A Programming Flash Memory through the Intel386™ EX Embedded
Contents
1. Function to get ID string from the Intel tm 386EX Chip void Get JTAG Device ID 1 const char p 01010101010101010101010101010101 Dummy string will change value after Send Data executes char ID ID String Length strcpy ID p Fill with dummy string Send Instruction IN strlen IDCODE IDCODE Do NOT overwrite Instr Because it resides in the Fixed string area Send Data strlen ID ID Flip ID String strlen ID ID Makes MSB first in array printf nThe JTAG CPU Chip Identifier is s n ID printf For Intel386 tm EX it should be 00000000001001110000000000010011Nn Function to fill the JTAG array with zeros and set all as inputs void Fill JTAG PJTAGdata P Configures pins for typical configuration P15 Out Low ADS Out Low BHE Out Low BLE Out Low WR Out Don t Care RD Out Don t Care WRD Out Low DC Out High MIO Out High UCS Out Don t Care LBA Out Low All other entries configured as inputs Dir Bit Output i 2 Data Bit i 241 KEEN unsigned i for i 0 i lt BSR Length 1 i P i 0 P P15 2 1 P P15 2 1 ente Make Vpp active to program FLASH P ADS 2 1 P ADS 2 1 0 A 9 AP 720 Table A 1 Program Source Code Sheet 10 of 15 P BHE 2 19 P BHE 2 1 T BHE and BLE active for 16 Bit P BLE 2 1 P BLE 2 1 0 P WR 2 xor Not necessary to2. Ready to write data n Function to program the data in the file into the FLASH unsigned long int Program Flash Data Code below outputs data from binary file to the FLASH Outputs words A data_start_address gt gt 1 So that starting point can be remembered in fopen input_file rb printf nWriting input file data into FLASH An printf Please be patient May take 2 10 seconds per kilobyte Mn vhile c fgetc in EOF Code to make a word from two chars new word 0 Initializes the two byte word new word new word c Puts first byte into low 8 bits c fgetc in Gets second bytes high part 0 Initializes temporary space high part high part c Puts second byte into low 8 bits high part high part 8 Shifts second byte up 8 bits to top new word new word high part Combines low 8 and high Flash Write PinState A 0x40 Program set up command Flash Write PinState A new word Writes 16 bit word May add the following section to do status checks for each write Not necessary for the very slow speed of parallel port Will severely inhibit performance do Flash Write PinState A 0x70 Check Status Register 17 Flash Read PinState A for each word while RX amp 0x80 FALSE Wait Until Ready again TRA Increments address in word mode printf Fi
3. define FLT 43 define STXCLK 44 define INT7 45 define INT6 46 define INT5 47 define INT4 48 define TMRGATE2 49 define TMROUT2 50 A 2 AP 720 Table A 1 Program Source Code Sheet 3 of 15 define NMI 51 define PEREQ 52 define P37 53 define P36 54 define P35 55 define P34 56 define P33 57 define P32 58 define SSIOTX 59 define SSIORX 60 define SRXCLK 61 define P31 62 define P30 63 define SMI 64 define A25 65 define A24 66 define A23 67 define A22 68 define A21 69 define A20 70 define A19 71 define A18 72 define A17 73 define A16 74 define A15 75 define A14 76 define A13 77 define A12 78 define All 79 define 80 define A9 81 define A8 82 define AT 83 define A6 84 define A5 85 define A4 86 define A3 87 define A2 88 define A1 89 define NA 90 define ADS 91 define BHE 92 define BLE 93 define WR 94 define RD 95 define 558 96 define READY 97 define WRD 98 define DC 99 define MIO 100 define TRUE 1 define FALSE typedef unsigned int word 16 Bit word typedef unsigned char byte 8 Bit Byte typedef char Pchar typedef Pchar PJTAGdata JTAG Data array null term string const word BSR Length 202 bits in JTAG BSR string 101x2 const word ID String Length 32 bits in JTAG CPU ID String unsigned long int A Stores address data A 3 AP 720 Tab
4. pit bit bit pit bit bit bit bit bit bit bit bit bit bit B 2 Intel Table B 1 BSDL File Sheet 3 of 10 AP 720 A19 inout bit 18 52 inout bit A17XCAS1 i inout bit 16 5 inout bit A15 inout bit A14 inout bit A13 inout bit A12 inout bit All inout bit A10 inout bit A9 inout bit AB8 i inout bit A7 inout bit A6 inout bit A5 inout bit A4 inout bit A3 inout bit A2 inout bit Al inout bit NAbar inout bit ADSbar inout bit BHEbar inout bit BLEbar inout bit WRbar inout bit RDbar inout bit BS8bar inout bit READYbar inout bit WXRbar inout bit DXCbar inout bit MXIObar S inout bit TCK in bit TDI in bit TMS in bit TRSTbar S in bit TDO E out bit linkage bit vector 0 to 10 VSS linkage bit vector 0 to 12 use STD 1149 1 1990 all This list describes the physical pin layout of all signals attribute PIN MAP of i386 EX Processor entity is PHYSICAL PIN MAP constant PQFP 132 PIN MAP STRING Define PinOut of PQFP DLS 23 6 amp D14 22 amp 013 21 amp D12 20 amp D11 19 amp D10 gt 18 amp D9 16 amp D8 14 amp D7 13 74 B 3 AP 720 Table B 1 BSDL File Sheet 4 of 10 D6 D5 D4 D3 D2 Di 00 LBAbar LCSbar UCSbar P27XCTSO P26XTXDO P25XRXDO D
5. whatsoever including infringement of any patent or copyright concerning the included software Intel Corporation makes no warranty for the use of this software and assumes no responsibility for any errors which may appear in this document nor does it make a commitment to w update the information contained herein Copyright C Intel Corporation 1995 All Rights Reserved A 1 AP 720 Table A 1 Program Source Code Sheet 2 of 15 kkkkkkkkkkkkkkkkkkkkkkkkk GLOBAL DECLARATIONS w x finclude stdio h finclude string h finclude stdlib h include conio h Definitions of JTAG BSR pins for sequence for Intel 386 EX CPU Note MIO shifted out LAST D15 first kk EES define D15 0 define D14 1 define D13 2 define D12 3 define D11 4 define D10 5 define D9 6 define D8 7 define D7 8 define D6 9 define D5 10 define D4 1 1 define D3 12 define D2 13 define D1 14 define DO 15 define LBA 16 define 56 17 define 5 18 define P27 19 define P26 20 define P25 21 define DACKO 22 define P24 23 define P23 24 define P22 25 define P21 26 define P20 27 define SMIACT 28 define 3891 29 define DRQ0 30 define WDTOUT 31 define EOP 32 define DACK1 33 define P17 34 define RESET 35 define P16 36 define P15 37 define P14 38 define 13 39 define P12 40 define P11 41 define P10 42
6. 17 BC 6 D7 bidit X 16 Z 6 18 BC 2 4 contfol 0 amp 19 BC 6 D6 bidir X 18 0 Z amp 20 BC 2 control 0 amp 21 BC 6 D5 bidir X 20 Z 6 22 2 control 0 5 23 BC 6 D bidir X 22 0 Z amp 24 BC 2 control 0 5 25 6 bidir X 24 Z amp B 6 AP 720 Table B 1 BSDL File Sheet 7 of 10 26 BC 2 control 0 amp NT BC 6 D2 bidir X 26 0 2 8 28 BC 2 control 0 amp 29 BC 6 D1 bidir X 28 0 Z amp 30 RE e control y 31 BC 6 D bidir X 30 0 2 5 32 BC 2 control 0 33 BC 6 LBAbar bidir X 32 0 Z amp 34 BG 2 control 0 amp 35 BC 6 LCSbar bidir X 34 2 6 36 BC 2 control 0 317 6 UCSbar bidir X 36 Z 6 36 BC 2 control 0 amp 39 BC 6 P27XCTSO bidir X 38 0 Z amp 40 BC 2 control 0 41 BC 6 P26XTXD bidir X 40 Z s 42 BC 2 control 0y 5 43 BC 6 P25XRXDO bidir X 42 Z s 44 BC 2 control 0 amp 45 BC 6 DACKObarXGCS5bar bidir X 44 0 Z amp 46 BC 2 control 0 amp 47 BC 6 P24XGCS4bar bidir X 46 Z 6 48 BC 2 control 0 49 BC 6 P23XGCS3bar bidir X 48 2 6 b BC 25 control 0377 amp ie BC 6
7. 19 b N 6280 HOLO3NNOO dN dv 7 09 65 4 N oNnanooaa f 8 ZS 72286 81 98 SS Pay Ger raea d l n vorz 29 19 04 ca uy p ISHI 7 Y SALE 57 yasa 9t vv v 102 Mm ev ly erh Ov 65 9c 61 oer 1 86 6 p 95 95 Dier ve ce el vic YVC CT TT cE LE Gg BAe DE 191 Oz 1 08 62 AGONTS H 242 vz Loy 2 6 380 8 9 9 82 12 era klaz iye SL wee o KIM 014 95 52 xol zi PVL V MOL 79 6 ve 62 RISUL EE EV 9 av 13838 ez 22 12 SAL gi CAL CVE SWL 27 IV Tz viua od _ ie zeuay H33dng Amd TOL ob 0 MHO WO 21 8 9 99 80 15 MM Lr 6 o 3M 019 VOI ep 7 L FIM Weg Mod 4 IM df V SAL FEM HS 90415 Wied OGL YO LOANNOO Zar c opa Nu Figure 2 TAP Parallel Port Interface AP 720 3 2 JTAG Software Interface This section details the operation of the various software routines that use the Test Access Port to program data into the Boot Block flash The source code for the executable program TAPLOADR EXE which contains both inline assembly routines as well as C language functions is shown in Appendix A The software demonstrates how to Configure and modify the status of pins for data input and output Shift in the values necessary to perform I O to the flash device Perform operations such as status checks and data UO 3 2 1 Hardware Cons
8. 2 2 522 11 5 0 CONCLUSION E 12 6 0 RELATED INFORMATION 55 5 2 2 enn U I mama mara maa aaa eee ana isin 12 APPENDIX A PROGRAM SOURCE CODE APPENDIX B Intel386 EX Embedded Processor BSDL File FIGURES Figure 1 TAP Controller Finite State Machine 3 Figure 2 TAP Parallel Port Interface enne nennen ennt nein adi 7 TABLES Table 1 Test Logic Unit Inistr ctions iuiii cnn s s t tre ttt rre rent ed 4 Table 2 Boundary scan Register Bit Assignments 25 Table 3 Device Identification Codes seen nennen R Rs nennen nennen nnn 6 Table 4 TAPLOADER EXE Order of Execution nennen nennen 10 Table 5 TAP Flash Programming Sample Timings eee 11 Table 6 Related Intel Documents U U ee eee eee nennen etn 12 Table A 1 Program Source Code a cnm Ur Ru ass DIRE x A 1 Table B 1 BSDIEEile rene n un es E B 1 Intel 1 0 INTRODUCTION This application note describes a simple method for programming data into flash memory using a standard JTAG Joint Test Action Group port specified by IEEE 1149 1 The JTAG device used in this c
9. all pins in the Boundary Scan Register e The valid and reserved JTAG unit opcodes The expected contents of the IDCODE register shown also in Section 2 2 2 for the Intel386 EX embedded processor A description of the BSR contents The BSDL file may be incorporated into software which uses the JTAG port for testing or programming functions BSDL is a de facto standard recently approved by the IEEE for describing essential features of IEEE 1149 1 b compliant devices A copy of the Intel386 EX embedded processor BSDL file is shown in Appendix B ntel AP 720 Table 2 Boundary scan Register Bit Assignments Bit Pin Bit Pin Bit Pin Bit Pin 0 M IO 25 1A15 50 TMROUT2 75 P22 1 D C 26 A16 CAS0 51 TMRGATE2 76 P23 2 W R 27 A17 GAS1 52 INT4 TMRCLKO 77 P2 4 3 READY 28 A18 CAS2 53 INT5 TMRGATEO 78 DACKO 4 BS8 29 A19 54 INT6 TMRCLK1 79 1 P2 5 RXDO 5 RD 30 A20 55 INT7 TMRGATE1 80 P2 6 TXDO 6 WR 31 A21 56 STXCLK 81 P27 7 BLE 32 A22 57 FLTK 82 UCS 8 BHE 33 A23 58 1 0 83 CSS REFRESH 9 ADS 34 A24 59 P1 1 84 LBA 10 35 A25 60 1 2 85 DO 11 A1 36 SMI 61 1 3 86 1 12 2 37 P3 0 TMROUTO 62 1 4 87 2 13 A3 38 P3 1 TMROUT1 63 P1 5 88 14 A4 39 SRXCLK 64 P1 6 HOLD 89 4 15 A5 40 SSIORX 65 RES
10. equipment to the fine pitch IC packages replacing socketed broader pitch parts becomes less feasible Furthermore the design of mobile equipment with even smaller form factors and more stringent shock tolerance requirements does not allow the designer to use sockets at all The components in this case must be soldered directly onto the board to reduce manufacturing costs improve reliability and decrease the AP 720 space required by the hardware Additionally Just In Time manufacturing requirements make it desirable to solder unprogrammed devices such as flash memory onto printed circuit boards This allows designers to customize the boards in their final stage while reducing the amount of inventory that is required by the use of preprogrammed devices These constraints make the programming of bootstrap software and other firmware an even more formidable task than in the past It is now desirable to download these integral pieces of the product into initially unprogrammed memories on the board in order to have the microprocessor up and running when it comes time to develop test and manufacture systems which take advantage of the latest advanced technologies A good solution is to use a simple flash memory programming device that uses the Test Access Port TAP found on JTAG compliant devices 2 0 BACKGROUND INFORMATION Designers unfamiliar with the features of the IEEE 1149 1 specification the Intel386 EX embedded processor o
11. ke Intel Corporation makes no warranty for the use of its products and assumes no responsibility for any errors which may appear in this document nor does it make a commitment to update the information contained herein I kk ee Rok III ICICI Ro E HE AE KE E HE AE KE E AE AE AE E AE AE EE Boundary Scan Description Language BSDL Version 0 0 is a de facto standard means of describing essential features of ANSI IEEE 1149 1 1993 compliant devices This language is under consideration by the IEEE for formal inclusion within a supplement to the 1149 1 1990 standard The generation of the supplement entails an extensive IEEE review and a formal acceptance balloting procedure which may change the resultant form of the language Be aware that this process may extend well into 1993 and at this time the IEEE does not endorse or hold an opinion on the language ke e ek ek ek e kk ek ke kk kk ek I ke kk kk kk ke kk kk kk ke kk kk kk ke ke ke kk kk ek ke kk kk I kk koe koe koe koe Intel386 TM EX Processor BSDL Model File NOT verified electrically Rev 0 4 14 Sep 1994 The following list describes all of the pins that are contained in the E3D entity i386 EX Processor is generic PHYSICAL PIN MAP string PQFP 132 port D15 inout bit D14 inout bit D13 inout bit D12 inout bit D11 inout bit D10 inout bit D9 inout bit D8 inout bi
12. necessary to use one of the provided means to return the TAP state machine to Test Logic Reset If the chosen implementation uses the Restore Idle function rather than the Reset JTAG routine it is advisable to tie an inverted CPU Reset signal to the TRST input of the processor This guarantees that the TAP relinquishes control of all the controlled CPU pins upon a system reset If the Reset JTAG function is used care must be taken to reset the system immediately after TRST is asserted 3 2 2 Assembly Language Routines The heart of the software that allows you to program flash through the JTAG port is contained in the assembly routines which control the JTAG unit of the Intel386 EX embedded processor via the parallel port of a PC These routines have been implemented as inline assembly code to simplify the development process and the clarity of the software They use a set of bit masks and variables shown in the first section of Appendix A under the heading Assembly Language Variables A description of each function is shown below Reset JTAG Resets the TAP to the Test Logic Reset state by toggling the TRST signal This signal is optional in IEEE 1149 1 but has been provided on the Intel386 EX embedded processor Alternately the same intel 3 2 3 function is provided by five consecutive TCK periods with TMS held high See Restore Idle below for more details Restore Idle Resets the TAP to the Test Logic Reset stat
13. state machine that is capable of 16 states Each state contains a link in the operation sequence necessary to manipulate the data moving through the TAP This includes applying stimuli to the pins capturing incoming data loading instructions and shifting data into and out of the Boundary Scan Register Figure 1 shows the TAP state machine flowchart and demonstrates the sequence of inputs on TMS necessary to progress from any one state to another Asserting the TRST pin at any time will cause the TAP to reset to the Test Logic Reset home state AP 720 Run Test Idle Select DR Scan Select IR Scan 0 A2356 01 Figure 1 TAP Controller Finite State Machine 2 2 Intel386 EX Embedded Processor JTAG Test Logic Unit The JTAG Test Logic Unit of the Intel386 EX embedded processor can control all device pins except those of the clock power ground and TAP control signals A boundary scan cell resides at each of the 101 controlled device pins The cells are connected serially to form the 101 bit boundary scan register Each bit has both a control cell which controls the I O status of the pin and a data cell which holds the logical high or low value to be asserted at the pin itself An EXTEST or INTEST instruction as shown in Table 1 requires a total of 202 101 bits x 2 cells shifts of data into the TAP In addition to the boundary scan BOUND register the Intel386 EX processor has
14. 0 2 amp B 7 AP 720 Table B 1 BSDL File Sheet 8 of 10 82 BC 2 control 0 amp 83 6 P11XRTSObar bidir X 82 Z s 84 BC 2 control y 5 85 6 P10XDCDObar bidir X 84 2 amp 86 BC 2 control 0 6 87 BC 6 FLTbar bidir X 86 0 Z amp 88 2 control 0 6 89 6 DSRlbarXSTXCLK bidir X 88 Z 6 90 BC 2 control 0 amp 91 BC 6 INT7XTMRGATE1 bidir X 90 Z amp og BC 2 control 0 amp 93 6 INT6XTMRCLK1 bidir X 92 Z amp 94 BC 2 control E 95 6 INT5XTMRGATEO bidir X 94 Z amp 96 BC 2 3 control 0 5 97 BC 6 INT4XTMRCLKO bidir X 96 Z amp 98 BC 2 control 0 amp 99 BC 6 BUSYbarXTMRGATE2 bidir X 98 0 Z 100 BC 2 control 0 amp 101 BC 6 ERRORbarXTMROUT2 bidir X 100 2 102 BC 2 control 0 5 103 BC 6 NMI bidir X 102 Z s 104 BG 2 control 0 S 105 BC 6 PEREQXTMRCLK2 bidir X 104 Z amp 106 BC 2 control 0 amp 107 BC 6 P37XCOMCLK bidir X 106 0 2 amp 108 BG 2 control 0 amp 109 BC 6 P36XPWRDOWN bidir X 108 0 Z amp 110 BC 2 control 0 5 111 6 P35XINT3 bidir X 110 Z amp 112 25 X con
15. 01 there is no Instruction Disable attribute for 1386 EX Processor attribute Instruction Private of 1386 EX Processor entity is Reserved attribute Idcode Register of 4386 EX Processor entity is 0000 6 version 0000001001110000 amp part number 77 00000001001 amp manufacturers identity por required by the standard attribute Register Access of 4386 EX Processor entity is Bypass HIGHZ BETEN The first cell cell 0 is closest to TDO xoxxxxxxx x xxx xx x xxx xxxx xx xxxx xx xx x xx xx xxxxoxxox exxoxxxx attribute Boundary Cells of i386 EX Processor entity is BC 6 BC 2 attribute Boundary Length of i386 EX Processor entity is 202 attribute Boundary Register of i386 EX Processor entity is 0 BC 2 control 0 6 1 BC 6 D15 bidir X Z amp M2 BC 2 control 0 6 Rer BC 6 D14 bidir X 2 0 Z amp 4 BC 2 control 0 5 5 6 D13 bidir X 4 Z s 6 BC 2 control 0 amp 7 BC 6 D12 bidir X 6 Z 6 8 BC 2 control 0 amp 9 6 Dll bidir X 8 Z s 10 BC 2 control 0 5 NL BC 6 D10 bidir X 10 0 Z amp 12 BC 2 control amp 13 BC 6 D9 bidir X 12 0 Z amp 14 BC 2 control 0 6 15 BC 6 D8 bidir X 14 Z 6 LG BC 2 control 0 amp
16. 1 Bit 6 is TDI output z Bit O 1 Bit TDI TMS JTAG 2 JTAG 1 bit is inverted LPT1 Data Address Default Ts Contains circuit input 2 Reset bit is here YXXXXXXXXXXXXXXXXXXEYYXXXYYXXXYYXXXYEXXXYYXX LER FUNCTIONS FOR JTAG I O Yxxxxxxxxxxxxxxxxxx FOCI III ICICI II ICICI III ICI I ICICI I I I ICICI I ICI nection to reset the JTAG unit eee et TAP logic by optional TRST signal mov dx JTAG mov al 0 TDI out dx al mov dx JTAGR mov al 0 TRST LOW out dx al mov dx JTAGR mov al TRST 5 HIGH out dx al Assembly function to go void far Restore Idle xx _asm into Run_Test_Idle state from unknown state Restore Test_Logic_Reset state by 5 TCK s Goes into TLR state from any unknown state of the JTAG controller A 4 Table 1 Program Source Code Sheet 5 of 15 AP 720 mov mov FiveTimes mov out or out xor out loop 5 dx JTAG al TMS dx al al TCK dx al al dx al FiveTimes TMS HIGH Set TMS TDI TCK High TCK Low Assembly function to do one transition with TMS High x void near TMS High 1 asm mov mov out or out xor out One transition with TMS High dx JTAG al TMS d 81 al TCK dx al al TCK dx al Sets TMS high Set TMS TDI TCK High TCK Low Assembly functio
17. 14 A13 A12 A11 A10 A9 A8 AT A6 A5 A4 A3 A2 Al NAbar ADSbar BHEbar BLEbar WRbar RDbar BS8bar READYba WXRbar DXCbar MXIObar TRSTbar TDO TDI TMS TCK VCC VSS Tap_Scan_In Tap_Scan_Mode Tap_Scan_Out Tap_Scan_Reset Tap_Scan_Clock Instruction_Length Instruction Opcode 1111 2 0 E of of of of of amp 73 amp 72 amp 70 amp 68 amp 67 amp 66 amp 65 amp 63 amp 62 amp 61 amp 59 amp 58 amp 57 amp 56 amp 55 amp 54 amp 53 amp 52 amp 51 amp 50 amp 49 amp 48 amp 45 amp 44 amp 43 amp 42 amp 41 amp 40 amp 39 amp 37 amp 35 amp 34 amp 33 amp 32 amp 30 amp 29 amp 27 amp 119 amp 24 amp 25 amp 26 amp 76 amp 15 28 38 47 60 71 81 88 109 121 127 6 3 17 31 36 46 64 69 83 97 100 103 116 130 TDI signal is TMS signal is TDO signal is TRSTBAR signal TCK signal is true true true is true 33 0e6 BOTH of i386 EX Processor entity is 4 of i386 EX Processor entity is B 5 AP 720 Table B 1 BSDL File Sheet 6 of 10 EXTEST 0000 amp SAMPLE 0001 amp IDCODE 0010 amp HIGHZ 1000 amp Reserved 1100 1011 Private instructions DO NOT belong in BSDL attribute Instruction Capture of i386 EX Processor entity is 00
18. 69 170 171 172 NIS 174 NIS 176 177 NES 179 180 181 182 183 184 185 186 187 188 189 190 SVO 192 A22 bidir control A21 bidir m control A20 bidir m control A19 bidir control A18XCAS2 bidir Ze control A17XCAS1 bidir m control A16XCAS bidir control A15 bidir control A14 bidir control A13 bidir x control A12 bidir Ze control All bidir control A10 bidir control A9 bidir x control A8 bidir Ze control A7 bidir control A6 bidir control A5 bidir m control A4 bidir Ze control A3 bidir control A2 bidir control Al bidir Ze control NAbar bidir Ze control ADSbar bidir control BHEbar bidir control BLEbar bidir control WRbar bidir control RDbar bidir control B 9 AP 720 Table B 1 BSDL File Sheet 10 of 10 193 BC 6 BS8bar bidir X 192 0 Z amp 194 BC 2 control 0 amp 195 BC 6 READYbar bidir X 194 0 Z amp 196 BC 2 control 0 amp 197 BC 6 WXRbar bidir X 196 0 Z amp 198 BC 2 control 0 6 199 BC 6 DXCbar bidir X 198 0 Z amp 200 BC 2 control 0 amp 201 BC 6 MXIObar bidir X 200 2 end i386 EX Processor B 10
19. ACK barXGCS5bar P24XGCS4bar P23XGCS3bar P22XGCS2bar P21XGCSlbar P20XGCSO0bar SMIACTbarXEXCSIG DRQIXRXDI DRQOXDCD bar WDTOUT EOPbarXCTSlbar DACKlbarXTXDl PI7XHLDA RESET P16XHOLD PI5XLOCKbar Pl4XRIObar P13XDSRObar P12XDTRObar P11XRTSObar P10XDCDObar FLTbar DSRIbarXSTXCLK VINT7XTMRGATE1 INT6XTMRCLK1 INT5XTMRGATEO VINT4XTMRCLKO BUSYbarXTMRGATE2 ERRORbarXTMROUT2 NMI PEREQXTMRCLK2 P37XCOMCLK P36XPWRDOWN P35XINT3 P34XINT2 P33XINTI P32XINTO VRTSlbarXSSIOTX RIlbarXSSIORX DTRIbarXSRXCLK P31XTMROUT 1 P3OXTMROUTO 12 amp 11 amp 10 amp 8 amp 7 amp 6 amp 5 amp 4 amp 2 amp 1 amp 132 amp 131 amp 129 amp 128 amp 126 amp 125 amp 124 amp 123 amp 122 amp 120 amp 118 amp 117 amp 114 amp 113 amp 112 amp 111 amp 110 amp 108 amp 107 amp 106 amp 105 amp 104 6 102 6 101 amp 99 amp 98 amp 96 amp 95 amp 94 amp 93 amp 92 amp 91 amp 90 amp 89 amp 87 amp 86 amp 85 amp 84 amp 82 amp 80 amp 79 amp 78 5 71 amp 75 amp 74 amp B 4 Table 8 1 BSDL File Sheet 5 of 10 AP 720 attribute attribute attribute attribute attribute attribute attribute BYPASS SMIbar A25 A24 A23 A22 A21 A20 A19 A18XCAS WA17XCAS 16 5 15
20. ARNING Verification file will contain one extra byte forin printf input files with odd byte counts An OOOO ok k SI IIDC SII DISCS ICICI IIIS oko ok k III ook K Kok IOI ICICI I k kok I I Ce a Yxxxxxxxxxxxxxxxxxxxxxxxxxxxx BEGIN MAIN EE I ICI I kok Ci a a ea YXXXXXXXXXXXXXXXXXXKXXXXXKKXXXXXEYXXXXEXYXXXXKYXXXXKYXXXXYYXXXYYXXXYYXXKXRXYXXK XL void main if Input File Name OK input file printf On next line n INTEL i386EX PROGRAMS FLASH VIA THE JTAG PORT n y Fill UTAG PinState Initialization string Reset JTAG Reset the JTAG unit Reset board while TRST is low to insure proper startup printf nWARNING Reset Evaluation Board nov and press any key in while kbhit Waits until a key is hit _getch Throws away character Restore Idle Used to reset JTAG state machine Get JTAG Device ID Get ID see 386EX manual for code Get Flash Device ID Get ID see flash manual Check Flash Status Check status register example Erase Flash Erases the entire Flash chip printf nEnter starting address of program data in hex bytes 51 6 start address Scans starting address in hex Uses word mode below i Program Flash Data Opens file and programs FLASH data Check Flash Status Checks status before continuing Read FLASH Data verify bin data start address i Copy conte
21. ET 90 D5 16 A6 41 SSIOTX 66 P1 7 HLDA 91 D6 17 42 P3 2 INTO 67 DACK1 TXD1 92 7 18 A8 43 P3 3 INT1 68 EOP 93 8 19 AQ 44 P3 4 INT2 69 WDTOUT 94 9 20 A10 45 P3 5 INT3 70 DRQO 95 D10 21 A11 46 P3 6 PWRDOWN 71 DRQ1 RXD1 96 11 22 A12 47 P3 7 SERCLK 72 SMIACT 97 12 23 13 48 PEREQ TMRCLK2 73 P2 0 98 13 24 A14 49 NMI 74 P2 1 99 D14 100 15 NOTES 1 Bit 0 is closest to TDI bit 100 is closest to TDO 2 The boundary scan chain consists of 101 bits however each bit has both a control cell and a data cell so an EXTEST or INTEST instruction requires 202 shifts 101 bits X 2 cells AP 720 2 2 2 Identification Code Register The IDCODE instruction allows the user to determine the contents of the device s identification code register For the Intel386 EX embedded processor this command should return one of the values shown in Table 3 Table 3 Device Identification Codes Step Vec IDCODE A 5V 0027 0013H B 5V 0027 0013H 5 2027 0013H G 3V 2827 0013H For more information about identification codes see the Intel386 EX Embedded Microprocessor User s Manual 2 3 Intel 4 Mbit Boot Block Flash The number of instructions necessary to program flash devices is significantly reduced by using an Intel Boot Block device In the sample design described in the next section the automated Write State Machi
22. JTAG port is sure to be an important tool for in circuit device reprogramming and reconfiguration The parallel port of a standard PC becomes a flexible tool in this case and may be used to generate TAP signals for either lab or low volume production With a high performance solution based on a simple TAP controller card in a PC programming performance signifi cantly improves without the purchase of costly test equipment 6 0 RELATED INFORMATION This application note is one of the many sources of information available regarding designing with the Intel386 EX embedded processor Table 6 shows other useful documents and their Intel order numbers Table 6 Related Intel Documents Publication Title Intel386 V EX Embedded Microprocessor datasheet 272420 Intel886 EX Embedded Microprocessor User s Manual 272485 Intel886 SX Embedded Microprocessor datasheet 240187 Intel386 SX Embedded Microprocessor Programmer s Reference Manual 240331 Intel386 SX Embedded Microprocessor Hardware Reference Manual 240332 186 Development Tools Handbook 272326 Intel386 EX Embedded Microprocessor Evaluation Board Manual 272525 Buyer s Guide for the Intel386 Ex Embedded Processor Family 272520 Packaging 240800 1995 Flash Memory Databook 210830 12 intel To receive these documents or any other available Intel literature contact Intel Corporation Literature Sales P O Box 7641
23. Mt Prospect IL 60056 7641 1 800 879 4683 To receive files that contain the source code executable programs and schematics for this application of flash programming through the TAP contact Intel Corporation America s Application Support BBS 916 356 3600 AP 720 Additional information on the IEEE 1149 1 1a specification may be found in the official IEEE Standards document IEEE Standard Test Access Port and Boundary Scan Archi This publication is sponsored by the Test Technology Standards Committee of the IEEE Computer Society and is available from tecture Institute of Electrical and Electronics Engineers Inc 345 East 47th Street New York NY 10017 18 AP 720 APPENDIX PROGRAMI SOURCE CODE The following source code was written in Microsoft Visual C version 1 5 and has been tested using the aforementioned hardware interface on a Intel386 EX Embedded Processor Evaluation Board It was compiled and linked into the file TAPLOADR EXE which is available on Intel s America s Application Support BBS in the zipped file TAPLOADR ZIP Table A 1 Program Source Code Sheet 1 of 15 xxxxxxxxxxxxxxxxxxxxxxxxxxxx TAPLOADR CPP Program Name TAPLOADR CPP Version 1 0 Pate July 18 1995 Author Daniel S Hays 386 Applications Engineer References Excerpts of code take
24. P22XGCS2bar bidir X 50 0 Z amp 52 BC 2 control 0 53 BC 6 P21XGCSlbar bidir X 52 Z 6 54 BO 2 gontrol y amp 55 BC 6 P20XGCS0bar bidir X 54 2 6 56 BC 2 control 0 r BC 6 SMIACTbarXEXCSIG bidir X 56 Z 6 58 BC 2 control 0 6 NOS BC 6 DRQIXRXDI bidir X 58 Z amp 60 BC 2 control 0 61 BC 6 DRO0XDCDlbar bidir X 60 Z amp 62 BC 2 control 0 amp 63 BC 6 WDTOUT bidir X 62 0 Z 6 64 BC 2 control 0 amp 65 BC 6 EOPbarXCTSlbar bidir X 64 0 Z amp 66 BC 2 control 0 amp 67 BC 6 DACKlbarXTXD1 bidir X 66 Z 6 68 BC 2 control 0 6 69 BC 6 PITXHLDA bidir X 68 Z s 70 BC 2 control 0 TA BC 6 RESET bidir X 70 2 6 72 BC 2 control 0 amp 73 BC 6 P16XHOLD bidir X 72 Z s 74 BC 2 control 0 BC 6 P15XLOCKbar bidir X 74 Z 6 76 BC 2 control 0 yur BC 6 P14XRIObar bidir X 76 Z amp 78 BC 2 control 0 amp Ar BC 6 P13XDSRObar bidir X 78 0 Z 8 80 BC 2 control Dy jE 81 BC 6 P12XDTRObar bidir X 80
25. RD 241 0 For Read Send Data IN BSR Length P Can skip if WE is already High i P WR 2 1 0 WR Low Data P WRD 2 1 1 For Write access Send Data IN BSR Length P ti P WR 2 1 1 WR High Data again P WRD 2 1 O Read access again Send Data IN BSR Length P Function to read input file name and data exe int Input File Name OK char input file name 80 1 11 AP 720 Table A 1 Program Source Code Sheet 12 of 15 FILE in Points to the input file printf nEnter name of input file scanf 80s input file name if in fopen input file name rb FILE NULL 1 printf Could not open s for input data Mn input file name fclose in return FALSE File not loaded into memory else 4 printf File name is good continuing Nn fclose in return TRUE File is loaded in memory Function to retrieve info about FLASH manufacturer and Device void Get Flash Device ID 4 Send Instruction IN strlen SAMPLE SAMPLE Sample Preload to initialize BSR Send Instruction IN strlen EXTEST EXTEST Configure for External Test A 0x0 Initializer Flash Write PinState A 0x90 Send command to flash read ID RX Flash Read PinState A Rd 1 word Flash Device ID printf nFlash Chip Intelligent ID reads 4 4xH RX Print first word RX Fl
26. ROBEF 40 1 25 512 Kbyte Vvrite Yes WE 2940 5 74 512 Kbyte Read N A WE 660 1 28 512 Kbyte Write No WE 1620 3 16 512 Kbyte Read N A WE 660 1 28 512 Kbyte Write No STROBE 555 1 08 512 Kbyte Read N A STROBE 590 1 15 Table 5 also illustrates how the use of a WE generated by the STROBE line of a typical parallel port may expedite the delivery of data through the TAP Using this method allows writes to complete in a single cycle of the TAP rather than the normal three cycles that are required when strobing the WE signal from the TAP As shown in Appendix A the data and address are placed on the bus in a single cycle when using STROBE as WE They are then clocked into the flash device by toggling the STROBE line externally In the latter case however three complete shifts of the BSR data must be performed in order to send the data and address and simultaneously toggle the WE line in a similar high low high pattern Reductions in write cycle time of close to two thirds are expected when using the first method The unused data signals of the parallel port may also be used to control other useful signals such as RD or to monitor the status of control lines on the system under test It is worth mentioning that several companies currently offer JTAG port interface cards that use a standard ISA bus interface to communicate with one or more Test Access 11 AP 720 Ports These cards can vastly improve the data transfer rates o
27. Send Data unsigned S char far D Send data string into JTAG port replace the original string with the data that comes out TDO TMS Low Go to Run Test Idle TMS Low Go to Run Test Idle TMS High Go To Select DR Scan TMS Low Go to Capture DR TMS Low Go to Shift DR Shift Data Array S D TMS High Update IR new data is in effect TMS Low Run Test Idle Function to send data string into JTAG port w o replacing orig void far Send Data IN unsigned S char far D Send data string into JTAG port The original data is not overwritten TMS Low Go to Run Test Idle TMS Low Go to Run Test Idle TMS High Go To Select DR Scan TMS Low Go to Capture DR TMS Low Go to Shift DR Shift Data Array IN S D TMS High Update IR new data is in effect TMS Low Run Test Idle kk t Function to invert a data string so MSB is first void Flip ID String int length char Input ID String Length 1 Flips the JTAG Unit ID string since it is read in backwards A 8 Intel Table A 1 Program Source Code Sheet 9 of 15 AP 720 int 1 3 char Temp ID String Length j 0 Initialize Temporary place holder for i length i gt 1 i 1 Temp j Input i 1 Tri for 3 0 i lt length 1 i Input i Temp i Copy Temp string to perm one
28. TROBE without RESET out dx al pop dx YXXXXXXXXXXXXXXXXXXEXXXXXEXXXXXKXKXXXXKYXXXXEXXXXYYXXXYYXXXKEYXXXYYXXXYYXX Yxkkxxoxxxxxkoxkkkxkk C FUNCTIONS FOR JTAG PROGRAMMING YXXXXXXXXXXXXXXXXXXXXXXXKXXXXXKXXXXXEXXXXEXXXXXXXXXXEXXKXKYXXXYYXXXXYXXXYY Yxxxxkxkkkkekxkkk Function to send instruction to JTAG xxxxxxxxxxxx xxxx xx void Send Instruction unsigned S char far D Send instruction string into JTAG port replace A 7 AP 720 Table A 1 Program Source Code Sheet 8 of 15 the original string with the data that comes out TDO TMS Low Go to Run Test Idle TMS Low Go to Run Test Idle TMS High Go to Select DR Scan TMS High Go to Select IR Scan TMS Low Go to Capture IR TMS Low Go to Shift IR Shift Data Array S D TMS High Update IR new instr in effect TMS Low Run Test Idle Function to send instruction into JTAG port do not read TDO void Send Instruction IN unsigned S char far D TMS Low Go to Run Test Idle TMS Low Go to Run Test Idle TMS High Go To Select DR Scan TMS High Go To Select IR Scan TMS Low Go to Capture IR TMS Low Go to Shift IR Shift Data Array IN S D TMS High Update IR new instr in effect TMS Low Run Test Idle Function to send data string into JTAG port replace original void
29. akes them into outputs int i long int M 1 for 1 1 i gt A25 i 1 if Address amp M 0 P i 241 2 1 else P i 241 i M lt lt 1 pP i 2 e 1 P UCS 2 1 O yxkxxkkkkkkkk Function to read data from FLASH w word Flash_Read PJTAGdata P unsigned long int Address 1 Get Data P Configure Data Bus as inputs Set Address P Address Set addr on bus P UCS 241 Selects Flash chip P RD 241 gs RD Low Data P WR 241 1 WR High Data P WRD 241 OF For Read Send Data IN BSR Length P sets data on the Address bus Data bus in the input mode Send Data BSR Length P Latches Data bus into BSR and then shifts it out into P return Parse Data P Convert result into binary DOC EE Function to Write Data to Flash w void Flash Write PJTAGdata P unsigned long int A word D 1 Set Data P D Output data on bus Set Address P Ai Output address P UCS 241 0 Selects Flash Chip P RD 241 1 RD High Data 1111 ONLY ONE OF SECTIONS 1 or 2 MAY BE USED COMMENT OUT THE OTHER 1111 SECTION 1 USE IF STROBEf IS CONNECTED DIRECTLY TO FLASH WEf FASTEST Send Data IN BSR Length P Strobe Data In Clocks the Par Port STROBE line SECTION 2 USE IF DRAM WE IS CONNECTED DIRECTLY TO FLASH WEf SLOWER 1 P WR 241 1 WR High Data P W
30. an instruction register IR whose instructions are shown in Table 1 These instructions are used in programming flash memory through the JTAG port The bypass register BYPASS is also featured on the processor but is only used in systems with two or more JTAG compliant devices The identification code IDCODE register is the last one implemented in the Intel386 EX processor and is discussed further in Section 2 2 2 AP 720 Table 1 Test Logic Unit Instructions Mnemonic Opcode Description Bypass on chip system logic mandatory instruction BYPASS 1111 7 psy gic Used for those components that are not being tested Off chip circuitry test mandatory instruction EXTEST 0000 Sen Used for testing device interconnections on a board Sample pins preload data mandatory instruction SAMPRE 0001 Used for controlling preload or observing sample the signals at device pins This test has no effect on system operation ID code test optional instruction IDCODE 0010 CS Used to identify devices on a board On chip system test optional instruction INTEST 1001 Used for static testing of the internal device logic in a single step mode High impedance ONCE mode test optional instruction HIGHZ 1000 Used to place device pins into their inactive drive states Allows external components to drive signals onto connections that the processor normally drives NOTES 1 The opcode is the seq
31. arison against the source code The static nature of the Intel386 EX embedded processor s Boundary Scan Register outputs combined with the high speed of the flash device ensures that timing issues are a minimal problem In fact a 16 bit word may be written to the flash device in only a single cycle of the boundary scan register This is accomplished by using an additional output pin of the controlling PC s parallel port connected to WE to clock the data and address into the chip By doing so as is discussed in Section 4 0 PERFORMANCE ANALYSIS AND CONSIDERATIONS even a simple design can achieve throughput levels of more than 1 Kbyte per second through the serial BSR of the Test Access Port 3 0 SAMPLE DESIGN 3 1 TAP Hardware Interface Figure 2 illustrates a straightforward design that uses a standard parallel port to communicate with the TAP of the 191386 EX Embedded Microprocessor Evaluation Board This interface is typical of any design based on the Intel386 EX embedded processor and requires only a CMOS buffer to protect the TAP pins and translate the printer port signals to the CMOS levels required for the TAP This assembly can be built onto a simple cable or card that plugs into the Intel386 EX Embedded Microprocessor Evaluation Board Option Header It receives power and ground signals from the Evaluation Board which must be powered on during operation of the TAP programmer The majority of the signal control is done by soft
32. ase is the Intel386TM EX embedded processor however the scope of this application is easily extended to many other JTAG compliant devices Using the features of the Intel386 EX embedded processor in conjunction with a simple hardware interface a standard set of software routines can be used to program data into flash memory By controlling the CPU s JTAG port these routines manage the data that is programmed into flash memory as well as the processor s control lines This document contains a general overview of The basic functions specified by IEEE 1149 1 The operation of the JTAG port of the Intel386 EX processor The features of the Intel 28F400BV T 4 Mbit Boot Block device flash device This application note also provides a functional design which can be used in conjunction with Revision 2 1 of the EV386EX Intel386 EX Embedded Microprocessor Evaluation Board The design consists of A simple low cost parallel port host interface design standard set of JTAG C in line assembly source code functions Source code that implements the programming validation and erasure of the contents of the Boot Block flash device The compiled and executable code are available through Intel s America s Application Support BBS at 916 356 3600 They are contained in the file TAPLOADR ZIP 1 1 Design Motivation As more packaged silicon devices populate printed circuit boards the connection of test and programming
33. ash Read PinState A 1 printf 4 4xH n RX Print second word printf Flash ID for 28F400 T should be 00898 4470H n Function checks FLASH status register and displays the contents void Check_Flash_Status Flash Write PinState A 0x50 Clears Status Registers Flash Write PinState A 0x70 Send command to flash RD Status RX Flash Read PinState A printf XnStatus of the FLASH part is 4 4xH n RX printf FLASH status should be read 0080H n Function to erase the contents of the entire FLASH chip void Erase_Flash int index unsigned long int blocks 0x0000 0x10000 0x20000 0x30000 0x3C000 0x3D000 0x3E000 Above Starting word address of each of the blocks in a 28F400BV T printf XnNow Erasing FLASH Please be patient Xd for index 0 index 6 index 1 A blocks index Flash Write PinState A 0x20 Flash Write PinState A 0xD0 Wait until Erase Complete do Intel Table A 1 Program Source Code Sheet 13 of 15 AP 720 Flash Write PinState A 0x70 Check Status Register RX Flash Read PinState A while RX amp 0x80 FALSE Wait Until Ready again printf Status of FLASH block x is 4 4xH n index 1 RX Flash Write PinState A 0x50 Clears Status Registers for next block erase printf FLASH status should be read 0080Hin printf FLASH has been erased
34. be independent of any clocks If any buffers on the busses are required in the design their direction and enable signals should be static Take care to ensure that all flash control signals are clock independent Revision 2 1 of the EV386EX Tntel386TM EX Embedded Microprocessor 8 intel Evaluation Board requires that a change be made to temporarily disconnect the output of Pin 20 of the U16 PLD FLSH_WE so that the flash s WE signal may be controlled by an external static and clock independent source Examples are shown in Figure 2 for Parallel Port and TAP control of the WE signal Making the changes described in the figure notes enables the correct operation of the programming functions and eliminates any contention for control of the devices and their signals Future steppings of the Intel386 EX embedded processor remove the need for PLD control of the flash s WE signal by correcting errata 429 of the Intel386 EX embedded processor errata list This allows a glueless flash interface to be used in some designs and eliminates the need for modifi cations to the PLD when implementing the programming of the flash memory through the TAP When cutting the trace on the FLSH WE signal however care must be taken to jumper pins 3 4 on the JTAG interface card so that correct operation of the EV386EX evaluation board is retained Although two examples are given for resetting the JTAG unit of the Intel386 EX embedded processor it is only
35. e by transitioning through the state machine TMS is held high for five consecutive TCK clock periods This is in accordance with the IEEE 1149 1 specifi cation TMS High Provides a vehicle for progression through the state machine with TMS held high for a single TCK clock period Used when shifting data into and out of the TAP TMS Low Provides a vehicle for progression through the state machine with TMS held low for a single TCK clock period Used when shifting data into and out of the TAP Shift Data Array Shifts a data string into the TAP while copying the data in the TAP into the place of the incoming data This function is called when the TAP state machine is in the Select DR Scan state Shift Data Array IN Shifts a data string into the TAP and does not copy any data from the TAP in the place of the incoming data This function is called when the TAP state machine is in the Select DR Scan state Strobe Data In Pulses the STROBE line of the PC s parallel port This function is used only when STROBE is connected to the WE line of the flash C Routines Appendix A contains a number of C language functions that make the programming of flash modular and easy to implement Many of them are called from the Main function of TAPLOADR EXE but others are used to move data back and forth into the TAP by means that would be complicated by using assembly language programming The program was compiled under Microsof
36. f about 0 5 Kbytes per second that are typical of a parallel port programmer Although this rate is comparable to that of atypical EPROM programmer TMS periods on the order of a few microseconds are less than ideal Typical data rates of 8 Mbits per second may be achieved by a simple card which uses RAM to send and read data patterns from the JTAG port Since the bus signal emulation requires only the toggling of a few signals out of all that are within the BSR the card stores the data to be written and transfers it to the TAP in a rapid manner Most hardware vendors provide a library of software to assist the programmer in writing code to interface with such cards Even the simplest combination of hardware and software can be a valuable tool in programming and testing new code in flash 5 0 CONCLUSION The Intel386 EX processor provides a powerful means of programming onboard flash devices to meet the needs of Just In Time manufacturing systems Unprogrammed devices may now be soldered directly onto PCB s allowing for concurrent software and hardware development processes as well as last minute changes in BIOS code intel without the loss of valuable time or inventory Accessing these devices via the chip s IEEE 1149 1 compliant Test Access Port provides an inexpensive versatile and reliable tool that functions far beyond the realms of debug and test If shock tolerance and reduction of form factor are primary design concerns using the
37. iderations The high level routines used in programming data through the TAP are device dependent because they assume a particular device configuration on the board as well as a predetermined system interface In the example the JTAG chain contains only a single IEEE 1149 1 compliant device the Intel386 EX embedded processor If the JTAG chain consisted of several devices connected in series the routines would need to control the whole chain and place any other devices into the BYPASS mode The routines in the example assume only a single device with separate RD and WRf strobes generated by the CPU The WR signal may be enabled externally to improve performance this is discussed in Section 4 0 PERFORMANCE ANALYSIS AND CONSIDERATIONS Several preparations must be made before the flash memory can be programmed On the Evaluation Board JP12 must be installed and R12 removed Jumpering pins 1 and 2 of JP12 enables the PWD signal pin 44 of the 28F400BV T flash device which provides programming voltage for block erases and writes When programming the flash it is also critical to enable Vpp pin 1 by setting Port 1 5 pin 107 of the Intel386 EX embedded processor on the Evaluation Board used in the example In the example UCS is used as the chip select CS for the flash device it is LOW for any address that is accessed The example also implies static behavior of the bus therefore the connection of flash chips to the CPU should
38. initialize value P RD 2 19 Not necessary to initialize value P WRD 2 1 P WRD 241 80 is Read by default P DC 2 1 P DC 2 1 iv P MIO 2 1 P MIO 241 IF P UCS 2 ni Not necessary to initialize value y P LBA 2 1 P LBA 2 1 0 Enables U8 by fooling PLD Function to Set Data Pins given 16 Bit Data k kkkkkkkwk kx void Set Data PJTAGdata P word D Sets data onto pins and makes them 1 into outputs int ij word M M 1 for i D0 i D15 i 1 if D 6 M FALSE 1 2 1 1 else P i 241 0 P i 2 1 Data pins are Outputs now M 1 Function to set data DIR bits to on 16 bit data bus x void Get Data PJTAGdata P Configures data lines as inputs 1 int i for i D0 P i 2 Configure as inputs Function to convert JTAG output string into byte xdeeee word Parse Data PJTAGdata P Reads data lines and returns data word 4 int i word M 1 D 0 for i D0 i D15 i Reads data lines 1 if Pli 241 1 D D M M lt lt 1 return D Function to set the address on the address pins void Set Address PJTAGdata P unsigned long int Address A 10 AP 720 Table A 1 Program Source Code Sheet 11 of 15 1 Sets address lines and m
39. intel AP 720 APPLICATION NOTE Programming Flash Memory through the Intel386 EX Embedded Microprocessor JTAG Port Daniel Hays Applications Engineer Intel Corporation 5000 West Chandler Boulevard Dmitrii Loukianov Field Applications Engineer Chandler AZ 85226 August 8 1995 Order Number 272753 001 Information in this document is provided solely to enable use of Intel products Intel assumes no liability whatsoever including infringement of any patent or copyright for sale and use of Intel products except as provided in Intel s Terms and Conditions of Sale for such products Intel Corporation makes no warranty for the use of its products and assumes no responsibility for any errors which may appear in this document nor does it make a commitment to update the information contained herein Intel retains the right to make changes to these specifications at any time without notice Contact your local Intel sales office or your distributor to obtain the latest specifications before placing your product order MDS is an ordering code only and is not used as a product name or trademark of Intel Corporation Intel Corporation and Intel s FASTPATH are not affiliated with Kinetics a division of Excelan Inc or its FASTPATH trademark or products Other brands and names are the property of their respective owners Additional copies of this document or other Intel literature may be obtained from Intel Corporation Lite
40. ion of the JTAG standard and the operation of JTAG compliant devices 2 1 4 TAP Signal Descriptions The TAP uses a serial synchronous data exchange protocol and consists of five signals TDI Test Data Input a serial bit stream that goes into either the JTAG control command registers or Boundary Scan Registers BSR that control the pin drivers register on the Intel386 EX processor TDO Test Data Output a serial bit stream which goes to the tester and contains information shifted out of either the identifier register or the Pin Data Capture register of the JTAG unit TCK Test Port Clock a synchronous clock which accompanies any data transfers through the JTAG port Data on input lines is sampled on the rising edge of the TCK signal Data on the output line is sampled on the falling edge of the TCK signal intel TMS Test Mode Select this signal used in conjunction with TDI controls the state machine which determines the state of the TAP related circuitry and the direction of data streams within the device under test 5 Test Port Reset an optional signal implemented in the Intel386 EX processor that resets the TAP state machine to the predetermined initial state 2 1 2 JTAG State Machine The movement of data through the TAP can be controlled by supplying the proper logic level to the TMS pin at the rising edge of consecutive TCK cycles The TAP controller itself is a finite
41. le A 1 Program Source Code Sheet 4 of 15 unsigned long int i Stores index value unsigned long int data start address Holds starting address of program word RX word new word word high part char PinState BSR Length char input file 80 int ex FILE in Stores register data Holds word to be written to FLASH Temp Holder for upper part of word Holds Pin Data to move in and out Holds name of input file Holds character being worked with Points to input file location JTAG1149 Commands for Intel386EX Embedded Processor x char BYPASS 1111 5 0000 char SAMPLE 1000 char IDCODE 0100 char INTEST 1001 char HIGHZ 0001 Use BYPASS register in data path External Test Mode Sample Preload Instruction Read ID CODE from the chip On chip System Test Place device into Hi Z mode Yxxxxxxxxxxxxxxxxxx Assembly language variables eeeeeeeeeeeeeeeeeeeeooer define TCK ts define TMS ER define TCKTMS 3 define TDI 0x40 define not TCKTMS OxFC define TDITMS 0x42 define TRST 4 define TDO 0x80 static word JTAG 0x378 const word JTAGI JTAG const word JTAGR JTAG Yxxxxxxxxxxxxxxxxx xxxxxxxxo yxxkxkkekkkkkkk INLINE ASSEMB Yxxxxxxxxxxxxxxxxx xxxxxxxxxok yxxxxxkxxxxxkkkx Assembly fu void far Reset JTAG Res 1 asm Bit 0 is TCK output Bit 1 is TMS output Bit 0
42. le has been sucessfully read from disk printf Data programmed at hex byte location 1xHMn data start address if fclose in printf The file s was not closed successfully Mn input file else printf The file s was closed successfully Mn input file return A data start address 1 Function to read the upper 32k of FLASH for Debug void Read FLASH Data char FileName unsigned long int AStart unsigned long int Size Reads 16 bit words from FLASH chip into binary file starting 8 AStart 1 A 13 AP 720 Table A 1 Program Source Code Sheet 14 of 15 FILE DataFile unsigned long int Address word Data printf nNow reading back data for verification of program success Nn printf Please be patient May take up to 2 seconds per kilobyte Xd printf nFile starting location in FLASH is 1xH n AStart printf File ending location in FLASH is 1xHWMn AStart Size lt lt 1 Flash Write PinState A OxFF Sets up to read back data DataFile fopen FileName w b AStart AStart gt gt 1 For word access addressing for Address AStart Address lt AStart Size Address Data Flash Read PinState Address if fwrite amp Data sizeof Data 1 DataFile 1 printf problem writing to file fclose DataFile printf nFile verification image has been written to file VERIFY BIN Nn printf W
43. lear TCK and TMS bits Put first data bit Set TCK high Shift in first data bit Sample first data bit Set TMS bit Put last data bit Set TCK high Shift in first data bit Sample first data bit Leave TCK pin Low Assembly function to shift data into JTAG port while not reading void near Shift Data Array IN unsigned S cha r far D Shifts data String into JTAG port WITHOUT reading data from JTAG port back into D The procedure should be called when JTAG controller is in the SelectDRScan state A 6 Table 1 Program Source Code Sheet 7 of 15 AP 720 asm 1 mov dx JTAG push es push di les di D Get string cld xor ax ax mov ax S Get Size dec ax mov 2 LastClock4 I Shift4 mov al byte ptr es di shl al 6 and al notTCKTMS out dx al Put first data bit or al TCK Set TCK high out dx al Shift in first data bit inc di Update pointer loop I Shift4 LastClock4 mov al byte ptr es di shl al 6 and al notTCKTMS or al TMS out dx al Put last data bit or al TCK Set TCK high out dx al Shift in last data bit mov al TDITMS Leave TCK pin Low out dx al pop di pop es Assembly function to pulse STROBE line on parallel ports void far Strobe Data In asm push dx mov dx JTAGR mov al 1 TRST Sets STROBE bit low for WE use out dx al mov al TRST Returns S
44. n from modules of the article Beyond the Myth of JTAG Boundary Scan Port by Dmitrii Loukianov Intel Corp 1995 Program Spec This program will take an input flash file residing on a PC and program it into the boot block flash of the 386EX Evaluation Board utilizing the JTAG unit onboard the 386EX A embedded processor It will also erase the entire FLASH chip beforehand including the boot block area if x enabled as described in the requirements section below Requirements In addition to the eval board itself it is required that the user has a JTAG interface board plugged into both the evaluation board s expansion bus slot and the host PC s parallel port The U16 PLD chip must be updated in order to disable the FLASH_WE signal and a jumper must be installed on pins 1 2 of Jumper J12 which is not normally populated on the standard eval board Note The power supply for the 386EX eval board must be ON in order for successful programming of the flash to take place The program implies that UCS is the CSf pin for flash memory being programmed UCS is set LOW for any address The user must also know the location and name of the input data file in BIN format as well as the starting location in FLASH memory that the file is to be located at Disclaimer Information in this document is provided as is solely to enable use of Intel products Intel assumes no liability
45. n to do one transition with TMS Low x void near TMS Low asm mov mov out or out xor out One transition with TMS Low dx JTAG al 0 dx al al TCK dx al al TCK dx al Set TMS Low Set TMS TDI TCK High TCK Low Assembly function to shift data into JTAG port while reading void near Shift Data Array unsigned S char far D 1 Shifts data String into JTAG port while reading data from JTAG port back into D The procedure should be called when JTAG controller is in the SelectDRScan state _asm mov dx JTAG push es push di les di D Get array pointer cld xor ax ax mov ax S Get Size dec ax A 5 AP 720 Table A 1 Program Source Code Sheet 6 of 15 mov jz I Shift3 mov shl and out or out inc in and mov je mov ex 1 stosb dec loop LastClock3 mov shl and or out or out inc in and mov je mov ex 2 stosb dec mov out pop pop Last al al 6 al dx a al T dx a dx x Clock3 byte ptr es di notTCKTMS 1 CK 1 81 38 al 8 al Ex 1 al dx I Sh al al 6 al ax dx a al T dx a dx Oh 1 0 ift3 byte ptr es di notTCKTMS TMS d CK il al dx al 8 al Ex 2 al dx al T dx a di es Oh 1 or DITMS 1 C
46. ne WSM of the 28F400BV T flash unit ensures that all algorithms and timings necessary for erasing and programming the device are executed automatically freeing the TAP control software of additional burdensome I O cycles and iterative code The device also performs its own program and erase verifications updating the Status Register SR to indicate the successful completion of operations These features are standard with Intel s Boot Block FlashFileTM and Embedded Flash RAM families which are available in a variety of sizes and configurations Writing data to Intel s second generation flash memories consists of these steps 1 The write setup command 40H is issued to flash memory 2 This is followed by a second write specifying the address and data for the location to be written 3 The data and address are latched internally on the rising edge of the WE strobe which may be issued by one of a variety of sources intel At this point the WSM takes over writing the results of the verification into the status register Since data access is much slower than the typical programming time the contents of the SR need not be checked after each write Instead writes are repeated sequentially for all locations to be programmed with the SR verified when the block programming is completed After the device is programmed the data may be read back sequentially with RD held constantly low and the contents may be verified by comp
47. ng status after each word is programmed data from Program Operation and Options TAPLOADR EXE operations are controlled from the program s Main function The program does not execute until it is given a valid input file name Table 4 lists the functions which verify write and then read back the data in the file that is written to the flash device Table 4 TAPLOADER EXE Order of Execution Input File Name OK input file Fill JTAG PinState Reset JTAG Restore Idle Get JTAG Device ID Get Flash Device ID Check Flash Status Erase Flash i Program Flash Data Check Flash Status Read FLASH Data verify bin data start address i Checks input file name Initialization string Reset the JTAG unit Used to reset JTAG state machine Get ID see 386EX manual for code Get ID see flash manual Check status register example Erases the entire flash chip Opens file and programs flash data Checks status before continuing Copy contents to file Intel The program displays status check messages throughout its operation t is important to recognize that some operations especially when programming large amounts of data may take from a few seconds to a few minutes to complete A block erase operation normally requires approximately 0 5 seconds per block or about 4 seconds per flash device Writing data may take from just a few
48. nts to file to verify OK printf XnThe board must now be reset to return to normal operation Reset board while TRST is low to insure proper startup printf NnWARNING Reset Evaluation Board now and press any key in while kbhit Waits until a key is hit A 14 Intel Table A 1 Program Source Code Sheet 15 of 15 getch AP 720 Throws away character Reset JTAG Reset TAP to release BSR control printf n lt lt lt lt lt lt lt lt lt lt lt lt lt lt lt lt The end gt gt gt gt gt gt gt gt gt gt gt gt gt gt gt gt gt n n printf Hit any key to return to DOS in while kbhit Waits until a key is hit _getch Throws away character else printf File transmission unsuccessful Mn printf Please check input file and physical connections Yxxxxxxxxxxxxxxxxxkxxxxkxxxokok END MAIN 4330 0000 30 EE A 15 AP 720 APPENDIX B Intel386 M EX Embedded Processor BSDL File The following BSDL file for the A and B steppings of the Intel386 EX embedded processor is located on Intel s America s Application Support BBS at 916 356 3600 It is contained in the zipped file called JTAGBSDL ZIP located in the Intel386TM EX embedded processor area Table B 1 BSDL File Sheet 1 of 10 Copyright Intel Corporation 1994 ENEE koe CK III III III IIIS III IO ook kk ek kk kool H A E E H
49. pts the user to try executing the program again If the file is valid the program executes normally Get Flash Device ID Retrieves the flash device ID from the Intel Boot Block flash Device Displays the results and the expected value Check Flash Status Clears the flash status registers and sends a Read Status command to the device The results are read back and displayed along with the expected values for a properly functioning device Erase Flash Erases each block within the Intel Boot Block flash device An address within each block is stored in an array in this function and the function loops for a specified number of blocks seven in this case The function may be altered to erase only the Boot Block or selected blocks within the device 3 2 4 intel Program Flash Data Outputs the specified binary input file to the flash device Data is read in as 8 bit characters and is merged into 16 bit words which are then written to the Flash device Status checks are not performed after each write because doing so slows performance The function displays the status of a successful programming operation and notifies the user if the input file has been closed successfully Read Flash Data Reads back the data that has been written to the flash into the file VERIFY BIN A file comparison may be done to check the correct programming of flash data This is unnecessary in most real applications but is marginally faster than checki
50. r the Intel 28F400BV T Boot Block flash will benefit from a brief overview of the features that these pieces provide The design for programming flash memory shown in Figure 2 takes advantage of these features The design uses The five wire interface of the TAP which simplifies the hardware requirements The unique configuration of the Intel386 EX embedded processor in the embedded system to control flash memory programming e The advanced programming algorithm of the Intel 28F400B V T Boot Block flash device This application note focuses on the 101 pin JTAG imple mentation found on the Intel386 EX embedded processor Sections 2 1 and 2 2 describe this implementation while the features of the Boot Block flash device are described in section 2 3 2 1 IEEE 1149 1 The JTAG Specifi cation The IEEE 1149 1 specification was originally intended to provide an easy way to verify the functionality and correct interconnection of both compliant and non compliant devices in a printed circuit board design However without the presence of any firmware the JTAG compliant Intel386 EX embedded processor can imitate most of the bus signals 720 by controlling the TAP This powerful feature can be used to access all of the peripherals as if an emulator or programmer were connected instead of the CPU The IEEE s official publication the JEEE Standard Test Access Port and Boundary Scan Architecture contains a complete descript
51. rature Sales P O Box 7641 Mt Prospect IL 60056 7641 or call 1 800 879 4683 INTEL CORPORATION 1995 m l ntel Contents Programming Flash Memory through the Intel386 EX Embedded Microprocessor JTAG Port 1 0 INTRODUCTION eene 1 1 1 Design Motivation rece 1 2 0 BACKGROUND INFORMATION 22d 2 1 IEEE 1149 1 The JTAG Specification octets e reed pee dede 1 2441 TAP Signal Descriptions rrt inr erp gos eiie i eie 2 2 1 2 JTAG Stato Machine dtt tene ertt ttt vt t dere toe d dede Fes 2 2 2 Intel386 EX Embedded Processor JTAG Test Logic Unit eee eee emr esasi eee een nn 3 2 2 Boundary Scan Register unu de pe e 4 2 2 2 Identification Code Register U u nennen nennen nennen 6 2 3 Intel 4 5 Boot Block Flash eerte 6 3 0 SAMPLE DESIGN 3 1 TAP Hardware Interface 3 2 STAG Software TEE 8 3 2 1 Hardware Considerations rere oerte edited re er P S eden eaae Y a des 8 3 2 2 Assembly Language Routines naa 8 3 2 3 Routes u R H YAYA 9 3 2 4 Program Operation and Options nennen rennen nene 10 4 0 PERFORMANCE ANALYSIS AND CONSIDERATIONS
52. seconds to over 30 minutes depending on the size of the input file and the methods used for verifying data programming and enabling WE on the flash chip These issues are discussed in the next section 4 0 PERFORMANCE ANALYSIS AND CONSIDERATIONS A number of factors can affect the performance specifically the throughput levels of any programming device that uses AP 720 the JTAG port Among these the most critical are the methods used to write the data into the flash device and verify that it has been successfully stored at the correct location As was mentioned earlier reducing the number of status checks performed while programming can greatly reduce the time required to program data into flash The relatively slow operation of the parallel port and TAP combination ensures that read and write operations do not interfere with those that precede them Checking status bits only at the end of blocks of writes can reduce programming time by as much as one half Table 5 shows a comparison of typical timings measured while loading data into the flash device found on the Intel3867M EX Embedded Microprocessor Evaluation Board Table 5 TAP Flash Programming Sample Timings Size of Operation Type of Access Status Check FLSH WEZ Type Seconds Seconds Kbyte 32 Kbyte Write Yes WE 180 5 62 32 Kbyte Read N A WE 40 1 25 32 Kbyte Write No WE 100 3 12 32 Kbyte Read N A WE 40 1 25 32 Kbyte Write No STROBE 45 1 41 32 Kbyte Read N A ST
53. sor and must be configured differently for other devices Set Data Decodes a 16 bit data word onto the DO through D15 data lines in the BSR array Sets the data line directional bits to a value of 1 which makes them into outputs Used when writing data to the flash Get Data Configures the data lines as inputs allowing data to be output from the flash and read into the BSR array Used when reading data back from the flash Parse Data Reads the data from the data lines in the BSR array and parses it into a 16 bit data word Used when reading data back from the flash Set Address Decodes an address onto the AI through A25 data lines in the BSR array Sets the directional bits for the address lines to a value of 1 which makes them into outputs Used for both reads and writes to and from the flash Flash Read Reads a 16 bit data word from the flash device at the specified address Used for verification of data and status checks Flash Write Writes a 16 bit data word to the flash device at the specified address Used for data programming and status checks Optional section within this procedure may be chosen depending on AP 720 chosen method of WE hardware control Only one type of WE signal enabling procedure may be used at a time Input File Name OK Verifies that the input file is a file that can be read When this function does not return a value of TRUE the pogram displays an error message and prom
54. t DY inout bit D6 inout bit D5 inout bit D4 inout bit D3 inout bit D2 inout bit D1 inout bit DO inout bit B 1 AP 720 Table B 1 BSDL File Sheet 2 of 10 LBAbar LCSbar UCSbar P27XCTS0 P26XTXDO P25XRXDO DACKObarXGCS5bar P24xGCS4bar P23XGCS3bar P22XGCS2bar P21XGCSlbar P20XGCS bar SMIACTbarXEXCSIG DRO1XRXD1 DRQOXDCD bar WDTOUT EOPbarXCTS1bar DACK1barXTXD1 P17XHLDA RESET P16XHOLD P15XLOCKbar P14XRIObar P13XDSRObar P12XDTRObar P11XRTSObar P10XDCDObar FLTbar DSRlbarXSTXCLK INT7XTMRGATE1 INT6XTMRCLK1 INT5XTMRGATEO INT4XTMRCLKO BUSYbarXTMRGATE2 ERRORbarXTMROUT2 NMI PEREQXTMRCLK2 P37XCOMCLK P36XPWRDOWN P35XINT3 P34XINT2 P33XINTI P32XINTO RTSlbarxSSIOTX RIlbarXSSIORX DTRibarXSRXCLK P31XTMROUT1 P30XTMROUTO SMIbar A25 A24 A23 A22 A21 A20 inout inout inout inout inout inout inout inout inout inout inout inout inout inout inout inout inout inout inout inout inout inout inout inout inout inout inout inout inout inout inout inout inout inout inout inout inout inout inout inout inout inout inout inout inout inout inout inout inout inout inout inout inout inout inout bit bit bit bit bit pit bit bit bit bits bit bit bits bit bit bit bit bit bit bit bit bit bit bit bit bits bit bit pit bit bit bit bit bit bit bit bit pit bit bit pit
55. t Visual C 1 50 A list of the functions their dependencies and a brief description of their operation is given below Send Instruction Sends a JTAG instruction as a string into the TAP Replaces the original string with the data that is shifted out on TDO Send Instruction IN Sends a JTAG instruction as a string into the TAP Does not replace the original string with the data that is shifted out on TDO AP 720 Send Data Sends a JTAG data string into the TAP Replaces the original string with the data that is shifted out on TDO Send Data IN Sends a JTAG data string into the TAP Does not replace the original string with the data that is shifted out on TDO Flip ID String Flips the JTAG unit ID string within its own array This needs to be done in order to reverse the string which is read in backwards least significant bit first This allows for verification of the data that is read against the value shown in the Intel3867M Ex Embedded Microprocessor Users Manual most significant bit first Get JTAG Device ID Retrieves the JTAG device ID from the processor Displays the results and the expected value Fill JTAG Initializes the values in the 202 bit JTAG BSR array for a standard configuration Sets up input and output pins and values for the control pins in the BSR Sets the direction bits of the unused pins to a value of 0 which makes them inputs This routine is unique to the Intel386 EX embedded proces
56. trol Uj amp 113 BC 6 P34XINT2 bidir X 112 0 Z amp 114 BC 2 control 0 amp WIS BC 6 P33XINTI bidir X 114 Z amp 116 BG 2 control 0 amp 117 BC 6 P32XINTO bidir X 116 0 Z amp 118 BC 2 control 0 amp 119 BC 6 RTSlbarXSSIOTX bidir X 118 Z 120 BC 2 control 0 amp 121 BC 6 RIlbarXSSIORX bidir X 120 0 Z amp 122 BC 2 control 0 amp 123 BC 6 DTRIbarXSRXCLK bidir X 122 0 2 124 BC 2 control 0 amp 125 6 P31XTMROUT1 bidir X 124 Z 6 126 BC 2 control 0 5 127 BC 6 P30XTMROUTO bidir X 126 Z 6 128 227 control 0 amp 129 6 SMIbar bidir X 128 0 Z 6 130 BC 2 control 0 131 BC 6 A25 bidir X 130 0 Z amp 132 2 gontrol 0 amp N33 BC 6 A24 bidir X 132 0 Z amp 134 BC 2 control 0 135 6 A23 bidir X 134 Z s 136 BG 2 control 0 SS B 8 Table 8 1 BSDL File Sheet 9 of 10 AP 720 4137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 8132 160 161 162 51 53 164 165 166 167 168 1
57. uence of data bits shifted serially into the instruction register IR from the TDI input The opcodes for EXTEST and BYPASS are mandated by IEEE 1149 1 so they should be the same for all JTAG compliant devices The remaining opcodes are defined for use on the Intel386 EX embedded processor so they may vary among devices 2 Allunlisted opcodes are reserved Use of reserved opcodes could cause the device to enter reserved factory test modes 2 2 4 Boundary Scan Register The order of the bits contained in the Boundary Scan Register BSR is shown in Table 2 The direction or control bits follow their corresponding data bits in the chain sequence For example Bit 0 M IO would be followed in the chain by its directional bit which in turn would be followed by Bit 1 D C It is important to remember that the boundary scan register is shifted in serially when shifting data out onto the pins the first bit shifted into the BSR must be the directional bit of D15 entry number 100 in Table 2 This method ensures that all data is loaded onto the correct pins at the conclusion of the 202 bit serial data shift Although it is not used in the software examples included in Appendix A a copy of the BSDL Boundary Scan Description Language file for the A and B steppings of the Intel386 EX embedded processor JTAGBSDL ZIP is located on Intel s America s Application Support BBS at 916 356 3600 This file lists e The physical pin layout of
58. ware routines which read and write data to and from the BSR L S664 LE Anf ejeq ee 43M dP JO y Suid preog 5 01 V eui JO uonejedo ou Dog JOU JIM 514 Leinen use eui uo FIM Ev Uld ESN 01 pei A3H JOQUINN jueumoog ezig 4 PINOYS JO p Uld 1d eui uo IM HSH pales OZ Uld 9 01 pinous Ldf 40 OL Uld 098505 NYHA eui uo 43M Zr Uld YSN 01 peJlM eq PINOYS Zdr JO 8 Uld GHVOd 1 DVL Aj euonippy eoi ep USEJ eui pue 1144 eui 112 eq 1snui preog uomenje eui HL uo 014 911 94130 oz uid uo 3921 1ndino y Ajnisseoons 919 6 105 o Guruuue1Goad 40 4 AP 720 92288 ZV YSIGNVHO GHVAZTTOG HZTONVHO M 0009 uod ovr NOIL VHOdHOO TALNI S diuo eui ufnouui ysel yoolq 100g jo BuruueJ604d eui lelilloe 0 peog uonen e 3 X3 w1988l lul OU jo uonoeuuoo Zar eui l pe2e d eq PINOYS pieoq jeuonippe siu L eonou jnoujIM uBisep 514 o 1UBu eui 4 Il uBisep eui ul Teedde Aew yeu S10 19 Aue 10 jliqisuodsai ou seuinsse eu euonoun aq o UBisep siy parue seu eu uBnoujv SALON A eXe v9 69 m z
Download Pdf Manuals
Related Search