J-Link cJTAG specifics

J-Link supports cJTAG as a target interface. While cJTAG is basically serializing TMS, TDI, TDO on one bi-directional line, it also specifies a whole set of new features and commands to configure the cJTAG interface that is independent from the CPU core debug logic. This wiki article explains the specifics when using the cJTAG interface with J-Link.

Connect sequence

Initially, J-Link does not know in what mode the cJTAG interface is. (There are several different sub-protocols available where TMS / TDI / TDO data may be omitted) Therefore, J-Link needs to bring the cJTAG interface into a known state where to start from. This sequence is explained in the following

Standard connect sequence

WriteEscapeSeq(10);        // Escape sequence "Reset": >= 8 TMS line state changes while TCK == HIGH
                           // cJTAG TAP7 is in JScan0 mode now (TCK + TMS are transmitted)
WriteTMS(0xFFFFFFFF, xx);  // >= 22 dummy clocks with TMS == HIGH. TAP: ??? => Reset
WriteTMS(0x00, 1);         // TAP: Reset -> Idle
WriteEscapeSeq(7);         // Escape sequence "Selection"
WriteTMS(0x00, 4);         // 4-bit OAC sequence: Wake-up TAP7 of all technologies
WriteTMS(0x00, 4);         // 4-bit EC sequence: Use long-form selection sequence that also allows to specify the active format in detail
WriteTMS(0x00000000, 24);  // Write all 0s for 24-bit global register init values: SCNFMT, DLYC, RDYC, TPST, TPPREV, TP_DELN
WriteTMS(0x00, 4);         // Check packet
SetCmdLevel(2);            // Set command level to 2 and lock it
WriteTAP7Cmd1Param(1, 1);  // STC1.SREDGE = 1
WriteTAP7Cmd1Param(3, 9);  // STFMT[4:0] == 9 => OScan1
WriteTMS(0x00, 4);         // Check packet
                           // OScan1 protocol is active from now on
WriteTAP7Cmd1Param(7, 0);  // MSC = 0
WriteOScan1(0, 0, 1);      // Needed for SPA to CPA transition
WriteTMS(0x00, 4);         // Check packet
WriteOScan1(0x1B, 0, 6);   // Exit command level 2: Idle -> DR-Scan -> IR-Scan -> Capture-IR -> Exit1-IR -> Update-IR -> Idle
                           // J-Link will start communicating with the target core itself. OScan1 is used all the time from now on

WriteTMS(U32 Data, U32 NumBits):

Outputs exactly <NumBits> bits on the TMS line, no matter what protocol is currently active

WriteOScan1(U32 TMSData, U32 TDIData, U32 NumBits):

Outputs <NumBits> bits via OScan1. E.g. for <NumBits> == 2, the following will be output: 1 clock nTDI, 1 clock TMS, 1 clock TDO

WriteEscapeSeq(U32 NumToggle):

Toggle TMS <NumToggle> times while TCK == HIGH

Short connect sequence

Some vendors did not implement a fully blown cJTAG interface in their devices (e.g. SiFive on their E31ARTY FPGA bitstream). For such devices, J-Link offers a short connect sequence that may be used instead of the standard one.

Note: By default, J-Link will use the standard connect sequence. In order to make J-Link to use the short one instead, a command string needs to be executed before connecting to the device: "SetcJTAGInitMode = 1". For more information about how to use command strings, please refer to this wiki article

WriteEscapeSeq(10);        // Escape sequence "Reset": >= 8 TMS line state changes while TCK == HIGH
                           // cJTAG TAP7 is in JScan0 mode now (TCK + TMS are transmitted)
WriteTMS(0xFFFFFFFF, xx);  // >= 22 dummy clocks with TMS == HIGH. TAP: ??? => Reset
WriteTMS(0x00, 1);         // TAP: Reset -> Idle
WriteEscapeSeq(7);         // Escape sequence "Selection"
WriteTMS(0x0C, 4);         // 4-bit OAC sequence: Wake-up 2-wire TAP7 only. Boot with OScan format being active
WriteTMS(0x08, 4);         // 4-bit EC sequence
WriteTMS(0x00, 4);         // Check packet
                           // OScan1 protocol is active from now on
                           // J-Link will start communicating with the target core itself. OScan1 is used all the time from now on

Note: In case none of the sequences match for the device in use, please get in touch with us.

Short connect sequence

TBD