How to unsecure K22F

[cwati]

Hi there,

We just recently tried to program our production-version boards (2 kinds) using these K22F chips:

MK22FN1M0AVMC12

MK22FN256VDC12

As we tried to bringup the boards for the first time, we couldn't download the code image with J-Link (KDS &/ IAR) due to "timeout unsecuring device" (see exact error messages below).

Connecting to J-Link...

J-Link is connected.

Firmware: J-Link OpenSDA 2 compiled Aug  4 2014 13:30:09

Hardware: V1.00

S/N: 621000000

Checking target voltage...

Target voltage: 3.30 V

Listening on TCP/IP port 2331

Connecting to target...ERROR: Kinetis (connect): Timeout while unsecuring device. Erase never starts.

Kinetis (connect): Failed to unsecure Kinetis device.

ERROR: Error while identifying Cortex-M core.

ERROR: Could not connect to target.

Target connection failed. GDBServer will be closed...Restoring target state and closing J-Link connection...

Shutting down...

We also tried to unlock the MCU using J-Link Commander tool, but failed as well with similar messages.

We followed different posts, for example this one: How to unlock a secured Freescale Kinetis L chip

It didn't work.  But, the chip is different so I'm wondering if there's another set of steps for K22F.

it seems like 22F is a newer board and there's no exact help on the forum for this.

Thanks,

Cecylia

[guangyuli]

I just fix my KEA board which is locked by erasing block 0x2 (0x400~0x5FF)。

Thanks for Cecylia's sharing!

[cwati · Accepted solution]

This chip: MK22FN1M0XXX12 is giving me a lot of headache.
This is named 22F, but is actually 21F minus the security feature, or so they say.

Anyways, we found that this chip is super sensitive, meaning some firmware programming on this chip could easily cause the chip to get into some sort of locked state.  (Maybe they didn't fully remove the "security" feature? I don't know...)

If you're lucky the chip is still responding and these steps might recover it.

1. Use JLINK Commander
   Open a CMD (Command prompt) then "cd C:\Freescale\KDS***\segger"
   Then type "jlink"
   On a bad hub the Jlink can't recognize the device.  Use the next steps to recover.
2. On the jlink prompt type:
   1. speed 4 
   2. device ?   ---> put device name, or simply
      device MK22FN1M0XXX12
   3. erase  ----> slow as expected at 4 KHz, but just be patient if you want to even have a hope of recovering your chip
   4. unlock kinetis
3. If step 1. & 2. are successful, when you restart jlink, jlink should automatically recognize the chip.

[jeremyzhou]

Hi Ceylia,

According to the message you shared, I think the root cause of issue is failed connection, Fig 1 shows the message about correct connection.

So please check the JTAG hardware circuit design at first, and I'd like to suggest that you can refer to the attachment for designing the JTAG interface.

                                                                          Fig 1

Have a great day,
Ping

-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

[cwati]

Ping,

We don't use JTAG per say.  I only see 4 pins connected on this board, SWDIO & SWDCLK and then Voltage and GND.  Do you think that might be causing it?

Thanks,
Cecylia

[jeremyzhou]

Hi Cecyila,

The SWD mode debug port pin is compatible with the JTAG mode, likes the Fig 1 shows.

And I'd like to recommend that you'd better to add an external pull-up resistor (4.7~10kΩ ) to NMI pin.
Have a great day,

Ping

-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

[cwati]

When i first connect the board to the debugger, it shows the following.  So I think there is some sort of connection happening.

SEGGER J-Link Commander V4.92 ('?' for help)

Compiled Sep 30 2014 09:33:51

DLL version V4.92, compiled Sep 30 2014 09:33:42

Firmware: J-Link OpenSDA 2 compiled Aug  4 2014 13:30:09

Hardware: V1.00

S/N: 621000000

VTarget = 3.300V

No devices found on JTAG chain. Trying to find device on SWD.

No device found on SWD.

Failed to identify target. Trying again with slow (4 kHz) speed.

Info: Found SWD-DP with ID 0x2BA01477

****** Error: Error while identifying Cortex-M core.

Info: Found SWD-DP with ID 0x2BA01477

No devices found on JTAG chain. Trying to find device on SWD.

Info: Found SWD-DP with ID 0x2BA01477

****** Error: Error while identifying Cortex-M core.

Info: Found SWD-DP with ID 0x2BA01477

No device found on SWD.

J-Link>