Verfiying Backdoor access key using in S32k144 Before project start i wanna verfity backdoor test using s32k144. I have a example code about unsecureProject. (Example_S32K144_Verify_Backdoor_Access_Key_S32DS1.3_v2.zip) compare with example code and Referenece manual I have some question. 1. According to the Reference Manual about Verify Backdoor Access Key, it states like below table. FCCOB Number 0 is used when command. but in the code, FCCOB Number 4 is used when command. so I wondered. FTFC->FCCOB[0x0] = 0x45; // Backdoor Key Verify command (0x45) FTFC->FCCOB[0x3] = 0x45; // Backdoor Key Verify command (0x45) which is the right one? 2. I want to check the lock and unlock(verify backdoor access) mechanism. First. Set the backdoor key using T32. (I know it isn't normal way. usually insert the code) ex) Data.Set SD:0x400 %LE %Long &pwd_Head Data.Set SD:0x404 %LE %Long &pwd_Tail Data.Set SD:0x40C %LE %Long 0xFFFF7FBF Second. upon reset, the FSEC register (0x40020002) is initialized with the value stored in the security byte of the Flash Configuration Field (0x40C). Q. 2-1. Does this mean the device remains in the unsecure state until reset, and after reset, the FSEC register (0x40020002) is updated with the value read from 0x40C, causing the device to enter the secure state? Third. When Verify Backdoor Access, Reference Manual mention like capture below. Q. 2-2. Does this mean the FSEC register is temporarily changed to the unsecured mode and then restored after reset? On reset, FSEC register (0x40020002) read value from 0x40C again right? Q. 2-3. When this update occurs, is only the security-related bit changed, or is the entire FSEC byte overwritten? For example, is the transition BF → FE or BF → BE? 3. Based on this description, once the keys do not match, the device remains secured until reset. In this situation, if backdoor access is disabled, how can the device be reset? 4. When I execute the following command: Data.Set AD:0x40020000 %Byte 0x30 and then immediately read it back using: Data.Byte(AD:0x40020000) the value still remains 0x80. What could be the reason for this behavior, and what does it mean? ================================================================== So, I think When programming data into the S32K144, the configuration values are written to the 0x400–0x40F region. When the MCU is reset or rebooted, the FTFC registers read the configuration values stored in the 0x400–0x40F region and operate according to those settings. right? Also, the backdoor comparison key appears in startup_S32K144.S, should I understand that the configuration is applied before entering main()? ================================================= Using the address 0x40000100 or 0x40000104 to check the unsecure status. Is this correct? I could not find any related description in the Reference Manual. thank you. #s32k144 @backdoor access Re: Verfiying Backdoor access key using in S32k144 thank you for your support!! Re: Verfiying Backdoor access key using in S32k144 Hi @LGI,
A4 follow up:
At address 0x40020000, the FSTAT register is located. As mentioned previously, this register cannot be written in a way that sets bits from 0 to 1. Writing a ‘1’ to a bit only clears it (W1C – Write‑1‑to‑Clear). Therefore, writing ‘1’ does not set a bit; it only clears bits that are already ‘1’.
A8 follow up:
These are the MDM‑AP status and control registers, which are accessible only through the Arm Debug Access Port (DAP).
For example, it is used in this script:
https://community.nxp.com/t5/S32K-Knowledge-Base/Lauterbach-Script-For-MDM-AP-Mass-erase-S32K142/ta-p/2336449
Regards,
Daniel
Re: Verfiying Backdoor access key using in S32k144 thank you for your answer. @danielmartynek then, I have some question for your answer. A4. I wrote 0x30 to address 0x40020000, but when I read it back, the value did not change to 0x30 and remained 0x80. What could be the reason for this behavior, and what does it mean? Q8. This is actually related to a Trace32 example. In the Trace32 example for the S32K144, addresses 0x40000100 and 0x40000104 are used for security state information. However, I could not find any information about addresses 0x40000100 and 0x40000104. That’s the point I’m asking about. Thank you for your support. Re: Verfiying Backdoor access key using in S32k144 Hi @LGI,
A1:
It is FTFC->FCCOB[0x3] = 0x45; // Backdoor Key Verify command (0x45)
Because FCCOB0 is the 4th register in the memory map.
A2: You can program the Flash Configuration Field using a programmer/debugger, but the sector must be erased beforehand. Note that a mass erase also programs the FSEC byte to the Unsecure state.
A2.1: Yes
A2.2: Yes
A2.3: Only FSEC[SEC].
A3: There are many reset sources on the MCU (RM, 25.2.2 System reset sources).
The debugger can reset the MCU by asserting Reset_b pin (PTA5).
A4: Write to the register has the W1C function only:
Q5: When programming data into the S32K144, the configuration values are written to the 0x400–0x40F region.
A5: Yes
Q6: When the MCU is reset or rebooted, the FTFC registers read the configuration values stored in the 0x400–0x40F region and operate according to those settings.
A6: Yes, the MCU loads the FTFC registers with the values in the Flash configuration field.
Q7: Also, the backdoor comparison key appears in startup_S32K144.S, should I understand that the configuration is applied before entering main()
A7: Reset is required, but this is what the programmer/debugger usually does after programming.
Q8: Using the address 0x40000100 or 0x40000104 to check the unsecure status. Is this correct?
A9: I'm not what you mean. Please elaborate.
Regards,
Daniel
記事全体を表示
