Transcript Document

• JTAG
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
Joint Test Action Group - Daisy-chained JTAG (IEEE 1149.1)
The TRST pin is an optional active-low
reset to the test logic - usually
asynchronous, but sometimes
synchronous, depending on the chip. If
the pin is not available, the test logic can
be reset by switching to the reset state
synchronously, using TCK and TMS. Note
that resetting test logic doesn't
necessarily imply resetting anything else.
There are generally some processorspecific JTAG operations which can reset
all or part of the chip being debugged.
1
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
Joint Test Action Group - Daisy-chained JTAG (IEEE 1149.1)
Faster TCK frequencies are most
useful when JTAG is used to transfer
lots of data, such as when storing a
program executable into flash memory.
1
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
Joint Test Action Group - Daisy-chained JTAG (IEEE 1149.1)
1
Clocking changes on TMS steps through a
standardized JTAG state machine. The
JTAG state machine can reset, access an
instruction register, or access data
selected by the instruction register.
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
Joint Test Action Group - Daisy-chained JTAG (IEEE 1149.1)
JTAG platforms often add signals to
the handful defined by the IEEE 1149.1
specification. A System Reset (SRST)
signal is quite common, letting
debuggers reset the whole system, not
just the parts with JTAG support.
Sometimes there are event signals
used to trigger activity by the host or
by the device being monitored
through JTAG; or, perhaps, additional
control lines.
1
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
Joint Test Action Group - Daisy-chained JTAG (IEEE 1149.1)
1
Even though few consumer products
provide an explicit JTAG port
connector, the connections are often
available on the printed Circuit Board
as a remnant from development
prototype|prototyping and/or
production. When exploited, these
connections often provide the most
viable means for reverse engineering.
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
Joint Test Action Group - Reduced pin count JTAG (IEEE 1149.7)
1
Reduced pin count JTAG uses only two
wires, a clock wire and a data wire.
This is defined as part of the IEEE
1149.7 standard. The connector pins
are
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
Joint Test Action Group - Reduced pin count JTAG (IEEE 1149.7)
[
http://www.corelis.com/education/Major
-Benefits-of-IEEE-1149.7.htm] The star
topology enables some parts of the
system to be powered down, whilst
others can still be accessed over JTAG;
a daisy chain requires all JTAG
interfaces to be powered. Other twowire interfaces exist, such as Serial
Wire Debug.
1
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
Joint Test Action Group - JTAG IEEE Std 1149.1 (boundary scan) instructions
1
This allows JTAG hosts to identify the size
and, at least partially, contents of the scan
chain to which they are connected
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
Joint Test Action Group - JTAG IEEE Std 1149.1 (boundary scan) instructions
The IEEE 1149.1 (JTAG) standard
describes a number of instructions to
support boundary scan applications.
Some of these instructions are
mandatory, but TAPs used for debug
instead of boundary scan testing
sometimes provide minimal or no
support for these instructions. Those
mandatory instructions operate on the
Boundary Scan Register (BSR) defined in
the boundary scan description
language|BSDL file, and include:
1
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
Joint Test Action Group - JTAG facilities
This debug TAP exposes several
standard instructions, and a few
specifically designed for hardwareassisted debugging, where a software
tool (the debugger) uses JTAG to
communicate with a system being
debugged:
1
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
Joint Test Action Group - JTAG facilities
1
* HALT and RESTART, ARM11-specific
instructions to halt and restart the CPU.
Halting it puts the core into the Debug
Mode, where the ITR can be used to
execute instructions, including using
the DCC to transfer data between the
debug (JTAG) host and the CPU.
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
Joint Test Action Group - JTAG facilities
1
That model resembles the model used in
other ARM cores. Non-ARM systems
generally have similar capabilities,
perhaps implemented using the Nexus
(standard)|Nexus protocols on top of
JTAG, or other vendor-specific schemes.
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
Joint Test Action Group - JTAG facilities
(ARM takes the four standard JTAG
signals and adds the optional TRST, plus
the RTCK signal used for adaptive
clocking.) Also, the newer cores have
updated trace support.
1
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
Joint Test Action Group - JTAG connectors
1
Production boards may omit the headers;
or when space is tight, just provide JTAG
signal access using test points.
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
Joint Test Action Group - JTAG connectors
Some common
pinouts[http://www.jtagtest.com/pinout
s/ JTAG Pinouts] lists a few JTAG-only
header layouts that have widespread
tool support. for pin headers are:
1
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
Joint Test Action Group - JTAG connectors
1
* MIPS EJTAG (2×7 pin)
used for MIPS
Technologies|MIPS
based systems
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
Joint Test Action Group - JTAG connectors
1
* 2×5 pin Atmel AVR|AVR extends Altera JTAG
with SRST (and in some cases TRST and an
event output)
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
Joint Test Action Group - JTAG connectors
1
* MIPI Debug Architecture|MIPI10-/20-connectors
(1.27mm 050) for JTAG, cJTAG and SWD
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
Joint Test Action Group - JTAG connectors
1
The connector usually provides the boardunder-test's logic supply voltage so that
the JTAG adapters will use the appropriate
logic levels
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
Joint Test Action Group - JTAG connectors
1
A recent trend is to have development
boards integrate a USB interface to
JTAG, where a second channel is used
for a serial port
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
Joint Test Action Group - JTAG adapter hardware
1
There are both dumb adapters, where
the host decides and performs all
JTAG operations; and smart ones,
where some of that work is performed
inside the adapter, often driven by a
microcontroller
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
Joint Test Action Group - JTAG adapter hardware
1
Serial port adapters also exist, and are
similarly declining in usefulness.
They generally involve either slower
bitbanging than a parallel port, or a
microcontroller translating some
command protocol to JTAG
operations. Such serial adapters are
also not fast, but their command
protocols could generally be reused
on top of higher speed links.
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
Joint Test Action Group - JTAG adapter hardware
With all JTAG adapters, software
support is a basic concern. Many
vendors do not publish the protocols
used by their JTAG adapter hardware,
limiting their customers to the tool
chains supported by those vendors.
This is a particular issue for smart
adapters, some of which embed
significant amounts of knowledge
about how to interact with specific
1
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
Joint Test Action Group - JTAG for software development
Most development environments for
embedded software include JTAG support.
There are, broadly speaking, three
sources of such software:
1
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
Joint Test Action Group - JTAG for software development
1
The JTAG adapters themselves are not
free, although sometimes they are bundled
with development boards.
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
Joint Test Action Group - JTAG for software development
1
JTAG adapters are sometimes sold
along with support bundles.
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
Atmel AVR - JTAG
The Joint Test Action Group (JTAG)
feature provides access to on-chip
debugging functionality while the chip is
running in the target system. JTAG allows
accessing internal memory and registers,
setting breakpoints on code, and singlestepping execution to observe system
behaviour.
1
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
Atmel AVR - JTAG
1
# The JTAGICE 3 is the latest member
of the JTAGICE family (JTAGICE mkIII).
It supports JTAG, aWire, SPI, and PDI
interfaces.
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
Atmel AVR - JTAG
# The JTAGICE mkII replaces the
JTAGICE and is similarly priced. The
JTAGICE mkII interfaces to the PC via
USB, and supports both JTAG and the
newer debugWIRE interface. Numerous
third-party clones of the Atmel JTAGICE
mkII device started shipping after Atmel
released the communication protocol.
1
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
Atmel AVR - JTAG
# The AVR Dragon is a low-cost
(approximately $50) substitute for the
JTAGICE mkII for certain target parts.
The AVR Dragon provides in-system
serial programming, high-voltage
serial programming and parallel
programming, as well as JTAG or
debugWIRE emulation for parts with
32KB of program memory or less.
ATMEL changed the debugging
1
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
Atmel AVR - JTAG
1
# The JTAGICE adapter interfaces to
the PC via a standard serial port.
Although the JTAGICE adapter has
been declared End-of-life
(product)|end-of-life by Atmel, it is still
supported in AVR Studio and other
tools.
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
Atmel AVR - JTAG
JTAG can also be used to perform a
boundary scan
test,[http://atmel.com/dyn/corporate/vie
w_detail.asp?ref=FileName=JTEGICE.ht
mlSEC_NAME=product JTAGICE Press
Release, 2004.] which tests the
electrical connections between AVRs
and other boundary scan capable chips
in a system. Boundary scan is wellsuited for a production line, while the
1
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
Atmel AVR - JTAGICE mkI
The JTAG In Circuit Emulator
(JTAGICE) debugging tool supports onchip debugging (OCD) of AVRs with a
JTAG interface. The original JTAGICE
mkI uses an RS-232 interface to a PC
and can only program AVR's with a
JTAG interface. The JTAGICE mkI is no
longer in production, however it has
been replaced by the JTAGICE mkII.
1
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
Atmel AVR - JTAGICE mkII
The JTAGICE mkII debugging tool
supports on-chip debugging (OCD) of
AVRs with SPI, JTAG, PDI, and
debugWIRE interfaces. The debugWire
interface enables debugging using only
one pin (the Reset pin), allowing
debugging of applications running on low
pin-count microcontrollers.
1
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
Atmel AVR - JTAGICE mkII
1
The JTAGICE mkII connects using USB,
but there is an alternate connection via a
serial port, which requires using a
separate power supply. In addition to
JTAG, the mkII supports ISP programming
(using 6-pin or 10-pin adapters). Both the
USB and serial links use a variant of the
STK500 protocol.
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
Atmel AVR - JTAGICE3
The JTAGICE3 updates the mkII with
more advanced debugging capabilities
and faster programming. It connects via
USB and supports the JTAG, aWire, SPI,
and PDI
interfaces.[http://www.atmel.com/tools/JTA
GICE3.aspx JTAGICE3 Product Page]
The kit includes several adapters for use
with most interface pinouts.
1
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
JTAG
'Joint Test Action Group' ('JTAG') is the
common name for the Institute of
Electrical and Electronics Engineers|IEEE
1149.1 'Standard Test Access Port and
Boundary-Scan Architecture'. It was
initially devised by electronic engineers for
testing printed circuit boards using
boundary scan and is still widely used for
this application.
1
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
JTAG
Today, JTAG is also widely used for
Integrated circuit|IC debug ports. In the
embedded processor market, essentially
all modern processors implement JTAG
when they have enough pins. Embedded
systems development relies on debuggers
communicating with chips with JTAG to
perform operations like Stepping
(debugging)|single stepping and
breakpointing.
1
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
JTAG - Overview
1
JTAG was meant to provide a pins-out
view from one IC pad to another so all
these faults could be discovered.
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
JTAG - Overview
Boundary-scan is now mostly
synonymous with JTAG, but JTAG has
essential uses beyond such
manufacturing applications.
1
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
JTAG - Debugging
An in-circuit emulator (or, more
correctly, a JTAG adapter) uses JTAG
as the transport mechanism to access
on-chip debug modules inside the
target Central processing unit|CPU
1
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
JTAG - Debugging
The adoption of the JTAG standard
helped move JTAG-centric debugging
environments away from early
processor-specific designs
1
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
JTAG - Debugging
For example, custom JTAG
instructions can be provided to allow
reading registers built from arbitrary
sets of signals inside the FPGA,
providing visibility for behaviors which
are invisible to boundary scan
operations
1
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
JTAG - Storing firmware
In addition, internal monitoring
capabilities (temperature, voltage and
current) may be accessible via the
JTAG port.
1
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
JTAG - Storing firmware
1
JTAG programmers are also used to write
software and data into flash memory. This
is usually done using data bus access like
the CPU would use, and is sometimes
actually handled by a CPU, but in other
cases memory chips have JTAG interfaces
themselves. Some modern debug
architectures provide internal and external
bus master access without needing to halt
and take over a CPU. In the worst case, it
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
JTAG - Storing firmware
1
Using a serial UART port and bootloader
to upload firmware to Flash makes this
debug cycle quite slow and possibly
expensive in terms of tools; installing
firmware into Flash (or SRAM instead of
Flash) via JTAG is an intermediate
solution between these extremes.
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
JTAG - Boundary scan testing
In many ICs today, all the pins that
connect to electronic logic are linked
together in a set called the Boundary Scan
chain. By using JTAG to manipulate the
chip's external interface (inputs and
outputs to other chips) it is possible to test
for certain faults, caused mainly by
manufacturing problems. By using JTAG
to manipulate its internal interface (to onchip registers), the combinational logic can
1
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
JTAG - Boundary scan testing
When combined with built-in self-test
(Built-in self-test|BIST), the JTAG scan
chain enables a low overhead, embedded
solution to testing an IC for certain static
faults (shorts, opens, and logic errors)
1
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
JTAG - Electrical characteristics
1
In either case a test probe need only
connect to a single JTAG port to have
access to all chips on a circuit board.
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
JTAG - Daisy-chained JTAG (IEEE 1149.1)
1
Faster TCK frequencies are most useful
when JTAG is used to transfer lots of data,
such as when storing a program
executable into flash memory.
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
JTAG - Reduced pin count JTAG (IEEE 1149.7)
1
[http://www.corelis.com/education/
Major-Benefits-of-IEEE-1149.7.htm]
The star topology enables some parts
of the system to be powered down,
whilst others can still be accessed
over JTAG; a daisy chain requires all
JTAG interfaces to be powered. Other
two-wire interfaces exist, such as
Serial Wire Debug.
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
JTAG - Communications model
1
In JTAG, devices expose one or more
test access ports (TAPs). The picture
above shows three TAPs, which might
be individual chips or might be
modules inside one chip. A daisy chain
of TAPs is called a scan chain, or
(loosely) a target. Scan chains can be
arbitrarily long, but in practice twenty
TAPs is unusually long.
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
JTAG - Communications model
1
To use JTAG, a host is connected to the
target's JTAG signals (TMS, TCK, TDI,
TDO, etc.) through some kind of JTAG
adapter, which may need to handle
issues like level shifting and galvanic
isolation. The adapter connects to the
host using some interface such as
USB, PCI, Ethernet, and so forth.
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
JTAG - Primitives
1
The host communicates with the TAPs by
manipulating TMS and TDI in conjunction
with TCK, and reading results through
TDO (which is the only standard host-side
input). TMS/TDI/TCK output transitions
create the basic JTAG communication
primitive on which higher layer protocols
build:
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
JTAG - Primitives
1
This JTAG state machine is part of the JTAG spec,
and includes sixteen states
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
JTAG - Primitives
1
* Shifting ... Most parts of the JTAG state
machine support two stable states used to
transfer data. Each TAP has an instruction
register (IR) and a data register (DR). The
size of those registers varies between
TAPs, and those registers are combined
through TDI and TDO to form a large shift
register. (The size of the DR is a function
of the value in that TAP's current IR, and
possibly of the value specified by a
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
JTAG - Primitives
1
So at a basic level, using JTAG involves
reading and writing instructions and
their associated data registers; and
sometimes involves running a number
of test cycles. Behind those registers
is hardware that is not specified by
JTAG, and which has its own states
that will be affected by JTAG activities.
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
JTAG - Primitives
1
Some ARM cores use such sequences
to enter and exit a two-wire (non-JTAG)
Serial Wire Debug|SWD mode
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
JTAG - Example: ARM11 debug TAP
1
The processor itself has extensive JTAG
capability, similar to what is found in other
CPU cores, and it is integrated into chips
with even more extensive capabilities
accessed through JTAG.
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
JTAG - Example: ARM11 debug TAP
1
So this is a non-trivial example, which is
representative of a significant cross
section of JTAG-enabled systems. In
addition, it shows how control mechanisms
are built using JTAG's register read/write
primitives, and how those combine to
facilitate testing and debugging complex
logic elements; CPUs are common, but
FPGAs and Application-specific integrated
circuit|ASICs include other complex
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
JTAG - Example: ARM11 debug TAP
1
However, a Texas Instruments document
[http://wiki.davincidsp.com/images/9/90/Db
jtag_users_guide.pdf The User's Guide to
DBGJTAG] discussing a JTAG diagnostic
tool presents this OMAP2420 scan chain
example (and others).
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
JTAG - Example: ARM11 debug TAP
* The i.MX31 processor, which is
similar, although its System JTAG
boundary scan TAP,See i.MX35
(MCIMX35) Multimedia Applications
Processor Reference Manual from the
Freescale web site. Chapter 44
presents its Secure JTAG Controller
(SJC). which is very different from
ICEpick, and it includes a TAP for its
DMA engine instead of a DSP and
1
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
JTAG - Example: ARM11 debug TAP
1
Those processors are both intended for
use in wireless handsets such as cell
phones, which is part of the reason
they include TAP controllers which
modify the JTAG scan chain:
Debugging low power operation
requires accessing chips when they are
largely powered off, and thus when not
all TAPs are operational. That scan
chain modification is one subject of a
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
JTAG - Halt mode debugging
1
So for example a JTAG host might HALT
the core, entering Debug Mode, and then
read CPU registers using ITR and DCC.
After saving processor state, it could
write those registers with whatever values
it needs, then execute arbitrary algorithms
on the CPU, accessing memory and
peripherals to help characterize the
system state. After the debugger
performs those operations, the state may
be restored and execution continued
using the RESTART instruction.
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
JTAG - Monitor mode debugging
1
Modern software is often too complex
to work well with such a single
threaded model. For example, a
processor used to control a motor
(perhaps one driving a saw blade) may
not be able to safely enter halt mode ...
it may need to continue handling
interrupts to ensure physical safety of
people and/or machinery. Issuing a
HALT instruction using JTAG might be
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
JTAG - Common extensions
Microprocessor vendors have often
defined their own core-specific debugging
extensions. Such vendors include
Infineon, MIPS with EJTAG, and more. If
the vendor does not adopt a standard
(such as the ones used by ARM
processors; or Nexus), they need to define
their own solution. If they support
boundary scan, they generally build
debugging over JTAG.
1
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
JTAG - Common extensions
1
OnCE includes a JTAG command which
makes a TAP enter a special mode where
the IR holds OnCE debugging
commandsAN1817/D, MMC20xx M•CORE
OnCE Port Communication and Control
Sequences; Freescale Semiconductor,
Inc.; 2004
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
JTAG - Common extensions
1
(However, trace data is too voluminous to use JTAG
as more than a trace control channel.)
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
JTAG - Common extensions
Nexus (standard)|Nexus defines a
processor debug infrastructure which
is largely vendor-independent. One of
its hardware interfaces is JTAG. It
also defines a high speed auxiliary
port interface, used for tracing and
more. Nexus is used with some newer
platforms, such as the Atmel AVR32
and Freescale MPC5500 series
processors.
1
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
JTAG - Widespread uses
1
* Except for some of the very lowest
end systems, essentially all
embedded systems platforms have a
JTAG port to support in-circuit
debugging and firmware
programming as well as for boundary
scan testing:
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
JTAG - Widespread uses
1
** ARM architecture processors come
with JTAG support, sometimes
supporting a two-wire SWD variant or
high speed tracing of traffic on
instruction or data busses.
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
JTAG - Widespread uses
1
** Modern 8-bit and 16-bit Microcontroller
chips, such as Atmel AVR and TI MSP430
chips, support JTAG programming and
debugging. However, the very smallest
chips may not have enough pins to spare
(and thus tend to rely on proprietary
single-wire programming interfaces); if the
pin count is over 32, there is probably a
JTAG option.
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
JTAG - Widespread uses
1
** Almost all FPGAs and CPLDs used
today can be programmed via a JTAG
port. A Standard Test and
Programming Language is defined by
JEDEC standard JESD-71 for JTAG
programming of PLD's.
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
JTAG - Widespread uses
** Many MIPS
architecture|MIPS
and PowerPC
processors have
JTAG support
1
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
JTAG - Widespread uses
1
** Intel Core, Xeon, Atom, and Quark
processors all support JTAG probe
mode with Intel specific extensions of
JTAG using the so-called 60pin
eXtended Debug Port [XDP].
Additionally the Quark processor
supports more traditional 10pin
connectors.
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
JTAG - Widespread uses
1
** Consumer products such as networking
appliances and satellite television
integrated receiver/decoders often use
microprocessors which support JTAG,
providing an alternate means to reload
firmware if the existing bootloader has
been corrupted in some manner.
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
JTAG - Widespread uses
*The Peripheral Component
Interconnect|PCI bus connector standard
contains optional JTAG signals on pins 15;[http://www.techfest.com/hardware/bus/p
ci.htm#4.10 PCI Local Bus Technical
Summary, 4.10 JTAG/Boundary Scan
Pins] PCI-Express contains JTAG signals
on pins 59.[http://www.interfacebus.com/Design_PC
I_Express_16x_PinOut.html PCI-Express
1
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
JTAG - Widespread uses
1
* Boundary scan testing and in-system
(device) programming applications are
sometimes programmed using the Serial
Vector Format, a textual representation of
JTAG operations using a simple syntax
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
JTAG - Widespread uses
* As mentioned, many boards include
JTAG connectors, or just pads, to support
manufacturing operations, where
boundary scan testing helps verify board
quality (identifying bad solder joints, etc.)
and to initialize flash memory or FPGAs.
1
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
JTAG - Widespread uses
1
* JTAG can also support
field updates and
troubleshooting.
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
JTAG - Client support
The target's JTAG interface is
accessed using some JTAG-enabled
application and some JTAG adapter
hardware. There is a wide range of
such hardware, optimized for
purposes such as production testing,
debugging high speed systems, low
cost microcontroller development,
and so on. In the same way, the
software used to drive such hardware
1
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
JTAG - Client support
1
If you want to acquire a JTAG adapter,
you first need to decide what systems
it must support. Everything else
follows from that, including your
software options. Low-end adapters
may cost less than $US 50 and have
limited hardware and software
support. High-end adapters can cost a
hundred times as much, including
software support, and have
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
JTAG - Serial Wire Debug
1
On JTAG devices with SWD capability,
the TMS and TCK are used as SWDIO
and SWCLK signals, providing for dualmode programmers.
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
Boundary scan - JTAG test operations
1
There are JTAG instructions to SAMPLE
the data in that boundary scan register, or
PRELOAD it with values.
https://store.theartofservice.com/itil-2011-foundation-complete-certification-kit-fourth-edition-study-guide-ebook-and-online-course.html
For More Information, Visit:
• https://store.theartofservice.co
m/itil-2011-foundationcomplete-certification-kitfourth-edition-study-guideebook-and-online-course.html
The Art of Service
https://store.theartofservice.com