Hello, On Tuesday 07 February 2006 04:21, Jayasooriah wrote: > I am curious if this is stated anywhere or if you determined this by > experiment. Note, besides ETM chain, there is also a processor chain that > can be accessed. > Philips stated it, but only after several reports in this group, in the "[lpc2000] destroyed LPC2138 via software" thread (though with the usual amount of unclarity, stating that jtag was disabled after reset, and only reenabled by software ;)). Before that, I found it out by experiment. Force nSRST low, and you can shift into the device whatever you want, without any effect. Also, the content of the EmbeddedICE registers is reset, so the target wont break on a previously set breakpoint (other ARMs support this). > >Test logic comes out of reset in Test-Logic-Reset. From there, you have to > >go to Shift-IR to select the SCAN_N instruction, that's 5 TCK cycles. The > >IR register is 4 bits long, but the last bit is scanned when moving out of > >Shift-IR, so you spend 3 ticks shifting bits into the IR reg. From there, > >you have to move to Shift-DR to select the EmbeddedICE scan chain. This > >takes 7 TCK cycles. The SCAN_N register is 4 bits long, so you shift 3 > >bits. Back to > >Shift-IR to select INTEST takes 8 ticks. 3 ticks for the instruction. 7 > >Ticks back to Shift-DR. The EmbeddedICE scan chain is 38 bits long, > >requiring a shift of 37 cycles. The synchronization latches only open in > >Run-Test/Idle, so you have to move there in 5 ticks, plus one tick in > >R-T-I for the debug request to register. > >5 + 3 + 7 + 3 + 8 + 3 + 7 + 37 + 5 + 1 = 79 TCK cycles. > > I can follow your logic here, but 79 ticks seems too far off the mark > compared to 34 and 49 above. Have out missed out something? These 79 TCK cycles are the minimum necessary to write the Debug control register when coming out of Test-Logic-Reset. You just can't do it with less TCKs. > > Jaya
Message
Re: [lpc2000] re: CRP exploits using JTAG
2006-02-08 by Dominic Rath
Attachments
- No local attachments were found for this message.