Secure JTAG in imxrt1050-EVKB

[vanessa_dis]

Hello

I'm using an IMXRT1050-EVKB REV A1, and the micro said MIMXRT1052.

I did the fuse configurations described here https://www.nxp.com/docs/en/application-note/AN12419.pdf.

and I've read that J32 and J33 should be removed, so I removed those jumpers.

And when I tried to debug in MCUExpresso (without run script in j-link) it let me debug like this image.

(i'm using JTAG connector on J34)

I don't know if it would be like this, i mean, if this is correct.

And if I try to run the script, it didn't identify UUID0 and UUIDD1, it doesn't matter if I put JTAG_MOD in 0 or 1, it never find UUID's  

I'm not sure what steps I have to follow then, because I just blown the fuses in the manual.

I hope you can help me,

Thanks

[kerryzhou]

Hi @vanessa_dis 

  Check my oscilloscope wave:

ch1: TCK
Ch2: TDI
ch3: TDO
ch4: TMS

You can seem, my board have the wave.

So, if your board even no wave, I think your JLINK even didn't really connect to your RT board with the JTAG interface, you need to check your connections.

It's better use the 20 pin JTAG cable directly instead of your wire by wire, if you can't make sure your connection is correct or not.

Wish it helps you!

If you still have questions about it, please kindly let me know.

Kerry

[kerryzhou]

Hi @vanessa_dis ,

   Please double check quickly, which JTAG interface you are using? 

   From your picture, seems you connect to J34?

   Please note, J34 is not the RT1050 chip JTAG, it is your on board K20(debugger ) JTAG, 

You need to use J21 as the RT JTAG:

This is the key point, please also check your JLINK commander, you can find you find the ARM cortex M4 core, it is the K20, RT is ARM cortex M7 core.

Any updated information from your side, please let me know.

kerry

[vanessa_dis]

Thanks for your help Kerry.

That explain a lot.

Yes, you're right, I tried with J21 and now it detects the target. Although, it appears like this. With this error: 

TotalIRLen = ?, IRPrint = 0x..000000000000000000000000

If I try doing key validation, and put JTAG_MOD=1, it's the same

Thanks a lot Kerry,

Vanessa

[kerryzhou]

Hi @vanessa_dis 

Do you totally follow the chapter 4 Debugging with the Secure JTAG enabled steps on your side?

In my memory, I test it with the validation board, it works OK.

Do you already manually control the JTAG_MOD like the AN12419 mentioned?

The following are my test result, seems your Lock side still have issues, just share my pictures at first from my previous testing(about two years ago):

Please check your situation with my previous testing result.

Best Regards,

kerry

[vanessa_dis]

Yes Kerry, I followed  the chapter 4 Debugging with the Secure JTAG. 
And yes, I control JTAG_MOD manually with TP11.

Well. like I see, is the same modification of fuses as mine.

Even I have a custom board, I only burn fuse DAP_SJC_SWD_SEL from ‘0’ to ‘1’ to choose JTAG (I haven't select Secure JTAG yet) . And it has the same problem. Appears the same when I tried connect via JTAG.

Thanks,

Vanessa

[kerryzhou]

Hi @vanessa_dis,

   Thanks for your updated information, from your fuse, even similar to my test result previously which I have tested with the internal validation board.

   Now, let's talk step by step with your customer board, which just  burn fuse DAP_SJC_SWD_SEL from ‘0’ to ‘1’ to choose JTAG , to that board, before you didn't burn fuse, do you can use the JLINK SWD to find the ARM core or not?

   If yes, now, just burn SWD fuse, can't connect with JTAG, right? What about JTAG_MOD? It should be pulled low. Please also note the related JTAG other pins, 

Then give me the jlink command test result.

Best Regards,

kerry

[vanessa_dis]

Thanks for your answer Kerry,

Yes, exactly, I used to debug with SWD. 

And Yes, I removed the resistor to JTAG_MOD ( I shouldn't have done that), but in SWD when I manually put JTAG_MOD to GND, it worked very well. Then I changed that to JTAG, and after the error I soldered again that resistor, I tried with that and also I have tried to put manually to GND (as SWD).

This is my log

About the others pins: TMS, TCK, TDO, TDI are directly connected to JLINK, and TRSTB is connected with a resistor to Vcc

Thanks and regards,

Vanessa

[kerryzhou]

Hi @vanessa_dis 

   Thanks a lot for your effort.

   So, to TCK, TMS, TDI, TDO, no external circuit, connect to JLINK JTAG directly. TRSTB pull to VDD directly, JTAG_MOD, pull low or GND in the customer board, still not OK, right?

  Please also readout the fuse map, and share it with me.

I will find time and try to borrow the validation board again, and test my previously secure JTAG chip again. In my previous testing, I even didn't meet issues when I totally follow the AN.

Best Regards,

kerry

[vanessa_dis]

Just to correct me for my previous repply, this was the output when I tried to read and print the values of JTAG_MOD (with an image)

also I would like to say that before doing this modification I had experimented some errors when I tried to erase my flash via J-LINK,

and reading I found that I had to unlock kinetis but it didn't work

Do you think this is like a kind of reason that connect with JTAG doesn't work? (even thought, this is rare because with SWD worked perfectly with this problem) Or do you thing that this is other independent problem?

I hope you know something about it, Thank you so much,

Vanessa

[kerryzhou]

Hi @vanessa_dis 

   What's the RT1050 chip you are using for your customer board?

   I just have MIMXRT1052CVL5B samples on my side, so I will use the validation board to test this chip with the secure JTAG. In the previous time, I tested the RT1060 Secure JTAG.

   Please help to answer my confirmed points, these days, I will help you do the testing on my side.

Best Regards,

kerry

[vanessa_dis]

Thank you so much.

I have a MIMXRT1051CVL5B. I just only burn the JTAG fuse. The secure JTAG no yet.

and thanks a lot for your other response about erase the flash, I searched about your answer and now I can erase the flash (I tried it with other board, with SWD interface).

I thought somehow it could influence in the JTAG, and I tried with my board with JTAG interface and not.

Kind regards,

Vanessa

[kerryzhou]

Hi @vanessa_dis 

   If you can, find a totally new chip board, and follow me do it step by step, that will be synchronous between you and I.

   Today, I do the totally new chip MIMXRT1052CVL5B+ ISSI IS26KSxxxs flash.

  Now, go!

Background, JTAG_MOD directly connect to GND, the same situation as you, it's OK!

1. Enter serial download mode, use the MCUBootUtility to test the normal situation at first.

   I do these things, download a led_blinky code, and check it works.

   scan the fuse map, it is:

Totally no modification for the fuse.

2. exit the MCUbootUtility, board switch to the internal boot mode, use the JLINK SWD+JLINK commander to connect

OK, SWD works normally.

Key point coming!

3. Enter serial download mode, connect the MCUBootutility, modify the fuse 0X460[19] DAP_SJC_SWD_SEL from 0 to 1, it will be DAP works in JTAG mode

This is my fuse situation:

You can find my fuse modified, right?

4. Exit the MCUbootutility tool, enter internal boot mode+reset

Then use the Segger JLINK plus+jlink command+jtag to connect

You can find, my JTAG works OK.

Please note, don't worry about your JTAG_MOD pin, just connect to GND, I am the same as you.

If you still have issues, you need to check your other JTAG pins. Make sure it is not connected to other external module except the JLINK.

Please catch up with me, then we can write the key, enter the secure jtag mode.

I just want you to follow me step by step, as I am totally consuming one new chip to help you!

Best Regards,

Kerrry

[kerryzhou]

I don't know why the community have the picture attach issues in the previous reply for the step 3, although attach successfully, but publish will be disappear, so I reply another post to add the picture:

3. Enter serial download mode, connect the MCUBootutility, modify the fuse 0X460[19] DAP_SJC_SWD_SEL from 0 to 1, it will be DAP works in JTAG mode

This is my fuse situation:

You can find my fuse modified, right?

[vanessa_dis]

Yes, That's what I did, this is my fuse map if I read it:

Regards,

Vanessa

[kerryzhou]

Hi @vanessa_dis 

  Thanks for your updated information.    

  I mean, whether you can find a new customer board to test it and follow me, your fuse already adds a lot of other things, eg. BEE key. Please check your 0X450, 0x460, not the same as mine.

  So, I just we can let the JTAG works at first without the other fuse configuration, after the JTAG works, we can add other configuration.

  Until now, I just modify the JTAG fuse bit, it works OK. So, I don't know, whether your JTAG board hardware has issues or it is influenced by other fuse bit. So, can you find a new customer board with new chip to test it? It will be more easy to find the root issues.

Best Regards,

kerry

[vanessa_dis]

In this moment I don't have other custom board without those fuses. I have other board but it has the same fuses.

So, do you think is a good idea burn the BEE fuses in the evaluation board? In order to see if this fuses influence the JTAG.

Thanks,

Vanessa

[kerryzhou]

Hi @vanessa_dis 

1. Your customer board ongong fuse situation

   Before you modify the SWD to JTAG, can you use the SWD to debug the board?

2. Why you modify so many fuse bit, what's the detail function on your customer board?

 Seems you add BEE, boot from fuse, etc.

 Please let me know more about the background.

And to your MIMXRT1050-EVKB board, why you also modify the other fuse bit, eg, 0X600, 0X610, 0X460 except the SWD->JTGA, what's your testing aim?

Best Regards,

Kerry

[vanessa_dis]

Hi Kerry,

1.- Yes, before change SWD to JTAG, with SWD worked perfectly 

2.- I didn´t modify that, this is how my company give me the board. I don't know exactly why those fuses are blown. 

3.- Well I modify 0x600 and 0x610 because of the key for secure JTAG, and no, I also modified the fuse from SWD to JTAG, see:

I don't remember if I told you, but now secure JTAG with evaluation board works, I tried again without any modification and it worked. For that reason I ask you if a burn the BEE fuses in the evaluation board, in order to see if this is the reason that in my custom board don´t work.

Thanks a lot,

Vanessa

[kerryzhou]

Hi @vanessa_dis 

   That's good to hear you EVKB board works with the secure JTAG, that's strange why you can't work previously? As I find your hardware modification is correct. Maybe the JTAG connection is not very good, why you don't use the 20pin JTAG cable directly, just use the wire sto connect it.

   To your customer board, I don't know why you add all the secure bit directly, normally, I will test the JTAG connection at first, why I say this, because I am afraid your hardware JTAG related pins has issues. 

Please help to confirm, whether you connect other JTAG pins to the external module except the pull up or pull down. Tomorrow, I will secure my JTAG, let it works at first.

In fact, I don't want to totally modify the fuse like you, as you boot from fuse, if I do it like that, my chip even can't do other things, if I just add the secure JTAG, at least, I still can debug it, and change the external memory.

Wish it helps you!

Best Regards.

kerry

[vanessa_dis]

Hi Kerry,

Today I burned the BEE/BT fuses in evaluation board but JTAG keeps working, so, I guess is not the fuses.

Also I measure with an oscilloscope and all signals TDI/TDO/TMS/TCK in my custom board and it doesn´t have any signal. I think just the TCK pass from LOW to HIGH when I try connect with J-LINK and it's all.  

And about your reply:

-how do you test only the JTAG connection without the fuse?

-what do you mean with "whether you connect other JTAG pins to the external module"? Which module? I mean, TMS, TCK, TDI, TDO are connected directly to the IMX, and it's all the relation.

Thank you for your help,

Vanessa