S32K146 Unsecuring Problem

[wane]

Hello.

Can anyone help for unsecure my board?

I had erased all flash blocks using SDK driver function FLASH_DRV_EraseAllBlock().

After this job, I can't access to MCU resources using JTAG connection.

Hence I tried to mass erase using MDM-AP as follows but I didn't get success.

1) MDM-AP Status Read after power on reset

 Two values of 0x34 and 0x36 are repeated. It seems the Flash Memory Ready bit is changing.

2) MDM-AP Status Read after mass erase request

 Two values of 0x35 and 0x37 are repeated. It also seems the Flash Memory Ready bit is changing.

3) Mass Erase Step

- WHILE (Data.Long(EDBG:0x40000100)&0x02)!=0x02 {} // wait flash ready

- Data.Set EDBG:0x40000104 %long 0x1               // mass erase

- WHILE (Data.Long(EDBG:0x40000104)&0x01)==0x01 {} // wait mass erade done

- Data.Set EDBG:0x40000104 %long 0x18              // system reset

4) Test of Mass Erase on normal unsecured board

 I have checked upper 3) Mass Erase Step works well.

Best Regards,

J.W.Park

[wane]

Hi Daniel,

Thanks for your information.

I'll try again with your suggestion.

Regards,

[danielmartynek · Accepted solution]

Hi @wane,

The FLASH_DRV_EraseAllBlock() always puts the MCU in the secure state. The flash operation could have failed and it could left the flash in an undefined state with ECC errors.

In case the FlexNVM was partitioned with CSEC keys allocated, the Mass erase will be blocked by the engine regardless of the MDM-AP Status[Flash ready].

Have you tried erasing the MCU while it is in reset? After power-on reset keep PTA5 (reset_b) connected to the ground externaly? If this does not resolve it, I'm afraid there is nothing we can do.

Regards,

Daniel