Broadcom LV mode

This is an undocumented special JTAG mode used on some Broadcom SoCs.

Key properties

• IR length is 32 bits
• Some hints available at hndjtagdefs.h
• IDCODE command is 0xfffffffe

Known IDCODEs

• 0xa817f
• 0x1471617f
• 0x1535717f
• 0x1535617f
• 0xc417f

Switch to EJTAG

It's possible to switch to standard EJTAG by doing the following:

• Shift 0x0143ff3a into IR, end state run/idle
• Shift 1 into DR (length 32), end state run/idle
• Reenumerate the bus, the device will reappear with a different ID and IR length (5 or 7)

OpenOCD example:

   poll 0
   irscan $_CHIPNAME-lv.tap 0x143ff3a
   drscan $_CHIPNAME-lv.tap 32 1