s32k144

[soulyoung]

Hello, I would like to ask  questions.

1.Regarding whether the device can be restored to its factory settings and the strict sequential startup mode can be canceled through the CMD_SBG_CAL and CMD_SBG_SUTH commands after enabling strict sequential startup, I see that strict sequential startup is irreversible. And the condition for restoring factory settings is whether there is a write protected key, so I would like to confirm.

2.I am currently disabling mass erase and enabling SEC and enabling the backdoor, and the program has passed the backdoor key verification. How can I simulate the program through Keil now, because I found that the simulation prompts a failure and cannot connect to the chip. If I temporarily unlock SEC, how should I connect to the device through jlink, preferably with Keil simulation program

[lukaszadrapa · Accepted solution]

Hi @soulyoung 

1. If you configure strict sequential secure boot mode or if there's write protected key, it's not possible get back to factory state.

2. The key point is that you need to attach the debugger without reset because unsecuring via backdoor is temporary only and the device is secured again after next reset. For example, when Pemicro debug probe is used in S32DS, it can be done like this:

https://community.nxp.com/t5/S32-Design-Studio/How-attach-to-running-program/m-p/1030376/highlight/t...

If a debugger from Lauterbach is used, you can use command sys.attach.

Not sure about Keil, please contact their support directly.

Regards,

Lukas

[soulyoung]

It seems that the inability to stop the CPU caused the burn failure, How to burn the program like this,Looking forward to your answer

[lukaszadrapa]

The device is still running after "hot attach". It's necessary to stop execution and then you can run flash scripts. But everything depends on used tools...

Another option is to do the "hot attach", then stop the execution and then just write manually to flash registers to erase the first sector and then program the flash configuration field back to unsecured state. Something like this (example only, it programs different addresses), just run the same procedure manually by your debugger:

[soulyoung]

Thank you very much for your answer. I have another question on my end. After temporarily releasing the SEC, can I rewrite the app code (such as placing the app address at 0x4000) and how can I do it