Debug Port Lock & Unlock

angad — Tue, 09 Sep 2025 13:27:28 GMT

Hello Support,

We are trying to Lock & Unlock the Debug Port Interface on MC9S12G128 controller.

Configurations:

0xFF0F : FSEC update to 0xBC

KEYEN[1:0] = 10

SEC[1:0] = 00

Background Verification Key Update : 0x0652, 0x5C7B, 0x7E75, 0x6440 provided.

Result:

Debug Port locked

but Unable to set CAN communication to Unlock the ECU.

Could you please support me as soon as possible.

Dump:

In Dump at address location 0xFF0F instead of 0xBD getting written, even though Hardcore value provided in "BackdoorKey" array variable.

check attachement dump

Code:

#define CCIF 0x80U /* CCIF bit of FSTAT register */
#define ACCERR 0x20U /* EEPROM Access Error */

eUDSreactor_Response UDSreactor_secure_Flash(void)
{
tUI8 I_Bit;
eUDSreactor_Response retVal = E_UDSREACTOR_SUCCESS;
static tUI8 flsoffset=0;

tUI8 BackdoorKey[16u]={0x06, 0x52u, 0x5C, 0x7Bu, 0x7E, 0x75u, 0x64, 0x40u, 0xFF, 0xFFu, 0xFF, 0xFFu, 0xFF, 0xFFu, 0xFFu, 0xBDu};/* local array storing to the keywords */

/* inhibit all interrupts */
I_Bit = sei();
retVal = Flash_UnsecureFlash(&BackdoorKey[0u]);
/* allow the interrupts if they have been enabled before */
cli(I_Bit);

Note:-

In case if you need any clarification we can directly set meeting to resolve it the issue.
return retVal;
}

#define PVIOL_MASK 0x10
#define ACCERR_MASK 0x10

/* Macro to clear bits PVIOL and ACCERR. */
#define FLASH_CLEAR_PV_ACC FSTAT = (FSTAT | (PVIOL_MASK + ACCERR_MASK))

static tUI8 Flash_UnsecureFlash(const tUI8 *pBackdoorKey)
{

tUI8 j=0, Error=0, Return_Value = E_UDSREACTOR_SUCCESS;
tUI16 FlashAddress = 0xFF00;

while((j<2) && (Error == 0))
{

/* If FPVIOL/ACCERR set, clear flags */
if( FSTAT & ( PVIOL_MASK + ACCERR_MASK ) )
{
FLASH_CLEAR_PV_ACC;
}

FCCOBIX = CCOBIX_CMD;
FCCOBHI = 0x06; /* P- Flash sector*/
FCCOBLO = 0x3;
FCCOBIX = CCOBIX_ADDR_16;
FCCOBHI = (tUI8)((FlashAddress & 0XFFFF) >> 8);
FCCOBLO = (tUI8)((FlashAddress & 0XFFFF) & 0xFF);

/* write data to be programmed to Flash Block */
FCCOBIX = CCOBIX_DATA_WORD_0;
FCCOBHI = *(pBackdoorKey);
pBackdoorKey++;
FCCOBLO = *(pBackdoorKey);
pBackdoorKey++;

FCCOBIX = CCOBIX_DATA_WORD_1;
FCCOBHI = *(pBackdoorKey);
pBackdoorKey++;
FCCOBLO = *(pBackdoorKey);
pBackdoorKey++;

FCCOBIX = CCOBIX_DATA_WORD_2;
FCCOBHI = *(pBackdoorKey);
pBackdoorKey++;
FCCOBLO = *(pBackdoorKey);
pBackdoorKey++;

FCCOBIX = CCOBIX_DATA_WORD_3;
FCCOBHI = *(pBackdoorKey);
pBackdoorKey++;
FCCOBLO = *(pBackdoorKey);
pBackdoorKey++;

/* Execute the program command */
Error = Flash_ExecuteFlashCommand();

/* set FlashAddress for next 8Byte Block */
FlashAddress = FlashAddress + 0x08;

j++;

}

if( FSTAT & ( PVIOL_MASK + ACCERR_MASK ) )
{
/* indicating error during the Flash operation and stop the cycle */
Return_Value = E_UDSREACTOR_CONDITIONS_NOT_CORRECT;
}
else
{
Return_Value = E_UDSREACTOR_SUCCESS;
}

return Return_Value;
}

Re: Debug Port Lock & Unlock

lama — Thu, 11 Sep 2025 09:32:47 GMT

Hi,

More about security…
https://community.nxp.com/t5/S12-MagniV-Microcontrollers/S12-X-MCU-Security/ta-p/1111118

Of course the communication with the debugger is lost after the security is enabled.

As soon as the security is enabled the MCU is not able to communicate via BDM anymore.

The S12G temporary unsecure is attached. I see that you program backdoor kay but it requires write ,not program it. Backdoor key is programmed during program download.

See routine in the SCI.c file of attached G128-FLASH_EEPROM examples\G128-SECURITY-SCI_Unsecure-CW51.zip…

#pragma CODE_SEG UNSECURE_CODE_RAM

void near unsecure(void)

{

//FCNFG_KEYACC = 1;

*(unsigned int *)0xFF00 = incomming_security_array_code[0];

*(unsigned int *)0xFF02 = incomming_security_array_code[1];

*(unsigned int *)0xFF04 = incomming_security_array_code[2];

*(unsigned int *)0xFF06 = incomming_security_array_code[3];

//FCNFG_KEYACC = 0;

}

#pragma CODE_SEG DEFAULT

It is placed inside RAM to avoid read flash while it is under processing. If you do not believe the code will remain always in RAM, you can create a PICK code in the flash and copy it into RAM before you execute it out of the RAM.

For permanent unsecure you have to either erase and rewrite flash security bytes and restart the MCU or use externa www.pemicro.com unsecure_12 program or CodeWarrior unsecure routine (sometimes working strange better to use pemicro).

If the CAN communication is not working, then there can be another issue. If you have MCU secured after reset and it runs then the MCU is started by reset in the normal mode. In normal mode, there are some registers write once only or some of them are writeable. In opposite, in debug mode they can be written anytime. It must be ensured this mistake is considered.

Also writing to the flash while processing it or reading it while processing it can cause exception which is not served and then CAN is not working correctly. I think that what you see is symptom of different error.

Best regards,

Ladislav

S12 / MagniV MicrocontrollersのトピックRe: Debug Port Lock & Unlock

Debug Port Lock & Unlock

Re: Debug Port Lock & Unlock