BP Target
----- ----------
Vpu pin 14 (3.3v)
GND pins 2,4,6,8,10
CS pin 7 (TMS)
MISO pin 5 (TDO)
MOSI pin 3 (TDI)
CLK pin 9 (TCK)
VIO is the targets reference voltage ...
better NOT connect it to the Vpu pin (3.3V) of the Bus Pirate!!!!!
However, you could connect Vpu to the ADC (voltage measurement probe) pin on the Bus Pirate
to check for the voltage level of the target board (D/d command).
The Bus Pirates AUX signal can be used to control the system reset on the target board (nS)RST* or
the TAP controller reset signal (n)TRST but this is optional.
MIPS' JTAG implementation EJTAG is specified in "MIPS® EJTAG Specification", document number MD00047,
chapter 10 - "Off-Chip and Probe Interfaces".
The document can be downloaded from MIPS website for free after registering. The Atheros WNPUs (AR5000,
AR7000 and AR9000 families) implement the EJTAG interface as specified by MIPS for the processor (side). It's
an essential document if you want to understand the EJTAG interface and functionality in detail.
Pinout of the EJTAG header as defined by MIPS (top view):
1 nTRST oo GND 2
3 TDI oo GND 4
5 TDO oo GND 6
7 TMS oo GND 8
9 TCK oo GND 10
11 nSRST oo N.C. 12
13 DINT oo VIO 14The EJTAG signals of interest on the target/router board:
| TCK | Test Clock Input is the clock that controls the updates of the TAP
controller and the shifts through the Instruction or selected data register(s).
Both the rising and the falling edges of TCK are used. | Input | Required with probe connection |
| TMS | Test Mode Select Input is the control signal for the TAP controller.
This signal is sampled at the rising edge of TCK. | Input |
| TDI | Test Data Input has the data shifted into the Instruction or data register.
This signal is sampled on the rising edge of TCK. | Input |
| TDO | Test Data Output has the data shifted out from the Instruction
or data register. This signal is changed on the falling edge of TCK. | Output |
| nTRST* | Test Reset Input is used for the TAP reset of the TAP controller, Instruction register,
and EJTAGBOOT indication. TAP reset is applied asynchronously when low. | Input | Optional with probe connection |
| nSRST* | nSRST* is the system reset of the target board. When the probe asserts RST* low,
the result is either a reset (recommended) or soft reset of the processor. No reset
is applied when the RST* is undriven (3-stated from the probe). | Input | Required with probe connection (why?) |
| VIO | Voltage Sense for I/O indicates if target power is applied, and indicates the voltage
level for the probe signals. | Output | Required with probe connection |
* Input/Output (direction applies) to/from the target board/WNPU. The other signals are not needed
unless you plan to debug/emulate the WNPU.
In fact you will only need to connect TDI, TDO, TMS, TCK and (one) GND pin to the Bus Pirate as follows
((nS)RST* or (n)TRST* are optional) :
Bus Pirate EJTAG connector
connector on target/router
MOSI ---> TDI
MISO <--- TDO
CS ---> TMS
CLK ---> TCK
AUX ---> (nS)RST* or (n)TRST* <-- optional
GND ---- GNDI am inclined to say that the description of the (n)TRST* signal on the
JTAG page of the MIPS Wiki appears
to be rather confusing:
To conform to MIPS EJTAG specifications this pin should be pulled to the ground via resistor ~1KOhm to keep TAP in reset state w/o probe attached.
If probe does not control this pin, you need just to feed logical "1" to nTRST pin or pull this to the +VCC via ~300Ohm resistor.
The EJTAG (and JTAG) specification requires that the TAP controller is reset at power on! This is usually
accomplished by a 1.0 kΩ pull-down resistor that holds (n)TRST always down (unless a JTAG probe is
connected). However, if (n)TRST* is always "1" (because it's connected to some external power, i.e.
Bus Pirate ) then (n)TRST* will not be driven low during power-up. Therefor (n)TRST* must be connected
to +Vcc
on the target board via a 300Ω pull-up resistor (and the fingers crossed that Vcc stays low long
enough during power-up). After power-up (n)TRST* must be "1" for the JTAG interface to work properly
while a probe is attached.
Regarding the questions about pull-ups/pull-downs for the lines robots already gave a good hint while
I was writing this up and checking the details: Use the Bus Pirate to check the states/levels of (nS)RST*,
(n)TRST*, TDO, TDI, TMS, TCK (and VIO) with the Bus Pirates voltage measurement probe (ADC). This will
tell you which signals have pull-ups/pull-downs on the target board.
I have pulled following general info from Mentor's "
JTAG DEBUG – EVERYTHING YOU NEED TO KNOW"
white paper (consider the
MAJIC probe to be the Bus Pirate):
REGARDING LAYOUT OF THE BOARD'S JTAG LINES:
▪▪ The TRST* signal [JTAG TAP Reset] connection to the processor is optional, but it’s recommended that the
connector pin be pulled up regardless of whether it is connected to the processor. It’s acceptable to pull down
the TRST* pin, providing that you configure the MAJIC probe to enable its TRST* outputdriver (which is
the default). In this case, however, you will not be able to use TRST* for sensing the target voltage level.
▪▪ Some CPU datasheets recommend a pull-down on certain JTAG signals instead of a pull-up. The MAJIC
probe can support that recommendation, but the signals should not be left floating.
REGARDING RESET MANAGEMENT:
▪▪ The RST* signal should be connected so that the target system (including the CPU) will be reset when it is
asserted (low) by the MAJIC probe, but will not result in TRST* (JTAG reset) being asserted on the target
processor. This allows the MAJIC probe to reset the target system upon your command. When both cold and
warm resets are provided, warm reset is recommended. This is an optional feature, but RST* should be pulled
up to the target’s I/O voltage regardless of whether the reset feature is implemented.
▪▪ The RST* signal is an open-collector signal, so you must provide a pull-up for this signal. It may be tied
directly to the reset switch or power-up reset circuit on your board (unless that results in TRST* being
asserted as well).
Please Note: RST* (Board Reset) and TRST* (Tap Reset) should never be tied together.
If the designers of your router board followed the guidlines given in the MIPS EJTAG specification then
no pull-up/pull-down resistors will be needed (because they should be either in the Atheros WNPU
and/or on the board). However, since every cent counts in SOHO products designers often remove all
components from the production units that are not absolutely needed for the units to function.
Instead they design special test/JTAG adapters for production/testing/service and put those
components inside the adapter.
According to the MIPS (and JTAG) specification (n)TRST* must be pulled low (to GND) via a 1.0 kΩ
resistor to assure that the TAP controller (on/inside the CPU/WNPU) is reset upon power-up.
(nS)RST* must have a pull-up resistor (1.0 kΩ or more). I'd expect those resistors to be installed
on the board so you won't have to do anything if you do not connect/use (n)TRST and (nS)RST.
