One of the hardware devices explains JTAG and SWD interfaces in detail

  JTAG and SWD can be seen everywhere in embedded development, and they are usually used to debug embedded programs online with emulators such as J-Link, ULINK, and ST-LINK. In addition, there are Background debug mode (BDM) interfaces in Freescale chips, debugWIRE in Atmel chips, and IEEE-ISTO 5001, a global embedded processor debugging interface standard formulated by the Nexus 5001 Forum.

JTAG

  The name JTAG is an acronym for the standard's creators, the Joint Test Action Group. Its related standards were standardized in 1990 as IEEE Std. 1149.1-1990 (the full name of the standard is Test Access Port and Boundary-Scan Architecture (Test Access Port and Boundary-Scan Architecture)).

JTAG is a fancy name for the team of engineers from the major manufacturers who sat together and came up with the standard we now know as JTAG.

boundary scan

  JTAG was originally developed as a method of testing interconnects (wires) on printed circuit boards or submodules within integrated circuits using boundary-scan technology. Boundary scan is widely used as a debugging method to observe the state of IC pins, measure voltages, or analyze sub-modules inside ICs. Many chips on the circuit board can connect their JTAG pinstogether through Daisy Chain .

  The basic idea of ​​the Boundary-Scan technology is to add a shift register unit, that is, the Boundary-Scan Register, to the input/output pins close to the chip. When the chip is in the debugging state, the boundary scan register can isolate the input/output of the chip and the periphery. Through the boundary scan register unit, the observation and control of the input/output signals of the chip can be realized.

  Today, more and more devices are packaged in BGA (Ball Grid Array). Each BGA device on a circuit board imposes severe limitations on the testing that can be done with a conventional bed of nails or flying probe machine. JTAG provides a simple method in the production test of ball grid array (BGA) chips, therefore, boundary scan is also considered synonymous with JTAG.

debugging

  JTAG was formed primarily to aid in the production and testing of electronic devices, not to actually set standards for software debugging! But with the passage of time, chip manufacturers found that JTAG integrated into the chip can assist chip software debugging! Today, JTAG is used as the primary means of accessing submodules of integrated circuits, making it an essential mechanism for debugging embedded systems.

  The detailed debugging protocol (defining how to read the boundary scan register through the JTAG interface) is defined by the architecture manufacturer. For example, ARM gives a detailed introduction to DP in the "ARM® Debug Interface v5" specification; RISC-V is in "RISC-V Debug There is a detailed description of DMI in Specification.

Firmware burning

  JTAG allows device programmer hardware to transfer data to internal non-volatile device memory (such as CPLD, flash memory), currently, all FPGAs and CPLDs, including our commonly used SoC, MCU, use JTAG to provide access to their programming functions.

  Note that firmware programming can be divided into RAM programming and ROM programming according to the storage medium. Among them, RAM programming can be written directly, while ROM programming requires a specific programming algorithm (the usual practice is (for example, Keil), first write the programming algorithm to RAM, and then run the program in RAM, the debugger and Program communication in RAM to achieve burning).

TAP

  The original JTAG standard IEEE 1149.1 defines 5 pins, which are collectively called Test Access Port (TAP). JTAG itself has no fixed voltage, which is determined by the IO supply voltage of the target board and the target chip. It must be ensured that the voltage of the JTAG signal line is the same as that of the connected chip.

• TCK : Test Clock, has an internal weak pull-down resistor. TCK provides an independent, basic clock signal for the operation of TAP, and all operations of TAP are driven by this clock signal.
• TMS : Test Mode Select, with an internal weak pull-up resistor. The TMS signal is used to control the transition of the TAP state machine and is valid on the rising edge of TCK. Through the TMS signal, TAP can be controlled to switch between different states.
• TDI : Test Data-In, with internal weak pull-up resistor. TDI is the interface for data input. All data to be input to a specific register is serially input bit by bit through the TDI interface (driven by TCK).
• TDO : Test Data-out. TDO is the interface for data output. All data to be output from specific registers are serially output bit by bit through the TDO interface (driven by TCK).
• TRST : Test Reset (Optional), with internal weak pull-up resistor. TRST can be used to reset (initialize) the TAP Controller. Because TRST is optional, there are four-wire JTAG and five-wire JTAG.

The compact JTAG (cJTAG) defined by the IEEE-1149.7 standard reduces the number of pins, only defines 2 pins, and can be connected in a star topology:

• TMSC： Test Serial Data
• TCKS： Test Clock

The above is just the signal line, there may be some other pins besides

• VTREF : The interface signal level reference voltage is generally directly connected to Vsupply. This can be used to determine the logic level used by the JTAG interface! Our commonly used J-Link, ULINK, etc. can be powered by 5V voltage, and then internally can convert and output 1.8V ~ 5V to directly supply power to the chip.
• System Reset (nSRST) : Optional, connected to the system reset signal on the target board, it can directly reset the target system. At the same time, it can detect the reset situation of the target system. In order to prevent false triggering, an appropriate pull-up resistor should be added to the target end.
• Return Test Clock ( RTCK ) : Optional, the clock signal fed back from the target to the emulator is used to synchronize the generation of the TCK signal, and it is directly grounded when not in use.

  The JTAG standard does not define the layout of each pin of TAP. Our common debugger interface has 20 pins (it is derived from the interface definition given by ARM, see below for details), and the extra pins are Some power supply, ground, etc., the layout is basically as shown in the figure below:

TAP Controller

  The TAP Controller is responsible for interpreting the TCK and TMS signals and controlling the behavior of the JTAG interface. The data input pin (TDI) is used to load data into the boundary cell between the physical pin and the IC core, and to load data into the instruction register or one of the data registers. The data output pin (TDO) is used to read data from the boundary cell, or read data from the instruction or data register.

  The main body of TAP Controller is a finite state machine (FSM, Finite State Machine) with 16 states, and its state transition process is controlled by TMS signal, which is driven by TCK. The TAP controller can only change the state on the rising edge of TCK, which state (next state) the FSM will jump to next is determined by the level of TMS and the current state (current state) of the FSM.

The state machine has only two "paths", representing two different modes: instruction mode and data mode .

• Data Register (DR) Path: Shown in green in the diagram above, used to load instructions
• Instruction Register (IR) Path: Shown in blue in the above figure, it is used to read/write data from/to data registers (including boundary scan registers (BSR)),

  The IEEE 1149.1 standard defines a set of commands that must be available in order for a device to be considered compliant. These instructions are (see the IEEE 1149.1 standard JTAG documentation for more details on each state):

• BYPASS : This instruction connects the TDI and TDO lines through a single-bit pass-through register (BYPASS register). This instruction allows testing other devices in the JTAG chain without any unnecessary overhead.
• EXTEST : This instruction connects TDI and TDO to the boundary scan register (BSR). The device's pin state capture dris sampled through the JTAG state, and new values ​​are shifted into the BSR through shift drthe state ; update drthe values ​​are then applied to the device's pins using the state.
• SAMPLE/PRELOAD : This command connects TDI and TDO to BSR. However, the device remains in normal functional mode. During this command, the BSR can be accessed through a data scan operation to sample functional data entering and leaving the device. This instruction is also used to preload test data into the BSR before loading the EXTEST instruction.

Other common instructions include:

• IDCODE : This instruction connects TDI and TDO to the IDCODE register.
• INTEST : This instruction connects the TDI and TDO lines to the Boundary Scan Register (BSR). The EXTEST instruction allows the user to set and read pin states, while the INTEST instruction is associated with the core logic signals of the device.

SWD

  SWD (Serial Wire Debug) is a protocol designed by ARM for programming and debugging Cortex series microcontrollers. Since the SWD is dedicated to programming and debugging, it has many special features not usually available elsewhere, such as sending debug information to the computer through the IO lines.

Architecture

  As opposed to JTAG which links TAPs together, SWD uses a bus called DAP (Debug Access Port). On this DAP, there is a master station (DP, Debug Port, debug port) and one or more slave stations (AP, Access Port, access port), similar to JTAG TAP. DP communicates with the AP using packets containing the AP's address.

debug port

The debug port is the interface between the host and the DAP. It also handles the host interface. There are three different debug ports available for accessing the DAP:

• JTAG Debug Port (JTAG-DP) : This port uses the standard JTAG interface and protocol to access the DAP
• Serial Wire Debug Port (SW-DP) : This port uses the SWD protocol to access the DAP.
• Serial Wire/JTAG Debug Port (SWJ-DP) : This port can use JTAG or SWD to access the DAP. This is a common interface on many microcontrollers. It multiplexes the TMS and TCK signals of JTAG to transmit SWDIO and SWDCLK signals respectively. A specific sequence must be sent to switch from one interface to another.

access port

Multiple APs can be added to the DAP as needed. ARM provides two AP specifications:

• Memory Access Port (MEM-AP) : This AP provides access to core memory and registers.
• JTAG Access Port (JTAG-AP) : This AP allows connecting the JTAG chain to the DAP.

debugging

  SWD is only used for debugging (tracing), so it is much simpler than JTAG. The detailed debugging protocol is introduced in the chapter The Serial Wire Debug Port (SW-DP) of "ARM® Debug Interface v5".

Firmware burning

  The implementation of firmware burning is the same as that mentioned in JTAG, which is the SWD protocol, so I won't repeat it here!

pin

  The SWD protocol defines 2 pins and supports star topology in terms of architecture. SWD itself has no fixed voltage, which is determined by the IO power supply voltage of the target board and the target chip. It must be ensured that the voltage of the JTAG signal line is the same as that of the connected chip. :

• SWDIO : Serial Wire Data Input Output. Clock signal sent by the host. Since there is no relationship between the processor clock and the SWD clock, the frequency selection is determined by the host interface.
• SWCLK : Serial Wire Clock. This is a bidirectional signal with data from/to DP. Data is set by the host during the rising edge and sampled by the DP during the falling edge of the SWDCLK signal.

  SWD is actually just a modification/implementation of JTAG for ARM processors. ARM has given common interface layouts in its system and interface design reference documents, which has become a de facto standard. Usually it multiplexes the TMS and TCK signals of JTAG to transmit the SWDIO and SWDCLK signals respectively, allowing the user to use JTAG or SWD.

  In addition to the debug signal, ARM's SWD interface also specifies a dedicated pin that allows the target CPU to output specific data on the dedicated pin through the UART or Manchester protocol. This pin is called SWO. Not all ARM architectures that support SWD support SWO.

reference

1. https://learn.sparkfun.com/tutorials/arm-programming/jtag-and-swd
2. https://embeddedinventor.com/swd-vs-jtag-differences-explained/
3. https://www.corelis.com/education/tutorials/jtag-tutorial/what-is-jtag/
4. https://www.xjtag.com/about-jtag/what-is-jtag/
5. https://research.kudelskisecurity.com/2019/05/16/swd-arms-alternative-to-jtag/
6. https://vlsitutorials.com/jtag-test-access-port-and-tap-controller/
7. https://www.allaboutcircuits.com/technical-articles/introduction-to-jtag-test-access-port-tap/