Difference between revisions of "JTAG"

From LinuxMIPS
Jump to: navigation, search
(EJTAG software)
 
(26 intermediate revisions by 5 users not shown)
Line 1: Line 1:
{{stub}}
+
== (E)JTAG in general ==
  
''Moved from ADM5120 page''
+
Most of modern MIPS [[SOC]]s support [[Wikipedia:JTAG|JTAG]] (IEEE 1149.1). The MIPS [http://www.mips.com/products/resource_library/product_materials/MIPS_Architecture.php EJTAG] is a proprietary extension which utilizes widely used IEEE JTAG pins for debug functions. '''E'''JTAG provides: run control, single-step execution, breakpoints on both data and instructions, real-time trace (optional) and direct memory access.
  
ADM5120 SoC supports [[Wikipedia:JTAG|JTAG]] (IEEE 1149.1) and MIPS [http://www.mips.com/content/Documentation/MIPSDocumentation/EJTAG/doclibrary EJTAG] 2.6 interfaces.
+
The EJTAG prior v2.6 was not documented, however many SOCs still use it. The v2.6 is fully documented and available on the MIPS site (''free'' registration required). The IMPCODE register contains EJTAGver field, so software should read it to distinguish EJTAG version.
  
Edimax BR-6104K, BR-6104KP and clones has 14-pin connector '''JP1''' with conventional EJTAG 2.6 layout (aka "old VisionICE").  
+
== Memory access ==
 +
 
 +
MIPS EJTAG has two modes, one is "DMA" mode where the JTAG can cause CPU bus cycles directly, the other "PrAcc" is where the JTAG interface is used to respond to CPU memory accesses in a special range of memory (DMSEG, 0xFF200000) and you have to write little bits of MIPS code to do what you want and emulate that memory on the host side. All systems support PrAcc mode by nature. The DMA mode is optional and not as widely supported as the normal mode. The presence of DMA mode is noted in the IMPCODE register.
 +
 
 +
== JTAG headers ==
 +
 
 +
EJTAG utilizes 5-pin interface defined in IEEE 1149.1 JTAG specification for off-chip communications. These signals (TDI, TDO, TMS, TCK and nTRST) forms a Test Access Port (TAP).
 +
 
 +
EJTAG specification 1.5.2 and 2.0 call for dual row male male header with 0.05"x0.05" spacing
 +
 
 +
EJTAG 2.5 and later defines a dual row 14-pin male header (mechanical connector) with 0.1"x0.1" spacing to attach a JTAG probe. 3M part number 2414-600UB is recommended.
  
 
  nTRST  1  2 GND
 
  nTRST  1  2 GND
Line 15: Line 25:
 
  DINT  13 14 VCC
 
  DINT  13 14 VCC
  
DINT pin is not used. nTRST is a "TAP Reset" signal and it's active level is "0" (the first "n"
+
'''DINT''' pin is used to raise Debug Interrupt. Many chips has no this pin.
indicates negative logic). nSRST is optional. This signal resets TAP controller independently from the CPU logic. To conform to MIPS EJTAG specifications this pin should be pulled to the ground via resistor ~1KOhm to keep TAP in reset state w/o probe attached. If probe does not control this pin, you need just to feed logical "1" to nTRST pin or pull this to the +VCC via ~300Ohm resistor.
+
  
nSRST is a "system reset" signal and acts like conventional "Reset' button. Some routers
+
'''nTRST''' is a "TAP Reset" signal and it's active level is "0" (the first "n" indicates negative logic). This signal resets TAP controller independently from the CPU logic. To conform to MIPS EJTAG specifications this pin should be pulled to the ground via resistor ~1KOhm to keep TAP in reset state w/o probe attached. If probe does not control this pin, you need just to feed logical "1" to nTRST pin or pull this to the +VCC via ~300Ohm resistor.
  
Unfortunately, [http://openwince.sourceforge.net/jtag/ openwince jtag] can't identify this processor.  
+
'''nSRST''' is a "system reset" signal and acts like conventional "Reset' button. Does not reset TAP controller. nSRST often resets a SoC peripherals (i.e. DRAM controller) too. nSRST is optional.
 +
 
 +
== (E)JTAG Cables ==
 +
There is a page at the OpenWrt Wiki that discusses [http://wiki.openwrt.org/OpenWrtDocs/Customizing/Hardware/JTAG_Cable JTAG cables].  Specifically, how one Wiggler-style buffered cable can be used for both ADM5120-based routers (e.g. Edimax) and Broadcom-based routers (e.g. Linksys). Most of the discussion centers on difficulties that can arise when using a Wiggler-style cable with the Linksys de-brick utility, but the cable information is applicable to Edimax (ADM5120) devices as well.
 +
 
 +
== EJTAG software ==
 +
 
 +
For MIPS there are a variety of commercial offerings which differ in features, quality, support offered, supported probes, supported target hardware, performance, price and more.  In general if you have are going for a commercial offering you probably want to start by checking out which one supports your target.
 +
 
 +
Macraigor [http://www.macraigor.com/ocd_cmd.htm OCD Commander] is a simple JTAG debugger with MIPS support, [http://www.macraigor.com/flash_prog.htm OCD Flash programmer] DEMO version. Requires [http://www.macraigor.com/wiggler.htm Wiggler] probe or clone.
 +
 
 +
As for [[Free Software]], the state of EJTAG software is less peachy.
 +
 
 +
* http://www.baycom.org/~tom/ejtag/
 +
* http://gdbmipsejtag.sourceforge.net/
 +
* http://www.totalembedded.com/open_source/jtag/mips32_ejtag.php
 +
* Successful debrick experience http://midge.vlad.org.ua/forum/viewtopic.php?t=121
 +
* [http://openocd.sourceforge.net/ OpenOCD] open source debugger.  Supports MIPS targets.
 +
* http://www.wehavemorefun.de/fritzbox/index.php/EJTAG
 +
 
 +
The [http://openwince.sourceforge.net/jtag/ openwince jtag] software can be used to re-flash, but that project is a shambles.  If you dig around enough through the patches and discussions there you can find enough to make it work. The [http://urjtag.wiki.sourceforge.net/ UrJTAG] project (openwince fork) integrates most of this patches.
 +
 
 +
* [http://www.ronetix.at/peedi.html PEEDI] is a hardware JTAG emulator and Flash Programmer with built-in support for GNU gdb
 +
* http://www.usbjtag.com. The new generation uses Cypress FX2 and CPLD optimized for MIPS JTAG. It runs on Win32 and have been ported to Linux too (With Mac OS support pending). It has wide range of flash support. The programming speed is lightening fast. A recent German company used it to program its Linux based router (SPI chip) and get the programming speed of 342KB/s.
 +
 
 +
==Processor-specific information==
 +
 
 +
===ADM5120===
 +
 
 +
[[Adm5120|ADM5120]] is a popular [[SOC|SoC]] based on the [[4K|4Kc]] core and [[Wikipedia:AMBA specification|AMBA]] bus. Unfortunately, [http://openwince.sourceforge.net/jtag/ openwince jtag] can't identify this processor.  
  
 
  jtag> cable ppdev /dev/parport0 WIGGLER
 
  jtag> cable ppdev /dev/parport0 WIGGLER
Line 69: Line 107:
 
CPU Reset via PrRst bit in the CONTROL EJTAG register works.
 
CPU Reset via PrRst bit in the CONTROL EJTAG register works.
  
=== (E)JTAG Cables ===
+
==External links==
There is a page at the OpenWrt Wiki that discusses [http://wiki.openwrt.org/JTAG_Cables JTAG cables].  Specifically, how one Wiggler-style buffered cable can be used for both ADM5120-based routers (e.g. Edimax) and Broadcom-based routers (e.g. Linksys).  Most of the discussion centers on difficulties that can arise when using a Wiggler-style cable with the Linksys de-brick utility, but the cable information is applicable to Edimax (ADM5120) devices as well.
+
* [http://www.idt.com/sites/default/files/documents/IDT_79xx434_MAU_20060302.pdf IDT 32434 User Manual]. Chapter 18 describes EJTAG system
 
+
* http://www.linuxbios.org/index.php/JTAG/BSDL_Guide
=== EJTAG software ===
+
* MIPS Whitepaper: [http://www.mips.com/media/files/white-papers/ejtag_debug_eetimes.pdf Non-intrusive On-chip Debug Hardware Accelerates Development for MIPS RISC Processors]
 
+
* [http://electronicdesign.com/article/embedded/mips-on-chip-debug-hardware3673 MIPS On-Chip Debug Hardware]
Macraigor [http://www.macraigor.com/ocd_cmd.htm OCD Commander] is a simple JTAG debugger with MIPS support, [http://www.macraigor.com/flash_prog.htm OCD Flash programmer] DEMO version. Requires [http://www.macraigor.com/wiggler.htm Wiggler] probe (Wiggler [http://vlad.org.ua/adm5120/media/adm5120/wiggler.gif clone]).
+
* [http://www.usbjtag.com Very fast and EJTAG based on USB technology]
 
+
* http://www.baycom.org/~tom/ejtag/  
+
* http://gdbmipsejtag.sourceforge.net/
+
* http://www.totalembedded.com/open_source/jtag/mips32_ejtag.php
+
* Discussion http://wiki.openwrt.org/zt8qmwz
+
* Successful debrick experience http://midge.vlad.org.ua/forum/viewtopic.php?t=121
+
 
+
In general, the state of EJTAG software is pretty bad.  The [http://openwince.sourceforge.net/jtag/ openwince jtag] software can be used to re-flash, but that project is a shambles.  If you dig around enough through the patches and discussions there you can find enough to make it work.
+

Latest revision as of 11:44, 14 August 2012

(E)JTAG in general

Most of modern MIPS SOCs support JTAG (IEEE 1149.1). The MIPS EJTAG is a proprietary extension which utilizes widely used IEEE JTAG pins for debug functions. EJTAG provides: run control, single-step execution, breakpoints on both data and instructions, real-time trace (optional) and direct memory access.

The EJTAG prior v2.6 was not documented, however many SOCs still use it. The v2.6 is fully documented and available on the MIPS site (free registration required). The IMPCODE register contains EJTAGver field, so software should read it to distinguish EJTAG version.

Memory access

MIPS EJTAG has two modes, one is "DMA" mode where the JTAG can cause CPU bus cycles directly, the other "PrAcc" is where the JTAG interface is used to respond to CPU memory accesses in a special range of memory (DMSEG, 0xFF200000) and you have to write little bits of MIPS code to do what you want and emulate that memory on the host side. All systems support PrAcc mode by nature. The DMA mode is optional and not as widely supported as the normal mode. The presence of DMA mode is noted in the IMPCODE register.

JTAG headers

EJTAG utilizes 5-pin interface defined in IEEE 1149.1 JTAG specification for off-chip communications. These signals (TDI, TDO, TMS, TCK and nTRST) forms a Test Access Port (TAP).

EJTAG specification 1.5.2 and 2.0 call for dual row male male header with 0.05"x0.05" spacing

EJTAG 2.5 and later defines a dual row 14-pin male header (mechanical connector) with 0.1"x0.1" spacing to attach a JTAG probe. 3M part number 2414-600UB is recommended.

nTRST  1  2 GND
TDI    3  4 GND
TDO    5  6 GND
TMS    7  8 GND
TCK    9 10 GND
nSRST 11 12 -key
DINT  13 14 VCC

DINT pin is used to raise Debug Interrupt. Many chips has no this pin.

nTRST is a "TAP Reset" signal and it's active level is "0" (the first "n" indicates negative logic). This signal resets TAP controller independently from the CPU logic. To conform to MIPS EJTAG specifications this pin should be pulled to the ground via resistor ~1KOhm to keep TAP in reset state w/o probe attached. If probe does not control this pin, you need just to feed logical "1" to nTRST pin or pull this to the +VCC via ~300Ohm resistor.

nSRST is a "system reset" signal and acts like conventional "Reset' button. Does not reset TAP controller. nSRST often resets a SoC peripherals (i.e. DRAM controller) too. nSRST is optional.

(E)JTAG Cables

There is a page at the OpenWrt Wiki that discusses JTAG cables. Specifically, how one Wiggler-style buffered cable can be used for both ADM5120-based routers (e.g. Edimax) and Broadcom-based routers (e.g. Linksys). Most of the discussion centers on difficulties that can arise when using a Wiggler-style cable with the Linksys de-brick utility, but the cable information is applicable to Edimax (ADM5120) devices as well.

EJTAG software

For MIPS there are a variety of commercial offerings which differ in features, quality, support offered, supported probes, supported target hardware, performance, price and more. In general if you have are going for a commercial offering you probably want to start by checking out which one supports your target.

Macraigor OCD Commander is a simple JTAG debugger with MIPS support, OCD Flash programmer DEMO version. Requires Wiggler probe or clone.

As for Free Software, the state of EJTAG software is less peachy.

The openwince jtag software can be used to re-flash, but that project is a shambles. If you dig around enough through the patches and discussions there you can find enough to make it work. The UrJTAG project (openwince fork) integrates most of this patches.

  • PEEDI is a hardware JTAG emulator and Flash Programmer with built-in support for GNU gdb
  • http://www.usbjtag.com. The new generation uses Cypress FX2 and CPLD optimized for MIPS JTAG. It runs on Win32 and have been ported to Linux too (With Mac OS support pending). It has wide range of flash support. The programming speed is lightening fast. A recent German company used it to program its Linux based router (SPI chip) and get the programming speed of 342KB/s.

Processor-specific information

ADM5120

ADM5120 is a popular SoC based on the 4Kc core and AMBA bus. Unfortunately, openwince jtag can't identify this processor.

jtag> cable ppdev /dev/parport0 WIGGLER
Initializing Macraigor Wiggler JTAG Cable on ppdev port /dev/parport0
jtag> detect
IR length: 5
Chain length: 1
Device Id: 00000000000000000000000000000001
  Unknown manufacturer!
chain.c(110) Part 0 without active instruction
chain.c(133) Part 0 without active instruction
chain.c(110) Part 0 without active instruction

It seems, it's a real ID for this processor, other JTAG ulilities (i.e. detect subrotine from the wrt54g-debrick) returns the same value...

IMPCODE identification works:

jtag> instruction length 5
jtag> register IMP 32
jtag> instruction IMPCODE 00011 IMP
jtag> instruction IMPCODE
jtag> shift ir
jtag> shift dr
jtag> dr
01000001010000000100000000000000

Decode:

31:29 EJTAGver 010 Version 2.6
   28 R4k/R3k    0 R4k
   24 DINTsup    1 supported
22:21 ASIDsize  10 8-bit ASID
   16 MIPS16e    0 not supported
   14 NoDMA      1 No EJTAG DMA support
    0 MIPS32/64  0 MIPS32

EJTAG CONTROL register:

jtag> instruction length 5
jtag> register ECR 32
jtag> instruction CONTROL 01010 ECR
jtag> instruction CONTROL
jtag> shift ir
jtag> shift dr
jtag> dr
10000000011000000000000000000000

CPU Reset via PrRst bit in the CONTROL EJTAG register works.

External links