S32k142 Device is Secure

[ev1]

Good Morning,

Yesterday I received an S32k142 microcontroller. I flashed in some example code using OpenSDA debugger provided by S32DS IDE. I debugged it several times, and since everything was working like it was expected I took a break. When I was back I tried to connect with the debugger without changing the code. The IDE shows me a window with the following error message: Device is permanently secured (Mass Erase is Disabled). Try to unsecure anyways?. 
Since then, even if I answer "Yes" the popup is just shown once more. I also tried to enable  Emergency Kinetis Device Recovery by full chip erase but I still cannot connect debugger to the board even if the debugger shows the correct serial number for it.

Thanks in advance for your help

[danielmartynek]

Helloev@drivesec.com,

The debugger reads the MDM-AP Status register.

And since it is reporting that Mass erase is disabled, it cannot mass erase the MCU by setting the MDM-AP Control[0] bit. I'm afraid that it cannot be unlocked.

AN12130 Production Flash Programming Best Practices for S32K1xxMCUs

[firmsol]

Hello @danielmartynek, & @lukaszadrapa   

I am using S32K142 controller for our hardware. We have secured it with FSEC register with MEEN bit enabled. however, unable to perform mass erase with S32k.cmm mentioned in Solved: In s32k118 Cant write FSEC bit Setting using T32 - NXP Community script using lauterbach. when tried system.up command "bus error generated by CPU" is thrown.

When MDM-AP register is read using lauterbach debugger. The value is 0x7F. Can you help me how to perform mass erase?
FYI, debug interface is SWD

Thanks in advance

[danielmartynek]

Hi @firmsol,

Can you create a new thread?

Thank you

[dirkakemann]

Hello Daniel,

Reports from NXP FAEs tell me, that you should be able to unsecure the device still using a J-Link. One option would be to make your OpenSDA probe a J-Link as shown here: https://www.segger.com/products/debug-probes/j-link/models/other-j-links/opensda-sda-v2/ 

As I work for SEGGER, naturally I would prefer if you bought a J-Link PLUS, which provides an even better experience with higher JTAG clocks that can be used, unlimited breakpoints in flash memory (even in external NOR flash), license to use Ozone the J-Link debugger and performance analyser and more.

For a J-Link model overview please visit: https://www.segger.com/products/debug-probes/j-link/models/model-overview/ 

Best regards,
Dirk Akemann

[danielmartynek]

Hello Dirk,

To my knowledge, with SEGGER probes (unlike OpenSDA) we can read the MDM-AP Status register to see what is the state of the security and whether Mass Erase is enabled or not.

But in this case, if the OpenSDA debugger is reporting it correctly and Mass Erase is indeed disabled, we cannot unlock the MCU.

Regards,

Daniel   

[dirkakemann]

Hi Daniel,

I have verified this with one of your colleagues. Actually the old Kinetis devices could only be unlocked by J-Link in a certain state, so I sort of expected, that this is true for the S32K as well. With the S32K it seems indeed, that in the state mentioned above

The only chance for unlocking is using the backdoor key access method if the user has it enabled and implemented in sw.   

I hope I have not confused too many people.

Best regards,
Dirk