JTAG .

• JTAG

https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html

Joint Test Action Group - Daisy-chained JTAG (IEEE 1149.1)

1 The TRST pin is an optional active-low reset to the test logic - usually asynchronous, but sometimes synchronous, depending on the

chip. If the pin is not available, the test logic can be reset by switching to the reset state synchronously, using TCK and TMS. Note

that resetting test logic doesn't necessarily imply resetting anything else. There are generally some processor-specific JTAG

operations which can reset all or part of the chip being debugged.



1 Faster TCK frequencies are most useful when JTAG is used to transfer lots of data, such as when storing a

program executable into flash memory.



1 Clocking changes on TMS steps through a standardized JTAG state machine. The JTAG state machine

can reset, access an instruction register, or access data selected by

the instruction register.



1 JTAG platforms often add signals to the handful defined by the IEEE 1149.1

specification. A System Reset (SRST) signal is quite common, letting

debuggers reset the whole system, not just the parts with JTAG support.

Sometimes there are event signals used to trigger activity by the host or by the

device being monitored through JTAG; or, perhaps, additional control lines.



1 Even though few consumer products provide an explicit JTAG port

connector, the connections are often available on the printed Circuit Board

as a remnant from development prototype|prototyping and/or

production. When exploited, these connections often provide the most

viable means for reverse engineering.


Joint Test Action Group - Reduced pin count JTAG (IEEE 1149.7)

1 Reduced pin count JTAG uses only two wires, a clock wire and a data wire. This is defined as part of the

IEEE 1149.7 standard. The connector pins are


Joint Test Action Group - Reduced pin count JTAG (IEEE 1149.7)

1 [ http://www.corelis.com/education/Major-Benefits-of-IEEE-1149.7.htm] The star topology enables some parts of

the system to be powered down, whilst others can still be accessed

over JTAG; a daisy chain requires all JTAG interfaces to be powered. Other

two-wire interfaces exist, such as Serial Wire Debug.


Joint Test Action Group - JTAG IEEE Std 1149.1 (boundary scan) instructions

1 This allows JTAG hosts to identify the size and, at least partially, contents of the scan chain to which they are

connected


Joint Test Action Group - JTAG IEEE Std 1149.1 (boundary scan) instructions

1 The IEEE 1149.1 (JTAG) standard describes a number of instructions to support

boundary scan applications. Some of these instructions are mandatory, but TAPs used for debug instead of boundary scan testing sometimes provide minimal or no support for these instructions. Those mandatory

instructions operate on the Boundary Scan Register (BSR) defined in the boundary scan description language|BSDL file, and include:


Joint Test Action Group - JTAG facilities

1 This debug TAP exposes several standard instructions, and a few

specifically designed for hardware-assisted debugging, where a

software tool (the debugger) uses JTAG to communicate with a system

being debugged:



1 * HALT and RESTART, ARM11-specific instructions to halt and restart the

CPU. Halting it puts the core into the Debug Mode, where the ITR can be

used to execute instructions, including using the DCC to transfer data between the debug (JTAG) host

and the CPU.



1 That model resembles the model used in other ARM cores. Non-ARM

systems generally have similar capabilities, perhaps implemented using the Nexus (standard)|Nexus protocols on top of JTAG, or other

vendor-specific schemes.



1 (ARM takes the four standard JTAG signals and adds the optional TRST,

plus the RTCK signal used for adaptive clocking.) Also, the newer cores have updated trace support.


Joint Test Action Group - JTAG connectors

1 Production boards may omit the headers; or when space is tight, just provide JTAG signal access using test

points.



1 Some common pinouts[http://www.jtagtest.com/pino

uts/ JTAG Pinouts] lists a few JTAG-only header layouts that have

widespread tool support. for pin headers are:



1 * MIPS EJTAG (2×7 pin) used for MIPS

Technologies|MIPS based systems



1 * 2×5 pin Atmel AVR|AVR extends Altera JTAG with SRST (and in some cases TRST and an

event output)



1 * MIPI Debug Architecture|MIPI10-/20-connectors (1.27mm 050) for JTAG, cJTAG and

SWD



1 The connector usually provides the board-under-test's logic supply

voltage so that the JTAG adapters will use the appropriate logic levels



1 A recent trend is to have development boards integrate a USB

interface to JTAG, where a second channel is used for a serial port


Joint Test Action Group - JTAG adapter hardware

1 There are both dumb adapters, where the host decides and performs all JTAG operations; and smart ones,

where some of that work is performed inside the adapter, often

driven by a microcontroller



1 Serial port adapters also exist, and are similarly declining in usefulness. They generally involve either slower bitbanging than a parallel port, or a

microcontroller translating some command protocol to JTAG

operations. Such serial adapters are also not fast, but their command

protocols could generally be reused on top of higher speed links.



1 With all JTAG adapters, software support is a basic concern. Many

vendors do not publish the protocols used by their JTAG adapter hardware,

limiting their customers to the tool chains supported by those vendors. This is a particular issue for smart adapters, some of which embed

significant amounts of knowledge about how to interact with specific

CPUs.https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html

Joint Test Action Group - JTAG for software development

1 Most development environments for embedded software include JTAG

support. There are, broadly speaking, three sources of such

software:



1 The JTAG adapters themselves are not free, although sometimes they

are bundled with development boards.



1 JTAG adapters are sometimes sold along with support

bundles.


Atmel AVR - JTAG

1 The Joint Test Action Group (JTAG) feature provides access to on-chip debugging functionality while the

chip is running in the target system. JTAG allows accessing internal memory and registers, setting

breakpoints on code, and single-stepping execution to observe

system behaviour.


Atmel AVR - JTAG

1 # The JTAGICE 3 is the latest member of the JTAGICE family (JTAGICE mkIII). It supports JTAG, aWire, SPI, and PDI

interfaces.


Atmel AVR - JTAG

1 # The JTAGICE mkII replaces the JTAGICE and is similarly priced. The JTAGICE mkII interfaces to the PC via USB, and supports both JTAG and the

newer debugWIRE interface. Numerous third-party clones of the Atmel JTAGICE mkII device started shipping after Atmel released the

communication protocol.


Atmel AVR - JTAG

1 # The AVR Dragon is a low-cost (approximately $50) substitute for the JTAGICE mkII for certain target

parts. The AVR Dragon provides in-system serial programming, high-voltage serial programming and parallel programming, as well as JTAG or debugWIRE emulation for

parts with 32KB of program memory or less. ATMEL changed the

debugging feature of AVR Dragon with the latest firmware of AVR

Studio 4 - AVR Studio 5 and now it supports devices over 32KB of

program memory.


Atmel AVR - JTAG

1 # The JTAGICE adapter interfaces to the PC via a standard serial port. Although the JTAGICE adapter has

been declared End-of-life (product)|end-of-life by Atmel, it is still

supported in AVR Studio and other tools.


Atmel AVR - JTAG

1 JTAG can also be used to perform a boundary scan

test,[http://atmel.com/dyn/corporate/view_detail.asp?

ref=FileName=JTEGICE.htmlSEC_NAME=product JTAGICE Press Release,

2004.] which tests the electrical connections between AVRs and other

boundary scan capable chips in a system. Boundary scan is well-suited

for a production line, while the hobbyist is probably better off testing

with a multimeter or oscilloscope.


Atmel AVR - JTAGICE mkI

1 The JTAG In Circuit Emulator (JTAGICE) debugging tool supports on-chip debugging (OCD) of AVRs with a JTAG interface. The original

JTAGICE mkI uses an RS-232 interface to a PC and can only

program AVR's with a JTAG interface. The JTAGICE mkI is no longer in production, however it has been

replaced by the JTAGICE mkII.https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html

Atmel AVR - JTAGICE mkII

1 The JTAGICE mkII debugging tool supports on-chip debugging (OCD) of

AVRs with SPI, JTAG, PDI, and debugWIRE interfaces. The

debugWire interface enables debugging using only one pin (the Reset pin), allowing debugging of

applications running on low pin-count microcontrollers.


Atmel AVR - JTAGICE mkII

1 The JTAGICE mkII connects using USB, but there is an alternate

connection via a serial port, which requires using a separate power

supply. In addition to JTAG, the mkII supports ISP programming (using 6-

pin or 10-pin adapters). Both the USB and serial links use a variant of the

STK500 protocol.


Atmel AVR - JTAGICE3

1 The JTAGICE3 updates the mkII with more advanced debugging

capabilities and faster programming. It connects via USB and supports the JTAG, aWire, SPI, and PDI interfaces.[http://www.atmel.com/tools/JTAGICE3.aspx JTAGICE3 Product Page] The kit includes several adapters for use

with most interface pinouts.


JTAG

1 'Joint Test Action Group' ('JTAG') is the common name for the Institute of

Electrical and Electronics Engineers|IEEE 1149.1 'Standard Test Access

Port and Boundary-Scan Architecture'. It was initially devised by electronic engineers for testing

printed circuit boards using boundary scan and is still widely used for this

application.https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html

JTAG

1 Today, JTAG is also widely used for Integrated circuit|IC debug ports. In

the embedded processor market, essentially all modern processors implement JTAG when they have enough pins. Embedded systems development relies on debuggers

communicating with chips with JTAG to perform operations like Stepping

(debugging)|single stepping and breakpointing.


JTAG - Overview

1 JTAG was meant to provide a pins-out view from one IC pad to another

so all these faults could be discovered.


JTAG - Overview

1 Boundary-scan is now mostly synonymous with JTAG, but JTAG has

essential uses beyond such manufacturing applications.


JTAG - Debugging

1 An in-circuit emulator (or, more correctly, a JTAG adapter) uses JTAG

as the transport mechanism to access on-chip debug modules inside

the target Central processing unit|CPU


JTAG - Debugging

1 The adoption of the JTAG standard helped move JTAG-centric debugging

environments away from early processor-specific designs


JTAG - Debugging

1 For example, custom JTAG instructions can be provided to allow reading registers built from arbitrary

sets of signals inside the FPGA, providing visibility for behaviors

which are invisible to boundary scan operations


JTAG - Storing firmware

1 In addition, internal monitoring capabilities (temperature, voltage and current) may be accessible via

the JTAG port.



1 JTAG programmers are also used to write software and data into flash

memory. This is usually done using data bus access like the CPU would

use, and is sometimes actually handled by a CPU, but in other cases memory chips have JTAG interfaces themselves. Some modern debug architectures provide internal and

external bus master access without needing to halt and take over a CPU.

In the worst case, it is usually possible to drive external bus signals

using the boundary scan facility.



1 Using a serial UART port and bootloader to upload firmware to

Flash makes this debug cycle quite slow and possibly expensive in terms of tools; installing firmware into Flash (or SRAM instead of Flash) via JTAG is

an intermediate solution between these extremes.


JTAG - Boundary scan testing

1 In many ICs today, all the pins that connect to electronic logic are linked together in a set called the Boundary

Scan chain. By using JTAG to manipulate the chip's external

interface (inputs and outputs to other chips) it is possible to test for certain

faults, caused mainly by manufacturing problems. By using

JTAG to manipulate its internal interface (to on-chip registers), the combinational logic can be tested.


JTAG - Boundary scan testing

1 When combined with built-in self-test (Built-in self-test|BIST), the JTAG scan chain enables a low overhead, embedded solution to testing an IC

for certain static faults (shorts, opens, and logic errors)


JTAG - Electrical characteristics

1 In either case a test probe need only connect to a single JTAG port to have access to all chips on a circuit board.


JTAG - Daisy-chained JTAG (IEEE 1149.1)

1 Faster TCK frequencies are most useful when JTAG is used to transfer lots of data, such as when storing a

program executable into flash memory.


JTAG - Reduced pin count JTAG (IEEE 1149.7)

1 [http://www.corelis.com/education/Major-Benefits-of-IEEE-1149.7.htm]

The star topology enables some parts of the system to be powered

down, whilst others can still be accessed over JTAG; a daisy chain requires all JTAG interfaces to be

powered. Other two-wire interfaces exist, such as Serial Wire Debug.


JTAG - Communications model

1 In JTAG, devices expose one or more test access ports (TAPs). The picture above shows three TAPs, which might

be individual chips or might be modules inside one chip. A daisy

chain of TAPs is called a scan chain, or (loosely) a target. Scan chains

can be arbitrarily long, but in practice twenty TAPs is unusually

long.https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html

JTAG - Communications model

1 To use JTAG, a host is connected to the target's JTAG signals (TMS, TCK, TDI, TDO, etc.) through some kind of

JTAG adapter, which may need to handle issues like level shifting and

galvanic isolation. The adapter connects to the host using some

interface such as USB, PCI, Ethernet, and so forth.


JTAG - Primitives

1 The host communicates with the TAPs by manipulating TMS and TDI in

conjunction with TCK, and reading results through TDO (which is the

only standard host-side input). TMS/TDI/TCK output transitions

create the basic JTAG communication primitive on which higher layer

protocols build:


JTAG - Primitives

1 This JTAG state machine is part of the JTAG spec, and includes sixteen states


JTAG - Primitives

1 * Shifting ... Most parts of the JTAG state machine support two stable states used to transfer data. Each TAP has an instruction register (IR)

and a data register (DR). The size of those registers varies between TAPs,

and those registers are combined through TDI and TDO to form a large shift register. (The size of the DR is a

function of the value in that TAP's current IR, and possibly of the value specified by a SCAN_N instruction.) There are three operations defined

on that shift register:


JTAG - Primitives

1 So at a basic level, using JTAG involves reading and writing

instructions and their associated data registers; and sometimes

involves running a number of test cycles. Behind those registers is hardware that is not specified by

JTAG, and which has its own states that will be affected by JTAG

activities.https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html

JTAG - Primitives

1 Some ARM cores use such sequences to enter and exit a two-wire (non-JTAG) Serial Wire Debug|

SWD mode


JTAG - Example: ARM11 debug TAP

1 The processor itself has extensive JTAG capability, similar to what is found in other CPU cores, and it is

integrated into chips with even more extensive capabilities accessed

through JTAG.



1 So this is a non-trivial example, which is representative of a

significant cross section of JTAG-enabled systems. In addition, it

shows how control mechanisms are built using JTAG's register read/write

primitives, and how those combine to facilitate testing and debugging

complex logic elements; CPUs are common, but FPGAs and Application-

specific integrated circuit|ASICs include other complex elements

which need to be debugged.



1 However, a Texas Instruments document

[http://wiki.davincidsp.com/images/9/90/Dbjtag_users_guide.pdf The User's Guide to DBGJTAG] discussing a JTAG

diagnostic tool presents this OMAP2420 scan chain example (and

others).



1 * The i.MX31 processor, which is similar, although its System JTAG boundary scan TAP,See i.MX35

(MCIMX35) Multimedia Applications Processor Reference Manual from the

Freescale web site. Chapter 44 presents its Secure JTAG Controller (SJC). which is very different from

ICEpick, and it includes a TAP for its DMA engine instead of a DSP and

imaging engine.https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html


1 Those processors are both intended for use in wireless handsets such as

cell phones, which is part of the reason they include TAP controllers which modify the JTAG scan chain:

Debugging low power operation requires accessing chips when they are largely powered off, and thus

when not all TAPs are operational. That scan chain modification is one

subject of a forthcoming IEEE 1149.7 standard.


JTAG - Halt mode debugging

1 So for example a JTAG host might HALT the core, entering Debug Mode, and then read

CPU registers using ITR and DCC. After saving processor state, it could write those

registers with whatever values it needs, then execute arbitrary algorithms on the CPU,

accessing memory and peripherals to help characterize the system state. After the debugger performs those operations, the

state may be restored and execution continued using the RESTART instruction.


JTAG - Monitor mode debugging

1 Modern software is often too complex to work well with such a single

threaded model. For example, a processor used to control a motor (perhaps one driving a saw blade)

may not be able to safely enter halt mode ... it may need to continue

handling interrupts to ensure physical safety of people and/or

machinery. Issuing a HALT instruction using JTAG might be

dangerous.


JTAG - Common extensions

1 Microprocessor vendors have often defined their own core-specific

debugging extensions. Such vendors include Infineon, MIPS with EJTAG, and more. If the vendor does not

adopt a standard (such as the ones used by ARM processors; or Nexus),

they need to define their own solution. If they support boundary

scan, they generally build debugging over JTAG.



1 OnCE includes a JTAG command which makes a TAP enter a special

mode where the IR holds OnCE debugging commandsAN1817/D,

MMC20xx M•CORE OnCE Port Communication and Control

Sequences; Freescale Semiconductor, Inc.; 2004



1 (However, trace data is too voluminous to use JTAG as more than a trace control

channel.)



1 Nexus (standard)|Nexus defines a processor debug infrastructure which is largely vendor-independent. One of its hardware interfaces is JTAG. It also defines a high speed auxiliary port interface, used for tracing and

more. Nexus is used with some newer platforms, such as the Atmel

AVR32 and Freescale MPC5500 series processors.


JTAG - Widespread uses

1 * Except for some of the very lowest end systems, essentially all

embedded systems platforms have a JTAG port to support in-circuit

debugging and firmware programming as well as for boundary

scan testing:



1 ** ARM architecture processors come with JTAG support, sometimes

supporting a two-wire SWD variant or high speed tracing of traffic on

instruction or data busses.



1 ** Modern 8-bit and 16-bit Microcontroller chips, such as Atmel AVR and TI MSP430 chips, support

JTAG programming and debugging. However, the very smallest chips

may not have enough pins to spare (and thus tend to rely on proprietary single-wire programming interfaces);

if the pin count is over 32, there is probably a JTAG option.



1 ** Almost all FPGAs and CPLDs used today can be programmed via a JTAG

port. A Standard Test and Programming Language is defined by

JEDEC standard JESD-71 for JTAG programming of PLD's.



1 ** Many MIPS architecture|MIPS

and PowerPC processors have

JTAG supporthttps://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html


1 ** Intel Core, Xeon, Atom, and Quark processors all support JTAG probe

mode with Intel specific extensions of JTAG using the so-called 60pin eXtended Debug Port [XDP].

Additionally the Quark processor supports more traditional 10pin

connectors.



1 ** Consumer products such as networking appliances and satellite

television integrated receiver/decoders often use

microprocessors which support JTAG, providing an alternate means to reload firmware if the existing

bootloader has been corrupted in some manner.



1 *The Peripheral Component Interconnect|PCI bus connector standard contains optional JTAG

signals on pins 1-5;[http://www.techfest.com/hardwa

re/bus/pci.htm#4.10 PCI Local Bus Technical Summary, 4.10

JTAG/Boundary Scan Pins] PCI-Express contains JTAG signals on pins 5-9.[http://www.interfacebus.com/Design_PCI_Express_16x_PinOut.html

PCI-Express 16x Connector Pin Out] A special JTAG card can be used to

reflash a corrupt BIOS.



1 * Boundary scan testing and in-system (device) programming

applications are sometimes programmed using the Serial Vector Format, a textual representation of

JTAG operations using a simple syntax



1 * As mentioned, many boards include JTAG connectors, or just pads, to

support manufacturing operations, where boundary scan testing helps verify board quality (identifying bad solder joints, etc.) and to initialize

flash memory or FPGAs.



1 * JTAG can also support field updates and troubleshooting.


JTAG - Client support

1 The target's JTAG interface is accessed using some JTAG-enabled application and some JTAG adapter hardware. There is a wide range of

such hardware, optimized for purposes such as production testing, debugging high speed systems, low cost microcontroller development, and so on. In the same way, the

software used to drive such hardware can be quite varied. Software developers mostly use JTAG for

debugging and updating firmware.


JTAG - Client support

1 If you want to acquire a JTAG adapter, you first need to decide what systems it must support.

Everything else follows from that, including your software options.

Low-end adapters may cost less than $US 50 and have limited hardware and software support. High-end

adapters can cost a hundred times as much, including software support,

and have corresponding improvements in capability.


JTAG - Serial Wire Debug

1 On JTAG devices with SWD capability, the TMS and TCK are used

as SWDIO and SWCLK signals, providing for dual-mode

programmers.


Boundary scan - JTAG test operations

1 There are JTAG instructions to SAMPLE the data in that boundary scan register, or PRELOAD it with

values.


For More Information, Visit:

• https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html

The Art of Servicehttps://store.theartofservice.com








JTAG .

Documents

Transcript of JTAG .