S32K144 EVB can't connect after CSEc and readout protection caused by erase

cancel
Showing results for 
Search instead for 
Did you mean: 

S32K144 EVB can't connect after CSEc and readout protection caused by erase

158 Views
delete
Contributor I

Hi all,

I'm trying the example CSEc boot protection. At step 2 load the test program, described in the application usage of this example, I erase the chip address from 0 to 0x7FFFF before load but don't load the test program. Then I break the connect. Next time I tried to connect to the S32K144, it failed because the Protection bytes in flash at addr 0x400 - 0x40F indicate that readout protection is set.

The J-link commander:

InitTarget() start
InitTarget()
Device will be unsecured now.
Timeout while halting CPU.
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPIDR: 0x2BA01477
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x001C0000)
Iterating through AP map to find AHB-AP to use
AP[0]: Skipped. Could not read CPUID register
AP[1]: Skipped. Not an AHB-AP
InitTarget() start
InitTarget()
Device will be unsecured now.
Timeout while halting CPU.
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPIDR: 0x2BA01477
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x001C0000)
Iterating through AP map to find AHB-AP to use
AP[0]: Skipped. Could not read CPUID register
AP[1]: Skipped. Not an AHB-AP

****** Error: Could not find core in Coresight setup

 

The reset pin is 1us high and 400us low in cycle.

Using the jlink commander unlock kinetis holding the reset pin low externally, the result is OK, but I still can't connect with the chip and it seems still locked.

I try to read the AP register as described at https://community.nxp.com/t5/S32K/Unbricking-S32K146/m-p/937227

J-Link>r0
J-Link>swdwritedp 2,0x01000000
Write DP register 2 = 0x01000000
J-Link>swdreadap 0
Read AP register 0 = 0x00000000
J-Link>swdreadap 0
Read AP register 0 = 0x00000037
J-Link>swdreadap 1
Read AP register 1 = 0x00000037
J-Link>swdreadap 1
Read AP register 1 = 0x00000000

AP is 0x00000037. I want to know if there is a solution other than replacing the MCU and how to do it.

Greetings.

0 Kudos
3 Replies

152 Views
danielmartynek
NXP TechSupport
NXP TechSupport

Hello @delete,

If the MCU has been already partitioned for CSEc, it cannot be mass erased anymore - which would be otherwise the only way to unlock it.

The CSEc engine blocks Mass erase even if it was enabled in the MDM-AP Status register.

This should be taken into consideration when the CSEc is enabled.

 

BR, Daniel

0 Kudos

137 Views
delete
Contributor I

hello,

Thank you for your reply. I think I have to replace the MCU.

0 Kudos

128 Views
danielmartynek
NXP TechSupport
NXP TechSupport

Unfortunately, it looks like the CSEc is bloking the mass erase.

 

BR, Daniel

 

0 Kudos