J-Link cJTAG specifics

From SEGGER Wiki
Jump to: navigation, search

J-Link supports cJTAG as a target interface. While cJTAG is basically serializing TMS, TDI, TDO on one bi-directional line, it also specifies a whole set of new features and commands to configure the cJTAG interface that is independent from the CPU core debug logic. This wiki article explains the specifics when using the cJTAG interface with J-Link.

Connect sequence

Initially, J-Link does not know in what mode the cJTAG interface is. (There are several different sub-protocols available where TMS / TDI / TDO data may be omitted) Therefore, J-Link needs to bring the cJTAG interface into a known state where to start from. This sequence is explained in the following

Standard connect sequence

WriteEscapeSeq(10);        // Escape sequence "Reset": >= 8 TMS line state changes while TCK == HIGH
                           // cJTAG TAP7 is in JScan0 mode now (TCK + TMS are transmitted)
WriteTMS(0xFFFFFFFF, xx);  // >= 22 dummy clocks with TMS == HIGH. TAP: ??? => Reset
WriteTMS(0x00, 1);         // TAP: Reset -> Idle
WriteEscapeSeq(7);         // Escape sequence "Selection"
WriteTMS(0x00, 4);         // 4-bit OAC sequence: Wake-up TAP7 of all technologies
WriteTMS(0x00, 4);         // 4-bit EC sequence: Use long-form selection sequence that also allows to specify the active format in detail
WriteTMS(0x00000000, 24);  // Write all 0s for 24-bit global register init values: SCNFMT, DLYC, RDYC, TPST, TPPREV, TP_DELN
WriteTMS(0x00, 4);         // Check packet
SetCmdLevel(2);            // Set command level to 2 and lock it
WriteTAP7Cmd1Param(1, 1);  // STC1.SREDGE = 1
WriteTAP7Cmd1Param(3, 9);  // STFMT[4:0] == 9 => OScan1
WriteTMS(0x00, 4);         // Check packet
                           // OScan1 protocol is active from now on
WriteTAP7Cmd1Param(7, 0);  // MSC = 0
WriteOScan1(0, 0, 1);      // Needed for SPA to CPA transition
WriteTMS(0x00, 4);         // Check packet
WriteOScan1(0x1B, 0, 6);   // Exit command level 2: Idle -> DR-Scan -> IR-Scan -> Capture-IR -> Exit1-IR -> Update-IR -> Idle
                           // J-Link will start communicating with the target core itself. OScan1 is used all the time from now on

WriteTMS(U32 Data, U32 NumBits):

Outputs exactly <NumBits> bits on the TMS line, no matter what protocol is currently active

WriteOScan1(U32 TMSData, U32 TDIData, U32 NumBits):

Outputs <NumBits> bits via OScan1. E.g. for <NumBits> == 2, the following will be output: 1 clock nTDI, 1 clock TMS, 1 clock TDO

WriteEscapeSeq(U32 NumToggle):

Toggle TMS <NumToggle> times while TCK == HIGH

Short connect sequence

Some vendors did not implement a fully blown cJTAG interface in their devices (e.g. SiFive on their E31ARTY FPGA bitstream). For such devices, J-Link offers a short connect sequence that may be used instead of the standard one.

Note:
By default, J-Link will use the standard connect sequence. In order to make J-Link to use the short one instead, a command string needs to be executed before connecting to the device: "SetcJTAGInitMode = 1". For more information about how to use command strings, please refer to this wiki article.
WriteEscapeSeq(10);        // Escape sequence "Reset": >= 8 TMS line state changes while TCK == HIGH
                           // cJTAG TAP7 is in JScan0 mode now (TCK + TMS are transmitted)
WriteTMS(0xFFFFFFFF, xx);  // >= 22 dummy clocks with TMS == HIGH. TAP: ??? => Reset
WriteTMS(0x00, 1);         // TAP: Reset -> Idle
WriteEscapeSeq(7);         // Escape sequence "Selection"
WriteTMS(0x0C, 4);         // 4-bit OAC sequence: Wake-up 2-wire TAP7 only. Boot with OScan format being active
WriteTMS(0x08, 4);         // 4-bit EC sequence
WriteTMS(0x00, 4);         // Check packet
                           // OScan1 protocol is active from now on
                           // J-Link will start communicating with the target core itself. OScan1 is used all the time from now on
Note:
In case none of the sequences match for the device in use, please get in touch with us.

KEEPER logic

The cJTAG spec. specifies that the target device must release the TMSC pin on the rising edge of TCKC, so the debug probe can toggle TMSC while TCK == HIGH to output escape sequences.

Therefore, the cJTAG spec. also specifies a KEEPER logic to be present in the device, that takes over on rising edge of TCKC and keeps the TMSC line at the last level that was output on the previous falling edge of TCKC.

However, some devices (especially in the RISC-V segment) have a buggy KEEPER logic or no KEEPER logic at all which would result in the TMSC pin being floating after the target device has output the TDO data. A floating TMSC pin can cause the target to detect escape sequences where there are none and so cause problems.

In current J-Link models, a workaround for target devices with buggy / missing KEEPER logic is implemented. If a specific J-Link hardware version comes with this workaround, can be checked via the model overview page.


Note:
The non-existent-KEEPER workaround requires that cJTAG speeds > 500 kHz are used while communicating in OScan1 format. Therefore, J-Link ignores speed settings < 500 kHz for cJTAG and implicitly converts them to 500 kHz.