Hi!
After following along to application note AN13133, we can confirm that:
1) Secure JTAG works: We can log into the IMXRT117X using the secure jlink script to unlock and debug with an application.
2) OTFAD Debugging works: We also have found we can debug with an OTFAD encrypted app not locked down with Secure JTAG.
However, we have found that we cannot use Secure JTAG and OTFAD simultaneously. When we use the same jlink script to unlock on an OTFAD encrypted application, the device jumps into the boot rom.
Why would OTFAD and Secure JTAG not work together?
Thanks
Hi @eforzano
Thank you for your patience, I have checked this internally, with another expert colleague on this, see the below feedback.
Actually, RT1170 forbids to debug security codes when HAB closed plus code protection via OTFAD or IEE. And each security engine implement itself process mechanism when receiving debug signal, in other word, When JTAG attempts to access encrypted resources, the related engine will prevent exposure of encrypted resources.
In your customer case, enabling secure debug must require to do HAB closing on RT1170, so the case's problem is as designer expected.
We suggest customer to only enable common codes in-field debugging, secure codes debugging must be finished in-development not in-field.
We hope this could help you! do not hesitate to let me know any further questions you could have.
Diego
Thank you for your response! Let me know if you need anything. Were you able to reproduce the issue?
Hi @eforzano
I just want to maintain you updated, I am sorry for the delayed response.
For now, I am currently investigating the issue, please allow me to return back to you with feedback as soon as possible for me! If I need more information I will let you know.
Diego.
Hi Diego!
It is the whole image - region 1.
The region start is: 0x30002000
The region length is: = 0x1FC000
Let me know if you have any more questions.
Hi @eforzano
Thank you for your interest and for reporting the issue you found during your development. Lets look into it.
Would you be able to let me know details about the OTFAD configuration that you made? Is it whole image ? if not, what is the OTFAD Region start and Region length and your application's start and end adress. Below some context of this question, using the MCUXpresso Secure Provisioning v10's OTFAD Configuration menu.
Best regards,
Diego