Secure JTAG in imxrt1050-EVKB

[vanessa_dis]

Hello

I'm using an IMXRT1050-EVKB REV A1, and the micro said MIMXRT1052.

I did the fuse configurations described here https://www.nxp.com/docs/en/application-note/AN12419.pdf.

and I've read that J32 and J33 should be removed, so I removed those jumpers.

And when I tried to debug in MCUExpresso (without run script in j-link) it let me debug like this image.

(i'm using JTAG connector on J34)

I don't know if it would be like this, i mean, if this is correct.

And if I try to run the script, it didn't identify UUID0 and UUIDD1, it doesn't matter if I put JTAG_MOD in 0 or 1, it never find UUID's  

I'm not sure what steps I have to follow then, because I just blown the fuses in the manual.

I hope you can help me,

Thanks

[kerryzhou]

Hi @vanessa_dis 

   After more testing, I can make sure your fuse map won't influence the JTAG connection, it should still in your hardware side.

   As I told you, one of my new RT1050CVL5B burn the wrong fuse, as I burn the data should from 0X610, 0x600 wrong to the 0x620, 0x610.

So, in fact, to this wrong chip, my key0=0x00000000, key1=0x87654321.

So, I modify the jlinkscript, this chip still can do the secure JTAG connection.

So, based on your previous fuse map, I modify the related bit like you:

Just refer to your customer fuse map.

Then my .jlinkscript modify the key:

// Secure response stored @ 0x600, 0x610 in eFUSE region (OTP memory)
// Key0 = 0x87654321;
// Key1 = 0xedcba9;
Key0 = 0x00000000;
Key1 = 0x87654321;

Then, I do the JLINK connection, the secure JLINK still works.

So, don't care about the fuse map, your fuse map, totally can do the connection.

You need to check the hardware, both the chip JTAG pin solder and the connection between your JLINK and customer RT board.

Best Regards,

Kerry

[vanessa_dis]

Hi Kerry,

Well, I tried with other custom board because I believed that the problem was the first hardware, and it has the same problem with the TotalIRLen=?? when I changed the fuse from SWD to JTAG.

Let's review the circuit, I have the following conections:

J-LINK
TMS--to TMS chip
TCK-- to TCK chip
TDO--to TDO chip
TDI--to TDI chip
Reset-to chip
TRST-to GND
JTAG_MOD--NC

CHIP
JTAG_MOD-- to resistor to chip
TRSTB-- to HIGH

Are this connections right?
TRSTB should be connected to HIGH? I mean, I see that it's negated inside the chip.

About the 20-pin, I'm using an ARM adapter, I'm not connecting wire by wire. And I check continuity  between the board and J-LINK. (my custom board doesn't have 20-pin for JTAG).

about your reply "do you try to test the JLINK side, whether that has signals, just change the test point"
How can I change the test point? What do you mean?
The only thing that I know is when I monitored the signals of EVKB, it's right and if I disconnected any pin of TDO/TCK/TMS it give me the same problem and it was any wave.

Thanks for all your test,
Vanessa

[kerryzhou]

Hi @vanessa_dis 

  Please test your TRSTB pin after you connect the JTAG, still didn't input the command, it is high or low?

My side, it is high.

TDI=3.3v

TMS=3.3V

TCLK=3.3V

TDO=0V

RESTB=3.3V

NSRST=3.3V

JTAG_MOD=0v, very important.

TRSTB should be connect to high, as when it is low, it will be controlled by the JLINK to do reset.

My side, it is high.

After you modify the JTAG fuse, do you read out it, whether it is burned or not? Please scan this customer fuse map, and send it to me, as you already share a lot of fuse map, I don't know which one is your tested board fuse map now.

If you use ARM adapter, it's OK, as I find in the previous pictures you share for the EVK, you use the pin connection method.

You EVKB also works now, just your customer board can't work, so still seems the JTAG hardware side has issues, I don't know whether your chip solder is OK or not, please test the pin wave at first in default, whether you are the same as me.

When you use the JLINK do the connection, whether you can see the wave like me or not?

Just let you know, in fact, even I remove my chip, just test the JTAG_TCK, when I use the JLINK command do the JTAG connection, I also can see the clock wave. My validation board chip can insert to the socket.

So, I think you also can test your related JTAG wave, whether it a wave or not?

This is my test picture:

Wish it helps you!

Best Regards,

Kerry

[vanessa_dis]

Thank you so much Kerry, it really helped me a lot.

I didn't notice about the TRSTB because in the evaluation board JTAG worked without this pin connected to J-LINK.

Now I realize that TRSTB had 0 V, not HIGH. I connected to HIGH and now it works. Thank you a lot for all your recommendations, I really appreciate this.

I just have a final question, so, can I tried Secure JTAG with the resistor of 4.7k in JTAG_MOD? I mean, when I put HIGH to JTAG_MOD there is not any problem that the resistor is connected to GND? Just to be sure.

Thanks for all. 

Vanessa 

[kerryzhou]

Hi @vanessa_dis 

   So happy to hear you make it works, TRSTB has the 47k internal pull up, in default, it should be high:

So, to your customer board, maybe the external layout make this pin to low, or the internal pull up is too weak to pull it high. that's why it also has the 10K external pull up can be used.

 About your question:can I tried Secure JTAG with the resistor of 4.7k in JTAG_MOD? I mean, when I put HIGH to JTAG_MOD there is not any problem that the resistor is connected to GND? Just to be sure.

Answer: yes, you can use 4.7K pull down, or tie to GND manually. But if you also want to put high to JTAG_MODE, you need to add 4.7K pull down. It's Ok, just don't set to high when the pin already connect to GND. 4.7k pull down is OK when you put high.

You also can test the pin voltage when you have 4.7k pull down and connect to high, just make sure the input voltage is high is enough.

Wish it helps you!

If you still have questions about it, please kindly let me know.

Any new questions in the future, welcome let me know.

Best Regards,

kerry

Best Regards.

[kerryzhou]

Hi @vanessa_dis 

Give you my side Secure test result.

1. original chip situation and SWD connection

2. JTAG fuse and connection

3. Secure JTAG fuse modification

4. Secure JTAG connection test result

You can find my chip connection is OK.

This is totally a new RT1052DVL6B connection, ignore my previous RT1052CVL5B, as I burn the wrong fuse map, so I use a totally wrong chip.

[kerryzhou]

Hi @vanessa_dis 

   Thanks for your updated information, now, whether your EVKB board fuse map is the same as your customer board?

   Do you test the EVKB board about the TCK,TMS,TDI, TRSTB on your side, whether that has signal or not? In fact, to the RT about these pins, it will receive the JLINK side signal, If you can't find the signal, whether your connection between the JLINK and the customer RT board has issues or not?

-how do you test only the JTAG connection without the fuse?

Answer: Just one fuse bit is modified with JTAG connection. I already give you my picture in the previous email.

This is totally from a new RT1050 chip.

-what do you mean with "whether you connect other JTAG pins to the external module"? Which module? I mean, TMS, TCK, TDI, TDO are connected directly to the IMX, and it's all the relation.

Answer:  So, JTAG related pins on your customer board just connect to the debugger JLINK, no other on board external circuit, right?

Now, you even can't see the signal, seems the JLINK side didn't send out the data, do you try to test the JLINK side, whether that has signals, just change the test point. Now, two of your customer all have this issues?

I am adding the secure JTAG on my side, will send you my test result.

If we are totally the same fuse modification, you may need to consider the hardware issues.

Best Regards,

kerry

[kerryzhou]

Hi @vanessa_dis 

   Do you want to do the mass erase for the external memory?

   If yes, you need to find the ARM core at first, it is not like the kinetis situation.

   I have a question for you, when you do the testing, you are using your customer board with RT1050?

 Please also let me know your customer board external memory, it is the hyperflash like the MIMXRT1050-EVKB board or QSPI flash, this is important to the JLINK external memory operation, as the JLINK is using the hyperflash in default, if you are using the external QSPI flash, you need to modify the JLINK script.  Please give me the confirmation ASAP.

  Best Regards,

Kerry

[vanessa_dis]

Thank you Kerry for the help, 

Look, this is my map fuse.

I can't remember if I told you, but the only difference between my steps and what I did is that I incorrectly removed the resistor connected to JTAG_MOD, but I'm put GND manually to this pin.

Is there any way to know if this pin is ok with GND?. I tried to read JTAG_MOD and printing that but it showed me other error, something about TDI was always in HIGH, so I guess it was not a way.

Thanks for the help,

Vanessa

[kerryzhou]

Hi @vanessa_dis 

  Manually control the JTAG_MOD to GND is no problem, in about two years ago, I also do it like that.

That's why I didn't mention it.

  So, now, I will find a new RT1050 chip and do the testing again for you. And tell you step by step.

Please keep patient!

Best Regards,

Kerry

[kerryzhou]

Hi @vanessa_dis 

Seems you also read this post:

https://community.nxp.com/t5/i-MX-RT/Secure-JTAG-mode/m-p/974136?commentID=1225729&et=watches.email....

Do you also follow these hardware modification:

1） Burn fuse DAP_SJC_SWD_SEL from ‘0’ to ‘1’ to choose JTAG;

2） DNP R323,R309,R152 to isolate JTAG multiplexed signals.

3） Keep off J47~J50 to isolate board level debugger.-> your board should be j29-j32

Seems you already burn the fuse, in fact, normally, I will suggest the customer let the JTAG mode works at first, then check the secure JTAG again. Anyway, please modiy my point 2 and check it again, that will related to the JTAG mode.

Any updated information from your side, please kindly let me know.

Kerry

[vanessa_dis]

Hi Kerry

Are you sure about theses resistors? I looked at schematic and I saw it was about ethernet not JTAG

I saw it here 

Other thing.. is a must remove J29? because I only have an USB cable (Micro B) to power it, and if this jumper is removed the board doesn't turn on. Or how can I turn on the board without J29?

[kerryzhou]

Hi @vanessa_dis 

 Yes, I am sure, as I have tested the JTAG on my side, that's why I tell you.

  If you check the ENET_INT, ENET_RST, you will find it is also the JTAG pins, that's why we need to modify the resistor, and before I reply you, I also check your board version, 2） DNP R323,R309,R152 to isolate JTAG multiplexed signals. it is correct, just do it.

  Please also note, DAP_SJC_SWD_SEL  need to modify from 0 to 1.

From your picture, you already do it.

So, now, you need to modify the resistor.

Any updated information from your side, kindly let me know.

Best Regards,

kerry

[vanessa_dis]

Thanks Kerry,

I burned the following fuses like the instructions.

Now I just removed the resistors that you mention but it looks the same, like the beginning of post

But note that I keep the J29 connected, because without it, it doesn't have power.

Other thing that it's important to say is that I removed the R303, but i don't think that this is the problem because I manually alternate JTAG_MOD

Kind regards,

Vanessa

[kerryzhou · Accepted solution]

Hi @vanessa_dis 

   1. to your MIMXRT1050-EVKB revA1,  j29 is the SDA_RST_TGTMCU_B pin，you can don't disconnect it, but it should not related to the power. 

Please check your board, do you J29 is the SD_RST pin? I just want to confirm your board version.

2. R303 is connect the 10K GND to the JTAG_MOD, you can't disconnect it, as this pin has the internal 100K pull up. 

You testing flow is really not very correct, you should let the JTAG mode works at first, then test the secure JTAG by modifying the secure fuse.

3. Please give me a photo of your board, I need to check your board version, you mentioned MIMXRT1050-EVKB REVA1. 

J1 5-6 connect, it will use the J28 to power on the board.

But, from your picture:

Your VTref is 0V, it is not correct, you still need to check your board power:

Seems your JTAG_VREF, DCD_3V3 no power.

Do you connect J1 2-3?

This is my board which is the JTAG without the secure result:

For the secure JTAG, you can refer to the AN12419, Fig 5,6,7, you can find the VTref is also 3.3V, but you are 0.

Best Regards,

kerry

[vanessa_dis]

With the first configuration...

checking JTAG, it seems correctly 

key validation for secure JTAG:

[vanessa_dis]

Thanks for your answer Kerry,

With this configuration, it looks like the beginning, V==3.3 V and UUID is no identified. That's how I tested in the beginning of my problem.

With this configuration It looks like the previous photo in J-link, that V=0, it make a sense because SDA doesn't have Voltage for JTAG.

I'm using J34 because I don't have the adapter for J21.

Am I doing wrong? I think is the first configuration, because with this detect my target, but it doesn't recognize UUID.

Thanks and regards,

Vanessa

[vanessa_dis]

****Actualization:  Well, after change the power supply to USB_OTG with J1, now I can't debug (and it's correct because of Secure JTAG). But now in J-link it doesn't connect with target.