How to disable detecting the JTAG activity on RT1052 SNVS

[JerryQian_132]

Hi,

My board has programmed the fuse to set SEC_CONFIG=1 to enable security, and programmed SRK hash. I have configured to use the SNVS OPTMK.

When debugging my secure boot, I found that:

1. If connect to JTAG (J-Link, SWD, reset type core), the HPSR.SSM_STATE is always 0x3, which means Soft fail. As "Table 10-2. Security State Machine State Difinations", DCP will use the test master key for blobs. So I cannot use the programmed SRK hash to decrypt my encrypted application.
2. I have checked the HPSVSR and LPSR registers too. They are
   HPSR      : 0x8000b300
   HPSVSR : 0x80000002
   LPSR       : 0x00000008
   HPSVSR.SV1 = 1 means security vilation 1 is active. As the RM, it's JTAG active.
3. If I disconnect the JTAG, my code reports HPSR.SSM_STATE = 0xD (Trusted). It can use the expected SRK hash to decrypt my encrypted application.

My questions are:

1. Can I disable the JTAG activity detections when it is connecting to JTAG after POR? Fuse?
   The RM mentioned that "Based on configuration fuses and configured bits within registers, SNVS is able to detect a variety of security violation inputs and perform the configured policy enforcement actions." How can I diable the security violation 1 detections? 
2. Is it possible make SSM from "Soft Fail" to "Trusted"? As Figure 10-2. Security State Machine, seems no.

Thanks

[danielchen]

Hi 

RT10xx shouldn't have this limitation, please double check your pull resistors configuration for JTAG pins as following:

You could pull TCK low, or pull TRST low, or pull TMS high by SW (PUE/PUS of IOMUXC) before any reset. IOMUXC won’t be reset by system reset so just need one time program of any one of these IO after POR.

[JerryQian_132]

Hi Daniel,

I have never changed the JTAG pins configurations. Below are their values. Same as default value.

Without JTAG

0x401F80D8 : 0x0
0x401F82C8 : 0x70A0
0x401F80E8 : 0x0
0x401F82D8 : 0x70A0
0x401F80D4 : 0x0
0x401F82C4 : 0x70A0

With JTAG

0x401F80D8 : 0x0
0x401F82C8 : 0x70A0
0x401F80E8 : 0x0
0x401F82D8 : 0x70A0
0x401F80D4 : 0x0
0x401F82C4 : 0x70A0

BTW, could it related to HW? Below is my schematic about JTAG connection.

Thanks

[danielchen · Accepted solution]

Hi @JerryQian_132 :

The attached picture is unclear, please make sure TRST pin with pull-down resistor in order to avoid JTAG violation (0 PKE_0_Pull_Keeper_Disabled — Pull/Keeper Disabled). It can make effect on all of reset beside POR. 

If can't rework the board, please use SW to configure with core reset only

0x401F80D8 : 0x0 0x401F82C8 : 0x30A0 0x401F80E8 : 0x0 0x401F82D8 : 0x30A0 0x401F80D4 : 0x0 0x401F82C4 : 0x70A0

Additionally, please boot firstly, then connect the JTAG interface.

[JerryQian_132]

Hi Daniel,

I have tried your suggestions. My problem has been resolved.

When connect to JTAG, my code can decrypt the encrypted application now. HPSR.SSM_STATE is trusted (0xD) too. Same behavior as JTAG disconnected. Thanks.