Unlock flash on S32K144W from firmware

[kdc]

Hello there,

We are using a S32K144W. Every time we do a power cycle and want to connect our j-link we have to unlock and erase it.

JLink.exe -device S32K144W -if SWD -speed auto -IP 192.168.2.XXX
> connect
> unlock Kinetis
> erase
> exit

We would like to avoid this by doing this from the C-code running on the MCU.
We're using S32 SDK for S32K1xx v4.0.2.
I thought this could be done the following way:

static void unlock_flash(void)
{
flash_ssd_config_t flash_ssd_config;
const flash_user_config_t flash_init_config = {
.PFlashBase = 0x0U,
.PFlashSize = 0x80000U,
.DFlashBase = 0x10000000U,
.EERAMBase = 0x14000000U,
.CallBack = NULL_CALLBACK };
DEV_ASSERT(STATUS_SUCCESS == FLASH_DRV_Init(&flash_init_config, &flash_ssd_config));
const uint8_t key[] = {
2, 2, 2, 2, 2, 2, 2, 2,
};
DEV_ASSERT(8 == sizeof(key));
uint32_t ret = FLASH_DRV_SecurityBypass(&flash_ssd_config, key);
DEV_ASSERT(STATUS_SUCCESS == ret);
}

However, the FLASH_DRV_SecurityBypass returns STATUS_ERROR.
I couldn't find any example of how to use this function.
Can someone help me?

Best regards,

K.

[kdc]

Hi,

Yes, I have changed the startup file:

I also verified via gdb that this value is correctly loaded:

Can you confirm that the FLASH_DRV_SecurityBypass function allows me to connect with my debugger and reprogram the MCU?

[danielmartynek]

Hi @kdc,

You did not enable the backdoor key function in FSEC.

It should be something like this

.long 0xFFFF7FBF     /* FDPROT:FEPROT:FOPT:FSEC(0xBF = Backdoor key enabled, mass erese enabled, MCU secured)*/

The FLASH_DRV_SecurityBypass() then unlocks the MCU on a match.

And the MCU stays unlocked until it is reset.

The J-link must not reset the MCU, this would lock the MCU again.

A special J-link script is necessary, which can be found here:

https://wiki.segger.com/S32Kxxx#Attach_to_debug_session

J-Link commander has to be called in the following way:
C:\Programme\SEGGER\JLink\JLink.exe -JLinkScriptFile NXP_Kinetis_S32_Attach.JLinkScript

Then the MCU is not reset and access to all the memory and registers is possible.

Please contact SEGGER support if you need more information.

Thank you,

BR, Daniel

[danielmartynek]

Hi @kdc,

Is the key programed at 0x400?

startup_S32K144W.S

Regards,

Daniel