S32k146 will not erase via debugger

neurolyzer · ‎10-22-2021

Hi,

I accidently reprogrammed the option bytes from region 0x400 to 0x40f and now I am not able to erase the device anymore. I can connect with Jlink Commander and I tried to start a mass erase as described in this question: Unbricking S32K146 - NXP Community but it does not seem to work

SEGGER J-Link Commander V7.56a (Compiled Oct 11 2021 16:33:05)
DLL version V7.56a, compiled Oct 11 2021 16:31:49

Connecting to J-Link via USB...O.K.
Firmware: J-Link V11 compiled Oct 6 2021 11:22:15
Hardware version: V11.00
License(s): RDI, FlashBP, FlashDL, JFlash, GDB
VTref=4.999V

Type "connect" to establish a target connection, '?' for help
J-Link>connect
Please specify device / core. <Default>: S32K146
Type '?' for selection dialog
Device>?
Please specify target interface:
J) JTAG (Default)
S) SWD
T) cJTAG
TIF>S
Specify target interface speed [kHz]. <Default>: 4000 kHz
Speed>
Device "S32K146 (ALLOW SECURITY)" selected.

Connecting to target via SWD
InitTarget() start
InitTarget()
Active Kinetis write protection detected. This could cause problems during flash download.
Note: Unsecuring will trigger a mass erase of the internal flash.

Executing default behavior previously saved in the registry.
Device will be unsecured now.
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPIDR: 0x2BA01477
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x001C0000)
Iterating through AP map to find AHB-AP to use
AP[0]: Core found
AP[0]: AHB-AP ROM base: 0xE00FF000
CPUID register: 0x410FC241. Implementer code: 0x41 (ARM)
Found Cortex-M4 r0p1, Little endian.
FPUnit: 6 code (BP) slots and 2 literal slots
CoreSight components:
ROMTbl[0] @ E00FF000
[0][0]: E000E000 CID B105E00D PID 000BB00C SCS-M7
[0][1]: E0001000 CID B105E00D PID 003BB002 DWT
[0][2]: E0002000 CID B105E00D PID 002BB003 FPB
[0][3]: E0000000 CID B105E00D PID 003BB001 ITM
[0][4]: E0040000 CID B105900D PID 000BB9A1 TPIU
Initializing 126976 bytes work RAM @ 0x1FFF0000
Reset: Halt core after reset via DEMCR.VC_CORERESET.
Reset: Reset device via AIRCR.SYSRESETREQ.
T-bit of XPSR is 0 but should be 1. Changed to 1.
Cortex-M4 identified.
J-Link>r0
J-Link>swdwritedp 2,0x01000000
Write DP register 2 = 0x01000000
J-Link>swdreadap 0
Read AP register 0 = 0x40000001
J-Link>swdreadap 0
Read AP register 0 = 0x0001003B
J-Link>swdreadap 1
Read AP register 1 = 0x0001003B
J-Link>swdreadap 1
Read AP register 1 = 0x00000000
J-Link>unlock Kinetis
Found SWD-DP with ID 0x2BA01477
Unlocking device...O.K.
J-Link>swdwriteap 1,0x01
Write AP register 1 = 0x00000001
J-Link>

Any Hints on what is going wrong. Or is there any other way to start a mass erase and restore the bytes from section 0x400 to 0x40F. Just for my understanding I would also like to know how I can read out the Read-only identification register (0x3F) from the MDM-AP with Jlink just so I can check that I am doing everything right.

Thank you in advance

neurolyzer · ‎10-25-2021

Thank you for the quick reply,

I tried to upload a small file but I get the following result:

J-Link>r
Reset delay: 0 ms
Reset type NORMAL: Resets core & peripherals via SYSRESETREQ & VECTRESET bit.
Reset: Halt core after reset via DEMCR.VC_CORERESET.
Reset: Reset device via AIRCR.SYSRESETREQ.
T-bit of XPSR is 0 but should be 1. Changed to 1.
J-Link>swdwriteDP 2, 0x01000000
Write DP register 2 = 0x01000000
J-Link>swdreadap 0
Read AP register 0 = 0x40000001
J-Link>swdreadap 0
Read AP register 0 = 0x0001003B
J-Link>swdreadap 1
Read AP register 1 = 0x0001003B
J-Link>swdreadap 1
Read AP register 1 = 0x00000000
J-Link>unlock Kinetis
Found SWD-DP with ID 0x2BA01477
Unlocking device...O.K.
J-Link>loadbin r:\upload.bin, 0x400 ,0x20
T-bit of XPSR is 0 but should be 1. Changed to 1.
Downloading file [r:\upload.bin]...

****** Error: Failed to erase sectors 0 @ address 0x00000000 (Algo91: Unspecified error #2)
Failed to erase sectors.

Unspecified error -1
J-Link>

Wouldn't it work to just do like

w1 0x400 FF ?

with all the memory range in the rangefrom 0x400 0x40f to reset their values?

Or do I have to tell the jlink commander somehow not to erase before flash?

Thank you in advance

danielmartynek · ‎10-26-2021

Hi @neurolyzer,

If you look at the MDM-AP Status register, it reads 0x0001003B, Status[2] = 0 Unsecure state.

Also, the Unlock Kinetis command was successful.

When unlocked (Unlocking device...O.K.), the Flash configuration field at 0x400 is programmed to 0xFFFFFFFE (FSEC[SEC] = 0b10).

All 0xFF in the flash configuration field would mean the MCU is secure.

Can you load an example from the S32DS IDE?

Do you have any other debugger?

Thank you,

BR, Daniel

neurolyzer · ‎10-26-2021

Hi,

when I examine the area 0x400 i do not see the 0xFFFFFFFE (FSEC[SEC] = 0b10).

this is what actually is written to that 0x400 area

J-Link>mem 0x400 20
00000400 = 30 30 43 35 30 36 30 30 30 30 43 35 32 36 30 30 00C5060000C52600
00000410 = 30 30 43 35 30 36 30 30 30 30 30 32 0D 0A 53 32 00C506000002..S2
J-Link>

I do have an debugger from ISystem but that one is also no capable erasing or flashing...

Any more Ideas on what I could check or do?

danielmartynek · ‎10-26-2021

The fact that you can read the flash means the MCU is not secure.

The FSEC byte is at 0x40C, and you read 0x32 there.

KEYEN = 0b00 disabled, MEEN = 0b11 enabled, FSLACC = 0b00 granted, SEC = 0b10 unsecure.

In the first post you had:

Connecting to target via SWD
InitTarget() start
InitTarget()
Active Kinetis write protection detected. This could cause problems during flash download.
Note: Unsecuring will trigger a mass erase of the internal flash.

So, it seems like this is not an issue with the security but the flash protection configured in FPROT bytes of the Flash configuration field.

This protection can be removed by Mass erase only:

It seems like the programmer cannot mass erase the MCU even though the mass erase is enabled in the FSEC byte.

I think the only explanation is that CSEc is enabled.

Have you partitioned the MCU for CSEc?

If so, Mass erase is blocked by the CSEc engine.

Please refer to: AN12130 Production Flash Programming Best Practices for S32K1xx MCUs

3.2.5.2 Mass erase and CSEc considerations

https://www.nxp.com/docs/en/application-note/AN12130.pdf

Regards,

Daniel

neurolyzer · ‎10-26-2021

Have you partitioned the MCU for CSEc?

Not Knowingly ;-)...is there a quick way to check if it is partioned or not?

danielmartynek · ‎10-26-2021

You can read the FCFG1_DEPART register to see if the MCU was partitioned at all.

But it is more difficult to tell if the CSEc keys space has been allocated and the keys loaded.

Something similar was discussed recently here:

https://community.nxp.com/t5/S32K/S32K144-detect-partition-settings-and-change-partitioning/m-p/1355...

BR, Daniel

neurolyzer · ‎10-27-2021

Hi,

danielmartynek · ‎10-27-2021

Hi @neurolyzer,

Comparing the result to my reading on an EVB, I think DEPART = 0xC

So, it was partitioned but not for EEPROM/CSEc.

Not sure why it can't mass erase the MCU.

Can you try loading an application to SRAM instead of Flash in S32DS and trigger mass erase (Erase All Blocks Unsecure) from that application?

Regards,

Daniel

danielmartynek · ‎10-25-2021

Hi Nils,

The Status register looks good.

You should be able to unlock it, and the command reports that it was successful (Unlocking device...O.K.).

Please remove the last command (J-Link>swdwriteap 1,0x01) and try to load an application instead.

To read the Read-only identification register, write:

J-Link>swdwritedp 2,0x010000F0

Write DP register 2 = 0x010000F0

J-Link>swdreadap 3

Read AP register 3 = 0x00000000

J-Link>swdreadap 3

Read AP register 3 = 0x001C0000

The first command above selects the bank with IDR (SELECT[7:4] = 0xF).

And the second command reads the IDR register (A[3:2] = 3).

Regards,

Daniel