4.3.1. How JTAG is used by the OpenRISC 1000 Debug Unit

The OpenRISC 1000 debug unit uses a 4-bit JTAG instruction register. It adds two additional instructions, CHAIN_SELECT (binary 0011) and DEBUG (binary 1000).

When instruction CHAIN_SELECT is used, the subsequent value shifted into the JTAG data register indicates the debug chain (see the section called “ JTAG Debug Chains ”) that will be used for subsequent debug operations.
When instruction DEBUG is used, subsequent values shifted into the JTAG data register are interpreted as instructions for the debug chain selected by the most recent CHAIN_SELECT instruction. 4 bits are used to specify the debug chain.

All data registers have a cyclic redundancy check (CRC) field as their final (most significant) 8-bits, calculated on the remaining bits. The CRC used is the 8-bit ATM Header Error Correction [3], using the irreducible polynomial x⁸ + x² + x + 1. This is capable of detecting all single and double bit errors in the data register and single burst errors of up to 8 bits.

So the usual sequence of operations is as follows:

Shift instruction register CHAIN_SELECT.
Shift data register with the desired debug chain (4 bits) + CRC (8 bits).
Shift instruction register DEBUG.
Shift the instructions appropriate to the selected debug chain in to the data register. The number of bits depends on the chosen debug chain (see the section called “ JTAG Debug Chains ”).

JTAG Debug Chains

The debug chain is a 4-bit field. The OpenRISC 1000 Debug Unit defines 6 scan chains:

GLOBAL_BS (binary 0000). The default debug chain, selected on reset, with no functionality.
RISC_DEBUG (binary 0001). The data register is used to read and write Special Purpose Registers (SPRs). It is described in more detail in the section called “ The RISC_DEBUG Debug Chain ”.
RISC_TEST (binary 0010). This debug chain is specified, but not used. It has no functionality if selected.
TRACE_TEST (binary 0011). This is optionally available for the Debug Unit (under control of a Verilog `define), offering hardware trace functionality. It is not described further in this application note.
REGISTER (binary 0100). The data register is used to access and set the CPU's control registers. It is described in more detail in the section called “ The REGISTER Debug Chain ”.
WISHBONE (binary 0101). The data register is used to read and write main memory attached to the Wishbone bus. It is described in more detail in the section called “ The WISHBONE Debug Chain ”.

The `RISC_DEBUG` Debug Chain

The RISC_DEBUG chain uses a 73-bit data register as shown in Figure 4.5.

Figure 4.5. RISC_DEBUG JTAG data register format

The first 32 bits (SPR) specify the SPR to be accessed. Bit 32 (W) is set if the value is to be written. Bits 33-64 (Data) form the value to be written (if W is set) or the value read when the result is shifted out. The final 8 bits (65-72) are the CRC.

The CPU logic is fast enough that the data field can be set during a single JTAG capture-shift-update operation.

The `REGISTER` Debug Chain

The REGISTER chain uses a 46-bit data register as shown in Figure 4.6.

Figure 4.6. REGISTER JTAG data register format

The first 5 bits (Reg) specify the CPU control register to be accessed. Bit 5 (W) is set if the value is to be written. Bits 6-37 (Data) form the value to be written (if W is set) or the value read when the result is shifted out. The final 8 bits (38-45) are the CRC.

The CPU logic is fast enough that the data field can be set during a single JTAG capture-shift-update operation.

The OpenRISC 1000 Debug Unit defines 6 CPU control registers:

MODER (binary 00000), TSEL (binary 00001), QSEL (binary 00010), SSEL (binary 00011) and RECSEL (binary 10000). These registers control hardware trace, if that functionality is implemented. They are not described further here.

RISCOP (binary 00100). The bits in this register control the CPU. Bit 0 is the reset bit. If written to 1, the CPU will be reset. Bit 1 is the stall bit. The value read indicates whether the CPU is stalled. The CPU can be stalled by writing 1 to this bit and unstalled by reading 0 from this bit.

	Caution
	Remember that accessing a JTAG register takes hundreds of system clock cycles. It is quite possible to unstall the processor and for the processor to have stalled again (perhaps due to hardware single step, or an adjacent breakpoint) before the register is next read. This can cause confusion, with "unstalling" appearing to have no effect. A VCD trace always clarifies what is happening.

	Note
	The Mohor Debug Unit has no support for trace and the value of the Reg field is ignored. All accesses are for the `RISCOP` register.

The `WISHBONE` Debug Chain

The WISHBONE chain uses a 73-bit data register as shown in Figure 4.7.

Figure 4.7. WISHBONE JTAG data register format

The first 32 bits (Address) specify the memory address to be accessed. Bit 32 (W) is set if the value is to be written. Bits 33-64 (Data) form the value to be written (if W is set) or the value read when the result is shifted out. The final 8 bits (65-72) are the CRC.

The Wishbone memory interface may not be able to set the data field during a single JTAG capture-shift-update operation. This is particularly the case with slow memory. This can be solved either by using the PAUSE-DR state of the JTAG TAP state machine, or by performing two reads, one immediately after the other.