Hello Renesas Community,
I am currently working with the RA8M1 (EK-RA8M1) board and have encountered several critical issues related to flashing, erasing, and restoring the device to factory defaults. The primary error is 0xDA (Protection Error), which is preventing me from making further progress. Below are the details of my situation, along with the logs from various tools I've tried.
I attempted to erase and flash the device using JLinkFlashLite. Here’s the log from my attempt to erase the chip and flash a .hex file:
Connecting to J-Link...Bank selection: BankAddr=0x0300A100 DisabledBank selection: BankAddr=0x1300A180 DisabledBank selection: BankAddr=0x27030080 DisabledBank selection: BankAddr=0x02000000 EnabledBank selection: BankAddr=0x12000000 EnabledBank selection: BankAddr=0x27000000 EnabledBank selection: BankAddr=0x37000000 EnabledBank selection: BankAddr=0x80000000 DisabledBank selection: BankAddr=0x90000000 DisabledLoader selection: BankAddr=0x0300A100 Loader=DefaultLoader selection: BankAddr=0x1300A180 Loader=DefaultLoader selection: BankAddr=0x27030080 Loader=DefaultLoader selection: BankAddr=0x02000000 Loader=DefaultLoader selection: BankAddr=0x12000000 Loader=DefaultLoader selection: BankAddr=0x27000000 Loader=DefaultLoader selection: BankAddr=0x37000000 Loader=DefaultLoader selection: BankAddr=0x80000000 Loader=DefaultLoader selection: BankAddr=0x90000000 Loader=DefaultConnecting to target...Erasing...ERROR: Could not erase chip.Done.
Selected file: /home/sravula/zephyr1.hexData file contains 7 memory ranges: #0: 0x02000000 - 0x0200552B (21804 Bytes) #1: 0x02005544 - 0x02005843 (768 Bytes) #2: 0x02005850 - 0x020062E5 (2710 Bytes) #3: 0x0300A100 - 0x0300A113 (20 Bytes) #4: 0x0300A134 - 0x0300A137 (4 Bytes) #5: 0x0300A200 - 0x0300A2CF (208 Bytes) #6: 0x220018D8 - 0x22001E67 (1424 Bytes)Connecting to J-Link...Bank selection: BankAddr=0x0300A100 DisabledBank selection: BankAddr=0x1300A180 DisabledBank selection: BankAddr=0x27030080 DisabledBank selection: BankAddr=0x02000000 EnabledBank selection: BankAddr=0x12000000 EnabledBank selection: BankAddr=0x27000000 EnabledBank selection: BankAddr=0x37000000 EnabledBank selection: BankAddr=0x80000000 DisabledBank selection: BankAddr=0x90000000 DisabledLoader selection: BankAddr=0x0300A100 Loader=DefaultLoader selection: BankAddr=0x1300A180 Loader=DefaultLoader selection: BankAddr=0x27030080 Loader=DefaultLoader selection: BankAddr=0x02000000 Loader=DefaultLoader selection: BankAddr=0x12000000 Loader=DefaultLoader selection: BankAddr=0x27000000 Loader=DefaultLoader selection: BankAddr=0x37000000 Loader=DefaultLoader selection: BankAddr=0x80000000 Loader=DefaultLoader selection: BankAddr=0x90000000 Loader=DefaultConnecting to target...Downloading...ERROR: Could not download file.Done.
Here is the log from JLinkExe when i tried to flash and erase
SEGGER J-Link Commander V7.98g (Compiled Sep 5 2024 11:52:56)DLL version V7.98g, compiled Sep 5 2024 11:52:30
Connecting to J-Link via USB...O.K.Firmware: J-Link OB-RA4M2 compiled Jul 3 2024 17:03:13Hardware version: V1.00J-Link uptime (since boot): 0d 00h 21m 59sS/N: 1081455662USB speed mode: Full speed (12 MBit/s)VTref=3.300V
Type "connect" to establish a target connection, '?' for helpJ-Link>connectPlease specify device / core. <Default>: R7FA8M1AHType '?' for selection dialogDevice>Please specify target interface: J) JTAG (Default) S) SWD T) cJTAGTIF>sSpecify target interface speed [kHz]. <Default>: 4000 kHzSpeed>Device "R7FA8M1AH" selected.
Connecting to target via SWDConfigTargetSettings() startConfiguring FlashDLNoRMWThreshold=0x200 in order to make sure that option bytes programming is done via read-modify-writeConfigTargetSettings() end - Took 32usInitTarget() startIdentifying target device...SWD selected. Executing JTAG -> SWD switching sequence...Initializing DAP...Error: Failed to initialize DAP.Attach to CPU failed. Trying connect under reset.Identifying target device...SWD selected. Executing JTAG -> SWD switching sequence...Initializing DAP...DAP initialized successfully.Determining TrustZone configuration... Secure Debug: Enabled (SSD)Determining currently configured transfer type by reading the AHB-AP CSW register. --> Correct transfer type configured. Done.InitTarget() end - Took 216msFound SW-DP with ID 0x6BA02477DPIDR: 0x6BA02477CoreSight SoC-400 or earlierScanning AP map to find all available APsAP[2]: Stopped AP scan as end of AP map has been reachedAP[0]: AHB-AP (IDR: 0x84770001, ADDR: 0x00000000)AP[1]: APB-AP (IDR: 0x54770002, ADDR: 0x01000000)Iterating through AP map to find AHB-AP to useAP[0]: Core foundAP[0]: AHB-AP ROM base: 0xE00FE000CPUID register: 0x410FD232. Implementer code: 0x41 (ARM)Feature set: MainlineCache: L1 I/D-cache presentFound Cortex-M85 r0p2, Little endian.FPUnit: 8 code (BP) slots and 0 literal slotsSecurity extension: implementedSecure debug: enabledPACBTI extension: implementedCoreSight components:ROMTbl[0] @ E00FE000[0][0]: E00FF000 CID B105100D PID 000BB4D4 ROM TableROMTbl[1] @ E00FF000[1][0]: E000E000 CID B105900D PID 000BBD23 DEVARCH 47702A04 DEVTYPE 00 ???[1][1]: E0001000 CID B105900D PID 000BBD23 DEVARCH 47711A02 DEVTYPE 00 DWT[1][2]: E0002000 CID B105900D PID 000BBD23 DEVARCH 47701A03 DEVTYPE 00 FPB[1][3]: E0000000 CID B105900D PID 000BBD23 DEVARCH 47701A01 DEVTYPE 43 ITM[1][5]: E0041000 CID B105900D PID 002BBD23 DEVARCH 47754A13 DEVTYPE 13 ETM[1][6]: E0003000 CID B105900D PID 000BBD23 DEVARCH 47700A06 DEVTYPE 16 ???[1][7]: E0042000 CID B105900D PID 000BBD23 DEVARCH 47701A14 DEVTYPE 14 CSS600-CTI[0][1]: E0040000 CID B105900D PID 000BBD23 DEVARCH 00000000 DEVTYPE 11 TPIUI-Cache L1: 16 KB, 256 Sets, 32 Bytes/Line, 2-WayD-Cache L1: 16 KB, 128 Sets, 32 Bytes/Line, 4-WayMemory zones: Zone: "Default" Description: Default access modeCortex-M85 identified.J-Link>loadfile zephyr1.hex 'loadfile': Performing implicit reset & halt of MCU.ResetTarget() startReset: ARMv8M core with Security Extension enabled detected. Switch to secure domain.Reset: Halt core after reset via DEMCR.VC_CORERESET.Reset: Reset device via AIRCR.SYSRESETREQ.ResetTarget() end - Took 55.6msDownloading file [zephyr1.hex]...CPU is running at low speed (8351 kHz).J-Link: Flash download: Bank 0 @ 0x0300A100: 2 ranges affected (240 bytes)J-Link: Flash download: Total: 0.537s (Prepare: 0.144s, Compare: 0.056s, Erase: 0.156s, Program: 0.130s, Verify: 0.021s, Restore: 0.029s)J-Link: Flash download: Program speed: 1 KB/sCPU is running at low speed (8352 kHz).
****** Error: Failed to erase sectors.
Unspecified error -1J-Link>eraseNo address range specified, 'Erase Chip' will be executed'erase': Performing implicit reset & halt of MCU.ResetTarget() startReset: ARMv8M core with Security Extension enabled detected. Switch to secure domain.Reset: Halt core after reset via DEMCR.VC_CORERESET.Reset: Reset device via AIRCR.SYSRESETREQ.ResetTarget() end - Took 54.3msErasing device...J-Link: Flash download: Only internal flash banks will be erased.To enable erasing of other flash banks like QSPI or CFI, it needs to be enabled via "exec EnableEraseAllFlashBanks"
****** Error: Timeout while restoring target, RAMCode did not respond in time!Failed to restore target. RAMCode never stops
****** Error: Timeout while preparing target, RAMCode did not respond in time!Failed to perform RAMCode-sided Prepare()ERROR: Erase returned with error code -1.J-Link>exec EnableEraseAllFlashBanksJ-Link>eraseNo address range specified, 'Erase Chip' will be executed'erase': Performing implicit reset & halt of MCU.ResetTarget() startReset: ARMv8M core with Security Extension enabled detected. Switch to secure domain.Reset: Halt core after reset via DEMCR.VC_CORERESET.Reset: Reset device via AIRCR.SYSRESETREQ.ResetTarget() end - Took 54.6msErasing device...
****** Error: Failed to measure CPU clock frequencyERROR: Erase returned with error code -1.J-Link>
I also attempted to flash the device using e2 studio, but I encountered errors during both the flashing and erasing processes. Since I was unable to erase the chip, I tried disabling the "Erase on-chip program flash before download" option, but the issue persisted.
To resolve the problem, I tried to initialize the device to factory default settings using Renesas Device Partition Manager in e2 studio. Unfortunately, I received the following error:
Renesas Device Partition Manager version: 1.7.4.0 by Renesas Electronics Corporation
Starting connection with the following settings: Device family : RA Emulator information : - Emulator type : Segger J-Link - Connection interface : SWD - Emulator selected : Auto - Supply voltage (V) : Using external power supply. Connection speed (Hz) : Default connection speed Display errors in : English
Connecting... Loading library : SUCCESSFUL! Establishing connection : SUCCESSFUL! Checking the device's TrustZone type : SUCCESSFUL! CONNECTED.
Initializing device and rolling back Protection Level to PL2...FAILED! A protection error has occurred in the device. Boot error code: 0xda
Disconnecting...DISCONNECTED.
----------SUMMARY OF RESULT----------Connection : SUCCESSFUL! Device initialization : FAILED! -------------END SUMMARY-------------
From research and reviewing other community posts, I suspect that the issue may be related to the FSPR bit or PBPS registers, which might have been altered, potentially causing certain flash blocks to become locked. However, my attempts to read the relevant memory regions or unlock the device have been unsuccessful.
I tried reading the SAS register at address 0x0100A134 using various methods, but with no success:
0x0100A134
I have been unable to flash, erase, or restore the device to factory defaults, and the protection error (0xDA) is blocking further progress. Could someone provide guidance on how to resolve this protection error? Any steps to unlock the device, disable FSPR bit locking, or reset the PBPS registers would be greatly appreciated.
Please let me know if any additional information or logs would help diagnose this issue.P.S. This is my first post on the community, so if there are any mistakes in how I've structured or presented my query, please kindly ignore them. Suggestions for improvement are more than welcome!
Hello,
The reasons that the Initialize command may return with protection error code 0xDA are:
https://www.renesas.com/en/document/apn/renesas-boot-firmware-ra8m1-group-mcus?r=25447396
SAS register on RA8M1 exists at 0x0300_A134. I think you are trying to read from a reserved area at 0x0100_A134 is in reserved area. Can you check again ?
I cannot connect my board now , I've accidentally transitioned my Renesas RA device to Protection Level 0 (PL0), which seems to have locked down debugging and certain security-related features. I'm trying to roll back to PL2 using the Renesas Flash programmer, but it is prompting for a AL2 key where can i get it from?
[Edit]During the initialization process using Renesas Device Partition Manager, I encountered the error "Initializing device and rolling back Protection Level to PL2...". This occurred before I accidentally set the device to PL0. Could this be related in any way?
To change from PL0 to PL2 you can normally issue the Initialize command:
Please try on Renesas Flash Programmer to issue the Initialize command from Target Device->Initialize Device.
I tried the mentioned process on Renesas flash programmer, i got this particular error log
Renesas Flash Programmer V3.16.00 [1 July 2024] Loading Project (C:\Users\aannarapu\Documents\Renesas Flash Programmer\V3.16\testing\testing.rpj)
Target device : R7FA8M1AHECBD
Connecting the tool J-Link Firmware: J-Link OB-RA4M2 compiled Jul 3 2024 17:03:13 Tool : J-Link (SEGGER J-Link (unknown)), Interface : SWD Connecting to the target device Setting the target device Setting the target device Communication speed : 12.5 MHz Signature: Device: R7FA8M1AHECBD Boot Firmware Version: V3.6.32 Device Unique ID: 4E4B2E9239E64E36305034362D147F88 Device Code: 03 Current state: OEM_PL0 Current Authentication Level: AL0 AL2 Key Injection: No AL1 Key Injection: No RMA Key Injection: No
Erasing the target device Setting the target device
Disconnecting the tool Error(E100000E): A protection error occurred in the device. (Command: 50, Response: DA) Operation failed.
This was my initial problem where I couldn't initialize the device.
I had a option of changing the DLM state to OLM_AL2 , which i tried but prompted with authentication key, is my approach correct?
Can you check the FSPR bit and PBPS registers with J-Link ?
No, I am unable read the memory
Connecting the tool J-Link Firmware: J-Link OB-RA4M2 compiled Jul 3 2024 17:03:13Tool : J-Link (SEGGER J-Link (unknown)), Interface : SWDConnecting to the target deviceSetting the target deviceSetting the target deviceCommunication speed : 12.5 MHzSignature: Device: R7FA8M1AHECBD Boot Firmware Version: V3.6.32 Device Unique ID: 4E4B2E9239E64E36305034362D147F88 Device Code: 03 Current state: OEM_PL0 Current Authentication Level: AL0 AL2 Key Injection: No AL1 Key Injection: No RMA Key Injection: No
Reading data [Config Area 1] 0x0300A100 - 0x0300A17F size : 128Setting the target device
Disconnecting the toolError(E100000E): A protection error occurred in the device. (Command: 15, Response: E4)Operation failed.
So you have protection level set to PL0 and authentication level set to AL0.
Changing to a higher PL requires that the MCU be at that AL or higher. For example, when the current AL is AL0, changing to PL1 or PL2 is impossible. PL can be reset only by the Initialize command.
Changing AL0 to AL1 or AL2 is also not possible because this requires the AL keys but you do not have injected either of these.
Can you try to use the J-Link commander tool to read FSPR bit at 0x0300_A134 and PBPS registers and also read flash options from Target Device->Read Flash options on RFP ?
I cannot read the FSPR bit using the J-Link commander tool (JMemExe). It returned an error:
Could not connect to target for unknown reasons.
When I tried to read the Flash options, it failed with a protection error.
Reading data [Flash Options] Option Information : BoundaryOption Information : DLM StateOption Information : Anti-Rollback Counter SettingsSetting the target device
Disconnecting the toolError(E100000E): A protection error occurred in the device. (Command: 4D, Response: E4)Operation failed.Is there a way to inject those AL keys?
No, AL2_KEY can be injected in AL2, AL1_KEY can be injected in AL2 or AL1.