The S32K148 has secure boot functionality, but the bootloader fails to start after JTAG is disabled. Dear NXP, hello: Our company's K148 has two partitions: a bootloader and an application partition. The application partition has a function to disable JTAG. When JTAG is disabled in the application, the bootloader fails to start after a reset, causing the chip to become bricked. Investigation revealed that the bootloader is 32KB, ranging from 0x00 to 0x8000. Disabling JTAG involved writing 0xFFu , 0xFFu , 0xFFu , 0xFFu , 0xFCu, 0x7Fu , 0xFFu , 0xFFu at address 0x408 , causing a change in the flash content. After a reset, the CSEc calculates a different boot_mac value for the bootloader, resulting in the bricking. Does NXP have any mature solutions to resolve this issue? Thank you. Re: S32K148有secureboot功能,但是bootloader在jtag关闭后起不来 K148的key槽.png Hi, @lukaszadrapa According to the manual above, BOOT_MAC is a one-time, irreversible write. Is there an official API that allows changing its value? If so, could you provide this API? Re: 晶振波形异常 Using your company's FS32K144HFT0MLHT MC IMG_20260718_141710.jpg The crystal oscillator is an 8MHz passive crystal oscillator (AV08000009), and the waveform is abnormal. Is this waveform acceptable for your company's MCU, and will it affect normal operation? Re: S32K148有secureboot功能,但是bootloader在jtag关闭后起不来 Hi @vurtual
The common approach is to disable the debug interface during manufacturing, rather than later from the application. In that case, the process can be done in a single production step: reprogram the Flash Configuration Field (FCF) to disable the debug port and then provision the correct BOOT_MAC value (or allow the CSEc to calculate it automatically after the next reset).
If you need to disable the debug interface later in the product lifecycle, that is also possible. However, once the FCF is reprogrammed, the BOOT_MAC must be updated as well, since the secure boot calculation includes the modified FCF contents. Otherwise, the secure boot verification will fail.
The BOOT_MAC can be updated using the standard SHE memory update protocol, in the same way that CSEc keys are updated. After updating the BOOT_MAC to match the new FCF contents, secure boot should operate correctly with the debug port disabled.
Regards, Lukas Re: S32K148有secureboot功能,但是bootloader在jtag关闭后起不来 Hi @vurtual
Where do you see that this is an irreversible operation? That is not correct. BOOT_MAC can be updated.
As I mentioned previously:
"The BOOT_MAC can be updated using the standard SHE memory update protocol, in the same way that CSEc keys are updated."
This means you can use the CMD_LOAD_KEY command, which is the same command used to import and update regular SHE/CSEc keys.
To update BOOT_MAC, you need to generate the M1–M5 values according to the standard SHE key update procedure. The key counter must be incremented, and the update can be authorized using either the MASTER_ECU_KEY or the BOOT_MAC_KEY.
Therefore, updating BOOT_MAC is a supported operation and is not irreversible.
Regards,
Lukas Re: 晶振波形异常 Hello,@ lukaszadrapa Our company uses your FS32K144HFT0MLHT MCU with an 8MHz passive crystal oscillator (AV08000009), and the waveform is abnormal. Is this crystal oscillator waveform acceptable for your MCU? Will it affect the normal operation of the MCU? Thank you. IMG_20260718_141710.jpg Re: 晶振波形异常 Please create new thread for this. Thank you. Re: 晶振波形异常 OK ,Thank you. Re: S32K148有secureboot功能,但是bootloader在jtag关闭后起不来 I also implemented the function to disable JTAG while Secure Boot is enabled. Before starting formal work, I conducted an experiment. The procedure was as follows: Experiment 1: 1. Secure boot is set to parallel mode, and size is set to 0x8000 during BOOT_DEFINE. 2. Manually calculate CMAC and import it into BOOT_MAC using the master key. After restarting, the board boots normally with BOK=1. 3. Disable watchdog (WDOG_DRV_Deinit) 4. Rewrite the 8 bytes starting at 0xFFF0 5. After recalculating CMAC, import CMAC into BOOT_MAC using the secure boot key. 6. Enable watchdog (WDOG_DRV_Init) When powered on again, BOK=1 can be seen. With this process debugged successfully, I changed the modification in step 4 to rewrite the 8 bytes starting from 0x408 (to disable JTAG), that is... Experiment 2: 1. Secure boot is set to strict mode, and size is set to 0x8000 during BOOT_DEFINE. 2. Manually calculate CMAC and import it into BOOT_MAC using the master key. After restarting, the board boots normally with BOK=1. 3. Disable watchdog (WDOG_DRV_Deinit) 4. Modify the 8 bytes starting from 0x408 to disable JTAG. 5. After recalculating CMAC, import CMAC into BOOT_MAC using the secure boot key. 6. Enable watchdog (WDOG_DRV_Init) A reset occurred during this process. After execution, the board current dropped directly to 0.0102A, and the log "calculate start" that I added at the beginning of step 5 was not printed. Therefore, I suspect that a reset occurred between steps 5 and 6, causing the flash memory to change but the boot cmac value to remain the old one. I then improved this process. Experiment 3: 1. Secure boot is set to strict mode, and size is set to 0x8000 during BOOT_DEFINE. 2. Manually calculate CMAC and import it into BOOT_MAC using the master key. After restarting, the board boots normally with BOK=1. 3. WDOG_DRV_Trigger 4. DISABLE_GLOBAL_IRQ 5. Rewrite the 8 bytes starting at 0xFFF0 6. ENABLE_GLOBAL_IRQ 7. WDOG_DRV_Trigger 8. After recalculating CMAC, import CMAC into BOOT_MAC using the secure boot key. The process was successful; no reset occurred. I want to know why the reset occurred in Solution 2... Please ensure that the steps added in Solution 3 regarding interrupt disabling and WDOG_DRV_Trigger are effective.
查看全文