topic Re: JTAG_SMODE to secure and SWD (E-XIP) in i.MX RT Crossover MCUs

JTAG_SMODE to secure and SWD (E-XIP)

leonardos1 — Fri, 29 Mar 2019 14:54:06 GMT

Hi,

I'm settings up the security on a iMXRT1051 custom board, also tested on the IMXRT1050 EVKB.

The build is a FreeRTOS firmware and can proudly say that is running in EXIP (Encrypted eXecution In Place) flashed in a QSPI NOR. So, to recap the BEE is configured but I didn't touch anything to HAB or Central Secure Unit.

Everything was fine but I was going to close the board and securing the debugging ports.

Reading IMXRT1051SRM_rev1 and the AN4686 documents I was planning to enable the Secure JTAG mode fusing the JTAG_SMODE to 01.

Will it make possible to use the challenge/response mechanism with SWD?

Does it work only with JTAG so I need to disable the SWD entirely?

Re: JTAG_SMODE to secure and SWD (E-XIP)

jeremyzhou — Mon, 01 Apr 2019 06:28:59 GMT

Hi leonardo salvatore,

Thank you for your interest in NXP Semiconductor products and for the opportunity to serve you.
Q1) Will it make possible to use the challenge/response mechanism with SWD?
-- Actually, I'm very clear with the question, whether you can clarify it.
Q2) Does it work only with JTAG so I need to disable the SWD entirely?
-- Yes, you can disable the SWD mode by setting the DAP_SJC_SWD_SEL bit.

Fig 1

Have a great day,
TIC

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!

- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------

Re: JTAG_SMODE to secure and SWD (E-XIP)

leonardos1 — Mon, 01 Apr 2019 08:21:28 GMT

Hello,

Let me be more clear here.

I know how to use secure jtag with other boards lautherbach and OpenoOCD sending custom shift commands for challenge/response handshake.

But I'm new to imxrt and swd.

Q1.

The custom PCB I'm working with has only SWD.

Is it possible to secure it with the Secure JTAG?

Q2.

Sure I have done on the EVKB and is working fine.

Thank you for your time.

Re: JTAG_SMODE to secure and SWD (E-XIP)

leonardos1 — Tue, 02 Apr 2019 11:37:48 GMT

Thank you Micheal,

I finally had chance to test what I have done on the customer PCB and the EVKB.

To switch to JTAG and secure it I was missing the KTE_FUSE to me wasn't crystal clear in the documentaion.

What I'm missing now is the very last step, means communicate with the JTAG state machine to read the Challenge and send back the matching Response using the Segger/JLink script.

I was planning to use the chapter 4.1 of the document you share, unfortunately I cannot find this file to download.

If you wish to navigate to these scripts from Lauterbach’s main page for reference, they are located under “Support” - “Download Center” - “Start-UpScripts” at “arm” - “imxrt” “secure-jtag”.

Re: JTAG_SMODE to secure and SWD (E-XIP)

leonardos1 — Tue, 09 Apr 2019 05:43:02 GMT

Finally it worked, Secure JTAG works with an EXIP image.

SWD is not duable you have to switch the chip to JTAG.

Re: JTAG_SMODE to secure and SWD (E-XIP)

michael_galda — Wed, 10 Apr 2019 08:41:38 GMT

Hi Leonardo,

Thanks for confirmation.

This is exactly what I saw before.

Attached is the AppNote draft, describing the usage with Segger JLink (instead of the Lauterbach)

The AN will be released soon. If you see anything wrong or unclear, correct me, please.

Thanks for cooperation,

Michael