JTAG

JTAG stands for Joint Test Action Group, which is an IEEE work group defining an electrical interface for integrated circuit testing and programming.

JTAG automate

There is always a JTAG automate (JTAG logic) integrated into your SoC or CPU and usually this is connected to a JTAG header on the PCB. You can test and program the IC by issuing JTAG commands to it through the JTAG.

To do that, you need to connect the parallel port of your PC with the JTAG header on the PCB via a bought or a homemade "JTAG cable". You then run a special JTAG software on your PC, which allows you to comfortably control the JTAG automate and make it perform commands like reads and writes at arbitrary locations.

As already stated the primal intention of the JTAG automate is to test the IC itself. But of course it can additionally be utilized to recover a device if you erased the bootloader resident on the flash. Because, through the JTAG automate in the SoC, you can also write to the Flash Chip.

A JTAG port can be used without any software running on the IC itself, but the IC still has to be powered by a separate power supply. This means, you can solder a lonely SoC to a PCB, no Flash-Chip, no RAM; then connect to it via JTAG and interact with the SoC. Of course, on the PC itself, you should have some sort of software, to make this interaction with the hardware on the lowest level possible a bit more comfortable.

Of course, if there is a flash chips soldered onto the PCB, you could access this chip by programming the SoC via JTAG. It's one of those amazingly useful things that allows you to recover from pretty much anything that doesn't involve a hardware failure.

There is no one JTAG automate (← please rephrase)! Different SoCs/CPUs/ISAs have different JTAG automates behavior and reset sequence, most likely you will find ARM and MIPS CPUs, both having their standard to allow controlling the CPU behavior using JTAG. FIXME

Finding JTAG connector on a PCB can be a little easier than finding the UART since most vendors leave those headers unpopulated after production. JTAG connectors are usually 12, 14, or 20-pins headers with one side of the connector having some signals at 3.3V and the other side being connected to GND.

Identifying JTAG connector

Headers

There are two major JTAG header arrangements used in SOHO routers based on MIPS CPUs. One uses 12 pins and the other uses 14 pins. While not radically different, you should be familiar with both. Other JTAG pinouts can be found at http://www.jtagtest.com/pinouts/.

10 Pin Header

Found in many Huawei routers:

TCK 1 2 GND
TDO 3 4 VREF
TMS 5 6 nSRST
- 7 8 nTRST
TDI 9 10 GND

It matches with the ALTERA ByteBlasterMV 10-pin cable, but without the nSRST, nTRST pins.

12 Pin Header

Found in Linksys routers such as the WRT54G and WRT54GS, the 12-pin header has the following arrangement of JTAG signals and pins:

nTRST 1 2 GND
TDI 3 4 GND
TDO 5 6 GND
TMS 7 8 GND
TCK 9 10 GND
nSRST 11 12 GND

Seems, this header is a truncated version of the full EJTAG header.

14 Pin Header

This header is fully MIPS EJTAG 2.6 compatible and described in the EJTAG 2.6 standard. Found in Edimax routers (and other brands that are Edimax clones), the 14-pin header has the following arrangement of JTAG signals and pins:

nTRST 1 2 GND
TDI 3 4 GND
TDO 5 6 GND
TMS 7 8 GND
TCK 9 10 GND
nSRST 11 12 n/a
n/a 13 14 Vcc

A buffered cable such as the Wiggler requires an external Vcc voltage supply. The 14-pin header conveniently supplies this voltage on pin 14. The typical unbuffered cable, however, does not require an external voltage in order to function. Formally, the pin 14 is called VREF and used to indicate a JTAG signal levels: 5V, 3.3V or 2.5V. On the most devices this pin is tied to the device's Vcc and may be used to power a buffer IC chip (and to generate an appropriate levels as result). Note that the 12-pin JTAG header arrangement does not provide Vcc.

16 Pin Header

Usually found in IBM 4XX powerpc platform, this layout is also known as JTAG RISCWATCH

TDO o 1 2 nc -
TDI i 3 4 i nTRST
HALTED o 5 6 p VREF
TCK i 7 8 nc -
TMS i 9 10 nc -
HALT i 11 12 p GND
nSRST od 13 14 k KEY
- nc 15 16 p GND

JTAG software

Hairydairymaid

The most famous software for JTAG is probably the Linksys De-Brick Utility by Hairydairymaid (aka Lightbulb). As of 12 September 2006 the most recent version is v4.8. Virtually everyone who uses this software opts for an unbuffered cable, and the software itself, by default, expects this type of cable to be used.

The utility CAN operate on most any MIPS based cpu supporting EJTAG by using PrAcc routines (non-dma mode) - use the /nodma switch. It is not limited to WRT54G/GS units.

If you don't have a PC with parallel port but instead own a Raspberry Pi, you can use a Raspberry Pi version of this software instead which uses the onboard GPIO pins to drive the JTAG lines.

Downloads:
hairydairymaid
HairyDairyMaid_WRT54G_Debrick_Utility_v48~cshore2.zip
HairyDairyMaid_WRT54G_Debrick_Utility_v48.zip

Hairydairymaid variants:

UrJTAG

Another popular JTAG utility is Openwince JTAG. But is no longer developed. In late 2007, development of the openwince JTAG tools has been resumed in a new project named UrJTAG, with improvements like support for USB cables.

jtag> print
No. Manufacturer Part Stepping Instruction Register
---------------------------------------------------------------------------------------------
0 Lexra LX5280 1 BYPASS BR
Active bus:
*0: EJTAG compatible bus driver via PrAcc (JTAG part No. 0)
start: 0x00000000, length: 0x20000000, data width: 8 bit
start: 0x20000000, length: 0x20000000, data width: 16 bit
start: 0x40000000, length: 0x20000000, data width: 32 bit

OpenOCD

OpenOCD is more complex than Hairydairymaid or UrJTAG since it is mainly used for debugging. But it can be also used for debricking.

http://openocd.sourceforge.net/

Links

Cleanup Required!
This page or section needs cleanup. You can edit this page to fix wiki markup, redundant content or outdated information.

Back to top

doc/hardware/port.jtag.txt · Last modified: 2013/11/09 18:28 by oxplot