Chapter 3. Usage

3.1. Quick start

3.1.1. Run the software

Connect your JTAG adapter between your PC and target device and turn on your device.

To run UrJTAG type "jtag" and press Enter; jtag should start and display some initial information. Output should end with a line like this:

WARNING: UrJTAG may damage your hardware!
Type "quit" to exit, "help" for help.

3.1.2. Configure the cable

Type "help cable" for a list of supported JTAG cables.

Type the "cable" command followed by the cable name and possibly further arguments for cable configuration. Example:

jtag> cable EA253 parallel 0x378
Initializing ETC EA253 JTAG Cable on parallel port at 0x378

See the section about the "cable" command for details and USB support.

3.1.3. Detect parts on the JTAG chain

Type "detect" at the jtag command prompt:

jtag> detect

Your output should look like this:

IR length: 5
Chain length: 1
Device Id: 01011001001001100100000000010011
  Manufacturer: Intel
  Part:         PXA250
  Stepping:     C0
  Filename:     /usr/local/share/urjtag/intel/pxa250/pxa250c0

If you get empty output or an error message your JTAG adapter is not connected properly, or your target board doesn’t work, or it is turned off.

The "detect" command is required before all other commands.

3.1.4. Print current JTAG chain status

jtag> print chain
 No. Manufacturer Part   Stepping Instruction Register
---------------------------------------------------------
   0 Intel        PXA250 C0       BYPASS      BR

3.1.5. Sample device pin status

jtag> instruction SAMPLE/PRELOAD
jtag> shift ir
jtag> shift dr
jtag> dr
1000110010000010000110010111111111111111111001101110...
jtag> print chain
 No. Manufacturer Part   Stepping Instruction    Register
------------------------------------------------------------
   0 Intel        PXA250 C0       SAMPLE/PRELOAD BSR
jtag> get signal BOOT_SEL[0]
BOOT_SEL[0] = 0
jtag>
Note: BSR is "Boundary Scan Register"

3.1.6. Burn flash connected to the part

jtag> flashmem 0 brux.b
0x00000000
Note: Supported configuration is 2 x 16 bit only
BOOT_SEL: Asynchronous 32-bit ROM
2 x 16 bit CFI devices detected (QRY ok)!
program:
block 0 unlocked
erasing block 0: 0
addr: 0x00002854
verify:
addr: 0x00002854
Done.
jtag>

or:

jtag> flashmem msbin xboot.bin
Note: Supported configuration is 2 x 16 bit only
BOOT_SEL: Asynchronous 32-bit ROM
2 x 16 bit CFI devices detected (QRY ok)!
block 0 unlocked
erasing block 0: 0
program:
record: start = 0x00000000, len = 0x00000004, checksum = 0x000001EB
record: start = 0x00000040, len = 0x00000008, checksum = 0x000001B0
record: start = 0x00001000, len = 0x00002B30, checksum = 0x00122CAB
record: start = 0x00004000, len = 0x00000160, checksum = 0x0000684B
record: start = 0x00005000, len = 0x00000054, checksum = 0x000008EE
record: start = 0x00005054, len = 0x00000030, checksum = 0x00000DA9
record: start = 0x00000000, len = 0x00001000, checksum = 0x00000000
verify:
record: start = 0x00000000, len = 0x00000004, checksum = 0x000001EB
record: start = 0x00000040, len = 0x00000008, checksum = 0x000001B0
record: start = 0x00001000, len = 0x00002B30, checksum = 0x00122CAB
record: start = 0x00004000, len = 0x00000160, checksum = 0x0000684B
record: start = 0x00005000, len = 0x00000054, checksum = 0x000008EE
record: start = 0x00005054, len = 0x00000030, checksum = 0x00000DA9
record: start = 0x00000000, len = 0x00001000, checksum = 0x00000000
Done.
jtag>

3.1.7. Non-standard flash commands

Erasing and programming flash devices is covered by standard procedures in UrJTAG. Apart from these, many flash chips implement a lot more functionality via dedicated commands that vary from between manufacturers and device families. UrJTAG can’t cover them all natively.

It’s however possible to send any command stream to the flash by using the poke and peek commands. You just need to clarify two things:

  1. base address of the flash (BA) it’s the same that’s used for detectflash

  2. data width, x8 or x16 defined by the width of the bus where the flash is attached

Next look up the address/data pairs for the command in question. The data sheet for your particular flash should document all commands in a table e.g. If your flash is attached in x16 mode, the address must be shifted by one position. Addresses in x8 mode are not affected.

The "Read Manufacturer ID" command in x16 mode would look like

poke BA+(0x555*2) 0xaa
poke BA+(0x2aa*2) 0x55
poke BA+(0x555*2) 0x90
peek BA+(0x000*2)

Note that the calculations must be done beforehand. UrJTAG can’t evaluate expressions on the command line.