Identifying undocumented JTAG pinout?

[pcee]

I’m looking at a board that has a few test points scattered around the board, including a cluster of 6, and I suspect some of them collectively make up a JTAG interface.

Is there any good way to identify the correct pinout?  Any telltale signals that I should look for?  First I plan to rule out anything connected to ground.

[RoGeorge]

Usually the JTAG pins are fixed on a chip's pinout, so if you can identify the main chip (I assume that would be a FPGA or an MCU), then search for its datasheet, then test the continuity between the 6 testing points and the main chip.

If there are ,ore than one JTAG enabled chip, they are usually daisy chained to the same JTAG connector.

Another hint might be to identify the GND pin in the JTAG connector, then the Vcc, and see if their order in the 6 pins connector correspond with the JTAG programmer's pinout.

If you can attach a clear picture of the board, somebody might recognize the board and the connector.

[ataradov]

First if all find ground and power. This should be easy enough.

Weakly pull-up/down all the pins and find the inputs/outputs. Just make sure to override whatever pull-up/down resistors may be on the board.

Power cycle/reset the device.

Then monitor all pins on the  logic analyzer and drive them one by one with a clock (something slow, like 1 kHz).  If there is a JTAG, one of the pins will clock out a device ID. This pin would be TDO and the clock pin would be TCK. If that happens, then the remaining two can just be found experimentally with a JTAG probe.

And you only really need to monitor one previously identified output for TDO.  But just in case monitor all of them.

[pcee]

Weakly pull-up/down all the pins and find the inputs/outputs. Just make sure to override whatever pull-up/down resistors may be on the board.

I understood everything else, but how would this work?  Is the idea that any pin that I can successfully pull both high and low is an input, and any pin that I can’t is an output that the chip is driving?

[ataradov]

Yes, if the pin is driven by the device, it would be able to override your pull-ups and pull-downs.

But really, all you need to do is observe all the pins with a logic analyzer and use a clock source with current limiting resistor and supply that clock to all the pins. If you find a pin that has some data on it other than the clock pin, you automatically identified both TCK and TDO.

[Renate]

I use a wiggler program.
It configures a pin as GPIO input with high pullup, then low pullup at a 100 Hz or so.
Then you look for the point that's wiggling.

[ataradov]

I use a wiggler program.

This may not work if there are relatively strong pull-up or pull-down resistors on the board, for example. Internal MCU resistors are typically in the 100 kOhm range, on the board it is not uncommon to see 10 kOhm.

For this wiggler setup it is better to use an output driven low and high with a series resistor with a low value (< 1kOhm, probably close to 330 Ohm). This would be strong enough to override any other pull resistors, but not strong enough to cause any issues with conflicts.

[RoGeorge]

To identify which ones are the input pins, I simply connect the oscilloscope to the pin, then touch first the GND of the probe to discharge any electrostatic charges I may have, and then touch the pin with the finger.

The finger will induce more 60Hz wiggling on an input pin than on an output pin.  Seems brutal, but if you touch the GND first it should be safe for the board.

[ataradov]

Nobody would leave JTAG pins floating, they would be pulled up or down internally or externally.

[Renate]

I use a wiggler program.

This may not work...

It's always worked fine for me.
Of course since everything is current limited you can get away with just wiggling an output too.
You might have to do that if you only have gpio-sysfs to play with.

[Fred27]

I found a Raspberry Pi program called JTAGenum helped narrow down the possibilities to something more manageable for checking by hand.