S32K3 JTAG Password Protection

[ASN7]

MCU: S32K314

RTD: 3.0

HSE_B : For S32K3X4 - v0.2.1.0

I am try to password protect my JTAG on the board using HSE(I am not using Challenge/Response).

These are the steps that I am following:

1. Read the HSE Version to make sure it is active. 

SOC Type ID= 5, Major Version= 2, Minor Version=1

HSE Response = 0x55a5aa33 = Success

2. Read the current lifecycle. 

Current LC = 0x4 = HSE_LC_CUST_DEL

HSE Response = 0x55a5aa33 = Success

3. Check if HSE_APP_DEBUG_KEY_ATTR_ID is already set.

I do not get HSE_SRV_RSP_NOT_ALLOWED, which means ADKP is set. 

HSE Response = 0x55a5aa33 = Success

4. If not set, then Set up the ADKP.

5. Check if debug auth mode set to password mode 

I see 0x00 which is HSE_DEBUG_AUTH_MODE_PW. 

6. I advance the Lifecycle. 

    hseAttrSecureLifecycle_t programLC = HSE_LC_SIMULATED_OEM_PROD;

    HSE_AdvanceLifecycle(programLC);

In this step, I get this error: 0xAA55A21CUL = HSE_SRV_RSP_NOT_ALLOWED = The operation is not allowed because of some restrictions (in attributes, life-cycle dependent operations, key-management, etc.) */

And the program is now stuck in  ASSERT(HSE_SRV_RSP_OK == srvResponse);. 

What is it that is causing the issue ? I tried to change the lifecycle to HSE_LC_IN_FIELD, HSE_LC_OEM_PROD and even HSE_LC_SIMULATED_OEM_PROD (which is what I want). But all of them throw the same error. I have set everything that is needed. 

[davidtosenovjan]

This procedure seems to be right. Question is how it is actually done.

Which example code are you based on?

[ASN7]

I created a new project just to test locking of JTAG and all my reference have been from S32K344_DemoAppTemplate. 

I have copied the files and functions from S32K344_DemoAppTemplate\services\src\fw_attribute\otp\hse_debug_auth_mode.c. 

[davidtosenovjan]

Don't you have set CUST_START_AS_USER what would lead in having User rights after reset?

[kerti1]

Thanks for the reply. If user rights set CUST_START_AS_USER then it won't be able to change the LC and also cannot format the keycatalogs. Even If the LC is changed to SIMULATED_OEM using super user rights. The JTAG is not getting locked