Beruflich Dokumente
Kultur Dokumente
Joint Test Action Group (JTAG) is the common name for the IEEE 1149.1 Standard Test Access Port and Boundary-Scan Architecture. It was initially devised by electronic engineers for testing printed circuit boards using boundary scan and is still widely used for this application. Today JTAG is also widely used for IC debug ports. In the embedded processor market, essentially all modern processors implement JTAG when they have enough pins. Embedded systems development relies on debuggers communicating with chips with JTAG to perform operations like single stepping and breakpointing.
Overview
JTAG was an industry group formed in 1985 to develop a method to test populated circuit boards after manufacture. At the time, multi-layer boards and non-lead-frame ICs were becoming standard and connections were being made between ICs which were not available to probes. The majority of manufacturing and field faults in circuit boards were due to solder joints on the boards, imperfections in board connections, or the bonds and bond wires from IC pads to pin lead frames. JTAG was meant to provide a pins-out view from one IC pad to another so all these faults could be discovered. The industry standard finally became an IEEE standard in 1990 as IEEE Std. 1149.11990 after many years of initial use. That same year Intel released the first processor with JTAG the80486 which led to quicker industry adoption by all manufacturers. In 1994, a supplement that contains a description of the boundary scan description language (BSDL) was added. Further refinements regarding the use of all-zeros for EXTEST, separating the use of SAMPLE from PRELOAD and better implementation for OBSERVE_ONLY cells were made and released in 2001. Since 1990, this standard has been adopted by electronics companies all over the world. Boundary-scan is now mostly synonymous with JTAG, but JTAG has essential uses beyond such manufacturing applications.
Debugging
Although JTAG's early applications targeted board level testing, the JTAG standard was designed to assist with device, board, and system testing, diagnosis, and fault isolation. Today JTAG is used as the primary means of accessing sub-blocks of integrated circuits, making it an essential mechanism for debugging embedded systems which may not have any other debugcapable communications channel. On most systems, JTAG-based debugging is available from the very first instruction after CPU reset, letting it assist with development of early boot software which runs before anything is set up. An in-circuit emulator (or, more correctly, a "JTAG adapter") uses JTAG as the transport mechanism to access on-chip debug modules inside the target CPU. Those modules let software developers debug the software of an embedded
1
system directly at the machine instruction level when needed, or (more typically) in terms of high level language source code. System Software Debug support is, for many software developers, the main reason to be interested in JTAG. Many silicon architectures such as PowerPC, MIPS, ARM, x86 built an entire software debug, instruction tracing, and data tracing infrastructure around their basic JTAG protocol. Frequently individual silicon vendors will however only implement parts of these extensions. Some examples are ARM CoreSight and Nexus as well as Intel's BTS (Branch Trace Storage), LBR (Last Branch Record), and IPT (Intel Processor Trace) implementations. There are many other such silicon vendor-specific extensions that may not be documented except under NDA). The adoption of the JTAG standard helped move JTAG-centric debugging environments away from early processor-specific designs. Processors can normally be halted, single stepped, or let run freely. One can set code breakpoints, both for code in RAM (often using a special machine instruction) and in ROM/flash. Data breakpoints are often available, as is bulk data download to RAM. Most designs have halt mode debugging, but some allow debuggers to access registers and data buses without needing to halt the core being debugged. Some toolchains can use ARM Embedded Trace Macrocell (ETM) modules, or equivalent implementations in other architectures to trigger debugger (or tracing) activity on complex hardware events, like a logic analyser programmed to ignore the first seven accesses to a register from one particular subroutine. Sometimes FPGA developers also use JTAG to develop debugging tools.[3] The same JTAG techniques used to debug software running inside a CPU can help debug other digital design blocks inside an FPGA. For example, custom JTAG instructions can be provided to allow reading registers built from arbitrary sets of signals inside the FPGA, providing visibility for behaviors which are invisible to boundary scan operations. Similarly, writing such registers could provide controllability which is not otherwise available.
Storing firmware
JTAG allows device programmer hardware to transfer data into internal non-volatile device memory (e.g. CPLDs). Some device programmers serve a double purpose for programming as well as debugging the device. In the case of FPGAs, volatile memory devices can also be programmed via the JTAG port, normally during development work. In addition, internal monitoring capabilities (temperature, voltage and current) may be accessible via the JTAG port. JTAG programmers are also used to write software and data into flash memory. This is usually done using data bus access like the CPU would use, and is sometimes actually handled by a CPU, but in other cases memory chips have JTAG interfaces themselves. Some modern debug architectures provide internal and external bus master access without needing to halt and take over a CPU. In the worst case, it is usually possible to drive external bus signals using the boundary scan facility. As a practical matter, when developing an embedded system, emulating the instruction store is the fastest way to implement the "debug cycle" (edit, compile, download, test, and debug). This is because the in-circuit emulator simulating an instruction store can be updated very quickly from the development host via, say, USB. Using a serial UART port and bootloader to upload firmware to Flash makes this debug cycle quite slow and possibly expensive in terms
2
of tools; installing firmware into Flash (or SRAM instead of Flash) via JTAG is an intermediate solution between these extremes.
Electrical characteristics
A JTAG interface is a special four-pin (or optionally five-pin) interface added to a chip, designed so that multiple chips on a board can have their JTAG lines daisy-chained together if specific conditions be met, and a test probe need only connect to a single "JTAG port" to have access to all chips on a circuit board. The connector pins are 1. 2. 3. 4. 5. TDI (Test Data In) TDO (Test Data Out) TCK (Test Clock) TMS (Test Mode Select) TRST (Test Reset) optional.
The
TRST pin is
3
an optional active-low reset to the test logic - usually asynchronous, but sometimes synchronous, depending on the chip. If the pin is not available, the test logic can be reset by switching to the reset state synchronously, using TCK and TMS. Note that resetting test logic doesn't necessarily imply resetting anything else. There are generally some processor-specific JTAG operations which can reset all or part of the chip being debugged. Since only one data line is available, the protocol is serial. The clock input is at the TCK pin. One bit of data is transferred in from TDI, and out to TDO per TCK rising clock edge. Different instructions can be loaded. Instructions for typical ICs might read the chip ID, sample input pins, drive (or float) output pins, manipulate chip functions, or bypass (pipe TDI to TDO to logically shorten chains of multiple chips). As with any clocked signal, data presented to TDI must be valid for some chipspecific Setup time before and Hold time after the relevant (here, rising) clock edge. TDO data is valid for some chip-specific time after the falling edge of TCK. The maximum operating frequency of TCK varies depending on all chips in the chain (the lowest speed must be used), but it is typically 10-100 MHz (100-10 ns per bit). Also TCK frequencies depend on board layout and JTAG adapter capabilities and state. One chip might have a 40 MHz JTAG clock, but only if it's using a 200 MHz clock for non-JTAG operations; and it might need to use a much slower clock when it's in a low power mode. Accordingly, some JTAG adapters have adaptive clocking using an RTCK (Return TCK) signal. Faster TCK frequencies are most useful when JTAG is used to transfer lots of data, such as when storing a program executable into flash memory. Clocking changes on TMS steps through a standardized JTAG state machine. The JTAG state machine can reset, access an instruction register, or access data selected by the instruction register. JTAG platforms often add signals to the handful defined by the IEEE 1149.1 specification. A System Reset (SRST) signal is quite common, letting debuggers reset the whole system, not just the parts with JTAG support. Sometimes there are event signals used to trigger activity by the host or by the device being monitored through JTAG; or, perhaps, additional control lines. Even though few consumer products provide an explicit JTAG port connector, the connections are often available on the printed circuit board as a remnant from development prototyping and/or production. When exploited, these connections often provide the most viable means for reverse engineering.
Communications model
In JTAG, devices expose one or more test access ports (TAPs). The picture above shows three TAPs, which might be individual chips or might be modules inside one chip. A daisy chain of TAPs is called a scan chain, or (loosely) a target. Scan chains can be arbitrarily long, but in practice twenty TAPs is unusually long.. To use JTAG, a host is connected to the target's JTAG signals (TMS, TCK, TDI, TDO, etc.) through some kind of JTAG adapter, which may need to handle issues like level shifting
4
and galvanic isolation. The adapter connects to the host using some interface such as USB, PCI, Ethernet, and so forth.
Primitives
The host communicates with the TAPs by manipulating TMS and TDI in conjunction with TCK, then reading results through TDO (which is the only standard host-side input). TMS/TDI/TCK output transitions create the basic JTAG communication primitive on which higher layer protocols build: State switching ... All TAPs are in the same state, and that state changes on TCK transitions. This JTAG state machine is part of the JTAG spec, and includes sixteen states. There are six stable states where keeping TMS stable prevents the state from changing. In all other states, TCK always changes that state. In addition, asserting TRST forces entry to one of those stable states (Test_Logic_Reset), in a slightly quicker way than the alternative of holding TMS high and cycling TCK five times.
Shifting ... Most parts of the JTAG state machine support two stable states used to transfer data. Each TAP has an instruction register (IR) and a data register (DR). The size of those registers varies between TAPs, and those registers are combined through TDI and TDO to form a large shift register. (The size of the DR is a function of the value in that TAP's current IR, and possibly of the value specified by a SCAN_N instruction.) There are three operations defined on that shift register: Capturing a temporary value Entry to the Shift_IR stable state goes via the Capture_IR state, loading the shift register with a partially fixed value (not the current instruction) Entry to the Shift_DR stable state goes via the Capture_DR state, loading the value of the Data Register specified by the TAP's current IR. Shifting that value bit-by-bit, in either the Shift_IR or Shift_DR stable state; TCK transitions will shift the shift register one bit, from TDI towards TDO, exactly like a SPI mode 1 data transfer through a daisy chain of devices (with TMS=0 acting like the chip select signal, TDI as MOSI, etc.). Updating IR or DR from the temporary value shifted in, on transition through the Update_IR or Update_DR state. Note that it is not possible to read (capture) a register without writing (updating) it, and vice versa. A common idiom adds flag bits to say whether the update should have side effects, or whether the hardware is ready to execute such side effects. Running ... One stable state is called Run_Test/Idle. The distinction is TAPspecific. Clocking TCK in the Idle state has no particular side effects, but clocking it in the Run_Test state may change system state. For example, some ARM9 cores support a debugging mode where TCK cycles in the Run_Test state drive the instruction pipeline.
So at a basic level, using JTAG involves reading and writing instructions and their associated data registers; and sometimes involves running a number of test cycles. Behind those registers is hardware that is not specified by JTAG, and which has its own states that will be affected by JTAG activities.
5
Most JTAG hosts use the shortest path between two states, perhaps constrained by quirks of the adapter. (For example, one adapter[ only handles paths whose lengths are multiples of seven bits.) Some layers built on top of JTAG monitor the state transitions, and use uncommon paths to trigger higher level operations. Some ARM cores use such sequences to enter and exit a two-wire (non-JTAG) SWD mode. A Zero Bit Scan (ZBS) sequence is used in IEEE 1149.7 to access advanced functionality such as switching TAPs into and out of scan chains, power management, and a different two-wire mode.
On exit from the RESET state, the instruction register is preloaded with either BYPASS or IDCODE. This allows JTAG hosts to identify the size and, at least partially, contents of the scan chain to which they are connected. (They can enter the RESET state then scan the Data Register until they read back the data they wrote. A BYPASS register has only a zero bit; while an IDCODE register is 32-bits and starts with a one. So the bits not written by the host can easily be mapped to TAPs.) Such identification is often used to sanity check manual configuration, since IDCODE is often unspecific. It could for example identify an ARM Cortex-M3 based microcontroller, without specifying the microcontroller vendor or model; or a particular FPGA, but not how it has been programmed. A common idiom involves shifting BYPASS into the instruction registers of all TAPs except one, which receives some other instruction. That way all TAPs except one expose a single bit data register, and values can be selectively shifted into or out of that one TAP's data register without affecting any other TAP. The IEEE 1149.1 (JTAG) standard describes a number of instructions to support boundary scan applications. Some of these instructions are "mandatory", but TAPs used for debug instead of boundary scan testing sometimes provide minimal or no support for these instructions. Those "mandatory" instructions operate on the Boundary Scan Register (BSR) defined in the BSDL file, and include:
EXTEST for external testing, such as using pins to probe board-level behaviors PRELOAD loading pin output values before EXTEST (sometimes combined with
6
SAMPLE)
Devices may define more instructions, and those definitions should be part of a BSDL file provided by the manufacturer. They will often just be marked as PRIVATE.
complex logic elements; CPUs are common, but FPGAs and ASICs include other complex elements which need to be debugged. Licensees of this core integrate it into chips, usually combining it with other TAPs as well as numerous peripherals and memory. (Peripherals and memory comprise the bulk of SoC designs; ARM cores don't take up much chip area.) One of those other TAPs will handle boundary scan testing for the whole chip; it is not supported by the debug TAP. Examples of such chips include: The OMAP2420, which includes a boundary scan TAP, the ARM1136 Debug TAP, an ETB11 trace buffer tap, a C55x DSP, and a tap for an ARM7TDMI-based imaging engine, with the boundary scan TAP ("ICEpick-B") having the ability to splice TAPs into and out of the JTAG scan chain. The i.MX31 processor, which is similar, although its "System JTAG" boundary scan TAP, which is very different from ICEpick, and it includes a TAP for its DMA engine instead of a DSP and imaging engine. Those processors are both intended for use in wireless handsets such as cell phones, which is part of the reason they include TAP controllers which modify the JTAG scan chain: Debugging low power operation requires accessing chips when they are largely powered off, and thus when not all TAPs are operational. That scan chain modification is one subject of a forthcoming IEEE 1149.7 standard.
JTAG facilities
This debug TAP exposes several standard instructions, and a few specifically designed for hardware-assisted debugging, where a software tool (the "debugger") uses JTAG to communicate with a system being debugged: BYPASS and IDCODE, standard instructions as described above EXTEST, INTEST, standard instructions, but operating on the core instead of an external boundary scan chain. EXTEST is nominally for writing data to the core, INTEST is nominally for reading it; but two scan chains are exceptions to that rule. SCAN_N ARM instruction to select the numbered scan chain used with EXTEST or INTEST. There are six scan chains: 0 - Device ID Register, 40 bits of read-only identification data 1 - Debug Status and Control Register (DSCR), 32 bits used to operate the debug facilities 4 - Instruction Transfer Register (ITR), 33 bits (32 instruction plus one status bit) used to execute processor instructions while in a special "Debug Mode" (see below) 5 - Debug Communications Channel (DCC), 34 bits (one long data word plus two status bits) used for bidirectional data transfer to the core. This is used both in debug mode, and possibly at runtime when talking to debugger-aware software. 6 - Embedded Trace Module (ETM), 40 bits (7 bit address, one 32-bit long data word, and a R/W bit) used to control the operation of a passive instruction and data trace mechanism. This feeds either an on-chip Embedded Trace Buffer (ETB), or an external high speed trace data collection pod. Tracing supports passive debugging (examining execution history) and profiling for performance tuning. 8
7 - debug module, 40 bits (7 bit address, one 32-bit long data word, and a R/W bit) used to access hardware breakpoints, watchpoints, and more. These can be written while the processor is running; it does not need to be in Debug Mode. HALT and RESTART, ARM11-specific instructions to halt and restart the CPU. Halting it puts the core into the "Debug Mode", where the ITR can be used to execute instructions, including using the DCC to transfer data between the debug (JTAG) host and the CPU. ITRSEL, ARM11-specific instruction to accelerate some operations with ITR.
That model resembles the model used in other ARM cores. Non-ARM systems generally have similar capabilities, perhaps implemented using the Nexus protocols on top of JTAG, or other vendorspecific schemes. Older ARM7 and ARM9 cores include an EmbeddedICE module which combines most of those facilities, but has an awkward mechanism for instruction execution: the debugger must drive the CPU instruction pipeline, clock by clock, and directly access the data buses to read and write data to the CPU. The ARM11 uses the same model for trace support (ETM, ETB) as those older cores. Newer ARM cores within the Sitara Family, such as the Cortex-A8, closely resemble this debug model, but build on a Debug Access Port (DAP) instead of direct CPU access. They are also decoupled from JTAG so they can be hosted over ARM's two-wire "SWD" interface instead of just the six-wire JTAG interface. (ARM takes the four standard JTAG signals and adds the optional TRST, plus the RTCK signal used for adaptive clocking.) Also, the newer cores have updated trace support.
able to safely enter halt mode ... it may need to continue handling interrupts to ensure physical safety of people and/or machinery. Issuing a HALT instruction using JTAG might be dangerous. ARM processors support an alternative debug mode, called Monitor Mode, to work with such situations. (This is distinct from the Secure Monitor Mode implemented as part of security extensions on newer ARM cores; it manages debug operations, not security transitions.) In those cases, breakpoints and watchpoints trigger a special kind of hardware exception, transferring control to a "debug monitor" running as part of the system software. This monitor will communicate with the debugger using the DCC, and could arrange for example to single step only a single process while other processes (and interrupt handlers) continue running.
Common extensions
Microprocessor vendors have often defined their own core-specific debugging extensions. Such vendors include Infineon, MIPS with EJTAG, and more. If the vendor does not adopt a standard (such as the ones used by ARM processors; or Nexus), they need to define their own solution. If they support boundary scan, they generally build debugging over JTAG. Freescale has COP and OnCE (On-Chip Emulation). OnCE includes a JTAG command which makes a TAP enter a special mode where the IR holds OnCE debugging commands for operations such as single stepping, breakpointing, and accessing registers or memory. It also defines EOnCE (Enhanced On-Chip Emulation) presented as addressing real time concerns. ARM has an extensive processor core debug architecture (CoreSight) that started with EmbeddedICE (a debug facility available on most ARM cores), and now includes many additional components such as an ETM (Embedded Trace Macrocell), with a high speed trace port, supporting multi-core and multithread tracing. Note that tracing is non-invasive; systems do not need to stop operating to be traced. (However, trace data is too voluminous to use JTAG as more than a trace control channel.) Nexus defines a processor debug infrastructure which is largely vendor-independent. One of its hardware interfaces is JTAG. It also defines a high speed auxiliary port interface, used for tracing and more. Nexus is used with some newer platforms, such as the Atmel AVR32 and Freescale MPC5500 series processors.
Widespread uses
Except for some of the very lowest end systems, essentially all embedded systems platforms have a JTAG port to support in-circuit debugging and firmware programming as well as for boundary scan testing: ARM architecture processors come with JTAG support, sometimes supporting a two-wire "SWD" variant or high speed tracing of traffic on instruction or data busses. Modern 8-bit and 16-bit Microcontroller chips, such as Atmel AVR and TI MSP430 chips, support JTAG programming and debugging. However, the very smallest chips may not have enough pins to spare (and thus tend to rely on proprietary single-wire programming interfaces); if the pin count is over 32, there is probably a JTAG option.
10
Almost all FPGAs and CPLDs used today can be programmed via a JTAG port. A Standard Test and Programming Language is defined by JEDEC standard JESD71 for JTAG programming of PLD's. Many MIPS and PowerPC processors have JTAG support Intel Core, Xeon, Atom, and Quark processors all support JTAG probe mode with Intel specific extensions of JTAG using the so-called 60pin eXtended Debug Port [XDP]. Additionally the Quark processor supports more traditional 10pin connectors. Consumer products such as networking appliances and satellite television integrated receiver/decoders often use microprocessors which support JTAG, providing an alternate means to reload firmware if the existing bootloader has been corrupted in some manner. The PCI bus connector standard contains optional JTAG signals on pins 1-5; PCIExpress contains JTAG signals on pins 5-9. A special JTAG card can be used to reflash a corruptBIOS. Boundary scan testing and in-system (device) programming applications are sometimes programmed using the Serial Vector Format, a textual representation of JTAG operations using a simple syntax. Other programming formats include 'JAM' and STAPL plus more recently the IEEE Std. 1532 defined format 'ISC' (short for In-System Configuration). ISC format is used in conjunction with enhanced BSDL models for programmable logic devices (i.e. FPGAs and CPLDs) that include addition ISC_<operation> instructions in addition to the basic bare minimum IEEE 1149.1 instructions. FPGA programming tools from Xilinx, Altera, Lattice, Cypress, Actel etc.. and will typically be able to export such files. As mentioned, many boards include JTAG connectors, or just pads, to support manufacturing operations, where boundary scan testing helps verify board quality (identifying bad solder joints, etc.) and to initialize flash memory or FPGAs. JTAG can also support field updates and troubleshooting.
Client support
The target's JTAG interface is accessed using some JTAG-enabled application and some JTAG adapter hardware. There is a wide range of such hardware, optimized for purposes such as production testing, debugging high speed systems, low cost microcontroller development, and so on. In the same way, the software used to drive such hardware can be quite varied. Software developers mostly use JTAG for debugging and updating firmware. If you want to acquire a JTAG adapter, you first need to decide what systems it must support. Everything else follows from that, including your software options. Low-end adapters may cost less than $US 50 and have limited hardware and software support. High-end adapters can cost a hundred times as much, including software support, and have corresponding improvements in capability.
11
JTAG connectors
A Netgear DG632 ADSL modem with an 8 pin JTAG header at location "5". There are no official standards for JTAG adapter physical connectors. Development boards usually include a header to support preferred development tools; in some cases they include multiple such headers, because they need to support multiple such tools. For example, a microcontroller, FPGA, and ARM application processor will rarely share tools, so a development board using all of those components might have three or more headers. Production boards may omit the headers; or when space is tight, just provide JTAG signal access using test points. Some common pinouts for 2.54 mm (0.100 in) pin headers are:
ARM 210 pin (or sometimes the older 27), used by almost all ARM based
systems MIPS EJTAG (27 pin) used for MIPS based systems 25 pin Altera ByteBlaster-compatible JTAG extended by many vendors 25 pin AVR extends Altera JTAG with SRST (and in some cases TRST and an event output) 27 pin Texas Instruments used with DSPs and ARM-based products such as OMAP 8 pin (single row) generic PLD JTAG compatible with many Lattice ispDOWNLOAD cables MIPI10-/20-connectors (1.27 mm 050") for JTAG, cJTAG and SWD
12
Those connectors tend to include more than just the four standardized signals (TMS, TCK, TDI, TDO). Usually reset signals are provided, one or both of TRST (TAP reset) and SRST (system reset). The connector usually provides the board-under-test's logic supply voltage so that the JTAG adapters will use the appropriate logic levels. The board voltage may also serve as a "board present" debugger input. Other event input or output signals may be provided, or general purpose I/O (GPIO) lines, to support more complex debugging architectures. Higher end products frequently use dense connectors (frequently 38pin MICTOR connectors) to support high-speed tracing in conjunction with JTAG operations. A recent trend is to have development boards integrate a USB interface to JTAG, where a second channel is used for a serial port. (Smaller boards can also be powered through USB. Since modern PCs tend to omit serial ports, such integrated debug links can significantly reduce clutter for developers.) Production boards often rely on bed-of-nails connections to test points for testing and programming.
13
All such software tends to include basic debugger support: stopping, halting, single stepping, breakpoints, data structure browsing, and so on. Commercial tools tend to provide tools like very accurate simulators and trace analysis, which are not currently available as open source.
14