How to unlock a secured Freescale Kinetis L chip

[rogerzhong]

Hi,

I am working on an FRDM-KL25Z board. But the MKL25Z128xx chip was secured accidentally, it seems that the on-board OpenSDA can not unlock this MKL25Z128xx chip, so I try to using "unlock kinetis" command in Jlink commander, but it also can not be unlocked successfully, and Jlink commander displays the following message.

===================================================

SEGGER J-Link Commander V4.56 ('?' for help)
Compiled Oct 22 2012 19:40:24
DLL version V4.56, compiled Oct 22 2012 19:40:04
Firmware: J-Link ARM V8 compiled Sep 20 2012 13:27:01
Hardware: V8.00
S/N:
Feature(s):
VTarget = 3.002V
Info: Found SWD-DP with ID 0x0BC11477

****** Error: Could not read AHB-AP Id. Could not connect to target.
Info: Found SWD-DP with ID 0x0BC11477
No devices found on JTAG chain. Trying to find device on SWD.
Info: Found SWD-DP with ID 0x0BC11477

****** Error: Could not read AHB-AP Id. Could not connect to target.
Info: Found SWD-DP with ID 0x0BC11477
No device found on SWD.
Failed to identify target. Trying again with slow (4 kHz) speed.
Info: TotalIRLen = ?, IRPrint = 0x..000000000000000000000000
Info: TotalIRLen = ?, IRPrint = 0x..000000000000000000000000
No devices found on JTAG chain. Trying to find device on SWD.
Info: Found SWD-DP with ID 0x0BC11477

****** Error: Could not read AHB-AP Id. Could not connect to target.
Info: Found SWD-DP with ID 0x0BC11477
No device found on SWD.
J-Link>unlock kinetis
Unlocking device...Timeout while unlocking device.
J-Link>
===================================================
How to unlock a secured Kinetis L MCU with a JLink? Does OpenSDA or Jlink support such feature of unlocking secured Kinetis L MCU?

Thanks!

[quanhuynh]

Hello,

I have a problem with FRDM-KL46Z, cannot connect with board, when try to connect with JLink, I see below info:

SEGGER J-Link Commander V4.98e ('?' for help)
Compiled May 5 2015 11:01:31
DLL version V5.12d, compiled Apr 26 2016 19:19:35
Firmware: J-Link OpenSDA compiled Oct 13 2015 12:09:57
Hardware: V1.00
S/N: 621000000
VTarget = 3.300V
Info: Device "CORTEX-M0+" selected.
Info: Found SWD-DP with ID 0x0BC11477
Info: Could not power-up debug power domain.

****** Error: DAP error while reading AHB-AP IDR.
Info: Found SWD-DP with ID 0x0BC11477
Info: Could not power-up debug power domain.
Info: Found SWD-DP with ID 0x0BC11477
Info: Could not power-up debug power domain.
Info: Found SWD-DP with ID 0x0BC11477
Info: Could not power-up debug power domain.
No devices found on JTAG chain. Trying to find device on SWD.
Info: Found SWD-DP with ID 0x0BC11477
Info: Could not power-up debug power domain.

****** Error: DAP error while reading AHB-AP IDR.
Info: Found SWD-DP with ID 0x0BC11477
Info: Could not power-up debug power domain.
Info: Found SWD-DP with ID 0x0BC11477
Info: Could not power-up debug power domain.
Info: Found SWD-DP with ID 0x0BC11477
Info: Could not power-up debug power domain.
No device found on SWD.
Failed to identify target. Trying again with slow (4 kHz) speed.
Info: Found SWD-DP with ID 0x0BC11477
Info: Could not power-up debug power domain.

****** Error: DAP error while reading AHB-AP IDR.
Info: Found SWD-DP with ID 0x0BC11477
Info: Could not power-up debug power domain.
Info: Found SWD-DP with ID 0x0BC11477
Info: Could not power-up debug power domain.
Info: Found SWD-DP with ID 0x0BC11477
Info: Could not power-up debug power domain.
No devices found on JTAG chain. Trying to find device on SWD.
Info: Found SWD-DP with ID 0x0BC11477
Info: Could not power-up debug power domain.

****** Error: DAP error while reading AHB-AP IDR.
Info: Found SWD-DP with ID 0x0BC11477
Info: Could not power-up debug power domain.
Info: Found SWD-DP with ID 0x0BC11477
Info: Could not power-up debug power domain.
Info: Found SWD-DP with ID 0x0BC11477
Info: Could not power-up debug power domain.
No device found on SWD.
J-Link>

I do not modify anything in HW

Please help me to solve this problem

Thank so much!

[kamejoko80]

Hi Erich,

Thanks so much for your reply.

So that means my board is not able to use now, what a pity.

I think we should not use evaluation kit like this.

Best Regards

[BlackNight]

It seems you bricked your microcontroller:

>>****** Error: Kinetis (connect): Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set and mass erase is disabled.

If you have secured your device with mass erase disabled, then the device is bricked, because this is what it is supposed to do when you have those bits set :-(

See https://mcuoneclipse.com/2012/11/04/how-not-to-secure-my-microcontroller/

The only solution you have is to unsolder the microcontroller and replace it with a new one on your board.

But keep in mind if you remove the microcontroller on the FRDM-KL46Z, you will not be able to debug it any more with the P&E OpenSDA application.

Bottom line is that a new board might be the best approach for you.

I hope this helps,

Erich

[kamejoko80]

Hello,

I have a problem with FRDM-KL46Z, I've tried to unlock by using Jlink commands and got the following error :

C:\Users\PhuongDM1>Jlink.exe -device MKL46Z256XXX4 -if SWD -speed 4000 -jtagconf -1,-1 -autoconnect 1

SEGGER J-Link Commander V5.12d (Compiled Apr 26 2016 19:20:11)

DLL version V5.12d, compiled Apr 26 2016 19:19:35

Connecting to J-Link via USB...O.K.

Firmware: J-Link OpenSDA 2 compiled Oct 13 2015 12:10:56

Hardware version: V1.00

S/N: 621000000

VTref = 3.300V

Device "MKL46Z256XXX4" selected.

Found SWD-DP with ID 0x0BC11477

****** Error: Kinetis (connect): Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set and mass erase is disabled.

J-Link cannot unprotect the device.

Kinetis (connect): Failed to unsecure Kinetis device.

Found SWD-DP with ID 0x0BC11477

****** Error: Kinetis (connect): Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set and mass erase is disabled.

J-Link cannot unprotect the device.

Kinetis (connect): Failed to unsecure Kinetis device.

Found SWD-DP with ID 0x0BC11477

****** Error: Kinetis (connect): Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set and mass erase is disabled.

J-Link cannot unprotect the device.

Kinetis (connect): Failed to unsecure Kinetis device.

Found SWD-DP with ID 0x0BC11477

****** Error: Kinetis (connect): Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set and mass erase is disabled.

J-Link cannot unprotect the device.

Kinetis (connect): Failed to unsecure Kinetis device.

Can not connect to target.

J-Link>unlock Kinetis

Found SWD-DP with ID 0x0BC11477

Unlocking device...Unlock via debug port is disabled. Unlock failed.

Timeout while unlocking device.

J-Link>

Please help me to unbrick the board.

Thank you very much.

[BlackNight · Accepted solution]

Hello,

I was able to unlock my device with CodeWarrior and OpenSDA:

Unsecuring the KL25Z Freedom Board | MCU on Eclipse

So no J-Link required for me.

I have received the attached Segger script file which might help you.

Hope this helps,

Erich

// J-Link Mass Erase script for Kinetis L - series devices

// VERSION 1.1

// History

// Version 1.0 - original release

// Version 1.1 Nov 1st 2012

//             Updated to include the setting of the system reset bit in the MDM-AP to allow the system to be

//             held in reset when the reset pin has been disabled

speed 1000

sleep 10

RSetType 2

r

halt

r0

sleep 1000

si 1

sleep 10

swdselect

sleep 10

swdwritedp 2, 0x01000000

sleep 10

swdreadap 0

sleep 10

swdreadap 0

sleep 10

swdreadap 1

sleep 10

swdreadap 1

sleep 10

swdreadap 0

sleep 10

swdreadap 0

sleep 10

swdwriteap 1, 0x00000008

sleep 1000

swdreadap 0

sleep 10

swdreadap 0

sleep 10

swdwriteap 1, 0x00000009

swdreadap 1

sleep 10

swdreadap 1

sleep 100

swdwritedp 2, 0x00000000

sleep 1000

r1

si 0

sleep 100

rx 0

exit

[rogerzhong]

Hi Erich,

I have tested the J-Link Mass Erase script file for Kinetis L series devices that you provided, it works Ok. Just copy and paste the command sequence shown as above into J-Link commander, then the secured MKL25Z128xxx chip was unlocked successfully.

Many thanks for your help. I think it's also very useful for any other people who have the same problem.

After being unlocked, the J-Link will prompt the information as below,

==============================

SEGGER J-Link Commander V4.56 ('?' for help)

Compiled Oct 22 2012 19:40:24

DLL version V4.56, compiled Oct 22 2012 19:40:04

Firmware: J-Link ARM V8 compiled Sep 20 2012 13:27:01

Hardware: V8.00

S/N:

Feature(s):

VTarget = 2.989V

Info: Found SWD-DP with ID 0x0BC11477

Info: FPUnit: 2 code (BP) slots and 0 literal slots

Info: Found Cortex-M0 r0p0, Little endian.

Found 1 JTAG device, Total IRLen = 4:

Cortex-M0 identified.

JTAG speed: 100 kHz

J-Link>

[rogerzhong]

Hi Erich,

Thanks for your good suggestion, I will make a try with your J-Link script file and feed back the result later.

Thanks!