How to disable JTAG on i.MX 8M?

[christian_mauderer]

The i.MX 8M reference manual mentions a JTAG_SMODE[1:0] and a SJC DISABLE e-fuse that are necessary to disable JTAG access. But I can't find the address or location of the fuses. Where can I find them? Is there some document describing it?

[Nocker]

Hi,

I have the exact same question, can someone let me know the answer please?

And I agree with what someone else has posted, it is not very useful when the answer results in a private email.

Regards,

Chris

[bernhardfink · Accepted solution]

Here is the description of these fuse bits:

Fuse Address	Fuse Name	Function	Setting
0x470[21]	SJC_DISABLE	Disable/Enable the Secure JTAG Controller module. This fuse is used to create highest JTAG security level, where JTAG is totally blocked.	0 - Secure JTAG Controller is enabled 1 - Secure JTAG Controller is disabled
0x470[23:22]	JTAG_SMODE[1:0]	JTAG Security Mode. Controls the security mode of the JTAG debug interface	00 - JTAG enable mode 01 - Secure JTAG mode 1x - No debug mode

[Bhardwaj]

Hi,

When we are read the bank 1 word 3 in I.MX8MPLUS after the U-BOOT ,we observe the below value.

Does it means ,Is JTAG is Disable?

You said that  SJC_DISABLE  and JTAG_SMODE are set high ,that means JTAG is Disable.

Does the I.MX8M  fuse address are applicable for I.MX8MPLUS ?.

Fuse Address	Fuse Name	Function	Setting
0x470[21]	SJC_DISABLE	Disable/Enable the Secure JTAG Controller module. This fuse is used to create highest JTAG security level, where JTAG is totally blocked.	0 - Secure JTAG Controller is enabled 1 - Secure JTAG Controller is disabled
0x470[23:22]	JTAG_SMODE[1:0]	JTAG Security Mode. Controls the security mode of the JTAG debug interface	00 - JTAG enable mode 01 - Secure JTAG mode 1x - No debug mode

[bernhardfink]

You seem to have a closed part. All 3 relevant bits are set. Bit definitions and the location are valid for i.MX 8M Plus.

Make a crosscheck with a debugger, if you don't see any core appearing, then the JTAG is definitely closed.

Regards,
Bernhard.

[Bhardwaj]

1.How to enable JTAG Mode in I.MX8MPLUS ? 

2.Is there any possibility to override that register in I.MX8MPLUS ? for I.MX6 a bit is mentioned to override JTAG_SMODE by setting the BOOT_CFG_LOCK bits as shown below?.

[bernhardfink]

Closed is closed. If there would a way to re-open it, the closed configuration wouldn't make sense. The OTP bits are really just one-time-programmable.

The alternative way to access the chip is the Serial Download Protocol (SDP) on the USB port.

According to your readout, bit[28] = BT_FUSE_SEL is not set, so the device can still boot taking a configuration from external BOOT_MODE pins.

Regards,
Bernhard.

[kirankumar007]

Problem-1

1)We have I.MX8MP EVK has default image, stopped at u-boot using putty and checked below register JTAG 

From above image JTAG Disable permanently one of of the NXP Support aslo given message.please confirm

Problem-2

1)We have custom board(i.MX8MP) doesnt have default image, any procedure for JTAG Access. Is it possible any where without default image JTAG access is possible????

2)If possible means how decribe procedure

3)if not, USB connections out cutstom device shown below

Its USB2.0 in EVK Type C connections given, said USB2.0 also compatible,then please given a procedure with our hardwrae and software loading using USB2.0.

Many days happen request you give clear and stright procedure for all of above 

[bernhardfink]

On my EVK boards the JTAG is enabled, the two lock bits are not set:

u-boot=>     fuse read 1 3
Reading bank 1:

Word 0x00000003: 88000000

1) The JTAG port on your EVK is disabled by the fuses.

2) The BOOT_MODE[3:0] pins need to have the value '0 0 0 1' to force the i.MX 8M Plus into serial downloader mode. 

Pin Name	Ball	Value for USB download
BOOT_MODE0	G10	1
BOOT_MODE1	F8	0
BOOT_MODE2	G8	0
BOOT_MODE3	G12	0

On the 8M Plus EVK this is easy to make, there are DIP switches near to the PWR switch, marked with BOOT_MODE.

The USB connection on your custom PCB seems to be perfectly fine, if you succeed to set the BOOT_MODE pins correctly, you should see the i.MX 8M Plus going into SDP mode after power-on:

Download the Windows UUU tool from here:  https://github.com/nxp-imx/mfgtools/releases/download/uuu_1.5.201/uuu.exe

• uuu.exe is a command line tool, open a cmd window to work with it
• Connect the EVK or your custom board with the PC and power it up
• Type  $ uuu.exe -lsusb
  
  

  D:\Image-Programming>uuu.exe -lsusb
  uuu (Universal Update Utility) for nxp imx chips -- libuuu_1.5.201-0-g727fc2b
  
  Connected Known USB Devices
          Path     Chip    Pro     Vid     Pid     BcdVersion      Serial_no
          ====================================================================
          2:6      MX865   SDPS:   0x1FC9 0x0146   0x0001  E5973000757D125C​

• If you see that, then you can download u-boot or a full image using the uuu tool.
• Please download the demo image for the 8M Plus from here:
  https://www.nxp.com/webapp/Download?colCode=L6.12.34-2.1.0_IMX8MP&appType=license
• Extract the file, copy uuu.exe into the folder and program the complete image:
  

  # Flash to SD-Card (if it's there)
  > uuu.exe -b sd_all imx-image-full-imx8mpevk.wic
  
  # Flash to eMMC​
  > uuu.exe -b emmc_all imx-image-full-imx8mpevk.wic

  
  
  
• You can download a smaller boot image (u-boot only) from here:
  https://www.nxp.com/webapp/Download?colCode=L6.12.34-2.1.0_BOOT_8M&appType=license
  

  # Download to RAM
  > uuu.exe ​imx-boot-imx8mpevk-sd.bin-flash_evk
  
  # Flash to SD-Card (if it's there)
  > uuu.exe -b sd ​imx-boot-imx8mpevk-sd.bin-flash_evk
  
  # Flash to eMMC
  > uuu.exe -b emmc ​imx-boot-imx8mpevk-sd.bin-flash_evk

Regards,
Bernhard.

[Bhardwaj]

Hi @bernhardfink 

1. In our custom board(I.MX8MPLUS) we connected one end of USB to the board and other end to the PC. we Set BOOT MODE pins/jumpers to Serial Download Mode and powered on.

2.After power on we executed uuu.exe -lsusb command in CMD window, no USB device was detected.

 

Queries:

1. As per your confirmation, the schematic connections are correct, but why we are unable to detect the USB?
2. After powering on the board, the ROM code begins execution. Does the Boot ROM initialize and enumerate the USB interface during this stage?
3. If so, how can we verify that the ROM code has successfully executed and the system has entered the USB download (Serial Downloader) mode?

[bernhardfink]

Hi Bhardwaj,

even if USB 2.0 is not that fast, the wiring you did to connect USB may impact the electrical quality of the D+/D- signals too much. Could you try to make the wires shorter?

There is no real indication to the outside, that the USB block is enabled. If you have a spectrum analyzer, then you could try to catch the 480 MHz radiation from the USB PLL on top of the 8M Plus.

I did it with a simple antenna probe (thin wire, 20 loops, connected to an RF cable) and the settings below.

Regards,
Bernhard.

[Bhardwaj]

Hi @bernhardfink ,

1. On the i.MX8M Plus EVK, LPDDR4 memory is used. However, on our custom board, we are using DDR4 memory (Part No: MT40A1G16RC-062EIT:B).

2. we had build U-Boot in standalone environment by seeing I.MX porting guide,and followed the below procedure mentioned.

https://community.nxp.com/t5/i-MX-Processors-Knowledge-Base/Manually-build-Boot-binary-for-i-MX8M-Mi...

3. whenever we tried to boot from fspi ,we are facing the below mention error.

4. we also download the ddr_timing.c from DDR TOOL.

5. While generating images for the i.MX8M Plus LPDDR4 EVK using the Yocto BSP, we are able to successfully generate SD card, F SPI, and boot binary images.
However, when we try to generate images for the i.MX8M Plus DDR4 configuration, it fails to generate the F SPI images and shows an error indicating that only SD and NAND are supported.

can you please guide us regarding this DDR4.

[kirankumar007]

Previous Post Image is not clear please check below

[M_J]

Hi @igorpadykov 

Could you forward to me details as well?

Kind regards,
Marcin

[bernhardfink]

Meanwhile these fuse bits have been documented in the Security Reference Manuals of 8M Nano and 8M Plus. It's the same structure as in 8M and 8M Mini.

I will check

• Why we haven't updated it for 8M Mini and 8M yet
• Why it is not part of the OTP fuse description in the normal Reference Manual

Regards,
Bernhard.

[igorpadykov]

Hi Christian

one can look at

Understanding how to burn eFuses on i.MX8 and i.MX8x families - i.MXDev Blog 

https://community.nxp.com/thread/505184 

Best regards
igor
-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

[christian_mauderer]

Hello Igor,

thanks for the reply. My problem is not how to set a fuse in general. It's more the problem where this specific fuses are located.

For example: The reference manual tells me that BT_FUSE_SEL is at 0x470[28] and it tells me that this is bank 1 word 3. But it doesn't tell me a location for JTAG_SMODE[1:0] and SJC DISABLE. For i.MX6 or i.MX7 there is another document that tells me the location (https://www.nxp.com/docs/en/application-note/AN4581.pdf ). But I didn't find one for i.MX8.

Best regards

Christian

[igorpadykov]

Hi Christian

I sent additional details by mail.

Best regards
igor

[xuxa]

Can you also send me the additional details?

Thank you.

[bernhardfink]

I marked my answer from last year as solution, so that it's easier to find.

[marcusfolkesson]

Please post the solution here instead of sending it to one single recipient. There are too many threads here that end with "I sent you a mail". The thread is useless for everyone but the thread creator.

I would like to have this information as well.

Thanks,
Marcus