Access authentication circuit for serial line debugging
By introducing a sequence detection module and an output control module into the SWD interface, access to MCU resources is only allowed when a valid sequence is detected, thus solving the security risks and false triggering problems of the SWD interface and achieving higher security and stability.
Patent Information
- Application Number
- CN202511136081.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-08-14
- Publication Date
- 2025-11-28
AI Technical Summary
The SWD interface poses significant security risks when accessing internal MCU resources and is prone to accidental triggering.
A serial line debugging access authentication circuit was designed. When the sequence detection module detects a valid sequence, the control output module outputs a valid clock signal, allowing only authorized users to access the internal resources of the MCU. When not needed, the sequence detection module is stopped to avoid false triggering.
It improves the security and stability of SWD access to the MCU, prevents unauthorized user access, and reduces the possibility of accidental triggering.
Smart Images
Figure CN121030728A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of digital circuit technology, and more particularly to an access authentication circuit for serial line debugging. Background Technology
[0002] SWD (Serial Wire Debug) is a debugging interface standard in the field of embedded systems, used to replace the traditional JTAG interface. SWD is characterized by requiring only two wires (clock line SWCLK and data line SWDIO) to achieve debugging functionality, saving more pin resources compared to JTAG, and is widely used in ARM architecture microcontrollers (MicroControl Unit, MCU).
[0003] While SWD provides convenient access to the internal resources of the MCU, it also poses significant security risks. Summary of the Invention
[0004] This invention provides a serial line debugging access authentication circuit to improve the security of SWD accessing the MCU.
[0005] According to one aspect of the present invention, a serial line debugging access authentication circuit is provided, comprising: an output control module, an output module, and a sequence detection module;
[0006] The input terminal of the sequence detection module is connected to a data line, the output terminal of the sequence detection module is connected to the first control terminal of the output control module, the second control terminal of the output control module is connected to a microcontroller, the output terminal of the output control module is connected to the control terminal of the output module, the input terminal of the output module is connected to a clock line, the first output terminal of the output module is connected to a subsequent debugging circuit, and the second output terminal of the output module is connected to the clock terminal of the sequence detection module. The output control module is used to control the clock signal output by the first output terminal of the output module to be valid and the clock signal output by the second output terminal of the output module to be invalid when the sequence value detected by the sequence detection module is equal to a preset value, or to respond to the signal output by the microcontroller to control the clock signal output by the first output terminal of the output module to be invalid and the clock signal output by the second output terminal of the output module to be valid.
[0007] Optionally, the output control module includes a first trigger, the data input terminal of the first trigger is connected to the output terminal of the first trigger, the set terminal of the first trigger is connected to the output terminal of the sequence detection module, the reset terminal of the first trigger is connected to the microcontroller, and the output terminal of the first trigger is connected to the control terminal of the output module.
[0008] Optionally, the output module includes a first output unit and a second output unit. The control terminal of the first output unit is connected to the output terminal of the output control module, the input terminal of the first output unit is connected to the clock line, and the output terminal of the first output unit is connected to the subsequent debugging circuit. The control terminal of the second output unit is connected to the output terminal of the output control module, the input terminal of the second output unit is connected to the clock line, and the output terminal of the second output unit is connected to the clock terminal of the sequence detection module.
[0009] Optionally, the first output unit includes a first clock gating unit, and the second output unit includes a second clock gating unit and an inverter;
[0010] The input terminals of the first clock gating unit and the second clock gating unit are both connected to the clock line. The control terminal of the first clock gating unit is connected to the output terminal of the output control module. The output terminal of the first clock gating unit is connected to the subsequent debugging circuit. The control terminal of the second clock gating unit is connected to the output terminal of the inverter. The input terminal of the inverter is connected to the output terminal of the output control module. The output terminal of the second clock gating unit is connected to the clock terminal of the sequence detection module.
[0011] Optionally, the sequence detection module includes an initial state setting unit, a first logic operation unit, a second logic operation unit, and n cascaded storage units. The input terminal of the first logic operation unit is connected to the output terminals of at least two of the n cascaded storage units. The output terminal of the first logic operation unit is connected to the control terminal of each level of the storage unit. The first input terminal of the first level storage unit is connected to the data line, and the output terminal of the previous level storage unit is connected to the first input terminal of the current level storage unit. The initial state setting unit is connected to the second input terminals of the n storage units and is used to write initial values to the n storage units respectively. The first logic operation unit is used to perform logical operations on the output results of the storage units connected to it and select the first or second input terminal of the storage unit according to the logical operation result.
[0012] The input terminal of the second logic operation unit is connected to the output terminal of each level of the storage unit, and the output terminal of the second logic operation unit is connected to the first control terminal of the output control module. The second logic operation unit is used to detect the sequence value output by the n-level storage unit, where n is an integer greater than 1.
[0013] Optionally, the storage unit includes a first selector and a second flip-flop. The control terminal of the first selector is connected to the output terminal of the first logic operation unit, the output terminal of the first selector is connected to the data input terminal of the second flip-flop, the clock terminal of the second flip-flop is connected to the second output terminal of the output module, the output terminal of the second flip-flop in the previous level storage unit is connected to the first input terminal of the first selector in the current level storage unit, wherein the first input terminal of the first selector in the first level storage unit is connected to the data line, and the second input terminals of the first selectors in each level storage unit are respectively connected to the output terminal of the initial state setting unit.
[0014] Optionally, the first logic operation unit includes at least one first XOR gate, and the first logic operation unit further includes a second selector and a second XOR gate. The input terminal of one of the first XOR gates is connected to the output terminals of two of the memory cells. The output terminal of the first XOR gate is connected to the input terminal of the second selector. The output terminal of the second selector is connected to the first input terminal of the second XOR gate. The second output terminal of the second XOR gate is connected to the data line. The output terminal of the second XOR gate is connected to the control terminal of each of the memory cells. The control terminal of the second selector is connected to a selection control signal.
[0015] Optionally, the number of the first XOR gates matches the number of inputs to the second selector.
[0016] Optionally, the sequence detection module further includes a third logic operation unit and a verification unit. The third logic operation unit is used to output the expected value of the n-level storage units in the next step based on the XOR value of the first n-1 levels of the storage units and the input value of the second XOR gate. The input terminal of the verification unit is connected to the output terminal of the third logic operation unit, and the verification unit is used to verify the expected value.
[0017] The connection path between the second XOR gate and the control terminal of each of the memory cells also includes a fourth logic operation unit. The first input terminal of the fourth logic operation unit is connected to the output terminal of the second XOR gate, the second input terminal of the fourth logic operation unit is connected to the output terminal of the verification unit, and the output terminal of the fourth logic operation unit is connected to the control terminal of each of the memory cells.
[0018] Optionally, the third logic operation unit includes a third XOR gate, a third selector, and a third flip-flop; the verification unit includes a fourth XOR gate and a fourth flip-flop; and the fourth logic operation unit includes an OR gate.
[0019] The first input of the third XOR gate is connected to the input of the second XOR gate. The second input of the third XOR gate is connected to the XOR value of the first n-1 levels of the storage cells. The output of the third XOR gate is connected to the first input of the third selector. The second input of the third selector is connected to a set signal. The control terminal of the third selector is connected to the output of the OR gate. The output of the third selector is connected to the data input of the third flip-flop. The output of the third flip-flop is connected to the first input of the fourth XOR gate. The second input of the fourth XOR gate is connected to the output of the nth level of the storage cell. The third input of the fourth XOR gate is connected to the second input of the third XOR gate. The output of the fourth XOR gate is connected to the data input of the fourth flip-flop. The output of the fourth flip-flop is connected to the first input of the OR gate. The second input of the OR gate is connected to the output of the second XOR gate. The output of the OR gate is connected to the control terminal of each level of the storage cells.
[0020] The serial line debugging access authentication circuit provided in this embodiment of the invention controls the first clock signal output by the output module to be valid when the sequence detection module detects a valid sequence, thereby ensuring that only authorized users can access the internal resources of the MCU via SWD, thus improving system security. Furthermore, when the first clock signal swclk is valid, the second clock signal prbs_clk is invalid, causing the sequence detection module to stop working, avoiding false triggering, and improving the stability of system operation.
[0021] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description
[0022] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0023] Figure 1 A schematic diagram of the structure of an access authentication circuit for serial line debugging provided in an embodiment of the present invention;
[0024] Figure 2 A schematic diagram of another serial line debugging access authentication circuit provided in an embodiment of the present invention;
[0025] Figure 3 A schematic diagram of another serial line debugging access authentication circuit provided in an embodiment of the present invention;
[0026] Figure 4 A schematic diagram of another serial line debugging access authentication circuit provided in an embodiment of the present invention;
[0027] Figure 5 A schematic diagram of another serial line debugging access authentication circuit provided in an embodiment of the present invention;
[0028] Figure 6 A schematic diagram of another serial line debugging access authentication circuit provided in an embodiment of the present invention;
[0029] Figure 7 This is a schematic diagram of another serial line debugging access authentication circuit provided in an embodiment of the present invention. Detailed Implementation
[0030] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.
[0031] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.
[0032] Figure 1 This is a schematic diagram of the access authentication circuit for serial line debugging provided in an embodiment of the present invention, with reference to... Figure 1 The serial line debugging access authentication circuit provided in this embodiment includes: an output control module 10, an output module 20, and a sequence detection module 30;
[0033] The input terminal of the sequence detection module 30 is connected to the data line SWDIO. The output terminal of the sequence detection module 30 is connected to the first control terminal of the output control module 10. The second control terminal of the output control module 10 is connected to the microcontroller 40. The output terminal of the output control module 10 is connected to the control terminal of the output module 20. The input terminal of the output module 20 is connected to the clock line SWCLK. The first output terminal of the output module 20 is connected to the subsequent debugging circuit. The second output terminal of the output module 20 is connected to the clock terminal of the sequence detection module 30. The output control module 10 is used to control the clock signal output by the first output terminal of the output module 20 to be valid and the clock signal output by the second output terminal of the output module 20 to be invalid when the sequence value detected by the sequence detection module 30 is equal to the preset value. Alternatively, in response to the signal output by the microcontroller 40, the clock signal output by the first output terminal of the output module 20 is invalid and the clock signal output by the second output terminal of the output module 20 is valid.
[0034] Specifically, the sequence detection module 30 can be used to receive data on the data line SWDIO and detect the data on the data line SWDIO. When the detected sequence value is equal to the preset value, the control signal output by the output terminal of the control output module 10 makes the clock signal output by the first output terminal of the output module 20 valid, while the clock signal output by the second output terminal of the output module 20 invalid.
[0035] For example, the clock signal output by the first output terminal of the output module 20 is the first clock signal swclk, and the clock signal output by the second output terminal is the second clock signal prbs_clk. The first clock signal swclk is used to provide a working clock for the subsequent debugging circuit, and the second clock signal prbs_clk is used to provide a working clock for the sequence detection module 30.
[0036] When the sequence detection module 30 detects that the sequence value of the data on the data line SWDIO is equal to a preset value, it indicates that a valid sequence has been detected. The output control module 10 controls the first clock signal swclk output by the output module 20 to be valid, allowing SWD to access the internal resources of the MCU. At this time, the second clock signal prbs_clk output by the output module 20 is invalid, and the sequence detection module 30 stops working to prevent false triggering.
[0037] When access to SWD needs to be restricted, the microcontroller 40 generates a pulse signal (e.g., generated by a write operation to the write-protect register by the microcontroller 40). The output control module 10 responds to this pulse signal by making the second clock signal prbs_clk output by the output module 20 valid, and the sequence detection module 30 operates normally. At this time, the first clock signal swclk output by the output module 20 is invalid, and SWD cannot access the internal resources of the MCU.
[0038] The serial line debugging access authentication circuit provided in this embodiment of the invention controls the first clock signal swclk output by the output module 20 to be valid when the sequence detection module 30 detects a valid sequence, thereby ensuring that only authorized users can access the internal resources of the MCU via SWD, thus improving system security. Furthermore, when the first clock signal swclk is valid, the second clock signal prbs_clk is invalid, causing the sequence detection module 30 to stop working, avoiding false triggering, and improving the stability of system operation.
[0039] Figure 2 A schematic diagram of another serial line debugging access authentication circuit provided in an embodiment of the present invention is shown below. Figure 2 Based on the above embodiments, optionally, the output control module 10 includes a first trigger 101, the data input terminal D of the first trigger 101 is connected to the output terminal Q of the first trigger 101, the set terminal of the first trigger 101 is connected to the output terminal of the sequence detection module 30, the reset terminal of the first trigger 101 is connected to the microcontroller 40, and the output terminal Q of the first trigger 101 is connected to the control terminal of the output module 20.
[0040] The first flip-flop 101 can be an SR flip-flop. When the set input of the first flip-flop 101 is 1 and the reset input is 0, the output Q is 1; when the set input of the first flip-flop 101 is 0 and the reset input is 1, the output Q is 0; when the set input of the first flip-flop 101 is 0 and the reset input is 0, the state is maintained. Using the first flip-flop 101 to control the output of the output module 20 is simple to operate and helps to simplify the circuit structure and reduce circuit cost.
[0041] Figure 3 A schematic diagram of another serial line debugging access authentication circuit provided in an embodiment of the present invention is shown below. Figure 3 Based on the above embodiments, optionally, the output module 20 includes a first output unit 201 and a second output unit 202. The control terminal of the first output unit 201 is connected to the output terminal of the output control module 10, the input terminal of the first output unit 201 is connected to the clock line SWCLK, and the output terminal of the first output unit 201 is connected to the subsequent debugging circuit. The control terminal of the second output unit 202 is connected to the output terminal of the output control module 10, the input terminal of the second output unit 202 is connected to the clock line SWCLK, and the output terminal of the second output unit 202 is connected to the clock terminal of the sequence detection module 30.
[0042] Both the first output unit 201 and the second output unit 202 respond to the signals output by the output control module 10, but the first output unit 201 and the second output unit 202 have different working states, that is, the first output unit 201 and the second output unit 202 are not turned on at the same time, so that one of the two clock signals output by the output module 20 is valid and the other is invalid.
[0043] Specifically, the first output unit 201 includes a first clock gating unit CG1, and the second output unit 202 includes a second clock gating unit CG2 and an inverter U1. The input terminals of the first clock gating unit CG1 and the second clock gating unit CG2 are both connected to the clock line SWCLK. The control terminal of the first clock gating unit CG1 is connected to the output terminal of the output control module 10, and the output terminal of the first clock gating unit CG1 is connected to the subsequent debugging circuit. The control terminal of the second clock gating unit CG2 is connected to the output terminal of the inverter U1, and the input terminal of the inverter U1 is connected to the output terminal of the output control module 10. The output terminal of the second clock gating unit CG2 is connected to the clock terminal of the sequence detection module 30.
[0044] The clock gating unit is a functional unit used for dynamically controlling the transmission of clock signals. It can cut off the clock signal when the circuit is not needed, thereby reducing dynamic losses. When the gating signal of the clock gating unit is valid, the clock gating unit can transmit the clock signal input to its input terminal to its output terminal without obstruction. When the gating signal of the clock gating unit is invalid, the clock signal is turned off, and the output remains at a high or low level. In an optional embodiment, the clock gating unit may consist of logic gates and flip-flops.
[0045] In this embodiment, the sequence detection module 30 detects the data on the data line SWDIO. When the sequence value output by the sequence detection module 30 equals a preset value, the set terminal of the first flip-flop 101 is set to 1, thus setting the output of the first flip-flop 101 to 1. At this time, the first clock gating unit CG1 is turned on, and the second clock gating unit CG2 is turned off. The first clock gating unit CG1 outputs the clock signal on the clock line SWCLK to form the first clock signal swclk, allowing access to SWD. Simultaneously, the sequence detection module 30 stops working. When SWD access is prohibited, the microcontroller 40 controls the reset terminal 101 of the first flip-flop 101 to 1, thus setting the output of the first flip-flop 101 to 0. At this time, the first clock gating unit CG1 is turned off, and the second clock gating unit CG2 is turned on. The second clock gating unit CG2 outputs the clock signal on the clock line SWCLK to form the second clock signal prbs_clk, thus prohibiting access to SWD. Simultaneously, the sequence detection module 30 starts working.
[0046] Figure 4This is a schematic diagram of another serial line debugging access authentication circuit provided in an embodiment of the present invention, combined with... Figure 3 and Figure 4 Based on the above embodiments, optionally, the sequence detection module 30 includes an initial state setting unit 302, a first logic operation unit 303, a second logic operation unit 304, and n cascaded storage units 301. The input terminal of the first logic operation unit 303 is connected to the output terminal a of at least two of the n cascaded storage units 301. The output terminal of the first logic operation unit 303 is connected to the control terminal b of each level of storage unit 301. The first input terminal c of the first level storage unit 301 is connected to the data line SWDIO. The output terminal a of the previous level storage unit 301 is connected to the first input terminal c of the current level storage unit 301. The initial state setting unit 302... The initial state setting unit 302 is used to write initial values to the n storage units 301 respectively. The first logic operation unit 303 is used to perform logical operations on the output results of the storage units 301 connected to itself, and select the first input terminal c or the second input terminal d of the storage unit 301 according to the logical operation results. The input terminals of the second logic operation unit 304 are respectively connected to the output terminals of each level of storage units 301, and the output terminal of the second logic operation unit 304 is connected to the first control terminal of the output control module 10. The second logic operation unit 304 is used to detect the sequence values output by the n-level storage units 301, where n is an integer greater than 1.
[0047] The sequence detection module 30 can be an n-level linear feedback shift register detection circuit. Through specific linear feedback rules, the register state can change periodically according to a predicted pattern, thereby generating a sequence.
[0048] In this embodiment, the initial state setting unit 302 can assign initial values to each level of storage unit 301, and the initial values of the n storage units 301 are not all zero. In each clock cycle, the n cascaded storage units 301 perform a shift operation and update the state of the storage units 301 according to the logical operation result of the first logic operation unit 303, thereby making the output column exhibit periodic changes.
[0049] Figure 5 A schematic diagram of another serial line debugging access authentication circuit provided in an embodiment of the present invention is shown below. Figure 4 and Figure 5Based on the above embodiments, optionally, the storage unit 301 includes a first selector 32 and a second flip-flop 31 (the n second flip-flops are numbered from left to right as sreg[0], sreg[1], sreg[2]...sreg[n-1], sreg[n]). The control terminal of the first selector 32 is connected to the output terminal of the first logic operation unit 303, the output terminal of the first selector 32 is connected to the data input terminal D of the second flip-flop 301, and the clock terminal of the second flip-flop 31 is connected to the second output terminal of the output module 20. The output terminal of the second flip-flop 31 in the storage unit 301 is connected to the first input terminal of the first selector 32 in the same level storage unit 301. The first input terminal of the first selector 32 in the first level storage unit 301 is connected to the data line SWDIO. The second input terminals of the first selectors 32 in each level storage unit 301 are respectively connected to the output terminals of the initial state setting unit 302. The initial state setting unit 302 outputs sinit[0], sinit[1], sinit[2]...sinit[n-1], sinit[n] respectively.
[0050] The first logic operation unit 303 includes at least one first XOR gate xor1. The first logic operation unit 303 also includes a second selector 33 and a second XOR gate xor2. The input terminal of the first XOR gate xor1 is connected to the output terminal a of the two memory cells 301. The output terminal of the first XOR gate xor1 is connected to the input terminal of the second selector 33. The output terminal of the second selector 33 is connected to the first input terminal of the second XOR gate xor2. The second output terminal of the second XOR gate xor2 is connected to the data line SWDIO. The output terminal of the second XOR gate xor2 is connected to the control terminal b of each memory cell 301. The control terminal of the second selector 33 is connected to the selection control signal Sel.
[0051] Each second flip-flop 31 stores one bit of binary data (0 or 1), and linear feedback logic is implemented through taps (for extracting signals from a specific second flip-flop 31) and XOR gates (first XOR gate xor1 and second XOR gate xor2). Here, the tap position is defined by the "characteristic polynomial".
[0052] Specifically, taking n=10 as an example, the characteristic polynomial generated by the 10-level storage unit 301 is 1+x 2 +x 9 The tap positions are the third stage second flip-flop sreg[2] and the tenth stage second flip-flop sreg[9]. The initial state setting unit 302 assigns initial values to each stage of the second flip-flop, and the output state of the 10-stage linear feedback shift register is (sreg[0], sreg[1], ..., sreg[8], sreg[9]).
[0053] The output values of the third-stage second flip-flop sreg[2] and the tenth-stage second flip-flop sreg[9] are XORed by the first XOR gate xor1. The output good_bit_val of the first XOR gate xor is sreg[2]⊕sreg[9]. good_bit_val and the value on the data line SWDIO are XORed by the second XOR gate xor2 and fed back to the data input terminal D of the first-stage second flip-flop sreg[0] to realize the sequence output. At this time, the output state of the 10-stage linear feedback shift register is (sreg[9]⊕sreg[2], sreg[0], sreg[1], ... sreg[8]). As the clock cycle progresses, the output state of the linear feedback shift register is continuously updated, and the output sequence exhibits periodicity. The maximum period of the 10-stage linear feedback shift register is 1023, that is, 1023 different bits will be generated before the sequence repeats.
[0054] In this embodiment, when the value of good_bit_val is the same as the value of SWDIO, the output of the second XOR gate xor2 is 0. Each first selector 32 selects the first input terminal as input. The output of the first XOR gate xor1 and the value on the data line SWDIO are XORed by the second XOR gate xor2 to compare the value of the data line SWDIO, thereby calculating the expected value of the next sequence. When the value of good_bit_val is different from the value of SWDIO, the output of the second XOR gate xor2 is 1. Each first selector 32 selects the second input terminal as input, and the initial value is loaded into each second flip-flop in the next step. The second logic operation unit 304 performs logical operations (e.g., XOR operation) on the output of each second flip-flop. When the output sequence is a valid sequence, the second logic operation unit 304 sets the first flip-flop 101, thereby realizing the access function of SWD.
[0055] Figure 6 This is a schematic diagram of another serial line debugging access authentication circuit provided in an embodiment of the present invention, combined with... Figure 5 and Figure 6 In this embodiment, the number of first XOR gates (xor1) matches the number of inputs to the second selector 33. That is, when there is only one first XOR gate (xor1), the second selector 33 also has only one input (e.g., ...). Figure 5 As shown), in this case, the second selector 33 can also be omitted. When there are multiple first XOR gates (xor1), the inputs of the second selector 33 are also multiple (e.g., Figure 6 As shown in the diagram, at this point, different feature polynomials can be generated through the second selector 33 to correspond to different SWD input sequences, which helps to improve the diversity and flexibility of SWD access. Figure 6 The working principle of the structure shown is Figure 5The working principle of the structure shown is the same, so it will not be described again.
[0056] Figure 7 A schematic diagram of another serial line debugging access authentication circuit provided in an embodiment of the present invention is shown below. Figure 7 ,by Figure 5 Based on the structure shown, the sequence detection module 30 in the serial line debugging access authentication circuit provided in this embodiment further includes a third logic operation unit 305 and a verification unit 306. The third logic operation unit 305 is used to output the expected value of the n-level storage unit 301 in the next step based on the XOR value of the first n-1 level storage unit 301 and the input value of the second XOR gate XOR2. The input terminal of the verification unit 306 is connected to the output terminal of the third logic operation unit 305, and the verification unit 306 is used to verify the expected value.
[0057] Furthermore, a fourth logic operation unit 307 is also included in the connection path between the second XOR gate XOR2 and the control terminal of each memory cell 301. The first input terminal of the fourth logic operation unit 307 is connected to the output terminal of the second XOR gate XOR2, the second input terminal of the fourth logic operation unit 3074 is connected to the output terminal of the verification unit 306, and the output terminal of the fourth logic operation unit 307 is connected to the control terminal of each memory cell 301.
[0058] The third logic operation unit 305 includes a third XOR gate (XOR3), a third selector 315, and a third flip-flop 325; the verification unit 306 includes a fourth XOR gate (XOR4) and a fourth flip-flop 316; and the fourth logic operation unit 307 includes an OR gate (OR). The first input of the third XOR gate (XOR3) is connected to the input of the second XOR gate (XOR2); the second input of the third XOR gate (XOR3) is connected to the XOR value of the first n-1 level storage units 301; the output of the third XOR gate (XOR3) is connected to the first input of the third selector 315; the second input of the third selector 315 is connected to a set signal RE (the set signal RE can be a 1-bit signal, such as 0); and the control terminal of the third selector 315... The output of the OR gate is connected to the output of the third selector 315, which is connected to the data input D of the third flip-flop 325. The output of the third flip-flop 315 is connected to the first input of the fourth XOR gate XOR4. The second input of the fourth XOR gate XOR4 is connected to the output of the nth level storage unit 301. The third input of the fourth XOR gate XOR4 is connected to the second input of the third XOR gate XOR3. The output of the fourth XOR gate XOR4 is connected to the data input D of the fourth flip-flop 316. The output Q of the fourth flip-flop 316 is connected to the first input of the OR gate OR. The second input of the OR gate OR is connected to the output of the second XOR gate XOR2. The output of the OR gate OR is connected to the control terminal of each level storage unit 301.
[0059] Specifically, the output of the third XOR gate xor3 is good_bit_val⊕sreg[0]⊕sreg[1]⊕…⊕sreg[8] (sreg[0]⊕sreg[1]⊕…⊕sreg[8] can be implemented by multiple fifth XOR gates xor5). This value can be understood as the expected value of sreg[0]⊕sreg[1]⊕…⊕sreg[9] in the next cycle. After good_bit_val⊕sreg[0]⊕sreg[1]⊕…⊕sreg[8] is registered by the third flip-flop 325 for one cycle, it is then XORed with the current sreg[0]⊕sreg[1]⊕…⊕sreg[9] through the fourth XOR gate xor4 to verify the registered value of the third flip-flop 325. If the two do not match, the fourth trigger 316 will be set, controlling the second input terminal of the first selector 32 as the input, so that the initial value is loaded into the second trigger 31 in the next step, avoiding the phenomenon of sequence output disorder, which helps to improve the accuracy of sequence detection and thus improve the security of SWD access.
[0060] The sequence detection module 30 provided in this embodiment operates under the second clock signal prbs_clk. When the second clock signal prbs_clk is valid, the sequence detection module 30 works normally, and the initial value (sreg[9:0]) of the sequence detection module 30 is 0xA3 (hexadecimal). If the value on the data line SWDIO is the same as the preset value of the sequence, after 1023 cycles, the value of sreg[9:0] is 0x251. At this time, the first flip-flop 101 is set, the first clock signal swclk output by the output module 20 is valid, the second clock signal prbs_clk is invalid, the sequence detection module 30 stops working, and SWD is allowed to access, thereby preventing unauthorized users from debugging the embedded device and improving the security of the system.
[0061] Optionally, the technical solution provided in this embodiment, in addition to authenticating the scope of the SWD interface, can also be used for switching the functions of the SWD and SWC interfaces. For example, when the SWD and SWC interfaces are used as I / O interfaces, the debugging function is disabled. When the expected sequence is detected on the SWD, the SWD and SWC interfaces can be switched from I / O interface mode back to debug mode.
[0062] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.
[0063] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.
Claims
1. A serial line debugging access authentication circuit, characterized in that, include: Output control module, output module, and sequence detection module; The input terminal of the sequence detection module is connected to a data line, the output terminal of the sequence detection module is connected to the first control terminal of the output control module, the second control terminal of the output control module is connected to a microcontroller, the output terminal of the output control module is connected to the control terminal of the output module, the input terminal of the output module is connected to a clock line, the first output terminal of the output module is connected to a subsequent debugging circuit, and the second output terminal of the output module is connected to the clock terminal of the sequence detection module. The output control module is used to control the clock signal output by the first output terminal of the output module to be valid and the clock signal output by the second output terminal of the output module to be invalid when the sequence value detected by the sequence detection module is equal to a preset value, or to respond to the signal output by the microcontroller to control the clock signal output by the first output terminal of the output module to be invalid and the clock signal output by the second output terminal of the output module to be valid.
2. The access authentication circuit for serial line debugging according to claim 1, characterized in that, The output control module includes a first trigger, the data input terminal of the first trigger is connected to the output terminal of the first trigger, the set terminal of the first trigger is connected to the output terminal of the sequence detection module, the reset terminal of the first trigger is connected to the microcontroller, and the output terminal of the first trigger is connected to the control terminal of the output module.
3. The access authentication circuit for serial line debugging according to claim 1, characterized in that, The output module includes a first output unit and a second output unit. The control terminal of the first output unit is connected to the output terminal of the output control module, the input terminal of the first output unit is connected to the clock line, and the output terminal of the first output unit is connected to the subsequent debugging circuit. The control terminal of the second output unit is connected to the output terminal of the output control module, the input terminal of the second output unit is connected to the clock line, and the output terminal of the second output unit is connected to the clock terminal of the sequence detection module.
4. The access authentication circuit for serial line debugging according to claim 3, characterized in that, The first output unit includes a first clock gating unit, and the second output unit includes a second clock gating unit and an inverter; The input terminals of the first clock gating unit and the second clock gating unit are both connected to the clock line. The control terminal of the first clock gating unit is connected to the output terminal of the output control module. The output terminal of the first clock gating unit is connected to the subsequent debugging circuit. The control terminal of the second clock gating unit is connected to the output terminal of the inverter. The input terminal of the inverter is connected to the output terminal of the output control module. The output terminal of the second clock gating unit is connected to the clock terminal of the sequence detection module.
5. The access authentication circuit for serial line debugging according to claim 1, characterized in that, The sequence detection module includes an initial state setting unit, a first logic operation unit, a second logic operation unit, and n cascaded storage units. The input terminal of the first logic operation unit is connected to the output terminals of at least two of the n cascaded storage units. The output terminals of the first logic operation unit are respectively connected to the control terminals of each level of the storage units. The first input terminal of the first level storage unit is connected to the data line. The output terminal of the previous level storage unit is connected to the first input terminal of the current level storage unit. The initial state setting unit is connected to the second input terminals of the n storage units and is used to write initial values to the n storage units respectively. The first logic operation unit is used to perform logical operations on the output results of the storage unit connected to itself, and select the first input terminal or the second input terminal of the storage unit according to the logical operation result; The input terminal of the second logic operation unit is connected to the output terminal of each level of the storage unit, and the output terminal of the second logic operation unit is connected to the first control terminal of the output control module. The second logic operation unit is used to detect the sequence value output by the n-level storage unit, where n is an integer greater than 1.
6. The access authentication circuit for serial line debugging according to claim 5, characterized in that, The storage unit includes a first selector and a second flip-flop. The control terminal of the first selector is connected to the output terminal of the first logic operation unit. The output terminal of the first selector is connected to the data input terminal of the second flip-flop. The clock terminal of the second flip-flop is connected to the second output terminal of the output module. The output terminal of the second flip-flop in the previous level storage unit is connected to the first input terminal of the first selector in the current level storage unit. The first input terminal of the first selector in the first level storage unit is connected to the data line. The second input terminals of the first selectors in each level storage unit are respectively connected to the output terminal of the initial state setting unit.
7. The access authentication circuit for serial line debugging according to claim 5, characterized in that, The first logic operation unit includes at least one first XOR gate, and the first logic operation unit also includes a second selector and a second XOR gate. The input terminal of one of the first XOR gates is connected to the output terminals of two of the memory cells. The output terminal of the first XOR gate is connected to the input terminal of the second selector. The output terminal of the second selector is connected to the first input terminal of the second XOR gate. The second output terminal of the second XOR gate is connected to the data line. The output terminal of the second XOR gate is connected to the control terminal of each of the memory cells. The control terminal of the second selector is connected to a selection control signal.
8. The access authentication circuit for serial line debugging according to claim 7, characterized in that, The number of the first XOR gates matches the number of inputs to the second selector.
9. The access authentication circuit for serial line debugging according to claim 7, characterized in that, The sequence detection module further includes a third logic operation unit and a verification unit. The third logic operation unit is used to output the expected value of the n-level storage units in the next step based on the XOR value of the first n-1 levels of the storage units and the input value of the second XOR gate. The input terminal of the verification unit is connected to the output terminal of the third logic operation unit, and the verification unit is used to verify the expected value. The connection path between the second XOR gate and the control terminal of each of the memory cells also includes a fourth logic operation unit. The first input terminal of the fourth logic operation unit is connected to the output terminal of the second XOR gate, the second input terminal of the fourth logic operation unit is connected to the output terminal of the verification unit, and the output terminal of the fourth logic operation unit is connected to the control terminal of each of the memory cells.
10. The access authentication circuit for serial line debugging according to claim 9, characterized in that, The third logic operation unit includes a third XOR gate, a third selector, and a third flip-flop; the verification unit includes a fourth XOR gate and a fourth flip-flop; and the fourth logic operation unit includes an OR gate. The first input of the third XOR gate is connected to the input of the second XOR gate. The second input of the third XOR gate is connected to the XOR value of the first n-1 levels of the storage cells. The output of the third XOR gate is connected to the first input of the third selector. The second input of the third selector is connected to a set signal. The control terminal of the third selector is connected to the output of the OR gate. The output of the third selector is connected to the data input of the third flip-flop. The output of the third flip-flop is connected to the first input of the fourth XOR gate. The second input of the fourth XOR gate is connected to the output of the nth level of the storage cell. The third input of the fourth XOR gate is connected to the second input of the third XOR gate. The output of the fourth XOR gate is connected to the data input of the fourth flip-flop. The output of the fourth flip-flop is connected to the first input of the OR gate. The second input of the OR gate is connected to the output of the second XOR gate. The output of the OR gate is connected to the control terminal of each level of the storage cells.