How to do JTAG

Post Reply
Go4IT
Pro
Posts: 732
Joined: 08 Feb 2019, 12:25

How to do JTAG

Post by Go4IT »

In the base, JTAG is a serial "protocol". Multiple targets can be connected to a "scanchain" by connecting the serial out (TDO) to the serial in (TDI) of the next device. The start and end of the chain is made up by an tester device which is controlled by a PC. Each member has a shift register size which mades up his need, there is no predefined length for it, but at least 1 bit. By using a shared clock signal (TCK) for all devices, all do a shift operation on the rising edge of this signal. The bit on the TDI is sampled into the internal register and the last bit of this register is set on TDO. The clock has not to be synchronous with the members internal clock but could not exceed the maximum frequency of the device. So the slowest member of the chain gives the overall TCK.

The easiest way to play with JTAG devices is to use an Arduino, combined with an levelshifter (if not on the same voltage). Place a bit on the TDI of a device and clock it into using TCK. Then watch what you get from TDO. At reset, the JTAG standard requires the device to place it's JTAG-ID into the shift register, which is the instruction register (IR) and connect this register to TDI and TDO. So what you "clock out" (regardless of if you clock in anything) is the ID of the device, or if there are more in a chain, the IDs of all devices. You only need to know how many Bits the internal register uses. If not, there are some methods to estimate the size of the register. One is to clock in many zeros (e.g hundret or more), just to be shure the register is flooded. Then clock ones until you see the first one on the TDO. The number of clocks it uses is the length of the IR. Simple, eh? ;-) If you have only one device (either logically or physically), this is a convinient way to find out. If there are multiple devices in the chain, you must guess how long each one is.

The JTAG port of the device (called TAP, Test-Access-Port) provide two other signals, TMS and /TRST. With /TRST you can reset the TAP to it's initial state. This does not influence the Chip the JTAG-TAP is used, to do anything, it's only for the JTAG part. On TMS you can change the state of the internal statemachine (SM), which controls what the JTAG controller do next. For now, we just keep this signal high (1).

JTAG only enforces a few commands (instructions) to be known by every JTAG-enabled device. Over this, there could exist many many vendor specific commands. We will discuss this later.

First, build a small hardware you could controll from your PC interactively to play around with a JTAG device, e.g the OMAP-processor on the Radio mainboard or the Cyclone FPGA on the graphicsboard. But any other will do also. You just need to know which voltage level it uses (to not kill it) and where to connect which pin to. You can do this with your Segger J-Link commander software also, if you are not willing to create an own tool. It provides low-level commands to control the signals directly. But with a selfmade solution it's still more fun! ;-)

Then try to clock and look what you get out. Convert this to a hex number and do a lookup in the JTAG-ID database: http://bsdl.info/
Don't worry if you do not find your device here. There are many devices not registered anywhere (vendor specific).
Gwe89
Active member
Posts: 240
Joined: 09 Feb 2019, 21:21

Re: How to do JTAG

Post by Gwe89 »

Has anyone attempted to write the flash to the convers with JTAG
DGAlexandru
Pro
Posts: 295
Joined: 04 Aug 2019, 22:47

Re: How to do JTAG

Post by DGAlexandru »

Yes and it's lightning fast.
But only Main Flash.
For External Flash you need to send commands to init External Flash. Support for it is HW so there is no need to code..
Also I remember that I was able to read some of Ext. Flash by JTAG, with MAC in running mode, but never able to write this way.
Gwe89
Active member
Posts: 240
Joined: 09 Feb 2019, 21:21

Re: How to do JTAG

Post by Gwe89 »

Intresting it would be something I'd like to look at but unsure what to get
User avatar
Stevebe
Pro
Posts: 256
Joined: 08 Feb 2019, 12:28

Re: How to do JTAG

Post by Stevebe »

There are a bunch of good tools to aid with jtag, easyjtag plus is mainly for phone use but has great features for finding jtag pins readind NAND and EMMC
ANOTHER GREAT UNIT is the jtagulator
Just connect the jtag pins or what you think are the pin and the unit will scan and tell you what they are also looks for uart .
Most of the better jtag readers will also scan TAP. And boundary and read more than one device ..
A few good links
https://embeddedbits.org/2020-02-20-ext ... sing-jtag/
http://www.grandideastudio.com/wp-conte ... slides.pdf
Digimod
Go4IT
Pro
Posts: 732
Joined: 08 Feb 2019, 12:25

Re: How to do JTAG

Post by Go4IT »

I also looked at Jtagulator the other day, looks really great. Besides, the autodetection is all made by software in the end. Identifying the JTAG pins is usally not that hard, but getting into the chip(s) needs a lot of knowledge and of course the right downloadcode.
User avatar
Stevebe
Pro
Posts: 256
Joined: 08 Feb 2019, 12:28

Re: How to do JTAG

Post by Stevebe »

Go4IT wrote: 30 Jan 2021, 07:37 I also looked at Jtagulator the other day, looks really great. Besides, the autodetection is all made by software in the end. Identifying the JTAG pins is usally not that hard, but getting into the chip(s) needs a lot of knowledge and of course the right downloadcode.
Its great for finding jtag on. BGA like the BM86R03 on the ipc 5,

A621B04E-CFCD-494F-A120-698F0A4F52CE.jpeg
Also autokeys reader is great for SPC
CAF874A5-0D9B-4EAB-822C-69356012E0B9.jpeg
2C65BF30-283A-481F-9F95-0C6C028D1496.jpeg
You do not have the required permissions to view the files attached to this post.
Digimod
Post Reply