MIPS EJTAG Application

This application is used for programming and debugging MIPS processors implementing the EJTAG protocol.

The pinout is that of the MSP430 FET, so an adapter will be needed for debugging targets such as the Linksys WRT54G routers.


A simple client in Python is available in svn as `goodfet.mips'.


This is a very new target, and it is not yet verified to be useful or even functional.


Prior to any transaction, the SETUP (0x10) verb should be sent to the JTAG application to properly set the I/O pin directions. After that, the START (0x20) and STOP (0x21) verbs may be used to enter and exit the TAP. HALTCPU (0xA0) and RELEASECPU (0xA1) should be used to stop the CPU during memory accesses, releasing afterward.

All reads and writes are 32-bit, but 64-bit support might be added once we have acquired test hardware. IR_SHIFT (0x80) and DR_SHIFT (0x80) are available for raw access to JTAG, but higher level functions are also implemented for convenience and speed.


The following verbs are supported.

0x02PEEKRead word from memory at int32[0].
0x03POKEWrite int32[1] to memory at in32[0].
0x10SETUPConfigure I/O pins.
0x20STARTBegin to debug by JTAG.
0x21STOPEnd JTAG debugging.
0x7ENOKNo Operation
0x80IR_SHIFTShift the IR.
0x81DR_SHIFTShift the DR.
0xC1SETINSTRFETCHSet CPU to Instruction Fetch state.
0xC2SETPCSet the Program Counter.
0xE1WRITEFLASHWrite a word of flash memory.
0xE2READMEMAlias for PEEK.

WRITEMEM and WRITEFLASH read and return the written value. Client implementations should throw an error during programming if the returned value does not match the written value. Insufficient writes commonly leave 0xA100.