## 10 TAP Declaration

Test Access Ports (TAPs) are the core of JTAG. TAPs serve many roles, including:

- Debug Target A CPU TAP can be used as a GDB debug target
- Flash Programing Some chips program the flash directly via JTAG. Others do it indirectly, making a CPU do it.
- Program Download Using the same CPU support GDB uses, you can initialize a DRAM controller, download code to DRAM, and then start running that code.
- Boundary Scan Most chips support boundary scan, which helps test for board assembly problems like solder bridges and missing connections

OpenOCD must know about the active TAPs on your board(s). Setting up the TAPs is the core task of your configuration files. Once those TAPs are set up, you can pass their names to code which sets up CPUs and exports them as GDB targets, probes flash memory, performs low-level JTAG operations, and more.

### 10.1 Scan Chains

TAPs are part of a hardware scan chain, which is daisy chain of TAPs. They also need to be added to OpenOCD's software mirror of that hardware list, giving each member a name and associating other data with it. Simple scan chains, with a single TAP, are common in systems with a single microcontroller or microprocessor. More complex chips may have several TAPs internally. Very complex scan chains might have a dozen or more TAPs: several in one chip, more in the next, and connecting to other boards with their own chips and TAPs.

You can display the list with the `scan_chain` command. (Don't confuse this with the list displayed by the `targets` command, presented in the next chapter. That only displays TAPs for CPUs which are configured as debugging targets.) Here's what the scan chain might look like for a chip more than one TAP:

       TapName            Enabled IdCode     Expected   IrLen IrCap IrMask
    -- ------------------ ------- ---------- ---------- ----- ----- ------
     0 omap5912.dsp          Y    0x03df1d81 0x03df1d81    38 0x01  0x03
     1 omap5912.arm          Y    0x0692602f 0x0692602f     4 0x01  0x0f
     2 omap5912.unknown      Y    0x00000000 0x00000000     8 0x01  0x03

OpenOCD can detect some of that information, but not all of it. See Autoprobing. Unfortunately those TAPs can't always be autoconfigured, because not all devices provide good support for that. JTAG doesn't require supporting IDCODE instructions, and chips with JTAG routers may not link TAPs into the chain until they are told to do so.

The configuration mechanism currently supported by OpenOCD requires explicit configuration of all TAP devices using `jtag newtap` commands, as detailed later in this chapter. A command like this would declare one tap and name it `chip1.cpu`:

         jtag newtap chip1 cpu -irlen 4 -expected-id 0x3ba00477

Each target configuration file lists the TAPs provided by a given chip. Board configuration files combine all the targets on a board, and so forth. Note that the order in which TAPs are declared is very important. It must match the order in the JTAG scan chain, both inside a single chip and between them. See FAQ TAP Order.

For example, the ST Microsystems STR912 chip has three separate TAPs1. To configure those taps, `target/str912.cfg` includes commands something like this:

         jtag newtap str912 flash ... params ...
         jtag newtap str912 cpu ... params ...
         jtag newtap str912 bs ... params ...

Actual config files use a variable instead of literals like `str912`, to support more than one chip of each type. See Config File Guidelines.

— Command: jtag names

> Returns the names of all current TAPs in the scan chain. Use `jtag cget` or `jtag tapisenabled` to examine attributes and state of each TAP.

>               foreach t [jtag names] {
>                   puts [format "TAP: %s\n" $t]
>               }

— Command: scan_chain

> Displays the TAPs in the scan chain configuration, and their status. The set of TAPs listed by this command is fixed by exiting the OpenOCD configuration stage, but systems with a JTAG router can enable or disable TAPs dynamically.

### 10.2 TAP Names

When TAP objects are declared with `jtag newtap`, a dotted.name is created for the TAP, combining the name of a module (usually a chip) and a label for the TAP. For example: `xilinx.tap`, `str912.flash`, `omap3530.jrc`, `dm6446.dsp`, or `stm32.cpu`. Many other commands use that dotted.name to manipulate or refer to the TAP. For example, CPU configuration uses the name, as does declaration of NAND or NOR flash banks.

The components of a dotted name should follow “C” symbol name rules: start with an alphabetic character, then numbers and underscores are OK; while others (including dots!) are not.

> Tip: In older code, JTAG TAPs were numbered from 0..N. This feature is still present. However its use is highly discouraged, and should not be relied on; it will be removed by mid-2010. Update all of your scripts to use TAP names rather than numbers, by paying attention to the runtime warnings they trigger. Using TAP numbers in target configuration scripts prevents reusing those scripts on boards with multiple targets.

### 10.3 TAP Declaration Commands

— Command: jtag newtap chipname tapname configparams...

> Declares a new TAP with the dotted name chipname.tapname, and configured according to the various configparams.

> The chipname is a symbolic name for the chip. Conventionally target config files use `$_CHIPNAME`, defaulting to the model name given by the chip vendor but overridable.

> The tapname reflects the role of that TAP, and should follow this convention:

> - `bs` – For boundary scan if this is a seperate TAP;
> - `cpu` – The main CPU of the chip, alternatively `arm` and `dsp` on chips with both ARM and DSP CPUs, `arm1` and `arm2` on chips two ARMs, and so forth;
> - `etb` – For an embedded trace buffer (example: an ARM ETB11);
> - `flash` – If the chip has a flash TAP, like the str912;
> - `jrc` – For JTAG route controller (example: the ICEpick modules on many Texas Instruments chips, like the OMAP3530 on Beagleboards);
> - `tap` – Should be used only FPGA or CPLD like devices with a single TAP;
> - `unknownN` – If you have no idea what the TAP is for (N is a number);
> - when in doubt – Use the chip maker's name in their data sheet. For example, the Freescale IMX31 has a SDMA (Smart DMA) with a JTAG TAP; that TAP should be named `sdma`.

> Every TAP requires at least the following configparams:

> - `-irlen` NUMBER
>   The length in bits of the instruction register, such as 4 or 5 bits.

> A TAP may also provide optional configparams:

> - `-disable` (or `-enable`)
>   Use the `-disable` parameter to flag a TAP which is not linked in to the scan chain after a reset using either TRST or the JTAG state machine's reset state. You may use `-enable` to highlight the default state (the TAP is linked in). See Enabling and Disabling TAPs.
> - `-expected-id` number
>   A non-zero number represents a 32-bit IDCODE which you expect to find when the scan chain is examined. These codes are not required by all JTAG devices. Repeat the option as many times as required if more than one ID code could appear (for example, multiple versions). Specify number as zero to suppress warnings about IDCODE values that were found but not included in the list.

>   Provide this value if at all possible, since it lets OpenOCD tell when the scan chain it sees isn't right. These values are provided in vendors' chip documentation, usually a technical reference manual. Sometimes you may need to probe the JTAG hardware to find these values. See Autoprobing.

> - `-ignore-version`
>   Specify this to ignore the JTAG version field in the `-expected-id` option. When vendors put out multiple versions of a chip, or use the same JTAG-level ID for several largely-compatible chips, it may be more practical to ignore the version field than to update config files to handle all of the various chip IDs.
> - `-ircapture` NUMBER
>   The bit pattern loaded by the TAP into the JTAG shift register on entry to the ircapture state, such as 0x01. JTAG requires the two LSBs of this value to be 01. By default, `-ircapture` and `-irmask` are set up to verify that two-bit value. You may provide additional bits, if you know them, or indicate that a TAP doesn't conform to the JTAG specification.
> - `-irmask` NUMBER
>   A mask used with `-ircapture` to verify that instruction scans work correctly. Such scans are not used by OpenOCD except to verify that there seems to be no problems with JTAG scan chain operations.

### 10.4 Other TAP commands

— Command: jtag cget dotted.name `-event` name
— Command: jtag configure dotted.name `-event` name string

> At this writing this TAP attribute mechanism is used only for event handling. (It is not a direct analogue of the `cget`/`configure` mechanism for debugger targets.) See the next section for information about the available events.

> The `configure` subcommand assigns an event handler, a TCL string which is evaluated when the event is triggered. The `cget` subcommand returns that handler.

### 10.5 TAP Events

OpenOCD includes two event mechanisms. The one presented here applies to all JTAG TAPs. The other applies to debugger targets, which are associated with certain TAPs.

The TAP events currently defined are:

- post-reset
  The TAP has just completed a JTAG reset. The tap may still be in the JTAG reset state. Handlers for these events might perform initialization sequences such as issuing TCK cycles, TMS sequences to ensure exit from the ARM SWD mode, and more.

  Because the scan chain has not yet been verified, handlers for these events should not issue commands which scan the JTAG IR or DR registers of any particular target. NOTE: As this is written (September 2009), nothing prevents such access.

- setup
  The scan chain has been reset and verified. This handler may enable TAPs as needed.
- tap-disable
  The TAP needs to be disabled. This handler should implement `jtag tapdisable` by issuing the relevant JTAG commands.
- tap-enable
  The TAP needs to be enabled. This handler should implement `jtag tapenable` by issuing the relevant JTAG commands.

If you need some action after each JTAG reset, which isn't actually specific to any TAP (since you can't yet trust the scan chain's contents to be accurate), you might:

         jtag configure CHIP.jrc -event post-reset {
           echo "JTAG Reset done"
           ... non-scan jtag operations to be done after reset
         }

### 10.6 Enabling and Disabling TAPs

In some systems, a JTAG Route Controller (JRC) is used to enable and/or disable specific JTAG TAPs. Many ARM based chips from Texas Instruments include an “ICEpick” module, which is a JRC. Such chips include DaVinci and OMAP3 processors.

A given TAP may not be visible until the JRC has been told to link it into the scan chain; and if the JRC has been told to unlink that TAP, it will no longer be visible. Such routers address problems that JTAG “bypass mode” ignores, such as:

- The scan chain can only go as fast as its slowest TAP.
- Having many TAPs slows instruction scans, since all TAPs receive new instructions.
- TAPs in the scan chain must be powered up, which wastes power and prevents debugging some power management mechanisms.

The IEEE 1149.1 JTAG standard has no concept of a “disabled” tap, as implied by the existence of JTAG routers. However, the upcoming IEEE 1149.7 framework (layered on top of JTAG) does include a kind of JTAG router functionality.

In OpenOCD, tap enabling/disabling is invoked by the Tcl commands shown below, and is implemented using TAP event handlers. So for example, when defining a TAP for a CPU connected to a JTAG router, your `target.cfg` file should define TAP event handlers using code that looks something like this:

         jtag configure CHIP.cpu -event tap-enable {
           ... jtag operations using CHIP.jrc
         }
         jtag configure CHIP.cpu -event tap-disable {
           ... jtag operations using CHIP.jrc
         }

Then you might want that CPU's TAP enabled almost all the time:

         jtag configure $CHIP.jrc -event setup "jtag tapenable $CHIP.cpu"

Note how that particular setup event handler declaration uses quotes to evaluate `$CHIP` when the event is configured. Using brackets { } would cause it to be evaluated later, at runtime, when it might have a different value.

— Command: jtag tapdisable dotted.name

> If necessary, disables the tap by sending it a `tap-disable` event. Returns the string "1" if the tap specified by dotted.name is enabled, and "0" if it is disabled.

— Command: jtag tapenable dotted.name

> If necessary, enables the tap by sending it a `tap-enable` event. Returns the string "1" if the tap specified by dotted.name is enabled, and "0" if it is disabled.

— Command: jtag tapisenabled dotted.name

> Returns the string "1" if the tap specified by dotted.name is enabled, and "0" if it is disabled.

> > Note: Humans will find the `scan_chain` command more helpful for querying the state of the JTAG taps.

### 10.7 Autoprobing

TAP configuration is the first thing that needs to be done after interface and reset configuration. Sometimes it's hard finding out what TAPs exist, or how they are identified. Vendor documentation is not always easy to find and use.

To help you get past such problems, OpenOCD has a limited autoprobing ability to look at the scan chain, doing a blind interrogation and then reporting the TAPs it finds. To use this mechanism, start the OpenOCD server with only data that configures your JTAG interface, and arranges to come up with a slow clock (many devices don't support fast JTAG clocks right when they come out of reset).

For example, your `openocd.cfg` file might have:

         source [find interface/olimex-arm-usb-tiny-h.cfg]
         reset_config trst_and_srst
         jtag_rclk 8

When you start the server without any TAPs configured, it will attempt to autoconfigure the TAPs. There are two parts to this:

1. TAP discovery ... After a JTAG reset (sometimes a system reset may be needed too), each TAP's data registers will hold the contents of either the IDCODE or BYPASS register. If JTAG communication is working, OpenOCD will see each TAP, and report what `-expected-id` to use with it.
2. IR Length discovery ... Unfortunately JTAG does not provide a reliable way to find out the value of the `-irlen` parameter to use with a TAP that is discovered. If OpenOCD can discover the length of a TAP's instruction register, it will report it. Otherwise you may need to consult vendor documentation, such as chip data sheets or BSDL files.

In many cases your board will have a simple scan chain with just a single device. Here's what OpenOCD reported with one board that's a bit more complex:

         clock speed 8 kHz
         There are no enabled taps.  AUTO PROBING MIGHT NOT WORK!!
         AUTO auto0.tap - use "jtag newtap auto0 tap -expected-id 0x2b900f0f ..."
         AUTO auto1.tap - use "jtag newtap auto1 tap -expected-id 0x07926001 ..."
         AUTO auto2.tap - use "jtag newtap auto2 tap -expected-id 0x0b73b02f ..."
         AUTO auto0.tap - use "... -irlen 4"
         AUTO auto1.tap - use "... -irlen 4"
         AUTO auto2.tap - use "... -irlen 6"
         no gdb ports allocated as no target has been specified

Given that information, you should be able to either find some existing config files to use, or create your own. If you create your own, you would configure from the bottom up: first a `target.cfg` file with these TAPs, any targets associated with them, and any on-chip resources; then a `board.cfg` with off-chip resources, clocking, and so forth.

#### Footnotes

[1] See the ST document titled: STR91xFAxxx, Section 3.15 Jtag Interface, Page: 28/102, Figure 3: JTAG chaining inside the STR91xFA. http://eu.st.com/stonline/products/literature/ds/13495.pdf