TWI451255B - Microprocessor apparatus and method for precluding the use of extended jtag operations - Google Patents

Description

Integrated circuit for disabling and expanding JTAG operation and its disable method

The present invention relates to a microelectronic, and more particularly to an apparatus and method for protecting a programmable fuse array in an integrated circuit.

In the current integrated circuit, most of the components or features are enabled and disabled by a fuse made of metal or polymer, wherein the fuse is disposed on the wafer of the integrated circuit. In general, certain fuses are blown during the manufacturing process of the factory to produce a particular version of the device. For example, in a general design of a microprocessor, the microprocessor may have an encryption unit or other protection feature in which the encryption unit or guard features are placed on the wafer and can be enabled by blowing certain fuses. Encryption unit and protection features. The ability to enable or disable specific components or features by fuses not only meets the cost considerations of manufacturing microprocessors, but also makes it easier for manufacturers to produce microprocessors with different performance and price.

However, in recent years, the designer of the integrated circuit can not only enable/disable the above features in the manufacturing process, but also can be selected by actually blowing some fuses after the manufacturing is completed. Characteristics. In most similar configurations, the stylization of fuses can be accomplished by sending specific commands and materials from the interface of the Joint Test Action Group (JTAG). The JTAG interface/protocol exists in a microprocessor, mobile phone, chip or other device. The particular fuse on the wafer can be selected and blown by transmitting appropriate commands and data, or by voltages within a specified range on a particular package pin, to enable or disable the features to be selected for the actual application.

As more and more features can be programmed, an unauthorized user has the opportunity to reconfigure the integrated circuit without the manufacturer's consent.

Therefore, a need exists for a device and method for preventing unauthorized activation of a fuse to enable or disable the original features.

In addition, a need exists for an apparatus and method for determining whether an unauthorized user attempts to tamper with the programmable features of the device and to prevent tampering.

Furthermore, there is a need for a technique that allows a manufacturer to temporarily re-enable a programmatic function of a device to allow authorized enabling or disabling of partial features.

It is an object of the present invention to solve the above-mentioned problems and other problems, disadvantages and limitations.

The present invention provides a preferred technique for disabling an extended JTAG operation for use in an integrated circuit. The present invention provides an integrated circuit that can re-enable extended JTAG operations that have been disabled. The integrated circuit of the present invention includes a JTAG control chain, a feature fuse, a machine-specific register, and an access controller. The JTAG control chain enables/disables extended JTAG operations. A feature fuse is used to indicate if the extended JTAG operation has been disabled. A machine-specific register is used to store a specific value. The access controller is coupled to the feature fuse, the machine-specific register, and the JTAG control chain to determine if the feature fuse has been blown. When a particular value in the machine-specific scratchpad conforms to a coverage value of the access controller, the access controller causes the JTAG control chain to re-enable the disabled extended JTAG operation.

The present invention further provides a method for re-enabling extended JTAG operations that are disabled in an integrated circuit. The method of the present invention includes, by blowing a feature fuse, to indicate that the extended JTAG operation has been disabled, wherein the feature fuse is disposed in the integrated circuit; performing a first determining action to determine whether the feature fuse has been Blowing; performing a second determining action for determining whether a particular value meets a coverage value, wherein the specific value is stored in a machine-specific register; and when a specific value meets the coverage value, enabling a JTAG control Chain reactivation enables extended JTAG operations that are disabled.

The present invention provides a preferred technique for disabling an extended JTAG operation for use in an integrated circuit. The JTAG operation can be enabled/disabled by blowing the fuse. To achieve the above object, the present invention provides an integrated circuit for inhibiting extended JTAG operation. The integrated circuit of the present invention includes a JTAG control chain, a feature fuse, and an access controller. JTAG control chain enable/disable extended JTAG operation. The feature fuse is used to indicate whether the extended JTAG operation has been disabled. The access controller is coupled to the feature fuse and the JTAG control chain to determine if the feature fuse has been blown and to disable the JTAG operation of the JTAG control chain.

The present invention further provides a method for inhibiting extended JTAG operations within an integrated circuit. The method of the present invention includes, by blowing a feature fuse, indicating whether the extended JTAG operation has been disabled, wherein the feature fuse is disposed in the integrated circuit; determining whether the feature fuse has been blown; and when the feature fuse is A JTAG operation that disables the expansion of a JTAG control chain when it has been blown.

The present invention provides a preferred technique for disabling an extended JTAG operation for use in an integrated circuit. Enable/disable extended JTAG operation by blowing the fuse. To achieve the above object, the present invention provides an integrated circuit for inhibiting an extended JTAG operation. The integrated circuit of the present invention includes a JTAG control chain, a feature fuse, a quasi-detector, and an access controller. The JTAG control chain enables or disables extended JTAG operations. The characteristic fuse indicates whether the extended JTAG operation has been disabled. The level detector monitors an external voltage signal to determine if the external voltage signal is at a failed voltage level. The access controller is coupled to the feature fuse, the level detector, and the JTAG control chain to determine if the feature fuse has been blown. As long as the external voltage signal is at this unacceptable voltage level, the access controller disables the JTAG operation of the JTAG control chain regardless of whether the feature fuse has been blown.

The present invention further provides a disable method for disabling an extended JTAG operation in an integrated circuit, the method comprising: blowing a feature fuse to indicate that the extended JTAG operation has been disabled, wherein the feature fuse is set In the integrated circuit; performing a first determining operation for determining whether an external voltage signal is at a failed voltage level; performing a second determining operation for determining whether the characteristic fuse has been blown; when the external voltage When the signal is at the unqualified voltage level, the JTAG control chain disables the JTAG operation; and when the external voltage signal is at a qualified voltage level, and the characteristic fuse has been blown, the JTAG control chain is disabled. JTAG operation.

In order to make the features and advantages of the present invention more comprehensible, the preferred embodiments are described below, and are described in detail with reference to the accompanying drawings.

Figure 1 is a schematic diagram of a microprocessor with a fuse enable function. As shown, the microprocessor 100 has a fuse array 101 that is coupled to one or more enable logic elements 105. Each of the consistent logic elements 105 provides a disable signal DIS to a corresponding feature element 102-103, such as a cryptography engine 102 or other guard feature 103.

The fuse array 101 includes one or more fuses (not shown) that can be placed with the microprocessor 100 over a plurality of accessible layers of a die. These accessible layers are metals or polymers. During the manufacture of the microprocessor 100, the fuse can be blown through the laser or by any other known technique. In addition, the fuse array 101 is coupled to a blow controller 107 through the bus bar BLOWMODE. The burnout controller 107 is coupled to a connection pin 110 of the package of the microprocessor 100 for receiving an external voltage signal FSOURCE.

The fuse array 101 is coupled to a JTAG control chain 108 via a bus bar RDARRAY. The JTAG control chain 108 is coupled to a JTAG bus interface component 109. The JTAG bus interface component 109 communicates with a JTAG controller (not shown) via a JTAG bus JT[1:N]. Each signal on the JTAG bus JT[1:N] is transferred to the connection pin 110 of the package of the corresponding microprocessor.

The JTAG control chain 108 is coupled to the microcode storage 106. The microcode storage 106 may include a temporary storage (such as random access memory RAM, scratchpad, etc.), a non-transitory storage (such as a read-only memory ROM, a fixed programmable logic unit, etc. ) or a combination of temporary storage and non-transitory storage. The microcode (or microinstructions) stored by the microcode storage 106 can be provided to the logic elements of the microprocessor 100 for performing the stylized sequential operations by conventional mechanisms. Typical logic elements include encryption engine 102 and protection features 103, but may also include cache memory, special purpose hardware, power management hardware, or other components that can be enabled or disabled. The logic component can directly execute the microcode to perform the programmatic operation, or execute the microcode to operate the logic component through an associated element (not shown).

As described above, during the manufacturing process of the microprocessor 100, some of the fuses in the fuse array 101 may be blown by laser or other means to indicate whether the corresponding guard feature 103 and/or the encryption engine 102 are banned. can. Thus, when the microprocessor 100 is activated, each of the consistent logic elements 105 determines the state of the corresponding fuse within the fuse array 101 and can trigger a corresponding disable signal DIS. The disable signal DIS is used to disable the corresponding encryption engine 102 and the protection feature 103. Thus, in general, many microprocessors having different characteristics can be defined by the state of the fuse of the fuse array 101 of the microprocessor itself. For example, when all fuses are blown to disable the corresponding encryption engine 102 and guard feature 103, a low performance microprocessor can be defined. Conversely, when the fuses corresponding to all of the encryption engine 102 and the guard feature 103 are not blown, a high performance microprocessor can be defined.

As noted above, typically during the manufacture of microprocessor 100 (before packaging), the fuse state of fuse array 101 is set. However, in recent years, microprocessors that allow the encryption engine 102 and the protection feature 103 to be arbitrarily enabled or disabled are relatively popular. Therefore, the present invention provides a programmable function sufficient to meet the needs of the current market. For example, a blown fuse may indicate that the encryption engine 102 and the guard feature 103 are enabled or disabled. The encryption engine 102 or guard feature 103 may have a plurality of associated fuses to allow for a certain number of enabling and disabling.

It is well known in the art that the JTAG bus JT[1:N] is used to test and program the microprocessor 100. JTAG is an abbreviation of Joint Test Action Group, a common standard widely used in the field for boundary scan and test access of microprocessors. ), especially for testing and evaluation of microprocessors. Therefore, the state of the JTAG bus JT[1:N] is controlled by a test unit, a debugger, or other similar device external to the microprocessor 100. The JTAG bus interface component 109 receives the JTAG commands transmitted by the JTAG bus JT[1:N] and transmits the received commands to the JTAG control chain 108, wherein the JTAG control chain 108 is coupled to the microprocessor. Almost all testable elements within the device 100.

In general, JTAG commands are used to test circuits and components within microprocessor 100. However, since JTAG structures, commands, and related devices are common, circuit designers have recently expanded the use of JTAG technology to provide operations other than testing, including verification of stylized microcode in microcode memory 106, and Verification of the stylized fuse state in fuse array 101. To accomplish these operations, the associated JTAG commands are passed to the JTAG control chain 108, to the microcode memory 106 via the bus RDCODE, and to the fuse array 101 via the busbar RDARRAY. In addition, an external test unit (not shown) is used to read the state of the fuses in the fuse array 101 and to read the microcode stored in the microcode storage 106.

In addition to reading the fuse array 101 and the microcode memory 106, the JTAG commands can be used to blow certain fuses within the fuse array 101 after the microprocessor is fabricated. Therefore, the blown data is transferred to the JTAG control chain 108 via the JTAG bus JT[1:N] and transmitted to the fuse array 101 through the bus bar RDARRAY. Then, by setting the voltage level on the connection pin 110 coupled to the signal FSOURCE, the controller 107 can be blown to blow some of the fuses. In order to blow the fuse, the appropriate burnout data is transmitted to the fuse scan chain via the JTAG busbar JT[1:N] via the busbar RDARRAY, and the blow command is transmitted through the JTAG busbar JT[1:N]. The wafer enters a state that allows the fuse to be blown. The voltage level of the signal FSOURCE is set to an appropriate level and maintained at this level for a predetermined period of time. The blow controller 107 can blow the fuse in the fuse array 101 according to the voltage level of the signal FSOURCE.

In general, on the system board (not shown), the voltage level of the signal FSOURCE is VSS, where VSS is typically 0V or ground. This level must be sufficient for the enable logic element 105 and the JTAG control chain 108 to read to the state of the fuse array 101. In order to blow the fuse, the voltage level of the signal FSOURCE is raised to a preset level, which is determined by the process technology and the type of fuse (eg metal or polymer). When a wafer is fabricated according to the 90 nm process technology, the voltage level of the signal FSOURCE is about 3.5V. If the wafer is fabricated according to the 65nm process technology, the voltage level of the signal FSOURCE is about 1.7V.

Therefore, today's microprocessor 100 is quite flexible in terms of programmability, whether in the field of manufacturing or application. This structural flexibility allows manufacturers and system designers to more efficiently utilize common structures to create devices with different performance at different cost requirements. The above structure also allows the microprocessor 100 to add selected functions to the board level, i.e., after manufacturing, packaging, and shipping.

Such resilience is beneficial for the product's vision, but has the disadvantage that the functionality of the product is susceptible to tampering with unauthorized operations. That is, the above structure allows authorized users to directly enable/disable feature elements 102 and 103. But at the same time, unauthorized users can use the same method of enabling. The unauthorized user can read the microcode stored in the microcode storage 106 through the JTAG bus JT[1:N] and the signal FSOURCE, and read the state of the fuse array 101. Unauthorized users can also blow certain fuses to enable or disable certain feature elements 102 and 103.

In current integrated circuits, many of the functions and components are related to the enabling method of the fuse. In this embodiment, the apparatus and method are provided to avoid such unauthorized tampering.

The present invention also provides a mechanism for detecting and preventing unauthorized users from performing JTAG operations in addition to the normal boundary scan function, thereby overcoming some features that can be enabled/disabled by a programmable fuse. The limitations and disadvantages of the integrated circuit structure. The present invention will be described in detail later through Figures 2-5.

Figure 2 is a schematic illustration of a microprocessor of the present invention that protects a programmable fuse array. The microprocessor 200 of Fig. 2 is similar to the microprocessor 100 of Fig. 1. Microprocessor 200 has a fuse array 201. The fuse array 201 is coupled to one or more enable logic elements 205. Each of the consistent logic elements 205 provides an disable signal DIS to a corresponding feature element 202-203, such as the encryption engine 202 or other guard feature 203.

Fuse array 201 has one or more fuses (not shown). The fuse and microprocessor 200 can be disposed over a plurality of accessible layers of a die. The above accessible layer is a metal or a polymer. During the manufacture of microprocessor 200, the fuse can be blown through laser or by any other known technique. In addition, the fuse array 201 is coupled to a blow controller 207 through the bus bar BLOWMODE. The burnout controller 207 is coupled to a connection pin 210 on the package of the microprocessor 200 for receiving an external voltage signal FSOURCE.

The fuse array 201 is coupled to a JTAG control chain 208 via a bus bar RDARRAY. The JTAG control chain 208 is coupled to a JTAG bus interface component 209. The JTAG bus interface component 209 communicates with a JTAG controller (not shown) via a JTAG bus JT[1:N]. Each signal on the JTAG bus JT[1:N] is transmitted to a corresponding connection pin 210 of the microprocessor.

The JTAG control chain 208 is coupled to the microcode storage 206. The microcode storage 206 may include a temporary storage (such as random access memory RAM, scratchpad, etc.), a non-transitory storage (such as a read-only memory ROM, a fixed programmable logic unit... Etc.), or a combination of temporary storage and non-transitory storage. The microcode (or microinstructions) stored by the microcode storage 206 can be provided to the logic elements of the microprocessor 200 for performing the stylized sequential operations by conventional mechanisms. The logic elements include encryption engine 202 and protection features 203, but may also include cache memory, special purpose hardware, power management hardware, or other components that can be enabled or disabled. These logic elements can be directly executed by microcode to perform programmatic operations, or by executing microcodes through an associated element (not shown) to operate the logic elements.

As noted above, certain fuses within the fuse array 201 may be blown by laser or other means during the fabrication of the microprocessor 200 to enable or disable certain guard features 203 and/or encryption engine 202. . Therefore, when the microprocessor 200 is activated or reset, each of the consistent logic elements 205 determines the fuse state of the fuse array 201 and can trigger a corresponding disable signal DIS for disabling the corresponding encryption engine 202. And a protective feature 203.

A blown fuse may indicate that certain feature elements 202, 203 are enabled or disabled. A feature element 202, 203 may have a plurality of associated fuses to allow a certain number of enabling or disabling.

The signals on the JTAG bus JT[1:N] can perform boundary scan and test operations on the microprocessor 200, and the state of the JTAG bus JT[1:N] is determined by a test unit, a debugger or a micro Control is performed by other similar devices external to processor 200. The JTAG bus interface component 209 receives the JTAG command transmitted by the JTAG bus JT[1:N] and transmits the received command to the JTAG control chain 208, wherein the JTAG control chain 208 is coupled to the microprocessor 200. Almost all testable components. In addition to the JTAG scan and test operations, the microprocessor 200 architecture allows for other extended operations, such as verification of the programmed microcode in the microcode memory 206 and verification of the stylized fuse state in the fuse array 201. To accomplish these operations, the associated JTAG commands can be passed to the JTAG control chain 208, to the microcode memory 206 via the bus RDCODE, and to the fuse array 201 via the busbar RDARRAY. In addition, an external test unit (not shown) is utilized to read the state of the fuses within the fuse array 201 and to read the microcode stored by the microcode storage 206.

In addition to reading fuse array 201 and microcode storage 206, JTAG commands can be used to blow certain fuses within fuse array 201 after microprocessor 200 is fabricated. Therefore, the blown data is transferred to the JTAG control chain 208 via the JTAG bus JT[1:N] and transmitted to the fuse array 201 through the bus bar RDARRAY. Then, by setting the voltage level on the connection pin 210 coupled to the signal FSOURCE, the blow controller 207 can be controlled to blow some of the fuses. In order to blow the fuse, the appropriate burnout data is transmitted to the fuse scan chain via the JTAG busbar JT[1:N] via the busbar RDARRAY, and the blow command is transmitted through the JTAG busbar JT[1:N]. The wafer enters a state that allows the fuse to be blown. The voltage level of the signal FSOURCE is set to an appropriate level and maintained at this level for a predetermined period of time. The blow controller 207 can blow the fuse according to the voltage level of the signal FSOURCE.

In general, on the system board (not shown), the voltage level of the signal FSOURCE is VSS, where VSS is typically 0V or ground level, which must be sufficient for the enable logic element 205 and the JTAG control chain 208 to read. The state to the fuse array 201. In order to blow the fuse, the voltage level of the signal FSOURCE is raised to a preset level, which is determined by the process technology and the type of fuse (eg metal or polymer). When a wafer is fabricated according to the 90 nm process technology, the voltage level of the signal FSOURCE is about 3.5V. If the wafer is fabricated according to the 65nm process technology, the voltage level of the signal FSOURCE is about 1.7V.

In contrast to current microprocessor 100, microprocessor 200 provides a mechanism to prevent unauthorized users from performing any JTAG actions other than normal boundary scan and test operations. In a possible embodiment, the microprocessor 200 has a feature fuse 211. The feature fuse 211 is disposed in the fuse array 201. When the feature fuse 211 is blown, the harmful or unauthorized JTAG action is disabled. An access controller 212 couples the feature fuse 211 through the bus bar FSENSE. The access controller 212 receives a microprocessor reset signal (RESET) and couples the JTAG control chain 208 through the bus bar BSONLY.

Like other fuses (not shown) within the fuse array 201, the feature fuse 211 may be constructed of metal or polymer that can be used to blow the feature fuse 211 or to manufacture when the microprocessor 200 is manufactured using known techniques. After completion, the characteristic fuse 211 is blown by the mechanism of the above-mentioned signal FSOURCE.

Operationally, when the microprocessor 200 is turned on or reset, the reset signal RESET is set, and the access controller 212 detects the state of the feature fuse 211 through the bus bar FSENSE. If the feature fuse 211 is not blown, the access controller 212 controls the JTAG control chain 208 to allow all JTAG operations through the bus bar BSONLY. The JTAG operation includes reading the microcode stored by the microcode storage 206 and reading/blowing the fuse of the fuse array 201. However, if the feature fuse 211 is blown, the access controller 212 controls the JTAG control chain 208 to disable all JTAG operations except normal boundary scan and test operations via the bus bar BSONLY. Therefore, when the feature fuse 211 is blown, if the microprocessor 200 receives a command from the JTAG bus JT[1:N] in an attempt to blow or read the fuse in the fuse array 201 or attempt to read the micro These commands will be ignored or invalidated when commanding the data stored in the code store 206.

The access controller 212 is operative to read the state of the feature fuse 211 and to control the JTAG chain 208 to allow/disallow the extended JTAG operation. The access controller 212 includes logic units, circuits, devices or microcode (such as microinstructions or native instructions), or a combination of logic units, circuits, devices, and microcode, or other executable inventions. The functional components described. The elements that perform the functions described herein may also be shared with circuitry, microcode that performs other functions in microprocessor 200. In the present embodiment, the microcode is a term that can represent a plurality of microinstructions. A microinstruction (also known as a native instruction) is an instruction that is executed in one unit. For example, the microinstructions can be executed by a reduced instruction set computer (RISC) microprocessor. For complex instruction set computer (CISC) microprocessors, such as x86 compatible microprocessors, x86 instructions are translated into associated microinstructions, and these associated microinstructions can be processed by CISC One or more units of the device are executed.

Similarly, JTAG control chain 208 is used to allow/disallow the above-described extended JTAG operations as indicated by access controller 212. The JTAG control chain 208 includes logic elements, circuits, devices or microcode (such as microinstructions or native instructions), or a combination of logic units, circuits, devices, and microcode, or other functions that perform the functions of the present invention. element. Elements that perform the functions described herein may also be shared with circuitry or microcode that performs other functions in microprocessor 200.

In an embodiment, the microprocessor 200 includes a central processing unit (CPU). The central processing unit can be placed in a single die of an integrated circuit. In other embodiments, the microprocessor 200 has an x86 compatible central processing unit that is housed in a single die of an integrated circuit and can be a superscalar microprocessor implemented in a pipeline An x86-compatible macro instruction that is extracted from a memory through a system bus.

In other embodiments, the microprocessor 200 can be replaced with an integrated circuit disposed on a single die. In this example, the integrated circuit provides the above-described programmable fuse, and the above-described mechanism for preventing tampering is also integrated into the design of the integrated circuit.

Figure 3 is another possible embodiment of the microprocessor of the present invention. In this embodiment, the microprocessor 300 has a protection device to prevent unauthorized users from tampering with the fuse state of the fuse array. Microprocessor 300 is similar to microprocessor 200 of FIG. Microprocessor 300 has a fuse array 301. The fuse array 301 is coupled to one or more enable logic elements 305. Each of the consistent logic elements 305 provides a disable signal DIS to a corresponding feature element 302-303, such as encryption engine 302 or other guard feature 303.

Fuse array 301 has one or more fuses (not shown). The fuse and microprocessor 300 can be disposed over a plurality of accessible layers of a die. The above accessible layer is a metal or a polymer. During the manufacture of microprocessor 300, the fuse can be blown through laser or by any other known technique. In addition, the fuse array 301 is coupled to a blow controller 307 through the bus bar BLOWMODE. The blow controller 307 is coupled to a connection pin 310 on the package of the microprocessor 300 for receiving an external voltage signal FSOURCE.

The fuse array 301 is coupled to a JTAG control chain 308 via a bus bar RDARRAY. The JTAG control chain 308 is coupled to a JTAG bus interface component 309. The JTAG bus interface component 309 communicates with a JTAG controller (not shown) via a JTAG bus JT[1:N]. Each signal on the JTAG bus JT[1:N] is transmitted to a corresponding connection pin 310 of the microprocessor.

The JTAG control chain 308 is coupled to the microcode storage 306. The microcode storage 306 may include a temporary storage (such as random access memory RAM, scratchpad, etc.), a non-transitory storage (such as a read-only memory ROM, a fixed programmable logic unit... Etc.), or a combination of temporary storage and non-transitory storage. The microcode (or microinstructions) stored by the microcode storage 306 can be provided to the logic elements of the microprocessor 300 for performing the stylized sequential operations by conventional mechanisms. The logic elements include encryption engine 302 and protection features 303, but may also include cache memory, special purpose hardware, power management hardware, or other components that can be enabled or disabled. These logic elements can be directly executed by microcode to perform programmatic operations, or by executing microcodes through a contact component (not shown) to operate the logic components.

As noted above, during the manufacture of microprocessor 300, certain fuses within fuse array 301 may be blown by laser or other means to enable or disable certain guard features 303 and/or encryption engine 302. . Therefore, when the microprocessor 300 is activated or reset, each of the consistent logic elements 305 determines the fuse state of the fuse array 301, and can trigger a corresponding disable signal DIS for disabling the corresponding encryption engine 302. And protection feature 303.

A blown fuse may indicate that certain feature elements 302-303 are enabled or disabled. A feature element 302-303 may have a plurality of associated fuses to allow for a certain number of enabling or disabling.

The signal on the JTAG bus JT[1:N] can perform boundary scan and test operations on the microprocessor 300, and the state of the JTAG bus JT[1:N] is determined by a test unit, a debugger or a micro Control is performed by other similar devices external to processor 300. The JTAG bus interface component 309 receives the JTAG command transmitted by the JTAG bus JT[1:N] and transmits the received command to the JTAG control chain 308, wherein the JTAG control chain 308 is coupled to the microprocessor 300. Almost all testable components. In addition to the scanning and testing features of JTAG, the structure of microprocessor 300 allows for other expansion operations, such as verification of the programmed microcode in microcode storage 306 and verification of the status of the programmed fuses in fuse array 301. To accomplish these operations, the associated JTAG commands can be passed to the JTAG control chain 308, transferred to the microcode storage 306 via the busbar RDCODE, and to the fuse array 301 via the busbar RDARRAY. In addition, an external test unit (not shown) is utilized to read the state of the fuses within the fuse array 301 and to read the microcode stored by the microcode storage 306.

In addition to reading fuse array 301 and microcode storage 306, JTAG commands can be used to blow certain fuses within fuse array 301 after microprocessor 300 is fabricated. Therefore, the blown data is transferred to the JTAG control chain 308 via the JTAG bus JT[1:N] and transmitted to the fuse array 301 through the bus bar RDARRAY. Then, by setting the voltage level on the connection pin 310 coupled to the signal FSOURCE, the controller 307 can be blown to blow some of the fuses. In order to blow the fuse, the appropriate burnout data is transmitted to the fuse scan chain via the JTAG busbar JT[1:N] via the busbar RDARRAY, and the blow command is transmitted through the JTAG busbar JT[1:N]. The wafer enters a state that allows the fuse to be blown. The voltage level of the signal FSOURCE is set at an appropriate level and maintained at this level for a predetermined period of time. The blow controller 307 can blow the fuse according to the voltage level of the signal FSOURCE.

In general, on the system board (not shown), the voltage level of the signal FSOURCE is VSS, where VSS is typically 0V or ground level, which must be sufficient for the enable logic component 305 and the JTAG control chain 308 to read. The state to the fuse array 301. In order to blow the fuse, the voltage level of the signal FSOURCE is raised to a preset level, which is determined by the process technology and the type of fuse (eg metal or polymer). When a wafer is fabricated according to the 90 nm process technology, the voltage level of the signal FSOURCE is about 3.5V. If the wafer is fabricated according to the 65nm process technology, the voltage level of the signal FSOURCE is about 1.7V.

Microprocessor 300 provides a mechanism to prevent unauthorized users from performing any JTAG actions other than normal boundary scan and test operations. In a possible embodiment, the microprocessor 300 has a feature fuse 311. The characteristic fuse 311 is disposed in the fuse array 301. When the feature fuse 311 is blown, the harmful or unauthorized JTAG action is disabled. An access controller 312 couples the feature fuse 311 through the bus bar FSENSE. The access controller 312 receives a microprocessor reset signal RESET and is coupled to the JTAG control chain 308 via the bus bar BSONLY. The microprocessor 300 further has a level sensor 313. The level detector 313 receives the signal FSOURCE and is coupled to the access controller 312 via the bus ILLEGAL.

Like other fuses (not shown) within fuse array 301, feature fuse 311 may be constructed of metal or polymer that may be used to blow feature fuse 311 or to manufacture when microprocessor 300 is manufactured using known techniques. After completion, the characteristic fuse 311 is blown by the mechanism of the above-mentioned signal FSOURCE.

Operationally, when the microprocessor 300 is turned on or reset, the reset signal RESET is set, and the access controller 312 detects the state of the characteristic fuse 311 through the bus bar FSENSE. If the feature fuse 311 is not blown, the access controller 312 controls the JTAG control chain 308 to allow all JTAG operations through the bus bar BSONLY. The JTAG operation includes reading the microcode stored by the microcode storage 306 and reading/blowing the fuse of the fuse array 301. However, if the feature fuse 311 is blown, the access controller 312 controls the JTAG control chain 308 to disable all JTAG operations except normal boundary scan and test operations via the bus bar BSONLY. Therefore, when the characteristic fuse 311 is blown, if the command received by the microprocessor 300 from the JTAG bus JT[1:N] is an attempt to blow or read the fuse in the fuse array 301, or attempt to read These commands will be ignored or invalidated when commands are stored in the microcode storage 306.

Note that in some configurations the signal FSOURCE may be set to a voltage level other than VSS to blow the fuse in the fuse array 301 such that the fuse in the fuse array 301 is in a state of being blown or not blown. It is not its original state. This situation may occur when an unauthorized user attempts to tamper with the characteristics of the microprocessor by providing the voltage level by the signal FSOURCE such that the value of the characteristic fuse 311 on the bus bar FSENSE indicates that the extended JTAG operation is If enabled, the fuse can be blown to add feature elements 302-303, and/or the data stored by microcode storage 306 can be read. In order to solve the above problem, the level detector 313 can monitor the voltage level of the signal FSOURCE, and the voltage level of the signal FSOURCE is at an unacceptable voltage level (for example, a voltage level other than VSS) The access controller 312 is informed via the bus ILLEGAL. Therefore, when the access controller 312 reads the state of the feature fuse 311, if the signal FSOURCE is at a failed voltage level, the access controller 312 will control the JTAG control chain 308 to disable normal boundary scan and Test all JTAG operations outside of the operation. Conversely, when the access controller 312 reads the state of the feature fuse 311, if the voltage level of the signal FSOURCE is VSS, the access controller 312 will cause the JTAG control chain 308 to allow or not according to the state of the feature fuse 311. Allow extended JTAG operations.

In one embodiment, microprocessor 300 includes a central processing unit (CPU). The central processing unit can be placed in a single die of an integrated circuit. In other embodiments, the microprocessor 300 has an x86 compatible central processing unit that is housed in a single die of an integrated circuit and can be an ultrapure microprocessor that is pipelined through a system. The x86 compatible giant instruction that the bus is extracted from a memory.

In other embodiments, the microprocessor 300 can be replaced with an integrated circuit disposed on a single die. In this example, the integrated circuit provides the above-described programmable fuse, and the above-described mechanism for preventing tampering is also integrated in the design of the integrated circuit.

Figure 4 is a flow chart of one of the protection methods of the present invention. The protection method of the present invention avoids tampering with the programmable fuse array. The protection method of the present invention begins with step 401. Please cooperate with the microprocessor 300 of Fig. 3 of the present invention.

In step 402, it is determined whether the microprocessor 300 is performing a sequence operation corresponding to a reset or power on sequence. If no, proceed to step 402. If yes, go to step 403.

In step 403, it is determined whether the voltage level of the signal FSOURCE is a pass (VSS) or a failed voltage level. If the voltage level of the signal FSOURCE is a qualified voltage level (VSS), then step 404 is performed. If the voltage level of the signal FSOURCE is a failed voltage level (not VSS), then step 407 is performed.

In step 404, the state of the feature fuse 311 for protection is read by the access controller 312, and then step 405 is performed.

In step 405, it is determined whether the feature fuse 311 is blown. If the feature fuse 311 is blown, step 407 is performed. If the feature fuse 311 is not blown, step 406 is performed.

In step 406, access controller 312 causes JTAG control chain 308 to enable extended JTAG operations, and then proceeds to step 408.

In step 407, access controller 312 causes JTAG control chain 308 to disable extended JTAG operations. The extended JTAG operation includes reading the microcode stored by the microcode storage 306, and/or reading/blowing the fuse of the fuse array 301, and then performing step 408.

In step 408, the method ends.

For an integrated circuit having the above-described programmable fuse to enable the feature, when the feature fuse 311 has been blown, it may also need to blow some of the fuses to enable or disable certain features. In other embodiments, the microprocessor of the present invention does not permanently disable the execution of extended JTAG operations, but may temporarily cancel the tamper-proof function of Figures 2-4.

Figure 5 is another possible embodiment of the microprocessor of the present invention. The microprocessor of the present embodiment can re-enable a fuse array having a tamper-proof function. Microprocessor 500 is similar to microprocessor 300 of FIG. Microprocessor 500 has a fuse array 501. The fuse array 501 is coupled to one or more enable logic elements 505. Each of the consistent logic elements 505 provides a disable signal DIS to a corresponding feature element 502-503, such as an encryption engine 502 or other guard feature 503.

Fuse array 501 has one or more fuses (not shown). The fuse and microprocessor 500 can be disposed over a plurality of accessible layers of a die. These accessible layers are metals or polymers. During the manufacture of microprocessor 500, the fuse can be blown through laser or by any other known technique. In addition, the fuse array 501 is coupled to a blow controller 507 through the bus bar BLOWMODE. The burnout controller 507 is coupled to a connection pin 510 on the package of the microprocessor 500 for receiving an external voltage signal FSOURCE.

The fuse array 501 is coupled to a JTAG control chain 508 via a bus bar RDARRAY. The JTAG control chain 508 is coupled to a JTAG bus interface component 509. The JTAG bus interface component 509 communicates with a JTAG controller (not shown) via a JTAG bus JT[1:N]. Each signal on the JTAG bus JT[1:N] is transmitted to a corresponding connection pin 510 of the microprocessor.

The JTAG control chain 508 is coupled to the microcode storage 506. The microcode storage 506 may include a temporary storage (such as random access memory RAM, scratchpad, etc.), a non-transitory storage (such as a read-only memory ROM, a fixed programmable logic unit... Etc.), or a combination of temporary storage and non-transitory storage. The microcode (or microinstructions) stored by the microcode storage 506 can be provided to the logic elements of the microprocessor 500 for performing the stylized sequential operations by conventional mechanisms. The logic elements include encryption engine 502 and protection features 503, but may also include cache memory, special purpose hardware, power management hardware, or other components that can be enabled or disabled. These logic elements can be directly executed by microcode to perform programmatic operations, or by executing microcodes through a contact component (not shown) to operate the logic components.

As noted above, certain fuses within the fuse array 501 may be blown by laser or other means during the fabrication of the microprocessor 500 to enable or disable certain guard features 503 and/or encryption engine 502. . Therefore, when the microprocessor 500 is activated or reset, each of the consistent logic elements 505 determines the fuse state of the fuse array 501 and can trigger a corresponding disable signal DIS for disabling the corresponding encryption engine 502. And a protective feature 503.

A blown fuse may indicate that certain feature elements 502-503 are enabled or disabled. A feature element 502-503 may have a plurality of associated fuses to allow for a certain number of enabling or disabling.

The signal on the JTAG bus JT[1:N] can perform boundary scan and test operations on the microprocessor 500, and the state of the JTAG bus JT[1:N] is determined by a test unit, a debugger or a micro Control is performed by other similar devices external to processor 500. The JTAG bus interface component 509 receives the JTAG command transmitted by the JTAG bus JT[1:N] and transmits the received command to the JTAG control chain 508, wherein the JTAG control chain 508 is coupled to the microprocessor 500. Almost all testable components. In addition to the scanning and testing features of JTAG, the structure of microprocessor 500 allows for other extended operations, such as verification of programmed microcode in microcode storage 506 and verification of the status of programmed fuses in fuse array 501. To accomplish these operations, the associated JTAG commands can be passed to the JTAG control chain 508, to the microcode memory 506 via the bus RDCODE, and to the fuse array 501 via the busbar RDARRAY. In addition, an external test unit (not shown) is utilized to read the status of the fuses within the fuse array 501 and to read the microcode stored by the microcode storage 506.

In addition to reading fuse array 501 and microcode storage 506, JTAG commands can be used to blow certain fuses within fuse array 501 after microprocessor 500 is fabricated. Therefore, the blown data is transferred to the JTAG control chain 508 via the JTAG bus JT[1:N] and transmitted to the fuse array 501 through the bus bar RDARRAY. Then, by setting the voltage level on the connection pin 510 coupled to the signal FSOURCE, the blow controller 507 can be controlled to blow some of the fuses. In order to blow the fuse, the appropriate burnout data is transmitted to the fuse scan chain via the JTAG busbar JT[1:N] via the busbar RDARRAY, and the blow command is transmitted through the JTAG busbar JT[1:N]. The wafer enters a blown state that allows the blown fuse to be blown. The voltage level of the signal FSOURCE is set to an appropriate level and maintained at this level for a predetermined period of time. The blow controller 507 can blow the fuse according to the voltage level of the signal FSOURCE.

In general, on the system board (not shown), the voltage level of the signal FSOURCE is VSS, where VSS is typically 0V or ground level, which must be sufficient for the enable logic element 505 and the JTAG control chain 508 to read. The state to the fuse array 501. In order to blow the fuse, the voltage level of the signal FSOURCE is raised to a preset level, which is determined by the process technology and the type of fuse (eg metal or polymer). When a wafer is fabricated according to the 90 nm process technology, the voltage level of the signal FSOURCE is about 3.5V. If the wafer is fabricated according to the 65nm process technology, the voltage level of the signal FSOURCE is about 1.7V.

Microprocessor 500 provides a mechanism to prevent unauthorized users from performing any JTAG actions other than normal boundary scan and test operations. In a possible embodiment, the microprocessor 500 has a feature fuse 511. The feature fuse 511 is disposed in the fuse array 501. When the characteristic fuse 511 is blown, the harmful or unauthorized JTAG action is disabled. An access controller 512 couples the feature fuse 511 through the bus bar FSENSE. The access controller 512 receives a microprocessor reset signal RESET and couples the JTAG control chain 508 through the bus bar BSONLY. The microprocessor 500 further has a quasi-detector 513. The level detector 513 receives the signal FSOURCE and is coupled to the access controller 512 via the bus ILLEGAL.

Like other fuses (not shown) in the fuse array 501, the feature fuse 511 may be constructed of metal or polymer that can be used to blow the feature fuse 511 or to manufacture when the microprocessor 500 is manufactured using known techniques. After completion, the characteristic fuse 511 is blown by the mechanism of the above-mentioned signal FSOURCE.

Operationally, when the microprocessor 500 is turned on or reset, the reset signal RESET is set, and the access controller 512 detects the state of the characteristic fuse 511 through the bus bar FSENSE. If the feature fuse 511 is not blown, the access controller 512 controls the JTAG control chain 508 to allow all JTAG operations through the bus bar BSONLY. The JTAG operation includes reading the microcode stored by the microcode storage 506 and reading/blowing the fuse of the fuse array 501. However, if the feature fuse 511 is blown, the access controller 512 controls the JTAG control chain 508 to disable all JTAG operations except normal boundary scan and test operations via the bus bar BSONLY. Therefore, when the feature fuse 511 is blown, if the microprocessor 500 receives a command from the JTAG bus JT[1:N] in an attempt to blow or read the fuse in the fuse array 501, or attempts to read These commands will be ignored or invalidated when commanding the data stored by the microcode storage 506.

In some configurations, the signal FSOURCE may be set to a voltage level other than VSS to blow the fuse in the fuse array 501 such that the state of the fuse in the fuse array 501 (burned or not blown) becomes not its original The real state. This situation may occur when an unauthorized user attempts to tamper with the characteristics of the microprocessor by providing the voltage level by the signal FSOURCE such that the value of the characteristic fuse 511 on the bus bar FSENSE indicates that the extended JTAG operation is If enabled, the fuse can be blown to add features 502-503, and/or the data stored by microcode storage 506 can be read. In order to solve the above problem, the level detector 513 can monitor the voltage level of the signal FSOURCE, and when the voltage level of the signal FSOURCE is at an unacceptable voltage level (for example, a voltage level other than VSS), through the confluence The row ILLEGAL informs the access controller 512. Therefore, when the access controller 512 reads the state of the feature fuse 511, if the signal FSOURCE is at a failed voltage level, the access controller 512 will control the JTAG control chain 508 to disable the normal boundary scan and test operations. All JTAG operations. Conversely, when the access controller 512 reads the state of the feature fuse 511, if the voltage level of the signal FSOURCE is VSS, the access controller 512 will cause the JTAG control chain 508 to allow or not according to the state of the feature fuse 511. Allow extended JTAG operations.

However, after the feature fuse 511 is blown, it may still be necessary to blow the fuse or read the microcode within the microcode storage 506. In a possible embodiment, the tamper prevention function can be temporarily cancelled. Therefore, in the embodiment, the microprocessor 500 further includes a machine specific register 521. The machine-specific register 521 is coupled to the access controller 512 via a bus RENVAL. When the feature fuse 511 has been blown, a specific value must exist in the machine-specific register 521 in order to temporarily re-enable the extended JTAG operation. In a possible embodiment, only the manufacturer of microprocessor 500 will know the particular value described above and store the particular value in access controller 512. In one possible embodiment, microprocessors 500 of the same batch may have the same specific value. In another embodiment, the particular value may be a generally known value. In other embodiments, the particular value is a value known only to the manufacturer of the microprocessor 500, and utilizes a uniqueness of the microprocessor 500 by the encryption engine in accordance with a predetermined encryption algorithm. The value is used as an encryption key to perform a specific number of encryption cycles on the value.

When the microprocessor 500 is activated or reset, the access controller 512 determines if the signal FSOURCE is at a qualified voltage level. If so, the access controller 512 then determines if the feature fuse 511 has been blown. If the feature fuse 511 has been blown, the access controller 512 confirms the value in the machine-specific register 521. In a possible embodiment, if the value in the machine-specific register 521 matches an override value (ie, the above-mentioned specific value) in the access controller 512, then the access controller 512 causes the JTAG control chain. 508 enables the above extended JTAG operation. After a fixed period of time, it is again confirmed whether the same value as the coverage value was originally detected in the machine-specific buffer 521. If so, the extended JTAG operation is allowed. However, when the same value as the overlay value is not detected in the machine-specific register 521, the extended JTAG operation is disabled.

In other embodiments, access controller 512 determines if signal FSOURCE is at a qualified voltage level. If so, the access controller 512 then determines if the feature fuse 511 has been blown. If the feature fuse 511 has been blown, the access controller 512 confirms the value in the machine-specific register 521 and at the same time causes the encryption engine to utilize the value unique to one of the microprocessors 500 as the encryption key. The value in register 521 performs a specific number of encryption cycles to generate an encrypted value. If the encrypted value conforms to a coverage value (i.e., the particular value described above), then access controller 512 causes JTAG control chain 508 to enable the extended JTAG operation. After a fixed period of time, it is again confirmed whether the encrypted value originally detected in the machine-specific register 521 is the same as the coverage value. If so, the extended JTAG operation is allowed. However, when the same encrypted value as the overlay value is not detected in the machine-specific register 521, the extended JTAG operation is disabled.

In one embodiment, microprocessor 500 includes a central processing unit (CPU). The central processing unit can be placed in a single die of an integrated circuit. In other embodiments, the microprocessor 500 has an x86 compatible central processing unit that is housed in a single die of an integrated circuit and can be a super-scalar microprocessor that is pipelined through a system. The x86 compatible giant instruction that the bus is extracted from a memory.

In other embodiments, the microprocessor 500 can be replaced with an integrated circuit disposed on a single die. In this example, the integrated circuit provides the above-described programmable fuse, and the above-described mechanism for preventing tampering is also integrated into the design of the integrated circuit.

Although the present invention has been disclosed in the above preferred embodiments, it is not intended to limit the invention, and any one of ordinary skill in the art can make some modifications and refinements without departing from the spirit and scope of the invention. Therefore, the scope of the invention is defined by the scope of the appended claims.

100, 200, 300, 500‧‧‧ microprocessor

101, 201, 301, 501‧ ‧ fuse array

102, 202, 302, 502‧‧‧ encryption engine

103, 203, 303, 503‧‧‧ protective features

105, 205, 305, 505‧‧‧ enabling logic components

106, 206, 306, 506‧‧‧ microcode storage

107, 207, 307, 507‧‧‧Burn controller

108, 208, 308, 508‧‧‧JTAG control chain

109, 209, 309, 509‧‧‧JTAG bus interface components

110, 210, 310, 510‧‧‧ connection pins

211, 311, 511‧ ‧ characteristic fuse

212, 312, 512‧‧‧ access controller

313, 513‧‧ ‧ position detector

401~408‧‧‧Steps

521‧‧‧ machine-specific register

Figure 1 is a schematic diagram of a microprocessor with a fuse enable function.

Figure 2 is a schematic illustration of a microprocessor of the present invention that protects a programmable fuse array.

Figure 3 is a schematic illustration of the apparatus of the present invention having a programmable fuse array for preventing tampering.

Figure 4 is a flow chart of one of the protection methods of the present invention.

Figure 5 is a schematic illustration of a fuse array of the present invention that can be re-enabled and has a tamper-proof function.

200. . . microprocessor

201. . . Fuse array

202. . . Cryptographic engine

203. . . Protective feature

205. . . Enable logic component

206. . . Microcode storage

207. . . Burn controller

208. . . JTAG control chain

209. . . JTAG bus interface component

210. . . Connection pin

211. . . Characteristic fuse

212. . . Access controller

Claims (29)

An integrated circuit for disabling an extended JTAG operation, comprising: a JTAG control chain for enabling or disabling the extended JTAG operation; and a feature fuse for indicating whether the extended JTAG operation has been banned A quasi-detector for monitoring an external voltage signal and informing that the external voltage signal is at a qualified voltage level; a machine-specific register for storing a specific value; and an access controller And coupling the characteristic fuse, the level detector, the machine-specific register, and the JTAG control chain, the access controller is configured to determine whether the characteristic fuse has been blown, and within a fixed period of time The access controller is configured to enable the extended JTAG operation of the JTAG control chain when the particular value meets a coverage value and the external voltage signal is at the acceptable voltage level. The integrated circuit for disabling an extended JTAG operation as described in claim 1, wherein the expanded JTAG operation comprises: reading a fuse state in a fuse array, and blowing a fuse in the fuse array Or read the microcode stored in a microcode storage component. An integrated circuit for disabling an extended JTAG operation as described in claim 1, wherein the access controller receives a reset signal, and after the reset signal is set, the access control The device determines if the feature fuse has been blown, and when the particular value meets the coverage value, the access controller enables the JTAG control chain to disable the extended JTAG operation. The integrated circuit for disabling an extended JTAG operation as described in claim 1 wherein a JTAG boundary scan operation and a test operation are still performed when the extended JTAG operation is disabled. The integrated circuit for disabling an extended JTAG operation, as described in claim 1, further comprising: an encryption engine coupled to the access controller, the encryption engine for performing a specific encryption algorithm A specific number of encryption cycles are performed on the particular value and an encrypted value is generated. A method for disabling an extended JTAG operation and re-enabling a forbidden extended JTAG operation in an integrated circuit, the method comprising: blowing a feature fuse to indicate the extended JTAG The operation has been disabled, wherein the characteristic fuse is disposed in the integrated circuit; performing a first determining operation for determining whether the characteristic fuse has been blown; performing a second determining action for determining an external Whether the voltage signal is at a qualified voltage level; performing a third determining operation for determining whether a specific value conforms to a coverage value, wherein the specific value is stored in a machine-specific register; and when the specific value is met The coverage value and the external voltage signal are at the pass voltage level, enabling a JTAG control chain to disable the extended JTAG operation. The method for disabling an extended JTAG operation as described in claim 6 of the patent application, wherein the extended JTAG operation comprises: reading one The state of the fuse in the fuse array, the fuse in the fuse array is blown, or the microcode stored in a microcode storage component is read. The method for disabling an extended JTAG operation as described in claim 6 further includes: receiving a reset signal, and after the reset signal is set, performing the first and determining actions and the a second determining action; and monitoring the particular value to enable the extended JTAG operation of the JTAG control chain to be disabled for a fixed period of time, wherein the particular value is within the fixed time period Stored in the machine-specific scratchpad. The method for disabling an extended JTAG operation as described in claim 6 of the patent application further includes: performing a JTAG boundary scan operation and a test operation when the extended JTAG operation is disabled. The method for disabling an extended JTAG operation as described in claim 6 further includes: causing a cryptographic engine to perform a certain number of encryption cycles on the specific value according to a specific encryption algorithm, and generating An encrypted value. An integrated circuit for disabling an extended JTAG operation, comprising: a JTAG control chain for enabling or disabling the extended JTAG operation; and a feature fuse for indicating whether the extended JTAG operation has been banned A quasi-detector for monitoring an external voltage signal and informing that the external voltage signal is at a qualified voltage level; An access controller coupled to the feature fuse, the level detector, and the JTAG control chain, the access controller is configured to determine whether the feature fuse has been blown, and when the feature fuse has been blown The JTAG control chain disables the extended JTAG operation, and when the external voltage signal is at a failed voltage level, the access controller disables the JTAG control chain regardless of whether the characteristic fuse has been blown. An extended JTAG operation; and a blow-off controller coupled to a fuse array for receiving a voltage and blowing a selected fuse in the fuse array according to the level of the voltage, wherein the blow control The selected fuse is only blown when the extended JTAG operation is enabled. The integrated circuit for disabling an extended JTAG operation as described in claim 11, wherein the expanded JTAG operation comprises: reading a fuse state in a fuse array, and blowing a fuse in the fuse array Or read the microcode stored in a microcode storage component. An integrated circuit for disabling an extended JTAG operation as described in claim 11, wherein the access controller receives a reset signal, and after the reset signal is set, the access control The device determines if the characteristic fuse has been blown. As described in claim 11, the integrated circuit for disabling an extended JTAG operation, wherein a JTAG boundary scan operation and a test operation are still performed when the extended JTAG operation is disabled. The integrated circuit for disabling an extended JTAG operation, as described in claim 11, further comprising: a blow controller coupled to a fuse array for receiving a voltage, And selecting a selected fuse in the fuse array based on the level of the voltage, wherein the blow controller blows the selected fuse when the extended JTAG operation is enabled. A method for inhibiting an extended JTAG operation includes: blowing a feature fuse to indicate that the extended JTAG operation has been disabled, wherein the feature fuse is disposed in the integrated circuit; a determining action for determining whether the characteristic fuse has been blown; performing a second determining operation for determining whether an external voltage signal is at a qualified voltage level; and when the characteristic fuse has been blown, A JTAG control chain disables the extended JTAG operation, and when the external voltage signal is at a failed voltage level, regardless of whether the characteristic fuse has been blown, the JTAG control chain disables the extended JTAG operation; A voltage is received and a selected fuse within the fuse array is blown according to the level of the voltage, wherein the selected fuse is only blown when the extended JTAG operation is enabled. The method for inhibiting the expansion of a JTAG operation as described in claim 16 wherein the extended JTAG operation comprises: reading a state of a fuse in a fuse array, blowing a fuse in the fuse array, or Reading the microcode stored by a microcode storage element. The method for prohibiting the expansion of the JTAG operation as described in claim 16 of the patent application, further comprising: receiving a reset signal, and after the reset signal is set, determining Whether the characteristic fuse has been blown. The method for prohibiting the expansion of the JTAG operation as described in claim 16 of the patent application further includes: performing a JTAG boundary scan operation and a test operation when the extended JTAG operation is disabled. An integrated circuit for disabling an extended JTAG operation, comprising: a JTAG control chain for enabling or disabling the extended JTAG operation; and a feature fuse for indicating whether the extended JTAG operation has been banned a quasi-detector for monitoring an external voltage signal and for determining whether the external voltage signal is at a failed voltage level; and an access controller coupled to the characteristic fuse, the level a detector and the JTAG control chain, the access controller is configured to determine whether the characteristic fuse has been blown, and when the external voltage signal is at the failed voltage level, regardless of whether the characteristic fuse has been blown, An access controller is used to disable the JTAG operation of the extended JTAG control chain. The integrated circuit for disabling an extended JTAG operation as described in claim 20, wherein the extended JTAG operation comprises: reading a fuse state in a fuse array, and blowing a fuse in the fuse array Or read the microcode stored in a microcode storage component. An integrated circuit for disabling an extended JTAG operation as described in claim 20, wherein the access controller receives a reset signal, and after the reset signal is set, the access control Determining whether the characteristic fuse has been blown, and when the external voltage signal is in the The access controller disables the extended JTAG operation of the JTAG control chain when the qualified voltage level is normal. An integrated circuit for disabling an extended JTAG operation as described in claim 20, wherein a JTAG boundary scan operation and a test operation are still performed when the extended JTAG operation is disabled. The integrated circuit for disabling an extended JTAG operation as described in claim 20, further comprising: a burnout controller coupled to a fuse array and the level detector for receiving the An external voltage signal, and according to a level of the external voltage signal, blowing a selected fuse in the fuse array, wherein the blow controller is configured to blow the selected one when the extended JTAG operation is enabled fuse. A method for inhibiting an extended JTAG operation for disabling an extended JTAG operation in an integrated circuit, the method comprising: blowing a feature fuse to indicate that the extended JTAG operation has been Disabled, wherein the characteristic fuse is disposed in the integrated circuit; performing a first determining operation for determining whether an external voltage signal is at a failed voltage level; performing a second determining action for determining the feature Whether the fuse has been blown; when the external voltage signal is at the unqualified voltage level, a JTAG control chain disables the extended JTAG operation; and when the external voltage signal is at a qualified voltage level, and the characteristic fuse The JTAG control chain disables the extended JTAG when it has been blown operating. The method for inhibiting the expansion of a JTAG operation as described in claim 25, wherein the expanded JTAG operation comprises: reading a state of a fuse in a fuse array, blowing a fuse in the fuse array, or Reading the microcode stored by a microcode storage element. The method for prohibiting the expansion of the JTAG operation as described in claim 25, further comprising: receiving a reset signal, and after the reset signal is set, performing the first determining action and the The second judgment action. The prohibition method for disabling and expanding the JTAG operation as described in claim 25 of the patent application further includes: performing a JTAG boundary scan operation and a test operation when the extended JTAG operation is disabled. The prohibition method for disabling an extended JTAG operation as described in claim 25, further comprising: receiving the external voltage signal when the extended JTAG operation is enabled, and in the integrated circuit A blow-off controller blows a selected fuse according to the level of the external voltage signal.