Secure JTAG in imxrt1050-EVKB

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Secure JTAG in imxrt1050-EVKB

Jump to solution
6,132 Views
vanessa_dis
Contributor III

Hello

I'm using an IMXRT1050-EVKB REV A1, and the micro said MIMXRT1052.

I did the fuse configurations described here https://www.nxp.com/docs/en/application-note/AN12419.pdf.

and I've read that J32 and J33 should be removed, so I removed those jumpers.

vanessa_dis_0-1623358894186.png

And when I tried to debug in MCUExpresso (without run script in j-link) it let me debug like this image.

(i'm using JTAG connector on J34)

I don't know if it would be like this, i mean, if this is correct.

vanessa_dis_1-1623359074647.png

And if I try to run the script, it didn't identify UUID0 and UUIDD1, it doesn't matter if I put JTAG_MOD in 0 or 1, it never find UUID's  

vanessa_dis_2-1623359169795.png

I'm not sure what steps I have to follow then, because I just blown the fuses in the manual.

 

I hope you can help me,

Thanks

 

Labels (1)
0 Kudos
1 Solution
5,886 Views
kerryzhou
NXP TechSupport
NXP TechSupport

Hi @vanessa_dis 

   1. to your MIMXRT1050-EVKB revA1,  j29 is the SDA_RST_TGTMCU_B pin,you can don't disconnect it, but it should not related to the power. 

kerryzhou_0-1623825792385.png

Please check your board, do you J29 is the SD_RST pin? I just want to confirm your board version.

 

2. R303 is connect the 10K GND to the JTAG_MOD, you can't disconnect it, as this pin has the internal 100K pull up. 

 

You testing flow is really not very correct, you should let the JTAG mode works at first, then test the secure JTAG by modifying the secure fuse.

 

3. Please give me a photo of your board, I need to check your board version, you mentioned MIMXRT1050-EVKB REVA1. 

J1 5-6 connect, it will use the J28 to power on the board.

But, from your picture:

kerryzhou_1-1623828112954.png

Your VTref is 0V, it is not correct, you still need to check your board power:

kerryzhou_2-1623828187666.png

Seems your JTAG_VREF, DCD_3V3 no power.

Do you connect J1 2-3?

This is my board which is the JTAG without the secure result:

kerryzhou_3-1623828387239.png

For the secure JTAG, you can refer to the AN12419, Fig 5,6,7, you can find the VTref is also 3.3V, but you are 0.

 

Best Regards,

kerry

 

 

 

 

 

 

View solution in original post

0 Kudos
39 Replies
3,507 Views
kerryzhou
NXP TechSupport
NXP TechSupport

Hi @vanessa_dis 

  Check my oscilloscope wave:

osc_wave1 ch1 tck ch2 TID ch3 tdo ch4 TMS.pngosc_wave2.png

ch1: TCK
Ch2: TDI
ch3: TDO
ch4: TMS

 

You can seem, my board have the wave.

So, if your board even no wave, I think your JLINK even didn't really connect to your RT board with the JTAG interface, you need to check your connections.

It's better use the 20 pin JTAG cable directly instead of your wire by wire, if you can't make sure your connection is correct or not.

 

Wish it helps you!

If you still have questions about it, please kindly let me know.

Kerry

 

0 Kudos
3,844 Views
kerryzhou
NXP TechSupport
NXP TechSupport

Hi @vanessa_dis ,

   Please double check quickly, which JTAG interface you are using? 

   From your picture, seems you connect to J34?

   Please note, J34 is not the RT1050 chip JTAG, it is your on board K20(debugger ) JTAG, 

kerryzhou_0-1623908063485.png

You need to use J21 as the RT JTAG:

kerryzhou_1-1623908100813.png

This is the key point, please also check your JLINK commander, you can find you find the ARM cortex M4 core, it is the K20, RT is ARM cortex M7 core.

 

Any updated information from your side, please let me know.

kerry

 

 

0 Kudos
3,831 Views
vanessa_dis
Contributor III

Thanks for your help Kerry.

That explain a lot.

Yes, you're right, I tried with J21 and now it detects the target. Although, it appears like this. With this error: 

TotalIRLen = ?, IRPrint = 0x..000000000000000000000000

 

vanessa_dis_0-1623971051912.png

If I try doing key validation, and put JTAG_MOD=1, it's the same

vanessa_dis_1-1623971441155.png

 

Thanks a lot Kerry,

Vanessa

 

 

0 Kudos
3,822 Views
kerryzhou
NXP TechSupport
NXP TechSupport

Hi @vanessa_dis 

Do you totally follow the chapter 4 Debugging with the Secure JTAG enabled steps on your side?

In my memory, I test it with the validation board, it works OK.

Do you already manually control the JTAG_MOD like the AN12419 mentioned?

The following are my test result, seems your Lock side still have issues, just share my pictures at first from my previous testing(about two years ago):

kerryzhou_0-1623999844164.jpeg

kerryzhou_1-1623999856320.jpeg

kerryzhou_2-1623999864962.jpeg

kerryzhou_3-1623999870696.png

Please check your situation with my previous testing result.

 

Best Regards,

kerry

 

 

 

 

0 Kudos
3,814 Views
vanessa_dis
Contributor III

Yes Kerry, I followed  the chapter 4 Debugging with the Secure JTAG. 
And yes, I control JTAG_MOD manually with TP11.

Well. like I see, is the same modification of fuses as mine.

vanessa_dis_0-1624024293222.png

 

Even I have a custom board, I only burn fuse DAP_SJC_SWD_SEL from ‘0’ to ‘1’ to choose JTAG (I haven't select Secure JTAG yet) . And it has the same problem. Appears the same when I tried connect via JTAG.

Thanks,

Vanessa

0 Kudos
3,774 Views
kerryzhou
NXP TechSupport
NXP TechSupport

Hi @vanessa_dis,

   Thanks for your updated information, from your fuse, even similar to my test result previously which I have tested with the internal validation board.

   Now, let's talk step by step with your customer board, which just  burn fuse DAP_SJC_SWD_SEL from ‘0’ to ‘1’ to choose JTAG , to that board, before you didn't burn fuse, do you can use the JLINK SWD to find the ARM core or not?

   If yes, now, just burn SWD fuse, can't connect with JTAG, right? What about JTAG_MOD? It should be pulled low. Please also note the related JTAG other pins, 

kerryzhou_0-1624328642725.png

Then give me the jlink command test result.

Best Regards,

kerry

 

0 Kudos
3,769 Views
vanessa_dis
Contributor III

Thanks for your answer Kerry,

Yes, exactly, I used to debug with SWD. 

And Yes, I removed the resistor to JTAG_MOD ( I shouldn't have done that), but in SWD when I manually put JTAG_MOD to GND, it worked very well. Then I changed that to JTAG, and after the error I soldered again that resistor, I tried with that and also I have tried to put manually to GND (as SWD).

This is my log

vanessa_dis_0-1624335508673.png

 

About the others pins: TMS, TCK, TDO, TDI are directly connected to JLINK, and TRSTB is connected with a resistor to Vcc

Thanks and regards,

Vanessa

 

0 Kudos
3,723 Views
kerryzhou
NXP TechSupport
NXP TechSupport

Hi @vanessa_dis 

   Thanks a lot for your effort.

   So, to TCK, TMS, TDI, TDO, no external circuit, connect to JLINK JTAG directly. TRSTB pull to VDD directly, JTAG_MOD, pull low or GND in the customer board, still not OK, right?

  Please also readout the fuse map, and share it with me.

 

I will find time and try to borrow the validation board again, and test my previously secure JTAG chip again. In my previous testing, I even didn't meet issues when I totally follow the AN.

Best Regards,

kerry

0 Kudos
3,665 Views
vanessa_dis
Contributor III

Just to correct me for my previous repply, this was the output when I tried to read and print the values of JTAG_MOD (with an image)

vanessa_dis_1-1625094833927.png

also I would like to say that before doing this modification I had experimented some errors when I tried to erase my flash via J-LINK,

vanessa_dis_3-1625094933555.png

and reading I found that I had to unlock kinetis but it didn't work

vanessa_dis_4-1625094995104.png

Do you think this is like a kind of reason that connect with JTAG doesn't work? (even thought, this is rare because with SWD worked perfectly with this problem) Or do you thing that this is other independent problem?

I hope you know something about it, Thank you so much,

Vanessa

 

0 Kudos
3,668 Views
kerryzhou
NXP TechSupport
NXP TechSupport

Hi @vanessa_dis 

   What's the RT1050 chip you are using for your customer board?

   I just have MIMXRT1052CVL5B samples on my side, so I will use the validation board to test this chip with the secure JTAG. In the previous time, I tested the RT1060 Secure JTAG.

   Please help to answer my confirmed points, these days, I will help you do the testing on my side.

Best Regards,

kerry

0 Kudos
3,652 Views
vanessa_dis
Contributor III

Thank you so much.

I have a MIMXRT1051CVL5B. I just only burn the JTAG fuse. The secure JTAG no yet.

 

and thanks a lot for your other response about erase the flash, I searched about your answer and now I can erase the flash (I tried it with other board, with SWD interface).

I thought somehow it could influence in the JTAG, and I tried with my board with JTAG interface and not.

 

Kind regards,

Vanessa

0 Kudos
3,639 Views
kerryzhou
NXP TechSupport
NXP TechSupport

Hi @vanessa_dis 

   If you can, find a totally new chip board, and follow me do it step by step, that will be synchronous between you and I.

   Today, I do the totally new chip MIMXRT1052CVL5B+ ISSI IS26KSxxxs flash.

  Now, go!

Background, JTAG_MOD directly connect to GND, the same situation as you, it's OK!

1. Enter serial download mode, use the MCUBootUtility to test the normal situation at first.

   I do these things, download a led_blinky code, and check it works.

   scan the fuse map, it is:

kerryzhou_0-1625218946700.png

Totally no modification for the fuse.

 

2. exit the MCUbootUtility, board switch to the internal boot mode, use the JLINK SWD+JLINK commander to connect

kerryzhou_1-1625219014139.png

OK, SWD works normally.

Key point coming!

3. Enter serial download mode, connect the MCUBootutility, modify the fuse 0X460[19] DAP_SJC_SWD_SEL from 0 to 1, it will be DAP works in JTAG mode

This is my fuse situation:

 

You can find my fuse modified, right?

4. Exit the MCUbootutility tool, enter internal boot mode+reset

Then use the Segger JLINK plus+jlink command+jtag to connect

kerryzhou_4-1625219244055.png

You can find, my JTAG works OK.

Please note, don't worry about your JTAG_MOD pin, just connect to GND, I am the same as you.

If you still have issues, you need to check your other JTAG pins. Make sure it is not connected to other external module except the JLINK.

kerryzhou_5-1625219356303.png

Please catch up with me, then we can write the key, enter the secure jtag mode.

I just want you to follow me step by step, as I am totally consuming one new chip to help you!

Best Regards,

Kerrry

 

 

 

 

0 Kudos
3,632 Views
kerryzhou
NXP TechSupport
NXP TechSupport

I don't know why the community have the picture attach issues in the previous reply for the step 3, although attach successfully, but publish will be disappear, so I reply another post to add the picture:

3. Enter serial download mode, connect the MCUBootutility, modify the fuse 0X460[19] DAP_SJC_SWD_SEL from 0 to 1, it will be DAP works in JTAG mode

This is my fuse situation:

2.jpg

You can find my fuse modified, right?

0 Kudos
3,625 Views
vanessa_dis
Contributor III

Yes, That's what I did, this is my fuse map if I read it:

vanessa_dis_0-1625262302886.png

Regards,

Vanessa

 

0 Kudos
3,618 Views
kerryzhou
NXP TechSupport
NXP TechSupport

Hi @vanessa_dis 

  Thanks for your updated information.    

  I mean, whether you can find a new customer board to test it and follow me, your fuse already adds a lot of other things, eg. BEE key. Please check your 0X450, 0x460, not the same as mine.

  So, I just we can let the JTAG works at first without the other fuse configuration, after the JTAG works, we can add other configuration.

  Until now, I just modify the JTAG fuse bit, it works OK. So, I don't know, whether your JTAG board hardware has issues or it is influenced by other fuse bit. So, can you find a new customer board with new chip to test it? It will be more easy to find the root issues.

 

Best Regards,

kerry

 

 

0 Kudos
3,592 Views
vanessa_dis
Contributor III

In this moment I don't have other custom board without those fuses. I have other board but it has the same fuses.

So, do you think is a good idea burn the BEE fuses in the evaluation board? In order to see if this fuses influence the JTAG.

 

Thanks,

Vanessa

0 Kudos
3,586 Views
kerryzhou
NXP TechSupport
NXP TechSupport

Hi @vanessa_dis 

1. Your customer board ongong fuse situation

   Before you modify the SWD to JTAG, can you use the SWD to debug the board?

2. Why you modify so many fuse bit, what's the detail function on your customer board?

 Seems you add BEE, boot from fuse, etc.

 Please let me know more about the background.

And to your MIMXRT1050-EVKB board, why you also modify the other fuse bit, eg, 0X600, 0X610, 0X460 except the SWD->JTGA, what's your testing aim?

 

Best Regards,

Kerry

 

0 Kudos
3,580 Views
vanessa_dis
Contributor III

Hi Kerry,

1.- Yes, before change SWD to JTAG, with SWD worked perfectly 

2.- I didn´t modify that, this is how my company give me the board. I don't know exactly why those fuses are blown. 

3.- Well I modify 0x600 and 0x610 because of the key for secure JTAG, and no, I also modified the fuse from SWD to JTAG, see:

vanessa_dis_0-1625579249475.png

I don't remember if I told you, but now secure JTAG with evaluation board works, I tried again without any modification and it worked. For that reason I ask you if a burn the BEE fuses in the evaluation board, in order to see if this is the reason that in my custom board don´t work.

Thanks a lot,

Vanessa

 

0 Kudos
3,526 Views
kerryzhou
NXP TechSupport
NXP TechSupport

Hi @vanessa_dis 

   That's good to hear you EVKB board works with the secure JTAG, that's strange why you can't work previously? As I find your hardware modification is correct. Maybe the JTAG connection is not very good, why you don't use the 20pin JTAG cable directly, just use the wire sto connect it.

   To your customer board, I don't know why you add all the secure bit directly, normally, I will test the JTAG connection at first, why I say this, because I am afraid your hardware JTAG related pins has issues. 

Please help to confirm, whether you connect other JTAG pins to the external module except the pull up or pull down. Tomorrow, I will secure my JTAG, let it works at first.

In fact, I don't want to totally modify the fuse like you, as you boot from fuse, if I do it like that, my chip even can't do other things, if I just add the secure JTAG, at least, I still can debug it, and change the external memory.

Wish it helps you!

Best Regards.

kerry

0 Kudos
3,518 Views
vanessa_dis
Contributor III

Hi Kerry,

Today I burned the BEE/BT fuses in evaluation board but JTAG keeps working, so, I guess is not the fuses.

Also I measure with an oscilloscope and all signals TDI/TDO/TMS/TCK in my custom board and it doesn´t have any signal. I think just the TCK pass from LOW to HIGH when I try connect with J-LINK and it's all.  

And about your reply:

-how do you test only the JTAG connection without the fuse?

-what do you mean with "whether you connect other JTAG pins to the external module"? Which module? I mean, TMS, TCK, TDI, TDO are connected directly to the IMX, and it's all the relation.

 

Thank you for your help,

Vanessa

 

0 Kudos