]>
Commit | Line | Data |
---|---|---|
66a8517e | 1 | ## |
50bd5d25 | 2 | ## This file is part of the libsigrokdecode project. |
66a8517e | 3 | ## |
6cdc1e09 | 4 | ## Copyright (C) 2012-2015 Uwe Hermann <uwe@hermann-uwe.de> |
66a8517e UH |
5 | ## |
6 | ## This program is free software; you can redistribute it and/or modify | |
7 | ## it under the terms of the GNU General Public License as published by | |
8 | ## the Free Software Foundation; either version 2 of the License, or | |
9 | ## (at your option) any later version. | |
10 | ## | |
11 | ## This program is distributed in the hope that it will be useful, | |
12 | ## but WITHOUT ANY WARRANTY; without even the implied warranty of | |
13 | ## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
14 | ## GNU General Public License for more details. | |
15 | ## | |
16 | ## You should have received a copy of the GNU General Public License | |
17 | ## along with this program; if not, write to the Free Software | |
18 | ## Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA | |
19 | ## | |
20 | ||
66a8517e UH |
21 | import sigrokdecode as srd |
22 | ||
23 | # JTAG debug port data registers (in IR[3:0]) and their sizes (in bits) | |
457acc28 UH |
24 | # Note: The ARM DAP-DP is not IEEE 1149.1 (JTAG) compliant (as per ARM docs), |
25 | # as it does not implement the EXTEST, SAMPLE, and PRELOAD instructions. | |
26 | # Instead, BYPASS is decoded for any of these instructions. | |
66a8517e UH |
27 | ir = { |
28 | '1111': ['BYPASS', 1], # Bypass register | |
29 | '1110': ['IDCODE', 32], # ID code register | |
30 | '1010': ['DPACC', 35], # Debug port access register | |
31 | '1011': ['APACC', 35], # Access port access register | |
e9656a0c | 32 | '1000': ['ABORT', 35], # Abort register # TODO: 32 bits? Datasheet typo? |
66a8517e UH |
33 | } |
34 | ||
35 | # ARM Cortex-M3 r1p1-01rel0 ID code | |
36 | cm3_idcode = 0x3ba00477 | |
37 | ||
38 | # JTAG ID code in the STM32F10xxx BSC (boundary scan) TAP | |
39 | jtag_idcode = { | |
40 | 0x06412041: 'Low-density device, rev. A', | |
41 | 0x06410041: 'Medium-density device, rev. A', | |
42 | 0x16410041: 'Medium-density device, rev. B/Z/Y', | |
43 | 0x06414041: 'High-density device, rev. A/Z/Y', | |
44 | 0x06430041: 'XL-density device, rev. A', | |
45 | 0x06418041: 'Connectivity-line device, rev. A/Z', | |
46 | } | |
47 | ||
d274e1bf | 48 | # ACK[2:0] in the DPACC/APACC registers (unlisted values are reserved) |
66a8517e | 49 | ack_val = { |
66a8517e UH |
50 | '001': 'WAIT', |
51 | '010': 'OK/FAULT', | |
66a8517e UH |
52 | } |
53 | ||
54 | # 32bit debug port registers (addressed via A[3:2]) | |
d274e1bf | 55 | dp_reg = { |
66a8517e UH |
56 | '00': 'Reserved', # Must be kept at reset value |
57 | '01': 'DP CTRL/STAT', | |
58 | '10': 'DP SELECT', | |
59 | '11': 'DP RDBUFF', | |
60 | } | |
61 | ||
d274e1bf UH |
62 | # APB-AP registers (each of them 32 bits wide) |
63 | apb_ap_reg = { | |
64 | 0x00: ['CSW', 'Control/status word'], | |
65 | 0x04: ['TAR', 'Transfer address'], | |
66 | # 0x08: Reserved SBZ | |
67 | 0x0c: ['DRW', 'Data read/write'], | |
68 | 0x10: ['BD0', 'Banked data 0'], | |
69 | 0x14: ['BD1', 'Banked data 1'], | |
70 | 0x18: ['BD2', 'Banked data 2'], | |
71 | 0x1c: ['BD3', 'Banked data 3'], | |
72 | # 0x20-0xf4: Reserved SBZ | |
73 | 0x800000000: ['ROM', 'Debug ROM address'], | |
74 | 0xfc: ['IDR', 'Identification register'], | |
75 | } | |
76 | ||
d274e1bf | 77 | # TODO: Split off generic ARM/Cortex-M3 parts into another protocol decoder? |
e9656a0c | 78 | |
457acc28 UH |
79 | # Bits[31:28]: Version (here: 0x3) |
80 | # JTAG-DP: 0x3, SW-DP: 0x2 | |
81 | # Bits[27:12]: Part number (here: 0xba00) | |
82 | # JTAG-DP: 0xba00, SW-DP: 0xba10 | |
83 | # Bits[11:1]: JEDEC (JEP-106) manufacturer ID (here: 0x23b) | |
84 | # Bits[11:8]: Continuation code ('ARM Limited': 0x04) | |
85 | # Bits[7:1]: Identity code ('ARM Limited': 0x3b) | |
86 | # Bits[0:0]: Reserved (here: 0x1) | |
87 | def decode_device_id_code(bits): | |
88 | id_hex = '0x%x' % int('0b' + bits, 2) | |
89 | ver = '0x%x' % int('0b' + bits[-32:-28], 2) | |
90 | part = '0x%x' % int('0b' + bits[-28:-12], 2) | |
91 | manuf = '0x%x' % int('0b' + bits[-12:-1], 2) | |
92 | res = '0x%x' % int('0b' + bits[-1], 2) | |
93 | return (id_hex, ver, part, manuf, res) | |
94 | ||
d274e1bf UH |
95 | # DPACC is used to access debug port registers (CTRL/STAT, SELECT, RDBUFF). |
96 | # APACC is used to access all Access Port (AHB-AP) registers. | |
97 | ||
98 | # APACC/DPACC, when transferring data IN: | |
99 | # Bits[34:3] = DATA[31:0]: 32bit data to transfer (write request) | |
100 | # Bits[2:1] = A[3:2]: 2-bit address (debug/access port register) | |
101 | # Bits[0:0] = RnW: Read request (1) or write request (0) | |
102 | def data_in(instruction, bits): | |
c840e704 UH |
103 | data, a, rnw = bits[:-3], bits[-3:-1], bits[-1] |
104 | data_hex = '0x%x' % int('0b' + data, 2) | |
105 | r = 'Read request' if (rnw == '1') else 'Write request' | |
d274e1bf UH |
106 | # reg = dp_reg[a] if (instruction == 'DPACC') else apb_ap_reg[a] |
107 | reg = dp_reg[a] if (instruction == 'DPACC') else a # TODO | |
108 | return 'New transaction: DATA: %s, A: %s, RnW: %s' % (data_hex, reg, r) | |
109 | ||
110 | # APACC/DPACC, when transferring data OUT: | |
111 | # Bits[34:3] = DATA[31:0]: 32bit data which is read (read request) | |
112 | # Bits[2:0] = ACK[2:0]: 3-bit acknowledge | |
113 | def data_out(bits): | |
c840e704 UH |
114 | data, ack = bits[:-3], bits[-3:] |
115 | data_hex = '0x%x' % int('0b' + data, 2) | |
d274e1bf UH |
116 | ack_meaning = ack_val.get(ack, 'Reserved') |
117 | return 'Previous transaction result: DATA: %s, ACK: %s' \ | |
118 | % (data_hex, ack_meaning) | |
c840e704 | 119 | |
66a8517e | 120 | class Decoder(srd.Decoder): |
12851357 | 121 | api_version = 2 |
66a8517e UH |
122 | id = 'jtag_stm32' |
123 | name = 'JTAG / STM32' | |
124 | longname = 'Joint Test Action Group / ST STM32' | |
125 | desc = 'ST STM32-specific JTAG protocol.' | |
126 | license = 'gplv2+' | |
127 | inputs = ['jtag'] | |
128 | outputs = ['jtag_stm32'] | |
da9bcbd9 | 129 | annotations = ( |
d011c2e1 UH |
130 | ('item', 'Item'), |
131 | ('field', 'Field'), | |
132 | ('command', 'Command'), | |
133 | ('warning', 'Warning'), | |
134 | ) | |
135 | annotation_rows = ( | |
136 | ('items', 'Items', (0,)), | |
137 | ('fields', 'Fields', (1,)), | |
138 | ('commands', 'Commands', (2,)), | |
139 | ('warnings', 'Warnings', (3,)), | |
da9bcbd9 | 140 | ) |
66a8517e UH |
141 | |
142 | def __init__(self, **kwargs): | |
143 | self.state = 'IDLE' | |
a4dd548f | 144 | self.samplenums = None |
66a8517e | 145 | |
8915b346 | 146 | def start(self): |
be465111 | 147 | self.out_ann = self.register(srd.OUTPUT_ANN) |
66a8517e | 148 | |
0edb5d58 UH |
149 | def putx(self, data): |
150 | self.put(self.ss, self.es, self.out_ann, data) | |
151 | ||
d011c2e1 UH |
152 | def putf(self, s, e, data): |
153 | self.put(self.samplenums[s][0], self.samplenums[e][1], self.out_ann, data) | |
154 | ||
d274e1bf | 155 | def handle_reg_bypass(self, cmd, bits): |
0edb5d58 | 156 | self.putx([0, ['BYPASS: ' + bits]]) |
66a8517e | 157 | |
d274e1bf | 158 | def handle_reg_idcode(self, cmd, bits): |
c840e704 UH |
159 | # IDCODE is a read-only register which is always accessible. |
160 | # IR == IDCODE: The device ID code is shifted out via DR next. | |
d011c2e1 UH |
161 | |
162 | s = self.samplenums | |
163 | s.reverse() | |
164 | id_hex, ver, part, manuf, res = decode_device_id_code(bits[:-1]) | |
165 | self.putf(0, 0, [1, ['Reserved (BS TAP)', 'BS', 'B']]) | |
166 | self.putf(1, 1, [1, ['Reserved', 'Res', 'R']]) | |
167 | self.putf(2, 12, [1, ['Manufacturer: %s' % manuf, 'Manuf', 'M']]) | |
168 | self.putf(13, 28, [1, ['Part: %s' % part, 'Part', 'P']]) | |
169 | self.putf(29, 32, [1, ['Version: %s' % ver, 'Version', 'V']]) | |
170 | ||
171 | self.ss = s[1][0] | |
172 | self.putx([2, ['IDCODE: %s (ver=%s, part=%s, manuf=%s, res=%s)' % \ | |
173 | decode_device_id_code(bits[:-1])]]) | |
66a8517e | 174 | |
d274e1bf | 175 | def handle_reg_dpacc(self, cmd, bits): |
d011c2e1 | 176 | bits = bits[:-1] |
d274e1bf | 177 | s = data_in('DPACC', bits) if (cmd == 'DR TDI') else data_out(bits) |
d011c2e1 | 178 | self.putx([2, [s]]) |
d274e1bf UH |
179 | |
180 | def handle_reg_apacc(self, cmd, bits): | |
d011c2e1 | 181 | bits = bits[:-1] |
d274e1bf | 182 | s = data_in('APACC', bits) if (cmd == 'DR TDI') else data_out(bits) |
d011c2e1 | 183 | self.putx([2, [s]]) |
d274e1bf UH |
184 | |
185 | def handle_reg_abort(self, cmd, bits): | |
d011c2e1 | 186 | bits = bits[:-1] |
66a8517e UH |
187 | # Bits[31:1]: reserved. Bit[0]: DAPABORT. |
188 | a = '' if (bits[0] == '1') else 'No ' | |
189 | s = 'DAPABORT = %s: %sDAP abort generated' % (bits[0], a) | |
d011c2e1 | 190 | self.putx([2, [s]]) |
66a8517e | 191 | |
e9656a0c | 192 | # Warn if DAPABORT[31:1] contains non-zero bits. |
66a8517e | 193 | if (bits[:-1] != ('0' * 31)): |
d011c2e1 | 194 | self.putx([3, ['WARNING: DAPABORT[31:1] reserved!']]) |
e9656a0c | 195 | |
d274e1bf | 196 | def handle_reg_unknown(self, cmd, bits): |
d011c2e1 UH |
197 | bits = bits[:-1] |
198 | self.putx([2, ['Unknown instruction: %s' % bits]]) | |
66a8517e UH |
199 | |
200 | def decode(self, ss, es, data): | |
66a8517e UH |
201 | cmd, val = data |
202 | ||
203 | self.ss, self.es = ss, es | |
204 | ||
a4dd548f | 205 | if cmd != 'NEW STATE': |
a4dd548f | 206 | # The right-most char in the 'val' bitstring is the LSB. |
d011c2e1 | 207 | val, self.samplenums = val |
66a8517e UH |
208 | |
209 | # State machine | |
e9656a0c UH |
210 | if self.state == 'IDLE': |
211 | # Wait until a new instruction is shifted into the IR register. | |
212 | if cmd != 'IR TDI': | |
213 | return | |
214 | # Switch to the state named after the instruction, or 'UNKNOWN'. | |
6cdc1e09 UH |
215 | # The STM32F10xxx has two serially connected JTAG TAPs, the |
216 | # boundary scan tap (5 bits) and the Cortex-M3 TAP (4 bits). | |
217 | # See UM 31.5 "STM32F10xxx JTAG TAP connection" for details. | |
d011c2e1 UH |
218 | self.state = ir.get(val[:-1][-4:], ['UNKNOWN', 0])[0] |
219 | bstap_ir = ir.get(val[:-1][:4], ['UNKNOWN', 0])[0] | |
220 | self.putf(3, 0, [1, ['IR (BS TAP): ' + bstap_ir]]) | |
221 | self.putf(7, 4, [1, ['IR (M3 TAP): ' + self.state]]) | |
222 | self.putf(8, 8, [1, ['Reserved (BS TAP)', 'BS', 'B']]) | |
223 | self.putx([2, ['IR: %s' % self.state]]) | |
d274e1bf UH |
224 | elif self.state == 'BYPASS': |
225 | # Here we're interested in incoming bits (TDI). | |
e9656a0c UH |
226 | if cmd != 'DR TDI': |
227 | return | |
228 | handle_reg = getattr(self, 'handle_reg_%s' % self.state.lower()) | |
d274e1bf | 229 | handle_reg(cmd, val) |
e9656a0c | 230 | self.state = 'IDLE' |
d274e1bf UH |
231 | elif self.state in ('IDCODE', 'ABORT', 'UNKNOWN'): |
232 | # Here we're interested in outgoing bits (TDO). | |
457acc28 | 233 | if cmd != 'DR TDO': |
e9656a0c UH |
234 | return |
235 | handle_reg = getattr(self, 'handle_reg_%s' % self.state.lower()) | |
d274e1bf | 236 | handle_reg(cmd, val) |
e9656a0c | 237 | self.state = 'IDLE' |
d274e1bf UH |
238 | elif self.state in ('DPACC', 'APACC'): |
239 | # Here we're interested in incoming and outgoing bits (TDI/TDO). | |
240 | if cmd not in ('DR TDI', 'DR TDO'): | |
241 | return | |
242 | handle_reg = getattr(self, 'handle_reg_%s' % self.state.lower()) | |
243 | handle_reg(cmd, val) | |
0edb5d58 | 244 | if cmd == 'DR TDO': # Assumes 'DR TDI' comes before 'DR TDO'. |
d274e1bf | 245 | self.state = 'IDLE' |