cyphunk
commented
4 years ago I finally had a chance to look at this.
On the first setion, pattern scan: There are too many FOUND results. Even after I remove the results that could have been due to the loopback entries, there are still too many. It is not uncommon to have many "FOUND" results but typically you would see that at least the TDI, TDO and TCK pins remain constant. Having the correct ntrst pin is not always required and even the TMS pin may not be required if the target is already in bypass mode on reset. On your target in the FOUND results after removing loopback pairs, the TDI and TDO change too often to indicate proper JTAG found. Another issue with the results is that the IR length on the FOUND entries is often 0. IR of 0 I think pretty much impossible so those entries can be removed. The remaining entries show very high IR lengths. Most targets have IR length of 3 to 8. The IR length will increase if more chips are in the chain together. So those high IR lengths of 34 and 68 are not impossible but unlikely. For example here are the common irlength's found in targets supported by OpenOCD:
openocd-git/tcl$ grep -r "irlen [0-9]" . | sed 's/.*irlen/irlen/'| awk '{print $1" "$2}' | sort | uniq -c | sort -n
1 irlen 11
1 irlen 16
1 irlen 18
1 irlen 2
1 irlen 32
2 irlen 12
2 irlen 7
6 irlen 38
7 irlen 10
18 irlen 8
19 irlen 6
47 irlen 5
197 irlen 4The next scan, IDCODE scan requires manually checking given output to see if they are actually valid IDCODE's and the results have a few entries worth investigating further.
ntrst:A3 tck:A9 tms:A2 tdo:A8 tdi:A0 devices: 1
0xF901A003
ntrst:A3 tck:A9 tms:A2 tdo:A8 tdi:A1 devices: 1
0xF901A003
ntrst:A3 tck:A9 tms:A2 tdo:A8 tdi:A4 devices: 1
0xF901A003
ntrst:A3 tck:A9 tms:A2 tdo:A8 tdi:A6 devices: 1
0xF901A003
ntrst:A3 tck:A9 tms:A2 tdo:A8 tdi:A7 devices: 1
0xF901A003What is nice about the above entries is that the TCK, TMS and TDO are constant. Assuming the target chip starts with IDCODE its default register then you only need to find those 3 pins to read out the IDCODE. I could not find 0xF901A003 online or in OpenOCD but that does not mean that it is not valid. An IDCODE is made of 3 parts:
def parse(idcode):
manufacturer = idcode >>1 & 0b11111111111
part = idcode >>12 & 0b1111111111111111
version = idcode >>28 & 0b1111
print("mfg: 0x%3.3x, part: 0x%4.4x, ver: 0x%1.1x"%(manufacturer,part,version))
>>> parse(0xF901A003)
mfg: 0x001, part: 0x901a, ver: 0xfI really cannot imagine manufacturer 0x1 being valid? 0x1 would be an AMD chip (according to jep106.inc which is generated from the JEDEC list which you can find an unofficial copy of here )
A suggestion I could give would be to run the IDCODE scan a couple of times and compare the outputs to find entries that are consistent between scans.
brandonros
It isn't clear to me which pattern is the actual pattern I'm interested in.