Unable to disable JTAG in i.MX 8MPlus

[satoshi_ohta-at]

Hello,

I am considering disabling JTAG in i.MX8MPlus.

I have written to 0x470[21] and 0x470[23:22] (No debug mode) as described in the following forum.

https://community.nxp.com/t5/i-MX-Processors/How-to-disable-JTAG-on-i-MX-8M/m-p/966421

The command that I used is as follows.

-----
u-boot=> fuse prog -y 1 3 0xe00000
Programming bank 1 word 0x00000003 to 0x00e00000...
-----

Reading it after that will give out the results below.

-----
u-boot=> fuse read 1 3
Reading bank 1:

Word 0x00000003: 88e00000
-----

0x88000000 is the value already there from default.

I then tried connecting JTAG to see if JTAG was disabled, but JTAG is still enabled.

Are there any other Fuse bits that need to be written besides 0x470[21] and 0x470[23:22] to disable JTAG?

Best regards

[Rita_Wang]

Only this:

customer will need to perform a Threat and Risk Assessment and decide what is best for their requirements.

If a customer needs certain JTAG features then they may have to evaluate the risk and decide the tradeoffs. Our Security Checklist also makes similar recommendations for customers to evaluate and decide accordingly. For many customers programming the JTAG disable fuse is enough while others do not route the interfaces in their final product.

[satoshi_ohta-at]

Thank you for the reminder.
I am currently in the process of investigating whether JTAG can be disabled.

I have already written to the Fuse bit you mentioned.
-----
u-boot=> fuse read 1 3
Reading bank 1:

Word 0x00000003: 88e00000
------

I then connected JTAG to check the operation.

However, JTAG still able to read the ID codes of devices connected to the JTAG chain.
I think this means JTAG is not disabled.

Is my understanding correct?

Thank you in advance for your response.

[satoshi_ohta-at]

After additional research, I understood that there are three modes of JTAG in i.MX 8MPlus.

- Boundary scan mode
Reference: i.MX 8M Plus Hardware Developer's Guide
Pin settings: BOOT_MODE0, BOOT_MODE1, BOOT_MODE2, BOOT_MODE3, JTAG_MOD, POR_B must be at 111111

- Debug mode
Reference: i.MX 8M Plus Applications Processor Reference Manual
Pin setting: JTAG_MOD == 0

- Test mode
Source: i.MX 8M Plus Applications Processor Reference Manual
Pin setting: JTAG_MOD == 1

Up until now, I have been trying in Boundary scan mode.

When setting SJC_DISABLED == 1 (0x470[21]), JTAG_SMODE[1:0] == 11 (0x470[23:22]),
the device code ID cannot be read in Debug mode and Test mode, but it can be read in Boundary scan mode.
Therefore, I think that Debug mode and Test mode are already disabled, but Boundary scan mode is not disabled.

In Boundary scan mode, it is possible to read and write IO port status from JTAG, but it is not possible to see the CPU internal memory and registers.
Is this understanding correct?

If so, could you please tell me what else can and cannot be done in Boundary scan mode on the i.MX8M Plus?
Furthermore, can the Boundary scan mode be disabled?

Thank you in advance for your answer.

[Rita_Wang]

JTAG interface, our reserved debug interface, is not required for over 95% of designs because we only need to use JTAG when DDR requires separate debugging.

And we supply the ddr stress test and usb download tool. So you may not need to use it in your design.

For the BSDL few customer need to do it, only some NXP big parterner do it. Here you can do not do it.

Hope this can do help for you