JTAGulator: Assisted discovery of on-chip ... - Grand Idea Studio

More documents

Recommendations

Info

JTAG: TAP Controller*** State transitions occur onrising edge <strong>of</strong> TCK based oncurrent state and value <strong>of</strong> TMS*** TAP provides 4 majoroperations: Reset, Run-Test,Scan DR, Scan IR*** Can move to Reset statefrom any other state w/ TMShigh for 5x TCK*** 3 primary steps in Scan:Capture, Shift, Update*** Data held in "shadow"latch until Update state
JTAG: Instructions┌───────────┬─────────────┬──────────┬───────────────────────────────────────────────────────────────────────┐│ Name │ Required? │ Opcode │ Description │├───────────┼─────────────┼──────────┼───────────────────────────────────────────────────────────────────────┤│ BYPASS │ Y │ All 1s │ Bypass on-chip system logic. Allows serial data to be transferred ││ │ │ │ from TDI to TDO without affecting operation <strong>of</strong> the IC. │├───────────┼─────────────┼──────────┼───────────────────────────────────────────────────────────────────────┤│ SAMPRE │ Y │ Varies │ Used for controlling (preload) or observing (sample) the signals at ││ │ │ │ device pins. Enables the boundary scan register. │├───────────┼─────────────┼──────────┼───────────────────────────────────────────────────────────────────────┤│ EXTEST │ Y │ All 0s │ Places the IC in external boundary test mode. Used to test device ││ │ │ │ interconnections. Enables the boundary scan register. │├───────────┼─────────────┼──────────┼───────────────────────────────────────────────────────────────────────┤│ INTEST │ N │ Varies │ Used for static testing <strong>of</strong> internal device logic in a single-step ││ │ │ │ mode. Enables the boundary scan register. │├───────────┼─────────────┼──────────┼───────────────────────────────────────────────────────────────────────┤│ RUNBIST │ N │ Varies │ Places the IC in a self-test mode and selects a user-specified data ││ │ │ │ register to be enabled. │├───────────┼─────────────┼──────────┼───────────────────────────────────────────────────────────────────────┤│ CLAMP │ N │ Varies │ Sets the IC outputs to logic levels as defined in the boundary scan ││ │ │ │ register. Enables the bypass register. │├───────────┼─────────────┼──────────┼───────────────────────────────────────────────────────────────────────┤│ HIGHZ │ N │ Varies │ Sets all IC outputs to a disabled (high impedance) state. Enables ││ │ │ │ the bypass register. │├───────────┼─────────────┼──────────┼───────────────────────────────────────────────────────────────────────┤│ IDCODE │ N │ Varies │ Enables the 32-bit device identification register. Does not affect ││ │ │ │ operation <strong>of</strong> the IC. │├───────────┼─────────────┼──────────┼───────────────────────────────────────────────────────────────────────┤│ USERCODE │ N │ Varies │ Places user-defined information into the 32-bit device ││ │ │ │ identification register. Does not affect operation <strong>of</strong> the IC. │└───────────┴─────────────┴──────────┴───────────────────────────────────────────────────────────────────────┘
Page 1 and 2: Assisted Discovery
Page 3 and 4: Introduction• On-chip debug inter
Page 5 and 6: Goals• Create an easy-to-use tool
Page 7 and 8: Other Art• An Open JTAG Debugger
Page 9 and 10: HW Reverse Engineering• Informati
Page 11 and 12: Identifying Interfaces: Internal•
Page 13 and 14: Identifying Interfaces: Internal 3
Page 15 and 16: Manually Determining Pin Function
Page 17 and 18: On-Chip Debug Interfaces• JTAG•
Page 19 and 20: JTAG 2• Multiple devices can be "
Page 21: JTAG: Architecture 2
Page 25 and 26: JTAG: HW Tools• RIFF Box- www.jta
Page 27 and 28: UART• Universal Asynchronous Rece
Page 29 and 30: UART 3Mark (Idle)SpaceBit width= ~8
Page 31 and 32: Design Requirements• Open source/
Page 33 and 34: Development
Page 35 and 36: Assembly Drawing
Page 37 and 38: Schematic: Target InterfaceNOTE: RE
Page 39 and 40: Propeller/Core 2• Clock: DC to 12
Page 41 and 42: Propeller/Core 4• Standard develo
Page 43 and 44: USB Interface• Allows for Propell
Page 45 and 46: Adjustable Target Voltage• PWM fr
Page 47 and 48: Level Translation 2
Page 49 and 50: Input Protection 2• NUP4302MR6 Sc
Page 51 and 52: Firmware
Page 53 and 54: Cogs• Spin Interpreter (Cog 0)•
Page 55 and 56: General Commands• Set target syst
Page 57 and 58: IDCODE Scan• 32-bit Device ID (if
Page 59 and 60: IDCODE Scan 3• Ask user for numbe
Page 61 and 62: BYPASS Scan 2• Can determine how
Page 63 and 64: JTAG: Examples
Page 65 and 66: Linksys WRT54G v1.1• Broadcom BCM
Page 67 and 68: D-Link DWL-900AP+ 2• Lattice ispM
Page 69 and 70: BlackBerry 7250• Qualcomm MSM6500
Page 71 and 72: BlackBerry 7290 2
Page 73 and 74:
UART Scan• Ask user for desired o
Page 75 and 76:
UART Scan 3
Page 77 and 78:
Linksys WRT54G v2 rXH (w/ DD-WRT)
Page 79 and 80:
Scan Timing 2• UART- Only need to
Page 81 and 82:
Possible Limitations• Could cause
Page 83 and 84:
Other Uses• Propeller development
Page 85 and 86:
A Poem
show all

JTAGulator: Assisted discovery of on-chip ... - Grand Idea Studio

Create successful ePaper yourself

Delete template?

Save as template?