[dorkbotpdx-blabber] Bus Pirate for JTAG capture?

[Paul Stoffregen]

Does anyone know if the Bus Pirate board (the version from the recent
workshop) can be used to passively listen to JTAG?

Searching turns up lots of info about using the Bus Pirate for
JTAG-based chip programming, where it transmits on TCK, TDI, TMS and
receives on TDO, but nothing about receiving on all 4 signals, to
capture TDI, TDO & TMS every time TCK changes.

_______________________________________________
dorkbotpdx-blabber mailing list
dorkbotpd...@dorkbot.org
http://music.columbia.edu/mailman/listinfo/dorkbotpdx-blabber

[Eric Garner]

Sounds like a job for a logic analyzer. I have a USB based one that you can borrow if you would like. Let me know off list

Eric

Sent from my Banana Jr.(tm) mobile device

[Jim Larson]

This link seems to address your interest:
http://events.ccc.de/congress/2010/wiki/Embedded_Analysis

Additionally, it's pretty good on uses for the Bus Pirate as a scanner.

> -----
> No virus found in this message.
> Checked by AVG - www.avg.com
> Version: 2012.0.2171 / Virus Database: 2437/5170 - Release Date: 08/01/12

[Paul Stoffregen]

On 08/01/2012 10:03 AM, Eric Garner wrote:
> Sounds like a job for a logic analyzer. I have a USB based one that you can borrow if you would like. Let me know off list

Thanks.

I ended up building some hardware for the task, using a AM7203 FIFO chip
clocked by the TCK signal on the input side and code running on a Teensy
to clock the FIFO's output side and send stream it continuously to my PC.

It turns out the clock is about 300 kHz in bursts, but I need to capture
the 3 signals plus one other pin on every TCK clock cycle for about 30
seconds. I've heard there are smart logic analyzers that only write to
memory when changes happen. One of those would probably work great.
But if it's logs at a fixed rate (like the logic analyzer in my Rigol
scope), it would need to sample at least at 1 MHz for 30 seconds. I'm
pretty sure my scope's buffer is 512K or 1M... not nearly long enough!

Luckily, this JTAG host I'm watching isn't a fast one. If it has
sustained MHz speed clocking, continuously capturing it would be much
harder, probably needing a high-end logic analyzer.

Now I have some huge files to try deciphering into scan chains, register
accesses and (maybe) useful understanding.....


From Jim:

> This link seems to address your interest:
> http://events.ccc.de/congress/2010/wiki/Embedded_Analysis
>
> Additionally, it's pretty good on uses for the Bus Pirate as a scanner.

All that stuff is using the Bus Pirate to probe JTAG chips.


> Digging further into the BP web site, looks like the Bus Blaster is
> what you'd really want to monitor JTAG at speed. The Pirate isn't
> really fast enough.

That too is meant as a host to drive the JTAG signals. I could find
anything about listen passively to JTAG communication between a host and
a chip.


I did find the Dangerous Prototypes Logic Sniffer. I couldn't find any
info as to what size buffer memory it implements (whatever's inside that
FPGA... can't be megabytes), and if it supports continuous streaming.
The Sump software appears to be designed for a fast capture on the board
and slow transfer to the PC after the capture. This page has some
not-very-encouraging specs:

http://dangerousprototypes.com/docs/Logic_Sniffer_102

24K max samples is pretty tiny! Then again, the hardware is cheap.
Maybe they'll someday make a Logic Sniffer with a bigger FPGA and a DRAM
buffer? That would be pretty awesome.