Hello,
Accidentally I flashed garbage data on my S32K148 CPU. It seem that CPU is constantly rebooting (looking at RESET_PIN behavior).
It looks like CPU is not halting (the same symptoms as in Cannot connect to board after erase!).
I am not able to connect with debugger, or unlock/erase this part. Reading MDM-AP Status register returns 0x34.
It means that flash is locked and mass erase is allowed so in theory I should be able to unlock and do mass erase of this particular chip. However flash is in not ready state.
As I understand JTAG commands can be accepted only when reset PIN is in high state. In my case this is very short window.
My idea is to blindly send halt command over JTAG for this CPU after power up and release from reset using r1 command from J-Link script.
I would like to as how the reset command (or commands) over JTAG should looks like for this cpu? I thing wjc or wjraw command can be fast enough?
EDIT:
It looks like in the data I flashed my reset pin is disabled, so the problem is quite generic for those parts - there is very short window to halt CPU.
Do you have some ideas how can I test it?
See logs:
Accidentally I flashed garbage data on my S32K148 CPU. It seem that CPU is constantly rebooting (looking at RESET_PIN behavior).
It looks like CPU is not halting (the same symptoms as in Cannot connect to board after erase!).
I am not able to connect with debugger, or unlock/erase this part. Reading MDM-AP Status register returns 0x34.
It means that flash is locked and mass erase is allowed so in theory I should be able to unlock and do mass erase of this particular chip. However flash is in not ready state.
As I understand JTAG commands can be accepted only when reset PIN is in high state. In my case this is very short window.
My idea is to blindly send halt command over JTAG for this CPU after power up and release from reset using r1 command from J-Link script.
I would like to as how the reset command (or commands) over JTAG should looks like for this cpu? I thing wjc or wjraw command can be fast enough?
EDIT:
It looks like in the data I flashed my reset pin is disabled, so the problem is quite generic for those parts - there is very short window to halt CPU.
Do you have some ideas how can I test it?
See logs:
SEGGER J-Link Commander V6.40 (Compiled Oct 26 2018 15:06:29)
DLL version V6.40, compiled Oct 26 2018 15:06:02
Connecting to J-Link via USB...O.K.
Firmware: J-Link Lite-FSL V1 compiled Jun 25 2012 16:40:07
Hardware version: V1.00
S/N: 430110131
VTref=3.503V
Type "connect" to establish a target connection, '?' for help
J-Link>connect
Please specify device / core. <Default>: S32K148
Type '?' for selection dialog
Device>
Please specify target interface:
J) JTAG (Default)
S) SWD
T) cJTAG
TIF>j
Device position in JTAG chain (IRPre,DRPre) <Default>: -1,-1 => Auto-detect
JTAGConf>
Specify target interface speed [kHz]. <Default>: 4000 kHz
Speed>
Device "S32K148" selected.
Connecting to target via JTAG
InitTarget()
TotalIRLen = 4, IRPrint = 0x01
JTAG chain detection found 1 devices:
#0 Id: 0x0995001D, IRLen: 04, JTAG-DP
Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.
Executing default behavior previously saved in the registry.
Device was not unsecured. No action performed.
TotalIRLen = 4, IRPrint = 0x01
JTAG chain detection found 1 devices:
#0 Id: 0x0995001D, IRLen: 04, JTAG-DP
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x001C0000)
Iterating through AP map to find AHB-AP to use
AP[0]: Skipped. Invalid implementer code read from CPUIDVal[31:24] = 0x00
AP[1]: Skipped. Not an AHB-AP
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x001C0000)
Iterating through AP map to find AHB-AP to use
AP[0]: Skipped. Invalid implementer code read from CPUIDVal[31:24] = 0x00
AP[1]: Skipped. Not an AHB-AP
InitTarget()
Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.
Executing default behavior previously saved in the registry.
Device was not unsecured. No action performed.
TotalIRLen = 4, IRPrint = 0x01
JTAG chain detection found 1 devices:
#0 Id: 0x0995001D, IRLen: 04, JTAG-DP
****** Error: Could not find core in Coresight setup
InitTarget()
Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.
Executing default behavior previously saved in the registry.
Device was not unsecured. No action performed.
TotalIRLen = 4, IRPrint = 0x01
JTAG chain detection found 1 devices:
#0 Id: 0x0995001D, IRLen: 04, JTAG-DP
InitTarget()
Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.
Executing default behavior previously saved in the registry.
Device was not unsecured. No action performed.
TotalIRLen = 4, IRPrint = 0x01
JTAG chain detection found 1 devices:
#0 Id: 0x0995001D, IRLen: 04, JTAG-DP
Cannot connect to target.
The post was edited 2 times, last by krzemyk: New informations. ().