Broadcom LV mode

From WikiDevi.Wi-Cat.RU
Jump to navigation Jump to search

This is an undocumented special JTAG mode used on some Broadcom SoCs.

Key properties

  • IR length is 32 bits
  • Some hints available at hndjtagdefs.h
  • IDCODE command is 0xfffffffe


  • 0xa817f
  • 0x1471617f
  • 0x1535717f
  • 0x1535617f
  • 0xc417f

Switch to EJTAG

It's possible to switch to standard EJTAG by doing the following:

  • Shift 0x0143ff3a into IR, end state run/idle
  • Shift 1 into DR (length 32), end state run/idle
  • Reenumerate the bus, the device will reappear with a different ID and IR length (5 or 7)

OpenOCD example:

   poll 0
   irscan $_CHIPNAME-lv.tap 0x143ff3a
   drscan $_CHIPNAME-lv.tap 32 1