2394964_en-US

Yes

RT1176 - SPI NOR-Flash readout issue via JTAG after programming BT_FUSE_SEL

Hello,

we are testing the signing and encryption process on RT1176 CPU.

Our basic System setup is: UART/JTAG <-> RT1176 <-> SPI Nor Flash

The Software we use for testing is:

- RT1176 testfirmware (simple firmware which does active an LED after boot)

- NXP MCUXpresso Secure Provisioning / blhost (for signing and encryption via UART)

- Segger JFlash (for Flash access via JTAG)

So far, we carried out the following tests:
1) While the CPU is unlocked and signing is off, the firmware (unsigned / not encrypted) boot as expected and we can access the flash without problems via JTAG.
2) While the CPU is unlocked and signing is active, the firmware (signed / not encrypted) boot as expected and we can access the flash without problems via JTAG.
3) While the CPU is locked and signing is on, the firmware (signed / encrypted) will not boot and access to the flash becomes unstable via JTAG.

So, we have some kind of encryption issue. But before we examine the big encryption issue we want to understand the unstable flash behavior in step 3.

During a few tests, it became apparent that the flash problem always occurs as soon as BT_FUSE_SEL is blown (BT_FUSE_SEL intact: full flash access via jtag, BT_FUSE_SEL blown: unstable flash access via JTAG). Since we're still testing, we haven't disabled JTAG via fuse setting.

So the Question is:
Why does BT_FUSE_SEL cause us to lose access to flash? (Is there some read-out-protection active when the CPU is locked? Does the segger jflash tool have problems with the locked CPU? ...)

Also see:
https://community.nxp.com/t5/i-MX-RT-Crossover-MCUs/mxrt1176-quot-half-quot-bricked-after-programmin...
-> same issue: BT_FUSE_SEL > no flash access

Thanks in advance.

Best regards,
Florian

Re: RT1176 - SPI NOR-Flash readout issue via JTAG after programming BT_FUSE_SEL

Hi @florian_arndt ,

Thanks for your interest in NXP MIMXRT series!

BT_FUSE_SEL does not directly enable SPI NOR read-out protection or disable JTAG. Its function is to force the Boot ROM to use the boot configuration stored in eFuse instead of the BOOT_CFG pins.

If the OTFAD/encrypted-XIP configuration has also been programmed into eFuse, burning BT_FUSE_SEL makes that configuration effective on every boot and removes the possibility of bypassing it through the BOOT_CFG pins. An incorrect OTFAD context, key, address range, or encrypted image can therefore cause the Boot ROM to fail before the application starts.

Therefore, I believe the most likely cause at this point is that the GPIOs related to boot have been bypassed, but the corresponding eFuse has not been properly configured. BT_FUSE_SEL itself does not affect the JTAG connection. I suggest you conduct an A/B test to quickly pinpoint the issue.

Best regards,
Gavin