AM263P2: AM263Px - Secure debug - Permanent lock - SDK Reference

Hello,

I've assigned this thread to the relevant expert, please expect a reply shortly.

Best,

Matt

Hi Jayanthi, 

Sorry for the delay, i was on business travel.

Please find the response below

Jayanthi Guruswamy said:

Permanent Debug Disable: Our requirement is to permanently disable debug access. In the SDK, we noticed the API: SecMgr_isJTAGDisabled()
1. Is checking this status sufficient to confirm that JTAG/debug access is fully and permanently locked?

The default state of the device is JTAG locked in HS-SE. This API is used to read if JTAG is disabled from EFUSE. If you are opting for this option, then this API reflects the status of the same.

Jayanthi Guruswamy said:

Alternate Debug Access Paths
2. Are there any other possible interfaces or mechanisms through which debug access could still be enabled, even if JTAG is reported as disabled.

Yes, the efuse path of permanent jtag disable is not suggested (As mentioned in HSM Addendum). 

Hence we can use the SBL certificate with debug disable extension to get a permanent disable as ROM disables the JTAG in this case, so from a customer POV, the JTAG is always disabled. To enable it back, we need to update the SBL certificate to unlock JTAG.

Jayanthi Guruswamy said:

OTP / eFuse-Based Disable
While looking for clarification, we came across a presentation stating (: https://e2e.ti.com/support/microcontrollers/arm-based-microcontrollers-group/arm-based-microcontrollers/f/arm-based-microcontrollers-forum/1531676/mcu-plus-sdk-am263px-method-to-enable-secure-debug-on-r5f-and-hsm-core/5893756?tisearch=e2e-quicksearch&keymatch=Secure%20debug ):“Permanent disable via JTAG using OTP KW is currently not supported.” Could you please clarify:

Yes, this is not available using OTP KW. The efuse driver is present in TIFS SDK, which you can use to  write to Efuse. But as mentioned earlier, not recommended method of JTAG disable

Thanks and Regards,

Nikhil Dasan

Thanks Nikhil for the response.

To summarize, my understanding is that the:

- EFUSE_JTAG_DISABLE_STATUS for permanent efuse lock
- WRITE_ONCE_ONLY_STATUS plus the debug control/firewall registers for boot-time or runtime policy lock

Jayanthi Guruswamy said:

Given this limitation, could you kindly advise if there is a way to simulate the permanent lock? As we are working in an HS-SE development environment, we would prefer not to apply the actual lock, but still need to perform the necessary tests to ensure the functionality behaves as expected.

Hi,

Unfortunately, there is no way to recover back or simulate the JTAG lock via EFUSE write as this is a one time process and it does not revert back.

Nikhil Dasan said:

Hence we can use the SBL certificate with debug disable extension to get a permanent disable as ROM disables the JTAG in this case, so from a customer POV, the JTAG is always disabled. To enable it back, we need to update the SBL certificate to unlock JTAG.

The above way you can simulate JTAG log and revert it as well. May I know the concern behind going ahead with this approach in production?

Thanks and Regards,

Nikhil Dasan

Hi,

Hi,

Noted.

May I know your plan on address a customer return on the device due a field failure (if any).
i.e. if there is a need to debug from the field returned module, is there a method to achieve this at your end without enabling JTAG?

Please note That the option 2 of disabling the JTAG using SBL certificate is not a backdoor access path for the intruders. This path can be accessed only by the authenticated users who has access to the Root of Trust keys present on the device.

Thanks and Regards,

Nikhil Dasan

Hi,

The ROM disables the trace during this debug disable using the below register.

I'll confirm internally if this is a sticky register (i.e. can be written only once upon power ON and resets only on a power cycle).

If this is the case, then trace is also permanently disabled.

Thanks and Regards,

Nikhil Dasan