JTAG Port Disable (Passive) - JTAG Port Disable (Passive) - XAPP1098

Developing Tamper-Resistant Designs with UltraScale and UltraScale+ FPGAs (XAPP1098)

Document ID
XAPP1098
Release Date
2025-05-22
Revision
1.5.1 English

There are two passive ways of disabling the external JTAG port: one is temporary and the other is permanent. The temporary method is to add the set_property BITSTREAM.GENERAL.DISABLE_JTAG YES [current_design] option when using the write_bitstream Tcl command in the Vivado tools. In this case, the external JTAG port becomes disabled after the configuration bitstream is loaded. This method also disables the internal MASTER_JTAG port.

Note: If the Vivado tool option is used and an attacker tries to turn off this option later on, this bit-flip attack is detected by the authentication and the device does not start up. This modification is either detected by the RSA (asymmetric) or AES-GCM (symmetric) algorithms, depending on which authentication methods are enabled.

The Vivado hardware manager can program an eFUSE bit (namely, the FUSE_SHAD_SEC[3] bit in the FUSE_SEC register) to permanently disable the external JTAG port. This method effectively disables the external pins and turns them inside to the FPGA logic. This is effective as an external JTAG disable if authentication is required or if the only time the JTAG disable is required is while the user design is loaded. This would most likely be done as one of the last steps in a production facility so that JTAG-based boundary scan could still be used on the circuit board for testing prior to the programming of this eFUSE.