S32K144 EVB can't connect. Is MCU secured?

[rvalente]

Hello Mates,

I'm just getting started with S32K144, tried a few examples and was trying do test my own blink before migrating a application.

Suddenly i've got the loop "Device is secure. Erase to insecure"?

The PEMicro openSDA is "ready" at application version 1.19 and bootloader 1.13
When I power up the EVB the reset pulses every 512uS.

When I try to debug/connect with S32DS (just to flash a hello world from examples) the reset stops pulsing after the first debugger connection and stays @0.4V or so.

I do not yet have a pemicro multilink or a segger j-link just the openSDA from the board (i've a st-link but do not believe is useful)

I've not masse with secure bits and nothing like that (AFAIK)

So, what could I do to get back to program?

Is the micro secured? Is the openSDA damaged? 

Greetings

[petervlna]

Hello,

Which example codes do you loaded into the device? Any for CSEc?

I am afraid that it is not possible to get from this state with OpenSDA.

The device will secure, when  the device is erased with SEC=secured and then there is no pointer in reset vector.

please see chapter 5 of:

https://www.nxp.com/docs/en/application-note/AN12130.pdf

best regards,

Peter

[rvalente]

Hello,

i was testing just simple examples, like hello words, read adc, blink leds and so on.
I've tried to do my simple blink led, I may've not configured the reset gpio as reset.

I've never tried any example with CSEc AFAIK

But, when I turn the uC on the reset pulses every 512uS which I understand there is no flash content

Could I fix this back with a PEMicro/Jlink?

[rvalente]

I've installed the openSDA firmware from jLink hopping something was bad with PEmicro openSDA, turns out the result is similar.

How to unlock this thing? I've not massed with CSEc stuff. I've read its possible to get some keys and open a back door, would these keys be 0x00 or some standards?

I'm kind of mad with NXP for such an easy to do mistake, is not this resource be a little hard to enable by mistake?

And i've tried some jlink commander also...

SEGGER J-Link Commander V6.88c (Compiled Dec 4 2020 18:07:30)
DLL version V6.88c, compiled Dec 4 2020 18:05:56

Connecting to J-Link via USB...O.K.
Firmware: J-Link OpenSDA compiled May 27 2019 10:59:53
Hardware version: V1.00
S/N: 621000000
VTref=3.300V

Type "connect" to establish a target connection, '?' for help
J-Link>device S32K144
J-Link>connect
Please specify target interface:
J) JTAG (Default)
S) SWD
T) cJTAG
TIF>2
Device position in JTAG chain (IRPre,DRPre) <Default>: -1,-1 => Auto-detect
JTAGConf>
Specify target interface speed [kHz]. <Default>: 4000 kHz
Speed>10
Device "S32K144" selected.

Selected interface (2-wire) is not supported by the connected probe.
J-Link>

[LocaEtric]

Maybe a bit late for this question but I meet this problem today and I saw your post.

As far as I know, the "Selected interface (2-wire) is not supported by the connected probe" problem is due to the incorrect command you typed when the commander asks you to select the target interface. To select SWD you have to type "S" instead of "2".

[rvalente]

I was investigating further the situation...

I only used code generated by S32DS and some NXP examples and I've not touched CSEc at all (I did not know of the existence of CSEc at that time)..

AFAIK this code should not protect the MCU

/* Flash Configuration */
    .section .FlashConfig, "a"
    .long 0xFFFFFFFF     /* 8 bytes backdoor comparison key           */
    .long 0xFFFFFFFF     /*                                           */
    .long 0xFFFFFFFF     /* 4 bytes program flash protection bytes    */
    .long 0xFFFF7FFE     /* FDPROT:FEPROT:FOPT:FSEC(0xFE = unsecured) */

    .text
    .thumb

[danielmartynek]

Hi,

Please try the Unlock Kinetis command and keep the MCU in reset externally,

as it was discussed here:

https://community.nxp.com/t5/S32K/Unbricking-S32K146/m-p/937227

Thanks,

BR, Daniel

[rvalente]

Hello Daniel, 

i've tried before but, gave another shot

I'm getting 0x37, so although is locked I understand I could erase the flash, correct?

SEGGER J-Link Commander V6.88c (Compiled Dec  4 2020 18:07:30)
DLL version V6.88c, compiled Dec  4 2020 18:05:56

Connecting to J-Link via USB...O.K.
Firmware: J-Link OpenSDA compiled May 27 2019 10:59:53
Hardware version: V1.00
S/N: 621000000
VTref=3.300V


Type "connect" to establish a target connection, '?' for help
J-Link>device FS32K144
J-Link>if SWD
Selecting SWD as current target interface.
J-Link>speed 10
Selecting 10 kHz as target interface speed
J-Link>r0
J-Link>swdwritedp 2,0x01000000

****** Error: Not supported by current CPU + target interface combination.
Write DP register 2 = 0x01000000 ***ERROR
J-Link>connect
Device "S32K144" selected.


Connecting to target via SWD
InitTarget() start
InitTarget()
Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.
Executing default behavior previously saved in the registry.
Device will be unsecured now.
Timeout while halting CPU.
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPv0 detected
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x001C0000)
Iterating through AP map to find AHB-AP to use
AP[0]: Skipped. Invalid implementer code read from CPUIDVal[31:24] = 0x00
AP[1]: Skipped. Not an AHB-AP
InitTarget() start
InitTarget()
Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.
Executing default behavior previously saved in the registry.
Device will be unsecured now.
Timeout while halting CPU.
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPv0 detected
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x001C0000)
Iterating through AP map to find AHB-AP to use
AP[0]: Skipped. Invalid implementer code read from CPUIDVal[31:24] = 0x00
AP[1]: Skipped. Not an AHB-AP

****** Error: Could not find core in Coresight setup
nterface combination.
InitTarget() start
InitTarget()
Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.
Executing default behavior previously saved in the registry.
Device will be unsecured now.
Timeout while halting CPU.
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPv0 detected
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x001C0000)
Iterating through AP map to find AHB-AP to use
AP[0]: Skipped. Invalid implementer code read from CPUIDVal[31:24] = 0x00
AP[1]: Skipped. Not an AHB-AP
InitTarget() start
InitTarget()
Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.
Executing default behavior previously saved in the registry.
Device will be unsecured now.
Timeout while halting CPU.
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPv0 detected
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x001C0000)
Iterating through AP map to find AHB-AP to use
AP[0]: Skipped. Invalid implementer code read from CPUIDVal[31:24] = 0x00
AP[1]: Skipped. Not an AHB-AP

****** Error: Could not find core in Coresight setup
nterface combination.
Cannot connect to target.
J-Link>r0
J-Link>swdwritedp 2,0x01000000
Write DP register 2 = 0x01000000
J-Link>swdreadap 0
Read AP register 0 = 0x00000000
J-Link>swdreadap 0
Read AP register 0 = 0x00000037
J-Link>swdreadap 1
Read AP register 1 = 0x00000037
J-Link>swdreadap 1
Read AP register 1 = 0x00000000
J-Link>unlock Kinetis
Found SWD-DP with ID 0x2BA01477
Unlocking device...O.K.
J-Link>swdwriteap 1,0x1
Write AP register 1 = 0x00000001
J-Link>connect
Device "S32K144" selected.


Connecting to target via SWD
InitTarget() start
InitTarget()
Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.
Executing default behavior previously saved in the registry.
Device will be unsecured now.
Timeout while halting CPU.
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPv0 detected
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x001C0000)
Iterating through AP map to find AHB-AP to use
AP[0]: Skipped. Invalid implementer code read from CPUIDVal[31:24] = 0x00
AP[1]: Skipped. Not an AHB-AP
InitTarget() start
InitTarget()
Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.
Executing default behavior previously saved in the registry.
Device will be unsecured now.
Timeout while halting CPU.
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPv0 detected
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x001C0000)
Iterating through AP map to find AHB-AP to use
AP[0]: Skipped. Invalid implementer code read from CPUIDVal[31:24] = 0x00
AP[1]: Skipped. Not an AHB-AP

****** Error: Could not find core in Coresight setup
nterface combination.
InitTarget() start
InitTarget()
Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.
Executing default behavior previously saved in the registry.
Device will be unsecured now.
Timeout while halting CPU.
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPv0 detected
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x001C0000)
Iterating through AP map to find AHB-AP to use
AP[0]: Skipped. Invalid implementer code read from CPUIDVal[31:24] = 0x00
AP[1]: Skipped. Not an AHB-AP
InitTarget() start
InitTarget()
Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.
Executing default behavior previously saved in the registry.
Device will be unsecured now.
Timeout while halting CPU.
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPv0 detected
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x001C0000)
Iterating through AP map to find AHB-AP to use
AP[0]: Skipped. Invalid implementer code read from CPUIDVal[31:24] = 0x00
AP[1]: Skipped. Not an AHB-AP

****** Error: Could not find core in Coresight setup
nterface combination.
Cannot connect to target.
J-Link>
Unknown command. '?' for help.
J-Link>
Unknown command. '?' for help.
J-Link>
Unknown command. '?' for help.
J-Link>r0
J-Link>swdwritedp 2,0x01000000
Write DP register 2 = 0x01000000
J-Link>swdreadap 0
Read AP register 0 = 0x00000000
J-Link>swdreadap 1
Read AP register 1 = 0x00000037
J-Link>unlock Kinetis
Found SWD-DP with ID 0x2BA01477
Unlocking device...O.K.
J-Link>r0
J-Link>r1
J-Link>r0
J-Link>clear
Unknown command. '?' for help.
J-Link>r0
J-Link>r1 - When not in forced Reset pulse every 512 uS
J-Link>r0 - reset goes 0 (all the time)
J-Link>
Unknown command. '?' for help.
J-Link>
Unknown command. '?' for help.
J-Link>
Unknown command. '?' for help.
J-Link>
Unknown command. '?' for help.
J-Link>
Unknown command. '?' for help.
J-Link>
Unknown command. '?' for help.
J-Link>
Unknown command. '?' for help.
J-Link>swdwritedp 2,0x01000000
Write DP register 2 = 0x01000000
J-Link>swdreadap 0
Read AP register 0 = 0x00000000
J-Link>swdreadap 0
Read AP register 0 = 0x00000037 - I understand: Flash Memory Mass Erage Ack 1, Flash Memory ready True,  System Security True, System Reset False, bit 4 reserved, Mass erase enabled True, Back door disabled
J-Link>swdreadap 1
Read AP register 1 = 0x00000037
J-Link>swdreadap 1
Read AP register 1 = 0x00000000
J-Link>unlock Kinetis
Found SWD-DP with ID 0x2BA01477
Unlocking device...O.K.
J-Link>swdwriteap 1,0x1
Write AP register 1 = 0x00000001
J-Link>connect
Device "S32K144" selected.


Connecting to target via SWD
InitTarget() start
InitTarget()
Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.
Executing default behavior previously saved in the registry.
Device will be unsecured now.
Timeout while halting CPU.
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPv0 detected
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x001C0000)
Iterating through AP map to find AHB-AP to use
AP[0]: Skipped. Invalid implementer code read from CPUIDVal[31:24] = 0x00
AP[1]: Skipped. Not an AHB-AP
InitTarget() start
InitTarget()
Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.
Executing default behavior previously saved in the registry.
Device will be unsecured now.
Timeout while halting CPU.
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPv0 detected
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x001C0000)
Iterating through AP map to find AHB-AP to use
AP[0]: Skipped. Invalid implementer code read from CPUIDVal[31:24] = 0x00
AP[1]: Skipped. Not an AHB-AP

****** Error: Could not find core in Coresight setup
nterface combination.
InitTarget() start
InitTarget()
Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.
Executing default behavior previously saved in the registry.
Device will be unsecured now.
Timeout while halting CPU.
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPv0 detected
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x001C0000)
Iterating through AP map to find AHB-AP to use
AP[0]: Skipped. Invalid implementer code read from CPUIDVal[31:24] = 0x00
AP[1]: Skipped. Not an AHB-AP
InitTarget() start
InitTarget()
Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.
Executing default behavior previously saved in the registry.
Device will be unsecured now.
Timeout while halting CPU.
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPv0 detected
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x001C0000)
Iterating through AP map to find AHB-AP to use
AP[0]: Skipped. Invalid implementer code read from CPUIDVal[31:24] = 0x00
AP[1]: Skipped. Not an AHB-AP

****** Error: Could not find core in Coresight setup
nterface combination.
Cannot connect to target.
J-Link>