CN102073009B

CN102073009B - System chip JTAG (Joint Test Action Group) debugging control method based on chip flash memory

Info

Publication number: CN102073009B
Application number: CN2010105617014A
Authority: CN
Inventors: 严晓浪; 曾健林; 黄凯; 葛海通
Original assignee: Hangzhou C Sky Microsystems Co Ltd
Current assignee: Hangzhou C Sky Microsystems Co Ltd
Priority date: 2010-11-29
Filing date: 2010-11-29
Publication date: 2012-11-07
Anticipated expiration: 2030-11-29
Also published as: CN102073009A

Abstract

The invention discloses a system chip JTAG (Joint Test Action Group) debugging control method based on a chip flash memory. A JTAG realizes control on a boundary scanning chain through a TAP (Test Access Port), a TCK (Test Clock) interface, a TMS (Time Multiplexed Switching) interface and a TDI (Transport Driver Interface) are respectively controlled by an alternative datum, two inputs of a data selector are respectively used as a normal signal and a fixed low level or high level, the data selector is controlled through a register REG 1 with a bit width of a bit in a system chip, when the value of the REG1 is 1, the low level is connected to the TCK interface, the TMS interface and the TDI through signals and used for shielding an JTAG interface; when the value of the REG1 is 0, the normal signal is connected to the TCK interface, the TMS interface and the TDI and enters a normal debugging mode; and the value of the REG1 is determined according to the data of the chip flash memory. The invention ensures the data security and improves the security while the debugging is convenient.

Description

A kind of System on Chip/SoC JTAG debugging control program based on flash memory on the sheet

Technical field

The present invention relates to the System on Chip/SoC field, especially a kind of System on Chip/SoC JTAG debugging control program.

Background technology

System on Chip/SoC (SOC, System on Chip) is meant an integrated complete system on single chip.This designing technique starts from the mid-90 in 20th century.Fast development along with semiconductor process techniques; IC (Integrated Circuit; Integrated circuit) deviser can be integrated into the function that becomes increasingly complex on the single silicon chip; The trend that integrated circuit (IC) changes to integrated system (IS, Integrate System) occurred, SOC produces under this transformation.Along with the deep submicron process technology is increasingly mature, the scale of IC chip is increasing.The method for designing of numeral IC from driving based on sequential develops into based on the multiplexing method for designing of IP (Intellectual Property, intellecture property) nuclear, and this method for designing is widely used in SOC.SOC can utilize existing design accumulation fully; Improved ASIC (Application Specified Integrated Circuit greatly; Special IC) designed capacity, therefore the development ten minutes is rapid, and becomes the inexorable trend of integrated circuit development.

JTAG is the abbreviation of Joint Test Action Group (joint test behavior tissue).IEEE 1149.1 standards propose by this tissue of JTAG is initial, finally by IEEE approval and standardized.So IEEE 1149.1 these standards generally also are commonly called as the JTAG debug standard.Jtag interface is mainly used in the debugging of chip, can also be used to realize ISP (In-System Programmable, online programming), and FLASH devices such as (flash memories) is programmed.

In the middle of the JTAG debugging, boundary scan is a very important notion.The basic thought of boundary scan technique is near the input and output pin of chip, to increase a shift register cell.Because these shift register cells all are distributed on the border of chip, be called as boundary scan register.When chip was in debugging mode, these boundary scan register can be kept apart chip and peripheral input and output.Through these boundary scan register unit, just can observe with control chip on input and output signal.For the input pin of chip, can load signal (data) fall in this pin through the boundary scan register unit that is attached thereto and go; For the output pin of chip, also can obtain the output signal on this pin through the boundary scan register that is attached thereto.Under normal running status, these boundary scan register are transparent to chip, so normal operation can not be affected.Like this, boundary scan register provides a convenient mode in order to observe and to control the chip of required debugging, and the register and the data that read arbitrarily and revise in the chip become possibility.In addition, the boundary scan register unit on the chip input and output pin can be connected with each other, and around chip, forms a boundary scan chain.Boundary scan chain can serial input and output, through corresponding clock signals and control signal, just can observe and control the chip that is under the debugging mode easily.

JTAG realizes the control to boundary scan chain through TAP (Test Access Port, test access mouth).In IEEE 1149.1 standards the inside, register is divided into two big types: data register (DR) and order register (IR).It is very important a kind of in the data register that boundary scan chain belongs to, and is used for realizing observation and the control to the input and output of chip that data register also comprises device identification register and bypass register.And order register is used for realizing the control to the data register, for example can specify an access object for boundary scan chain.

TAP is a general port, all data registers and the order register that can access chip provide through TAP.Control to whole TAP is accomplished through TAP Controller (TAP controller).The TAP interface of standard is four lines: TMS (Test Mode Selection Input; Test pattern selection input), TCK (Test Clock Input; The test clock input), TDI (Test Data Input; The test data input), TDO (Test Data Output, test data output).Also has a selectable pin TRST (Test Reset Input, test reset input).Being defined as of these pins: TCK is that the operation of TAP provides one independently, basic clock signal, and the every operation of TAP all will drive through this clock; TDI is the test data input, and all will be input to the data of particular register and all will come one one serial to import through the TDI interface, and this input also has TCK to drive; TDO is test data output, and all will all pass through the output of one one bit serial of TDO from the data that particular register reads, and this process need drives through TCK; TMS is that test pattern is selected, and is used for controlling the conversion of TAP state machine, can control TAP through this signal and between different conditions, change, thereby accomplish different operating according to customer requirements, and this signal is effective at the TCK rising edge; TRST is the test reset line, can reset to the TAP state machine through this signal.

Following through TAP: as at first,, to select the data register of a needs visit through order register to the general process that the data register conducts interviews; Secondly, selected data register is connected on TDI and the TDO, is about to data register and is tied on the scan chain circuit; At last, under the driving of TCK, through TDI, the data of needs are input to the data designated register, through TDO, the data in the data designated register are exported simultaneously.

The TAP state machine always has 16 states shown in accompanying drawing 1, control the conversion between these states through TMS, thereby reaches the input of data register and read.The course of normal operation of jtag test system is to send into instruction to order register, tests through data register then.Test instruction has pointed out that the next test that will carry out and test need the data register that uses.Instruction is divided into open and privately owned, and the standard that has defined has been specified an open instruction set of minimum that compatible device must be supported.And privately owned instruction is mainly used in the special test on the sheet, and standard is not made concrete regulation.

The boundary-scan architecture of JTAG is as shown in Figure 2.BSC (Boundary Scan Cell) is a boundary scan cell, data that can each input and output pin of intercepting.Three piths of data register are following: the device identification register can be read the identification code that is fixed on chip internal; Bypass register postpones a clock with TDI and is connected to TDO, makes test board can visit next device (under a plurality of devices situation connected in series) fast; Boundary scan register all signals between can intercepting chip core logical and input and output pin.

A CPU who supports the JTAG debugging; As long as clock TCK is normal; Just can visit the internal register of CPU and hang over the equipment on the cpu bus, like RAM memory device and UART such as (Random Access Memory, RAS) through jtag interface; TIMER, the special I P of general purpose I P such as GPIO and certain chip.This just provides condition very easily for the debugging of System on Chip/SoC.But thereupon also produced new problem.Owing to can read and revise the data of chip internal memory device and the register of IP through jtag interface, this danger with regard to making that those have the chip of specific (special) requirements to face data disclosure and distorted to information security.

Flash memory has non-volatile characteristics on the sheet, after outage, can preserve data.Simultaneously, after Chip Packaging is accomplished, can read and write flash memory on the sheet, but then be difficult to read and change the data of flash memory on the sheet through other mode through jtag interface because it is positioned at chip internal.Need to prove; In theory, jtag interface can be visited any equipment on the cpu bus, so should be able to write flash memory on the sheet; But the writing mode of flash memory is not quite identical with RAM; Therefore the sequential of writing needs a specific interface IP that flash memory on the sheet is linked to each other with bus, the write-in functions of realization specified flash according to different flash memories and difference.

Summary of the invention

Have data security hidden danger, a relatively poor deficiency of security for what overcome existing System on Chip/SoC JTAG debugging control program, the present invention provide a kind of in convenient debugging, ensure data security, improving safety based on sheet on the System on Chip/SoC JTAG debugging control program of flash memory.

The technical solution adopted for the present invention to solve the technical problems is:

A kind of System on Chip/SoC JTAG debugging control program based on flash memory on the sheet; Said JTAG realizes the control to boundary scan chain through TAP; Said TAP interface comprises TCK interface, TMS interface, TDI interface, TDO interface and TRST interface; Said TCK interface, TMS interface and TDI interface are controlled through the data selector of an alternative respectively; Two inputs of data selector are respectively normal signal and fixing low level or high level, are that one register REG1 comes the control data selector switch through a bit wide in the System on Chip/SoC again, when the value of register REG1 be a period of time; Low level signal is connected on TCK interface, TMS interface and the TDI interface shielding jtag interface; And the value of register REG1 is connected to normal signal on TCK interface, TMS interface and the TDI interface when being zero, gets into the normal debugging pattern;

It is KEY1 and KEY2 that two key values are set, and deposits the address AD DR of keyword in the flash memory on the selected sheet;

Said System on Chip/SoC JTAG debugging control program may further comprise the steps:

(1), start-up routine, begin to get finger from zero-address, promptly get into the ROM section;

(2), 32 bit data VALUE are read in the ADDR address of flash memory from the sheet, and VALUE and key value KEY1 are compared:

If VALUE equates with KEY1, then write REG1 as one, jtag interface conductively-closed this moment, and jump to the start address of program;

If VALUE and KEY1 are unequal, then write REG1 as zero, this moment, jtag interface can be worked normally, got into debugging mode smoothly;

(3) continue VALUE and KEY2 are compared:

If VALUE equates with KEY2, then directly jump to the start address of program.If VALUE month KEY2 is unequal, then jump to one section recursion instruction.

As preferred a kind of scheme: said TRST interface is also controlled through the data selector of an alternative, when the value of register REG1 is for the moment, high level signal is received on the TRST interface; When the value of register REG1 is zero, normal signal is received on the TRST interface.

Further, said register REG1 supports read and write.

Said two key value KEY1 and KEY2 select the numerical value except 0xffffffff for use.The address of said two key value KEY1 and KEY2 and the address of program segment are positioned at the diverse location of flash memory on the sheet.

Technical conceive of the present invention is: can shield jtag interface in order to get into smoothly safely and effectively after JTAG debugging and debugging are accomplished; The present invention is to four input pin TCK of JTAG; TMS; TDI, TRST control (if corresponding jtag interface does not have TRST, also can only to other three controls).Can know that by the preamble argumentation these four pins have been debugged crucial effects to JTAG, when these four input pins can normally be imported, JTAG was operated under the debugging mode, can remove to debug chip.Work as TCK, TMS and TDI are fixing low level, when TRST is the high level of fixing; Because do not have TCK to drive, the TMS of model selection simultaneously also is a low level, the normally redirect of TAP state machine; The conductively-closed of JTAG debug function can not go to read and revise the data of chip internal again.It is because TRST when being low level, can make jtag interface reset that TRST is fixed to high level, is high level (not having this to follow pin also not influence final result) so it is connect.Following process thinks that JTAG is the interface with five lines, and promptly jtag interface comprises the TRST line.

Four input pins are controlled through the data selector of an alternative respectively.Two inputs of data selector are respectively normal signal and fixing low level or high level.Be that one register REG1 comes the control data selector switch through a bit wide in the chip again,, low level signal be connected to the TCK of jtag interface when the value of REG1 is for the moment; TMS; TDI is last, and on the TRST with high level signal street jtag interface, the shielding jtag interface; And the value of REG1 is when being zero, and normal signal is connected to the TCK of jtag interface, TMS, and on TDI and the TRST, entering normal debugging pattern.Consider the characteristic of flash memory on the sheet, we will decide the value of REG1 according to the data of flash memory on the sheet, thereby reach the control to the JTAG debugging.It should be noted that REG1 should not go to reset with global reset signal, promptly REG1 only supports read and write, does not support any type of resetting.

The core of whole control process is one section ROM program that is solidificated on the chip, can make the jtag interface operate as normal according to the content of a special address of flash memory on the sheet or shield jtag interface through this section ROM program.At first should determine two 32 key value, these two key values are foundations of judging current demand.Because flash memory generally is the state after wiping after dispatching from the factory on the sheet, promptly all data bit all are one, so two selected key values should be avoided 0xffffffff.Remember that these two selected key values are KEY1 and KEY2.Secondly should select an address of depositing key value.If program also is to leave on the sheet on the flash memory, should note not letting program segment of depositing and the address conflict of depositing key value so.This selected address of note is ADDR.

This section ROM program origin is positioned at the zero-address of chip address space.Can begin to get finger from zero-address behind the program start, promptly can get into the ROM section.The program that the ROM section is solidified will be accomplished following certain operations: at first, 32 bit data VALUE are read in the ADDR address of flash memory from the sheet, and VALUE and KEY1 are compared.If VALUE equates with KEY1, then write REG1 as one, jtag interface conductively-closed this moment, and jump to the start address base address of chip external memory (be generally on the sheet or) of program.If VALUE and KEY1 are unequal, then write REG1 as zero, this moment, jtag interface can be worked normally, got into debugging mode smoothly, and continued VALUE and KEY2 are compared.If VALUE equates with KEY2, then directly jump to the start address of program.If VALUE month KEY2 is unequal, then jump to one section recursion instruction.

According to top analysis, this section ROM program can produce three different state: shielding JTAG jumps to the program The initial segment; Open JTAG, jump to the program The initial segment; Open JTAG, jump to one section recursion instruction.The effect of these three kinds of states is following:

(1) before the chip debugging, flash memory is in the state of wiping on the sheet, and all data bit all are one.After resetting, 32 bit data of reading back in the ROM program that is positioned at zero-address flash memory ADDR address from the sheet are 0xffffffff, and are all unequal with KEY1 and KEY2.The ROM program segment will be opened JTAG; This moment is not because program also is loaded in the storer; Can not leap to the start address (otherwise CPU gets the instruction that can't discern) of program, can only jump to one section recursion instruction, to guarantee to get into smoothly debugging mode.After getting into the JTAG debugging mode, the program that needs are debugged is written into corresponding address space in the storer.And through jtag interface the ADDR address of flash memory on the sheet is write as the value of KEY2.

(2) reset once more start after, the ROM program segment is flash memory ADDR address reading data from the sheet once more, the data of at this moment reading back are for equaling KEY2, JTAG works normally, has downloaded and finishes owing to program, can leap to the start address of program.At this moment working procedure normally, the state of monitoring facilities operation, and modification that as required can be repeatedly and loader again.Move fully correctly up to program, and hope permanent shielding jtag interface,, at this moment the ADD address of flash memory on the sheet is write as the value of KEY1 through jtag interface to prevent the illegal data in the chip that read and revise.

(3) owing to flash memory on the sheet can be preserved data after outage; Later reset each time restart after; The ROM program segment data that read the ADDR address of flash memory from the sheet all equal the value of KEY1, and the JTAG conductively-closed can't go to read and revise the data in the chip through jtag interface again; Also can't go to revise the data of the ADDR address of flash memory on the sheet again, thereby reach the effect of data security in the protection chip.

In sum, the present invention can control the JTAG debugging of System on Chip/SoC through flash memory on the sheet safely and effectively, thereby reaches the purpose of protection chip data security.

Beneficial effect of the present invention mainly shows: in convenient debugging, ensure data security, improving safety.

Description of drawings

Fig. 1 is the synoptic diagram of TAP state machine.

Fig. 2 is the boundary-scan architecture figure of JTAG.

Fig. 3 is a synoptic diagram with simple SOC(system on a chip) of AMBA (Advanced Microcontroller Bus Architecture, Advanced Microcontroller Bus Architecture) 2.0 structures.

Fig. 4 is the synoptic diagram of concrete method of attachment of the jtag interface of CPU.

Fig. 5 is the process flow diagram of ROM program.

Embodiment

Below in conjunction with accompanying drawing the present invention is further described.

With reference to Fig. 3～Fig. 5; A kind of System on Chip/SoC JTAG debugging control program based on flash memory on the sheet; Said JTAG realizes the control to boundary scan chain through TAP; Said TAP interface comprises TCK interface, TMS interface, TDI interface, TDO interface and TRST interface, and said TCK interface, TMS interface and TDI interface are controlled through the data selector of an alternative respectively, and two inputs of data selector are respectively normal signal and fixing low level or high level; Be that one register REG1 comes the control data selector switch through a bit wide in the System on Chip/SoC again; When the value of register REG1 is for the moment, low level signal is connected on TCK interface, TMS interface and the TDI interface shielding jtag interface; And the value of register REG1 is connected to normal signal on TCK interface, TMS interface and the TDI interface when being zero, gets into the normal debugging pattern;

(3) continue VALUE and KEY2 are compared:

Said TRST interface is also controlled through the data selector of an alternative, when the value of register REG1 is for the moment, high level signal is received on the TRST interface; When the value of register REG1 is zero, normal signal is received on the TRST interface.

Said register REG1 supports read and write, does not support any type of resetting.

Fig. 3 is a simple SOC(system on a chip) with AMBA (Advanced Microcontroller Bus Architecture, Advanced Microcontroller Bus Architecture) 2.0 structures.CPU is RISC (Reduced Instruction Set Computer, a Reduced Instruction Set Computer) microprocessor of supporting the JTAG debugging.EFlash is a flash memory on the sheet, and flash memory parallel connection on the sheet that to adopt 4 sizes be 128K can be carried out the visit by word (word, promptly 32), and address space is that 0x80000 is to 0xfffffc.EFlash Controller (flash controller on the sheet) is flash memory and AMBA AHB (Advanced High-performance Bus on the sheet; High performance bus) interface; This interface can be corresponding flash memory control signal with the ahb bus conversion of signals; Thereby realization is read flash memory, writes, and wipes operation.This interface has also been arranged just, and making becomes possibility through JTAG to flash memory online programming on the sheet.

Fig. 4 has provided the concrete method of attachment of the jtag interface of CPU, and the data selector of four alternatives is controlled four input: TMS of jtag interface, TCK, TDI, TRST.Two inputs of data selector one are respectively the input pin TMS_IN and fixing low level of SOC(system on a chip); Two inputs of data selector two are respectively the input pin TCK_IN and fixing low level of SOC(system on a chip); Two inputs of data selector three are respectively the input pin TDI_IN and fixing low level of SOC(system on a chip); Two inputs of data selector four are respectively SOC(system on a chip) input pin TRST_IN and fixing high level.The control signal of four data selections all is JTAG_OFF.This control signal is from a register REG1 among the eFlash Controller, and is consistent with the value of REG1.This REG1 has only read-write capability, can not resetting and reset with system.When control signal JTAG_OFF was high level, fixing low level was selected respectively with fixing high level, and any debugging control information all can't pass to TAP, that is to say that the JTAG debugging is by shielding fully; When JTAG_OFF is low level, selected from the input pin of SOC(system on a chip), can import the data of needs into TAP through these four inputs, thereby the JTAG debugging can be carried out normally.

Selected two key value KEY1; KEY2 is respectively 0x20101234 and 0x19876789 (key value can be chosen arbitrarily, notes not selecting 0xffffffff, the reason articles and opinions that see before to state); The address AD DR that deposits key value is that 0xffff0c (can choose an address arbitrarily in the flash memory address spatial dimension on sheet; Note not be stored in sheet on the data of flash memory conflict mutually, and read according to word, should align in the address).

In order to change the value of register REG1 according to the value of certain address of flash memory on the sheet, need to solidify one section ROM program, and with the start-up routine of this section ROM program as entire chip.The flow process of ROM program is shown in accompanying drawing 5.Whether at first detect eFlash Controller is idle (only in idle condition, could pass through eFlash Controller flash memory on the sheet is initiated read operation).Busyly then wait for, idle then, be designated as VALUE from the data that 0xffff0c reads 32.Again VALUE and 0x20101234 are compared, equal then leap to the program origin.Unequally then the register REG1 among the eFlash Controller is set to 0, is about to JTAG_OFF and is set to low level, and continue VALUE and 0x19876789 are compared.If both equate, then jump to the program The initial segment; If both are unequal, then jump to one section recursion instruction that is positioned at the ROM program.

Before chip began debugging, the back that resets started from the ROM program segment.32 bit data of reading back from 0xffff0c are 0xffffffff (the flash memory original state is an erase status), and with KEY1, KEY2 is unequal, and the ROM program writes 0 with REG1.JTAG_OFF is a low level, and JTAG can operate as normal, and jumps to the recursion instruction of a section and ROM program.Can load the program that needs debugging this moment through JTAG.Program is write 0xffff0c as 0x19876789 after loading and accomplishing again.Reset restart after, be 0x19876789 from the 0xffff0c value of coming of reading back, equate that with KEY2 the ROM program writes 0 with REG1.JTAG_OFF is a low level, and JTAG can operate as normal, and jumps to the The initial segment of program.Can come working procedure this moment through JTAG, but and repetition loading, debugging repeatedly.By the time program debug is accomplished fully, is write 0xffff0c as 0x20121234 again.Reset once more restart after, the data of reading back from 0xffff0c equate that with KEY1 the ROM program writes 1 with REG1.This moment, JTAG_OFF was a high level, the shielding jtag interface, and leap to the program origin, program brings into operation.At this moment, can not come intercepting or update routine through jtag interface again, can not go to write this address of 0xffff0c again.Flash memory can be preserved the data at 0xffff0c place after outage, REG1 can not be reset simultaneously, thereby the state of JTAG conductively-closed can permanently be preserved.

Claims

1. System on Chip/SoC JTAG debugging control program based on flash memory on the sheet; Said JTAG realizes the control to boundary scan chain through TAP; Said TAP interface comprises TCK interface, TMS interface, TDI interface, TDO interface and TRST interface; It is characterized in that: said TCK interface, TMS interface and TDI interface are controlled through the data selector of an alternative respectively; Two inputs of data selector are respectively normal signal and fixing low level signal, are that one register REG1 comes the control data selector switch through a bit wide in the System on Chip/SoC again, when the value of register REG1 be a period of time; Low level signal is connected on TCK interface, TMS interface and the TDI interface shielding jtag interface; And the value of register REG1 is connected to normal signal on TCK interface, TMS interface and the TDI interface when being zero, gets into the normal debugging pattern;

(3) continue VALUE and KEY2 are compared:

If VALUE equates with KEY2, then directly jump to the start address of program; If VALUE and KEY2 are unequal, then jump to one section recursion instruction.

2. a kind of System on Chip/SoC JTAG debugging control program as claimed in claim 1 based on flash memory on the sheet; It is characterized in that: said TRST interface is also controlled through the data selector of an alternative; Two inputs of data selector are respectively normal signal and fixing high level signal; When the value of register REG1 is for the moment, high level signal is received on the TRST interface; When the value of register REG1 is zero, normal signal is received on the TRST interface.

3. according to claim 1 or claim 2 a kind of System on Chip/SoC JTAG debugging control program based on flash memory on the sheet, it is characterized in that: said register REG1 supports read and write.

4. according to claim 1 or claim 2 a kind of System on Chip/SoC JTAG debugging control program based on flash memory on the sheet, it is characterized in that: said two key value KEY1 and KEY2 select the numerical value except 0xffffffff for use.

5. a kind of System on Chip/SoC JTAG debugging control program based on flash memory on the sheet as claimed in claim 4 is characterized in that: the address of said two key value KEY1 and KEY2 and the address of program segment are positioned at the diverse location of flash memory on the sheet.