Unable to Flash, Erase, or Restore Factory Default on RA8M1 due to Error 0xDA (Protection Error)

Hello Renesas Community,

I am currently working with the RA8M1 (EK-RA8M1) board and have encountered several critical issues related to flashing, erasing, and restoring the device to factory defaults. The primary error is 0xDA (Protection Error), which is preventing me from making further progress. Below are the details of my situation, along with the logs from various tools I've tried.

1. Issue with Flashing and Erasing using JLinkFlashLite

I attempted to erase and flash the device using JLinkFlashLite. Here’s the log from my attempt to erase the chip and flash a .hex file:

Erase Log:

Connecting to J-Link...
Bank selection: BankAddr=0x0300A100 Disabled
Bank selection: BankAddr=0x1300A180 Disabled
Bank selection: BankAddr=0x27030080 Disabled
Bank selection: BankAddr=0x02000000 Enabled
Bank selection: BankAddr=0x12000000 Enabled
Bank selection: BankAddr=0x27000000 Enabled
Bank selection: BankAddr=0x37000000 Enabled
Bank selection: BankAddr=0x80000000 Disabled
Bank selection: BankAddr=0x90000000 Disabled
Loader selection: BankAddr=0x0300A100 Loader=Default
Loader selection: BankAddr=0x1300A180 Loader=Default
Loader selection: BankAddr=0x27030080 Loader=Default
Loader selection: BankAddr=0x02000000 Loader=Default
Loader selection: BankAddr=0x12000000 Loader=Default
Loader selection: BankAddr=0x27000000 Loader=Default
Loader selection: BankAddr=0x37000000 Loader=Default
Loader selection: BankAddr=0x80000000 Loader=Default
Loader selection: BankAddr=0x90000000 Loader=Default
Connecting to target...
Erasing...
ERROR: Could not erase chip.
Done.

Flashing Log:


Selected file: /home/sravula/zephyr1.hex
Data file contains 7 memory ranges:
#0: 0x02000000 - 0x0200552B (21804 Bytes)
#1: 0x02005544 - 0x02005843 (768 Bytes)
#2: 0x02005850 - 0x020062E5 (2710 Bytes)
#3: 0x0300A100 - 0x0300A113 (20 Bytes)
#4: 0x0300A134 - 0x0300A137 (4 Bytes)
#5: 0x0300A200 - 0x0300A2CF (208 Bytes)
#6: 0x220018D8 - 0x22001E67 (1424 Bytes)
Connecting to J-Link...
Bank selection: BankAddr=0x0300A100 Disabled
Bank selection: BankAddr=0x1300A180 Disabled
Bank selection: BankAddr=0x27030080 Disabled
Bank selection: BankAddr=0x02000000 Enabled
Bank selection: BankAddr=0x12000000 Enabled
Bank selection: BankAddr=0x27000000 Enabled
Bank selection: BankAddr=0x37000000 Enabled
Bank selection: BankAddr=0x80000000 Disabled
Bank selection: BankAddr=0x90000000 Disabled
Loader selection: BankAddr=0x0300A100 Loader=Default
Loader selection: BankAddr=0x1300A180 Loader=Default
Loader selection: BankAddr=0x27030080 Loader=Default
Loader selection: BankAddr=0x02000000 Loader=Default
Loader selection: BankAddr=0x12000000 Loader=Default
Loader selection: BankAddr=0x27000000 Loader=Default
Loader selection: BankAddr=0x37000000 Loader=Default
Loader selection: BankAddr=0x80000000 Loader=Default
Loader selection: BankAddr=0x90000000 Loader=Default
Connecting to target...
Downloading...
ERROR: Could not download file.
Done.

2. Flashing and erase through JLinkExe

Here is the log from JLinkExe when i tried to flash and erase

SEGGER J-Link Commander V7.98g (Compiled Sep 5 2024 11:52:56)
DLL version V7.98g, compiled Sep 5 2024 11:52:30

Connecting to J-Link via USB...O.K.
Firmware: J-Link OB-RA4M2 compiled Jul 3 2024 17:03:13
Hardware version: V1.00
J-Link uptime (since boot): 0d 00h 21m 59s
S/N: 1081455662
USB speed mode: Full speed (12 MBit/s)
VTref=3.300V


Type "connect" to establish a target connection, '?' for help
J-Link>connect
Please specify device / core. <Default>: R7FA8M1AH
Type '?' for selection dialog
Device>
Please specify target interface:
J) JTAG (Default)
S) SWD
T) cJTAG
TIF>s
Specify target interface speed [kHz]. <Default>: 4000 kHz
Speed>
Device "R7FA8M1AH" selected.


Connecting to target via SWD
ConfigTargetSettings() start
Configuring FlashDLNoRMWThreshold=0x200 in order to make sure that option bytes programming is done via read-modify-write
ConfigTargetSettings() end - Took 32us
InitTarget() start
Identifying target device...
SWD selected. Executing JTAG -> SWD switching sequence...
Initializing DAP...
Error: Failed to initialize DAP.
Attach to CPU failed. Trying connect under reset.
Identifying target device...
SWD selected. Executing JTAG -> SWD switching sequence...
Initializing DAP...
DAP initialized successfully.
Determining TrustZone configuration...
Secure Debug: Enabled (SSD)
Determining currently configured transfer type by reading the AHB-AP CSW register.
--> Correct transfer type configured. Done.
InitTarget() end - Took 216ms
Found SW-DP with ID 0x6BA02477
DPIDR: 0x6BA02477
CoreSight SoC-400 or earlier
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x84770001, ADDR: 0x00000000)
AP[1]: APB-AP (IDR: 0x54770002, ADDR: 0x01000000)
Iterating through AP map to find AHB-AP to use
AP[0]: Core found
AP[0]: AHB-AP ROM base: 0xE00FE000
CPUID register: 0x410FD232. Implementer code: 0x41 (ARM)
Feature set: Mainline
Cache: L1 I/D-cache present
Found Cortex-M85 r0p2, Little endian.
FPUnit: 8 code (BP) slots and 0 literal slots
Security extension: implemented
Secure debug: enabled
PACBTI extension: implemented
CoreSight components:
ROMTbl[0] @ E00FE000
[0][0]: E00FF000 CID B105100D PID 000BB4D4 ROM Table
ROMTbl[1] @ E00FF000
[1][0]: E000E000 CID B105900D PID 000BBD23 DEVARCH 47702A04 DEVTYPE 00 ???
[1][1]: E0001000 CID B105900D PID 000BBD23 DEVARCH 47711A02 DEVTYPE 00 DWT
[1][2]: E0002000 CID B105900D PID 000BBD23 DEVARCH 47701A03 DEVTYPE 00 FPB
[1][3]: E0000000 CID B105900D PID 000BBD23 DEVARCH 47701A01 DEVTYPE 43 ITM
[1][5]: E0041000 CID B105900D PID 002BBD23 DEVARCH 47754A13 DEVTYPE 13 ETM
[1][6]: E0003000 CID B105900D PID 000BBD23 DEVARCH 47700A06 DEVTYPE 16 ???
[1][7]: E0042000 CID B105900D PID 000BBD23 DEVARCH 47701A14 DEVTYPE 14 CSS600-CTI
[0][1]: E0040000 CID B105900D PID 000BBD23 DEVARCH 00000000 DEVTYPE 11 TPIU
I-Cache L1: 16 KB, 256 Sets, 32 Bytes/Line, 2-Way
D-Cache L1: 16 KB, 128 Sets, 32 Bytes/Line, 4-Way
Memory zones:
Zone: "Default" Description: Default access mode
Cortex-M85 identified.
J-Link>loadfile zephyr1.hex
'loadfile': Performing implicit reset & halt of MCU.
ResetTarget() start
Reset: ARMv8M core with Security Extension enabled detected. Switch to secure domain.
Reset: Halt core after reset via DEMCR.VC_CORERESET.
Reset: Reset device via AIRCR.SYSRESETREQ.
ResetTarget() end - Took 55.6ms
Downloading file [zephyr1.hex]...
CPU is running at low speed (8351 kHz).
J-Link: Flash download: Bank 0 @ 0x0300A100: 2 ranges affected (240 bytes)
J-Link: Flash download: Total: 0.537s (Prepare: 0.144s, Compare: 0.056s, Erase: 0.156s, Program: 0.130s, Verify: 0.021s, Restore: 0.029s)
J-Link: Flash download: Program speed: 1 KB/s
CPU is running at low speed (8352 kHz).

****** Error: Failed to erase sectors.

Unspecified error -1
J-Link>erase
No address range specified, 'Erase Chip' will be executed
'erase': Performing implicit reset & halt of MCU.
ResetTarget() start
Reset: ARMv8M core with Security Extension enabled detected. Switch to secure domain.
Reset: Halt core after reset via DEMCR.VC_CORERESET.
Reset: Reset device via AIRCR.SYSRESETREQ.
ResetTarget() end - Took 54.3ms
Erasing device...
J-Link: Flash download: Only internal flash banks will be erased.
To enable erasing of other flash banks like QSPI or CFI, it needs to be enabled via "exec EnableEraseAllFlashBanks"

****** Error: Timeout while restoring target, RAMCode did not respond in time!
Failed to restore target. RAMCode never stops

****** Error: Timeout while preparing target, RAMCode did not respond in time!
Failed to perform RAMCode-sided Prepare()
ERROR: Erase returned with error code -1.
J-Link>exec EnableEraseAllFlashBanks
J-Link>erase
No address range specified, 'Erase Chip' will be executed
'erase': Performing implicit reset & halt of MCU.
ResetTarget() start
Reset: ARMv8M core with Security Extension enabled detected. Switch to secure domain.
Reset: Halt core after reset via DEMCR.VC_CORERESET.
Reset: Reset device via AIRCR.SYSRESETREQ.
ResetTarget() end - Took 54.6ms
Erasing device...

****** Error: Failed to measure CPU clock frequency
ERROR: Erase returned with error code -1.
J-Link>

2. Flashing through e2 Studio

I also attempted to flash the device using e2 studio, but I encountered errors during both the flashing and erasing processes. Since I was unable to erase the chip, I tried disabling the "Erase on-chip program flash before download" option, but the issue persisted.

3. Attempt to Initialize Device to Factory Default

To resolve the problem, I tried to initialize the device to factory default settings using Renesas Device Partition Manager in e2 studio. Unfortunately, I received the following error:

Renesas Device Partition Manager
version: 1.7.4.0
by Renesas Electronics Corporation

Starting connection with the following settings:
Device family : RA
Emulator information :
- Emulator type : Segger J-Link
- Connection interface : SWD
- Emulator selected : Auto
- Supply voltage (V) : Using external power supply.
Connection speed (Hz) : Default connection speed
Display errors in : English

Connecting...
Loading library : SUCCESSFUL!
Establishing connection : SUCCESSFUL!
Checking the device's TrustZone type : SUCCESSFUL!
CONNECTED.

Initializing device and rolling back Protection Level to PL2...
FAILED! A protection error has occurred in the device. Boot error code: 0xda

Disconnecting...
DISCONNECTED.

----------SUMMARY OF RESULT----------
Connection : SUCCESSFUL!
Device initialization : FAILED!
-------------END SUMMARY-------------

4. Suspected Issue: FSPR Bit or PBPS Registers

From research and reviewing other community posts, I suspect that the issue may be related to the FSPR bit or PBPS registers, which might have been altered, potentially causing certain flash blocks to become locked. However, my attempts to read the relevant memory regions or unlock the device have been unsuccessful.


I tried reading the SAS register at address 0x0100A134 using various methods, but with no success:

  • J-Link CLI: 

  • JMemExe:



  • e2 Studio:




I have been unable to flash, erase, or restore the device to factory defaults, and the protection error (0xDA) is blocking further progress. Could someone provide guidance on how to resolve this protection error? Any steps to unlock the device, disable FSPR bit locking, or reset the PBPS registers would be greatly appreciated.

Please let me know if any additional information or logs would help diagnose this issue.

P.S. This is my first post on the community, so if there are any mistakes in how I've structured or presented my query, please kindly ignore them. Suggestions for improvement are more than welcome!

Parents
  • Hello,

    The reasons that the Initialize command may return with protection error code 0xDA are:

    https://www.renesas.com/en/document/apn/renesas-boot-firmware-ra8m1-group-mcus?r=25447396

    SAS register on RA8M1 exists at 0x0300_A134. I think you are trying to read from a reserved area at 0x0100_A134 is in reserved area. Can you check again ?

  • I cannot connect my board now , I've accidentally transitioned my Renesas RA device to Protection Level 0 (PL0), which seems to have locked down debugging and certain security-related features. I'm trying to roll back to PL2 using the Renesas Flash programmer, but it is prompting for a AL2 key where can i get it from?

    [Edit]
    During the initialization process using Renesas Device Partition Manager, I encountered the error "Initializing device and rolling back Protection Level to PL2...". This occurred before I accidentally set the device to PL0. Could this be related in any way?

  • To change from PL0 to PL2 you can normally issue the Initialize command:

    Please try on Renesas Flash Programmer to issue the Initialize command from Target Device->Initialize Device. 

  • I tried the mentioned process on Renesas flash programmer, i got this particular error log

    Renesas Flash Programmer V3.16.00 [1 July 2024]
    Loading Project (C:\Users\aannarapu\Documents\Renesas Flash Programmer\V3.16\testing\testing.rpj)

     

    Target device : R7FA8M1AHECBD

     

    Connecting the tool
        J-Link Firmware: J-Link OB-RA4M2 compiled Jul  3 2024 17:03:13
    Tool : J-Link (SEGGER J-Link (unknown)), Interface : SWD
    Connecting to the target device
    Setting the target device
    Setting the target device
    Communication speed : 12.5 MHz
    Signature:
        Device: R7FA8M1AHECBD
        Boot Firmware Version: V3.6.32
        Device Unique ID: 4E4B2E9239E64E36305034362D147F88
        Device Code: 03
        Current state: OEM_PL0
        Current Authentication Level: AL0
        AL2 Key Injection: No
        AL1 Key Injection: No
        RMA Key Injection: No

     

    Erasing the target device
    Setting the target device

     

    Disconnecting the tool
    Error(E100000E): A protection error occurred in the device. (Command: 50, Response: DA)
    Operation failed.

     

    This was my initial problem where I couldn't initialize the device.

    I had a option of changing the DLM state to OLM_AL2 , which i tried but prompted with authentication key, is my approach correct?

  • Can you check the FSPR bit and PBPS registers with J-Link ?

  • No, I am unable read the memory 

    Target device : R7FA8M1AHECBD

    Connecting the tool
    J-Link Firmware: J-Link OB-RA4M2 compiled Jul 3 2024 17:03:13
    Tool : J-Link (SEGGER J-Link (unknown)), Interface : SWD
    Connecting to the target device
    Setting the target device
    Setting the target device
    Communication speed : 12.5 MHz
    Signature:
    Device: R7FA8M1AHECBD
    Boot Firmware Version: V3.6.32
    Device Unique ID: 4E4B2E9239E64E36305034362D147F88
    Device Code: 03
    Current state: OEM_PL0
    Current Authentication Level: AL0
    AL2 Key Injection: No
    AL1 Key Injection: No
    RMA Key Injection: No

    Reading data
    [Config Area 1] 0x0300A100 - 0x0300A17F size : 128
    Setting the target device

    Disconnecting the tool
    Error(E100000E): A protection error occurred in the device. (Command: 15, Response: E4)
    Operation failed.

  • So you have protection level set to PL0 and authentication level set to AL0.

    Changing to a higher PL requires that the MCU be at that AL or higher. For example, when the current AL is AL0, changing to PL1 or PL2 is impossible. PL can be reset only by the Initialize command.

    Changing AL0 to AL1 or AL2 is also not possible because this requires the AL keys but you do not have injected either of these.

    Can you try to use the J-Link commander tool to read FSPR bit at 0x0300_A134 and PBPS registers and also read flash options from Target Device->Read Flash options on RFP ?

Reply
  • So you have protection level set to PL0 and authentication level set to AL0.

    Changing to a higher PL requires that the MCU be at that AL or higher. For example, when the current AL is AL0, changing to PL1 or PL2 is impossible. PL can be reset only by the Initialize command.

    Changing AL0 to AL1 or AL2 is also not possible because this requires the AL keys but you do not have injected either of these.

    Can you try to use the J-Link commander tool to read FSPR bit at 0x0300_A134 and PBPS registers and also read flash options from Target Device->Read Flash options on RFP ?

Children
  • I cannot read the FSPR bit using the J-Link commander tool (JMemExe). It returned an error:

    Could not connect to target for unknown reasons. 

    When I tried to read the Flash options, it failed with a protection error.

    Target device : R7FA8M1AHECBD

    Connecting the tool
    J-Link Firmware: J-Link OB-RA4M2 compiled Jul 3 2024 17:03:13
    Tool : J-Link (SEGGER J-Link (unknown)), Interface : SWD
    Connecting to the target device
    Setting the target device
    Setting the target device
    Communication speed : 12.5 MHz
    Signature:
    Device: R7FA8M1AHECBD
    Boot Firmware Version: V3.6.32
    Device Unique ID: 4E4B2E9239E64E36305034362D147F88
    Device Code: 03
    Current state: OEM_PL0
    Current Authentication Level: AL0
    AL2 Key Injection: No
    AL1 Key Injection: No
    RMA Key Injection: No

    Reading data
    [Flash Options]
    Option Information : Boundary
    Option Information : DLM State
    Option Information : Anti-Rollback Counter Settings
    Setting the target device

    Disconnecting the tool
    Error(E100000E): A protection error occurred in the device. (Command: 4D, Response: E4)
    Operation failed.

    Is there a way to inject those AL keys?

  • No, AL2_KEY can be injected in AL2, AL1_KEY can be injected in AL2 or AL1.