1.硬件调试工具-2.JTAG和SWD-《计算机知识》

admin

0
文章

0
评论

2025-11-02 22:21:35 系统网络来源：ZONE.CI 全球网 0 阅读模式

JTAG详解
- 参考资料
- JTAG硬件说明
- JTAG原理
  - 硬件接口
  - 边界扫描
  - TAP状态机
- 使用JLINK调试ARM
  - JTAG Probe
  - JLINK硬件说明
  - JLINK工具
- 使用Keil调试ARM
- 开源JTAG库
- 附录

JTAG详解

参考资料

基础知识和ARM JTAG和OpenJTAG-ARM和Insight into JTAG
XJTAG基础文档
JTAG时序详解
JTAG-DP ARM

JTAG硬件说明

JTAG引脚定义: JTAG有10pin的、14pin的和20pin-标准

JTAG(Joint Test Action Group，联合测试行动组)调试接口目前主要有10针，14针和20针。

必须有的信号-5个：

TMS：测试模式选择，TMS用来设置JTAG接口处于某种特定的测试模式，必须在目标板上将此引脚上拉；
TCK：测试时钟输入，建议在目标板上将此引脚上拉；
TDI：测试数据输入，仿真器连接至目标CPU的数据输入信号，建议在目标板上上拉到VDD；
TDO：测试数据输出，目标板返回给仿真器的数据信号；
VREF：目标表参考电压信号，用于检测目标板是否供电，直接与目标板VDD相连，并不向外提供输出电压；

可选信号：

RTCK:目标板提供仿真器的时钟信号，有些项目中是要求JTAG的输入与其内部时钟信号同步，仿真器利用此引脚的输入可动态的控制自己的TCK速率；
TRST：JTAG复位，连接到目标板CPU的nTRST引脚，用于复位CPU调试接口的TAP控制器；目标板上应该将此脚上拉到高电位，避免意外复位，可选引脚—复位JTAG；
RESET:仿真器输出至目标CPU的系统复位信号，可选信号-复位CPU；
USER IN / USER OUT ：用户自定义输入输出

JTAG原理

硬件接口

边界扫描

TAP状态机

使用JLINK调试ARM

参考资料：

JLINK User Guide
常见的ARM仿真器

J-Link是德国SEGGER公司推出基于JTAG的仿真器。简单地说，是给一个JTAG协议转换盒，即一个小型USB到JTAG的转换盒，其连接到计算机用的是USB接口，而到目标板内部用的还是jtag协议。它完成了一个从软件到硬件转换的工作。

JTAG Probe

软件工具和说明

JLINK硬件说明

淘宝链接: JLINK硬件支持SWD和JTAG两种模式，可选使用。转接板信息

JLINK工具

官网和下载地址
官网JLINK说明
JLINK使用文档

wiki系列

wiki-J-Link Commander

快速命令：
rt  # trest
device cortex-a7
si jtag
speed 100
connect
i  # read id
J-Link>?
Available commands are:
----------------------
f          Firmware info
h          halt
IsHalted   Returns the current CPU state (halted / running)
WaitHalt   Waits until the CPU is halted or the given timeout is exceeded.
             Syntax: WaitHalt <TimeoutMs>  Default timeout is 1000 ms
g          go
Sleep      Waits the given time (in milliseconds). Syntax: Sleep <delay>
s          Single step the target chip
             Syntax: s [<NumSteps (dec)>]
st         Show hardware status
hwinfo     Show hardware info
mem        Read memory. Syntax: mem  [<Zone>:]<Addr>, <NumBytes> (hex)
mem8       Read  8-bit items. Syntax: mem8  [<Zone>:]<Addr>, <NumBytes> (hex)
mem16      Read 16-bit items. Syntax: mem16 [<Zone>:]<Addr>, <NumItems> (hex)
mem32      Read 32-bit items. Syntax: mem32 [<Zone>:]<Addr>, <NumItems> (hex)
w1         Write  8-bit items. Syntax: w1 [<Zone>:]<Addr>, <Data> (hex)
w2         Write 16-bit items. Syntax: w2 [<Zone>:]<Addr>, <Data> (hex)
w4         Write 32-bit items. Syntax: w4 [<Zone>:]<Addr>, <Data> (hex)
erase      Erase internal flash of selected device. Syntax: Erase
wm         Write test words. Syntax: wm <NumWords>
is         Identify length of scan chain select register
ms         Measure length of scan chain. Syntax: ms <Scan chain>
mr         Measure RTCK react time. Syntax: mr
q          Quit
qc         Close JLink connection and quit
eoe        Exit on error
             Syntax: eoe <1/0>
r          Reset target         (RESET)
rx         Reset target         (RESET). Syntax: rx <DelayAfterReset>
RSetType   Set the current reset type. Syntax: RSetType <type>
Regs       Display contents of registers
wreg       Write register.   Syntax: wreg <RegName>, <Value>
moe        Shows mode-of-entry, meaning: Reason why CPU is halted
SetBP      Set breakpoint.   Syntax: SetBP <addr> [A/T] [S/H]
SetWP      Set Watchpoint. Syntax: <Addr> [R/W] [<Data> [<D-Mask>] [A-Mask]]
ClrBP      Clear breakpoint. Syntax: ClrBP  <BP_Handle>
ClrWP      Clear watchpoint. Syntax: ClrWP  <WP_Handle>
VCatch     Write vector catch. Syntax: VCatch <Value>
loadfile   Load data file into target memory.
             Syntax: loadfile <filename>, [<addr>]
             Supported extensions: *.bin, *.mot, *.hex, *.srec
             <addr> is needed for bin files only.
loadbin    Load *.bin file into target memory.
             Syntax: loadbin <filename>, <addr>
savebin    Saves target memory into binary file.
             Syntax: savebin <filename>, <addr>, <NumBytes>
verifybin  Verfies if the specified binary is already in the target memory at the specified address.
             Syntax: verifybin <filename>, <addr>
SetPC      Set the PC to specified value. Syntax: SetPC <Addr>
le         Change to little endian mode
be         Change to big endian mode
log        Enables log to file.  Syntax: log <filename>
unlock     Unlocks a device. Syntax: unlock <DeviceName>
           Type unlock without <DeviceName> to get a list
           of supported device names.
           nRESET has to be connected
term       Test command to visualize printf output from the target device,
           using DCC (SEGGER DCC handler running on target)
ReadAP     Reads a CoreSight AP register.
           Note: First read returns the data of the previous read.
           An additional read of DP reg 3 is necessary to get the data.
ReadDP     Reads a CoreSight DP register.
           Note: For SWD data is returned immediately.
           For JTAG the data of the previous read is returned.
           An additional read of DP reg 3 is necessary to get the data.
WriteAP    Writes a CoreSight AP register.
WriteDP    Writes a CoreSight DP register.
SWDSelect  Selects SWD as interface and outputs
           the JTAG -> SWD switching sequence.
SWDReadAP  Reads a CoreSight AP register via SWD.
           Note: First read returns the data of the previous read.
           An additional read of DP reg 3 is necessary to get the data.
SWDReadDP  Reads a CoreSight DP register via SWD.
           Note: Correct data is returned immediately.
SWDWriteAP Writes a CoreSight AP register via SWD.
SWDWriteDP Writes a CoreSight DP register via SWD.
Device     Selects a specific device J-Link shall connect to
           and performs a reconnect.
           In most cases explicit selection of the device is not necessary.
           Selecting a device enables the user to make use of the J-Link
           flash programming functionality as well as using unlimited
           breakpoints in flash memory.
           For some devices explicit device selection is mandatory in order
           to allow the DLL to perform special handling needed by the device.
ExpDevList Exports the device names from the DLL internal
           device list to a text file
             Syntax: ExpDevList <Filename>
ExpDevListXML Exports the device names from the DLL internal
           device list to a text file in XML format
             Syntax: ExpDevListXML <Filename>
PowerTrace Perform power trace (not supported by all models)
Syntax: PowerTrace <LogFile> [<ChannelMask> <RefCountSel>]
<LogFile>: File to store power trace data to
<ChannelMask>: 32-bit mask to specify what channels shall be enabled
<SampleFreq>: Sampling frequency in Hz (0 == max)
<RefCountSel>:       0: No reference count
                     1: Number of bytes transmitted on SWO
---- CP15 ------------
rce        Read CP15.  Syntax: rce <Op1>, <CRn>, <CRm>, <Op2>
wce        Write CP15. Syntax: wce <Op1>, <CRn>, <CRm>, <Op2>, <Data>
---- ICE -------------
Ice        Show state of the embedded ice macrocell (ICE breaker)
ri         Read Ice reg.  Syntax: ri <RegIndex>(hex)
wi         Write Ice reg. Syntax: wi <RegIndex>, <Data>(hex)
---- TRACE -----------
TClear     TRACE - Clear buffer
TSetSize   TRACE - Set Size of trace buffer
TSetFormat TRACE - SetFormat
TSR        TRACE - Show Regions (and analyze trace buffer)
TStart     TRACE - Start
TStop      TRACE - Stop
---- SWO -------------
SWOSpeed   SWO - Show supported speeds
SWOStart   SWO - Start
SWOStop    SWO - Stop
SWOStat    SWO - Display SWO status
SWORead    SWO - Read and display SWO data
SWOShow    SWO - Read and analyze SWO data
SWOFlush   SWO - Flush data
SWOView    SWO - View terminal data
---- PERIODIC --------
PERConf    PERIODIC - Configure
PERStart   PERIODIC - Start
PERStop    PERIODIC - Stop
PERStat    PERIODIC - Display status
PERRead    PERIODIC - Read and display data
PERShow    PERIODIC - Read and analyze data
---- File I/O --------
fwrite     Write file to emulator
fread      Read file from emulator
fshow      Read and display file from emulator
fdelete    Delete file on emulator
fsize      Display size of file on emulator
flist      List directory on emulator
SecureArea Creates/Removes secure area on probe
---- Test ------------
TestHaltGo   Run go/halt 1000 times
TestStep     Run step 1000 times
TestCSpeed   Measure CPU speed.
             Parameters: [<RAMAddr>]
TestWSpeed   Measure download speed into target memory.
             Parameters:  [<Addr> [<Size>]]
TestRSpeed   Measure upload speed from target memory.
             Parameters: [<Addr> [<Size>] [<NumBlocks>]]
TestNWSpeed  Measure network download speed.
             Parameters: [<NumBytes> [<NumReps>]]
TestNRSpeed  Measure network upload speed.
             Parameters: [<NumBytes> [<NumReps>]]
---- JTAG ------------
JTAGConf   Set number of IR/DR bits before ARM device.
             Syntax: Config <IRpre>, <DRpre>
speed      Set target interface speed. Syntax: speed <freq>|auto|adaptive, e.g. speed 2000, speed a
i          Read JTAG Id (Host CPU)
wjc        Write JTAG command (IR). Syntax: wjc <Data>(hex)
wjd        Write JTAG data (DR). Syntax: wjd <Data64>(hex), <NumBits>(dec)
RTAP       Reset TAP Controller using state machine (111110)
wjraw      Write Raw JTAG data. Syntax: wjraw <NumBits(dec)>, <tms>, <tdi>
rt         Reset TAP Controller (nTRST)
---- JTAG-Hardware ---
c00        Create clock with TDI = TMS = 0
c          Clock
tck0       Clear TCK
tck1       Set   TCK
0          Clear TDI
1          Set   TDI
t0         Clear TMS
t1         Set   TMS
trst0      Clear TRST
trst1      Set   TRST
r0         Clear RESET
r1         Set   RESET
---- Connection ------
usb        Connect to J-Link via USB.  Syntax: usb <port>, where port is 0..3
ip         Connect to J-Link ARM Pro or J-Link TCP/IP Server via TCP/IP.
           Syntax: ip <ip_addr>
---- Configuration ---
si         Select target interface. Syntax: si <Interface>,
           where <Interface> can be any supported target interface (e.g SWD, JTAG, ICSP, FINE, ...
power      Switch power supply for target. Syntax: power <State> [perm],
           where State is either On or Off. Example: power on perm
wconf      Write configuration byte. Syntax: wconf <offset>, <data>
rconf      Read configuration bytes. Syntax: rconf
license    Shows a list of all available license commands
ipaddr     Show/Assign IP address and subnetmask of/to the connected J-Link.
gwaddr     Show/Assign network gateway address of/to the connected J-Link.
dnsaddr    Show/Assign network DNS server address of/to the connected J-Link.
conf       Show configuration of the connected J-Link.
calibrate  Calibrate the target current measurement.
selemu     Select a emulator to communicate with,
           from a list of all emulators which are connected to the host
           The interfaces to search on, can be specified
             Syntax: selemu [<Interface0> <Interface1> ...]
ShowEmuList Shows a list of all emulators which are connected to the host.
            The interfaces to search on, can be specified.
             Syntax: ShowEmuList [<Interface0> <Interface1> ...]
VCOM        enable/disable VCOM. Takes effect after power cycle of the J-Link
             Syntax: VCOM <enable|disable>
VTREF       Sets a fixed value for VTref on J-Link.
              Syntax: VTREF <ValuemV>
----------------------

J-Flash有Linux和Windows版本，支持以下Flash烧写：

Supports most Cortex A-R-M, RX and Power PC devices/cores
Supports the following internal and external flash devices:
Internal flash of most popular microcontrollers
CFI-compliant NOR flash (the combinations 18x, 2x8, 1x16, 2x16 are supported)
Most non-CFI compliant NOR flash devices (the combinations 1x8, 2x8, 1x16, 2x16 are supported)
SPI NOR-flash
NAND flash

JLink和JFlash使用方法笔记-中文

J-Link>connect
Please specify device / core. <Default>: CORTEX-A9
Type '?' for selection dialog
Device>？
Please specify target interface:
  J) JTAG (Default)
  S) SWD
  F) FINE
  I) ICSP
  C) C2
  T) cJTAG
TIF>J
Device position in JTAG chain (IRPre,DRPre) <Default>: -1,-1 => Auto-detect
JTAGConf>connect
ERROR while parsing value for IRPre. Using default: -1.
ERROR while parsing value for DRPre. Using default: -1.
Specify target interface speed [kHz]. <Default>: 4000 kHz
Speed>speed 100
ERROR while parsing value for speed. Using default: 4000 kHz.
Device "CORTEX-A9" selected.
Connecting to target via JTAG
TotalIRLen = 4, IRPrint = 0x01
JTAG chain detection found 1 devices:
 #0 Id: 0x4BA00477, IRLen: 04, CoreSight JTAG-DP
Scanning AP map to find all available APs
AP[3]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x44770001)
AP[1]: APB-AP (IDR: 0x24770002)
AP[2]: JTAG-AP (IDR: 0x14760010)
Iterating through AP map to find APB-AP to use
AP[0]: Skipped. Not an APB-AP
AP[1]: APB-AP found
ROMTbl[0][0]: CompAddr: 80001000 CID: B105900D, PID:04-003BB907 ETB
ROMTbl[0][1]: CompAddr: 80002000 CID: B105900D, PID:04-003BB906 CTI
ROMTbl[0][2]: CompAddr: 80003000 CID: B105900D, PID:04-004BB912 TPIU
ROMTbl[0][3]: CompAddr: 80004000 CID: B105900D, PID:04-001BB908 CSTF
ROMTbl[0][4]: CompAddr: 80005000 CID: B105900D, PID:04-002BB913 ITM
ROMTbl[0][5]: CompAddr: 80006000 CID: B105900D, PID:04-002BB914 SWO
ROMTbl[0][6]: CompAddr: 80008000 CID: 00000000, PID:00-00000000 ???
ROMTbl[0][7]: CompAddr: 80010000 CID: B105900D, PID:04-000BBC09 Cortex-A9
Found Cortex-A9 r3p0
6 code breakpoints, 4 data breakpoints
Debug architecture ARMv7.0
Data endian: little
Main ID register: 0x413FC090
I-Cache L1: 32 KB, 256 Sets, 32 Bytes/Line, 4-Way
D-Cache L1: 32 KB, 256 Sets, 32 Bytes/Line, 4-Way
System control register:
  Instruction endian: little
  Level-1 instruction cache enabled
  Level-1 data cache disabled
  MMU enabled
  Branch prediction enabled
Memory zones:
  [0]: Default (Default access mode)
  [1]: AHB-AP (AP0) (DMA like acc. in AP0 addr. space)
  [2]: APB-AP (AP1) (DMA like acc. in AP1 addr. space)
Cortex-A9 identified.
J-Link>REGS
CPU is not halted !
J-Link>halt
PC: (R15) = C3E14EE8, CPSR = 400001D3 (SVC mode, ARM FIQ dis. IRQ dis.)
Current:
     R0 =13820000, R1 =C3E329C4, R2 =C3E3EC78, R3 =0001000E
     R4 =C3E3EA3C, R5 =C3E3EA3C, R6 =0000000C, R7 =00000022
     R8 =C3CFBFF0, R9 =00000000, R10=00200000, R11=00000000, R12=FFFFFFFF
     R13=43FFEF88, R14=C3E14EE8, SPSR=00000C55
USR: R8 =C3CFBFF0, R9 =00000000, R10=00200000, R11=00000000, R12=FFFFFFFF
     R13=00000000, R14=00000000
FIQ: R8 =00000000, R9 =00000000, R10=00000000, R11=00000000, R12=00000000
     R13=00000000, R14=00000000, SPSR=70081280
IRQ: R13=02020700, R14=00000000, SPSR=E4024E85
SVC: R13=43FFEF88, R14=C3E14EE8, SPSR=CC08C824
ABT: R13=00000000, R14=00000000, SPSR=82090C28
UND: R13=00000000, R14=00000000, SPSR=B80B2D51

使用Keil调试ARM

JLINK官网和下载地址, 中文推荐文档注：这里选择MDK-ARMUserGuide注：发现设备支持列表中没有CortexA9系列，放弃https://bbs.elecfans.com/jishu_1897394_1_1.html 破解器

开源JTAG库

http://news.eeworld.com.cn/mcu/article_2016072627853.html这个是个开源的JLINK库，以后有空了可以试试，这样可能可以绕过JTAG ID

附录

1.利用vivado抓取芯片的SPI信号

安装好vivado软件后，链接上JTAG，安装驱动 “./2017.4/data/xicom/cable_drivers/lin64/install_script/install_drivers/install_drivers”
重启设备后，会发现JTAG灯变为黄灯；
选择vivado-》open Hardware Manager
左上角open target 选择Auto connect,等链接上后，JTAG灯变绿
然后选择提供的10.31.32.65:/home/firmware/x2-mengnan/2018-0704-xiaosen-cpu-bifsd里边的
x2_fpga_20180704_xiaosen_cpu_bifsd.ltx文件，链接上后，会出现时序表，选择想要抓取的时序信息和触发条件(触发条件只能为1个）