Locating ARM jtag port

Hi there,
I have an embedded board with an ARM processor on it. There are also
about 150 "test points" on the board. Does anybody have an idea how I
can locate the JTAG port within all these test points?
I would like to attach a debugger; and before you ask: no, I don't have
any documentation... it's reverse engineering ;-)

Thanks in advance
/Chris

Christian Schleiffer wrote:

> I have an embedded board with an ARM processor on it. There are also
> about 150 "test points" on the board. Does anybody have an idea how I

There's no generic way. Is it a custom chip, or a standard part - if
the latter, do you have the pinouts for it?

Christian Schleiffer wrote:
> Hi there,
> I have an embedded board with an ARM processor on it. There are also
> about 150 "test points" on the board. Does anybody have an idea how I
> can locate the JTAG port within all these test points?
> I would like to attach a debugger; and before you ask: no, I don't have
> any documentation... it's reverse engineering ;-)
> 
> Thanks in advance
> /Chris

What are the part numbers of the ships ??
How many chips are on the board ??
Whats the number of pins on each side of the largest chip ?

Please list all the above or at least post a pics.

larwe wrote:
> There's no generic way. Is it a custom chip, or a standard part - if
> the latter, do you have the pinouts for it?

Unfortunatley it seems to be a custom chip. At least I can't find
anything on the web => no pinout (except for the pins I can trace to the
flash memory and DRAM chip)

Donald wrote:

> What are the part numbers of the ships ??
I don't have the board at hand right now. But, I am pretty sure it is a
custom chip, and I've signed an NDA for that project. Publishing that
number would make a too obvious link to the device, I guess.
Well, the other chips on the board are well know standard parts and
don't have JTAG ports... there is no JTAG chain.

> How many chips are on the board ??
Four: CPU, flash, DRAM, EEPROM
Flash and DRAM are connected with independent busses, EEPROM is a serial
type.

> Whats the number of pins on each side of the largest chip ?
"Largest chip"... do you mean by area? gates? pin count? Well, the CPU
has a BGA package. I would have to rip that off the board to count the
contacts.

> Please list all the above or at least post a pics.
Hmm, hope that can help!?! I'll have access to the board on monday
morning again.

Christian Schleiffer wrote:

> > There's no generic way. Is it a custom chip, or a standard part - if
> > the latter, do you have the pinouts for it?
>
> Unfortunatley it seems to be a custom chip. At least I can't find

Then forget about it. There is no generic way of tracing out the JTAG
lines.

It is _probable_ that these lines run directly to the micro and nothing
else, besides possibly a pullup resistor and (in the case of nTRST)
possibly a cap to ground. Beyond that, there's nothing to help you
guess what goes where.

In mass-market applications like set-top boxes, which is what I guess
you have there, it is not usual to program via JTAG at ICT - the flash
chips are normally preprogrammed externally. So the JTAG interface
might not even come to test points.

I assume you've already searched the board looking for appropriately
sized groups of contacts or an unpopulated space for a header.

Do you even know it is an ARM? Numerous proprietary 32-bit RISC cores
used in multimedia applications, you know.

Christian Schleiffer wrote:

> custom chip, and I've signed an NDA for that project. Publishing that
> number would make a too obvious link to the device, I guess.

If the part number starts with ES, it is not an ARM...

>>> There's no generic way. Is it a custom chip, or a standard part - if
>>> the latter, do you have the pinouts for it?
>> Unfortunatley it seems to be a custom chip. At least I can't find
> 
> Then forget about it. There is no generic way of tracing out the JTAG
> lines.
> 
> It is _probable_ that these lines run directly to the micro and nothing
> else, besides possibly a pullup resistor and (in the case of nTRST)
> possibly a cap to ground. Beyond that, there's nothing to help you
> guess what goes where.

Damn, that's what I feared.

> In mass-market applications like set-top boxes, which is what I guess
> you have there, it is not usual to program via JTAG at ICT - the flash
> chips are normally preprogrammed externally. So the JTAG interface
> might not even come to test points.
> 
> I assume you've already searched the board looking for appropriately
> sized groups of contacts or an unpopulated space for a header.

Yes, my first try :)

> Do you even know it is an ARM? Numerous proprietary 32-bit RISC cores
> used in multimedia applications, you know.

I have an disassembly of the flash memory and some logic analyzer traces
of the flash chip... it is an ARM.

>> custom chip, and I've signed an NDA for that project. Publishing that
>> number would make a too obvious link to the device, I guess.
> 
> If the part number starts with ES, it is not an ARM...

No, it doesn't. It is an ARM. That's about the only thing I know of this
chip.

Christian Schleiffer wrote:

> I have an disassembly of the flash memory and some logic analyzer traces
> of the flash chip... it is an ARM.

So what are you trying to do - capture smartcard transaction data in
mid-stream?