S32K144 EVB can't connect after CSEc and readout protection caused by erase

[delete]

Hi all,

I'm trying the example CSEc boot protection. At step 2 load the test program, described in the application usage of this example, I erase the chip address from 0 to 0x7FFFF before load but don't load the test program. Then I break the connect. Next time I tried to connect to the S32K144, it failed because the Protection bytes in flash at addr 0x400 - 0x40F indicate that readout protection is set.

The J-link commander:

InitTarget() start
InitTarget()
Device will be unsecured now.
Timeout while halting CPU.
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPIDR: 0x2BA01477
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x001C0000)
Iterating through AP map to find AHB-AP to use
AP[0]: Skipped. Could not read CPUID register
AP[1]: Skipped. Not an AHB-AP
InitTarget() start
InitTarget()
Device will be unsecured now.
Timeout while halting CPU.
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPIDR: 0x2BA01477
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x001C0000)
Iterating through AP map to find AHB-AP to use
AP[0]: Skipped. Could not read CPUID register
AP[1]: Skipped. Not an AHB-AP

****** Error: Could not find core in Coresight setup

The reset pin is 1us high and 400us low in cycle.

Using the jlink commander unlock kinetis holding the reset pin low externally, the result is OK, but I still can't connect with the chip and it seems still locked.

I try to read the AP register as described at https://community.nxp.com/t5/S32K/Unbricking-S32K146/m-p/937227, 

J-Link>r0
J-Link>swdwritedp 2,0x01000000
Write DP register 2 = 0x01000000
J-Link>swdreadap 0
Read AP register 0 = 0x00000000
J-Link>swdreadap 0
Read AP register 0 = 0x00000037
J-Link>swdreadap 1
Read AP register 1 = 0x00000037
J-Link>swdreadap 1
Read AP register 1 = 0x00000000

AP is 0x00000037. I want to know if there is a solution other than replacing the MCU and how to do it.

Greetings.

[danielmartynek]

Hello @delete,

If the MCU has been already partitioned for CSEc, it cannot be mass erased anymore - which would be otherwise the only way to unlock it.

The CSEc engine blocks Mass erase even if it was enabled in the MDM-AP Status register.

This should be taken into consideration when the CSEc is enabled.

BR, Daniel

[delete]

hello,

Thank you for your reply. I think I have to replace the MCU.

[danielmartynek]

Unfortunately, it looks like the CSEc is bloking the mass erase.

BR, Daniel