]>
Commit | Line | Data |
---|---|---|
66a8517e UH |
1 | ## |
2 | ## This file is part of the sigrok project. | |
3 | ## | |
4 | ## Copyright (C) 2012 Uwe Hermann <uwe@hermann-uwe.de> | |
5 | ## | |
6 | ## This program is free software; you can redistribute it and/or modify | |
7 | ## it under the terms of the GNU General Public License as published by | |
8 | ## the Free Software Foundation; either version 2 of the License, or | |
9 | ## (at your option) any later version. | |
10 | ## | |
11 | ## This program is distributed in the hope that it will be useful, | |
12 | ## but WITHOUT ANY WARRANTY; without even the implied warranty of | |
13 | ## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
14 | ## GNU General Public License for more details. | |
15 | ## | |
16 | ## You should have received a copy of the GNU General Public License | |
17 | ## along with this program; if not, write to the Free Software | |
18 | ## Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA | |
19 | ## | |
20 | ||
21 | # ST STM32 JTAG protocol decoder | |
22 | ||
23 | import sigrokdecode as srd | |
24 | ||
25 | # JTAG debug port data registers (in IR[3:0]) and their sizes (in bits) | |
457acc28 UH |
26 | # Note: The ARM DAP-DP is not IEEE 1149.1 (JTAG) compliant (as per ARM docs), |
27 | # as it does not implement the EXTEST, SAMPLE, and PRELOAD instructions. | |
28 | # Instead, BYPASS is decoded for any of these instructions. | |
66a8517e UH |
29 | ir = { |
30 | '1111': ['BYPASS', 1], # Bypass register | |
31 | '1110': ['IDCODE', 32], # ID code register | |
32 | '1010': ['DPACC', 35], # Debug port access register | |
33 | '1011': ['APACC', 35], # Access port access register | |
e9656a0c | 34 | '1000': ['ABORT', 35], # Abort register # TODO: 32 bits? Datasheet typo? |
66a8517e UH |
35 | } |
36 | ||
37 | # ARM Cortex-M3 r1p1-01rel0 ID code | |
38 | cm3_idcode = 0x3ba00477 | |
39 | ||
40 | # JTAG ID code in the STM32F10xxx BSC (boundary scan) TAP | |
41 | jtag_idcode = { | |
42 | 0x06412041: 'Low-density device, rev. A', | |
43 | 0x06410041: 'Medium-density device, rev. A', | |
44 | 0x16410041: 'Medium-density device, rev. B/Z/Y', | |
45 | 0x06414041: 'High-density device, rev. A/Z/Y', | |
46 | 0x06430041: 'XL-density device, rev. A', | |
47 | 0x06418041: 'Connectivity-line device, rev. A/Z', | |
48 | } | |
49 | ||
50 | # ACK[2:0] in the DPACC/APACC registers | |
51 | ack_val = { | |
52 | '000': 'Reserved', | |
53 | '001': 'WAIT', | |
54 | '010': 'OK/FAULT', | |
55 | '011': 'Reserved', | |
56 | '100': 'Reserved', | |
57 | '101': 'Reserved', | |
58 | '110': 'Reserved', | |
59 | '111': 'Reserved', | |
60 | } | |
61 | ||
62 | # 32bit debug port registers (addressed via A[3:2]) | |
63 | reg = { | |
64 | '00': 'Reserved', # Must be kept at reset value | |
65 | '01': 'DP CTRL/STAT', | |
66 | '10': 'DP SELECT', | |
67 | '11': 'DP RDBUFF', | |
68 | } | |
69 | ||
e9656a0c UH |
70 | # TODO: All start/end sample values in self.put() calls are bogus. |
71 | ||
457acc28 UH |
72 | # Bits[31:28]: Version (here: 0x3) |
73 | # JTAG-DP: 0x3, SW-DP: 0x2 | |
74 | # Bits[27:12]: Part number (here: 0xba00) | |
75 | # JTAG-DP: 0xba00, SW-DP: 0xba10 | |
76 | # Bits[11:1]: JEDEC (JEP-106) manufacturer ID (here: 0x23b) | |
77 | # Bits[11:8]: Continuation code ('ARM Limited': 0x04) | |
78 | # Bits[7:1]: Identity code ('ARM Limited': 0x3b) | |
79 | # Bits[0:0]: Reserved (here: 0x1) | |
80 | def decode_device_id_code(bits): | |
81 | id_hex = '0x%x' % int('0b' + bits, 2) | |
82 | ver = '0x%x' % int('0b' + bits[-32:-28], 2) | |
83 | part = '0x%x' % int('0b' + bits[-28:-12], 2) | |
84 | manuf = '0x%x' % int('0b' + bits[-12:-1], 2) | |
85 | res = '0x%x' % int('0b' + bits[-1], 2) | |
86 | return (id_hex, ver, part, manuf, res) | |
87 | ||
c840e704 UH |
88 | def dpacc_data_in(bits): |
89 | data, a, rnw = bits[:-3], bits[-3:-1], bits[-1] | |
90 | data_hex = '0x%x' % int('0b' + data, 2) | |
91 | r = 'Read request' if (rnw == '1') else 'Write request' | |
92 | return 'DATA: %s, A: %s, RnW: %s' % (data_hex, reg[a], r) | |
93 | ||
94 | def dpacc_data_out(bits): | |
95 | data, ack = bits[:-3], bits[-3:] | |
96 | data_hex = '0x%x' % int('0b' + data, 2) | |
97 | ack_meaning = ack_val[ack] | |
98 | return 'DATA: %s, ACK: %s' % (data_hex, ack_meaning) | |
99 | ||
66a8517e UH |
100 | class Decoder(srd.Decoder): |
101 | api_version = 1 | |
102 | id = 'jtag_stm32' | |
103 | name = 'JTAG / STM32' | |
104 | longname = 'Joint Test Action Group / ST STM32' | |
105 | desc = 'ST STM32-specific JTAG protocol.' | |
106 | license = 'gplv2+' | |
107 | inputs = ['jtag'] | |
108 | outputs = ['jtag_stm32'] | |
109 | probes = [] | |
110 | optional_probes = [] | |
111 | options = {} | |
112 | annotations = [ | |
e9656a0c | 113 | ['Text', 'Human-readable text'], |
66a8517e UH |
114 | ] |
115 | ||
116 | def __init__(self, **kwargs): | |
117 | self.state = 'IDLE' | |
e9656a0c | 118 | # self.state = 'BYPASS' |
66a8517e UH |
119 | |
120 | def start(self, metadata): | |
121 | # self.out_proto = self.add(srd.OUTPUT_PROTO, 'jtag_stm32') | |
122 | self.out_ann = self.add(srd.OUTPUT_ANN, 'jtag_stm32') | |
123 | ||
124 | def report(self): | |
125 | pass | |
126 | ||
127 | def handle_reg_bypass(self, bits): | |
128 | # TODO | |
e9656a0c | 129 | self.put(self.ss, self.es, self.out_ann, [0, ['BYPASS: ' + bits]]) |
66a8517e UH |
130 | |
131 | def handle_reg_idcode(self, bits): | |
132 | # TODO | |
c840e704 UH |
133 | # IDCODE is a read-only register which is always accessible. |
134 | # IR == IDCODE: The device ID code is shifted out via DR next. | |
e9656a0c | 135 | self.put(self.ss, self.es, self.out_ann, |
457acc28 UH |
136 | [0, ['IDCODE: %s (ver=%s, part=%s, manuf=%s, res=%s)' % \ |
137 | decode_device_id_code(bits)]]) | |
66a8517e | 138 | |
c840e704 | 139 | # DPACC is used to access debug port registers (CTRL/STAT, SELECT, RDBUFF). |
66a8517e UH |
140 | # When transferring data IN: |
141 | # Bits[34:3] = DATA[31:0]: 32bit data to transfer (write request) | |
142 | # Bits[2:1] = A[3:2]: 2-bit address of a debug port register | |
143 | # Bits[0:0] = RnW: Read request (1) or write request (0) | |
144 | # When transferring data OUT: | |
145 | # Bits[34:3] = DATA[31:0]: 32bit data which is read (read request) | |
146 | # Bits[2:0] = ACK[2:0]: 3-bit acknowledge | |
147 | def handle_reg_dpacc(self, bits): | |
e9656a0c UH |
148 | self.put(self.ss, self.es, self.out_ann, [0, ['DPACC: ' + bits]]) |
149 | ||
150 | # TODO: When to use Data IN / Data OUT? | |
c840e704 UH |
151 | self.put(self.ss, self.es, self.out_ann, [0, [dpacc_data_in(bits)]]) |
152 | self.put(self.ss, self.es, self.out_ann, [0, [dpacc_data_out(bits)]]) | |
66a8517e | 153 | |
c840e704 | 154 | # APACC is used to access all Access Port (AHB-AP) registers. |
e9656a0c UH |
155 | # When transferring data IN: |
156 | # Bits[34:3] = DATA[31:0]: 32bit data to shift in (write request) | |
157 | # Bits[2:1] = A[3:2]: 2-bit address (sub-address AP register) | |
158 | # Bits[0:0] = RnW: Read request (1) or write request (0) | |
159 | # When transferring data OUT: | |
160 | # Bits[34:3] = DATA[31:0]: 32bit data which is read (read request) | |
161 | # Bits[2:0] = ACK[2:0]: 3-bit acknowledge | |
66a8517e | 162 | def handle_reg_apacc(self, bits): |
e9656a0c UH |
163 | self.put(self.ss, self.es, self.out_ann, [0, ['APACC: ' + bits]]) |
164 | ||
165 | # TODO: When to use Data IN / Data OUT? | |
c840e704 UH |
166 | self.put(self.ss, self.es, self.out_ann, [0, [dpacc_data_in(bits)]]) |
167 | self.put(self.ss, self.es, self.out_ann, [0, [dpacc_data_out(bits)]]) | |
66a8517e UH |
168 | |
169 | def handle_reg_abort(self, bits): | |
170 | # Bits[31:1]: reserved. Bit[0]: DAPABORT. | |
171 | a = '' if (bits[0] == '1') else 'No ' | |
172 | s = 'DAPABORT = %s: %sDAP abort generated' % (bits[0], a) | |
173 | self.put(self.ss, self.es, self.out_ann, [0, [s]]) | |
174 | ||
e9656a0c | 175 | # Warn if DAPABORT[31:1] contains non-zero bits. |
66a8517e | 176 | if (bits[:-1] != ('0' * 31)): |
e9656a0c UH |
177 | self.put(self.ss, self.es, self.out_ann, |
178 | [0, ['WARNING: DAPABORT[31:1] reserved!']]) | |
179 | ||
180 | def handle_reg_unknown(self, bits): | |
181 | self.put(self.ss, self.es, self.out_ann, | |
182 | [0, ['Unknown instruction: ' % bits]]) # TODO | |
66a8517e UH |
183 | |
184 | def decode(self, ss, es, data): | |
185 | # Assumption: The right-most char in the 'val' bitstring is the LSB. | |
186 | cmd, val = data | |
187 | ||
188 | self.ss, self.es = ss, es | |
189 | ||
e9656a0c | 190 | # self.put(self.ss, self.es, self.out_ann, [0, [cmd + ' / ' + val]]) |
66a8517e UH |
191 | |
192 | # State machine | |
e9656a0c UH |
193 | if self.state == 'IDLE': |
194 | # Wait until a new instruction is shifted into the IR register. | |
195 | if cmd != 'IR TDI': | |
196 | return | |
197 | # Switch to the state named after the instruction, or 'UNKNOWN'. | |
198 | self.state = ir.get(val[-4:], ['UNKNOWN', 0])[0] | |
199 | self.put(self.ss, self.es, self.out_ann, [0, ['IR: ' + self.state]]) | |
200 | elif self.state in ('BYPASS'): | |
201 | # In these states we're interested in incoming bits (TDI). | |
202 | if cmd != 'DR TDI': | |
203 | return | |
204 | handle_reg = getattr(self, 'handle_reg_%s' % self.state.lower()) | |
205 | handle_reg(val) | |
206 | self.state = 'IDLE' | |
207 | elif self.state in ('IDCODE', 'DPACC', 'APACC', 'ABORT', 'UNKNOWN'): | |
208 | # In these states we're interested in outgoing bits (TDO). | |
457acc28 UH |
209 | if cmd != 'DR TDO': |
210 | # if cmd not in ('DR TDI', 'DR TDO'): | |
e9656a0c UH |
211 | return |
212 | handle_reg = getattr(self, 'handle_reg_%s' % self.state.lower()) | |
213 | handle_reg(val) | |
214 | self.state = 'IDLE' | |
215 | else: | |
216 | raise Exception('Invalid state: %s' % self.state) | |
66a8517e | 217 |