S32KのトピックRe: S32K148 Unsecurity

S32K148 Unsecurity

zhigang — Mon, 02 Nov 2020 05:42:57 GMT

Hi all,

I found my s32k148 chip is security.I reset the chip and use j-link commander to unlock kinetis,but it doesn't work.How can I unsecure the chip? Expect your answer.Thanks a lot.

Re: S32K148 Unsecurity

Robin_Shen — Tue, 03 Nov 2020 04:12:58 GMT

Hi zhigang,

Would you please show the image of "unlock kinetis" in J-Link Commander?

If Mass erase is enabled, you should be able to "unlock kinetis" in J-Link Commander.

Have you modify the value of Flash Configuration?

Please check the connection between S32K148 and J-Link. Are you using S32K148EVB or custom board?

Best Regards,
Robin
-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!

- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------

Re: S32K148 Unsecurity

zhigang — Tue, 03 Nov 2020 08:51:34 GMT

Hi,Robin

Thank you for your reply.

First of all, I finished the "unlock kinetis",and it showed "OK".Then, I do not know the Mass erase is enabled or not.If Mass erase is disabled,what should I do.At last, the connection between S32K148 and J-Link is OK,and the schematic diagram is the same as yours.Looking forward to your reply.

Best Regards,

Zhigang

Re: S32K148 Unsecurity

Robin_Shen — Wed, 04 Nov 2020 03:52:43 GMT

Could you please try to read the MDM_AP status and control registers first.
Use J-link commander and these commands:

J-Link>r0                      // pull reset pin low

J-Link>swdwritedp 2,0x01000000 // MDM_AP status register

J-Link>swdreadap 0      // Read MDM_AP status register
J-Link>swdreadap 0      // Read MDM_AP status register (has to be done 2x) Flash memory ready and Mass erase enable bits should be set

J-Link>swdreadap 1      // Read MDM_AP control register
J-Link>swdreadap 1      // Read MDM_AP control register (has to be done 2x) 

J-Link>unlock Kinetis   // Erase and unsecure the MCU

//J-Link>swdwriteap 1,0x1 // Launch mass erase directly, set Control[0] = 1
 ‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

For more information about the register please refer to Section 56.6 MDM-AP status and control registers, S32K1xx MCU Family - Reference Manual ^{(REV 12.1)}.

You should be able to see if the MCU secured (Status[2]), if the Mass Erase operation is enabled (Status[5]) and if the Flash memory is ready (Status[1]).

Re: S32K148 Unsecurity

zhigang — Fri, 13 Nov 2020 07:38:39 GMT

Hi Robin_Shen,

Below is my jlink trace.But it doesn't work.

J-Link>R0
J-Link>swdwritedp 2, 0x1000000
Write DP register 2 = 0x01000000
J-Link>swdreadap 0
Read AP register 0 = 0x00000000
J-Link>swdreadap 0
Read AP register 0 = 0x00000037
J-Link>swdreadap 1
Read AP register 1 = 0x00000037
J-Link>swdreadap 1
Read AP register 1 = 0x00000000
J-Link>unlock Kinetis
Found SWD-DP with ID 0x2BA01477
Unlocking device...O.K.
J-Link>swdwriteap 1,0x1
Write AP register 1 = 0x00000001
J-Link>

Re: S32K148 Unsecurity

rvalente — Mon, 14 Dec 2020 19:10:22 GMT

Hello,

i've facing the very same problem.

Suddenly S32DS started to give a pop-up to unsecure the device.
I've tried many things, emergency recover with kinetis, nothing
Changed my openSDA from PEMicro to Segger
Tried to do this mass erase j-link and the suggest and after that I can't connect or I'm doing wrongly

Type "connect" to establish a target connection, '?' for help J-Link>device S32K144 J-Link>connect Please specify target interface: J) JTAG (Default) S) SWD T) cJTAG TIF>S Specify target interface speed [kHz]. <Default>: 4000 kHz Speed> Device "S32K144" selected. Connecting to target via SWD InitTarget() start InitTarget() Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set. For debugger connection the device needs to be unsecured. Note: Unsecuring will trigger a mass erase of the internal flash. Executing default behavior previously saved in the registry. Device will be unsecured now. Timeout while halting CPU. InitTarget() end Found SW-DP with ID 0x2BA01477 DPv0 detected Scanning AP map to find all available APs AP[2]: Stopped AP scan as end of AP map has been reached AP[0]: AHB-AP (IDR: 0x24770011) AP[1]: JTAG-AP (IDR: 0x001C0000) Iterating through AP map to find AHB-AP to use AP[0]: Skipped. Invalid implementer code read from CPUIDVal[31:24] = 0x00 AP[1]: Skipped. Not an AHB-AP InitTarget() start InitTarget() Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set. For debugger connection the device needs to be unsecured. Note: Unsecuring will trigger a mass erase of the internal flash. Executing default behavior previously saved in the registry. Device will be unsecured now. Timeout while halting CPU. InitTarget() end Found SW-DP with ID 0x2BA01477 DPv0 detected Scanning AP map to find all available APs AP[2]: Stopped AP scan as end of AP map has been reached AP[0]: AHB-AP (IDR: 0x24770011) AP[1]: JTAG-AP (IDR: 0x001C0000) Iterating through AP map to find AHB-AP to use AP[0]: Skipped. Invalid implementer code read from CPUIDVal[31:24] = 0x00 AP[1]: Skipped. Not an AHB-AP ****** Error: Could not find core in Coresight setup InitTarget() start InitTarget() Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set. For debugger connection the device needs to be unsecured. Note: Unsecuring will trigger a mass erase of the internal flash. Executing default behavior previously saved in the registry. Device will be unsecured now. Timeout while halting CPU. InitTarget() end Found SW-DP with ID 0x2BA01477 DPv0 detected Scanning AP map to find all available APs AP[2]: Stopped AP scan as end of AP map has been reached AP[0]: AHB-AP (IDR: 0x24770011) AP[1]: JTAG-AP (IDR: 0x001C0000) Iterating through AP map to find AHB-AP to use AP[0]: Skipped. Invalid implementer code read from CPUIDVal[31:24] = 0x00 AP[1]: Skipped. Not an AHB-AP InitTarget() start InitTarget() Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set. For debugger connection the device needs to be unsecured. Note: Unsecuring will trigger a mass erase of the internal flash. Executing default behavior previously saved in the registry. Device will be unsecured now. Timeout while halting CPU. InitTarget() end Found SW-DP with ID 0x2BA01477 DPv0 detected Scanning AP map to find all available APs AP[2]: Stopped AP scan as end of AP map has been reached AP[0]: AHB-AP (IDR: 0x24770011) AP[1]: JTAG-AP (IDR: 0x001C0000) Iterating through AP map to find AHB-AP to use AP[0]: Skipped. Invalid implementer code read from CPUIDVal[31:24] = 0x00 AP[1]: Skipped. Not an AHB-AP ****** Error: Could not find core in Coresight setup Cannot connect to target. J-Link>r0 J-Link>swdwritedp 2,0x01000000 Write DP register 2 = 0x01000000 J-Link>swdreadap 0 Read AP register 0 = 0x00000000 J-Link>swdreadap 0 Read AP register 0 = 0x00000037 J-Link>swdreadap 1 Read AP register 1 = 0x00000037 J-Link>swdreadap 1 Read AP register 1 = 0x00000000 J-Link>unlock Kinetis Found SWD-DP with ID 0x2BA01477 Unlocking device...O.K. J-Link>swdwriteap 1,0x1 Write AP register 1 = 0x00000001 J-Link>