Secure JTAG in imxrt1050-EVKB

取消
显示结果 
显示  仅  | 搜索替代 
您的意思是: 
已解决

Secure JTAG in imxrt1050-EVKB

跳至解决方案
6,119 次查看
vanessa_dis
Contributor III

Hello

I'm using an IMXRT1050-EVKB REV A1, and the micro said MIMXRT1052.

I did the fuse configurations described here https://www.nxp.com/docs/en/application-note/AN12419.pdf.

and I've read that J32 and J33 should be removed, so I removed those jumpers.

vanessa_dis_0-1623358894186.png

And when I tried to debug in MCUExpresso (without run script in j-link) it let me debug like this image.

(i'm using JTAG connector on J34)

I don't know if it would be like this, i mean, if this is correct.

vanessa_dis_1-1623359074647.png

And if I try to run the script, it didn't identify UUID0 and UUIDD1, it doesn't matter if I put JTAG_MOD in 0 or 1, it never find UUID's  

vanessa_dis_2-1623359169795.png

I'm not sure what steps I have to follow then, because I just blown the fuses in the manual.

 

I hope you can help me,

Thanks

 

标签 (1)
标记 (3)
0 项奖励
1 解答
5,873 次查看
kerryzhou
NXP TechSupport
NXP TechSupport

Hi @vanessa_dis 

   1. to your MIMXRT1050-EVKB revA1,  j29 is the SDA_RST_TGTMCU_B pin,you can don't disconnect it, but it should not related to the power. 

kerryzhou_0-1623825792385.png

Please check your board, do you J29 is the SD_RST pin? I just want to confirm your board version.

 

2. R303 is connect the 10K GND to the JTAG_MOD, you can't disconnect it, as this pin has the internal 100K pull up. 

 

You testing flow is really not very correct, you should let the JTAG mode works at first, then test the secure JTAG by modifying the secure fuse.

 

3. Please give me a photo of your board, I need to check your board version, you mentioned MIMXRT1050-EVKB REVA1. 

J1 5-6 connect, it will use the J28 to power on the board.

But, from your picture:

kerryzhou_1-1623828112954.png

Your VTref is 0V, it is not correct, you still need to check your board power:

kerryzhou_2-1623828187666.png

Seems your JTAG_VREF, DCD_3V3 no power.

Do you connect J1 2-3?

This is my board which is the JTAG without the secure result:

kerryzhou_3-1623828387239.png

For the secure JTAG, you can refer to the AN12419, Fig 5,6,7, you can find the VTref is also 3.3V, but you are 0.

 

Best Regards,

kerry

 

 

 

 

 

 

在原帖中查看解决方案

0 项奖励
39 回复数
2,138 次查看
kerryzhou
NXP TechSupport
NXP TechSupport

Hi @vanessa_dis 

   After more testing, I can make sure your fuse map won't influence the JTAG connection, it should still in your hardware side.

   As I told you, one of my new RT1050CVL5B burn the wrong fuse, as I burn the data should from 0X610, 0x600 wrong to the 0x620, 0x610.

kerryzhou_0-1625718319684.png

So, in fact, to this wrong chip, my key0=0x00000000, key1=0x87654321.

So, I modify the jlinkscript, this chip still can do the secure JTAG connection.

So, based on your previous fuse map, I modify the related bit like you:

kerryzhou_1-1625718408529.png

Just refer to your customer fuse map.

Then my .jlinkscript modify the key:

// Secure response stored @ 0x600, 0x610 in eFUSE region (OTP memory)
// Key0 = 0x87654321;
// Key1 = 0xedcba9;
Key0 = 0x00000000;
Key1 = 0x87654321;

Then, I do the JLINK connection, the secure JLINK still works.

kerryzhou_2-1625718471757.png

kerryzhou_3-1625718481483.png

 

kerryzhou_4-1625718489331.png

So, don't care about the fuse map, your fuse map, totally can do the connection.

You need to check the hardware, both the chip JTAG pin solder and the connection between your JLINK and customer RT board.

Best Regards,

Kerry

 

 

 

 

 

0 项奖励
2,129 次查看
vanessa_dis
Contributor III

Hi Kerry,

Well, I tried with other custom board because I believed that the problem was the first hardware, and it has the same problem with the TotalIRLen=?? when I changed the fuse from SWD to JTAG.

vanessa_dis_0-1625785595574.png

 

Let's review the circuit, I have the following conections:

J-LINK
TMS--to TMS chip
TCK-- to TCK chip
TDO--to TDO chip
TDI--to TDI chip
Reset-to chip
TRST-to GND
JTAG_MOD--NC


CHIP
JTAG_MOD-- to resistor to chip
TRSTB-- to HIGH

Are this connections right?
TRSTB should be connected to HIGH? I mean, I see that it's negated inside the chip.

vanessa_dis_1-1625785816049.png

About the 20-pin, I'm using an ARM adapter, I'm not connecting wire by wire. And I check continuity  between the board and J-LINK. (my custom board doesn't have 20-pin for JTAG).

about your reply "do you try to test the JLINK side, whether that has signals, just change the test point"
How can I change the test point? What do you mean?
The only thing that I know is when I monitored the signals of EVKB, it's right and if I disconnected any pin of TDO/TCK/TMS it give me the same problem and it was any wave.

Thanks for all your test,
Vanessa

 

 

0 项奖励
2,126 次查看
kerryzhou
NXP TechSupport
NXP TechSupport

Hi @vanessa_dis 

  Please test your TRSTB pin after you connect the JTAG, still didn't input the command, it is high or low?

My side, it is high.

TDI=3.3v

TMS=3.3V

TCLK=3.3V

TDO=0V

RESTB=3.3V

NSRST=3.3V

JTAG_MOD=0v, very important.

TRSTB should be connect to high, as when it is low, it will be controlled by the JLINK to do reset.

My side, it is high.

After you modify the JTAG fuse, do you read out it, whether it is burned or not? Please scan this customer fuse map, and send it to me, as you already share a lot of fuse map, I don't know which one is your tested board fuse map now.

If you use ARM adapter, it's OK, as I find in the previous pictures you share for the EVK, you use the pin connection method.

You EVKB also works now, just your customer board can't work, so still seems the JTAG hardware side has issues, I don't know whether your chip solder is OK or not, please test the pin wave at first in default, whether you are the same as me.

When you use the JLINK do the connection, whether you can see the wave like me or not?

Just let you know, in fact, even I remove my chip, just test the JTAG_TCK, when I use the JLINK command do the JTAG connection, I also can see the clock wave. My validation board chip can insert to the socket.

So, I think you also can test your related JTAG wave, whether it a wave or not?

This is my test picture:

kerryzhou_0-1625799740843.png

 

Wish it helps you!

Best Regards,

Kerry

 

 

 

 

 

0 项奖励
2,108 次查看
vanessa_dis
Contributor III

Thank you so much Kerry, it really helped me a lot.

I didn't notice about the TRSTB because in the evaluation board JTAG worked without this pin connected to J-LINK.

Now I realize that TRSTB had 0 V, not HIGH. I connected to HIGH and now it works. Thank you a lot for all your recommendations, I really appreciate this.

I just have a final question, so, can I tried Secure JTAG with the resistor of 4.7k in JTAG_MOD? I mean, when I put HIGH to JTAG_MOD there is not any problem that the resistor is connected to GND? Just to be sure.

Thanks for all. 

Vanessa 

0 项奖励
2,098 次查看
kerryzhou
NXP TechSupport
NXP TechSupport

Hi @vanessa_dis 

   So happy to hear you make it works, TRSTB has the 47k internal pull up, in default, it should be high:

kerryzhou_0-1626141812246.png

So, to your customer board, maybe the external layout make this pin to low, or the internal pull up is too weak to pull it high. that's why it also has the 10K external pull up can be used.

 About your question:can I tried Secure JTAG with the resistor of 4.7k in JTAG_MOD? I mean, when I put HIGH to JTAG_MOD there is not any problem that the resistor is connected to GND? Just to be sure.

Answer: yes, you can use 4.7K pull down, or tie to GND manually. But if you also want to put high to JTAG_MODE, you need to add 4.7K pull down. It's Ok, just don't set to high when the pin already connect to GND. 4.7k pull down is OK when you put high.

You also can test the pin voltage when you have 4.7k pull down and connect to high, just make sure the input voltage is high is enough.

 

Wish it helps you!

If you still have questions about it, please kindly let me know.

Any new questions in the future, welcome let me know.

Best Regards,

kerry

Best Regards.

 

 

0 项奖励
2,140 次查看
kerryzhou
NXP TechSupport
NXP TechSupport

Hi @vanessa_dis 

Give you my side Secure test result.

1. original chip situation and SWD connection

kerryzhou_0-1625716436679.png

kerryzhou_1-1625716459149.png

 

2. JTAG fuse and connection

kerryzhou_2-1625716480456.png

kerryzhou_3-1625716491488.png

 

3. Secure JTAG fuse modification

kerryzhou_4-1625716514358.png

kerryzhou_5-1625716524328.png

 

4. Secure JTAG connection test result

kerryzhou_6-1625716547515.png

kerryzhou_7-1625716568932.png

 

kerryzhou_8-1625716576106.png

kerryzhou_9-1625716583759.png

You can find my chip connection is OK.

This is totally a new RT1052DVL6B connection, ignore my previous RT1052CVL5B, as I burn the wrong fuse map, so I use a totally wrong chip.

 

 

 

 

 

 

 

 

 

 

 

0 项奖励
2,145 次查看
kerryzhou
NXP TechSupport
NXP TechSupport

Hi @vanessa_dis 

   Thanks for your updated information, now, whether your EVKB board fuse map is the same as your customer board?

   Do you test the EVKB board about the TCK,TMS,TDI, TRSTB on your side, whether that has signal or not? In fact, to the RT about these pins, it will receive the JLINK side signal, If you can't find the signal, whether your connection between the JLINK and the customer RT board has issues or not?

 

-how do you test only the JTAG connection without the fuse?

Answer: Just one fuse bit is modified with JTAG connection. I already give you my picture in the previous email.

2_DAP_SJC_SWD_SEL_JTAG.jpg

This is totally from a new RT1050 chip.

-what do you mean with "whether you connect other JTAG pins to the external module"? Which module? I mean, TMS, TCK, TDI, TDO are connected directly to the IMX, and it's all the relation.

Answer:  So, JTAG related pins on your customer board just connect to the debugger JLINK, no other on board external circuit, right?

Now, you even can't see the signal, seems the JLINK side didn't send out the data, do you try to test the JLINK side, whether that has signals, just change the test point. Now, two of your customer all have this issues?

 

I am adding the secure JTAG on my side, will send you my test result.

If we are totally the same fuse modification, you may need to consider the hardware issues.

Best Regards,

kerry

0 项奖励
2,291 次查看
kerryzhou
NXP TechSupport
NXP TechSupport

Hi @vanessa_dis 

   Do you want to do the mass erase for the external memory?

   If yes, you need to find the ARM core at first, it is not like the kinetis situation.

   I have a question for you, when you do the testing, you are using your customer board with RT1050?

 Please also let me know your customer board external memory, it is the hyperflash like the MIMXRT1050-EVKB board or QSPI flash, this is important to the JLINK external memory operation, as the JLINK is using the hyperflash in default, if you are using the external QSPI flash, you need to modify the JLINK script.  Please give me the confirmation ASAP.

  Best Regards,

Kerry

0 项奖励
2,303 次查看
vanessa_dis
Contributor III

Thank you Kerry for the help, 

Look, this is my map fuse.

vanessa_dis_0-1625008250748.png

I can't remember if I told you, but the only difference between my steps and what I did is that I incorrectly removed the resistor connected to JTAG_MOD, but I'm put GND manually to this pin.

Is there any way to know if this pin is ok with GND?. I tried to read JTAG_MOD and printing that but it showed me other error, something about TDI was always in HIGH, so I guess it was not a way.

 

Thanks for the help,

Vanessa

 

 

0 项奖励
2,279 次查看
kerryzhou
NXP TechSupport
NXP TechSupport

Hi @vanessa_dis 

  Manually control the JTAG_MOD to GND is no problem, in about two years ago, I also do it like that.

That's why I didn't mention it.

  So, now, I will find a new RT1050 chip and do the testing again for you. And tell you step by step.

Please keep patient!

Best Regards,

Kerry

 

0 项奖励
2,522 次查看
kerryzhou
NXP TechSupport
NXP TechSupport

Hi @vanessa_dis 

Seems you also read this post:

https://community.nxp.com/t5/i-MX-RT/Secure-JTAG-mode/m-p/974136?commentID=1225729&et=watches.email....

Do you also follow these hardware modification:

1) Burn fuse DAP_SJC_SWD_SEL from ‘0’ to ‘1’ to choose JTAG;

2) DNP R323,R309,R152 to isolate JTAG multiplexed signals.

3) Keep off J47~J50 to isolate board level debugger.-> your board should be j29-j32

Seems you already burn the fuse, in fact, normally, I will suggest the customer let the JTAG mode works at first, then check the secure JTAG again. Anyway, please modiy my point 2 and check it again, that will related to the JTAG mode.

Any updated information from your side, please kindly let me know.

Kerry

 

0 项奖励
2,504 次查看
vanessa_dis
Contributor III

Hi Kerry

Are you sure about theses resistors? I looked at schematic and I saw it was about ethernet not JTAG

vanessa_dis_0-1623420778987.png

I saw it here 

vanessa_dis_1-1623420832471.png

 

Other thing.. is a must remove J29? because I only have an USB cable (Micro B) to power it, and if this jumper is removed the board doesn't turn on. Or how can I turn on the board without J29?

 

 

 

 

0 项奖励
2,475 次查看
kerryzhou
NXP TechSupport
NXP TechSupport

Hi @vanessa_dis 

 Yes, I am sure, as I have tested the JTAG on my side, that's why I tell you.

  If you check the ENET_INT, ENET_RST, you will find it is also the JTAG pins, that's why we need to modify the resistor, and before I reply you, I also check your board version, 2) DNP R323,R309,R152 to isolate JTAG multiplexed signals. it is correct, just do it.

  Please also note, DAP_SJC_SWD_SEL  need to modify from 0 to 1.

kerryzhou_0-1623740358527.jpeg

From your picture, you already do it.

So, now, you need to modify the resistor.

Any updated information from your side, kindly let me know.

Best Regards,

kerry

 

0 项奖励
2,432 次查看
vanessa_dis
Contributor III

Thanks Kerry,

I burned the following fuses like the instructions.

vanessa_dis_0-1623774261805.png

Now I just removed the resistors that you mention but it looks the same, like the beginning of post

But note that I keep the J29 connected, because without it, it doesn't have power.

Other thing that it's important to say is that I removed the R303, but i don't think that this is the problem because I manually alternate JTAG_MOD

Kind regards,

Vanessa

 

0 项奖励
5,874 次查看
kerryzhou
NXP TechSupport
NXP TechSupport

Hi @vanessa_dis 

   1. to your MIMXRT1050-EVKB revA1,  j29 is the SDA_RST_TGTMCU_B pin,you can don't disconnect it, but it should not related to the power. 

kerryzhou_0-1623825792385.png

Please check your board, do you J29 is the SD_RST pin? I just want to confirm your board version.

 

2. R303 is connect the 10K GND to the JTAG_MOD, you can't disconnect it, as this pin has the internal 100K pull up. 

 

You testing flow is really not very correct, you should let the JTAG mode works at first, then test the secure JTAG by modifying the secure fuse.

 

3. Please give me a photo of your board, I need to check your board version, you mentioned MIMXRT1050-EVKB REVA1. 

J1 5-6 connect, it will use the J28 to power on the board.

But, from your picture:

kerryzhou_1-1623828112954.png

Your VTref is 0V, it is not correct, you still need to check your board power:

kerryzhou_2-1623828187666.png

Seems your JTAG_VREF, DCD_3V3 no power.

Do you connect J1 2-3?

This is my board which is the JTAG without the secure result:

kerryzhou_3-1623828387239.png

For the secure JTAG, you can refer to the AN12419, Fig 5,6,7, you can find the VTref is also 3.3V, but you are 0.

 

Best Regards,

kerry

 

 

 

 

 

 

0 项奖励
2,378 次查看
vanessa_dis
Contributor III

   

0 项奖励
2,382 次查看
vanessa_dis
Contributor III

With the first configuration...

checking JTAG, it seems correctly 

vanessa_dis_0-1623879521986.png

key validation for secure JTAG:

vanessa_dis_1-1623879731222.png

 

 

 

 

0 项奖励
2,370 次查看
vanessa_dis
Contributor III

Thanks for your answer Kerry,

With this configuration, it looks like the beginning, V==3.3 V and UUID is no identified. That's how I tested in the beginning of my problem.

vanessa_dis_1-1623878537938.png

 

With this configuration It looks like the previous photo in J-link, that V=0, it make a sense because SDA doesn't have Voltage for JTAG.

vanessa_dis_0-1623878280721.png

I'm using J34 because I don't have the adapter for J21.

Am I doing wrong? I think is the first configuration, because with this detect my target, but it doesn't recognize UUID.

 

Thanks and regards,

Vanessa

 

0 项奖励
2,387 次查看
vanessa_dis
Contributor III

****Actualization:  Well, after change the power supply to USB_OTG with J1, now I can't debug (and it's correct because of Secure JTAG). But now in J-link it doesn't connect with target.

 

vanessa_dis_0-1623776691153.png

 

0 项奖励