Recovering from constant reset issue on s32k148evb

[harish_cont41]

Hi experts,

I have s32k148evb board where erase failed using J-Link and the reset led is constantly blinking. which means it is in constant reset. This is causing the issue of not able to be connected to the target either through segger or OpenSDA channels. Can you help me recover from this? Is there any utility that can be tried to program on this evb board? Kindly help me. This is the only board we have and the issue is urgent.

I tried J-LInk commander to issue to halt, reset etc commands but failed. I also tried Kinetis Recovery Utility but the USB connection is not recognized. Also when I connect the board with segger it shows red led blinking which means its not working properly. I cannot reflash any bootloader or application with this conditions. Kindly help me.

Harish.

[danielmartynek]

Hi Harish,

Please try the Unlock Kinetis command and keep the MCU in reset externally,

as it was discussed here:

https://community.nxp.com/t5/S32K/Unbricking-S32K146/m-p/937227

Thanks,

Daniel

[harish_cont41]

Hi Daniel,

I tried the steps that are mentioned in the link. Is the 3.5-3.11 connection is necessary and is it the same for S32K148EVB also. Please clarify this. Without this connection also my commands are as below:

J-Link>r0
J-Link>swdwritedp 2,0x01000000
Write DP register 2 = 0x01000000
J-Link>swdreadap 0
Read AP register 0 = 0x00000000
J-Link>swdreadap 0
Read AP register 0 = 0x00000000
J-Link>swdreadap 0
Read AP register 0 = 0x00000000
J-Link>swdreadap 0
Read AP register 0 = 0x00000000
J-Link>swdreadap 1
Read AP register 1 = 0x00000000
J-Link>swdreadap 1
Read AP register 1 = 0x00000000
J-Link>swdreadap 1
Read AP register 1 = 0x00000000
J-Link>swdreadap 1
Read AP register 1 = 0x00000000
J-Link>swdwriteap 1,0x1
Write AP register 1 = 0x00000001
J-Link>unlock Kinetis
Found SWD-DP with ID 0x2BA01477
Unlocking device...O.K.
J-Link>swdwriteap 1,0x1
Write AP register 1 = 0x00000001

And when I tried connecting, I am still not able to connect to the target. Do I need to hold the reset button for a long time or is it fine to issue the connect command as my previous  unlock kinetis worked fine. Please clarify.

This the connect command result on my connection to the target S32K148EVB:

J-Link>connect
Device "S32K148" selected.

Connecting to target via SWD
InitTarget() start
InitTarget()
Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.
Executing default behavior previously saved in the registry.
Device will be unsecured now.
Timeout while halting CPU.
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPIDR: 0x2BA01477
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x001C0000)
Iterating through AP map to find AHB-AP to use
AP[0]: Skipped. Could not read CPUID register
AP[1]: Skipped. Not an AHB-AP
InitTarget() start
InitTarget()
Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.
Executing default behavior previously saved in the registry.
Device will be unsecured now.
Timeout while halting CPU.
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPIDR: 0x2BA01477
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x001C0000)
Iterating through AP map to find AHB-AP to use
AP[0]: Skipped. Could not read CPUID register
AP[1]: Skipped. Not an AHB-AP

****** Error: Could not find core in Coresight setup

InitTarget() start
InitTarget()
Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.
Executing default behavior previously saved in the registry.
Device will be unsecured now.
Timeout while halting CPU.
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPIDR: 0x2BA01477
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x001C0000)
Iterating through AP map to find AHB-AP to use
AP[0]: Skipped. Could not read CPUID register
AP[1]: Skipped. Not an AHB-AP
InitTarget() start
InitTarget()
Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.
Executing default behavior previously saved in the registry.
Device will be unsecured now.
Timeout while halting CPU.
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPIDR: 0x2BA01477
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x001C0000)
Iterating through AP map to find AHB-AP to use
AP[0]: Skipped. Could not read CPUID register
AP[1]: Skipped. Not an AHB-AP

****** Error: Could not find core in Coresight setup

Cannot connect to target.
J-Link>

Please help me sir, this board was replaced recently and we run into another issue here.

BTW, reset led is constantly on, how can I reset this reset register to something which can help me to make a connection to the target. Can this be done by Jlink. As of now J-link Lite also not able  to connect to the target.

thanks & regards,

Harish.

[danielmartynek]

Hi Harish,

Please connect the reset pin (PTA5 - J3.7 to GND - J3.19) and power cycle the MCU, so that the MCU is kept in reset out POR. And use only the Unlock kinetis command, after that please read the registers again.

But it is strange that the J-link commander says the MCU is secure and yet a read of the MDM-AP Status register returns 0x00000000.

The MCU is periodically resetting itself due to core lockups since there is no code to be executed.

Was the MCU partitioned for CSEc before the failure?

If so, the MCU cannot be mass erased.

AN12130, Production Flash Programming Best Practices for S32K1xx MCUs

https://www.nxp.com/docs/en/application-note/AN12130.pdf

3.2.5.2 Mass erase and CSEc considerations

Thank you,

Regards,

Daniel

[harish_cont41]

Hi Daniel,

I connected J3.7 to J3.19 tried resetting but the reset Led continued to glow. And the unlock Kinetis went fine. But the readind the AP registers are as below:

J-Link>r0
J-Link>unlock Kinetis
Found SWD-DP with ID 0x2BA01477
Unlocking device...O.K.
J-Link>swdwritedp 2,0x01000000
Write DP register 2 = 0x01000000
J-Link>swdreadap 0
Read AP register 0 = 0x00000000
J-Link>swdreadap 0
Read AP register 0 = 0x00000037
J-Link>swdreadap 1
Read AP register 1 = 0x00000037
J-Link>swdreadap 1
Read AP register 1 = 0x00000000
J-Link>swdwriteap 1,0x1
Write AP register 1 = 0x00000001
J-Link>connect
Please specify device / core. <Default>: S32K148
Type '?' for selection dialog
Device>S32K148
Please specify target interface:
J) JTAG (Default)
S) SWD
T) cJTAG
TIF>S
Specify target interface speed [kHz]. <Default>: 4000 kHz
Speed>100
Device "S32K148" selected.

Connecting to target via SWD
InitTarget() start
InitTarget()
Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.
Executing default behavior previously saved in the registry.
Device will be unsecured now.
Timeout while halting CPU.
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPIDR: 0x2BA01477
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x001C0000)
Iterating through AP map to find AHB-AP to use
AP[0]: Skipped. Could not read CPUID register
AP[1]: Skipped. Not an AHB-AP
InitTarget() start
InitTarget()
Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.
Executing default behavior previously saved in the registry.
Device will be unsecured now.
Timeout while halting CPU.
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPIDR: 0x2BA01477
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x001C0000)
Iterating through AP map to find AHB-AP to use
AP[0]: Skipped. Could not read CPUID register
AP[1]: Skipped. Not an AHB-AP

****** Error: Could not find core in Coresight setup

InitTarget() start
InitTarget()
Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.
Executing default behavior previously saved in the registry.
Device will be unsecured now.
Timeout while halting CPU.
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPIDR: 0x2BA01477
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x001C0000)
Iterating through AP map to find AHB-AP to use
AP[0]: Skipped. Could not read CPUID register
AP[1]: Skipped. Not an AHB-AP
InitTarget() start
InitTarget()
Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.
Executing default behavior previously saved in the registry.
Device will be unsecured now.
Timeout while halting CPU.
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPIDR: 0x2BA01477
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x001C0000)
Iterating through AP map to find AHB-AP to use
AP[0]: Skipped. Could not read CPUID register
AP[1]: Skipped. Not an AHB-AP

****** Error: Could not find core in Coresight setup

Cannot connect to target.

I really not able to do away with this problem. To reprogram I can neither connect nor I can erase.

Is the board bricked or any other steps I can try to recover the board. Also let me know if the connecting J3.7 to 3.19 is correct. Because I read online that 3.19 is not GND. Please help.

I am working on S32K148EVB.

regards,

Harish.

[danielmartynek]

Hi Harish,

Please don't trigger the mass erase again after the successful Unlock Kinetis command.

Remove this:  J-Link>swdwriteap 1,0x1

Actually, the MCU needs to be released from the system reset so that the new unlocked configuration can be loaded to the FSEC register.

1. connect the reset pin to the ground - it is J3.7 -> J3.19, please see that attached schematic.

2. power cycle the MCU

3. use Unlock Kinetis

4. release the reset pin

5. try to load a new application.

Thank you,

Daniel

[harish_cont41]

Hi Daniel,

I tried the steps you sent. But i couldnt load the application onto the board as I was again unable to connect to the board. My observations are as follow:

J-Link>r0
J-Link>swdwritedp 2,0x01000000
Write DP register 2 = 0x01000000 ***ERROR
J-Link>unlock Kinetis
Found SWD-DP with ID 0x2BA01477
Unlocking device...O.K.
J-Link>swdwritedp 2,0x01000000
Write DP register 2 = 0x01000000
J-Link>swdreadap 0
Read AP register 0 = 0x00000000
J-Link>swdreadap 0
Read AP register 0 = 0x00000035
J-Link>swdreadap 1
Read AP register 1 = 0x00000035
J-Link>swdreadap 1
Read AP register 1 = 0x00000000
J-Link>connect
Please specify device / core. <Default>: S32K148
Type '?' for selection dialog
Device>S32K148
Please specify target interface:
J) JTAG (Default)
S) SWD
T) cJTAG
TIF>S
Specify target interface speed [kHz]. <Default>: 4000 kHz
Speed>100
Device "S32K148" selected.

Connecting to target via SWD
InitTarget() start
InitTarget()
Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.
Executing default behavior previously saved in the registry.
Device will be unsecured now.
Timeout while halting CPU.
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPIDR: 0x2BA01477
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x001C0000)
Iterating through AP map to find AHB-AP to use
AP[0]: Skipped. Could not read CPUID register
AP[1]: Skipped. Not an AHB-AP
InitTarget() start
InitTarget()
Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.
Executing default behavior previously saved in the registry.
Device will be unsecured now.
Timeout while halting CPU.
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPIDR: 0x2BA01477
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x001C0000)
Iterating through AP map to find AHB-AP to use
AP[0]: Skipped. Could not read CPUID register
AP[1]: Skipped. Not an AHB-AP

****** Error: Could not find core in Coresight setup

InitTarget() start
InitTarget()
Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.
Executing default behavior previously saved in the registry.
Device will be unsecured now.
Timeout while halting CPU.
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPIDR: 0x2BA01477
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x001C0000)
Iterating through AP map to find AHB-AP to use
AP[0]: Skipped. Could not read CPUID register
AP[1]: Skipped. Not an AHB-AP
InitTarget() start
InitTarget()
Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.
Executing default behavior previously saved in the registry.
Device will be unsecured now.
Timeout while halting CPU.
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPIDR: 0x2BA01477
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x001C0000)
Iterating through AP map to find AHB-AP to use
AP[0]: Skipped. Could not read CPUID register
AP[1]: Skipped. Not an AHB-AP

****** Error: Could not find core in Coresight setup

Cannot connect to target.
J-Link>

I tried connecting J3.7->3.19 and issued unlock kinetis which worked fine. But at the end I couldnt connect. Is it like the board is completely bricked or any other means of recovering from this?

regards,

Harish.

[danielmartynek]

Hi Harish,

Are you sure the MCU hasn't been partitioned for CSEc?

For example the SDK flexcan_encrypted example uses CSEc, and once the keys are allocated, the MCU cannot be mass erased even if Mass erase is enabled in the MDM-AP Status register until the keys are removed - and that is not possible anymore if the MCU gets accidentally locked.

Regards,

Daniel