FRDM MCXN947: Debug Authentication not working

[FlorianF1]

Hello, I'm currently evaluating the debug authentication on the FRDM-MCXN947.
Environment:

• Probe: On-board MCU-Link flashed with J-Link firmware

• SPSDK Version: 3.0.0

• J-Link Version: V8.56a

The Board is getting provisioned using the Secure Provisioning Tool version 25.12 (Workspace attached). I updated CC_SOCU_PIN, CC_SOCU_DFLT (CMPA), DCFG_CC_SOCU_NS_PIN, DCFG_CC_SOCU_NS_DFLT (CFPA) and advanced the lifecycle using the CFPA_LC_STATE Bit-field to enable debugging after authentication is done since advancing using OTP is irreversable. Keys, debug certificate request and debug certificate have been created using the GUI Tool. After Pin Reset the firmware is running. Connecting to the Board using J-Link is failing and stating to Re-enable the debug access. Debug Authentication is also failing:

After POR I'm able to debug the application using MCUXpresso for VSCode without doing debug authentication (This should not be possible, right?). Doing Debug Authentication though, this time its running through successfully. Nevertheless commands like 

nxpdebugmbox -i pyocd cmd -f mcxn947 ispmode -m 0

are still failing: "SPSDKAppError: Entering into ISP mode failed: SPSDK: Problem with debug mailbox occurred: SPSDK: Device did not send correct ACK answer!". Having a look at the lifecycle after setting the board into ISP mode (using reset and isp button), Lifecycle: Secured, and unable to read any PFR/OTP configuration (as expected).

By just enabling Dual Image Boot option, building, flashing the image (pfr mass erase done previously)and doing a POR. Doing debug authentication is always failing. No connection using J-Link can be established and trying to enter ISP mode through debug mailbox fails as well.

I'm think my configuration should be correct, but i would appreciate a validation. Since I'm only evaluating no fuses are burned. Is it required to burn fuses to get Debug Authentication to work correctly? If more detailed information are needed, just let me know. Appreciate any information on what i might have missed or how to move on.

[Alice_Yang]

Hi @FlorianF1 

In addition to Marek’s suggestion, you may also refer to this Application Note (AN14162) https://www.nxp.com/webapp/Download?colCode=AN14162 , which describes the debug authentication procedure for MCXN947 using the Secure Provisioning Tool indetail.

Thank you.

BR

Alice

[FlorianF1]

Hi @Alice_Yang , @marek-trmac 

I created a new fresh workspace and followed the instructions of Application Note (AN14162), but I'm seeing the same behaviour like in my previous setup.

Did anyone of you got the chance to have a look at the workspace I provided?

Regards

[marek-trmac]

Hi @FlorianF1 

I tried to follow the app note today with MCXN236 processor and I was able to open debug probe using J-Link Windows SW 8.56a, however with J-Link Windows SW V938a it does not work and the tool reports problem with AHB access (similar you have). I'd recommend to double-check the J-Link Windows SW V938a is not installed.

I also briefly looked into your workspace and I do not see any issue there.

You can also consider try the use cases with MCU-LINK debug probe (CMSIS firmware).

[FlorianF1]

Hi @marek-trmac 

thanks for the advice. I will double check the JLink.

Did you also check the following:

• Trying to debug the device without doing and after doing debug authentication after POR (the first one should not work)
• Changing provisioning to use "Dual image boot" (debug authentication and debug always fails at my side)
• Try to enter isp-mode using the debug mailbox command (should be possible since DCFG_CC_SOCU_PIN and DCFG_CC_SOCU_DFLT for both CMPA and CFPA are set to 0xFE3F01C0 following the app note meaning ISP_CMD_EN is in fixed state and enabled): 

nxpdebugmbox -v -i pyocd -s 1068597770 cmd -f mcxn947 ispmode -m 0​

Regards

[marek-trmac]

hi @FlorianF1 

can you share CC_SOCU_PIN, CC_SOCU_DFLT (CMPA), DCFG_CC_SOCU_NS_PIN, DCFG_CC_SOCU_NS_DFLT (CFPA) configured in Secure Provisioning tool OR complete workspace? 

After POR I'm able to debug the application using MCUXpresso for VSCode without doing debug authentication (This should not be possible, right?).

That's right, if you configured chip correctly, the debug should be disabled.

Since I'm only evaluating no fuses are burned. Is it required to burn fuses to get Debug Authentication to work correctly?

That should not be needed

[FlorianF1]

Hello @marek-trmac,

complete workspace is attached below.

Regards