writemem(unsigned long adr, unsigned long data);
37 //! Read data from address
38 unsigned long jtagarm7tdmi_readmem(unsigned long adr);
41 unsigned long jtagarm7tdmi_haltcpu();
43 unsigned long jtagarm7tdmi_releasecpu();
45 //! Set the program counter.
46 unsigned long jtagarm7tdmi_setpc(unsigned long adr);
48 //! Write data to address.
49 unsigned long jtagarm7tdmi_writeflash(unsigned long adr, unsigned long data);
53 unsigned long jtagarm7tdmi_start(void);
54 //! Reset TAP State Machine
55 void jtagarm7tdmi_resettap();
57 //! ARM-specific JTAG bit-transfer
58 unsigned long jtagarmtransn(unsigned long word, unsigned char bitcount, unsigned char lsb, unsigned char end, unsigned char retidle);
60 //! Grab debug register - Expect chain 2 to be selected
61 unsigned long jtagarm7tdmi_get_dbgstate() ;
63 unsigned long jtagarm7tdmi_idcode();
64 //! Connect Bypass Register to TDO/TDI
65 unsigned char jtagarm7tdmi_bypass();
66 //! Connect the appropriate scan chain to TDO/TDI
67 unsigned long jtagarm7tdmi_scan_intest(int n);
69 // ARM7TDMI-specific pins
70 // DBGRQ - GoodFET Pin 8
74 The instruction register is 4 bits in length.
75 There is no parity bit.
76 The fixed value 0001 is loaded into the instruction register during the CAPTURE-IR
78 The least significant bit of the instruction register is scanned in and scanned out first.
81 //4-bit ARM7TDMI JTAG commands, bit-swapped
82 #define ARM7TDMI_IR_EXTEST 0x0
83 #define ARM7TDMI_IR_SCAN_N 0x2
84 #define ARM7TDMI_IR_SAMPLE 0x3
85 #define ARM7TDMI_IR_RESTART 0x4
86 #define ARM7TDMI_IR_CLAMP 0x5
87 #define ARM7TDMI_IR_HIGHZ 0x7
88 #define ARM7TDMI_IR_CLAMPZ 0x9
89 #define ARM7TDMI_IR_INTEST 0xC
90 #define ARM7TDMI_IR_IDCODE 0xE
91 #define ARM7TDMI_IR_BYPASS 0xF
93 // read 3 bit - Debug Control
94 #define EICE_DBGCTRL 0
95 #define EICE_DBGCTRL_BITLEN 3
96 // read 5 bit - Debug Status
97 #define EICE_DBGSTATUS 1
98 #define EICE_DBGSTATUS_BITLEN 5
99 // read 6 bit - Debug Comms Control Register
100 #define EICE_DBGCCR 4
101 #define EICE_DBGCCR_BITLEN 6
102 // r/w 32 bit - Debug Comms Data Register
103 #define EICE_DBGCDR 5
104 // r/w 32 bit - Watchpoint 0 Address
105 #define EICE_WP0ADDR 8
106 // r/w 32 bit - Watchpoint 0 Addres Mask
107 #define EICE_WP0ADDRMASK 9
108 // r/w 32 bit - Watchpoint 0 Data
109 #define EICE_WP0DATA 10
110 // r/w 32 bit - Watchpoint 0 Data Masl
111 #define EICE_WP0DATAMASK 11
112 // r/w 9 bit - Watchpoint 0 Control Value
113 #define EICE_WP0CTRL 12
114 // r/w 8 bit - Watchpoint 0 Control Mask
115 #define EICE_WP0CTRLMASK 13
116 // r/w 32 bit - Watchpoint 0 Address
117 #define EICE_WP1ADDR 16
118 // r/w 32 bit - Watchpoint 0 Addres Mask
119 #define EICE_WP1ADDRMASK 17
120 // r/w 32 bit - Watchpoint 0 Data
121 #define EICE_WP1DATA 18
122 // r/w 32 bit - Watchpoint 0 Data Masl
123 #define EICE_WP1DATAMASK 19
124 // r/w 9 bit - Watchpoint 0 Control Value
125 #define EICE_WP1CTRL 20
126 // r/w 8 bit - Watchpoint 0 Control Mask
127 #define EICE_WP1CTRLMASK 21
138 //JTAGARM7TDMI commands
139 #define JTAGARM7TDMI_GET_DEBUG_CTRL 0x80
140 #define JTAGARM7TDMI_SET_DEBUG_CTRL 0x81
141 #define JTAGARM7TDMI_GET_PC 0x82
142 #define JTAGARM7TDMI_SET_PC 0x83
143 #define JTAGARM7TDMI_GET_CHIP_ID 0x84
144 #define JTAGARM7TDMI_GET_DEBUG_STATE 0x85
145 #define JTAGARM7TDMI_GET_WATCHPOINT 0x86
146 #define JTAGARM7TDMI_SET_WATCHPOINT 0x87
147 #define JTAGARM7TDMI_GET_REGISTER 0x88
148 #define JTAGARM7TDMI_SET_REGISTER 0x89
149 #define JTAGARM7TDMI_GET_REGISTERS 0x8a
150 #define JTAGARM7TDMI_SET_REGISTERS 0x8b
151 #define JTAGARM7TDMI_HALTCPU 0x8c
152 #define JTAGARM7TDMI_RELEASECPU 0x8d
153 #define JTAGARM7TDMI_DEBUG_INSTR 0x8e
154 #define JTAGARM7TDMI_STEP_INSTR 0x8f
155 #define JTAGARM7TDMI_WRITEMEM 0x90
156 #define JTAGARM7TDMI_READMEM 0x91
157 #define JTAGARM7TDMI_WRITE_FLASH_PAGE 0x92
158 #define JTAGARM7TDMI_READ_FLASH_PAGE 0x93
159 #define JTAGARM7TDMI_MASS_ERASE_FLASH 0x94
160 #define JTAGARM7TDMI_PROGRAM_FLASH 0x95
161 #define JTAGARM7TDMI_LOCKCHIP 0x96
162 #define JTAGARM7TDMI_CHIP_ERASE 0x97
163 // Really ARM specific stuff
164 #define JTAGARM7TDMI_GET_CPSR 0x98
165 #define JTAGARM7TDMI_SET_CPSR 0x99
166 #define JTAGARM7TDMI_GET_SPSR 0x9a
167 #define JTAGARM7TDMI_SET_SPSR 0x9b
168 #define JTAGARM7TDMI_SET_MODE_THUMB 0x9c
169 #define JTAGARM7TDMI_SET_MODE_ARM 0x9d
172 // for deeper understanding, read the instruction cycle timing section of:
173 // http://www.atmel.com/dyn/resources/prod_documents/DDI0029G_7TDMI_R3_trm.pdf
174 #define EXECNOPARM 0xe1a00000
175 #define ARM_INSTR_NOP 0xe1a00000
176 #define ARM_INSTR_STR_Rx_r14 0xe58e0000
177 #define ARM_READ_REG ARM_INSTR_STR_Rx_r14
178 #define ARM_INSTR_LDR_Rx_r14 0xe59e0000
179 #define ARM_WRITE_REG ARM_INSTR_LDR_Rx_r14
180 #define ARM_INSTR_LDR_R1_r0_4 0xe4901004
181 #define ARM_READ_MEM ARM_INSTR_LDR_R1_r0_4
182 #define ARM_INSTR_MRS_R0_CPSR 0xf10f0000
183 #define ARM_INSTR_MSR_cpsr_cxsf_R0 0xe12ff000
184 #define ARM_INSTR_STM_R0_r0_r15 0x
185 #define ARM_INSTR_STMIA_R14_r0_rx 0xE88E0000 // add up to 65k to indicate which registers...
186 // #define ARM_INSTR_STMIA_R14_r0_rx 0x00008ee8 // add up to 65k to indicate which registers...
187 #define ARM_INSTR_SKANKREGS 0xE88Effff // add up to 65k to indicate which registers...
188 #define ARM_STORE_MULTIPLE ARM_INSTR_STMIA_R14_r0-rx
190 #define ARM_INSTR_B_PC 0xea000000
191 #define ARM_INSTR_BX_PC 0xe1200010 // need to set r0 to the desired address
192 #define THUMB_INSTR_STR_R0_r0 0x60006000
193 #define THUMB_INSTR_MOV_R0_PC 0x46b846b8
194 #define THUMB_INSTR_BX_PC 0x47784778
195 #define THUMB_INSTR_NOP 0x1c001c00
196 #define ARM_REG_PC 15
198 #define JTAG_ARM7TDMI_DBG_DBGACK 1
199 #define JTAG_ARM7TDMI_DBG_DBGRQ 2
200 #define JTAG_ARM7TDMI_DBG_IFEN 4
201 #define JTAG_ARM7TDMI_DBG_cgenL 8
202 #define JTAG_ARM7TDMI_DBG_TBIT 16