AM62P: Debug unlock certificate elements for SBL debug extension and SYSFW Debug Cert extension

The screenshot is from:

SBL debug extension: Security X509 Certificate Documentation — TISCI User Guide

SYSFW debug Cert: Unlock JTAG on an HS-SE device

Hello,

Tim Wang said:

are they same parameter?

They are the same parameter. It's only a documentation inconsistency.

Tim Wang said:

for above table, what means of "DEBUG_PRESERVE" (Preserve current setting by locking registers )?  Keep the JTAG lock/unlock status?

I will check and get back to you.

Thanks!

Hello Prashant,

Is there any progress about the "DEBUG_PRESERVE" ?

Thanks

BR.

Hello,

I am still checking with the concerned team. May I know if you are looking for the information out of curiousity?

By default, the JTAG is locked on the HSSE device out of reset. The TISCI request to unlock the JTAG is simply used with DEBUG_FULL to unlock the JTAG for the active power cycle. Once unlocked, the JTAG remains in that state until the next power cycle.

Thanks,

Prashant

Hello Prashant,

we get the information from MCU+ SDK, the debug type "DBG_SOC_DEFAULT (1)", it is equal to this DEBUG_PRESERVE, DBG_SOC_DEFAULT means your sentence of default setting "By default, the JTAG is locked on the HSSE device out of reset. The TISCI request to unlock the JTAG is simply used with DEBUG_FULL to unlock the JTAG for the active power cycle. Once unlocked, the JTAG remains in that state until the next power cycle."

So I guess this DEBUG_PRESERVE also means same.

Another question,

In SBL X.509 Cert, also can include "debug extension" (of cause this extension is optional),

1. If don't have this debug extension, then after SBL bootup, the debug is closed for HS-SE device. And can open it via send "debug unlock cert" later.

2. If the SBL X.509 Cert has debug extension, and we set the correct UID and debugtype is open (DEBUG_FULL (4)), then after Cert authentication successful, does it mean after SBL boot up, then the debug is opened auto? 

Thanks 

Tim

Hello Tim,

Tim Wang said:

we get the information from MCU+ SDK, the debug type "DBG_SOC_DEFAULT (1)", it is equal to this DEBUG_PRESERVE,

May I know the section from the MCU+ SDK you are referring to?

Tim Wang said:

In SBL X.509 Cert, also can include "debug extension" (of cause this extension is optional),

If the SBL's certificate has the DEBUG extension, the Secure ROM unlocks the JTAG as part of authentication of the SBL. Otherwise, the JTAG can be unlocked at runtime with the TISCI API or `dbgauth` at runtime.

Regards,

Prashant

Hello Prashant

DBG_SOC_DEFAULT  is defined in SDK: mcu_plus_sdk_am62px_12_00_00_27, in python file rom_image_gen.py to generate tiboot3.bin:

If in SBL X.509 Cert "debug extension", used wrong UID, then debug unlock failed, does it affect the SBL bootup? or SBL also can bootup, but the debug still keep closed?

BR

Hi, the SBL debug extension unlock the JTAG, is it only available for R5F core? 

Hi, 

I got another info below, it said the debug extension only can open R5 core:

forum link:MCU-PLUS-SDK-AM263PX: method to enable secure debug on R5F and HSM core - Arm-based microcontrollers forum - Arm-based microcontrollers - TI E2E support forums

Could you help to double check?

Thanks very much!

Hello,

AM263PX and AM62P are two devices with different architectures so the features may deviate in implementation.