R7FA2A1AB: wrote wrong data to SECMPUxxx (option setting memory), unable to erase flash

Hello!

I made a mistake in gcc linker script (.ld file) and as result overwrote option setting memory.

I can connect to device with JLink, see CPU registers, read memory, etc. BUT I cannot erase flash.

I can't set the FENTRY0 bit in FENTRYR (0x407EFFB2) and as result cannot issue commands to FCB.

I also tied "AlErase" procedure, but it does not work since there is no lock acivated.

Now MCU have following data in option setting memory:

J-Link>mem32 0x400,10
00000400 = 2314709A 226418FB 00182100 F83FF000 
00000410 = F240003B F2C042CC CA130200 6811C313 
00000420 = 88926019 003B809A 00182112 FF0CF7FF 
00000430 = 18FB2314 F7FF0018 E7F9FF36 7FFFFFFF 

Full Jlink log:

$ JLinkExe 
SEGGER J-Link Commander V7.86d (Compiled Mar 15 2023 13:56:37)
DLL version V7.86d, compiled Mar 15 2023 13:56:20

Connecting to J-Link via USB...O.K.
Firmware: J-Link OB-S124 compiled Mar  2 2023 15:52:19
Hardware version: V1.00
J-Link uptime (since boot): 0d 00h 05m 18s
S/N: 831623884
VTref=3.300V


Type "connect" to establish a target connection, '?' for help
J-Link>connect
Please specify device / core. <Default>: R7FA2A1AB
Type '?' for selection dialog
Device>R7FA2A1AB
Please specify target interface:
  J) JTAG (Default)
  S) SWD
  T) cJTAG
TIF>s
Specify target interface speed [kHz]. <Default>: 4000 kHz
Speed>
Device "R7FA2A1AB" selected.


Connecting to target via SWD
InitTarget() start
Identifying target device...
SWD selected. Executing JTAG -> SWD switching sequence...
Initializing DAP...
Low power mode detected. Waking device from low power mode.
InitTarget() end - Took 10.7ms
Found SW-DP with ID 0x5BA02477
DPIDR: 0x5BA02477
CoreSight SoC-400 or earlier
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x74770001)
AP[1]: APB-AP (IDR: 0x44770002)
Iterating through AP map to find AHB-AP to use
AP[0]: Core found
AP[0]: AHB-AP ROM base: 0x4001A000
CPUID register: 0x411CD200. Implementer code: 0x41 (ARM)
Feature set: Baseline
Cache: No cache
Found Cortex-M23 r1p0, Little endian.
FPUnit: 4 code (BP) slots and 0 literal slots
Security extension: not implemented
CoreSight components:
ROMTbl[0] @ 4001A000
[0][0]: E000E000 CID B105900D PID 000BBD20 DEVARCH 47702A04 DEVTYPE 00 Cortex-M23
[0][1]: E0001000 CID B105900D PID 000BBD20 DEVARCH 47701A02 DEVTYPE 00 DWT
[0][2]: E0002000 CID B105900D PID 000BBD20 DEVARCH 47701A03 DEVTYPE 00 FPB
[0][3]: 40019000 CID B105900D PID 000BBD20 DEVARCH 47710A31 DEVTYPE 31 MTB
Memory zones:
  Zone: "Default" Description: Default access mode
Cortex-M23 identified.

J-Link>mem32 0x400,10
00000400 = 2314709A 226418FB 00182100 F83FF000 
00000410 = F240003B F2C042CC CA130200 6811C313 
00000420 = 88926019 003B809A 00182112 FF0CF7FF 
00000430 = 18FB2314 F7FF0018 E7F9FF36 7FFFFFFF

J-Link>mem16 0x438, 1
00000438 = FF36

J-Link>mem16 0x407EFFB2, 1
407EFFB2 = 0000 
J-Link>w2 0x407EFFB2, 0xaa01
Writing AA01 -> 407EFFB2
J-Link>sleep 100
Sleep(100)
J-Link>mem16 0x407EFFB2, 1
407EFFB2 = 0000 

Is this device permanently locked? Any Idea how to "revive" it? 

  • Hello,

    Thanks for reaching out Renesas Engineering Community!

    Can you please go to Renesas Device Partition Manager in e2studio and select Initialize device back to factory default and then press Run as shown in the picture bellow and retry to erase memory from J-Link  commander by typing >erase?

    Best Regards,

    IK

  • I tried `Renesas Device Partition Manage` from `e2studio`, but it failed with following message:

    Renesas Device Partition Manager
    	version: 1.5.5.0 
    	by Renesas Electronics Corporation
    
    Starting connection with the following settings: 
    	Emulator information	:
    		- Emulator type		: Segger J-Link
    		- Connection interface	: SWD
    		- Emulator selected	: Auto
    		- Supply voltage (V)	: Using external power supply.
    	Connection speed (Hz)	: Default connection speed
    	Display errors in	: English
    
    Connecting...
    	Loading library				: SUCCESSFUL! 
    	Establishing connection			: FAILED! SWD boot mode entry failed. JBMDR register's value did not become 0.
    
    Disconnecting...
    DISCONNECTED.

    After that I tried `erase` command in JLinkExe, but it failed:

    $ JLinkExe 
    SEGGER J-Link Commander V7.86d (Compiled Mar 15 2023 13:56:37)
    DLL version V7.86d, compiled Mar 15 2023 13:56:20
    
    Connecting to J-Link via USB...O.K.
    Firmware: J-Link OB-S124 compiled Mar  2 2023 15:52:19
    Hardware version: V1.00
    J-Link uptime (since boot): 0d 00h 03m 20s
    S/N: 831623884
    VTref=3.300V
    
    
    Type "connect" to establish a target connection, '?' for help
    J-Link>connect
    Please specify device / core. <Default>: R7FA2A1AB
    Type '?' for selection dialog
    Device>
    Please specify target interface:
      J) JTAG (Default)
      S) SWD
      T) cJTAG
    TIF>s
    Specify target interface speed [kHz]. <Default>: 4000 kHz
    Speed>
    Device "R7FA2A1AB" selected.
    
    
    Connecting to target via SWD
    InitTarget() start
    Identifying target device...
    SWD selected. Executing JTAG -> SWD switching sequence...
    Initializing DAP...
    Locked Renesas device detected. For proper debugger connection the device needs to be unlocked via an IDCODE.
    Please specify an IDCODE via JLINK_ExecCommand() or by specifying a callback for an external dialog to enter the 16-byte IDCODE.
    InitTarget() end - Took 6.00ms
    Connect failed. Resetting via Reset pin and trying again.
    InitTarget() start
    Identifying target device...
    SWD selected. Executing JTAG -> SWD switching sequence...
    Initializing DAP...
    Locked Renesas device detected. For proper debugger connection the device needs to be unlocked via an IDCODE.
    Please specify an IDCODE via JLINK_ExecCommand() or by specifying a callback for an external dialog to enter the 16-byte IDCODE.
    InitTarget() end - Took 5.46ms
    Cannot connect to target.
    

    Then I power-cycled the board and tried `erase` command in JLinkExe again, bit it failed in a different way:

    $ JLinkExe 
    SEGGER J-Link Commander V7.86d (Compiled Mar 15 2023 13:56:37)
    DLL version V7.86d, compiled Mar 15 2023 13:56:20
    
    Connecting to J-Link via USB...O.K.
    Firmware: J-Link OB-S124 compiled Mar  2 2023 15:52:19
    Hardware version: V1.00
    J-Link uptime (since boot): 0d 00h 00m 04s
    S/N: 831623884
    VTref=3.300V
    
    
    Type "connect" to establish a target connection, '?' for help
    J-Link>connect
    Please specify device / core. <Default>: R7FA2A1AB
    Type '?' for selection dialog
    Device>
    Please specify target interface:
      J) JTAG (Default)
      S) SWD
      T) cJTAG
    TIF>s
    Specify target interface speed [kHz]. <Default>: 4000 kHz
    Speed>
    Device "R7FA2A1AB" selected.
    
    
    Connecting to target via SWD
    InitTarget() start
    Identifying target device...
    SWD selected. Executing JTAG -> SWD switching sequence...
    Initializing DAP...
    Low power mode detected. Waking device from low power mode.
    InitTarget() end - Took 10.6ms
    Found SW-DP with ID 0x5BA02477
    DPIDR: 0x5BA02477
    CoreSight SoC-400 or earlier
    Scanning AP map to find all available APs
    AP[2]: Stopped AP scan as end of AP map has been reached
    AP[0]: AHB-AP (IDR: 0x74770001)
    AP[1]: APB-AP (IDR: 0x44770002)
    Iterating through AP map to find AHB-AP to use
    AP[0]: Core found
    AP[0]: AHB-AP ROM base: 0x4001A000
    CPUID register: 0x411CD200. Implementer code: 0x41 (ARM)
    Feature set: Baseline
    Cache: No cache
    Found Cortex-M23 r1p0, Little endian.
    FPUnit: 4 code (BP) slots and 0 literal slots
    Security extension: not implemented
    CoreSight components:
    ROMTbl[0] @ 4001A000
    [0][0]: E000E000 CID B105900D PID 000BBD20 DEVARCH 47702A04 DEVTYPE 00 Cortex-M23
    [0][1]: E0001000 CID B105900D PID 000BBD20 DEVARCH 47701A02 DEVTYPE 00 DWT
    [0][2]: E0002000 CID B105900D PID 000BBD20 DEVARCH 47701A03 DEVTYPE 00 FPB
    [0][3]: 40019000 CID B105900D PID 000BBD20 DEVARCH 47710A31 DEVTYPE 31 MTB
    Memory zones:
      Zone: "Default" Description: Default access mode
    Cortex-M23 identified.
    J-Link>erase
    No address range specified, 'Erase Chip' will be executed
    'erase': Performing implicit reset & halt of MCU.
    Reset: Halt core after reset via DEMCR.VC_CORERESET.
    Reset: Reset device via AIRCR.SYSRESETREQ.
    Erasing device...
    CPU is running at low speed (8000 kHz).
    
    ****** Error: Timeout while erasing sectors, RAMCode did not respond in time (PC = 0x2000076A, XPSR = 0x61000000, SP = 0x20000868)!
    Failed to erase sectors.
    
    J-Link: Flash download: Total time needed: 10.329s (Prepare: 0.200s, Compare: 0.000s, Erase: 10.070s, Program: 0.000s, Verify: 0.000s, Restore: 0.058s)
    ERROR: Erase returned with error code -5.
    J-Link>

  • Hello again,

    By noticing carefully the info you provided from J-Link Commander on your first post it seems that by writing data into the Option Setting memory, you might have enabled Security MPU settings and it is possible that you have locked your device. Take a look on the picture below:

    In order to check if your device is locked I would suggest to you to try the attached script. This script erases block 0 of code flash. You must edit  the JLink_path.bat to point to the location of JLink.exe, and then open command prompt in order to run the script.

    If the script runs successfully you should see something like this:

    If not then I am sorry but  your device is locked.

    3652.RA2A1_Erase_Block_0.zip

    Best Regards,

    IK

  • Hello,

    I ran the script you provided.
    Unfortunately it seems that my device is permanently locked.
    Thanks for your help!

    Best Regards,
    Krisjans

    P.S. Full log form executing RA2A1_Erase_Block_0.JlinkScript.jlink

    $ JLinkExe -CommanderScript RA2A1_Erase_Block_0.JlinkScript.jlink
    SEGGER J-Link Commander V7.86d (Compiled Mar 15 2023 13:56:37)
    DLL version V7.86d, compiled Mar 15 2023 13:56:20
    
    
    J-Link Command File read successfully.
    Processing script file...
    J-Link>Device R7FA2A1AB
    J-Link connection not established yet but required for command.
    Connecting to J-Link via USB...O.K.
    Firmware: J-Link OB-S124 compiled Mar  2 2023 15:52:19
    Hardware version: V1.00
    J-Link uptime (since boot): 0d 00h 00m 03s
    S/N: 831623884
    VTref=3.300V
    J-Link>si SWD
    Selecting SWD as current target interface.
    J-Link>speed 4000
    Selecting 4000 kHz as target interface speed
    J-Link>connect
    Device "R7FA2A1AB" selected.
    
    
    Connecting to target via SWD
    InitTarget() start
    Identifying target device...
    SWD selected. Executing JTAG -> SWD switching sequence...
    Initializing DAP...
    Low power mode detected. Waking device from low power mode.
    InitTarget() end - Took 10.3ms
    Found SW-DP with ID 0x5BA02477
    DPIDR: 0x5BA02477
    CoreSight SoC-400 or earlier
    Scanning AP map to find all available APs
    AP[2]: Stopped AP scan as end of AP map has been reached
    AP[0]: AHB-AP (IDR: 0x74770001)
    AP[1]: APB-AP (IDR: 0x44770002)
    Iterating through AP map to find AHB-AP to use
    AP[0]: Core found
    AP[0]: AHB-AP ROM base: 0x4001A000
    CPUID register: 0x411CD200. Implementer code: 0x41 (ARM)
    Feature set: Baseline
    Cache: No cache
    Found Cortex-M23 r1p0, Little endian.
    FPUnit: 4 code (BP) slots and 0 literal slots
    Security extension: not implemented
    CoreSight components:
    ROMTbl[0] @ 4001A000
    [0][0]: E000E000 CID B105900D PID 000BBD20 DEVARCH 47702A04 DEVTYPE 00 Cortex-M23
    [0][1]: E0001000 CID B105900D PID 000BBD20 DEVARCH 47701A02 DEVTYPE 00 DWT
    [0][2]: E0002000 CID B105900D PID 000BBD20 DEVARCH 47701A03 DEVTYPE 00 FPB
    [0][3]: 40019000 CID B105900D PID 000BBD20 DEVARCH 47710A31 DEVTYPE 31 MTB
    Memory zones:
      Zone: "Default" Description: Default access mode
    Cortex-M23 identified.
    J-Link>rsettype 0
    Reset type NORMAL: Resets core & peripherals via SYSRESETREQ & VECTRESET bit.
    J-Link>r
    Reset delay: 0 ms
    Reset type NORMAL: Resets core & peripherals via SYSRESETREQ & VECTRESET bit.
    Reset: Halt core after reset via DEMCR.VC_CORERESET.
    Reset: Reset device via AIRCR.SYSRESETREQ.
    J-Link>h
    PC = 00000440, CycleCnt = 00000000
    R0 = 20007F7C, R1 = 00000012, R2 = FFFFFFFF, R3 = 00000000
    R4 = 646C726F, R5 = 64000C09, R6 = 64400600, R7 = 20007F10
    R8 = 00110101, R9 = 801418C4, R10= 04007C10, R11= E80621E4
    R12= 40945E00
    SP(R13)= 20008000, MSP= 20008000, PSP= C44BD030, R14(LR) = 0000043B
    XPSR = 81000000: APSR = Nzcvq, EPSR = 01000000, IPSR = 000 (NoException)
    CFBP = 00000000, CONTROL = 00, FAULTMASK = 00, BASEPRI = 00, PRIMASK = 00
    MSPLIM = 00000000
    PSPLIM = 00000000
    FPU regs: FPU not enabled / not implemented on connected CPU.
    J-Link>sleep 100
    Sleep(100)
    J-Link>mem32 0x00000000, 0x110
    00000000 = 20008000 00000441 00000489 00000489 
    00000010 = 00000489 00000489 00000489 00000489 
    00000020 = 00000489 00000489 00000489 00000489 
    00000030 = 00000489 00000489 00000489 00000489 
    00000040 = 00000489 00000489 00000489 00000489 
    00000050 = 00000489 00000489 00000489 00000489 
    00000060 = 00000489 00000489 00000489 00000489 
    00000070 = 00000489 00000489 00000489 00000489 
    00000080 = 00000489 00000489 00000489 00000489 
    00000090 = 00000489 00000489 00000489 00000489 
    000000A0 = 00000489 00000489 00000489 00000489 
    000000B0 = 00000489 00000489 00000489 00000489 
    000000C0 = F240B510 F2C20400 78230400 F240B963 
    000000D0 = F2C00300 B12B0300 5000F240 0000F2C0 
    000000E0 = BF00E000 70232301 46C0BD10 0300F240 
    000000F0 = 0300F2C0 B14BB510 0104F240 5000F240 
    00000100 = 0100F2C2 0000F2C0 BF00E000 46C0BD10 
    00000110 = B082B580 F640AF00 F2C45300 78DB0304 
    00000120 = F640B2DA F2C45300 217F0304 B2D2400A 
    00000130 = F64070DA F2C45300 78DB0304 F640B2DA 
    00000140 = F2C45300 21400304 B2D2430A 230170DA 
    00000150 = 687B607B DC292B02 0300F640 0304F2C4 
    00000160 = 3230687A 58D20092 0300F640 0304F2C4 
    00000170 = 04C92180 687A4311 00923230 F64050D1 
    00000180 = F2C40300 687A0304 00923230 F64058D2 
    00000190 = F2C40300 21800304 43110249 3230687A 
    000001A0 = 50D10092 3301687B E7D2607B 5300F640 
    000001B0 = 0304F2C4 B2DA78DB 5300F640 0304F2C4 
    000001C0 = 438A2140 70DAB2D2 5300F640 0304F2C4 
    000001D0 = B2DA78DB 5300F640 0304F2C4 42492180 
    000001E0 = B2D2430A 46C070DA B00246BD 0000BD80 
    000001F0 = AF00B580 0300F24E 0301F2C4 32FEF240 
    00000200 = 5299490F 0300F24E 0301F2C4 04522280 
    00000210 = F24E621A F2C40300 F2400301 621A1200 
    00000220 = 0300F24E 0301F2C4 32FEF240 52994905 
    00000230 = F2C42300 220C0307 46C0705A BD8046BD 
    00000240 = FFFFA501 FFFFA500 B084B580 6078AF00 
    00000250 = 1CFB000A 2300701A 1CFB60FB B1F3781B 
    00000260 = F2C42300 791B0307 001AB2DB 40132304 
    00000270 = 4153425A B103B2DB 2300E7F2 0307F2C4 
    00000280 = 7812687A 687B70DA 607B3301 781A1CFB 
    00000290 = 3A011CFB 68FB701A 60FB3301 46C0E7DD 
    000002A0 = B00446BD B5B0BD80 AF00B092 687B6078 
    000002B0 = 2300647B 233F643B 220018FB 6C7B701A 
    000002C0 = 2B8D781B 2300D04F 0307F2C4 B2DB791B 
    000002D0 = 2340001A 1E5A4013 B2DB4193 D0EE2B00 
    000002E0 = F2C42300 795B0307 6C7BB2DA 2300701A 
    000002F0 = 0307F2C4 B2DA791B F2C42300 21400307 
    00000300 = B2D2438A 6C3B711A 643B3301 2B626C3B 
    00000310 = 200CD916 F240183B F2C042A0 CA320200 
    00000320 = CA32C332 CA32C332 6811C332 88916019 
    00000330 = 79928099 183B719A 0018212B FF84F7FF 
    00000340 = 187B213F 187B781A 701A3201 21016C7B 
    00000350 = F7FF0018 6C7BFF79 2B8D781B 6C7BD0AF 
    00000360 = 647B3301 6C7BE7AB 647B3301 228A6C7B 
    00000370 = 233F701A 781B18FB 00182101 FF64F7FF 
    00000380 = 63BB2300 F2446BBA F2C0233F 429A030F 
    00000390 = 6BBBDC03 63BB3301 687BE7F4 00182164 
    000003A0 = FF52F7FF 2264687B 00182100 F86FF000 
    000003B0 = 46BD46C0 BDB0B012 B09FB590 F7FFAF00 
    000003C0 = F646FEA7 F2C473FC 4A1C0304 F7FF605A 
    000003D0 = 2300FF0F 0307F2C4 B2DA789B F2C42300 
    000003E0 = 21200307 B2D2430A 2300709A 0307F2C4 
    000003F0 = B2DA789B F2C42300 21100307 B2D2430A 
    00000400 = 2314709A 226418FB 00182100 F83FF000 
    00000410 = F240003B F2C042CC CA130200 6811C313 
    00000420 = 88926019 003B809A 00182112 FF0CF7FF 
    00000430 = 18FB2314 F7FF0018 E7F9FF36 7FFFFFFF 
    J-Link>w2 0x4001E3FE, 0xA50B
    Writing A50B -> 4001E3FE
    J-Link>mem16 0x4001E3FE, 1
    4001E3FE = 000B 
    J-Link>mem8 0x4001E0A0,1
    4001E0A0 = 02 
    J-Link>w1 0x4001E0A0, 0x00
    Writing 00 -> 4001E0A0
    J-Link>mem8 0x4001E0A0,1
    4001E0A0 = 00 
    J-Link>sleep 100
    Sleep(100)
    J-Link>mem8 0x4001E0A0,1
    4001E0A0 = 00 
    J-Link>mem8 0x4001e036,1
    4001E036 = 00 
    J-Link>w1 0x4001E036, 0x00
    Writing 00 -> 4001E036
    J-Link>sleep 1000
    Sleep(1000)
    J-Link>mem8 0x4001E03C, 1
    4001E03C = 01 
    J-Link>mem8 0x4001e036,1
    4001E036 = 00 
    J-Link>w4 0x4001E020, 0x11000101
    Writing 11000101 -> 4001E020
    J-Link>mem32 0x4001E020,1
    4001E020 = 11000101 
    J-Link>w1 0x4001E026, 0x00
    Writing 00 -> 4001E026
    J-Link>sleep 100
    Sleep(100)
    J-Link>w1 0x407EC124, 0x01
    Writing 01 -> 407EC124
    J-Link>sleep 1
    Sleep(1)
    J-Link>w1 0x407EC124, 0x00
    Writing 00 -> 407EC124
    J-Link>w1 0x407EC090, 0x01
    Writing 01 -> 407EC090
    J-Link>mem8 0x407EC090,1
    407EC090 = 00 
    J-Link>w1 0x407EC1DC, 0
    Writing 00 -> 407EC1DC
    J-Link>mem8 0x407EC1DC,1
    407EC1DC = 00 
    J-Link>w2 0x407EFFB2, 0xAA01
    Writing AA01 -> 407EFFB2
    J-Link>mem16 0x407EFFB2,1
    407EFFB2 = 0000 
    J-Link>w1 0x407EC180, 0xA5
    Writing A5 -> 407EC180
    J-Link>w1 0x407EC100, 0x92
    Writing 92 -> 407EC100
    J-Link>w1 0x407EC100, 0x6D
    Writing 6D -> 407EC100
    J-Link>w1 0x407EC100, 0x92
    Writing 92 -> 407EC100
    J-Link>mem8 0x407EC100,1
    407EC100 = 00 
    J-Link>w1 0x407EC180, 0xA5
    Writing A5 -> 407EC180
    J-Link>w1 0x407EC100, 0x82
    Writing 82 -> 407EC100
    J-Link>w1 0x407EC100, 0x7D
    Writing 7D -> 407EC100
    J-Link>w1 0x407EC100, 0x82
    Writing 82 -> 407EC100
    J-Link>mem8 0x407EC100,1
    407EC100 = 00 
    J-Link>sleep 100
    Sleep(100)
    J-Link>w1 0x407EC104, 0x00
    Writing 00 -> 407EC104
    J-Link>w1 0x407EC1D8, 0x17
    Writing 17 -> 407EC1D8
    J-Link>mem8 0x407EC1D8,1
    407EC1D8 = 00 
    J-Link>w2 0x407EC110, 0x0000
    Writing 0000 -> 407EC110
    J-Link>w2 0x407EC108, 0x0000
    Writing 0000 -> 407EC108
    J-Link>mem16 0x407EC110, 1
    407EC110 = 0000 
    J-Link>mem16 0x407EC108, 1
    407EC108 = 0000 
    J-Link>w2 0x407EC120, 0x0000
    Writing 0000 -> 407EC120
    J-Link>w2 0x407EC118, 0x07ff
    Writing 07FF -> 407EC118
    J-Link>mem16 0x407EC120, 1
    407EC120 = 0000 
    J-Link>mem16 0x407EC118, 1
    407EC118 = 0000 
    J-Link>w1 0x407EC114, 0x84
    Writing 84 -> 407EC114
    J-Link>mem8 0x407EC114,1
    407EC114 = 00 
    J-Link>mem8 0x407EC12C,1
    407EC12C = 00 
    J-Link>sleep 1000
    Sleep(1000)
    J-Link>mem8 0x407EC12C,1
    407EC12C = 00 
    J-Link>w1 0x407EC114, 0x00
    Writing 00 -> 407EC114
    J-Link>mem8 0x407EC114,1
    407EC114 = 00 
    J-Link>mem8 0x407EC12C,1
    407EC12C = 00 
    J-Link>sleep 1000
    Sleep(1000)
    J-Link>mem8 0x407EC12C,1
    407EC12C = 00 
    J-Link>mem16 0x407EC1F0,1
    407EC1F0 = 0000 
    J-Link>w1 0x407EC180, 0xA5
    Writing A5 -> 407EC180
    J-Link>w1 0x407EC100, 0x92
    Writing 92 -> 407EC100
    J-Link>w1 0x407EC100, 0x6D
    Writing 6D -> 407EC100
    J-Link>w1 0x407EC100, 0x92
    Writing 92 -> 407EC100
    J-Link>mem8 0x407EC100,1
    407EC100 = 00 
    J-Link>w1 0x407EC180, 0xA5
    Writing A5 -> 407EC180
    J-Link>w1 0x407EC100, 0x12
    Writing 12 -> 407EC100
    J-Link>w1 0x407EC100, 0xED
    Writing ED -> 407EC100
    J-Link>w1 0x407EC100, 0x12
    Writing 12 -> 407EC100
    J-Link>mem8 0x407EC100,1
    407EC100 = 00 
    J-Link>w1 0x407EC180, 0xA5
    Writing A5 -> 407EC180
    J-Link>w1 0x407EC100, 0x08
    Writing 08 -> 407EC100
    J-Link>w1 0x407EC100, 0xF7
    Writing F7 -> 407EC100
    J-Link>w1 0x407EC100, 0x08
    Writing 08 -> 407EC100
    J-Link>mem8 0x407EC100,1
    407EC100 = 00 
    J-Link>sleep 100
    Sleep(100)
    J-Link>w2 0x407EFFB0, 0xAA00
    Writing AA00 -> 407EFFB0
    J-Link>mem16 0x407EFFB0,1
    407EFFB0 = 0000 
    J-Link>r
    Reset delay: 0 ms
    Reset type NORMAL: Resets core & peripherals via SYSRESETREQ & VECTRESET bit.
    Reset: Halt core after reset via DEMCR.VC_CORERESET.
    Reset: Reset device via AIRCR.SYSRESETREQ.
    J-Link>h
    PC = 00000440, CycleCnt = 00000000
    R0 = 20007F7C, R1 = 00000012, R2 = FFFFFFFF, R3 = 00000000
    R4 = 646C726F, R5 = 64000C09, R6 = 64400600, R7 = 20007F10
    R8 = 00110101, R9 = 801418C4, R10= 04007C10, R11= E80621E4
    R12= 40945E00
    SP(R13)= 20008000, MSP= 20008000, PSP= C44BD030, R14(LR) = 0000043B
    XPSR = 81000000: APSR = Nzcvq, EPSR = 01000000, IPSR = 000 (NoException)
    CFBP = 00000000, CONTROL = 00, FAULTMASK = 00, BASEPRI = 00, PRIMASK = 00
    MSPLIM = 00000000
    PSPLIM = 00000000
    FPU regs: FPU not enabled / not implemented on connected CPU.
    J-Link>mem32 0x00000000, 0x110
    00000000 = 20008000 00000441 00000489 00000489 
    00000010 = 00000489 00000489 00000489 00000489 
    00000020 = 00000489 00000489 00000489 00000489 
    00000030 = 00000489 00000489 00000489 00000489 
    00000040 = 00000489 00000489 00000489 00000489 
    00000050 = 00000489 00000489 00000489 00000489 
    00000060 = 00000489 00000489 00000489 00000489 
    00000070 = 00000489 00000489 00000489 00000489 
    00000080 = 00000489 00000489 00000489 00000489 
    00000090 = 00000489 00000489 00000489 00000489 
    000000A0 = 00000489 00000489 00000489 00000489 
    000000B0 = 00000489 00000489 00000489 00000489 
    000000C0 = F240B510 F2C20400 78230400 F240B963 
    000000D0 = F2C00300 B12B0300 5000F240 0000F2C0 
    000000E0 = BF00E000 70232301 46C0BD10 0300F240 
    000000F0 = 0300F2C0 B14BB510 0104F240 5000F240 
    00000100 = 0100F2C2 0000F2C0 BF00E000 46C0BD10 
    00000110 = B082B580 F640AF00 F2C45300 78DB0304 
    00000120 = F640B2DA F2C45300 217F0304 B2D2400A 
    00000130 = F64070DA F2C45300 78DB0304 F640B2DA 
    00000140 = F2C45300 21400304 B2D2430A 230170DA 
    00000150 = 687B607B DC292B02 0300F640 0304F2C4 
    00000160 = 3230687A 58D20092 0300F640 0304F2C4 
    00000170 = 04C92180 687A4311 00923230 F64050D1 
    00000180 = F2C40300 687A0304 00923230 F64058D2 
    00000190 = F2C40300 21800304 43110249 3230687A 
    000001A0 = 50D10092 3301687B E7D2607B 5300F640 
    000001B0 = 0304F2C4 B2DA78DB 5300F640 0304F2C4 
    000001C0 = 438A2140 70DAB2D2 5300F640 0304F2C4 
    000001D0 = B2DA78DB 5300F640 0304F2C4 42492180 
    000001E0 = B2D2430A 46C070DA B00246BD 0000BD80 
    000001F0 = AF00B580 0300F24E 0301F2C4 32FEF240 
    00000200 = 5299490F 0300F24E 0301F2C4 04522280 
    00000210 = F24E621A F2C40300 F2400301 621A1200 
    00000220 = 0300F24E 0301F2C4 32FEF240 52994905 
    00000230 = F2C42300 220C0307 46C0705A BD8046BD 
    00000240 = FFFFA501 FFFFA500 B084B580 6078AF00 
    00000250 = 1CFB000A 2300701A 1CFB60FB B1F3781B 
    00000260 = F2C42300 791B0307 001AB2DB 40132304 
    00000270 = 4153425A B103B2DB 2300E7F2 0307F2C4 
    00000280 = 7812687A 687B70DA 607B3301 781A1CFB 
    00000290 = 3A011CFB 68FB701A 60FB3301 46C0E7DD 
    000002A0 = B00446BD B5B0BD80 AF00B092 687B6078 
    000002B0 = 2300647B 233F643B 220018FB 6C7B701A 
    000002C0 = 2B8D781B 2300D04F 0307F2C4 B2DB791B 
    000002D0 = 2340001A 1E5A4013 B2DB4193 D0EE2B00 
    000002E0 = F2C42300 795B0307 6C7BB2DA 2300701A 
    000002F0 = 0307F2C4 B2DA791B F2C42300 21400307 
    00000300 = B2D2438A 6C3B711A 643B3301 2B626C3B 
    00000310 = 200CD916 F240183B F2C042A0 CA320200 
    00000320 = CA32C332 CA32C332 6811C332 88916019 
    00000330 = 79928099 183B719A 0018212B FF84F7FF 
    00000340 = 187B213F 187B781A 701A3201 21016C7B 
    00000350 = F7FF0018 6C7BFF79 2B8D781B 6C7BD0AF 
    00000360 = 647B3301 6C7BE7AB 647B3301 228A6C7B 
    00000370 = 233F701A 781B18FB 00182101 FF64F7FF 
    00000380 = 63BB2300 F2446BBA F2C0233F 429A030F 
    00000390 = 6BBBDC03 63BB3301 687BE7F4 00182164 
    000003A0 = FF52F7FF 2264687B 00182100 F86FF000 
    000003B0 = 46BD46C0 BDB0B012 B09FB590 F7FFAF00 
    000003C0 = F646FEA7 F2C473FC 4A1C0304 F7FF605A 
    000003D0 = 2300FF0F 0307F2C4 B2DA789B F2C42300 
    000003E0 = 21200307 B2D2430A 2300709A 0307F2C4 
    000003F0 = B2DA789B F2C42300 21100307 B2D2430A 
    00000400 = 2314709A 226418FB 00182100 F83FF000 
    00000410 = F240003B F2C042CC CA130200 6811C313 
    00000420 = 88926019 003B809A 00182112 FF0CF7FF 
    00000430 = 18FB2314 F7FF0018 E7F9FF36 7FFFFFFF 
    
    Script processing completed.
    
    
    
    Type "connect" to establish a target connection, '?' for help
    J-Link>
    



  • I checked MCU documentation again. In chapter 4 there is a small note (3.) that says that some regions are reserved for option-setting memory (see image above).
    Could you consider to update  Figure 4.1 so, that it explicitly show option-setting region from 0000 0400h to 0000 0440h?
    And add extra note that this region should be filled with FF (factory default) unless secure zone operation is explicitly desired?

    0101 0034h |--------------------------------------|
               |                                      |
               | On-chip flash(option-setting memory) |
    0101 0008h |                                      |
               |--------------------------------------|
               |                                      |
               |              Reserved area *2        |
               |                                      |
    0004 0000h |--------------------------------------|
               |                                      |
               |      On-chip flash (program flash)   |
               |              (read only) *1          |
               |                                      |
    0000 0440h |--------------------------------------|
               |                                      |
               | On-chip flash(option-setting memory) |
               |     Factory defaul filled with FFs   |
               |                 *3                   |
               |                                      |
    0000 0400h |--------------------------------------|
               |                                      |
               |      On-chip flash (program flash)   |
               |              (read only)             |
               |                                      |
    0000 0000h |--------------------------------------|
    
    Note 1. The capacity of the flash or SRAM depends on the product.
    Note 2. Do not access reserved areas.
    Note 3. This region is filled with FFs when shipped from factory. Do not write random data orther than FF into this region.
            For details about valid values see section 7, Option-Setting Memory.

     

  • Hello Krisjans,

    Actually not all of these registers are filled with FFs when come from factory, for more details check section 7.2.1 ,7.2.2 and sections 15.6 from hardware manual. Also noticed that in section 7 is mentioned:

    Thanks again!

    Best Regards,

    IK

  • Hello ,

    Thanks for you help!

    Could you point me to option-setting memory registers, that are not programmed to 0xffffffff when MCU comes from factory?
    After erasing whole code-flash memory, do I need to write some specific values (other than FFs) in some option-setting memory registers even if I don't need MPU?

    OFS0 (0x00000400) is set to 0xffffffff according to chapter 7.2.1 note 1.
    OFS1 (0x00000404) also is set to 0xffffffff according to chapter 7.2.2 note 1.
    SECMPUAC (0x00000438) also must be set to 0xffffffff according to chapter 15.6.1.11.
    I'm not sure about other registers (0x0000408-0x00000434) in option-setting memory. Chapters 15.6.1.1-15.6.1.10 define "value after reset", but no information about value after chip-erase or value for device when come from factory. Does "value after reset" is the same as value programmed in factory?

    Best Regards,
    Krisjans

  • Hello Krisjans,

    Let me correct my previous answer. When a bare device arrives from factory the values of these registers will be filled with FFs, but if a customer is using Renesas development boards with an example demo downloaded to them it is possible that not all of the registers will be filled with FFs.

    When creating a new project-application in e2studio and you are using FSP, you will see that there are some default settings on BSP properties as shown in the picture below:

    So when downloading your code on board and access the contents of these registers you will see that the values have been written according this default settings in FSP. These setting can be changed according to each customer's application needs. But generally we are suggesting to customers not  to overwrite the contents of this registers, because it is possible that they will write wrong data that might cause a failure on MCU operation.

    Thank you!

    Best Regards,

    IK

  • Thanks !

    Thank you very much for your help and explanations!

    To help anyone else in the future - may I suggest you consider updating RA2A1 datasheet chapter 4 ("Address space") figure 4.1 ("Memory map")? Explicitly state that range 0x400-0x440 IS NOT "program flash", it is "option setting memory" and everyone should use extra caution when writing anything into this range.
    This is the chapter that most likely will be used to create linker script (or linker configuration) to assemble final binary that will be flashed into MCU.
    I used figure 4.1 to write my linker script and I incorrectly assumed that note "*3" apply to range 0101 0008h - 0101 0034h and that whole range 0000 0000h - 0004 0000h is program flash (vector table and executable code).

    Thanks again for your quick responses and in-depth explanations!

    Best Regards,
    Krisjans

  • Hello again Krisjans,

    Thank you for your suggestion and your interest in our MCU products!

    I would like also to correct something on my previous answers, on my first answer I told you to use Renesas Device Partition Manager and select Initialize device back to factory default, this was a mistake from my side since your device does not have trust zone support or DLM, that would make sense only on device which have these features like RA6M4,RA6M5,RA4M2 etc. I wanted to mention this to avoid any misunderstandings.

    We will be glad to support you again!

    Best Regards,

    IK