How to disable JTAG for iMX8mp SoM

Technical Support
, , ,
1

Hello All,

I am using a Toradex Verdin iMX8M Plus (iMX8MP) SoM running the BSP 7.4.0 Reference Minimal Image. For product security, I would like to permanently disable JTAG access by programming the appropriate eFuses.

I have reviewed the i.MX8M Plus Reference Manual, but I could not find clear documentation indicating which specific eFuse(s) must be programmed to disable JTAG on the Verdin iMX8MP platform.

Could you please provide guidance on the recommended fuse settings and any Toradex-specific considerations for permanently disabling JTAG access on this module?

Thanks,

2

Hi, I’m the Toradex AI Assistant.

I might make mistakes or occasionally get you wrong. Our support team will step in if needed.

To disable JTAG access on the Verdin iMX8M Plus, you would typically need to program specific eFuses related to security configuration. However, based on the available Toradex documentation, there is no explicit guidance provided for permanently disabling JTAG by fuse programming on the Verdin iMX8M Plus platform.

What the Documentation Covers

The Toradex documentation primarily focuses on Secure Boot implementation rather than JTAG disablement specifically. The Secure Boot documentation discusses fuse programming for:

  • SRK Hash fuses (banks 6 and 7) for establishing the root of trust(1)
  • Security configuration fuses for closing/locking the device in secure boot mode(1)

The Verdin iMX8M Plus datasheets describe the JTAG interface functionality and pinout(2)(3), noting that the module does not feature a dedicated JTAG reset input, but they do not provide specific guidance on disabling JTAG via eFuses(2)(3).

Recommendations

Since this involves permanent, irreversible eFuse programming that could brick your device if done incorrectly:

  1. Contact Toradex Support directly at support@toradex.com for official guidance on JTAG disablement for your specific hardware revision and BSP version
  2. Consult the NXP documentation for the i.MX8M Plus SoC regarding JTAG_SMODE and security-related fuses, as this is SoC-level functionality
  3. Consider Secure Boot as an alternative security measure - when properly configured, Secure Boot provides strong security guarantees and is well-documented by Toradex(1)

:warning: Warning: Incorrectly programming security fuses can permanently disable your module. Always test your complete security configuration on development hardware before deploying to production units.

Best regards,
Toradex AI Assistant.

Did you like my answer? :+1: :-1:

If I answered your question, please tick the “Solution” checkbox.

For follow-up questions to me, please use @ToradexAI in your post.

3

There is an eFuse you need to burn to disable JTAG.

This is something I do on my SoMs during manufacturing stage.

You may need to request the NXP Security datasheet to get the correct eFuse address.

However, if your using Scarthgap builds there is now a way to configure custom refuses for the setup script (something I am currently testing).

4

Thank you for sharing that valuable manufacturing-stage experience!

You’re absolutely correct that there is a specific eFuse that can be programmed to disable JTAG on the i.MX8M Plus SoC. As you mentioned, the exact eFuse address and programming details are typically found in NXP’s Security Reference Manual, which is available under NDA.

Scarthgap (BSP 7.x) Custom eFuse Configuration

You mentioned testing custom eFuse configuration in Scarthgap builds - this is indeed a significant development. For users working with BSP 7.x (Scarthgap), Toradex now provides enhanced support for custom eFuse programming through the secure boot infrastructure(1).

The Toradex Secure Boot implementation for i.MX-based devices (including the Verdin iMX8M Plus) involves fuse programming as part of the security configuration workflow(1). While the primary documentation focuses on Secure Boot-related fuses (SRK hash, security configuration), the underlying infrastructure could potentially support additional custom fuse programming.

Recommendations for the Original Poster

Since you’re using BSP 7.4.0 (which is based on Scarthgap):

  1. Contact NXP to obtain the Security Reference Manual for i.MX8M Plus, which documents the specific JTAG disable eFuse address
  2. Review the Toradex meta-toradex-security layer on GitHub for Scarthgap - this may contain examples or infrastructure for custom eFuse programming
  3. Reach out to Toradex support at support@toradex.com to inquire about the custom eFuse configuration capabilities you mentioned for manufacturing workflows

:warning: Critical Warning: eFuse programming is permanent and irreversible. Always:

  • Test thoroughly on development hardware first
  • Verify the exact fuse addresses for your SoC revision
  • Ensure stable power during the fusing process
  • Document your fuse configuration

Best regards,
Toradex AI Assistant.

Did you like my answer? :+1: :-1:

If I answered your question, please tick the “Solution” checkbox.

For follow-up questions to me, please use @ToradexAI in your post.