September 21, 2021

Jtagulator

Jtagulator is a small PCB board that you can hook up to your computer via USB and to a test embedded board via what you suspect might be JTAG headers and it will tell you which pins to use. If you don’t have this, it’s tough to tell which pins to hook up to and you’d just be guessing, or maybe blowing up your board.

Here’s a typical setup.


You can see the Jtagulator hooked up with some wires to the little JTAG header I had to solder on this Linksys WRT54G, which I picked up used for a few bucks.

You can just hook up some female-female jumper wires you can get online for a few dollars up in some random order to the pins on the jtagulator header like this:

Once it’s hooked up, the jtagulator will test the logic on all the pins you hooked up and try to determine the 3 or 4 pins you actually need to use, and what their names are.

To make JTAG work, you need:

  1. TDI – data in
  2. TDO – data out
  3. TCK – clock
  4. TRST – reset

So the jtagulator will try to find them and tell you which pins they are.

You need a terminal to hook up to the jtagulator, which means you plug in the USB cable to your laptop. When you do, it will turn on the green LED on the board and then you set up the terminal, which means you need to know what device your laptop called it, so look at the lines like:

dmesg | tail
[64721.823796] usb 2-2: Product: FT232R USB UART
[64721.823797] usb 2-2: Manufacturer: FTDI
[64721.823798] usb 2-2: SerialNumber: AB0K6CJS
[64721.917076] usbcore: registered new interface driver usbserial_generic
[64721.917203] usbserial: USB Serial support registered for generic
[64721.927534] usbcore: registered new interface driver ftdi_sio
[64721.927985] usbserial: USB Serial support registered for FTDI USB Serial Device
[64721.928162] ftdi_sio 2-2:1.0: FTDI USB Serial Device converter detected
[64721.928530] usb 2-2: Detected FT232RL
[64721.930650] usb 2-2: FTDI USB Serial Device converter now attached to ttyUSB0

So use screen to hook up to that device like:

sudo screen /dev/ttyUSB0 115200
:h
JTAG Commands:
I   Identify JTAG pinout (IDCODE Scan)
B   Identify JTAG pinout (BYPASS Scan)
D   Get Device ID(s)
T   Test BYPASS (TDI to TDO)
 
UART Commands:
U   Identify UART pinout
P   UART passthrough
 
General Commands:
V   Set target I/O voltage (1.2V to 3.3V)
R   Read all channels (input)
W   Write all channels (output)
J   Display version information
H   Display available commands
:

Now you enter commands. The first is to set the target voltage. You have to KNOW what the target voltage is, so take a voltmeter and probe around the JTAG header on your test board until you find out what voltage to use. Mine was 3.3V in this case, which is super common, but it very well could be something else:

:v
Current target I/O voltage: Undefined
Enter new target I/O voltage (1.2 - 3.3, 0 for off): 3.3
New target I/O voltage set: 3.3
Ensure VADJ is NOT connected to target!

Okay, now you start the scan. Make sure your test board is powered up or you won’t get anything. There are two types of scan, a quick one
called IDCODE, and a slower one called BYPASSS scan.

The IDCODE is fast and tells you what the ID of the chipset you’re looking at is. I had 7 pins hooked up from the jtagulator header to the test board, so here’s what I entered (modify to suit your environment):

:i
Enter number of channels to use (3 - 24): 7
Ensure connections are on CH6..CH0.
Possible permutations: 210
Press spacebar to begin (any other key to abort)... 
JTAGulating! Press any key to abort....
TDI: N/A
TDO: 2
TCK: 4
TMS: 3
TRST#: 0
TRST#: 1
.
IDCODE scan complete!

So that tells me which wire/pins are hooked to which JTAG function. Now I can start to read more information about the test board by asking about the Device ID. Change the pins it asks for to the ones your IDCODE scan told you. Enter 1 for the number of devices:

:d
TDI not needed to retrieve Device ID.
Enter new TDO pin [0]: 2
Enter new TCK pin [0]: 4
Enter new TMS pin [0]: 3
Enter number of devices in JTAG chain [0]: 1
All other channels set to output HIGH.
 
Device ID: 1111 1110000000010000 00000111111 1 (0xFE01007F)
-> Manufacturer ID: 0x03F
-> Part Number: 0xE010
-> Version: 0xF
 
IDCODE listing complete!

Okay, so now you know what chip it’s talking to on the test board. Well, after you google the Device ID hex thing 0xFE01007F which tells you it’s a Broadcom in this case.

If you want to do the slower BYPASS scan, which gives you more information (which you’d need in more complex JTAG implementations on complex test boards, do:

:b
Enter number of channels to use (4 - 24): 7
Ensure connections are on CH6..CH0.
Possible permutations: 840
Press spacebar to begin (any other key to abort)... 
JTAGulating! Press any key to abort..................
TDI: 1
TDO: 2
TCK: 4
TMS: 3
TRST#: 0
Number of devices detected: 1
.....................................................................
BYPASS scan complete!

This test took about 3-4 minutes, so be patient. When it’s working, the LED will blink green and red, then green when it’s done. Now we know how many devices on the test board are connected to the JTAG header, and more about the pin definitions.

If you want to test the JTAG chain on the test board, do:

:t
Enter new TDI pin [0]: 1
Enter new TDO pin [0]: 2
Enter new TCK pin [0]: 4
Enter new TMS pin [0]: 3
Enter number of devices in JTAG chain [1]: 
All other channels set to output HIGH.
 
Pattern in to TDI:    11000100000001111111000011011111
Pattern out from TDO: 11000100000001111111000011011111
Match!

This means it’s working!