JTAG详解

参考资料

JTAG硬件说明

JTAG(Joint Test Action Group，联合测试行动组)调试接口目前主要有10针，14针和20针。

必须有的信号-5个：

  • TMS：测试模式选择，TMS用来设置JTAG接口处于某种特定的测试模式，必须在目标板上将此引脚上拉；
  • TCK：测试时钟输入，建议在目标板上将此引脚上拉；
  • TDI：测试数据输入，仿真器连接至目标CPU的数据输入信号，建议在目标板上上拉到VDD；
  • TDO：测试数据输出，目标板返回给仿真器的数据信号；
  • VREF：目标表参考电压信号，用于检测目标板是否供电，直接与目标板VDD相连，并不向外提供输出电压；

可选信号：

  • RTCK:目标板提供仿真器的时钟信号，有些项目中是要求JTAG的输入与其内部时钟信号同步，仿真器利用此引脚的输入可动态的控制自己的TCK速率；
  • TRST：JTAG复位，连接到目标板CPU的nTRST引脚，用于复位CPU调试接口的TAP控制器；目标板上应该将此脚上拉到高电位，避免意外复位，可选引脚—复位JTAG；
  • RESET:仿真器输出至目标CPU的系统复位信号，可选信号-复位CPU；
  • USER IN / USER OUT ：用户自定义输入输出

JTAG原理

硬件接口

image.png

边界扫描

image.png

TAP状态机

image.png

使用JLINK调试ARM

参考资料：

J-Link是德国SEGGER公司推出基于JTAG的仿真器。简单地说，是给一个JTAG协议转换盒，即一个小型USB到JTAG的转换盒，其连接到计算机用的是USB接口，而到目标板内部用的还是jtag协议。它完成了一个从软件到硬件转换的工作。
image.png

JTAG Probe

软件工具和说明

JLINK硬件说明

淘宝链接: JLINK硬件支持SWD和JTAG两种模式，可选使用。转接板信息
image.png

JLINK工具

wiki系列

  1. 快速命令：
  2. rt  # trest
  3. device cortex-a7
  4. si jtag
  5. speed 100
  6. connect
  9. i  # read id
  13. J-Link>?
  15. Available commands are:
  16. ----------------------
  17. f          Firmware info
  18. h          halt
  19. IsHalted   Returns the current CPU state (halted / running)
  20. WaitHalt   Waits until the CPU is halted or the given timeout is exceeded.
  21.              Syntax: WaitHalt <TimeoutMs>  Default timeout is 1000 ms
  22. g          go
  23. Sleep      Waits the given time (in milliseconds). Syntax: Sleep <delay>
  24. s          Single step the target chip
  25.              Syntax: s [<NumSteps (dec)>]
  26. st         Show hardware status
  27. hwinfo     Show hardware info
  28. mem        Read memory. Syntax: mem  [<Zone>:]<Addr>, <NumBytes> (hex)
  29. mem8       Read  8-bit items. Syntax: mem8  [<Zone>:]<Addr>, <NumBytes> (hex)
  30. mem16      Read 16-bit items. Syntax: mem16 [<Zone>:]<Addr>, <NumItems> (hex)
  31. mem32      Read 32-bit items. Syntax: mem32 [<Zone>:]<Addr>, <NumItems> (hex)
  32. w1         Write  8-bit items. Syntax: w1 [<Zone>:]<Addr>, <Data> (hex)
  33. w2         Write 16-bit items. Syntax: w2 [<Zone>:]<Addr>, <Data> (hex)
  34. w4         Write 32-bit items. Syntax: w4 [<Zone>:]<Addr>, <Data> (hex)
  35. erase      Erase internal flash of selected device. Syntax: Erase
  36. wm         Write test words. Syntax: wm <NumWords>
  37. is         Identify length of scan chain select register
  38. ms         Measure length of scan chain. Syntax: ms <Scan chain>
  39. mr         Measure RTCK react time. Syntax: mr
  40. q          Quit
  41. qc         Close JLink connection and quit
  42. eoe        Exit on error
  43.              Syntax: eoe <1/0>
  44. r          Reset target         (RESET)
  45. rx         Reset target         (RESET). Syntax: rx <DelayAfterReset>
  46. RSetType   Set the current reset type. Syntax: RSetType <type>
  47. Regs       Display contents of registers
  48. wreg       Write register.   Syntax: wreg <RegName>, <Value>
  49. moe        Shows mode-of-entry, meaning: Reason why CPU is halted
  50. SetBP      Set breakpoint.   Syntax: SetBP <addr> [A/T] [S/H]
  51. SetWP      Set Watchpoint. Syntax: <Addr> [R/W] [<Data> [<D-Mask>] [A-Mask]]
  52. ClrBP      Clear breakpoint. Syntax: ClrBP  <BP_Handle>
  53. ClrWP      Clear watchpoint. Syntax: ClrWP  <WP_Handle>
  54. VCatch     Write vector catch. Syntax: VCatch <Value>
  55. loadfile   Load data file into target memory.
  56.              Syntax: loadfile <filename>, [<addr>]
  57.              Supported extensions: *.bin, *.mot, *.hex, *.srec
  58.              <addr> is needed for bin files only.
  59. loadbin    Load *.bin file into target memory.
  60.              Syntax: loadbin <filename>, <addr>
  61. savebin    Saves target memory into binary file.
  62.              Syntax: savebin <filename>, <addr>, <NumBytes>
  63. verifybin  Verfies if the specified binary is already in the target memory at the specified address.
  64.              Syntax: verifybin <filename>, <addr>
  65. SetPC      Set the PC to specified value. Syntax: SetPC <Addr>
  66. le         Change to little endian mode
  67. be         Change to big endian mode
  68. log        Enables log to file.  Syntax: log <filename>
  69. unlock     Unlocks a device. Syntax: unlock <DeviceName>
  70.            Type unlock without <DeviceName> to get a list
  71.            of supported device names.
  72.            nRESET has to be connected
  73. term       Test command to visualize printf output from the target device,
  74.            using DCC (SEGGER DCC handler running on target)
  75. ReadAP     Reads a CoreSight AP register.
  76.            Note: First read returns the data of the previous read.
  77.            An additional read of DP reg 3 is necessary to get the data.
  78. ReadDP     Reads a CoreSight DP register.
  79.            Note: For SWD data is returned immediately.
  80.            For JTAG the data of the previous read is returned.
  81.            An additional read of DP reg 3 is necessary to get the data.
  82. WriteAP    Writes a CoreSight AP register.
  83. WriteDP    Writes a CoreSight DP register.
  84. SWDSelect  Selects SWD as interface and outputs
  85.            the JTAG -> SWD switching sequence.
  86. SWDReadAP  Reads a CoreSight AP register via SWD.
  87.            Note: First read returns the data of the previous read.
  88.            An additional read of DP reg 3 is necessary to get the data.
  89. SWDReadDP  Reads a CoreSight DP register via SWD.
  90.            Note: Correct data is returned immediately.
  91. SWDWriteAP Writes a CoreSight AP register via SWD.
  92. SWDWriteDP Writes a CoreSight DP register via SWD.
  93. Device     Selects a specific device J-Link shall connect to
  94.            and performs a reconnect.
  95.            In most cases explicit selection of the device is not necessary.
  96.            Selecting a device enables the user to make use of the J-Link
  97.            flash programming functionality as well as using unlimited
  98.            breakpoints in flash memory.
  99.            For some devices explicit device selection is mandatory in order
  100.            to allow the DLL to perform special handling needed by the device.
  101. ExpDevList Exports the device names from the DLL internal
  102.            device list to a text file
  103.              Syntax: ExpDevList <Filename>
  104. ExpDevListXML Exports the device names from the DLL internal
  105.            device list to a text file in XML format
  106.              Syntax: ExpDevListXML <Filename>
  107. PowerTrace Perform power trace (not supported by all models)
  108. Syntax: PowerTrace <LogFile> [<ChannelMask> <RefCountSel>]
  109. <LogFile>: File to store power trace data to
  110. <ChannelMask>: 32-bit mask to specify what channels shall be enabled
  111. <SampleFreq>: Sampling frequency in Hz (0 == max)
  112. <RefCountSel>:       0: No reference count
  113.                      1: Number of bytes transmitted on SWO
  114. ---- CP15 ------------
  115. rce        Read CP15.  Syntax: rce <Op1>, <CRn>, <CRm>, <Op2>
  116. wce        Write CP15. Syntax: wce <Op1>, <CRn>, <CRm>, <Op2>, <Data>
  117. ---- ICE -------------
  118. Ice        Show state of the embedded ice macrocell (ICE breaker)
  119. ri         Read Ice reg.  Syntax: ri <RegIndex>(hex)
  120. wi         Write Ice reg. Syntax: wi <RegIndex>, <Data>(hex)
  121. ---- TRACE -----------
  122. TClear     TRACE - Clear buffer
  123. TSetSize   TRACE - Set Size of trace buffer
  124. TSetFormat TRACE - SetFormat
  125. TSR        TRACE - Show Regions (and analyze trace buffer)
  126. TStart     TRACE - Start
  127. TStop      TRACE - Stop
  128. ---- SWO -------------
  129. SWOSpeed   SWO - Show supported speeds
  130. SWOStart   SWO - Start
  131. SWOStop    SWO - Stop
  132. SWOStat    SWO - Display SWO status
  133. SWORead    SWO - Read and display SWO data
  134. SWOShow    SWO - Read and analyze SWO data
  135. SWOFlush   SWO - Flush data
  136. SWOView    SWO - View terminal data
  137. ---- PERIODIC --------
  138. PERConf    PERIODIC - Configure
  139. PERStart   PERIODIC - Start
  140. PERStop    PERIODIC - Stop
  141. PERStat    PERIODIC - Display status
  142. PERRead    PERIODIC - Read and display data
  143. PERShow    PERIODIC - Read and analyze data
  144. ---- File I/O --------
  145. fwrite     Write file to emulator
  146. fread      Read file from emulator
  147. fshow      Read and display file from emulator
  148. fdelete    Delete file on emulator
  149. fsize      Display size of file on emulator
  150. flist      List directory on emulator
  151. SecureArea Creates/Removes secure area on probe
  152. ---- Test ------------
  153. TestHaltGo   Run go/halt 1000 times
  154. TestStep     Run step 1000 times
  155. TestCSpeed   Measure CPU speed.
  156.              Parameters: [<RAMAddr>]
  157. TestWSpeed   Measure download speed into target memory.
  158.              Parameters:  [<Addr> [<Size>]]
  159. TestRSpeed   Measure upload speed from target memory.
  160.              Parameters: [<Addr> [<Size>] [<NumBlocks>]]
  161. TestNWSpeed  Measure network download speed.
  162.              Parameters: [<NumBytes> [<NumReps>]]
  163. TestNRSpeed  Measure network upload speed.
  164.              Parameters: [<NumBytes> [<NumReps>]]
  165. ---- JTAG ------------
  166. JTAGConf   Set number of IR/DR bits before ARM device.
  167.              Syntax: Config <IRpre>, <DRpre>
  168. speed      Set target interface speed. Syntax: speed <freq>|auto|adaptive, e.g. speed 2000, speed a
  169. i          Read JTAG Id (Host CPU)
  170. wjc        Write JTAG command (IR). Syntax: wjc <Data>(hex)
  171. wjd        Write JTAG data (DR). Syntax: wjd <Data64>(hex), <NumBits>(dec)
  172. RTAP       Reset TAP Controller using state machine (111110)
  173. wjraw      Write Raw JTAG data. Syntax: wjraw <NumBits(dec)>, <tms>, <tdi>
  174. rt         Reset TAP Controller (nTRST)
  175. ---- JTAG-Hardware ---
  176. c00        Create clock with TDI = TMS = 0
  177. c          Clock
  178. tck0       Clear TCK
  179. tck1       Set   TCK
  180. 0          Clear TDI
  181. 1          Set   TDI
  182. t0         Clear TMS
  183. t1         Set   TMS
  184. trst0      Clear TRST
  185. trst1      Set   TRST
  186. r0         Clear RESET
  187. r1         Set   RESET
  188. ---- Connection ------
  189. usb        Connect to J-Link via USB.  Syntax: usb <port>, where port is 0..3
  190. ip         Connect to J-Link ARM Pro or J-Link TCP/IP Server via TCP/IP.
  191.            Syntax: ip <ip_addr>
  192. ---- Configuration ---
  193. si         Select target interface. Syntax: si <Interface>,
  194.            where <Interface> can be any supported target interface (e.g SWD, JTAG, ICSP, FINE, ...
  195. power      Switch power supply for target. Syntax: power <State> [perm],
  196.            where State is either On or Off. Example: power on perm
  197. wconf      Write configuration byte. Syntax: wconf <offset>, <data>
  198. rconf      Read configuration bytes. Syntax: rconf
  199. license    Shows a list of all available license commands
  200. ipaddr     Show/Assign IP address and subnetmask of/to the connected J-Link.
  201. gwaddr     Show/Assign network gateway address of/to the connected J-Link.
  202. dnsaddr    Show/Assign network DNS server address of/to the connected J-Link.
  203. conf       Show configuration of the connected J-Link.
  204. calibrate  Calibrate the target current measurement.
  205. selemu     Select a emulator to communicate with,
  206.            from a list of all emulators which are connected to the host
  207.            The interfaces to search on, can be specified
  208.              Syntax: selemu [<Interface0> <Interface1> ...]
  209. ShowEmuList Shows a list of all emulators which are connected to the host.
  210.             The interfaces to search on, can be specified.
  211.              Syntax: ShowEmuList [<Interface0> <Interface1> ...]
  212. VCOM        enable/disable VCOM. Takes effect after power cycle of the J-Link
  213.              Syntax: VCOM <enable|disable>
  214. VTREF       Sets a fixed value for VTref on J-Link.
  215.               Syntax: VTREF <ValuemV>
  216. ----------------------

J-Flash有Linux和Windows版本，支持以下Flash烧写：

  • Supports most Cortex A-R-M, RX and Power PC devices/cores
  • Supports the following internal and external flash devices:
  • Internal flash of most popular microcontrollers
  • CFI-compliant NOR flash (the combinations 18x, 2x8, 1x16, 2x16 are supported)
  • Most non-CFI compliant NOR flash devices (the combinations 1x8, 2x8, 1x16, 2x16 are supported)
  • SPI NOR-flash
  • NAND flash

JLink和JFlash使用方法笔记-中文

  1. J-Link>connect
  2. Please specify device / core. <Default>: CORTEX-A9
  3. Type '?' for selection dialog
  4. Device>？
  5. Please specify target interface:
  6.   J) JTAG (Default)
  7.   S) SWD
  8.   F) FINE
  9.   I) ICSP
  10.   C) C2
  11.   T) cJTAG
  12. TIF>J
  13. Device position in JTAG chain (IRPre,DRPre) <Default>: -1,-1 => Auto-detect
  14. JTAGConf>connect
  15. ERROR while parsing value for IRPre. Using default: -1.
  16. ERROR while parsing value for DRPre. Using default: -1.
  17. Specify target interface speed [kHz]. <Default>: 4000 kHz
  18. Speed>speed 100
  19. ERROR while parsing value for speed. Using default: 4000 kHz.
  20. Device "CORTEX-A9" selected.
  23. Connecting to target via JTAG
  24. TotalIRLen = 4, IRPrint = 0x01
  25. JTAG chain detection found 1 devices:
  26.  #0 Id: 0x4BA00477, IRLen: 04, CoreSight JTAG-DP
  27. Scanning AP map to find all available APs
  28. AP[3]: Stopped AP scan as end of AP map has been reached
  29. AP[0]: AHB-AP (IDR: 0x44770001)
  30. AP[1]: APB-AP (IDR: 0x24770002)
  31. AP[2]: JTAG-AP (IDR: 0x14760010)
  32. Iterating through AP map to find APB-AP to use
  33. AP[0]: Skipped. Not an APB-AP
  34. AP[1]: APB-AP found
  35. ROMTbl[0][0]: CompAddr: 80001000 CID: B105900D, PID:04-003BB907 ETB
  36. ROMTbl[0][1]: CompAddr: 80002000 CID: B105900D, PID:04-003BB906 CTI
  37. ROMTbl[0][2]: CompAddr: 80003000 CID: B105900D, PID:04-004BB912 TPIU
  38. ROMTbl[0][3]: CompAddr: 80004000 CID: B105900D, PID:04-001BB908 CSTF
  39. ROMTbl[0][4]: CompAddr: 80005000 CID: B105900D, PID:04-002BB913 ITM
  40. ROMTbl[0][5]: CompAddr: 80006000 CID: B105900D, PID:04-002BB914 SWO
  41. ROMTbl[0][6]: CompAddr: 80008000 CID: 00000000, PID:00-00000000 ???
  42. ROMTbl[0][7]: CompAddr: 80010000 CID: B105900D, PID:04-000BBC09 Cortex-A9
  43. Found Cortex-A9 r3p0
  44. 6 code breakpoints, 4 data breakpoints
  45. Debug architecture ARMv7.0
  46. Data endian: little
  47. Main ID register: 0x413FC090
  48. I-Cache L1: 32 KB, 256 Sets, 32 Bytes/Line, 4-Way
  49. D-Cache L1: 32 KB, 256 Sets, 32 Bytes/Line, 4-Way
  50. System control register:
  51.   Instruction endian: little
  52.   Level-1 instruction cache enabled
  53.   Level-1 data cache disabled
  54.   MMU enabled
  55.   Branch prediction enabled
  56. Memory zones:
  57.   [0]: Default (Default access mode)
  58.   [1]: AHB-AP (AP0) (DMA like acc. in AP0 addr. space)
  59.   [2]: APB-AP (AP1) (DMA like acc. in AP1 addr. space)
  60. Cortex-A9 identified.
  62. J-Link>REGS
  63. CPU is not halted !
  64. J-Link>halt
  65. PC: (R15) = C3E14EE8, CPSR = 400001D3 (SVC mode, ARM FIQ dis. IRQ dis.)
  66. Current:
  67.      R0 =13820000, R1 =C3E329C4, R2 =C3E3EC78, R3 =0001000E
  68.      R4 =C3E3EA3C, R5 =C3E3EA3C, R6 =0000000C, R7 =00000022
  69.      R8 =C3CFBFF0, R9 =00000000, R10=00200000, R11=00000000, R12=FFFFFFFF
  70.      R13=43FFEF88, R14=C3E14EE8, SPSR=00000C55
  71. USR: R8 =C3CFBFF0, R9 =00000000, R10=00200000, R11=00000000, R12=FFFFFFFF
  72.      R13=00000000, R14=00000000
  73. FIQ: R8 =00000000, R9 =00000000, R10=00000000, R11=00000000, R12=00000000
  74.      R13=00000000, R14=00000000, SPSR=70081280
  75. IRQ: R13=02020700, R14=00000000, SPSR=E4024E85
  76. SVC: R13=43FFEF88, R14=C3E14EE8, SPSR=CC08C824
  77. ABT: R13=00000000, R14=00000000, SPSR=82090C28
  78. UND: R13=00000000, R14=00000000, SPSR=B80B2D51

使用Keil调试ARM

JLINK官网和下载地址, 中文推荐文档
注： 这里选择MDK-ARM
UserGuide
注：发现设备支持列表中没有CortexA9系列，放弃
https://bbs.elecfans.com/jishu_1897394_1_1.html 破解器

开源JTAG库

http://news.eeworld.com.cn/mcu/article_2016072627853.html
这个是个开源的JLINK库，以后有空了可以试试 ， 这样可能可以绕过JTAG ID

附录

1.利用vivado抓取芯片的SPI信号

  1. 安装好vivado软件后，链接上JTAG，安装驱动 “./2017.4/data/xicom/cable_drivers/lin64/install_script/install_drivers/install_drivers”
  2. 重启设备后，会发现JTAG灯变为黄灯；
  5. 选择vivado-》open Hardware Manager
  6. 左上角open target 选择Auto connect,等链接上后，JTAG灯变绿
  7. 然后选择提供的10.31.32.65:/home/firmware/x2-mengnan/2018-0704-xiaosen-cpu-bifsd里边的
  8. x2_fpga_20180704_xiaosen_cpu_bifsd.ltx文件，链接上后，会出现时序表，选择想要抓取的时序信息和触发条件(触发条件只能为1个）