How to enable desired cJTAG OScan mode on CC26xx device

Below is a snippet of code to put a target into OSCAN1 (assuming it is starting in JTAG mode).  The "WriteTmsPattern" calls bang out patterns on TMS.  The first parameter is the pattern to send, LSB first.  The second parameter is the number of bits to send.  The "jtag_" variant does it via standard JTAG: toggling TCK and TMS to send out the pattern.  The "cjtag_" variant does it via OSCAN1 mode: allowing for nTDI, TMS, and TDO periods on the TMS pin.  Comments in the code should describe what each step is doing.  This code is part of the XDS110's firmware to support cJTAG on that debug probe.

{
    // Make sure we're at IDLE (via TLR)
    jtag_WriteTmsPattern(0xff, 8); // TLR
    jtag_WriteTmsPattern(0x0, 1); // IDLE

    // Execute a BYPASS IR scan to start at control level 0
    jtag_WriteTmsPattern(0x03, 3); // DRSELECT, IRSELECT, IRCAPTURE
    jtag_WriteTmsPattern(0x00, 64); // Shift in 64 bits to load bypass instruction.
    jtag_WriteTmsPattern(0x03, 3); // IREXIT2, IRUPDATE, IDLE

    // Open control level 2 by doing 2 zero bit scans, then a 1 bit DR shift
    // First zero bit scan
    jtag_WriteTmsPattern(0x05, 4); // DRSELECT, DRCAPTURE, DREXIT1, DRPAUSE
    jtag_WriteTmsPattern(0x03, 2); // DREXIT2, DRUPDATE
    // Second zero bit scan
    jtag_WriteTmsPattern(0x05, 4); // DRSELECT, DRCAPTURE, DREXIT1, DRPAUSE
    jtag_WriteTmsPattern(0x03, 2); // DREXIT2, DRUPDATE
    // Shift in 1 bit to lock control level
    jtag_WriteTmsPattern(0x05, 4); // DRSELECT, DRCAPTURE, DREXIT1, DRPAUSE
    jtag_WriteTmsPattern(0x0D, 4); // DREXIT2 DRSHIFT(1) DREXIT1 DRUPDATE
    // Make sure we end in DR pause
    jtag_WriteTmsPattern(0x05, 4); // DRSELECT, DRCAPTURE, DREXIT1, DRPAUSE

    // Select 2-pin scan format
    // Shift in 3 bits to load STFMT register.
    jtag_WriteTmsPattern(0x31, 6); // DREXIT2, SHIFT(3), DREXIT1, DRUPDATE
    jtag_WriteTmsPattern(0x05, 4); // DRSELECT, DRCAPTURE, DREXIT1, DRPAUSE
    // Shift in number of bits to select OSCAN1 format
    jtag_WriteTmsPattern(0x1c01, 13); // DREXIT2, SHIFT(n), DREXIT1, DRUPDATE, DRSELECT
    // Stay 4 clocks in the CSM
    jtag_WriteTmsPattern(0x00, 4);
    // OSCAN1 is now selected. Must from now on treat TMS as in OSCAN1 mode.
    // Make sure we end in DR pause
    cjtag_WriteTmsPattern(0x02, 3); // DRCAPTURE, DREXIT1, DRPAUSE

    // Deselect all targets
    // Complete a zero bit scan. This gives access to STMC command
    cjtag_WriteTmsPattern(0x03, 2); // DREXIT2 DRUPDATE
    // Do a DR shift of 4 bits, this writes STLCACT = b0
    cjtag_WriteTmsPattern(0x15, 6); // DRSELECT DRCAPTURE DREXIT1 DRPAUSE DREXIT2 SHIFT
    cjtag_WriteTmsPattern(0x08, 4); // SHIFT(+3) DREXIT1
    cjtag_WriteTmsPattern(0x01, 2); // DRUPDATE IDLE
    // (needed for selecting/deselecting target)
    // Stay 7 clocks in CSM
    jtag_WriteTmsPattern(0x00, 7);
    // Make sure we end in DR pause
    cjtag_WriteTmsPattern(0x05, 4); // DRSELECT, DRCAPTURE, DREXIT1, DRPAUSE

    // Select one target
    // Open MSC register
    cjtag_WriteTmsPattern(0x01, 2); // DREXIT2 SHIFT
    cjtag_WriteTmsPattern(0x40, 7); // SHIFT(+6) DREXIT1
    cjtag_WriteTmsPattern(0x01, 1); // DRUPDATE
    // Zero bit scan to select controller 0.
    cjtag_WriteTmsPattern(0x5, 4); // DRSELECT DRCAPTURE DREXIT1 DRPAUSE;
    cjtag_WriteTmsPattern(0x3, 3); // DREXIT2 DRUPDATE IDLE (since selecting/deselecting target)
    // Stay 7 clocks in CSM
    jtag_WriteTmsPattern(0x00, 7);
    // Make sure we end in DR pause
    cjtag_WriteTmsPattern(0x05, 4); // DRSELECT, DRCAPTURE, DREXIT1, DRPAUSE

    // Close control level
    // Complete a zero bit scan in order to load STMC
    cjtag_WriteTmsPattern(0x03, 2); // EXIT2_DR UPDATE_DR
    // Shift 1 bit to do ECL command (exit command level)
    cjtag_WriteTmsPattern(0x05, 4); // DRSELECT DRCAPTURE DREXIT1 DR_PAUSE;
    cjtag_WriteTmsPattern(0x01, 2); // DREXIT2 DRSHIFT
    cjtag_WriteTmsPattern(0x01, 1); // DREXIT1
    cjtag_WriteTmsPattern(0x01, 2); // DRUPDATE IDLE
    // Stay 7 clocks in CSM
    jtag_WriteTmsPattern(0x00, 7);
}

Hi,

I am currently wrestling with this issue and on finding this post I thought it would be the answer to my prayers. In my case I am attempting to in-circuit program a CC1310 using cJTAG (and OpenOCD) but I've yet to successfully get the CC1310 into 2 wire mode.

Initially, just to get things going, I am trying to read out the ICEPick ID Code. Firstly, is this a valid thing to do after the above sequence?

(I can put the device into 4 wire mode and read the ID Code using normal JTAG so that the proves my ZBS/command sequence is good).

There does seem to be some "magic" in the above sequence (for example, inserting 4 clocks after selecting OSCAN1 mode - why?) and I don't really understand what the deselect/select targets is doing. Also, I assume TMSC will be negative edge sampled (as that is the default)?

Sorry, I appreciate this is rambling but any further info on this subject would be appreciated. Thanks.

2-wire cJTAG is essentially just JTAG with TMS/TDO/TDI multioplex on a bidirectional TMS pin.  So IDCODE should work after putting the device into 2-wire cJTAG.

Which probe are you using for this?  And I wasn't aware that OpenOCD had any native cJTAG support included.  The only support for cJTAG targets I've seen was just a script to put them into 4-wire mode and continue with JTAG.

I think the deselect/select targets exists to support star configurations where targets can be wired in parallel instead of serial as in normal JTAG connections.  But I'm not 100% certain myself.  That's a bit of magic we kept from the original code written by someone who better understood the 1149.7 spec.

Thanks for the quick reply Edward.

We are not using a probe but are bit banging over GPIO pins. You are correct, OpenOCD does not have cJTAG support (other to select 4 wire mode). We are looking at producing a bit bang cJTAG driver for OpenOCD,.

Anyway, I'll keep plugging away trying to get this work. I have probed up the cJTAG signals on a SmartRF06 Eval Board and captured bus activity during CCS/SmartRF Programmer connection so that should also help to give me some insight. There is however a lot of stuff going on so it's difficult to decode.