JTAG

JTAG#

IEEE 1149.1 boundary-scan and on-chip debug. Four or five wires drive a state machine inside the chip that lets the operator read and write every register, halt the CPU, dump flash, and walk the boundary-scan chain through every pin on every chip on the board. The back door cut into the chip by the manufacturer; if the operator finds an unsealed JTAG header, the operator owns the device.

Wires#

Signal

Direction

Purpose

TCK

Probe out

Test clock. Drives the JTAG state machine.

TMS

Probe out

Test mode select. Transitions drive the state machine.

TDI

Probe out

Test data in. Shifts into the chain.

TDO

Probe in

Test data out. Shifts out of the chain.

TRST (optional)

Probe out

Test reset; asynchronously resets the JTAG TAP.

SRST (optional)

Probe out

System reset; resets the chip, not just the JTAG TAP.

GND

Reference

Ground.

Headers are typically 2x5, 2x7, or 2x10 0.1-inch pitch. ARM’s 20-pin Cortex Debug connector is a common standard pinout.

Wire format#

JTAG is a state machine driven by TMS sampled on the rising edge of TCK.

  • Test-Logic-Reset, the safe idle state.

  • Run-Test/Idle, the operating state.

  • Select-DR / Select-IR, branch into a Data Register or Instruction Register shift sequence.

  • Capture-DR/IR → Shift-DR/IR → Exit1 → Update, the cycle for one register operation.

Standard instructions include IDCODE (32-bit chip identifier), BYPASS (skip this chip in a chain), SAMPLE/PRELOAD, EXTEST (drive the boundary-scan cells onto the chip’s pins), and vendor-specific debug instructions.

Pads#

The operator’s first job on an unknown board is to find the JTAG pads. Vendors leave them unlabelled and sometimes spread the signals across the PCB.

  • Look for a 2xN 0.1-inch unpopulated header near the main MCU.

  • Look for unmarked test points clustered in a square or row.

  • Use a tool like JTAGulator to brute-force the pin assignment.

ARM Cortex Debug pinout (20-pin):

Pin

Signal

1

VTref (target voltage reference)

2, 6, 8, 10, 12, 14, 16, 18, 20

GND

3

TRST (or NC)

5

TDI

7

TMS / SWDIO

9

TCK / SWCLK

11

RTCK (optional)

13

TDO / SWO

15

SRST

Tools#

Tool

Effect

OpenOCD

Open-source JTAG / SWD daemon; drives most adapters.

urjtag

Lower-level JTAG manipulation; boundary-scan and flash programming.

JTAGulator

Identifies the JTAG pinout on an unknown header by trying every permutation against IDCODE.

Bus Pirate, BlackMagic Probe, J-Link, ST-Link

JTAG adapters with progressively more capability and cost.

gdb

Attaches to OpenOCD or BlackMagic Probe for live debug.

References#

  • IEEE 1149.1 Standard Test Access Port and Boundary-Scan Architecture.

  • OpenOCD user guide, http://openocd.org/doc/html/.

  • SWD for the two-wire ARM alternative.

  • JTAGulator firmware.

  • Tools for the broader bench-debug toolchain.

Contents