S32K341 HSE AB Swap

[connor-b]

I am trying to use the HSE AB Swap functionality on an S32K341. I have set up NXP HSE v2.55.0 on the chip (s32k342_hse_fw_1.13.0_2.55.0_pb251202.bin). When I connect via JTAG I do see “HSE firmware detected (SWAP enabled)”:

Connecting to target via SWD
ConfigTargetSettings() start
ConfigTargetSettings() end - Took 17us
InitTarget() start
SDA_AP detected
Unlocking device if necessary...
  Device is not locked. Proceeding without the unlock procedure.
Checking if debug access is already enabled...
  Core already enabled
Checking if HSE firmware is installed...
  HSE firmware detected (SWAP enabled)
Checking if Cortex-M7_0 and Cortex-M7_1 are operating in lockstep mode
  Lock step mode enabled
InitTarget() end - Took 11.3ms
Found SW-DP with ID 0x6BA02477
DPIDR: 0x6BA02477
CoreSight SoC-400 or earlier
AP map detection skipped. Manually configured AP map found.
AP[0]: MEM-AP (IDR: Not set, ADDR: 0x00000000)
AP[1]: APB-AP (IDR: Not set, ADDR: 0x00000000)
AP[2]: MEM-AP (IDR: Not set, ADDR: 0x00000000)
AP[3]: AHB-AP (IDR: Not set, ADDR: 0x00000000)
AP[4]: AHB-AP (IDR: Not set, ADDR: 0x00000000)
AP[5]: AHB-AP (IDR: Not set, ADDR: 0x00000000)
AP[6]: MEM-AP (IDR: Not set, ADDR: 0x00000000)
AP[7]: MEM-AP (IDR: Not set, ADDR: 0x00000000)
AP[4]: Skipped ROMBASE read. CoreBaseAddr manually set by user
AP[4]: Core found
CPUID register: 0x411FC272. Implementer code: 0x41 (ARM)
Cache: L1 I/D-cache present
Found Cortex-M7 r1p2, Little endian.
FPUnit: 8 code (BP) slots and 0 literal slots
ROM table scan skipped. CoreBaseAddr manually set by user: 0x40250400
I-Cache L1: 8 KB, 128 Sets, 32 Bytes/Line, 2-Way
D-Cache L1: 8 KB, 64 Sets, 32 Bytes/Line, 4-Way
SetupTarget() start
Initializing ECC RAM...
  RAMCodeAddr: 0x20000000
  RAMInitAddr: 0x20000010
  RAMInitSize: 0x00007FF0
  InitPattern: 0xDEADBEEF
  ECC RAM initialized successfully
Initializing ECC RAM...
  RAMCodeAddr: 0x20000000
  RAMInitAddr: 0x20400000
  RAMInitSize: 0x00004000
  InitPattern: 0xDEADBEEF
  ECC RAM initialized successfully
SetupTarget() end - Took 13.3ms
Memory zones:
  Zone: "Default" Description: Default access mode
Cortex-M7 identified.

However when I try to write to 0x0050000, which I expect to be the passive-block on the 341, I get a failure:

J-Link>loadbin some.arbitrary.bin 0x00500000
'loadbin': Performing implicit reset & halt of MCU.
ResetTarget() start
-- Identifying target device...
-- SWD selected. Executing JTAG -> SWD switching sequence...
Unlocking device if necessary...
  Device is not locked. Proceeding without the unlock procedure.
SDA_AP detected
Checking if core is already enabled...
  Core is not enabled yet. Performing enable core sequence...
  Core enabled
ResetTarget() end - Took 610ms
Device specific reset executed.
Downloading file [some.arbitrary.bin]...
Writing target memory failed.

This is in contrast to writing to 0x0040000, the active-block, which succeeds:

J-Link>loadbin some.arbitrary.bin 0x00400000
'loadbin': Performing implicit reset & halt of MCU.
ResetTarget() start
-- Identifying target device...
-- SWD selected. Executing JTAG -> SWD switching sequence...
Unlocking device if necessary...
  Device is not locked. Proceeding without the unlock procedure.
SDA_AP detected
Checking if core is already enabled...
  Core is not enabled yet. Performing enable core sequence...
  Core enabled
ResetTarget() end - Took 612ms
Device specific reset executed.
Downloading file [some.arbitrary.bin]...
HandleBeforeFlashProg() start
HandleBeforeFlashProg() end - Took 341us
J-Link: Flash download: Bank 0 @ 0x00400000: Skipped. Contents already match
HandleAfterFlashProg() start
HandleAfterFlashProg() end - Took 1us
O.K.

A teammate of mine has this process working on an S32K344, so I am wondering if there is something special to the 341. The TRM for the S32K3XX states that the 341 has an active and a passive block (32.3.1.3 AB swap configuration, Table 200. AB swap configuration), but the c40 modules does not specify a code-flash block for a passive block (21.1.1 Flash memory configuration and register settings, Table 102. Flash block configuration)

Is there something I'm missing to get AB Swap working on the S32K341?

[davidtosenovjan]

You have omitted zero at the end.

0x0040000 - wrong
0x00400000 - correct

0x0050000 - wrong
0x00500000 - correct

[connor-b]

Ah, apologies for the confusion. You are right that in my writeup, I accidentally missed a zero. However that's just a typo in my message. In the text-dumps showing the actual `loadbin` commands, I do have the correct values of `0x00400000` and `0x00500000`. I also just double-checked on my end to make sure I was using the correct values when running on the 341, and I was. So unfortunately the problem still exists.

[davidtosenovjan]

I don't see a reason why this should not work. I don’t have experience with J-link (I suppose these are messages from J-link), I would try to double check which FW is installed. Do you have other debugger option available (for instance PeMicro, Lauterbach or S32 Debug Probe)?

I would check with Segger, whether there is not some kind of protection, as S32K341 uses according memory map only block 0, but when HSE FW is enabled, it uses also block 1.

Another point crossing my mind is whether debugger cannot access flash when it is locked for HSE as stated below:

image.png

Just noting that current release of HSE FW for S32K342 is 0.2.95.0, so there is an option to test it with last release.