S32K3 - Read back JTAG restrict flag

[ssean]

Dear @VaneB 

Hello.

I will test restrict JTAG debug according to below article.

https://community.nxp.com/t5/S32K-Knowledge-Base/S32K3-Restrict-the-debug-access-with-a-password-whe...

Is there any solution to read back JTAG restrict or not in program without try JTAG attach?

I have to communication between tester(PC) and DUT(S32K3) about JTAG restrict status using UART.

Best Regards,

Suhyun Sung

[ssean]

Dear @VaneB 

Thanks a lot!

This is my last question maybe...

I set JTAG restrict follow your example, it works well.

(JTAG attached failed after set restrict)

But my debugger (Trace32) can't unlock use KEYCODE command.

Could you help how can I unlock with Trace32 ?

1. Set JTAG restrict

2. KEYCODE command in Trace32

- try 1: sys.Option.KEYCODE 0x03020100 0x07060504 0x0b0a0908 0x0f0e0d0c

- try 2: sys.Option.KEYCODE 0x00010203 0x04050607 0x08090a0b 0x0c0d0e0f

- sys.attach or sys.up

* Trace32 KEYCODE command

Best Regards,

Sean Sung.

[VaneB]

Hi @ssean 

With the HSE Demo App, script .cmm to unlock the device is provided.

[ssean]

Dear @VaneB 

Thank you.

Demo script works well.

Best Regards,

Sean Sung

[VaneB]

Hi @ssean 

Could you please explain what you mean by "read back JTAG restrict or not in program without try JTAG attach"?

B.R.

VaneB

[ssean]

Dear @VaneB 

Can you check one more question?

According to your knowledge, JTAG restrict flow is below.

1. Program password to CUST_DB_PSWD_A

2. Advance the MCU's lifecycle

  2-a. Set LC_CONFIG_ADDR in IVT

  2-b. Program DADA_DADAh to LC_CONFIG_ADDR

3. Reset

Q1. After then, if I erase LC_CONFIG_ADDR, is that make problem ?

Q2. If I erase LC_CONFIG_ADDR, how can I read current life cycle?

Best Regards,

Sean Sung.

[VaneB · Accepted solution]

Hi @ssean 

How can I check whether the JTAG restriction is set or not?
If it is correctly configured the CUST_DB_PSWD_A and, the LC was advanced to OEM_PROD or IN_FIELD. You should not be able to connect the debugger unless you unlock the MCU with the steps mentioned in the post.

Is there any register for JTAG restrict status?
No

Can I read the CUST_DB_PSWD_A value in the program code?
It is possible to read the password in code but the MCU should be unlocked.

After that, if I erase LC_CONFIG_ADDR, is there a problem?
It should not be any problem, because LC has already changed.

If I erase LC_CONFIG_ADDR, how can I read the current life cycle?
Please refer to section 39.3.3 (LC and LC Control (DCMLCC)) of the S32K3xx Reference Manual, Rev. 8.

[ssean]

Dear @VaneB 

Thank you for your support.

I read DCMLCC, it like below.

What mean is 0x3 value? 

There is no 0x3 in Reference Manual.

 

Best Regards,

Sean Sung

[VaneB]

Hi @ssean 

Your device shows a 011b, which means it is at the CUST_DEL LC stage.

[ssean]

Hello @VaneB .

I means... How can I check JTAG restrict set or not set ?

Is there any register for JTAG restrict status?

Or can I read CUST_DB_PSWD_A value in program code ?

Can I use like below ?

pseudo:
if( read(CUST_DB_PSWD_A) == MY_PASSWD && read(LC_CONFIG_ADDR) == OEM_PROD )
{
  return JTAG_RESTRICT
}
else
{
  return JTAG_OPEN
}