Kinetis MicrocontrollersのトピックRe: How to unsecure K22F

How to unsecure K22F

cwati — Tue, 04 Aug 2015 17:48:40 GMT

Hi there,

We just recently tried to program our production-version boards (2 kinds) using these K22F chips:

MK22FN1M0AVMC12

MK22FN256VDC12

As we tried to bringup the boards for the first time, we couldn't download the code image with J-Link (KDS &/ IAR) due to "timeout unsecuring device" (see exact error messages below).

Connecting to J-Link...

J-Link is connected.

Firmware: J-Link OpenSDA 2 compiled Aug 4 2014 13:30:09

Hardware: V1.00

S/N: 621000000

Checking target voltage...

Target voltage: 3.30 V

Listening on TCP/IP port 2331

Connecting to target...ERROR: Kinetis (connect): Timeout while unsecuring device. Erase never starts.

Kinetis (connect): Failed to unsecure Kinetis device.

ERROR: Error while identifying Cortex-M core.

ERROR: Could not connect to target.

Target connection failed. GDBServer will be closed...Restoring target state and closing J-Link connection...

Shutting down...

We also tried to unlock the MCU using J-Link Commander tool, but failed as well with similar messages.

We followed different posts, for example this one: How to unlock a secured Freescale Kinetis L chip

It didn't work. But, the chip is different so I'm wondering if there's another set of steps for K22F.

it seems like 22F is a newer board and there's no exact help on the forum for this.

Thanks,

Cecylia

Re: How to unsecure K22F

jeremyzhou — Wed, 05 Aug 2015 01:48:06 GMT

Hi Ceylia,

According to the message you shared, I think the root cause of issue is failed connection, Fig 1 shows the message about correct connection.

So please check the JTAG hardware circuit design at first, and I'd like to suggest that you can refer to the attachment for designing the JTAG interface.

Fig 1

Have a great day,
Ping

-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

Re: How to unsecure K22F

cwati — Wed, 05 Aug 2015 18:48:57 GMT

When i first connect the board to the debugger, it shows the following. So I think there is some sort of connection happening.

SEGGER J-Link Commander V4.92 ('?' for help)

Compiled Sep 30 2014 09:33:51

DLL version V4.92, compiled Sep 30 2014 09:33:42

Firmware: J-Link OpenSDA 2 compiled Aug 4 2014 13:30:09

Hardware: V1.00

S/N: 621000000

VTarget = 3.300V

No devices found on JTAG chain. Trying to find device on SWD.

No device found on SWD.

Failed to identify target. Trying again with slow (4 kHz) speed.

Info: Found SWD-DP with ID 0x2BA01477

****** Error: Error while identifying Cortex-M core.

Info: Found SWD-DP with ID 0x2BA01477

No devices found on JTAG chain. Trying to find device on SWD.

Info: Found SWD-DP with ID 0x2BA01477

****** Error: Error while identifying Cortex-M core.

Info: Found SWD-DP with ID 0x2BA01477

No device found on SWD.

J-Link>

Re: How to unsecure K22F

cwati — Fri, 07 Aug 2015 01:16:54 GMT

Ping,

We don't use JTAG per say. I only see 4 pins connected on this board, SWDIO & SWDCLK and then Voltage and GND. Do you think that might be causing it?

Thanks,
Cecylia

Re: How to unsecure K22F

jeremyzhou — Fri, 07 Aug 2015 01:40:25 GMT

Hi Cecyila,

The SWD mode debug port pin is compatible with the JTAG mode, likes the Fig 1 shows.

And I'd like to recommend that you'd better to add an external pull-up resistor (4.7~10kΩ ) to NMI pin.
Have a great day,

Ping

Re: How to unsecure K22F

cwati — Sat, 22 Aug 2015 00:00:20 GMT

This chip: MK22FN1M0XXX12 is giving me a lot of headache.
This is named 22F, but is actually 21F minus the security feature, or so they say.

Anyways, we found that this chip is super sensitive, meaning some firmware programming on this chip could easily cause the chip to get into some sort of locked state. (Maybe they didn't fully remove the "security" feature? I don't know...)

If you're lucky the chip is still responding and these steps might recover it.

Use JLINK Commander
Open a CMD (Command prompt) then "cd C:\Freescale\KDS***\segger"
Then type "jlink"
On a bad hub the Jlink can't recognize the device. Use the next steps to recover.
On the jlink prompt type:
1. speed 4
2. device ? ---> put device name, or simply
  device MK22FN1M0XXX12
3. erase ----> slow as expected at 4 KHz, but just be patient if you want to even have a hope of recovering your chip
4. unlock kinetis
If step 1. & 2. are successful, when you restart jlink, jlink should automatically recognize the chip.

Re: How to unsecure K22F

guangyuli — Wed, 04 Apr 2018 08:05:47 GMT

I just fix my KEA board which is locked by erasing block 0x2 (0x400~0x5FF)。

Thanks for Cecylia's sharing!