Secure JTAG for i.MXRT1160 EVK

[vishnusudhankj]

I am trying to secure the i.MXRT1160 EVK using JTAG with password,

Followed the steps provided in the AN13133.pdf under section 3 and also made hardware modifications as mentioned under section 1 & try to connect with the board using script(file: AN13133SW) & facing issue as below,

In HAB closed board,

Programmed the below eFuses for secure JTAG with password,

• Programmed JTAG_SMODE[7:6] fuse register as 01
• Programmed a 128-bit (16 Bytes) secret response key in the eFuse JTAG_RESP, location (0xcb0-0xce0).
• Programmed the JTAG_RESP_RLOCK for read lock
• Programmed the JTAG_HEO 

Now, try to connect the board using command,

./jlink -JLinkScriptFile NXP_RT1160_SecureJTAG.JlinkScript -device CORTEX-M7 -if JTAG -speed 30 -autoconnect 1 -JTAGConf -1,-1

Getting log as below,

SEGGER J-Link Commander V7.58e (Compiled Dec 7 2021 17:29:25)

DLL version V7.70c, compiled Aug 18 2022 17:29:50

Connecting to J-Link via USB...O.K.

Firmware: J-Link V11 compiled Aug 30 2022 11:47:49

Hardware version: V11.00

S/N: 601010942

License(s): RDI, FlashBP, FlashDL, JFlash, GDB

VTref=3.315V

Device "CORTEX-M7" selected.

Connecting to target via JTAG

InitTarget() start

TotalIRLen = 4, IRPrint = 0x01

JTAG chain detection found 1 devices:

#0 Id: 0x088C601D, IRLen: 04, JTAG-DP

Challenge UUID0:0x82968AA6

Challenge UUID1:0x1505080E

InitTarget() end

TotalIRLen = 4, IRPrint = 0x01

JTAG chain detection found 1 devices:

#0 Id: 0x088C601D, IRLen: 04, JTAG-DP

DPv0 detected

Scanning AP map to find all available APs

AP[3]: Stopped AP scan as end of AP map has been reached

AP[0]: AHB-AP (IDR: 0x84770001)

AP[1]: AHB-AP (IDR: 0x24770011)

AP[2]: APB-AP (IDR: 0x54770002)

Iterating through AP map to find AHB-AP to use

AP[0]: Skipped. Invalid implementer code read from CPUIDVal[31:24] = 0x00

AP[1]: Skipped. Invalid implementer code read from CPUIDVal[31:24] = 0x00

AP[2]: Skipped. Not an AHB-AP

Attach to CPU failed. Executing connect under reset.

Failed to power up DAP

Connect failed. Resetting via Reset pin and trying again.

InitTarget() start

Challenge UUID0:0x82968AA6

Challenge UUID1:0x1505080E

InitTarget() end

TotalIRLen = 4, IRPrint = 0x01

JTAG chain detection found 1 devices:

#0 Id: 0x088C601D, IRLen: 04, JTAG-DP

DPv0 detected

Scanning AP map to find all available APs

AP[3]: Stopped AP scan as end of AP map has been reached

AP[0]: AHB-AP (IDR: 0x84770001)

AP[1]: AHB-AP (IDR: 0x24770011)

AP[2]: APB-AP (IDR: 0x54770002)

Iterating through AP map to find AHB-AP to use

AP[0]: Skipped. Invalid implementer code read from CPUIDVal[31:24] = 0x00

AP[1]: Skipped. Invalid implementer code read from CPUIDVal[31:24] = 0x00

AP[2]: Skipped. Not an AHB-AP

Attach to CPU failed. Executing connect under reset.

Failed to power up DAP

InitTarget() start

Challenge UUID0:0x82968AA6

Challenge UUID1:0x1505080E

InitTarget() end

TotalIRLen = 4, IRPrint = 0x01

JTAG chain detection found 1 devices:

#0 Id: 0x088C601D, IRLen: 04, JTAG-DP

DPv0 detected

Scanning AP map to find all available APs

AP[3]: Stopped AP scan as end of AP map has been reached

AP[0]: AHB-AP (IDR: 0x84770001)

AP[1]: AHB-AP (IDR: 0x24770011)

AP[2]: APB-AP (IDR: 0x54770002)

Iterating through AP map to find AHB-AP to use

AP[0]: Skipped. Invalid implementer code read from CPUIDVal[31:24] = 0x00

AP[1]: Skipped. Invalid implementer code read from CPUIDVal[31:24] = 0x00

AP[2]: Skipped. Not an AHB-AP

Attach to CPU failed. Executing connect under reset.

Failed to power up DAP

Connect failed. Resetting via Reset pin and trying again.

InitTarget() start

Challenge UUID0:0x82968AA6

Challenge UUID1:0x1505080E

InitTarget() end

TotalIRLen = 4, IRPrint = 0x01

JTAG chain detection found 1 devices:

#0 Id: 0x088C601D, IRLen: 04, JTAG-DP

DPv0 detected

Scanning AP map to find all available APs

AP[3]: Stopped AP scan as end of AP map has been reached

AP[0]: AHB-AP (IDR: 0x84770001)

AP[1]: AHB-AP (IDR: 0x24770011)

AP[2]: APB-AP (IDR: 0x54770002)

Iterating through AP map to find AHB-AP to use

AP[0]: Skipped. Invalid implementer code read from CPUIDVal[31:24] = 0x00

AP[1]: Skipped. Invalid implementer code read from CPUIDVal[31:24] = 0x00

AP[2]: Skipped. Not an AHB-AP

Attach to CPU failed. Executing connect under reset.

Failed to power up DAP

Cannot connect to target.

Kindly let me know how to proceed further to connect with the board .

Is HAB must be closed, for secure JTAG process?

[vishnusudhankj]

Hi,

I programmed a 128-bit (16-byte) secret response key in the eFuse JTAG RESP (0xcb0-0xce0) and JTAG_SMODE fuse & checked SecureJTAG with a HAB OPEN Board.

With this configuration, I can connect the core with or without a challenge response (not considering challenge response - HAB Open)

I thus tried closing the board (HAB-closed) and connecting the core with the challenge response, and I was successful in doing so.

Therefore, I did not fuse JTAG HEO & JTAG RESP RLOCK when compared to my old close board (which was unable to communicate with the core through challenge response).

Therefore, I believe that JTAG HEO is to blame for the problem when connecting to the core via challenge response.

Could you briefly explain how JTAG HEO is used? Is this the root of the problem?

To be clear, can I configure the JTAG RESP RLOCK alone and connect to the core using the challenge response?

This is the second configuration to test the secure JTAG. So could you please advise on which fuse needs to be programmed and how to link the core using a challenge response?

Also, clarify when the JTAG HEO should be programmed as well.

[Omar_Anguiano]

Hello
I hope you are well.

As you know, The Secure JTAG authentication may be bypassed in SW by writing logic 1 to HAB_JDE, regardless of its security mode. This feature can be disabled through JTAG_HEO fuse.
I suggest you burn this fuse after you are sure you can access JTAG with the authentication.
It is important to set JTAG RESP RLOCK so the response becomes "invisible" on the fuse map.

To enable secure JTAG it is important that the device is in HAB-closed mode.

Best regards,
Omar