An attacker often starts at the external JTAG port when trying to break into a system. With UltraScale and UltraScale+ FPGAs, there are a number of active methods to block the JTAG port that can be done both temporarily and permanently. Like in previous FPGA families, the first method uses a single BSCANE2 primitive that is instantiated with the DISABLE_JTAG attribute set to TRUE. This breaks the JTAG chain (both the external JTAG port and the internal MASTER_JTAG port) and any other devices in the same chain as the FPGA device, either upstream or downstream. Here is an example VHDL instantiation (refer to UltraScale Architecture Libraries Guide (UG974)) for an UltraScale or UltraScale+ FPGA design:
BSCAN_U0 : BSCANE2
generic map (
DISABLE_JTAG => TRUE,
JTAG_CHAIN => 1 -- can be 1, 2, 3, or 4 depending on chain location
)
port map (
CAPTURE => open,
DRCK => open,
RESET => open,
RUNTEST => open,
SEL => open,
SHIFT => open,
TCK => tck_signal,
TDI => tdi_signal, TMS => tms_signal, UPDATE => open,
TDO => '1'
);The second method to block the external JTAG port is to instantiate a new primitive for the UltraScale and UltraScale+ FPGAs named MASTER_JTAG. This primitive can be used to override the external JTAG pins of the FPGA allowing full access to the JTAG port from within the device. This method effectively disables the external pins and turn them inside to the FPGA logic. This is effective as an external JTAG disable if authentication is required or if the only time the JTAG disable is required is while the user design is loaded. Using this method, the user design now has full JTAG control but any activity on the external JTAG pins cannot be monitored. Because MASTER_JTAG is accessible by the user design, in response to a tamper event it could be used to program an eFUSE bit that permanently disables the external JTAG port. Contact your local AMD FAE for additional details on how to program eFUSE bits from within the device via MASTER_JTAG.
If there are any JTAG-based debugging tools in your FPGA logic design (which are connected to the dedicated external JTAG port), breaking the JTAG chain does not allow them to function. During the FPGA debug phase, the JTAG chain can be left intact and then broken later on in the development cycle when the JTAG-based debugger tool is no longer required.
JTAG configuration of the device cannot be used when the option to break the JTAG chain is enabled. You must choose one of the other configuration interfaces such as serial, serial peripheral interface (SPI), byte parallel interface (BPI), and SelectMAP. Refer to UltraScale Architecture Configuration User Guide (UG570) for more information. JTAG boundary-scan board-level tests operate normally as long as the actual configuration of the FPGA is delayed.