0

First time delving into hardware reverse engineering and can't seem to connect using JTAG nor SWD. I found two identical devices that I'm trying to understand how they work and see if I can extract the firmware. One device I'm sacrificing to research, the ATSAME70Q21 is a BGA which I removed to help with identifying traces. The board has 10 holes that I've mapped the following pins:

Pin 1 -> +3V3

Pin 2 -> J11 (SWDIO/TMS)

Pin 3 -> F9 (SWCLK/TCK)

Pin 4 -> C10 (TDO/TRACESWO/WKUP13)

Pin 5 -> H12 (NRST) - Low to Reset

Pin 6 -> (GND)

Pin 7 -> M9 (PD19/NCS3/CTS2/UTXD4)

Pin 8 -> M10 (PD18/NCS1/SDCS/RTS2/URXD4)

Pin 9 -> A12 (TDI/PB4)

Pin 10 () -> UNKNOWN

The data sheet is rather confusing, it seems like JTAG is only used for manufacturing and the SW_DP isn't clear what needs to be set, I'm probably just missing it though. From the datasheet: "8.2.1 Serial Wire Debug Port (SW-DP) Pins The SW-DP pins, SWCLK and SWDIO, are commonly provided on a standard 20-pin JTAG connector defined by ARM. For additional information about voltage reference and reset state, refer to the Table 4-1. At startup, the SW-DP pins are configured in SW-DP mode to allow connection with debugging probe. For more details, refer to 16. Debug and Test Features. The SW-DP pins can be used as standard I/Os to provide users more general input/output pins when the debug port is not needed in the end application. Mode selection between SW-DP mode (System IO mode) and general IO mode is performed through the AHB Matrix Special Function Registers (MATRIX_SFR). Configuration of the pad for pull-up, triggers, debouncing and glitch filters is possible regardless of the mode. The JTAGSEL pin is used to select the JTAG boundary scan when asserted at a high level. It integrates a permanent pulldown resistor of about 15 kΩ to GND, so that it can be left unconnected for normal operations. The JTAG Debug Port TDI, TDO, TMS and TCK is inactive. It is provided for Boundary Scan Manufacturing Test purpose only."

Going through the traces, I did find they had a 0 Ohm resistor going to ground for the JTAGSEL pin and right next to it was an empty pad that switched it to VDDIO. I moved that pin but it didn't change anything. The datasheet mentions that to put it into JTAG mode, JTAGSEL (B11) has to be high, TST (H11) has to be high and PD0 (D4) has to be to GND. The board doesn't appear to have an easy way to bring TST high and PD0 to GND. I can upload pictures if that would help.

I've tried using a JTAGulator to identify pins, which is seemed to do quite well but couldn't connect via JTAG. I've also tried a Segger J-Link Edu Mini with no luck.

Anyone have any possible next steps? Any insight would be greatly appreciated.

Datasheet

1 Answer 1

0

It seems the JTAG pins are only intended for boundary scan (e.g. for board connectivity testing), and you should use the SWD pins for debugging.

5
  • Thanks Igor for your response. Yes, I removed components and ran wires to connect everything for the JTAG and as you stated, it had no effect. I can't seem to get SWD to work either. I've connected a logic analyzer and there is nothing happening on the SWD wires either. Anything else I could possibly try? Thanks again!
    – kumaichi
    Dec 4, 2023 at 2:01
  • Have you actually connected a debug probe to SWD pins? There won't be anything happening without a debugger driving the device.
    – Igor Skochinsky
    Dec 4, 2023 at 22:53
  • I have connected the JTAGulator and Hydrabus using OpenOCD but there is nothing coming across while connected to the device via the SWDIO/TMS and SWCLK/TCK.
    – kumaichi
    Dec 5, 2023 at 22:54
  • VTref=3.299V Type "connect" to establish a target connection, '?' for help J-Link>connect Please specify device / core. <Default>: ATSAME70Q21A Type '?' for selection dialog Device> Please specify target interface: J) JTAG (Default) S) SWD T) cJTAG TIF>s Specify target interface speed [kHz]. <Default>: 4000 kHz Speed> Device "ATSAME70Q21A" selected. Connecting to target via SWD Failed to attach to CPU. Trying connect under reset. Cannot connect to target.
    – kumaichi
    Dec 5, 2023 at 23:02
  • I hooked up a logic analyzer between the J-Link and the device and it keeps getting parity errors over and over again:Reset:56 AP RD A:1 Parity:Error! Stop:1! ACK:3! Reset:58 AP WR A:3 Parity:Error! Stop:1! ACK:6! Reset:58 DP RD A:0 ACK:7! Reset:32? Reset:50? DP RD A:3 Parity:Error! Stop:1! ACK:5! AP RD A:2 Stop:1! Park:0! ACK:7! AP WR A:3 Stop:1! ACK:7! DP WR A:3 Parity:Error! Park:0! ACK:7! DP WR A:0 Stop:1! Park:0! ACK:4 Failure
    – kumaichi
    Dec 6, 2023 at 3:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.