i.MXRT118x Debug Authentication example

I.MX RT118x offers the Debug Authentication Protocol (DAP) as a mechanism to authenticate the debugger (an external entity) which has the credentials approved by the product manufacturer before granting the debug access to the device. This example demonstrates process how to establish Debug Authentication protocol.

The process could be split into following steps:

Introduction

The fundamental principles of debugging, which require access to the system state and system information, conflict with the principles of security, which require the restriction of access to assets. Thus, many products disable debug access completely before deploying the product. To address these challenges, the chip offers a debug authentication protocol as a mechanism to authenticate the debugger (an external entity) has the credentials approved by the product manufacturer before granting debug access to the device. The debug authentication is a challenge-response scheme and assures that only the debugger in possession of the required debug credentials can successfully authenticate over the debug interface and access restricted parts of the device.

The protocol is divided into steps as described below:

1. The debugger initiates the Debug Mailbox message exchange by setting the CSW[RESYNCH_REQ] bit and CSW[CHIP_RESET_REQ] bit of DM-AP.

2. The debugger waits (minimum 30 ms) for the devices to restart and enter debug mailbox request handling loop.

3. The debugger sends Debug Authentication Start command (command code 10h) to the device.

4. The device responds back with Debug Authentication Challenge (DAC) packet based on the debug access rights preconfigured in CMPA fields, which are collectively referred as Device Credential Constraints Configuration (DCFG_CC). The response packet also contains a 32 bytes random challenge vector.

5. The debugger responds to the challenge with a Debug Authentication Response (DAR) message by using an appropriate debug certificate, matching the device identifier in the DAC. The DAR packet contains the debug access permission certificate, also referred as Debug Credential (DC), and a cryptographic signature binding the DC and the challenge vector provided in the DAC.

6. The device on receiving the DAR, validates the contents by verifying the cryptographic signature of the message using the debugger’s public key present in the embedded the Debug Credential (DC). On successful validation of DAR, the device enables access to the debug domains permitted in the DC

1. Prerequisites

• SPSDK is needed with examples extension. pip install spsdk[examples] (Please refer to the installation documentation.)

• The device must be properly configured to run signed application (example of run signed application is here: AHAB Secure boot)

• The device life cycle must be moved to state OEM_CLOSED (see more detail also in AHAB Secure boot)

• This example uses EVK-MIMXRT1189 board. This is example board configuration with external debugger. In our case we used Segger J-Link probe connected over sandard 20 pin JTAG connector.

  

1.1 Let’s prepare the environment

WORKSPACE = "workspace/"  # change this to path to your workspace
INPUTS = "inputs/"
VERBOSITY = (
    "-v"  # verbosity of commands, might be -v or -vv for debug or blank for no additional info
)

DAT_CONFIG = INPUTS + "dat_config.yaml"  # yaml file with configuration used in this example
DC_CONFIG = (
    INPUTS + "dc_config.yaml"
)  # yaml file with configuration used in this example for debug credential file

# DEBUGGER_PROBE = "pyocd" #onboard debugger on EVK-RT118x rev C
DEBUGGER_PROBE = "pyocd"
# Only one probe can be connected to the board.

FAMILY = "mimxrt1189"

env: JUPYTER_SPSDK=1
Created `%!` as an alias for `%execute`.

2. Generate RoT + Debug auth keys

First we need to generate Root of Trust Keys (RoTKs)/Super Root Keys (SRKs) and Debug Credential Key (DCK). Use nxpcrypto app to generate secp256r1 keys (see How-to-get-keys-using-nxpcrypto). We will need by default create 4 RoTKs and 1 DCK.

The notebook is using pre-generated keys just for that example purposes from folder _data/keys/ecc256 in root of all SPSDK examples.

3. Generate debug credential file including its configuration file

First we need to prepare the configuration file for debug credential file export. Let’s begin by creating a template configuration file using the nxpdebugmbox dat dc get-template command. To simplify this example, we have already prepared that configuration, which can be found in the ./inputs/dc_config.yaml file. Below, we’ll compare the differences between the template and our customized example to highlight the additions we’ve made.

Note: As is mentioned in introduction, the DC file should be created by owner of RoT credentials.

Note: Example how to get UUID for one device: Connect debug probe into the connector and read the UUID by nxpdebugmbox -f mimxrt1189 tool get-uuid

# Get difference of template and user YAML configuration
YamlDiffWidget("inputs/dc_config.diffc").html

nxpdebugmbox -f mimxrt1189 dat dc get-template -o workspace/dc_config.yaml --force 
The Debug Credentials template for mimxrt1189 has been saved into workspace\dc_config.yaml YAML file

Configuration Differences

Show Diff Download Config

# ==============================  Debug Credential file template for mimxrt1189 family.  ===============================


# -------------------------------------------------------- Note --------------------------------------------------------

# Debug credential file has following binary structure:
#  ============================================
#  ============================================
#  ===              Version                 ===
#  ============================================
#  ===             Soc Class                ===
#  ============================================
#  ===                UUID                  ===
#  ============================================
#  ===    RoT Meta SHA256 of following:     ===
#  ===          RoT Key0 SHA256             ===
#  ===          RoT Key1 SHA256             ===
#  ===          RoT Key2 SHA256             ===
#  ===          RoT Key3 SHA256             ===
#  ============================================
#  ===        Debugger Key DCK (Pub):       ===
#  ===                                      ===
#  ============================================
#  ===              CC SOCU                 ===
#  ============================================
#  ===               CC VU                  ===
#  ============================================
#  ===                 CB                   ===
#  ============================================
#  ===            RoT Key (pub)             ===
#  ===                                      ===
#  ============================================
#  ============================================
#  ===       Signature of all block         ===
#  ===  SHA256 of whole block => Sign(RoTK) ===
#  ============================================
#  ============================================


#  ============================================
#  Debug Credential Signature
#  ============================================
#  There are two ways how sign the final DC data blob.

#  1. In case that you is available private pair for rot_meta with index rot_id just use first simple style
#  to use it by rotk key. As a second way to do same is use sign_provider (or signProvider - both are accepted) option
# with 'type=file'.

#  2. For case that Debug Credential files are generated in untrusted environment (without access to RoT private keys),
#  there is option to use plugin (example how to create own plugin is in: ./SPSDK/examples/dat/hsm/). The plugin
#  has simple interface that allows handle DC data blob into plugin with index of RoT meta public key to get back signed
#  DC image.

#  Those options are exclusive, so only one option could be used to sign the DC.


# ======================================================================================================================
#                                                 == General Options ==                                                 
# ======================================================================================================================
# ------------------------------===== The chip family name [Conditionally required] =====-------------------------------
# Description: NXP chip family identifier.
# Possible options: 
# lpc55s36, lpc55s66, lpc55s69, mcxa132, mcxa133, mcxa142, mcxa143, mcxa144, mcxa145, mcxa146, mcxa152, mcxa153,
# mcxa154, mcxa155, mcxa156, mcxn235, mcxn236, mcxn546, mcxn547, mcxn946, mcxn947, mcxw716a, mcxw716c, mimx8ulp,
# mimx9131, mimx9352, mimx9596, mimxrt1181, mimxrt1182, mimxrt1187, mimxrt1189, mimxrt533s, mimxrt555s, mimxrt595s,
# mimxrt685s, mimxrt798s, nhs52s04, rw610, rw612>
family: mimxrt1189
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: 
revision: latest
# ======================================================================================================================
#                                             == Debug Credential Content ==                                            
# ======================================================================================================================
# ------------------------------------------===== Device UUID [Required] =====------------------------------------------
# Description: 128-bit IETF RFC4122 compliant non-sequential Universally Unique Identifier (UUID)
uuid: '00000000000000000000000000000000' The template file uses zeroized UUID. To create a debug credential file for specific par run the
"get-uuid" command listed below and replace to zeros at the UUID field by the UUID value returned by the command in the yaml file."
# -------------------------------------------===== SoC Usage [Required] =====-------------------------------------------
# Description: A CC (constraint) value that is a bit mask, and whose bits are used in an SoCC-specific manner. These
# bits are typically used for controlling which debug domains are accessed via the authentication protocol, but device-
# specific debug options can be managed in this way also.
cc_socu: '0x0FFF' Changed on value 0x00FFFFF0 to set everything open. For more info about this value check the documentation
cc_socu: 0x00FFFFF0
# -----------------------------------------===== Vendor Usage [Required] =====------------------------------------------
# Description: A CC (constraint) value that is opaque to the debug authentication protocol itself but which can be
# leveraged by vendors in product-specific ways.
cc_vu: 0
# ---------------------------------------===== Credential Beacon [Required] =====---------------------------------------
# Description: A value that is passed through the authentication protocol, which is not interpreted by the protocol but
# is instead made visible to the application being debugged. A credential beacon is associated with a DC and is
# therefore vendor/RoT-signed. An authentication beacon is provided and signed by the debugger during the authentication
# process.
cc_beacon: 0 We keep the cc beacon on value zero, it's enough for example purposes
# -----------------------------------------===== RoT meta-data [Required] =====-----------------------------------------
# Description: The RoT meta-data required by the device to corroborate; the ROTID sent in the DAC, the field in this DC,
# and any additional RoT state that is not stored within the device. This allows different RoT identification,
# management and revocation solutions to be handled.
rot_meta: Updated Root Of Trust public keys to used in our example
  - ./rotk0.pub
  - ./rotk1.pub
  - ./rotk2.pub
  - ./rotk3.pub
  - ../../_data/keys/ecc256/srk0_ecc256.pub
  - ../../_data/keys/ecc256/srk1_ecc256.pub
  - ../../_data/keys/ecc256/srk2_ecc256.pub
  - ../../_data/keys/ecc256/srk3_ecc256.pub
# ----------------------------------------===== RoT Identifier [Required] =====-----------------------------------------
# Description: RoTID allows the debugger to infer which RoT public key(s) are acceptable to the device. If the debugger
# cannot or does not provide such a credential, the authentication process will fail.
rot_id: 0 We keep it same because in our example the private key to sign whole DC file has been chooses with index 0
# -------------------------------------===== Debug Credential Key [Required] =====--------------------------------------
# Description: A user-owned key pair. The public part of the key is associated with a DC, the private part is held by
# the user and used to produce signatures during authentication.
dck: dck.pub Updated Debug Credential public key to used in our example
dck: ../../_data/keys/ecc256/dck_ecc256.pub
# ----------------------------===== RoT signature private key [Conditionally required] =====----------------------------
# Description: Private key for the RoT meta chosen by rot_id to sign the image.
rotk: ../../_data/keys/ecc256/srk0_ecc256.pem
rotk: rotk0.pem Add path to private key file for signing used in our example
# -------------------------------===== Signature Provider [Conditionally required] =====--------------------------------
# Description: Signature provider configuration in format 'type=;key_number='.
sign_provider: type=sasp;key_number=0 This is removed, because we are using private key in this example
# ======================================================================================================================
#                                         == Debug Credential Signature part ==                                         
# ======================================================================================================================
# --------------------------------------------===== CA Flag [Optional] =====--------------------------------------------
# Description: CA Flag is used by AHAB to indicate if the SRK is allowed to sign other keys
flag_ca: false CA Flag could be removed in case that the keys are not CA, the default value is also False.

# Copyright 2024 NXP
#
# SPDX-License-Identifier: BSD-3-Clause
# ================================  Debug Credential file template for mimxrt1189 family.  =================================

# -------------------------------------------------------- Note --------------------------------------------------------

# Debug credential file has following binary structure:
#  ============================================
#  ============================================
#  ===              Version                 ===
#  ============================================
#  ===             Soc Class                ===
#  ============================================
#  ===                UUID                  ===
#  ============================================
#  ===    RoT Meta SHA256 of following:     ===
#  ===          RoT Key0 SHA256             ===
#  ===          RoT Key1 SHA256             ===
#  ===          RoT Key2 SHA256             ===
#  ===          RoT Key3 SHA256             ===
#  ============================================
#  ===        Debugger Key DCK (Pub):       ===
#  ===                                      ===
#  ============================================
#  ===              CC SOCU                 ===
#  ============================================
#  ===               CC VU                  ===
#  ============================================
#  ===                 CB                   ===
#  ============================================
#  ===            RoT Key (pub)             ===
#  ===                                      ===
#  ============================================
#  ============================================
#  ===       Signature of all block         ===
#  ===  SHA256 of whole block => Sign(RoTK) ===
#  ============================================
#  ============================================

#  ============================================
#  Debug Credential Signature
#  ============================================
#  There are two ways how sign the final DC data blob.

#  1. In case that you is available private pair for rot_meta with index rot_id just use first simple style
#  to use it by rotk key. As a second way to do same is use sign_provider (or signProvider - both are accepted) option
# with 'type=file'.

#  2. For case that Debug Credential files are generated in untrusted environment (without access to RoT private keys),
#  there is option to use plugin (example how to create own plugin is in: ./SPSDK/examples/dat/hsm/). The plugin
#  has simple interface that allows handle DC data blob into plugin with index of RoT meta public key to get back signed
#  DC image.

#  Those options are exclusive, so only one option could be used to sign the DC.

# ======================================================================================================================
#                                                 == General Options ==
# ======================================================================================================================
# -----------------------------------===== MCU family [Conditionally required] =====------------------------------------
# Description: MCU family name.
# Possible options: 
# mcxn946, mcxw7116, mimx8ulp, mimx9352, mimx9596, nhs52s04, mimxrt1189, mimxrt595s, mimxrt685s, rw612>
family: mimxrt1189
# -------------------------------------===== Chip silicon revision [Optional] =====-------------------------------------
# Description: If needed this could be used to specify silicon revision of device.
revision: latest
# ======================================================================================================================
#                                             == Debug Credential Content ==
# ======================================================================================================================
# ------------------------------------------===== Device UUID [Required] =====------------------------------------------
# Description: 128-bit IETF RFC4122 compliant non-sequential Universally Unique Identifier (UUID)
uuid: '00000000000000000000000000000000'
# -------------------------------------------===== SoC Usage [Required] =====-------------------------------------------
# Description: A CC (constraint) value that is a bit mask, and whose bits are used in an SoCC-specific manner. These
# bits are typically used for controlling which debug domains are accessed via the authentication protocol, but device-
# specific debug options can be managed in this way also.
cc_socu: 0x00FFFFF0
# -----------------------------------------===== Vendor Usage [Required] =====------------------------------------------
# Description: A CC (constraint) value that is opaque to the debug authentication protocol itself but which can be
# leveraged by vendors in product-specific ways.
cc_vu: 0
# ---------------------------------------===== Credential Beacon [Required] =====---------------------------------------
# Description: A value that is passed through the authentication protocol, which is not interpreted by the protocol but
# is instead made visible to the application being debugged. A credential beacon is associated with a DC and is
# therefore vendor/RoT-signed. An authentication beacon is provided and signed by the debugger during the authentication
# process.
cc_beacon: 0
# -----------------------------------------===== RoT meta-data [Required] =====-----------------------------------------
# Description: The RoT meta-data required by the device to corroborate; the ROTID sent in the DAC, the field in this DC,
# and any additional RoT state that is not stored within the device. This allows different RoT identification,
# management and revocation solutions to be handled.
rot_meta:
  - ../../_data/keys/ecc256/srk0_ecc256.pub
  - ../../_data/keys/ecc256/srk1_ecc256.pub
  - ../../_data/keys/ecc256/srk2_ecc256.pub
  - ../../_data/keys/ecc256/srk3_ecc256.pub
# ----------------------------------------===== RoT Identifier [Required] =====-----------------------------------------
# Description: RoTID allows the debugger to infer which RoT public key(s) are acceptable to the device. If the debugger
# cannot or does not provide such a credential, the authentication process will fail.
rot_id: 0
# -------------------------------------===== Debug Credential Key [Required] =====--------------------------------------
# Description: A user-owned key pair. The public part of the key is associated with a DC, the private part is held by
# the user and used to produce signatures during authentication.
dck: ../../_data/keys/ecc256/dck_ecc256.pub
# ----------------------------===== RoT signature private key [Conditionally required] =====----------------------------
# Description: Private key for the RoT meta chosen by rot_id to sign the image.
rotk: ../../_data/keys/ecc256/srk0_ecc256.pem

Now we generate dc file based on yaml configuration.

DC_FILE_PATH = WORKSPACE + "debug_auth.dc"
%! nxpdebugmbox -f $FAMILY dat dc export -c $DC_CONFIG -o $DC_FILE_PATH --force

nxpdebugmbox -f mimxrt1189 dat dc export -c inputs/dc_config.yaml -o workspace/debug_auth.dc --force 
RKTH: cb2cc774b2dcec92c840eca0646b78f8d3661d3a43ed265a490a13aca75e190a
Creating Debug credential file succeeded

4. Generate debug authentication configuration file

In advance we will prepare the configuration file for debug authentication procedure itself. Let’s begin again by creating a template configuration file using the nxpdebugmbox dat get-template command. To simplify this example, we have already prepared that configuration, which can be found in the ./inputs/dat_config.yaml file. Below, we’ll compare the differences between the template and our customized example to highlight the additions we’ve made. This tiny configuration file is needed that specify the data from in-field technician.

# Get difference of template and user YAML configuration
YamlDiffWidget("inputs/dat_config.diffc").html

nxpdebugmbox -f mimxrt1189 dat get-template -o workspace/dat_config.yaml --force 
Creating workspace\dat_config.yaml template file.

Configuration Differences

Show Diff Download Config

# ===========================  Debug Authentication Configuration template for mimxrt1189.  ============================

# ======================================================================================================================
#                                                 == General Options ==                                                 
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: mimxrt1189
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
revision: latest
# ======================================================================================================================
#                                           == Debug Authentication Content ==                                          
# ======================================================================================================================
# -------------------------------===== Debug Credential Certificate file [Required] =====-------------------------------
# Description: A debug credential binary file provided by owner of Root Keys. The file could be created by 'dc' group of
# commands.
certificate: dc.bin Path to debug credential certificate (that we created in previous step)
certificate: workspace/rt118x_256.dc
# -------------------------------------===== Authentication beacon [Required] =====-------------------------------------
# Description: Debug authentication process can be extended with beacons. DEBUG_AUTH_BEACON (this field) contain
# information from debug authentication after debugger is successfully authenticated. This register contain data from
# Authentication beacon [31:16] which is defined during authentication session and Credential beacon [15:0] which is
# defined on RoT keys owner side during debug credential file generation and signing. When credential beacon non-zero
# value is used in this field, ROM defers opening debug access to user application. The result of the authentication
# process is written to DBG_FEATURES register while the user application after doing its extended processing, such as
# clean-up of critical keys and secrets, should copy the value to DBG_FEATURES_DP register to enable the debug access.
beacon: 0 We keep the beacon on value zero, it's enough for example purposes
# -------------------------------------------===== Keys set [Optional] =====--------------------------------------------
# Description: Selection of keys origin.
# Possible options: 
srk_set: oem We keep default value on OEM
# ----------------------------===== DCK signature private key [Conditionally required] =====----------------------------
# Description: Private key that match the public key in debug credential file, to sign Debug Authentication response.
dck_private_key: ../../_data/keys/ecc256/dck_ecc256.pem
dck_private_key: dck.pem Updated Debug Credential private key to used in our example
# -------------------------------===== Signature Provider [Conditionally required] =====--------------------------------
# Description: Signature provider configuration in format 'type=;key_number='.
sign_provider: type=sasp;key_number=0 This is removed, because we are using private key in this example

# Copyright 2024 NXP
#
# SPDX-License-Identifier: BSD-3-Clause
# ===========================  Debug Authentication Configuration template for mimxrt1189.  ============================

# ======================================================================================================================
#                                                 == General Options ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: mimxrt1189
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
revision: latest
# ======================================================================================================================
#                                           == Debug Authentication Content ==
# ======================================================================================================================
# -------------------------------===== Debug Credential Certificate file [Required] =====-------------------------------
# Description: A debug credential binary file provided by owner of Root Keys. The file could be created by 'dc' group of
# commands.
certificate: workspace/rt118x_256.dc
# -------------------------------------===== Authentication beacon [Required] =====-------------------------------------
# Description: Debug authentication process can be extended with beacons. DEBUG_AUTH_BEACON (this field) contain
# information from debug authentication after debugger is successfully authenticated. This register contain data from
# Authentication beacon [31:16] which is defined during authentication session and Credential beacon [15:0] which is
# defined on RoT keys owner side during debug credential file generation and signing. When credential beacon non-zero
# value is used in this field, ROM defers opening debug access to user application. The result of the authentication
# process is written to DBG_FEATURES register while the user application after doing its extended processing, such as
# clean-up of critical keys and secrets, should copy the value to DBG_FEATURES_DP register to enable the debug access.
beacon: 0
# -------------------------------------------===== Keys set [Optional] =====--------------------------------------------
# Description: Selection of keys origin.
# Possible options: 
srk_set: oem
# ----------------------------===== DCK signature private key [Conditionally required] =====----------------------------
# Description: Private key that match the public key in debug credential file, to sign Debug Authentication response.
dck_private_key: ../../_data/keys/ecc256/dck_ecc256.pem

5. Test debug authentication

Now we can call authentication command for nxpdebugmbox. Since the board is in the OEM closed life cycle, as a validation test we will use test-connection command from nxpdebugmbox application. After the auth command is performed, the MCU should has enable debug interface by settings in CC_SOCU field in debug credential file.

# Test to confirm that debug access doesn't work
%! nxpdebugmbox -f $FAMILY -i $DEBUGGER_PROBE mem-tool test-connection

nxpdebugmbox -f mimxrt1189 -i pyocd mem-tool test-connection 
  #   Interface   Id          Description                 
----------------------------------------------------------
  0   PyOCD       851002903   Segger J-Link Compact PLUS  
The device is not-accessible for debugging.

# Unlock the Debug Authentication
%! nxpdebugmbox -f $FAMILY -i $DEBUGGER_PROBE -v dat auth -c $DAT_CONFIG

nxpdebugmbox -f mimxrt1189 -i pyocd -v dat auth -c inputs/dat_config.yaml 
INFO:root:
INFO:root:
INFO:root:--- SPSDK DEBUG LOGGING STARTED (2024-11-06 09:33:11.634502) ---
INFO:root:SPSDK version: 2.3.0.dev196+g291e35f98
INFO:root:Python version: 3.11.4 (tags/v3.11.4:d2340ef, Jun  7 2023, 05:45:37) [MSC v.1934 64 bit (AMD64)]
INFO:root:
INFO:spsdk.apps.nxpdebugmbox:Starting Debug Authentication
  #   Interface   Id          Description                 
----------------------------------------------------------
  0   PyOCD       851002903   Segger J-Link Compact PLUS  
INFO:spsdk.debuggers.debug_probe_pyocd:PyOCD connected via J-Link Compact PLUS probe.
INFO:spsdk.apps.nxpdebugmbox:DAC: 
Version                : Version 2.0
SOCC                   : 0x5254049C
UUID                   : C8BDB7562AFA425B9528F5D63EB4125E
CC_VU                  : 0
ROTID_rkh_revocation   : 00000000
ROTID_rkth_hash        : cb2cc774b2dcec92c840eca0646b78f8d3661d3a43ed265a490a13aca75e190a
CC_soc_pinned          : 00FFFFF0
CC_soc_default         : 00000000
Challenge              : 60a392326c39a1de536d83b94287002443fbeae5859d67158c4d225b9de3318a

INFO:spsdk.apps.nxpdebugmbox:DAR:
DAC:
Version                : Version 2.0
SOCC                   : 0x5254049C
UUID                   : C8BDB7562AFA425B9528F5D63EB4125E
CC_VU                  : 0
ROTID_rkh_revocation   : 00000000
ROTID_rkth_hash        : cb2cc774b2dcec92c840eca0646b78f8d3661d3a43ed265a490a13aca75e190a
CC_soc_pinned          : 00FFFFF0
CC_soc_default         : 00000000
Challenge              : 60a392326c39a1de536d83b94287002443fbeae5859d67158c4d225b9de3318a

DC:
Version : Version 2.0
SOCC    : 0x5254049C
UUID    : 00000000000000000000000000000000
CC_SOCC : 0xfffff0
CC_VU   : 0x0
BEACON  : 0
Number of records in flags: 4
SRK table has 4 entries
CTRK hash   : cb2cc774b2dcec92c840eca0646b78f8d3661d3a43ed265a490a13aca75e190a

Authentication Beacon: 0

INFO:spsdk.debuggers.debug_probe_pyocd:PyOCD connected via J-Link Compact PLUS probe.
Debug Authentication ends successfully.

# Test to confirm that debug access works
%! nxpdebugmbox -f $FAMILY -i $DEBUGGER_PROBE mem-tool test-connection

nxpdebugmbox -f mimxrt1189 -i pyocd mem-tool test-connection 
  #   Interface   Id          Description                 
----------------------------------------------------------
  0   PyOCD       851002903   Segger J-Link Compact PLUS  
The device is accessible for debugging.