S32K148 Unsecurity

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

S32K148 Unsecurity

2,366 Views
zhigang
Contributor I

Hi all,

    I found my s32k148 chip is security.I reset the chip and use j-link commander to unlock kinetis,but it doesn't work.How can I unsecure the chip? Expect your answer.Thanks a lot.

11.PNG22.PNG

0 Kudos
5 Replies

2,355 Views
Robin_Shen
NXP TechSupport
NXP TechSupport

Hi zhigang,

Would you please show the image of "unlock kinetis" in J-Link Commander?

JLink Commander.png
If Mass erase is enabled, you should be able to "unlock kinetis" in J-Link Commander.

Have you modify the value of Flash Configuration?

Flash Configuration.png

Please check the connection between S32K148 and J-Link. Are you using S32K148EVB or custom board?

S32K148 Debugg Connector.png

Best Regards,
Robin
-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!

- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------

0 Kudos

2,350 Views
zhigang
Contributor I

Hi,Robin

         Thank you for your reply.

         First of all, I finished the "unlock kinetis",and it showed "OK".Then, I do not know the Mass erase is enabled or not.If Mass erase is disabled,what should I do.At last, the connection between S32K148 and J-Link is OK,and the schematic diagram is the same as yours.Looking forward to your reply.

 

Best Regards,

Zhigang

0 Kudos

2,342 Views
Robin_Shen
NXP TechSupport
NXP TechSupport

Could you please try to read the MDM_AP status and control registers first.
Use J-link commander and these commands:

J-Link>r0                      // pull reset pin low

J-Link>swdwritedp 2,0x01000000 // MDM_AP status register

J-Link>swdreadap 0      // Read MDM_AP status register
J-Link>swdreadap 0      // Read MDM_AP status register (has to be done 2x) Flash memory ready and Mass erase enable bits should be set

J-Link>swdreadap 1      // Read MDM_AP control register
J-Link>swdreadap 1      // Read MDM_AP control register (has to be done 2x) 

J-Link>unlock Kinetis   // Erase and unsecure the MCU

//J-Link>swdwriteap 1,0x1 // Launch mass erase directly, set Control[0] = 1
 ‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

For more information about the register please refer to Section 56.6 MDM-AP status and control registers, S32K1xx MCU Family - Reference Manual (REV 12.1) .

You should be able to see if the MCU secured (Status[2]), if the Mass Erase operation is enabled (Status[5]) and if the Flash memory is ready (Status[1]).

58.6.2 MDM-AP Status Register.png

0 Kudos

2,313 Views
zhigang
Contributor I

Hi Robin_Shen,

Below is my jlink trace.But it doesn't work.

J-Link>R0
J-Link>swdwritedp 2, 0x1000000
Write DP register 2 = 0x01000000
J-Link>swdreadap 0
Read AP register 0 = 0x00000000
J-Link>swdreadap 0
Read AP register 0 = 0x00000037
J-Link>swdreadap 1
Read AP register 1 = 0x00000037
J-Link>swdreadap 1
Read AP register 1 = 0x00000000
J-Link>unlock Kinetis
Found SWD-DP with ID 0x2BA01477
Unlocking device...O.K.
J-Link>swdwriteap 1,0x1
Write AP register 1 = 0x00000001
J-Link>

0 Kudos

2,273 Views
rvalente
Contributor III

Hello,

i've facing the very same problem.

Suddenly S32DS started to give a pop-up to unsecure the device.
I've tried many things, emergency recover with kinetis, nothing
Changed my openSDA from PEMicro to Segger
Tried to do this mass erase j-link and the suggest and after that I can't connect or I'm doing wrongly

Type "connect" to establish a target connection, '?' for help
J-Link>device S32K144
J-Link>connect
Please specify target interface:
  J) JTAG (Default)
  S) SWD
  T) cJTAG
TIF>S
Specify target interface speed [kHz]. <Default>: 4000 kHz
Speed>
Device "S32K144" selected.


Connecting to target via SWD
InitTarget() start
InitTarget()
Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.
Executing default behavior previously saved in the registry.
Device will be unsecured now.
Timeout while halting CPU.
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPv0 detected
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x001C0000)
Iterating through AP map to find AHB-AP to use
AP[0]: Skipped. Invalid implementer code read from CPUIDVal[31:24] = 0x00
AP[1]: Skipped. Not an AHB-AP
InitTarget() start
InitTarget()
Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.
Executing default behavior previously saved in the registry.
Device will be unsecured now.
Timeout while halting CPU.
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPv0 detected
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x001C0000)
Iterating through AP map to find AHB-AP to use
AP[0]: Skipped. Invalid implementer code read from CPUIDVal[31:24] = 0x00
AP[1]: Skipped. Not an AHB-AP

****** Error: Could not find core in Coresight setup

InitTarget() start
InitTarget()
Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.
Executing default behavior previously saved in the registry.
Device will be unsecured now.
Timeout while halting CPU.
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPv0 detected
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x001C0000)
Iterating through AP map to find AHB-AP to use
AP[0]: Skipped. Invalid implementer code read from CPUIDVal[31:24] = 0x00
AP[1]: Skipped. Not an AHB-AP
InitTarget() start
InitTarget()
Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.
Executing default behavior previously saved in the registry.
Device will be unsecured now.
Timeout while halting CPU.
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPv0 detected
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x001C0000)
Iterating through AP map to find AHB-AP to use
AP[0]: Skipped. Invalid implementer code read from CPUIDVal[31:24] = 0x00
AP[1]: Skipped. Not an AHB-AP

****** Error: Could not find core in Coresight setup

Cannot connect to target.
J-Link>r0
J-Link>swdwritedp 2,0x01000000
Write DP register 2 = 0x01000000
J-Link>swdreadap 0
Read AP register 0 = 0x00000000
J-Link>swdreadap 0
Read AP register 0 = 0x00000037
J-Link>swdreadap 1
Read AP register 1 = 0x00000037
J-Link>swdreadap 1
Read AP register 1 = 0x00000000
J-Link>unlock Kinetis
Found SWD-DP with ID 0x2BA01477
Unlocking device...O.K.
J-Link>swdwriteap 1,0x1
Write AP register 1 = 0x00000001
J-Link>
0 Kudos