Accessing S32K146 back up again

cancel
Showing results for 
Search instead for 
Did you mean: 

Accessing S32K146 back up again

Jump to solution
363 Views
danielreinwald
Contributor II

We are facing the problem that i cant access the S32K146 on our own hardware anymore.

Here's a quick summary:

- i am using J-Link Ultra+ and Segger J-Flash V7.56

- Because our chips getting locked and mass erase gets disabled during production, i have to completely erase them to use functionalitys like partitioning the eeprom -> This is working fine

The main problem is that i first programmed the chip to test if all is working correctly. After that check i have erased the chip again.

Now there occurred an error during erase and i cant access the S32K chip anymore. Is there any Solution fixing this problem?

 

Here is the log of the J-Flash Software:

Erasing chip ...
- 288 sectors, 2 ranges, 0x0 - 0xFFFFF, 0x10000000 - 0x1000FFFF
- Start of preparing flash programming
- End of preparing flash programming
- Start of determining dirty areas in flash cache
- End of determining dirty areas
- CPU speed could not be measured.
- Chip erase not supported for flash bank @ 0x00000000. Switched to sector erase
- Start of determining dirty areas in flash cache
- End of determining dirty areas
- Start of erasing sectors
- Blank checking 0x00000000 - 0x0001FFFF
- Erasing range 0x00000000 - 0x0001FFFF ( 32 Sectors, 128 KB)
- Blank checking 0x00020000 - 0x0003FFFF
- Blank checking 0x00040000 - 0x0005FFFF
- Blank checking 0x00060000 - 0x0007FFFF
- Blank checking 0x00080000 - 0x0009FFFF
- Blank checking 0x000A0000 - 0x000BFFFF
- Blank checking 0x000C0000 - 0x000DFFFF
- Blank checking 0x000E0000 - 0x000FFFFF
- Blank checking 0x10000000 - 0x1000FFFF
- ERROR: Failed to blank checking.
Failed to execute RAMCode for blank check!
- ERROR: Error while blank checking.
- Erasing range 0x10000000 - 0x1000FFFF ( 32 Sectors, 64 KB)
- ERROR: Failed to erase sectors.
- End of erasing sectors
- ERROR: Erase failed
- Start of restoring
- ERROR: Failed to restore target. RAMCode never stops
- End of restoring
- ERROR: Failed to erase chip
Disconnecting ...
- Disconnected

 


Connecting ...
- Connecting via USB to probe/ programmer device 0
- Probe/ Programmer firmware: J-Link Ultra Rev.1 compiled Dec 3 2013 14:27:53
- Device "S32K146 (ALLOW SECURITY)" selected.
- Target interface speed: 3847 kHz (Fixed)
- VTarget = 5.073V
- InitTarget() start
- InitTarget()
- TotalIRLen = 4, IRPrint = 0x01
- JTAG chain detection found 1 devices:
- #0 Id: 0x0994401D, IRLen: 04, JTAG-DP
- Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.

- Executing default behavior previously saved in the registry.
- Device will be unsecured now.
- Timeout while unsecuring device. Erase never stops.
- InitTarget() end
- TotalIRLen = 4, IRPrint = 0x01
- JTAG chain detection found 1 devices:
- #0 Id: 0x0994401D, IRLen: 04, JTAG-DP
- DPv0 detected
- Scanning AP map to find all available APs
- AP[2]: Stopped AP scan as end of AP map has been reached
- AP[0]: AHB-AP (IDR: 0x24770011)
- AP[1]: JTAG-AP (IDR: 0x001C0000)
- Iterating through AP map to find AHB-AP to use
- AP[0]: Skipped. Invalid implementer code read from CPUIDVal[31:24] = 0x00
- AP[1]: Skipped. Not an AHB-AP
- DPv0 detected
- Scanning AP map to find all available APs
- AP[2]: Stopped AP scan as end of AP map has been reached
- AP[0]: AHB-AP (IDR: 0x24770011)
- AP[1]: JTAG-AP (IDR: 0x001C0000)
- Iterating through AP map to find AHB-AP to use
- AP[0]: Skipped. Invalid implementer code read from CPUIDVal[31:24] = 0x00
- AP[1]: Skipped. Not an AHB-AP
- InitTarget() start
- InitTarget()
- Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.

- Executing default behavior previously saved in the registry.
- Device will be unsecured now.
- Timeout while unsecuring device. Erase never stops.
- InitTarget() end
- TotalIRLen = 4, IRPrint = 0x01
- JTAG chain detection found 1 devices:
- #0 Id: 0x0994401D, IRLen: 04, JTAG-DP
- DPv0 detected
- Scanning AP map to find all available APs
- AP[2]: Stopped AP scan as end of AP map has been reached
- AP[0]: AHB-AP (IDR: 0x24770011)
- AP[1]: JTAG-AP (IDR: 0x001C0000)
- Iterating through AP map to find AHB-AP to use
- AP[0]: Skipped. Invalid implementer code read from CPUIDVal[31:24] = 0x00
- AP[1]: Skipped. Not an AHB-AP
- ERROR: Could not find core in Coresight setup
- ERROR: Failed to connect.
Could not establish a connection to target.

 

Thanks and BR, Daniel

0 Kudos
1 Solution
282 Views
danielreinwald
Contributor II
0 Kudos
6 Replies
283 Views
danielreinwald
Contributor II

https://community.nxp.com/t5/S32K/How-to-unlock-S32K148-Chip/m-p/1204055

Works exactly the same way for the S32K146 MCU.

BR,Daniel

0 Kudos
352 Views
danielmartynek
NXP TechSupport
NXP TechSupport

Hello @danielreinwald,

Is the MCU partitioned for CSEc?

If so, and the MCU was locked, the CSEc engine does not allow Mass erase to unlock the MCU.

Please refer to AN12130 Production Flash Programming Best Practices for S32K1xx
MCUs

3.2.5.2 Mass erase and CSEc considerations

https://www.nxp.com/docs/en/application-note/AN12130.pdf

 

Regards,

Daniel

0 Kudos
333 Views
danielreinwald
Contributor II

Hi @danielmartynek,

Thank you for replying.

No the MCU is not partitioned for CSEc (below my partitoning code).

/* Launch partition code */
params = 0;
memset((void *)&flashCommandBuffer[0], 0x00, sizeof(FLASH_COMMAND_BUFFER_SIZE));

flashCommandBuffer[params++] = 0x80; /* FCCOB0: Selects the PGMPART command */
flashCommandBuffer[params++] = 0x00; /* FCCOB1: CSEc Key Size 0: No space for Keys*/
flashCommandBuffer[params++] = 0x00; /* FCCOB2: SFE */
flashCommandBuffer[params++] = 0x00; /* FCCOB3: FlexRAM loading reset option: 0 - FlexRAM loaded with valid EEPROM */
flashCommandBuffer[params++] = 0x02; /* FCCOB4: EEPROM data set size code: EEESIZE = 2 (4kB) */
flashCommandBuffer[params++] = 0x4; /* FCCOB5: FlexNVM Partition code: DEPART - 64 kB */

flash_command(&flashCommandBuffer[0], params);

while(!Api_EEPROM_Ready());


I was able to connect and completely erase the MCU (with J-Flash). Regarding to AN11983 unsecuring parts of the Chip is working by mass erasing.

danielreinwald_0-1638367103686.png

 

Then i have partitioned it during software tests for using eeprom functionality (on S32DS). Below is my setting of the FTFC Register after partioning. No securitybits gets set.

danielreinwald_0-1638357981121.png

 

I have also checked the flash configuration field, to stay sure, nothing is locked.

danielreinwald_1-1638359653440.png

Today after a checkup with another board and the same test sequence (first connecting, then completely erasing the MCU with J-Flash) i read back the entire chip. That worked fine, but after flashing and partitioning the eeprom of the chip, i cant read back the address space 0x1000 0000 - 0x1000FFFF (same problem as on the log in the first post... he cant black checking the same address space).

After my understand of the AN12130 you have posted (4.2.1) the FlexNVM, which is in the named addressspace above, isn't accessible anymore after partitioning. Applies this also to Jtag operations? Could be an explanation, the J-Link can't erase or blank check this area but not why read protection gets set after my second erase which ended up with errors.

Is there any error in my partitioning code? I want to avoid to lock further chips because of the current market situation and lack of chips.

Is it possible to factory reset the S32K MCUs?

Thanks and BR, Daniel

 

0 Kudos
327 Views
danielmartynek
NXP TechSupport
NXP TechSupport

Hello @danielreinwald,

Yes, that is correct, the FlexNVM address space (EEPROM Backup) is not accessible by any master on the bus. It is visible to the EEPROM state machine only.

The data are accessible in the EEPROM (FlexRAM) once the EEERDY bit is set.

You wrote that you could mass erase the MCUs and unlock it, so I'm not sure what do you mean by factory reset. The partitioning can be removed by mass erase. The MCUs are shipped mass erased and unsecured - the whole flash is blank (all ones) with the exception of FSEC[SEC] in the Flash configuration field.

 

BR, Daniel

0 Kudos
307 Views
danielreinwald
Contributor II

Hello @danielmartynek,

like described i have first completely erased the MCU, what have worked very well. After that i have partitioned the EEPROM and erased the complete MCU again.
After the second erase, which was flawed, i can't connect to the MCU anymore. Below the Log of J-Flash software.

Why it gets set the read protection after second erase? And what does the error "Could not find core in Coresight setup" exactly means (red marked)?

With factory reset i mean if there is any option to erase or rescue the MCU on my board without connecting it with a debugger, because this doesn't work. For example with a special command or something similar?

 

Connecting ...
- Connecting via USB to probe/ programmer device 0
- Probe/ Programmer firmware: J-Link Ultra Rev.1 compiled Dec 3 2013 14:27:53
- Device "S32K146 (ALLOW SECURITY)" selected.
- Target interface speed: 3847 kHz (Fixed)
- VTarget = 5.053V
- InitTarget() start
- InitTarget()
- TotalIRLen = 4, IRPrint = 0x01
- JTAG chain detection found 1 devices:
- #0 Id: 0x0994401D, IRLen: 04, JTAG-DP
- Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.

- Executing default behavior previously saved in the registry.
- Device will be unsecured now.
- Timeout while unsecuring device. Erase never stops.
- InitTarget() end
- TotalIRLen = 4, IRPrint = 0x01
- JTAG chain detection found 1 devices:
- #0 Id: 0x0994401D, IRLen: 04, JTAG-DP
- DPv0 detected
- Scanning AP map to find all available APs
- AP[2]: Stopped AP scan as end of AP map has been reached
- AP[0]: AHB-AP (IDR: 0x24770011)
- AP[1]: JTAG-AP (IDR: 0x001C0000)
- Iterating through AP map to find AHB-AP to use
- AP[0]: Skipped. Invalid implementer code read from CPUIDVal[31:24] = 0x00
- AP[1]: Skipped. Not an AHB-AP
- DPv0 detected
- Scanning AP map to find all available APs
- AP[2]: Stopped AP scan as end of AP map has been reached
- AP[0]: AHB-AP (IDR: 0x24770011)
- AP[1]: JTAG-AP (IDR: 0x001C0000)
- Iterating through AP map to find AHB-AP to use
- AP[0]: Skipped. Invalid implementer code read from CPUIDVal[31:24] = 0x00
- AP[1]: Skipped. Not an AHB-AP
- InitTarget() start
- InitTarget()
- Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.

- Executing default behavior previously saved in the registry.
- Device will be unsecured now.
- Timeout while unsecuring device. Erase never stops.
- InitTarget() end
- TotalIRLen = 4, IRPrint = 0x01
- JTAG chain detection found 1 devices:
- #0 Id: 0x0994401D, IRLen: 04, JTAG-DP
- DPv0 detected
- Scanning AP map to find all available APs
- AP[2]: Stopped AP scan as end of AP map has been reached
- AP[0]: AHB-AP (IDR: 0x24770011)
- AP[1]: JTAG-AP (IDR: 0x001C0000)
- Iterating through AP map to find AHB-AP to use
- AP[0]: Skipped. Invalid implementer code read from CPUIDVal[31:24] = 0x00
- AP[1]: Skipped. Not an AHB-AP
- ERROR: Could not find core in Coresight setup
- ERROR: Failed to connect.
Could not establish a connection to target.

 

Thanks for your help and BR, Daniel

0 Kudos
279 Views
danielmartynek
NXP TechSupport
NXP TechSupport

Hello @danielreinwald,

You can use j-link commander and read the MDM-AP Status register.

Then you can try running the Unlock Kinetis command with reset_b pin connected to the ground after power-on reset as discussed here:

https://community.nxp.com/t5/S32K/Unbricking-S32K146/m-p/937227

 

Regards,

Daniel

0 Kudos