差别

这里会显示出您选择的修订版和当前版本之间的差别。

--- jtag [2017/03/26 20:32]
gongyu
+++ jtag [2021/09/13 23:31] (当前版本)
gongyu
@@ 行 1: / 行 1: @@
-什么是JTAG?
+## 什么是JTAG?
 JTAG is an IEEE standard (1149.1) developed in the 1980s to solve electronic boards manufacturing issues. Nowadays it finds more use as programming, debug and probing port.
@@ 行 178: / 行 178: @@
 Here's an example:
+<code c>
   // go to reset state
   for(i=0; i<5; i++) JTAG_clock(TMS);
@@ 行 208: / 行 208: @@
   nbDevices = i;
   printf("There are %d device(s) in the JTAG chain\n", nbDevices);
+</code>
 Get the IDs of the devices in the JTAG chain
@@ 行 215: / 行 218: @@
 Here's an example:
+<code c>
   // go to reset state (that loads IDCODE into IR of all the devices)
   for(i=0; i<5; i++) JTAG_clock(TMS);
@@ 行 230: / 行 233: @@
     printf("IDCODE for device %d is %08X\n", i+1, JTAG_read(32));
   }
+</code>
-更详细的信息参见：[[WiKiPedia上关于JTAG的定义]]
+====== Run a boundary-scan ======
+Now let's ask the TAP controllers to go into boundary-scan mode, where the DR chain goes through each IO block and can read or hijack each pin!
+{{ ::jtag8.gif |}}
+Boundary-scan can be used even while a device is otherwise running. So for example, using JTAG on an FPGA, you can tell the status of each pin while the FPGA is running.
+===== SAMPLE =====
+Let's try to read the value of the pins. We use a JTAG instruction called SAMPLE for that. Each IC instruction code list is different. You have to look into the IC datasheet, or the IC BSDL file to get the codes.
+A BSDL file is actually a VHDL file that describes the boundary chain of an IC.
+Here's an interesting portion of an Altera BSDL file (Cyclone EP1C3 in TQFP 100 pins package).
+<code bsdl>
+attribute INSTRUCTION_LENGTH of EP1C3T100 : entity is 10;
+attribute INSTRUCTION_OPCODE of EP1C3T100 : entity is
+  "BYPASS            (1111111111), "&
+  "EXTEST            (0000000000), "&
+  "SAMPLE            (0000000101), "&
+  "IDCODE            (0000000110), "&
+  "USERCODE          (0000000111), "&
+  "CLAMP             (0000001010), "&
+  "HIGHZ             (0000001011), "&
+  "CONFIG_IO            (0000001101)";
+attribute INSTRUCTION_CAPTURE of EP1C3T100 : entity is "0101010101";
+attribute IDCODE_REGISTER of EP1C3T100 : entity is
+  "0000"&               --4-bit Version
+  "0010000010000001"&   --16-bit Part Number (hex 2081)
+  "00001101110"&        --11-bit Manufacturer's Identity
+  "1";                  --Mandatory LSB
+attribute BOUNDARY_LENGTH of EP1C3T100 : entity is 339;
+</code>
+Here's what we learn from this device's BSDL:
+  * The length of the IR register (10 bits long).
+  * The list of possible IR instructions, with their 10 bits codes. The code for SAMPLE is 0000000101b = 0x005.
+  * The IDCODE of the part (the manufacturer code reads 00001101110b = 0x6E, which is Altera. Xilinx would have been 00001001001b = 0x49).
+  * The length of the boundary-scan chain (339 bits long).
+  * The boundary-scan is 339 bits long. That doesn't mean there are 339 pins.
+Each pin use an IO pad on the IC die. Some IO pads use one, two or three bits from the chain (depending if the pin is input only, output with tri-state, or both). See the links at the bottom of this page for more details. Also some registers correspond to IO pads that may not be bounded (they exists on the IC die but are not accessible externally). Which explains why a 100 pins device can have a 339 bits boundary-scan chain.
+Going back to the BSDL file, we also get this:
+<code bsdl>
+attribute BOUNDARY_REGISTER of EP1C3T100 : entity is
+  --BSC group 0 for I/O pin 100
+  "0   (BC_1, IO100, input, X)," &
+  "1   (BC_1, *, control, 1)," &
+  "2   (BC_1, IO100, output3, X, 1, 1, Z)," &
+  --BSC group 1 for I/O pin 99
+  "3   (BC_1, IO99, input, X)," &
+  "4   (BC_1, *, control, 1)," &
+  "5   (BC_1, IO99, output3, X, 4, 1, Z)," &
+  ...
+  ...
+  ...
+  --BSC group 112 for I/O pin 1
+  "336 (BC_1, IO1, input, X)," &
+  "337 (BC_1, *, control, 1)," &
+  "338 (BC_1, IO1, output3, X, 337, 1, Z)" ;
+</code>
+This lists all the 339 bits of the chain, and what they do.
+For example, bit 3 is the one that tells us what is the value on pin 99.
+Let's read the boundary-scan registers, and print the value on pin 99:
+<code c>
+  // go to reset state
+  for(i=0; i<5; i++) JTAG_clock(TMS);
+  // go to Shift-IR
+  JTAG_clock(0);
+  JTAG_clock(TMS);
+  JTAG_clock(TMS);
+  JTAG_clock(0);
+  JTAG_clock(0);
+  // Assuming that IR is 10 bits long,
+  // that there is only one device in the chain,
+  // and that SAMPLE code = 0000000101b
+  JTAG_clock(1);
+  JTAG_clock(0);
+  JTAG_clock(1);
+  JTAG_clock(0);
+  JTAG_clock(0);
+  JTAG_clock(0);
+  JTAG_clock(0);
+  JTAG_clock(0);
+  JTAG_clock(0);
+  JTAG_clock(0 or TMS);  // last bit needs to have TMS active, to exit shift-IR
+  // we are in Exit1-IR, go to Shift-DR
+  JTAG_clock(TMS);
+  JTAG_clock(TMS);
+  JTAG_clock(0);
+  JTAG_clock(0);
+  // read the boundary-scan chain bits in an array called BSB
+  JTAG_read(BSB, 339);
+  printf("Status of pin 99 = %d\n, BSB[3]);
+</code>
+Easy, right?
+===== Do more with JTAG =====
+  * JTAG can hijack the pins. The JTAG instruction for that is EXTEST ("external test").
+  * JTAG can perform FPGA configuration. See for example this file.
+  * JTAG can be used as debug port - for example Altera's SignalTap and Xilinx's ChipScope.
+Your turn to experiment!
+===== Links =====
+  * Altera器件的[[http://www.altera.com/literature/an/an039.pdf|Boundary-Scan Testing]]
+  * Xilinx的[[http://www.xilinx.com/xlnx/xil_sw_updates_home.jsp?update=bsdl|BSDL文件]].
+  * Altera的[[http://www.altera.com/support/devices/bsdl/bsdl.html|BSDL文件]].
+更详细的信息参见：[[WiKiPedia上关于JTAG的定义]]