MIPS EJTAG Application
This application is used for programming and debugging MIPS processors implementing the EJTAG protocol.
The pinout is that of the MSP430 FET, so an adapter will be needed for debugging targets such as the Linksys WRT54G routers.
Clients
A simple client in Python is available in svn as `goodfet.mips'.
Status
This is a very new target, and it is not yet verified to be useful or even functional.
Development
Prior to any transaction, the SETUP (0x10) verb should be sent to the JTAG application to properly set the I/O pin directions. After that, the START (0x20) and STOP (0x21) verbs may be used to enter and exit the TAP. HALTCPU (0xA0) and RELEASECPU (0xA1) should be used to stop the CPU during memory accesses, releasing afterward.
All reads and writes are 32-bit, but 64-bit support might be added once we have acquired test hardware. IR_SHIFT (0x80) and DR_SHIFT (0x80) are available for raw access to JTAG, but higher level functions are also implemented for convenience and speed.
Verbs
The following verbs are supported.
| Hex | #define | Description |
|---|---|---|
| 0x02 | PEEK | Read word from memory at int32[0]. |
| 0x03 | POKE | Write int32[1] to memory at in32[0]. |
| 0x10 | SETUP | Configure I/O pins. |
| 0x20 | START | Begin to debug by JTAG. |
| 0x21 | STOP | End JTAG debugging. |
| 0x7E | NOK | No Operation |
| 0x80 | IR_SHIFT | Shift the IR. |
| 0x81 | DR_SHIFT | Shift the DR. |
| 0xC1 | SETINSTRFETCH | Set CPU to Instruction Fetch state. |
| 0xC2 | SETPC | Set the Program Counter. |
| 0xE0 | WRITEMEM | Alias for POKE. |
| 0xE1 | WRITEFLASH | Write a word of flash memory. |
| 0xE2 | READMEM | Alias for PEEK. |
| 0xE3 | ERASEFLASH | Mass Erase |
| 0xF0 | COREIP_ID | |
| 0xF1 | DEVICE_ID |
WRITEMEM and WRITEFLASH read and return the written value. Client implementations should throw an error during programming if the returned value does not match the written value. Insufficient writes commonly leave 0xA100.