FRDM MCXN947: Debug Authentication not working

[FlorianF1]

Hello, I'm currently evaluating the debug authentication on the FRDM-MCXN947.
Environment:

• Probe: On-board MCU-Link flashed with J-Link firmware

• SPSDK Version: 3.0.0

• J-Link Version: V8.56a

The Board is getting provisioned using the Secure Provisioning Tool version 25.12 (Workspace attached). I updated CC_SOCU_PIN, CC_SOCU_DFLT (CMPA), DCFG_CC_SOCU_NS_PIN, DCFG_CC_SOCU_NS_DFLT (CFPA) and advanced the lifecycle using the CFPA_LC_STATE Bit-field to enable debugging after authentication is done since advancing using OTP is irreversable. Keys, debug certificate request and debug certificate have been created using the GUI Tool. After Pin Reset the firmware is running. Connecting to the Board using J-Link is failing and stating to Re-enable the debug access. Debug Authentication is also failing:

After POR I'm able to debug the application using MCUXpresso for VSCode without doing debug authentication (This should not be possible, right?). Doing Debug Authentication though, this time its running through successfully. Nevertheless commands like 

nxpdebugmbox -i pyocd cmd -f mcxn947 ispmode -m 0

are still failing: "SPSDKAppError: Entering into ISP mode failed: SPSDK: Problem with debug mailbox occurred: SPSDK: Device did not send correct ACK answer!". Having a look at the lifecycle after setting the board into ISP mode (using reset and isp button), Lifecycle: Secured, and unable to read any PFR/OTP configuration (as expected).

By just enabling Dual Image Boot option, building, flashing the image (pfr mass erase done previously)and doing a POR. Doing debug authentication is always failing. No connection using J-Link can be established and trying to enter ISP mode through debug mailbox fails as well.

I'm think my configuration should be correct, but i would appreciate a validation. Since I'm only evaluating no fuses are burned. Is it required to burn fuses to get Debug Authentication to work correctly? If more detailed information are needed, just let me know. Appreciate any information on what i might have missed or how to move on.

[Alice_Yang]

Hi @FlorianF1 

In addition to Marek’s suggestion, you may also refer to this Application Note (AN14162) https://www.nxp.com/webapp/Download?colCode=AN14162 , which describes the debug authentication procedure for MCXN947 using the Secure Provisioning Tool indetail.

Thank you.

BR

Alice

[marek-trmac]

hi @FlorianF1 

can you share CC_SOCU_PIN, CC_SOCU_DFLT (CMPA), DCFG_CC_SOCU_NS_PIN, DCFG_CC_SOCU_NS_DFLT (CFPA) configured in Secure Provisioning tool OR complete workspace? 

After POR I'm able to debug the application using MCUXpresso for VSCode without doing debug authentication (This should not be possible, right?).

That's right, if you configured chip correctly, the debug should be disabled.

Since I'm only evaluating no fuses are burned. Is it required to burn fuses to get Debug Authentication to work correctly?

That should not be needed

[FlorianF1]

Hello @marek-trmac,

complete workspace is attached below.

Regards