S32K148 locked

KiranE · ‎08-25-2021

Hi,

We are testing flash drivers provide by NXP on S32K148EVB. As part of flash erase testing, we erased 512KB of data from 0x00080000.Since my application placed in the first 512KB of pflash starting from 0 to 0x7 FFFF, we choose to erase the flash from 0x80000.

Erase was not successful we got hard fault. Hardfault handler is simple while (1). Controller will stay forever in the hardfault handler.

Then, we tried to flash the application again using J-Link. We got below error.

Seems, locations from 0x400 to 0x40F erased and micro controller got locked but we never erased these locations. We are not sure how these locations are erased? Is there any issue with the procedure we followed above.

We tried to unlock the micro controller by initiating mass erase as mentioned in the below post using J-Link with SWD interface.. We have connected Reset pin to ground.

https://community.nxp.com/t5/S32K/How-to-unlock-S32K148-Chip/m-p/1327795#M11770.

This is not successful. Getting timed out error

By looking at the MDM_AP status registers, we can confirm that mass erase is enabled but we are not able to do mass erase of the chip.

How can we unlock the device from this state? It would be helpful if you can provide solution or workaround.

As per the spec, as long as mass erase is enabled ( MEEN ), we can recovery the chip but this is not happening.

danielmartynek · ‎08-25-2021

Hi Kiran,

Hard to say what could go wrong. But since there was the HardFault, I would guess it was accidentally trying to erase the first block and an access collision occurred on that block. I don't see any other reason why would an FTFC command ended up in a fault exception.

MDM-AP Status[2] = 0 indicating the flash does not get ready for some reason.

And it should be ready before the mass erase can be launched.

AN12130, Section 3.1.1 SWD connection steps

https://www.nxp.com/docs/en/application-note/AN12130.pdf

Once you connect RESET_b to VSS, power cycle the MCU so that it stays in reset after POR.

But if the flash does not become ready, I'm afraid it cannot be erased.

One more thing. Do you use CSEc? Or have been testing an example that use CSEc like the flexcan_encrypted_s32k148 SDK example.

If so, and there are keys allocated, the mass erase is blocked by CSEc, even if MDM-AP Status[5] = 1, Mass erase enabled.

Regards,

Daniel

KiranE · ‎08-25-2021

Hi Daniel,

Thanks for the information.

I am not using CSEc. I just called flash erase function provided by NXP FLASH_DRV_EraseSector after initialization.

As you suggested, we connected RESET_b to Vss, powered up the board and tried mass erase. It is not successful. Got time out error.

May I know what could be the possible reasons for the MDM-AP Status[1] (Flash memory ready) not getting set?

Many thanks

KiranE · ‎08-26-2021

Hi Daniel,

One more update.

We tried same testing on one more EVB just to know anything related to micro part/that particular hardware. Unfortunately, this EVB also went to locked state and we are not able to recover this too. It also showing same behavior. Now we are afraid of trying on another hardware until we know the reasons what can cause for the micro controller to go to locked state. We are sure, the test code we have is not erasing the locations 0x400 to 0x40F.

It would be very helpful if you can give us any clue.

If needed, I can share you the test code also. Please let me know.

Many thanks.

danielmartynek · ‎08-26-2021

Hi Kiran,

It would help to have the code.

If you don't want to post it here, please create a ticket.

Thank you,

BR, Daniel

KiranE · ‎08-26-2021

Hi Daniel,

Here is the code

/*
*****************************************************************************
* HAL_Memory_Erase_Block
*******************************************************************************
*/
uint8_t ui8HAL_MEMORY_EraseBlock(
uint32_t ui32InSectorStartAddr,
uint8_t ui8InNoOfSectors,
uint32_t ui8InTimeOut )
{
uint32_t u32Size;
status_t eStatus;

//check if the address is in dflash range
if( ( ui32InSectorStartAddr >= flashSSDConfig.DFlashBase ) &&
( ui32InSectorStartAddr < ( flashSSDConfig.DFlashBase + flashSSDConfig.DFlashSize ) ) )
{
u32Size = ui8InNoOfSectors * FEATURE_FLS_DF_BLOCK_SECTOR_SIZE;
}
//check if the address is in pflash range
else if ( ( ui32InSectorStartAddr >= flashSSDConfig.PFlashBase ) &&
( ui32InSectorStartAddr < ( flashSSDConfig.PFlashBase + flashSSDConfig.PFlashSize ) ) )
{
u32Size = ui8InNoOfSectors * FEATURE_FLS_PF_BLOCK_SECTOR_SIZE;
}
else
{
u32Size = 0;
}

//if size greater than zero, perform erase operation
if( u32Size > 0 )
{
eStatus = FLASH_DRV_EraseSector( &flashSSDConfig,
ui32InSectorStartAddr,
u32Size );
}
else
{
eStatus = STATUS_UNSUPPORTED;
}

return ( (uint8_t)HAL_MEMORY_STATUS(eStatus) );
}

*****************************************************************************
* ui8HAL_MEMORY_ProgramBlock
*******************************************************************************
*/
uint8_t ui8HAL_MEMORY_ProgramBlock(
uint32_t ui32InStartAddress,
uint32_t *pui32InData,
uint32_t ui32InDataLength,
uint32_t ui32InTimeOut )
{
status_t eStatus;

eStatus = FLASH_DRV_Program( &flashSSDConfig,
ui32InStartAddress,
( ui32InDataLength*4 ),
(uint8_t *)pui32InData );

return ( (uint8_t)HAL_MEMORY_STATUS(eStatus) );
}

//Erase
//pflash sector size is 4k = 1000
uint32_t ui32TestMemStartAddr = 0x00080000;
uint32_t ui32TestMemSectors = 128;

//1K buffer for program data
uint32_t ui32ProgramData[256];
uint8_t ui8Status;

//Erase 2nd read partition of pflash 512K block.
//Each time 4K will be erased
//No of sectors will be 128
void vTEST_MEMORY_Erase( void )
{
ui8Status = ui8HAL_MEMORY_EraseBlock( ui32TestMemStartAddr,ui32TestMemSectors,0);
}

//program

void vTEST_MEMORY_Program( void )
{
uint16_t ui16Index;
uint16_t ui16Index1K;

//program 512K

for( ui16Index1K = 0; ui16Index1K<512; ui16Index1K++)
{
//Program 1K each iteration
//Fill program buffer with data
for( ui16Index = 0; ui16Index<256; ui16Index++ )
{
ui32ProgramData[ui16Index] = 0x55555555;
}

ui8Status = ui8HAL_MEMORY_ProgramBlock( ui32TestMemStartAddr,&ui32ProgramData[0],256,0);
}

}

void vTEST_MEMORY_Flash( void )
{

vTEST_MEMORY_Erase( );
vTEST_MEMORY_Program( );

}

vTEST_MEMORY_Flash is called in the main. c file after flash initialization.

I have another question. As I said before, while erasing the flash memory, I got the hard fault. I am not sure what caused the hard fault but assuming it could be because of collision error. I saw controller went to hard fault handler and struck there as hard fault handler is simple while 1 loop. Then, I reset the application using debugger and tried to flash the application again. Then debugger popped up controller locked error message. Is there any chance that controller may go to locked state if erase/program operation interrupted or hard fault because of flash errors?

Thank you,

Kiran

danielmartynek · ‎08-30-2021

Hi Kiran,

The code looks good, but if you want to erase an entire block, why do you do it be sectors?

It takes some time to erase it. And the process must not be interrupted.

Although it is not specified that the MCU can get locked, it must not be interrupted.

AN12130, Chapter 5 Common problems

https://www.nxp.com/docs/en/application-note/AN12130.pdf

I assume that you have some data or code in the second block since you want to erase it.

It is possible that an interrupt accesses the block during the FTFC operations?

If so, please mask all interrupts before the erasing/programming starts.

Regards,

Daniel