topic MK20DX256VLH7 Jlink Problem readout protection in Kinetis Microcontrollers

MK20DX256VLH7 Jlink Problem readout protection

flesky — Thu, 08 Apr 2021 08:32:24 GMT

Dear all,

i have some problems with my mk20dx256vlh7 boards. Some of them work perfectly, but i have boards they seem to by protected.i have checked the soldering, vbat, reset and connector everything is fine. i use the segger jlink flash tool. is there any reset script or an other trick to remove the protection?

thank you very much

Connecting ...
- Connecting via USB to probe/ programmer device 0
- Probe/ Programmer firmware: J-Link EDU Mini V1 compiled Jan 4 2021 16:18:35
- Device "MK20DX256XXX7" selected.
- Target interface speed: 4000 kHz (Fixed)
- VTarget = 3.299V
- InitTarget()
- Connect Under Reset
- Communication error while accessing MDM-AP.
- Connect Under Reset
- InitTarget()
- Connect Under Reset
- Communication error while accessing MDM-AP.
- Connect Under Reset
- ERROR: InitTarget(): PCode returned with error code -1
- ERROR: Failed to connect.
Could not establish a connection to target.
Connecting ...
- Connecting via USB to probe/ programmer device 0
- Probe/ Programmer firmware: J-Link EDU Mini V1 compiled Jan 4 2021 16:18:35
- Device "MK20DX256XXX7" selected.
- Target interface speed: 4000 kHz (Fixed)
- VTarget = 3.298V
- InitTarget()
- Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.

- Executing default behavior previously saved in the registry.
- Device will be unsecured now.
- Timeout while unsecuring device. Erase never starts.
- Found SW-DP with ID 0x2BA01477
- DPIDR: 0x2BA01477
- Scanning AP map to find all available APs
- AP[2]: Stopped AP scan as end of AP map has been reached
- AP[0]: AHB-AP (IDR: 0x24770011)
- AP[1]: JTAG-AP (IDR: 0x001C0000)
- Iterating through AP map to find AHB-AP to use
- AP[0]: Skipped. Could not read CPUID register
- AP[1]: Skipped. Not an AHB-AP
- InitTarget()
- Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.

- Executing default behavior previously saved in the registry.
- Device will be unsecured now.
- Timeout while unsecuring device. Erase never starts.
- Found SW-DP with ID 0x2BA01477
- DPIDR: 0x2BA01477
- Scanning AP map to find all available APs
- AP[2]: Stopped AP scan as end of AP map has been reached
- AP[0]: AHB-AP (IDR: 0x24770011)
- AP[1]: JTAG-AP (IDR: 0x001C0000)
- Iterating through AP map to find AHB-AP to use
- AP[0]: Skipped. Could not read CPUID register
- AP[1]: Skipped. Not an AHB-AP
- ERROR: Could not find core in Coresight setup
code -1
- ERROR: Failed to connect.
Could not establish a connection to target.

Re: MK20DX256VLH7 Jlink Problem readout protection

diego_charles — Fri, 09 Apr 2021 19:22:02 GMT

Hi @flesky

Could you try yo use the J-Link commander to try to unlock your chip?

After typing connect, and ? to open the following device selection window.

Make sure to select the part with the ALLOW SECURITY option.

Then , type the unlock kinetis command.

Here is an example of me using unlocking a secured KL03Z (In my case I actually enabled flash protection features previously)

After performing the unlock and see the ok return status , I use to continue with the erase command,

Then I if the debug is enabled again.

Wish this helps,

Diego

Re: MK20DX256VLH7 Jlink Problem readout protection

flesky — Mon, 12 Apr 2021 18:05:28 GMT

Hi Diego!

Thank you very much for your Help. Do you have an other idea? After i connect via SWD it automatical fails on timeout while unsecuring devices. so i cannot enter unsecure kinetis

Best Regards

Re: MK20DX256VLH7 Jlink Problem readout protection

flesky — Mon, 19 Apr 2021 11:25:47 GMT

@diego_charles any other ideas? if not, i have to rework 15boards

Thanks and best regards

Re: MK20DX256VLH7 Jlink Problem readout protection

diego_charles — Wed, 21 Apr 2021 02:31:48 GMT

Hi @flesky

Thank you for letting me know,

Check that your application firmware do not have any configuration in the flash configuration settings. They are described in the following post How (not) to Secure my Microcontroller ( I am not sure if you are getting this error only with several boards of your batch , or if all of them are failing)

Regarding physical connection , check that the PINs corresponding to SWD do not have any other functionality, , or that they are not muxed to be digital pins for example.

Depending on your IDE and available debuggers in your workbench there are other procedures that may help .For example, the MCUxpresso IDE has the GUI Flash tool that lets you resurrect locked MCUs by overwriting the memory contents of at the 0x400 offset.

(The GUI Flash tool supports Segger, CMSIS DAP and PE- Micro debug probes)

My apologies for the delay (unfortunately I had missed your reply)

Let me know your findings.

Diego.

Re: MK20DX256VLH7 Jlink Problem readout protection

chhsu0229 — Fri, 03 Dec 2021 03:16:45 GMT

Hi flesky,

Do you fix this issue, Jlink program readout protection? And how fix?

Thanks

Re: MK20DX256VLH7 Jlink Problem readout protection

Analtino-inside — Thu, 23 Jan 2025 22:28:32 GMT

Have the same problem, could you find the ansewere

Firmware: J-Link V12 compiled Dec 4 2024 17:53:50
Hardware version: V12.00
J-Link uptime (since boot): 0d 02h 49m 14s
S/N: 822000059
License(s): GDB
USB speed mode: High speed (480 MBit/s)
VTref=3.290V

Type "connect" to establish a target connection, '?' for help
J-Link>connect
Please specify device / core. <Default>: MKE06Z128XXX4
Type '?' for selection dialog
Device>
Please specify target interface:
J) JTAG (Default)
S) SWD
T) cJTAG
TIF>SWD
Specify target interface speed [kHz]. <Default>: 4000 kHz
Speed>
Device "MKE06Z128XXX4" selected.

Connecting to target via SWD
ConfigTargetSettings() start
ConfigTargetSettings() end - Took 14us
InitTarget() start
InitTarget()
SWD selected. Executing JTAG -> SWD switching sequence.
Device will be unsecured now.
Device will be unsecured now.
InitTarget() end - Took 4.92s
Found SW-DP with ID 0x0BC11477
DPIDR: 0x0BC11477
CoreSight SoC-400 or earlier
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x04770031, ADDR: 0x00000000)
AP[1]: JTAG-AP (IDR: 0x001C0020, ADDR: 0x01000000)
Iterating through AP map to find AHB-AP to use
AP[0]: Skipped. Could not read CPUID register
AP[1]: Skipped. Not an AHB-AP
Attach to CPU failed. Executing connect under reset.
Failed to power up DAP
ConfigTargetSettings() start
ConfigTargetSettings() end - Took 18us
InitTarget() start
InitTarget()
SWD selected. Executing JTAG -> SWD switching sequence.
Device will be unsecured now.
InitTarget() end - Took 3.06s
Found SW-DP with ID 0x0BC11477
DPIDR: 0x0BC11477
CoreSight SoC-400 or earlier
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x04770031, ADDR: 0x00000000)
AP[1]: JTAG-AP (IDR: 0x001C0020, ADDR: 0x01000000)
Iterating through AP map to find AHB-AP to use
AP[0]: Skipped. Could not read CPUID register
AP[1]: Skipped. Not an AHB-AP
Attach to CPU failed. Executing connect under reset.
Failed to power up DAP

Re: MK20DX256VLH7 Jlink Problem readout protection

flesky — Fri, 24 Jan 2025 07:24:14 GMT

i had replaced the broken MCUs with new ones. problem is that if you do a erase chip !! do not do this!

please read here:

https://forum.segger.com/index.php/Thread/2390-JLink-on-unsecure-and-erase-Kinetis-FLASH/

Hope that helps