Altera/Intel JTAG-UART (JUART) protocol - Page 1
Forum section: electronics / general

author: berke
author_rank: Frequent Contributor
timestamp: October 14, 2025, 03:34:46 pm
content: Altera has a "UART over JTAG" protocol that can be used with their juart-terminal and nios2-terminal tools that come with Quartus and allows access to one or more (pseudo-)UART ports, typically instanciated as debug serial consoles for NIOS2 softcores.I was not able to find any details about this protocol. Some people managed to directly use the libjtag_atlantic DLL that is part of the Quartus distributions to talk to their devices without using the Quartus tools directly. This is an x86 DLL and in any case is meant to be used with a USB Blaster cable.So I have analyzed the JTAG-UART protocol. This is for a client having an already deployed custom application where the host architecture is ARM and where using a USB Blaster is impossible. The device is not physically accessible.After capturing a bunch of traces, I managed to write a tool that can talk to the target device's JUART port over that custom JTAG connection. The protocol is fairly simple, but I was not able to decode all of it.So far it seems to work at least as well as the Quartus tool, which sometimes causes the device to lock-up if you send too many bytes too quickly, but that might be an issue with the device FW.My tool is slightly sketchy because the Quartus tools have options to support multiple instances with multiple ports, but the design I've worked on has only a single instance with a single port, and I only have Quartus Lite to synthesize designs with multiple ports or different architectures.If anyone is interested I can share some of the results. The tool would have to be adjusted to work with standard JTAG interfaces (e.g. openocd or FTDI in JTAG mode), but it already has an FTDI backend with a non-standard interface.

author: RoGeorge
author_rank: Super Contributor
timestamp: October 14, 2025, 09:38:33 pm
content: Are you sure there are not 2 distinct communication channels, a JTAG port and an UART port?Usually this is implemented in hardware by a programmer containing a dual channel FTDI, like FTDI2232HQ.https://ftdichip.com/products/ft2232hq/

author: vstrakh
author_rank: Contributor
timestamp: October 15, 2025, 08:22:41 am
content: Quote from: RoGeorge on October 14, 2025, 09:38:33 pmThat UART is kind of "virtual". There are no TX/RX lines, the data being delivered into jtag-uart IP by poking its registers exposed via JTAG interface. If you don't have the real Altera infrastructure on the PC side - you'd need the description of the protocol used to exchange the virtual UART data through the JTAG.

author: berke
author_rank: Frequent Contributor
timestamp: October 15, 2025, 09:17:06 am
content: Quote from: vstrakh on October 15, 2025, 08:22:41 amYes, it's pure JTAG and I was expecting register pokes as well, but as soon as you look at the signals it's apparent that it's not how it works.Basically, after the setup phase, the protocol shifts bytes to and from the device using continuous data register shifts, resulting in DR packets of varying lengths congruent to 3 modulo 10, I've seen packets up to 81923 bits. The clocking is very irregular (as it's driven by USB packets) but JTAG doesn't care.For each byte to be transferred there are two status bits that come before: a byte present bit and a ready/accepted bit. The host (meaning juart-terminal) will continuously clock the JTAG line by sending dummy 10-bit words (where the byte present bit is false) to give the device an opportunity to respond if it has any bytes. So host sends 10 bit word, device clocks out another 10 bits (with a 2 bit lag).After each giant DR packet there is a small 6-bit "acknowledgement/status" packet.If there is no actual traffic for a while the host will stop sending giant DR packets and instead periodically probe using smaller 4-bit packets.Every half second or so there is a pair of small IR packets (18 and 10 bits), not sure what they do but I've reproduced them just in case.I've implemented the active phase based on the above, providing a TCP socket into which you can telnet or socat and it works well. I'd say it works better than the Quartus tool because the console is much more responsive with my tool.For the setup phase I'm just replaying it blindly, I've just adjusted some mask bits and inserted some delays. I assume that I would have to re-record the setup phase for a different design.If people are interested I can clean it up and put it on the Internet, and hopefully I can get some feedback to iterate a bit to and make it more robust, currently I don't feel like dropping $3k on a Quartus licence.BTW, is the USB Blaster II based on an FT2232H?PS. I haven't decompiled any of the Quartus tools or the Atlantic library for this, even though it is legally allowed in France (the interoperability clause). I was never able to get comfy with assembler again, having been spoiled by the MC68000, and until a few years ago I've felt that the x86 ISA was too disgusting (shifts with CL only, wtf), but with age my tastes change, and there are even more disgustinger things these days (like Python) that I'll still do if needed to put bread on the table.PPS. I also have previously reverse-engineered the serial flashing protocol, and likewise I could publish that as well. All of this stuff is for a Cyclone V, but I believe the JTAG-UART is applicable to other Altera chips (maybe even knock-off chips?).