S32K中的主题 Re: S32K3 JTAG password

S32K3 JTAG password

kjy106906 — Tue, 08 Oct 2024 05:46:01 GMT

I want to use the JTAG Password function of S32K312.
Is the following method possible?

S32K312 Secure debug setting (JTAG access not possible)
-> Password sent to MCU via CAN communication
-> MCU escapes Secure debug via Password (JTAG access possible)

Also, is it possible to set S32K312 Secure debug via CAN communication?
(When receiving a specific CAN message, MCU proceeds with setting Secure debug related registers)

If the above method is not possible, should I only enter the Password directly via JTAG to escape Secure debug?

Re: S32K3 JTAG password

ovidiubriscan — Tue, 08 Oct 2024 09:19:05 GMT

Hi, please check steps inside manual RM758221-HSE-B Firmware Reference Manual, chapter Host debug.

Step 1) Provision the ADKP using the HSE_APP_DEBUG_KEY_ATTR_ID attribute.

Step 2) Set authorization method: password-based or challenge-response based, using the HSE_DEBUG_AUTH_MODE_ATTR_ID system attribute.

Step 3) Set the life cycle to OEM_PROD or IN_FIELD using the HSE_SECURE_LIFECYCLE_ATTR_ID system attribute.

All the above steps can be implemented in a DID/UDS routine no issue with that. After the 3rd step you ECU will be JTAG locked. You will need to provide the same password to debug tooling (Lauterbach Trace32 for ex, .

Re: S32K3 JTAG password

kjy106906 — Thu, 10 Oct 2024 00:43:15 GMT

Thank you.
After Step 3, if JTAG is locked, can I unlock JTAG by entering the password through UDS.?
Or is JTAG unlock only possible through Debug Tool?
We are using T32. Do you know the relevant guide?

Re: S32K3 JTAG password

ovidiubriscan — Thu, 10 Oct 2024 06:28:14 GMT

Hi, morning, this depends on your project strategy, both ways are possible, UDS adviceable to be behind a security access mechanism. But be aware Jtag unlock is only effective up to the next reset, any kind (which is a pain .., normally you want to unlock to debug stuff, hot attach or sleep/wakeup imposible to debug, reflash SW almost impossible). Permanent unlock of Jtag is not possible (like in older NXP architectures or in Tricore).
regards,

Re: S32K3 JTAG password

kjy106906 — Thu, 10 Oct 2024 06:44:17 GMT

Thank you very much.

1. Please briefly explain how to unlock the Lock by JTAG PASSWORD with an external UDS message.

2. Should I input the JTAG PASSWORD with a tool like T32 through JTAG? Or is it possible to input it with a UDS message?

3. Is the reason why reprogramming is impossible because reprogramming requires a reset?

Re: S32K3 JTAG password

ovidiubriscan — Thu, 10 Oct 2024 07:15:51 GMT

1. You can do it with a $31 service , 31 01 <16bytes jtag_passwd>, or even with a $22 (RDBI), at the end you just need a trigger to your custom C API which will do the unlock procedure.
2. T32 is another easier option (and there are examples on how to do it, check S32_JTAG_WRITE.cmm inside HSE_DEMOAPP_S32K3XX_0_2_1_0) , this may be preferred method.
3. Normally when you do an attach o system up in T32 depends on the scripts behind but normally a reset happens, also when flashing process the scripts behind \demo\arm\flash\s32k3.cmm do some resets which will brake your "unlock" situation.

回复： S32K3 JTAG password

victory — Fri, 11 Oct 2024 01:11:47 GMT

you can do it on mcu as PEMicro script does, set SDAAP registers to unlock debug.

Re: S32K3 JTAG password

NileshDharap — Tue, 16 Sep 2025 05:57:05 GMT

Hello,
Where can I find this "S32_JTAG_WRITE.cmm inside HSE_DEMOAPP_S32K3XX_0_2_1_0)" ?
I am working on unlocking JTAG to automate whenever I open the trace32.

Re: S32K3 JTAG password

ovidiubriscan — Tue, 16 Sep 2025 06:11:01 GMT

You have it here : c:\NXP\HSE_DEMOAPP_S32K344_0_2_55_0\demo_security_installer\scripts\S32_JTAG_WRITE.cmm

Re: S32K3 JTAG password

NileshDharap — Tue, 16 Sep 2025 07:29:41 GMT

I see it directly accesses JTAG to unlock.
Can we use the same to unlock if the JTAG is locked with HSE module ?
If yes, can it have a mechanism where it reads a file where password is stored and unlock using it.
Or how can I insert a password ?