Secure JTAG issue on IMX6

[luc410]

Hello All,

We try to test a design with an  IMX6 processor using Goepel tool. This processor is in secure mode #2 this was done by the customer).
To check communication between tester and device under test, Goepel tool start communication by a "Test Byte" (8 bits).
Folow the application note AN4626, we apply the following pattern:
1) Load IR with "Security Output Challenge" opcode.

2) Apply 64+8 clocks and read on TDO "Testbyte" + "Device Unique ID" : this step is ok.
3) Load IR with "Security Enter Response" opcode.
4) Apply on TDI "TestByte" (8 bits) + "Secret Response Key" (56 bits) .Shift ( 64 clocks) : in the same time, we read the TDO output. We expect an unknow value (56 bits: Security Enter Response register init value ) and  the Testbyte (8 bits).
But, in fact, we have only "0" on TDO, for the 64 clocks. 
The system behaves as if the communication was down, and we cannot access  other data register.

Can anyone help me?

Many Thanks

[AldoG]

Hello,

I guess you mean the AN4686, in section 2.1.2 Debug flow when Secure JTAG mode is enabled

4. The SJC compares the expected internal fused response key with the one shifted in, and enables the JTAG access only if it matches.

As you said that you cannot access the register it means that the JTAG is not enabled since the response key shifted in is not correct, customer should check whether the response key is the same it was programmed into the SJC_RESP eFuse.

Hope this helps,

Best regards,

Aldo

[luc410]

Hi Aldo,

Thanks for your answer : but for the customer the response key shiften is correct.
Is it possible to have a more precise description of the "Secutity Enter Response register" in term of BC type cells ,
or other documentation.

Have a nice day.

Luc 

[AldoG]

Hello,

For more information of those register one could check the Security Reference Manual, please request access to this document trough your DFAE.

Thank you,

Best regards,

Aldo.