您的当前位置：首页 RM08001_JLinkUSBProtocol[1]

RM08001_JLinkUSBProtocol[1]

来源：华佗健康网

J-Link

Reference manual forJ-Link USB Protocol

Document RM08001-R7

Date: October 8, 2010

A product of SEGGER Microcontroller GmbH & Co. KG

www.segger.com

2CHAPTER

Disclaimer

Specifications written in this document are believed to be accurate, but are not guar-anteed to be entirely free of error. The information in this manual is subject tochange for functional or performance improvements without notice. Please make sureyour manual is the latest edition. While the information herein is assumed to beaccurate, SEGGER MICROCONTROLLER GmbH & Co. KG (the manufacturer) assumesno responsibility for any errors or omissions. The manufacturer makes and youreceive no warranties or conditions, express, implied, statutory or in any communica-tion with you. The manufacturer specifically disclaims any implied warranty of mer-chantability or fitness for a particular purpose.

You may not extract portions of this manual or modify the PDF file in any way withoutthe prior written permission of the manufacturer. The software described in this doc-ument is furnished under a license and may only be used or copied in accordancewith the terms of such a license.

Trademarks

Names mentioned in this manual may be trademarks of their respective companies.Brand and product names are trademarks or registered trademarks of their respec-tive holders.

Contact address

SEGGER Microcontroller GmbH & Co. KGIn den Weiden 11D-40721 HildenGermany

Tel.+49 2103-2878-0Fax.+49 2103-2878-28

Email: support@segger.com

Internet: http://www.segger.com

Document revisions

For further information on topics or routines not yet specified, please contact us.

Revision

0123

Date080523080526080527090520

ByOOOOOOOO

Explanation

Initial version

Chapter \"Background information\": Added JTAG buffer description.Some minor changes.Some minor changes.

Split chapter \"USB communication\" into chapter \"USB\" and chapter \"Emulator protocol\".Some minor changes.

Chapter \"Emulator protocol\"

* Section \"Protocol commands\" updated.

* Section \"Get system information functions\" updated.

4090526AG

Revision

Date090527090616

ByAGAG

Explanation

Chapter \"Emulator protocol\"

* Section \"Protocol commands\" updated.Chapter \"Emulator protocol\"

* Section \"Protocol commands\" updated/corrected.

Chapter \"Emulator protocol\"

* Added EMU_CMD_SELECT_IF

* Updated EMU_CMD_HW_JTAG3 for SWD7101008OO

usage.

4CHAPTER

About this document

Assumptions

This document assumes that you already have a solid knowledge of the following:••

The software tools used for building your application (assembler, linker, C com-piler)

The target processor.

How to use this manual

This manual explains all the functions and macros that the product offers. It assumesyou have a working knowledge of the C language. Knowledge of assembly program-ming is not required.

Typographic conventions for syntax

This manual uses the following typographic conventions:

StyleBodyKeywordParameter

Sample

Used for

Body text.

Text that you enter at the command-prompt or that appears on the display (that is system functions, file- or pathnames).Parameters in API functions.Sample code in program examples.

Reference to chapters, sections, tables and figures or other docu-ments.

Buttons, dialog boxes, menu names, menu commands.Very important sections

ReferenceGUIElementEmphasis

Table of Contents

1 Introduction......................................................................................................................9

1.11.21.3

How to use this manual............................................................................10Purpose of this document.........................................................................10Features of J-Link ARM.............................................................................10

2 Licensing........................................................................................................................11

2.1

License terms..........................................................................................12

3 Background information.................................................................................................13

3.13.23.3

JTAG scan chain values............................................................................14Emulator configuration.............................................................................16JTAG data buffers....................................................................................17

4 USB................................................................................................................................19

4.14.24.3

USB communication overview....................................................................20USB transactions.....................................................................................21Using USBLib..........................................................................................22

5 Emulator protocol...........................................................................................................23

5.15.25.35.45.55.65.7

Communication protocol overview..............................................................24Protocol commands..................................................................................25Get system information functions...............................................................27Get state information functions..................................................................35JTAG & Hardware functions.......................................................................39Target functions......................................................................................57Configuration functions.............................................................................66

6 Glossary.........................................................................................................................697 Literature and references...............................................................................................73

Chapter 1Introduction

This chapter describes the purpose of this manual and the J-Link ARM emulator which uses the J-Link USB Protocol.

10CHAPTER 1Introduction

1.1How to use this manual

This manual describes the J-Link USB Protocol used in J-Link products and how it isused.

In the course of this document the J-Link ARM is refered to as emulator.

1.2Purpose of this document

The purpose of this document is to allow developers of open source software such asOpenOCD to write software which uses J-Link as debug interface.

This document gives an overview about the J-Link USB communication and how itcan be used in your application. Sample communications to almost each commanddescription should give you an idea of the data transferred via USB between J-Linkand host.

1.3Features of J-Link ARM

J-Link provides a feature rich list of functions to simplify thedebugging process. All important functions which are used bythe SEGGER software are useable via the USB protocol.J-Link ARM has many features:

•USB 2.0 interface

•Any ARM7/ARM9 core supported, including thumb mode•Automatic core recognition

•Maximum JTAG speed 12 MHz

•Download speed up to 720 Kbytes/second *•DCC speed up to 800 Kbytes/second *

•No power supply required, powered through USB•Auto speed recognition

•Support for adaptive clocking

•All JTAG signals can be monitored, target voltage can be mea-sured

•Support for multiple devices•Fully plug and play compatible

•A Standard 20-pin JTAG connector

•Optional 14-pin JTAG adapter available•Wide target voltage range: 1.2V - 3.3V•Optional adapter for 5V targets available

* = Measured with J-Link Rev.5, ARM7 @ 50 MHz, 12MHz JTAG speed.

Chapter 2Licensing

This chapter gives information about the licensing terms under which this document is published.

12CHAPTER 2Licensing

2.1License terms

The information in this document may only be used when fully agreeing to the termsmentioned in this chapter.

Please note that the SEGGER J-Link software is copyrighted and may be used withoriginal SEGGER J-Links and legal OEM versions only. For details, please refer to theLicense terms in License.txt which comes with the J-Link software and documenta-tion pack.

In case of doubt, please contact us: info@segger.com .

2.1.1What you may do

You may use the information contained in this document to add support for the widespread SEGGER J-Link ARM emulator and OEM versions in open source software.

2.1.2

••

What you are not allowed to do

build J-Link clones

build J-Link compatible emulators.

You are not allowed to use the information in this document to

Chapter 3

Background information

This chapter provides information required to understand parameters for certain USB commands when working with the J-Link emulator.

14CHAPTER 3Background information

3.1JTAG scan chain values

Some JTAG-related commands need an IRpre and DevicePos parameter. These valuesdescribe the position of a device in the scan chain and the shift count to reach thatdevice.

The diagram below shows a scan chain configuration sample with 2 devices con-nected to the JTAG port.TDIDevice 1TRSTTDOTDIDevice 0TRSTTDOTMSTCKTRSTTMSTCKTCKTDITMSTDOJTAG3.1.1IRPre

The IRPre value is the total number of bits in the instruction registers of the devicesbefore the DUT counted from nearest device to TDO. The position can usually be seenin the schematic; the IR len can be found in the manual supplied by the manufactur-ers of the other devices.

ARM7 and ARM9 have an IR len of four.

For systems with just a single device, IRPre is 0.

For an example using the IRpre value please refer to the paragraph Scan chain exam-ple on page15.

3.1.2DevicePos

The DevicePos value of the DUT is the amount of devices in the scan chain before theDUT, counted from nearest device to TDO.

For systems with just a single device, DevicePos is 0.

For an example using the DevicePos value please refer to the paragraph Scan chainexample on page15.

3.1.3Scan chain example

The following table shows a few sample configurations with 1,2 and 3 devices in dif-ferent configurations. The DUT is marked in blue.Device 0(IR len)ARM(4)ARM(4)Xilinx(8)Xilinx(8)ARM(4)ARM(4)Xilinx(8)

Device 1(IR len)-Xilinx(8)ARM(4)Xilinx(8)Xilinx(8)Xilinx(8)ARM(4)

Device 2(IR len)---ARM(4)ARM(4)ARM(4)Xilinx(8)

DevicePos

0012021

IR len(IRpre)008160128

16CHAPTER 3Background information

3.2Emulator configuration

Emulator configuration is a 256 byte non-volatile memory area which can be readand written via USB. It holds the emulator configuration that was setup for your J-Link. The following table shows the current configuration offsets and their meanings.

Offset0x00

Values

0x00 - 0x03 : USB-Address 0-30xFF : Default

Explanation

USB-Address of the emulator. Allows usage of more than one J-Link at the same time.Reserved

Kickstart power on JTAG-pin 19.Reserved

IP-Address (only for J-Link Pro).Subnetmask (only for J-Link Pro).

Reserved

MAC-Address (only for J-Link Pro).

Reserved

0x01 - 0x030xFF

0xFFFFFFFF : Default, on if J-Link KS

0x04 - 0x070x00000000 : Off

0x00000001 : On

0x08 - 0x1F0xFF

IP-Address in hex format.

0x20 - 0x23

0xFFFFFFFF if not configured.Subnet mask in hex format.

0x24 - 0x27

0xFFFFFFFF if not configured.

0x28 - 0x2F0xFF

MAC-Address

0x30 - 0x35

0xFFFFFFFFFFFF if not configured.

0x36 - 0xFF0xFF

Table 3.2: Emulator configuration overview

3.3JTAG data buffers

The J-Link has three JTAG data buffers. Two of these are output buffers used for TMSand TDI, the third is an input buffer for TDO data. To work with the J-Link, an under-standing of the buffers and the way the data is stored in them is quite useful.

3.3.1Explanation of terms

In this document input and output buffers are seen from host perspective.

Input buffer

The input buffer stores the incoming TDO signals from the device.

Output buffer

Output buffers stores TMS and TDI signals which are transferred to the device.

3.3.2Organization of buffers

Model of JTAG Buffer:

byte0byte1byte2byte3byte4byte5byte6...b7b15b23b31b39b47b55...................................................................................................................................................b0b8b16b24b32b40b48...All three JTAG data buffers are organized the same way:

Bit n of the bit stream is stored in byte n/8, bit n%8. This means the first byte is sentfirst, least significant bit (lsb) first.

The same thing is true for data received: The first bit received is the lsb of byte 0.

Size of buffers

All buffers are big enough to hold 2 KByte of data.

18CHAPTER 3RM08001 Reference manual for J-Link USB ProtocolBackground information

Chapter 4USB

This chapter explains the USB communication and specifics which have to be takencare of when using USB communication under Windows and other operating systems.

20CHAPTER 4USB

4.1

4.1.1

USB communication overview

J-Link uses USB bulk communication to transfer data between host and J-Link.Various specifics which are mandatory are explained in this section.

USB endpoints

Newer J-Links use 2 bulk endpoints, one for \"IN\" (EP1) and one for \"OUT\" (EP2) com-munication whereas old J-Links (V3, V4) only use one endpoint (EP1) for \"IN\" and\"OUT\" communication. Data direction is seen from host side so \"IN\" means from theJ-Link to the host.

The following table gives a quick overview which hardware version uses what USBendpoints:

Hardware version

J-Link V3 / J-Link V4

J-Link V5 and versions aboveJ-Link compatible hardware(Flasher ARM, J-Trace,...)

Table 4.1: USB endpoint overviewEndpoint used Endpoint used

for \"IN\"for \"OUT\"111

122

4.1.2Using different operating systems

Depending on the operating system being used, there are different ways to commu-nicate with the J-Link via USB.

It is possible to use J-Link under almost every operating system as long as there is aUSB bulk driver which allows communication with the J-Link.

Using a Windows operating system

Using Windows for communication with the J-Link you will need to have a USB bulkkernel mode driver as Windows does not come with such a feature aboard. Thisdriver, named the J-Link USB driver, is shipped together with the Windows version ofthe J-Link software package.

Using a non Windows operating system

Using an operating system other than Windows you will have to find an other way tooperate the J-Link via USB. Under different operating systems there is a freewarepackage called \"USBLib\" available which allows you to communicate with the J-Link.

4.1.3Endianess

All data units larger than a single byte are transferred little endian, meaning leastsignificant bytes are transferred first.

U16 Example

U16 data to send:

0xCDEF

Data sent via USB:

EF CD

U32 Example

U32 data to send:

0x12345678

Data sent via USB:

78 56 34 12

4.2USB transactions

If multiple bytes are send to the emulator or send by the emulator, there is a choice:The information can be send in a single transaction or in multiple transactions. Soboth sides are free to send data in one or more transactions. However, due to thelong USB latencies, it is recommended to use as few transactions as possible.

4.2.1Timeout

J-Link uses a 5 second timeout for all USB operations.

This means that every command needs to be completed within 5 seconds. If 5 sec-onds is too short (for example for a long JTAG sequence at a low speed) the JTAGsequence needs to be split into 2 or more shorter sequences.

4.2.2

••

USB latency

USB Transmission speedUSBlatency

The two most important limiting factors in communication between the host and theemulator are:

The transmission speed is fixed to 12MHz and allows transmission of up to app.1MByte/sec. This is sufficient for fast operation of the emulator.

The USB latency is more of a problem. Since the host schedules USB transactions inframes of 1ms for full speed and 125us for high speed connections, the average

latency is 2ms for full speed and 250us for high speed connections. This means thateven a small transaction of 1byte typically takes 2ms on full speed connection and italso means that minimizing the number of transactions to the minimum required isdesirable.

4.2.3OUT transaction (downstream)

In an OUT-transaction, the host sends data to the emulator.

This is a pretty straightforward process; if the host wants to send a number of bytesto the J-Link, it can simply start such a write transaction.The maximum size of one transaction is 0xFFFF bytes.

4.2.4IN-transaction

In an IN-transaction, the host requests data from the emulator. This is a is a moretricky process.

The maximum size of one transaction is 0x8000 bytes.

A transaction is followed by a 0-byte packet if the transaction size is a multiple of bytes, but not the maximum packet size.

22CHAPTER 4USB

4.3Using USBLib

USBLib is freeware and can be used on most platforms.Again, downstream (OUT-) transactions are unproblematic.

For upstream (IN-) transactions, transaction termination needs to be handled cor-rectly.

One easy way of doing so is to not request multiples of bytes.

So if 256 bytes need to be read from the J-Link, instead 255 bytes, then 1 byte couldbe read.

Chapter 5Emulator protocol

This chapter explains the communication protocol used by the J-Link emulator tocommunicate with the host.

24CHAPTER 5Emulator protocol

5.1Communication protocol overview

The J-Link firmware uses several commands to communicate with the host software.The communication is always initiated by the host. The host sends an U8 command tothe emulator followed by parameters beeing known to be needed by this command.The firmware retrieves the first byte from the buffer, containing the command andexecutes the proper functions. The parameters expected are read from the communi-cation buffer by the subroutines that are called through the command. Return valuesare sent back via USB.

5.2Protocol commands

The list below gives an overview about the usable commands:

Define

Value

Explanation

Get system information functions

EMU_CMD_VERSION0x01Retrieves the firmware version.

Retrieves the base freq. and the min.

EMU_CMD_GET_SPEEDS0xC0

divider of the emulator CPU.

Retrieves the maximum memory block-EMU_CMD_GET_MAX_MEM_BLOCK0xD4

size.

EMU_CMD_GET_CAPS0xE8Retrieves capabilities of the emulator.

Retrieves capabilities (including

EMU_CMD_GET_CAPS_EX0xED

extended ones) of the emulator.

Retrieves the hardware version of the

EMU_CMD_GET_HW_VERSION0xF0

emulator.

Get state information functions

EMU_CMD_GET_STATE0x07Retrieves voltage and JTAG pin states.EMU_CMD_GET_HW_INFO0xC1Retrieves hardware information.EMU_CMD_GET_COUNTERS0xC2Retrieves target connection counters.EMU_CMD_MEASURE_RTCK_REACT0xF6Measures RTCK reaction time.

JTAG & Hardware functions

EMU_CMD_RESET_TRST0x02Resets TRST.EMU_CMD_SET_SPEED0x05Sets the JTAG speed.

Selects the target interface or retrieves

EMU_CMD_SELECT_IF0xC7

current configured target interface.

EMU_CMD_SET_KS_POWER0x08Sets KS power to on or off.EMU_CMD_HW_CLOCK0xC8Generates one clock and retrieves TDI.EMU_CMD_HW_TMS00xC9Clears TMS.EMU_CMD_HW_TMS10xCASets TMS.EMU_CMD_HW_DATA00xCBClears TDI.EMU_CMD_HW_DATA10xCCSets TDI.EMU_CMD_HW_JTAG0xCDHandles JTAG connection.

Handles JTAG connection with word

EMU_CMD_HW_JTAG20xCE

aligned data transfers.

Handles JTAG connection with word

EMU_CMD_HW_JTAG30xCFaligned data transfers and return

value.

Same as EMU_CMD_HW_JTAG3 but with-EMU_CMD_HW_JTAG_WRITE0xD5

out response data on TDO.

Receive status of sticky error bit which

EMU_CMD_HW_JTAG_GET_RESULT0xD6is handled by

EMU_CMD_HW_JTAG_WRITE.

EMU_CMD_HW_TRST00xDEActivates TRST.EMU_CMD_HW_TRST10xDFDeactivates TRST.EMU_CMD_WRITE_DCC0xF1Writes to JTAG using DCC.

Target functions

EMU_CMD_RESET_TARGET0x03Resets the target.

Resets the CPU and halts as soon as its EMU_CMD_HW_RELEASE_RESET_ST

0xD0

possible or the timeout expires.OP_EX

EMU_CMD_HW_RELEASE_RESET_STResets the CPU and halts as soon as its

0XD1

possible or the timeout expires.OP_TIMED

EMU_CMD_HW_RESET00xDCActivates target reset.

Table 5.1: Protocol command overview

26CHAPTER 5Emulator protocol

Define

EMU_CMD_HW_RESET1EMU_CMD_GET_CPU_CAPSEMU_CMD_EXEC_CPU_CMDEMU_CMD_WRITE_MEMEMU_CMD_READ_MEM

Value0xDD0xE90xEA0xF40xF5

Explanation

Deactivates target reset.

Retrieves capabilities of the CPU.Executes a CPU command.Writes to target memory.Reads from target memory.

Writes to target memory on ARM 7/9

EMU_CMD_WRITE_MEM_ARM790xF7

targets.

Reads from target memory on ARM 7/9

EMU_CMD_READ_MEM_ARM790xF8

targets.

Configuration functions

EMU_CMD_READ_CONFIG0xF2Reads the emulator configuration.EMU_CMD_WRITE_CONFIG0xF3Writes the emulator configuration.

5.3

5.3.1

Get system information functions

These commands are used to retrieve information about the firmware used by theemulator.

EMU_CMD_VERSION

Description

Retrieves the length and content of the firmware version string of the emulator.

Command

DirectionH->E

Data1 * U8

NameCmd

Command: 0x01

Explanation

Table 5.2: EMU_CMD_VERSION command overviewResponse

DirectionH<-EH<-E

Data1 * U16* U8

NameNumBytesVersion

Explanation

Length of the firmware string in bytes.Typically 0x70 .

Firmware version string.

Table 5.3: EMU_CMD_VERSION response overview

Additional information

This is typically the first command sent.

Sample communication

Retrieve firmware string command.

H->E: 01

Returns the firmware string length.

H<-E: 70

Returns the firmware string.

H<-E: 4A 2D 4C 69 6E 6B 20 63 6F 6D 70 69 6C 65 20 J-Link compiled 44 65 63 20 30 33 20 32 30 30 37 20 31 37 3A 31 Dec 03 2007 17:1 35 3A 33 31 20 41 52 4D 20 52 65 76 2E 35 00 00 5:31 ARM Rev.5.. 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

28CHAPTER 5Emulator protocol

5.3.2EMU_CMD_GET_SPEEDS

Description

Retrieves the base freq. and the min. divider of the emulator CPU.

Command

DirectionH->E

Data1 * U8

NameCmd

Command: 0xC0

Explanation

Table 5.4: EMU_CMD_GET_SPEEDS command overviewResponse

DirectionH<-EH<-E

Data1 * U321 * U16

NameBaseFreqMinDiv

Explanation

Retrieves the base frequency of emulator CPU.Retrieves the min. divider of emulator CPU.

Table 5.5: EMU_CMD_GET_SPEEDS response overview

Sample communication

Retrieve base freq. and min. divider of emulator CPU.

H->E: C0

Returns 48MHz base freq. with min. divider of 4.

H<-E: 00 6C DC 02 04 00

5.3.3EMU_CMD_GET_MAX_MEM_BLOCK

Description

Retrieves the maximum memory blocksize.

Command

DirectionH->E

Data1 * U8

NameCmd

Command: 0xD4

Explanation

Table 5.6: EMU_CMD_GET_MAX_MEM_BLOCK command overviewResponse

DirectionH<-E

Data1 * U32

NameMaxSize

Explanation

Returned maximum block size.

Table 5.7: EMU_CMD_GET_MAX_MEM_BLOCK response overview

30CHAPTER 5Emulator protocol

5.3.4EMU_CMD_GET_CAPS

Description

Retrieves capabilities of the emulator.

Command

DirectionH->E

Data1 * U8

NameCmd

Command: 0xE8

Explanation

Table 5.8: EMU_CMD_GET_CAPS command overviewResponse

DirectionH<-E

Data1 * U32

NameCaps

Explanation

Capabilities supported by the emulator.

Table 5.9: EMU_CMD_GET_CAPS response overview

Additional information

The capability flags used are described in the table below:

Bit012345671011121314151617

Define

EMU_CAP_RESERVED

Explanation

Always 1.

Supports command

EMU_CAP_GET_HW_VERSION

\"EMU_CMD_GET_HARDWARE_VERSION\"Supports command

EMU_CAP_WRITE_DCC

\"EMU_CMD_WRITE_DCC\"

EMU_CAP_ADAPTIVE_CLOCKINGSupports adaptive clocking

Supports command

EMU_CAP_READ_CONFIG

\"EMU_CMD_READ_CONFIG\"Supports command

EMU_CAP_WRITE_CONFIG

\"EMU_CMD_WRITE_CONFIG\"

EMU_CAP_TRACESupports trace commands

Supports command

EMU_CAP_WRITE_MEM

\"EMU_CMD_WRITE_MEM\"Supports command

EMU_CAP_READ_MEM

\"EMU_CMD_READ_MEM\"Supports command

EMU_CAP_SPEED_INFO

\"EMU_CMD_GET_SPEED\"

EMU_CAP_EXEC_CODESupports commands \"EMU_CMD_CODE_...\"

Supports command

EMU_CAP_GET_MAX_BLOCK_SIZE

\"EMU_CMD_GET_MAX_BLOCK_SIZE\"Supports commands

EMU_CAP_GET_HW_INFO

\"EMU_CMD_GET_HW_INFO\"Supports commands

EMU_CAP_SET_KS_POWER

\"EMU_CMD_SET_KS_POWER\"Supports commands

EMU_CAP_RESET_STOP_TIMED\"EMU_CMD_HW_RELEASE_RESET_STOP_TI

MED\"

-Reserved

Supports commands

EMU_CAP_MEASURE_RTCK_REACT

\"EMU_CMD_MEASURE_RTCK_REACT\"Supports command

EMU_CAP_SELECT_IF

\"EMU_CMD_HW_SELECT_IF\"

Bit1819202122232425262728293031

DefineExplanation

Supports command

EMU_CAP_RW_MEM_ARM79\"EMU_CMD_WRITE_MEM_ARM79\

\"EMU_CMD_READ_MEM_ARM79\"Supports command

EMU_CAP_GET_COUNTERS

\"EMU_CMD_GET_COUNTERS\"

EMU_CAP_READ_DCCSupports command \"EMU_CMD_READ_DCC\"

Supports command

EMU_CAP_GET_CPU_CAPS

\"EMU_CMD_GET_CPU_CAPS\"Supports command

EMU_CAP_EXEC_CPU_CMD

\"EMU_CMD_EXEC_CPU_CMD\"

EMU_CAP_SWOSupports command \"EMU_CMD_SWO\"

Supports command

EMU_CAP_WRITE_DCC_EX

\"EMU_CMD_WRITE_DCC_EX\"Supports command

EMU_CAP_UPDATE_FIRMWARE_EX

\"EMU_CMD_UPDATE_FIRMWARE_EX\"

EMU_CAP_FILE_IOSupports command \"EMU_CMD_FILE_IO\"EMU_CAP_REGISTERSupports command \"EMU_CMD_REGISTER\"

Supports command

EMU_CAP_INDICATORS

\"EMU_CMD_INDICATORS\"Supports command

EMU_CAP_TEST_NET_SPEED

\"EMU_CMD_TEST_NET_SPEED\"

EMU_CAP_RAWTRACESupports command \"EMU_CMD_RAWTRACE\"-Reserved

Table 5.10: EMU_CMD_GET_CAPS flag overviewSample communication

Retrieve emulator capabilities.

H->E: E8

Returns all capabilities except trace commands.

H<-E: BF 7F FF 3B

5.3.5EMU_CMD_GET_CAPS_EX

Description

Retrieves extended capabilities of the emulator.

32CHAPTER 5Emulator protocol

Command

DirectionH->E

Data1 * U8

NameCmd

Command: 0xED

Explanation

Table 5.11: EMU_CMD_GET_CAPS_EX command overviewResponse

DirectionH<-E

Data32 * U8

NameCaps

Explanation

Capabilities supported by the emulator.

Table 5.12: EMU_CMD_GET_CAPS_EX response overview

Additional information

The capability flags used are described in the table below:

Bit012345671011121314151617181920

Define

EMU_CAP_EX_RESERVEDEMU_CAP_EX_GET_HW_VERSIONEMU_CAP_EX_WRITE_DCC

Explanation

Always 1.

Supports command

\"EMU_CMD_GET_HARDWARE_VERSION\"Supports command

\"EMU_CMD_WRITE_DCC\"

EMU_CAP_EX_ADAPTIVE_CLOCKI

Supports adaptive clocking

Supports command

EMU_CAP_EX_READ_CONFIG

\"EMU_CMD_READ_CONFIG\"Supports command

EMU_CAP_EX_WRITE_CONFIG

\"EMU_CMD_WRITE_CONFIG\"

EMU_CAP_EX_TRACESupports trace commands

Supports command

EMU_CAP_EX_WRITE_MEM

\"EMU_CMD_WRITE_MEM\"Supports command

EMU_CAP_EX_READ_MEM

\"EMU_CMD_READ_MEM\"Supports command

EMU_CAP_EX_SPEED_INFO

\"EMU_CMD_GET_SPEED\"

EMU_CAP_EX_EXEC_CODESupports commands \"EMU_CMD_CODE_...\"EMU_CAP_EX_GET_MAX_BLOCK_SSupports command IZE\"EMU_CMD_GET_MAX_BLOCK_SIZE\"

Supports commands

EMU_CAP_EX_GET_HW_INFO

\"EMU_CMD_GET_HW_INFO\"Supports commands

EMU_CAP_EX_SET_KS_POWER

\"EMU_CMD_SET_KS_POWER\"Supports commands

EMU_CAP_EX_RESET_STOP_TIME

\"EMU_CMD_HW_RELEASE_RESET_STOP_TI

MED\"

-Reserved

EMU_CAP_EX_MEASURE_RTCK_RESupports commands ACT\"EMU_CMD_MEASURE_RTCK_REACT\"

Supports command

EMU_CAP_EX_SELECT_IF

\"EMU_CMD_HW_SELECT_IF\"Supports command

EMU_CAP_EX_RW_MEM_ARM79\"EMU_CMD_WRITE_MEM_ARM79\

\"EMU_CMD_READ_MEM_ARM79\"Supports command

EMU_CAP_EX_GET_COUNTERS

\"EMU_CMD_GET_COUNTERS\"

EMU_CAP_EX_READ_DCCSupports command \"EMU_CMD_READ_DCC\"

Bit212223242526272829303132

Define

EMU_CAP_EX_GET_CPU_CAPS

Explanation

Supports command

\"EMU_CMD_GET_CPU_CAPS\"Supports command

EMU_CAP_EX_EXEC_CPU_CMD

\"EMU_CMD_EXEC_CPU_CMD\"

EMU_CAP_EX_SWOSupports command \"EMU_CMD_SWO\"

Supports command

EMU_CAP_EX_WRITE_DCC_EX

\"EMU_CMD_WRITE_DCC_EX\"

EMU_CAP_EX_UPDATE_FIRMWARESupports command _EX\"EMU_CMD_UPDATE_FIRMWARE_EX\"EMU_CAP_EX_FILE_IOSupports command \"EMU_CMD_FILE_IO\"EMU_CAP_EX_REGISTERSupports command \"EMU_CMD_REGISTER\"

Supports command

EMU_CAP_EX_INDICATORS

\"EMU_CMD_INDICATORS\"Supports command

EMU_CAP_EX_TEST_NET_SPEED

\"EMU_CMD_TEST_NET_SPEED\"

EMU_CAP_EX_RAWTRACESupports command \"EMU_CMD_RAWTRACE\"

Supports command

EMU_CAP_EX_GET_CAPS_EX

\"EMU_CMD_GET_CAPS_EX\"Supports command

EMU_CAP_EX_HW_JTAG_WRITE

\"EMU_CMD_HW_JTAG_WRITE\"

Table 5.13: EMU_CMD_GET_CAPS_EX flag overviewSample communication

Retrieve emulator capabilities.

H->E: ED

Returns all capabilities except trace commands.

H<-E: BF 7F FF BB 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

34CHAPTER 5Emulator protocol

5.3.6EMU_CMD_GET_HW_VERSION

Description

Retrieves the product hardware version of the emulator.

Command

DirectionH->E

Data1 * U8

NameCmd

Command: 0xF0

Explanation

Table 5.14: EMU_CMD_GET_HW_VERSION command overviewResponse

DirectionH<-E

Data1 * U32

NameVersion

Explanation

Hardware version of the emulator.

Table 5.15: EMU_CMD_GET_HW_VERSION response overview

Additional information

The product hardware version is returned in the following format.TTMMmmrrThis stands for:TT: Hardware typeMM: Major versionmm: Minor versionrr: Revision

Example: The version 0052000 stands for a J-Link Version 5.2 .

If the capability EMU_CMD_GET_HW_VERSION is not enabled Version is always 0x00 .

Sample communication

Retrieve hardware version command.

H->E: F0

Returns the hardware version 0060000 which equals a J-Link V6.

H<-E: 60 EA 00 00

J-Link hardware versions

The following table gives an overview about what hardware versions can be retrievedusing this command:

Hardware type0123

J-LinkJ-TraceFlasherJ-Link Pro

Name

5.4

5.4.1

Get state information functions

These commands are used to retrieve information about the actual status of theemulator.

EMU_CMD_GET_STATE

Description

Retrieves the voltage of the target and the JTAG pin states for TCK, TDI, TDO, TMS,TRES and TRST.

Command

DirectionH->E

Data1 * U8

NameCmd

Command: 0x07

Explanation

Table 5.16: EMU_CMD_GET_STATE command overviewResponse

DirectionH<-EH<-EH<-EH<-EH<-EH<-EH<-E

Data1 * U161 * U81 * U81 * U81 * U81 * U81 * U8

NameVoltageTCKTDITDOTMSTRESTRST

Explanation

VCC stored in unit mVJTAG pin TCK state.JTAG pin TDI state.JTAG pin TDO state.JTAG pin TMS state.JTAG pin TRES state.JTAG pin TRST state.

Table 5.17: EMU_CMD_GET_STATE response overview

Sample communication

Retrieve state information command.

H->E: 07

Returns 3.267V; TCK, TRES and TRST are high; TDI, TDO, TMS are low.

H<-E: C3 0C 01 00 00 00 01 01

36CHAPTER 5Emulator protocol

5.4.2EMU_CMD_GET_HW_INFO

Description

Retrieves information about the KS power of the emulator.

Command

DirectionH->EH->E

Data1 * U81 * U32

NameCmdMask

Explanation

Command: 0xC1

Bitmask selecting the information that should be retrieved.

Table 5.18: EMU_CMD_GET_HW_INFO command overviewResponse

DirectionH<-E

Datax * U32

NameHW Info

Explanation

Hardware information returned. x means the amount of hardware information defined by the Mask flags.

Table 5.19: EMU_CMD_GET_HW_INFO response overview

Additional information

The flags that can be used as Mask are described in the table below:Bit0

Define

HW_INFO_POWER_ENABLED

Explanation

Retrieves KS power status.0x00000000: Power is off0x00000001: Power is on

Retrieves information about why the tar-get power was switched off.

0x00000000: Everything is normal0x00000001: 2ms @ 3000mA0x00000002: 10ms @ 1000mA0x00000003: 40ms @ 400mAConsumption of the target in mA.

Peak consumption of the target in mA.Peak consumption of the target in mA while operating. In most cases this is the same value as HW_INFO_ITARGET_PEAK.Max. time in ms the consumption of the target exceeded

HW_INFO_POWER_OVERCURRENT type 0x01.Max. time in ms the consumption of the target exceeded

HW_INFO_POWER_OVERCURRENT type 0x02.Max. time in ms the consumption of the target exceeded

HW_INFO_POWER_OVERCURRENT type 0x03.

1HW_INFO_POWER_OVERCURRENT

234

HW_INFO_ITARGET

HW_INFO_ITARGET_PEAK

HW_INFO_ITARGET_PEAK_OPERATION

10HW_INFO_ITARGET_MAX_TIME0

11HW_INFO_ITARGET_MAX_TIME1

12HW_INFO_ITARGET_MAX_TIME2

Table 5.20: EMU_CMD_GET_HW_INFO flag overviewThe amount of U32 data returned by this command depends on how many flags youhaved used in your Mask. Undefined flags return 0xFFFFFFFF.

Sample communication

Retrieve hadrware information about KS power status and target consumption.

H->E: C1 05 00 00 00

Returns KS power is on and the target consumes 12mA.

H<-E: 01 00 00 00 0C 00 00 00

RM08001 Reference manual for J-Link USB Protocol

5.4.3EMU_CMD_GET_COUNTERS

Description

Retrieves counter values of how long a target is connected and how many times atarget was connected / disconnected.

Command

DirectionH->EH->E

Data1 * U81 * U32

NameCmdMask

Explanation

Command: 0xC2

Bitmask selecting the information that should be retrieved.

Table 5.21: EMU_CMD_GET_COUNTERS command overviewResponse

DirectionH<-E

Datax * U32

NameCounters

Explanation

Returned counter values. x means the amount of counter values defined by the Mask flags.

Table 5.22: EMU_CMD_GET_COUNTERS response overview

Additional information

The flags that can be used as Mask are described in the table below:Bit0

Define

CNT_INDEX_POWER_ON

Explanation

Retrieves the counter describing how many ms a powered target is connected.The counter is reset after 24h.

Retrieves the counter describing how many times a powered target was con-nected or disconnected.

1CNT_INDEX_POWER_CHANGE

Table 5.23: EMU_CMD_GET_COUNTERS flag overviewThe amount of U32 data returned by this command depends on how many flags youhave used in your Mask. Undefined flags return 0xFFFFFFFF.

Sample communication

Requesting value of the power change counter.

H->E: C2 02 00 00 00

Returns 5 power changes.

H<-E: 05 00 00 00

38CHAPTER 5Emulator protocol

5.4.4EMU_CMD_MEASURE_RTCK_REACT

Description

Measures the RTCK reaction time of the target device.

Command

DirectionH->E

Data1 * U8

Cmd

Name

Explanation

Command: 0xF6

Table 5.24: EMU_CMD_MEASURE_RTCK_REACT command overviewResponse

DirectionH<-EH<-EH<-EH<-E

Data1 * U321 * U321 * U321 * U32

NameResultMinimumMaximumAverage

Explanation

0x00000000: O.K.

0x00000001: RTCK did not react on time.Minimum RTCK reaction time in ns.Maximum RTCK reaction time in ns.Average RTCK reaction time in ns.

Table 5.25: EMU_CMD_MEASURE_RTCK_REACT response overview

Sample communication

Measure RTCK reaction time command.

H->E: F6

Returns O.K., Min. 0ns, Max. 126ns and Average 25ns reaction time.

H<-E: 00 00 00 00 00 00 00 00 7E 00 00 00 19 00 00 00

5.5

5.5.1

JTAG & Hardware functions

These commands are used to read, write and handle JTAG data and to set hardwarestates.

EMU_CMD_RESET_TRST

Description

Resets TRST.

Command

DirectionH->E

Data1 * U8

NameCmd

Command: 0x02

Explanation

Table 5.26: EMU_CMD_RESET_TRST command overviewResponse

Additional information

Activates TRST and releases it after 2ms.

Sample communication

Reset TRST command.

H->E: 02

40CHAPTER 5Emulator protocol

5.5.2EMU_CMD_SET_SPEED

Description

Sets the JTAG speed.

Command

DirectionH->EH->E

Data1 * U81 * U16

NameCmdSpeed

Explanation

Command: 0x05JTAG speed in kHz.Example:

0x001E for 30kHz.

0xFFFF for adaptive clocking

Table 5.27: EMU_CMD_SET_SPEED command overviewResponse

Sample communication

Set speed to adaptive clocking command.

H->E: 05 FF FF

5.5.3EMU_CMD_SELECT_IF

Description

Select a target interface or retrieves the previously selected interface.

Command

DirectionH->E

Data1 * U8

NameCmd

Explanation

Command: 0xC7

0xFF to return 32bit mask of available inter-faces

0xFE to return previosly selected interface number (0..31)

1..31 to select interface (0..31)

H->E1 * U8SubCmd

Table 5.28: EMU_CMD_SELECT_IF command overviewResponse

Direction

Data

Name

Explanation

Response depends on SubCmd sent.

SubCmd == 0xFF: 32bit mask of available interfaces

SubCmd == 0xFE: Previously selected inter-face number (0..31)

SubCmd == 0..31: Previously selected inter-face number (0..31)

H<-E1 * U32Response

Table 5.29: EMU_CMD_SELECT_IF response overview

Additional information

The interfaces that can be selected (if available) are described in the table below:Interface #01

TIF_JTAGTIF_SWD

Define

Table 5.30: EMU_CMD_SELECT_IF interface overviewSample communication (requesting available interfaces)

Output command to check for available interfaces.

H->E: C7 FF

Returns available interfaces as 32bit mask (in this case JTAG and SWD are available).

H<-E: 03 00 00 00

Sample communication (selecting SWD interface)

Output command to select SWD interface.

H->E: C7 02

Returns previously selected interface (in this case previously selected interface wasJTAG).

H<-E: 01 00 00 00

42CHAPTER 5Emulator protocol

5.5.4EMU_CMD_SET_KS_POWER

Description

Sets KS power on JTAG pin 19 to on or off temporarily.

Command

DirectionH->EH->E

Data1 * U81 * U8

NameCmdOnOff

Explanation

Command: 0x08

Set KS power on: 0x01Set KS power off: 0x00

Table 5.31: EMU_CMD_SET_KS_POWER command overviewResponse

Additional information

JTAG pin 19 may provide 5V power to a target system. For details, please refer to J-Link User manual.

Sample communication

Set KS power to on command.

H->E: 08 01

5.5.5EMU_CMD_HW_CLOCK

Description

Generates one clock and retrieves data from TDI.

Command

DirectionH->E

Data1 * U8

NameCmd

Command: 0xC8

Explanation

Table 5.32: EMU_CMD_HW_CLOCK command overviewResponse

DirectionH<-E

Data1 * U8

NameTDI

Data from TDI.

Explanation

Table 5.33: EMU_CMD_HW_CLOCK response overview

Additional information

This command generates one clock and returns the value of TDI on falling edge ofclock.

Default value of clock ping (TCK) is high. So this function generates a low pulse, fol-lowed by a high pulse on TCK.

Sample communication

Generate one clock.

H->E: C8

Returns TDI data.

H<-E: 00

44CHAPTER 5Emulator protocol

5.5.6EMU_CMD_HW_TMS0

Description

Clears TMS signal.

Command

DirectionH->E

Data1 * U8

NameCmd

Command: 0xC9

Explanation

Table 5.34: EMU_CMD_HW_TMS0 command overviewResponse

Sample communication

Clear TMS command.

H->E: C9

5.5.7EMU_CMD_HW_TMS1

Description

Sets TMS signal.

Command

DirectionH->E

Data1 * U8

NameCmd

Command: 0xCA

Explanation

Table 5.35: EMU_CMD_HW_TMS1 command overviewResponse

Sample communication

Set TMS command.

H->E: CA

46CHAPTER 5Emulator protocol

5.5.8EMU_CMD_HW_DATA0

Description

Clears TDI signal.

Command

DirectionH->E

Data1 * U8

NameCmd

Command: 0xCB

Explanation

Table 5.36: EMU_CMD_HW_DATA0 command overviewResponse

Sample communication

Clear TDI command.

H->E: CB

5.5.9EMU_CMD_HW_DATA1

Description

Sets TDI signal.

Command

DirectionH->E

Data1 * U8

NameCmd

Command: 0xCC

Explanation

Table 5.37: EMU_CMD_HW_DATA1 command overviewResponse

Sample communication

Set TDI command.

H->E: CC

48CHAPTER 5Emulator protocol

5.5.10EMU_CMD_HW_JTAG

Description

Handles the JTAG connection. It receives data for TDI and TMS and sends TDO databack.

Command

DirectionH->EH->EH->EH->E

Data1 * U81 * U16* U8

* U8

NameCmd

NumBitsTMSTDI

Explanation

Command: 0xCD

Number of bits to transfer.

Data for TMS. NumBytes calculates as follows: NumBytes = (NumBits + 7) >> 3

Data for TDI. NumBytes calculates as follows: NumBytes = (NumBits + 7) >> 3

Table 5.38: EMU_CMD_HW_JTAG command overviewResponse

DirectionH<-E

Data* U8

NameTDO

Explanation

TDO data. NumBytes calculates as follows: NumBytes = (NumBits + 7) >> 3

Table 5.39: EMU_CMD_HW_JTAG response overview

Additional information

This command is obsolete. Please use EMU_CMD_HW_JTAG3 on page50.

5.5.11EMU_CMD_HW_JTAG2

Description

Handles the JTAG connection. It receives data for TDI and TMS and sends TDO databack.

Command

DirectionH->EH->EH->EH->EH->E

Data1 * U81 * U81 * U16* U8

* U8

NameCmdDUMMYNumBitsTMSTDI

Explanation

Command: 0xCE

Dummy data in order to word align data trans-fers.

Number of bits to transfer.

Data for TMS. NumBytes calculates as follows: NumBytes = (NumBits + 7) >> 3

Data for TDI. NumBytes calculates as follows: NumBytes = (NumBits + 7) >> 3

Table 5.40: EMU_CMD_HW_JTAG2 command overviewResponse

DirectionH<-E

Data* U8

NameTDO

Explanation

TDO data. NumBytes calculates as follows: NumBytes = (NumBits + 7) >> 3

Table 5.41: EMU_CMD_HW_JTAG2 response overview

Additional information

This command is obsolete for J-Links with hardware version 5 and above. Please useEMU_CMD_HW_JTAG3 on page50.

The hardware version can be retrieved using the commandEMU_CMD_GET_HW_VERSION on page34.

50CHAPTER 5Emulator protocol

5.5.12EMU_CMD_HW_JTAG3

Description

Handles the JTAG connection. If used with JTAG interface it receives data for TDI andTMS and sends TDO data back. If used with SWD interface it receives data for SWDIO(in) and DIR and sends SWDIO (out) data back.

Command (JTAG interface)

DirectionH->EH->EH->EH->EH->E

Data1 * U81 * U81 * U16* U8

* U8

NameCmdDUMMYNumBitsTMSTDI

Explanation

Command: 0xCF

Dummy data in order to word align data trans-fers.

Number of bits to transfer.

Data for TMS. NumBytes calculates as follows: NumBytes = (NumBits + 7) >> 3

Data for TDI. NumBytes calculates as follows: NumBytes = (NumBits + 7) >> 3

Table 5.42: EMU_CMD_HW_JTAG (JTAG interface) command overviewCommand (SWD interface)

DirectionH->EH->EH->E

Data1 * U81 * U81 * U16* U8* U8

NameCmdDUMMYNumBits

Explanation

Command: 0xCF

Dummy data in order to word align data trans-fers.

Number of bits to transfer.Direction of data to transmit.

NumBytes calculates as follows: NumBytes = (NumBits + 7) >> 3 .0: In1: Out

SWDIO input data. NumBytes calculates as fol-lows: NumBytes = (NumBits + 7) >> 3

H->EDIR

H->ESWDIO (in)

Table 5.43: EMU_CMD_HW_JTAG (SWD interface) command overview

Response (JTAG interface)

DirectionH<-EH<-E

Data* U81 * U8

NameTDOReturn

Explanation

TDO data. NumBytes calculates as follows: NumBytes = (NumBits + 7) >> 3Return value:0: O.K.

Everything else: Error occured.

Table 5.44: EMU_CMD_HW_JTAG (JTAG interface) response overviewResponse (SWD interface)

DirectionH<-EH<-E

Data* U81 * U8

NameSWDIO (out)Return

Explanation

SWDIO output data. NumBytes calculates as follows: NumBytes = (NumBits + 7) >> 3Return value:0: O.K.

Everything else: Error occured.

Table 5.45: EMU_CMD_HW_JTAG (SWD interface) response overview

Additional information

How the JTAG/SWD sequence is generated is beyond the scope of this manual.

RM08001 Reference manual for J-Link USB Protocol

This command is available for J-Links with hardware version 5 and above only.SWD support is available for J-Links with hardware version 6 and above only.

The hardware version can be retrieved using the commandEMU_CMD_GET_HW_VERSION on page34.

Sample communication

Output command and JTAG TDI, TMS data to halt ARM7 CPU.

H->E: CF 00 48 00 86 E3 71 C0 01 00 00 00 0C 20 00 18 02 00 00 00 00 00

Returns TDO data.

H<-E: 20 00 08 00 48 00 00 00 00

Returns O.K.

H<-E: 00

52CHAPTER 5Emulator protocol

5.5.13EMU_CMD_HW_JTAG_WRITE

Description

Handles the JTAG connection. If used with JTAG interface it receives data for TDI andTMS. No TDO data is sent back. If used with SWD interface it receives data forSWDIO (in) and DIR . No SWDIO (out) data is sent back. The status of the transmis-sion is saved in a stick error flag. This flag can be requested via theEMU_CMD_HW_JTAG_GET_RESULT command. For more information about theEMU_CMD_HW_JTAG_GET_RESULT command, please refer toEMU_CMD_HW_JTAG_GET_RESULT on page53

Command (JTAG interface)

DirectionH->EH->EH->EH->EH->E

Data1 * U81 * U81 * U16* U8

* U8

NameCmdDUMMYNumBitsTMSTDI

Explanation

Command: 0xCF

Dummy data in order to word align data trans-fers.

Number of bits to transfer.

Data for TMS. NumBytes calculates as follows: NumBytes = (NumBits + 7) >> 3

Data for TDI. NumBytes calculates as follows: NumBytes = (NumBits + 7) >> 3

Table 5.46: EMU_CMD_HW_JTAG_WRITE (JTAG interface) command overviewCommand (SWD interface)

DirectionH->EH->EH->E

Data1 * U81 * U81 * U16* U8* U8

NameCmdDUMMYNumBits

Explanation

Command: 0xCF

Dummy data in order to word align data trans-fers.

Number of bits to transfer.Direction of data to transmit.

NumBytes calculates as follows: NumBytes = (NumBits + 7) >> 3 .0: In1: Out

SWDIO input data. NumBytes calculates as fol-lows: NumBytes = (NumBits + 7) >> 3

H->EDIR

H->ESWDIO (in)

Table 5.47: EMU_CMD_HW_JTAG_WRITE (SWD interface) command overview

Additional information

How the JTAG/SWD sequence is generated is beyond the scope of this manual.This command is available for J-Links with hardware version 6 and above only.The hardware version can be retrieved using the commandEMU_CMD_GET_HW_VERSION on page34.

Sample communication

Output command and JTAG TDI, TMS data to halt ARM7 CPU.

H->E: CF 00 48 00 86 E3 71 C0 01 00 00 00 0C 20 00 18 02 00 00 00 00 00

5.5.14EMU_CMD_HW_JTAG_GET_RESULT

Description

Requests the sticky error bit from the emulator. This bit is set if aEMU_CMD_HW_JTAG_WRITE command failed. After theEMU_CMD_HW_JTAG_GET_RESULT command has been performed, the sticky errorbit is cleared.

Command

DirectionH->E

Data1 * U8

NameCmd

Command: 0xD6

Explanation

Table 5.48: EMU_CMD_HW_JTAG_GET_RESULT command overviewResponse

DirectionE->H

Data1 * U8

Name

Explanation

Return value:

sticky error

0: O.K.

bit

Everything else: Error

Table 5.49: EMU_CMD_HW_JTAG_GET_RESULT command overview

Sample communication

Output command to get the sticky error bit:

H->E: D6

Returns O.K.

E->H: 00

CHAPTER 5Emulator protocol

5.5.15EMU_CMD_HW_TRST0

Description

Activates TRST signal.

Command

DirectionH->E

Data1 * U8

NameCmd

Command: 0xDE

Explanation

Table 5.50: EMU_CMD_HW_TRST0 command overviewResponse

Sample communication

Activate TRST command.

H->E: DE

5.5.16EMU_CMD_HW_TRST1

Description

Deactivates TRST signal.

Command

DirectionH->E

Data1 * U8

NameCmd

Command: 0xDF

Explanation

Table 5.51: EMU_CMD_HW_TRST1 command overviewResponse

Sample communication

Deactivate TRST command.

H->E: DF

56CHAPTER 5Emulator protocol

5.5.17EMU_CMD_WRITE_DCC

Description

Writes to the CPU through JTAG using DCC.

Command

DirectionH->EH->EH->EH->EH->EH->EH->E

Data1 * U81 * U161 * U161 * U161 * U161 * U161 * U16* U8* U8

NameCmd

NumBitsInitNumBitsStatNumBitsDataBitPosStatTimeoutNumItems

Explanation

Command: 0xF1TBD.TBD.TBD.TBD.TBD.TBD.

JTAG Data. NumBytes calculates as follows: NumBytes = 2 *

((NumBitsInit + 7) >> 3) + ((NumBitsStat + 7) >> 3) +((NumBitsData + 7) >> 3) Data content.

H->EJTAG Data

H->EData

Table 5.52: EMU_CMD_WRITE_DCC command overviewResponse

DirectionH<-E

Data1 * U8

NameReturn

Explanation

Return value of the command:0x00: O.K.

0x01: Timeout

Table 5.53: EMU_CMD_WRITE_DCC response overview

Additional information

Explanation of DCC data generation is beyond the scope of this document.

5.6

5.6.1

Target functions

These commands are used to act on a target hardware such as resetting it.

EMU_CMD_RESET_TARGET

Description

Resets the target via hardware reset.

Communication

DirectionH->E

Data1 * U8

NameCmd

Command: 0x03

Explanation

Table 5.: EMU_CMD_RESET_TARGET command overviewResponse

Additional information

Activates the target RESET line and releases it after 2ms.

Sample communication

Reset target command.

H->E: 03

58CHAPTER 5Emulator protocol

5.6.2EMU_CMD_HW_RELEASE_RESET_STOP_EX

Description

Resets the CPU and halts as soon as possible. Means as soon as a criteria is matched.

Command

DirectionH->EH->EH->EH->EH->EH->EH->EH->E

Data1 * U81 * U161 * U161 * U161 * U161 * U16* U8

* U8

NameCmd

NumBytesNumRepsCriteriaBy-teOffCriteria-Mask

CriteriaDataTMSTDI

Explanation

Command: 0xD0

Number of bytes to transfer.

Number of repeats trying to halt the CPU.Offset address where to check for criteria match.Criteria mask.Criteria to match.TMS data.TDI data.

Table 5.55: EMU_CMD_HW_RELEASE_RESET_STOP_EX command overviewResponse

DirectionH<-E

Data* U8

NameTDO

TDO return data.

Explanation

Table 5.56: EMU_CMD_HW_RELEASE_RESET_STOP_EX response overview

Additional information

In order to halt an ARM7 or ARM9 CPU as soon as possible the emulator can decide ifthe CPU is halted by checking for a criteria. This eliminates the USB latency a deci-sion by the host PC would cause. What happens is that RESET is pulled high and theemulator tries to halt the CPU with a halting sequence as soon as possible for Num-Reps tries. To check if halting the CPU was successful the emulator checks for a crite-ria. A pseudo code could look like the following code:

U16 i = 0;

ResetHigh();do { i++;

SendSequence();

} while(((Data & CriteriaMask) != CriteriaData) && (i <= NumReps))

This command is emplemented for ARM7 and ARM9 cores only.

5.6.3EMU_CMD_HW_RELEASE_RESET_STOP_TIMED

Description

Resets the CPU and halts as soon as its possible or the timeout expires.

Command

DirectionH->EH->EH->EH->EH->EH->EH->EH->E

Data1 * U81 * U161 * U161 * U161 * U161 * U16* U8

* U8

NameCmd

NumBytesTimeOutCryteriaBy-teOffCriteria-Mask

CriteriaDataTMSTDI

Explanation

Command: 0xD1

Number of bytes to transfer.Timeout in ms.

Offset address where to check for criteria match.Criteria mask.Criteria to match.TMS data.TDI data.

Table 5.57: EMU_CMD_HW_RELEASE_RESET_STOP_TIMED command overviewResponse

DirectionH<-E

Data* U8

NameTDO

TDO return data.

Explanation

Table 5.58: EMU_CMD_HW_RELEASE_RESET_STOP_TIMED response overview

Additional information

For further information please refer to EMU_CMD_HW_RELEASE_RESET_STOP_EX onpage58. The only difference of this command is that the abort criteria is a timeoutinstead of a maximum repeat count.

60CHAPTER 5Emulator protocol

5.6.4EMU_CMD_HW_RESET0

Description

Activates target reset.

Command

DirectionH->E

Data1 * U8

NameCmd

Command: 0xDC

Explanation

Table 5.59: EMU_CMD_HW_RESET0 command overviewResponse

Sample communication

Activate target reset command.

H->E: DC

5.6.5EMU_CMD_HW_RESET1

Description

Deactivates target reset.

Command

DirectionH->E

Data1 * U8

NameCmd

Command: 0xDD

Explanation

Table 5.60: EMU_CMD_HW_RESET1 command overviewResponse

Sample communication

Deactivate target reset command.

H->E: DD

62CHAPTER 5Emulator protocol

5.6.6EMU_CMD_GET_CPU_CAPS

Description

Retrieves the capabilities of the target CPU.

Command

DirectionH->EH->EH->EH->EH->E

Data1 * U81 * U81 * U81 * U81 * U8

NameCmdDevice-FamilyInterfaceReservedReserved

Command: 0xE9

Device family of the target CPU

Target interface used to connect the emulator to the target CPU.DummyDummy

Explanation

Table 5.61: EMU_CMD_GET_CPU_CAPS command overviewResponse

DirectionH<-E

Data1 * U32

NameCapabilities

Explanation

Functionality supported by the target CPU.

Table 5.62: EMU_CMD_GET_CPU_CAPS response overview

Additional information

The capability flags used are described in the table below:Bit012

Define

CPU_CAP_RESERVEDCPU_CAP_WRITE_MEMCPU_CAP_READ_MEM

Explanation

Always 1.

Supports command

\"CPU_CMD_WRITE_MEM\"Supports command

\"CPU_CMD_READ_MEM\"

Table 5.63: EMU_CMD_GET_CPU_CAPS flag overviewSample communication

Requesting the CPU capabilities.

H->E: E9 07 00 00 00

Returns no capabilites.

H<-E: 01 00 00 00

5.6.7EMU_CMD_EXEC_CPU_CMD

Description

Executes functions supported by the CPU.

Command

DirectionH->EH->EH->EH->EH->EH->EH->EH->EH->E

Data1 * U81 * U81 * U81 * U81 * U81 * U16* U81 * U321 * U32* U8

NameCmd

CPUCmdSubCmdDevice-FamilyInterfaceNumBytesConfigAddr

NumBytes-WriteReadData

Explanation

Command: 0xEA

CPU command to be executed.

Sub command for the CPU command if any.Device family of the target CPU

Target interface used to connect the emulator to the target CPU.

Number of bytes to transmit for the configura-tion.

Configuration data.

Memory location to write to / read from.

Number of bytes to write/read to/from given address.

Data to be written to the given memory address.

Only used with command CPU_CMD_WRITE_MEM.

H->E

Table 5.: EMU_CMD_EXEC_CPU_CMD command overviewResponse

DirectionH<-E

Data1 * U32

NameResult

Explanation

Result of the write/read command. 0 : Everything O.K.

> 0 :Number of bytes that could not be read/written.

Table 5.65: EMU_CMD_EXEC_CPU_CMD response overview

Additional information

The list below gives an overview about the available CPU commands.

Define

CPU_CMD_WRITE_MEMCPU_CMD_READ_MEM

Table 5.66: CPU command overviewValue100101

Explanation

Writes to target memory.Reads from target memory.

CHAPTER 5Emulator protocol

5.6.8EMU_CMD_WRITE_MEM_ARM79

Description

Writes to target memory on ARM 7/9 targets.

Command

DirectionH->EH->EH->EH->EH->EH->EH->EH->EH->EH->EH->EH->E

Data1 * U81 * U81 * U81 * U81 * U81 * U81 * U81 * U161 * U81 * U321 * U32* U8

NameCmd

TotalIRLenNumDevicesDevicePosIRPreIsARM9IsBigEndianDummySubCmdAddr

NumBytesData

Explanation

Command: 0xF7

Total scanchain length.

Number of devices on scanchain.Devices before target device.IR bits before target device.0x00: ARM70x01: ARM9

0x00: Little endian0x01: Big endianDummy field.Typically 0x01 .

Target address in memory.Number of bytes to write.

Data that should be written to memory.

Table 5.67: EMU_CMD_WRITE_MEM_ARM79 command overviewResponse

DirectionH<-E

Data1 * U8

NameReturn status

Explanation

0x00: O.K.

0x01: Adaptive clocking timeout0x02: Memory access timeout0x03: Core error

Table 5.68: EMU_CMD_WRITE_MEM_ARM79 response overview

Sample communication

Writing 0xAB to address 0x12345678.

H->E: F7 04 01 00 00 00 00 00 00 01 78 56 34 12 01 00 00 00 AB

Returns O.K.

H<-E: 00

5.6.9EMU_CMD_READ_MEM_ARM79

Description

Reads from target memory on ARM 7/9 targets.

Command

DirectionH->EH->EH->EH->EH->EH->EH->EH->EH->EH->EH->E

Data1 * U81 * U81 * U81 * U81 * U81 * U81 * U81 * U161 * U81 * U321 * U32

NameCmd

TotalIRLenNumDevicesDevicePosIRPreIsARM9IsBigEndianDummySubCmdAddr

NumBytes

Explanation

Command: 0xF8

Total scanchain length.

Number of devices on scanchain.Devices before target device.IR bits before target device.0x00: ARM70x01: ARM9

0x00: Little endian0x01: Big endianDummy field.Typically 0x01 .

Target address in memory.Number of bytes to read.

Table 5.69: EMU_CMD_READ_MEM_ARM79 command overviewResponse

DirectionH<-E

Data1 * U8

Name

Explanation

H<-E

* U81 * U32

H<-E

H<-E1 * U32

0x00: O.K.

0x01: Adaptive clocking timeout

ReturnStatus

0x02: Memory access timeout0x03: Core error

Data that is read from the memory.

This transaction only happens if Return-Data

Status == 0x00 or NumBytes <= 0x40 .Address at which an error occured.

ErrorAddrThis transaction only happens if Return-Status != 0x00 or NumBytes > 0x40 .

Information about which data width could not be accessed in memory.

FailAccessWidth

This transaction only happens if Return-Status != 0x00 or NumBytes > 0x40 .

Table 5.70: EMU_CMD_READ_MEM_ARM79 response overview

Sample communication

Retrieve 1 byte from address 0x10 command.

H->E: F8 04 01 00 00 00 00 00 00 01 10 00 00 00 01 00 00 00

Returns O.K.

H<-E: 00

Returns data read from address 0x10.

H<-E: 18

66CHAPTER 5Emulator protocol

5.7

5.7.1

Configuration functions

These commands are used to configure the emulator.

EMU_CMD_READ_CONFIG

Description

Reads the emulator configuration from the J-Link.

Command

DirectionH->E

Data1 * U8

Cmd

Name

Explanation

Command: 0xF2

Table 5.71: EMU_CMD_READ_CONFIG command overviewResponse

DirectionH<-E

Data256 * U8

NameEmulator

configuration

Explanation

Returns the actual emulator configuration.

Table 5.72: EMU_CMD_READ_CONFIG response overview

Sample communication

Retrieve emulator configuration command.

H->E: F2

Returns emulator configuration.

H<-E: 00 02 FF FF 01 00 00 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF

For further information please refer to Emulator configuration on page16.

5.7.2EMU_CMD_WRITE_CONFIG

Description

Writes the emulator configuration to the J-Link.

Command

DirectionH->EH->E

Data1 * U8256 * U8

NameCmd

Emulator

configuration

Explanation

Command: 0xF3

The new emulator configuration.

Table 5.73: EMU_CMD_WRITE_CONFIG communication overviewResponse

Sample communication

Send emulator configuration command.

H->E: F3

Send emulator configuration.

H->E: 00 02 FF FF 01 00 00 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF

For further information please refer to Emulator configuration on page16.

68CHAPTER 5RM08001 Reference manual for J-Link USB ProtocolEmulator protocol

Chapter 6Glossary

This chapter describes important terms used throughout this manual.

70CHAPTER 6Glossary

Adaptive clocking

A technique in which a clock signal is sent out by J-Link / J-Trace. J-Link / J-Tracewaits for the returned clock before generating the next clock pulse. The techniqueallows the J-Link / J-Trace interface unit to adapt to differing signal drive capabilitiesand differing cable lengths.

Application Program Interface

A specification of a set of procedures, functions, data structures, and constants thatare used to interface two or more software components together.

Big-endian

Memory organization where the least significant byte of a word is at a higher addressthan the most significant byte. See Little-endian.

Device Under Test

The device in the scan chain debugged at the moment.

DUT

See Device Under Test.

EmbeddedICE

The additional hardware provided by debuggable ARM processors to aid debugging.

Halfword

A 16-bit unit of information. Contents are taken as being an unsigned integerunless otherwise stated.

Host

A computer which provides data and other services to another computer. Especially, acomputer providing debugging services to a target being debugged.

ICache

Instruction cache.

ICE Extension Unit

A hardware extension to the EmbeddedICE logic that provides more breakpoint units.

Identifier.

IEEE 1149.1

The IEEE Standard which defines TAP. Commonly (but incorrectly) referred to asJTAG.

In-Circuit Emulator (ICE)

A device enabling access to and modification of the signals of a circuit while that cir-cuit is operating.

Instruction Register

When referring to a TAP controller, a register that controls the operation of the TAP.

See Instruction Register.

Joint Test Action Group (JTAG)

The name of the standards group which created the IEEE 1149.1 specification.

Little-endian

Memory organization where the least significant byte of a word is at a lower addressthan the most significant byte. See also Big-endian.

Memory coherency

A memory is coherent if the value read by a data read or instruction fetch is thevalue that was most recently written to that location. Obtaining memory coherency isdifficult when there are multiple possible physical locations that are involved, such asa system that has main memory, a write buffer, and a cache.

RESET

Abbreviation of System Reset. The electronic signal which causes the target systemother than the TAP controller to be reset. This signal is also known as \"nSRST\"\"nSYSRST\

nTRST

Abbreviation of TAP Reset. The electronic signal that causes the target system TAPcontroller to be reset. This signal is known as nICERST in some other manuals. Seealso nSRST.

Open collector

A signal that may be actively driven LOW by one or more drivers, and is otherwisepassively pulled HIGH. Also known as a \"wired AND\" signal.

Processor Core

The part of a microprocessor that reads instructions from memory and executesthem, including the instruction fetch unit, arithmetic and logic unit, and the registerbank. It excludes optional coprocessors, caches, and the memory management unit.

RTCK

Returned TCK. The signal which enables Adaptive Clocking.

Scan Chain

A group of one or more registers from one or more TAP controllers connectedbetween TDI and TDO, through which test data is shifted.

TAP Controller

Logic on a device which allows access to some or all of that device for test purposes.The circuit functionality is defined in IEEE1149.1.

Target

The actual processor (real silicon or simulated) on which the application program isrunning.

TCK

The electronic clock signal which times data on the TAP data lines TMS, TDI, andTDO.

TDI

The electronic signal input to a TAP controller from the data source (upstream). Usu-ally, this is seen connecting the J-Link / J-Trace Interface Unit to the first TAP control-ler.

TDO

The electronic signal output from a TAP controller to the data sink (downstream).Usually, this is seen connecting the last TAP controller to the J-Link / J-Trace Inter-face Unit.

72CHAPTER 6Glossary

Test Access Port (TAP)

The port used to access a device's TAP Controller. Comprises TCK, TMS, TDI, TDO,and nTRST (optional).

Transistor-transistor logic (TTL)

A type of logic design in which two bipolar transistors drive the logic output to one orzero. LSI and VLSI logic often used TTL with HIGH logic level approaching +5V andLOW approaching 0V.

Watchpoint

A location within the image that will be monitored and that will cause execution tostop when it changes.

Word

A 32-bit unit of information. Contents are taken as being an unsigned integer unlessotherwise stated.

Chapter 7

Literature and references

This chapter lists documents, which we think may be useful to gain deeper under-standing of technical details.

74CHAPTER 7Literature and references

ReferenceTitleComments

[UM08001]

[UM08004]

[IEEE]

This document gives information about using the SEGGER J-Link / J-SEGGER J-Link / J-Trace User's

Trace ARM.

Guide.

It is publicly available from SEGGER (www.segger.com).

This document contains some hard-ware specific informations which are

SEGGER J-Link RDI User's

thought of beeing helpful.

Guide.

It is publicly available from SEGGER (www.segger.com).

This document contains the IEEE

IEEE Standard Test Access

1149.2000 JTAG standard.

Port and Boundary-Scan Archi-It is publicly available from IEEE

tecture, IEEE SS94949.

(www.ieee.org).

Index

Adaptive clocking.................................70Application Program Interface................70

nTRST...............................................71

Big-endian..........................................70

Open collector....................................71

Device Under Test................................70DUT...................................................70

Processor Core...................................71

RESET...............................................71RTCK.................................................71

EmbeddedICE.....................................70EMU_CMD_HW_JTAG_GET_RESULT........53EMU_CMD_HW_JTAG_WRITE.................52

Scan Chain.........................................71Support.............................................69Syntax, conventions used.......................5

Halfword.............................................70Host...................................................70

TAP Controller....................................Target...............................................TCK...................................................TDI...................................................TDO..................................................Test Access Port (TAP).........................Transistor-transistor logic (TTL).............

71717171717272

ICache...............................................70ICE Extension Unit...............................70ID.....................................................70IEEE 1149.1........................................70In-Circuit Emulator..............................70Instruction Register..............................70IR......................................................70

Watchpoint.........................................72Word.................................................72

Joint Test Action Group (JTAG)...............70

Little-endian.......................................71

Memory coherency...............................71

76Index

因篇幅问题不能全部显示，请点此查看更多更全内容

查看全文