MK20DX256VLH7 Jlink Problem readout protection

[flesky]

Dear all,

i have some problems with my mk20dx256vlh7 boards. Some of them work perfectly, but i have boards they seem to by protected.i have checked the soldering, vbat, reset and connector everything is fine. i use the segger jlink flash tool. is there any reset script or an other trick to remove the protection?

thank you very much

Connecting ...
- Connecting via USB to probe/ programmer device 0
- Probe/ Programmer firmware: J-Link EDU Mini V1 compiled Jan 4 2021 16:18:35
- Device "MK20DX256XXX7" selected.
- Target interface speed: 4000 kHz (Fixed)
- VTarget = 3.299V
- InitTarget()
- Connect Under Reset
- Communication error while accessing MDM-AP.
- Connect Under Reset
- InitTarget()
- Connect Under Reset
- Communication error while accessing MDM-AP.
- Connect Under Reset
- ERROR: InitTarget(): PCode returned with error code -1
- ERROR: Failed to connect.
Could not establish a connection to target.
Connecting ...
- Connecting via USB to probe/ programmer device 0
- Probe/ Programmer firmware: J-Link EDU Mini V1 compiled Jan 4 2021 16:18:35
- Device "MK20DX256XXX7" selected.
- Target interface speed: 4000 kHz (Fixed)
- VTarget = 3.298V
- InitTarget()
- Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.

- Executing default behavior previously saved in the registry.
- Device will be unsecured now.
- Timeout while unsecuring device. Erase never starts.
- Found SW-DP with ID 0x2BA01477
- DPIDR: 0x2BA01477
- Scanning AP map to find all available APs
- AP[2]: Stopped AP scan as end of AP map has been reached
- AP[0]: AHB-AP (IDR: 0x24770011)
- AP[1]: JTAG-AP (IDR: 0x001C0000)
- Iterating through AP map to find AHB-AP to use
- AP[0]: Skipped. Could not read CPUID register
- AP[1]: Skipped. Not an AHB-AP
- InitTarget()
- Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.

- Executing default behavior previously saved in the registry.
- Device will be unsecured now.
- Timeout while unsecuring device. Erase never starts.
- Found SW-DP with ID 0x2BA01477
- DPIDR: 0x2BA01477
- Scanning AP map to find all available APs
- AP[2]: Stopped AP scan as end of AP map has been reached
- AP[0]: AHB-AP (IDR: 0x24770011)
- AP[1]: JTAG-AP (IDR: 0x001C0000)
- Iterating through AP map to find AHB-AP to use
- AP[0]: Skipped. Could not read CPUID register
- AP[1]: Skipped. Not an AHB-AP
- ERROR: Could not find core in Coresight setup
code -1
- ERROR: Failed to connect.
Could not establish a connection to target.

[flesky]

@diego_charles any other ideas? if not, i have to rework 15boards

Thanks and best regards

[diego_charles]

Hi @flesky 

Thank you for letting me know,

Check that your application firmware do not have any configuration in the flash configuration settings. They are  described in the following  post How (not) to Secure my Microcontroller  ( I am not sure if you are getting this error only with  several boards of your batch , or if all of them are failing)

Regarding physical connection , check that  the PINs corresponding to SWD do not have any other functionality, , or that they are not muxed to be digital pins for example.

Depending on your  IDE  and available debuggers in your workbench there are other procedures that may help .For example, the MCUxpresso IDE has the GUI Flash tool that lets you resurrect locked MCUs by overwriting the memory contents of at the 0x400 offset.  

(The GUI Flash tool supports Segger, CMSIS DAP and PE- Micro debug probes)

My apologies for the delay (unfortunately I had missed your reply)

Let me know your findings.

Diego.

[diego_charles]

Hi @flesky 

Could you try yo use the J-Link commander to try to unlock your chip?

After typing connect, and ? to open the following  device selection window.

Make sure to select the part with the  ALLOW SECURITY option.

Then , type the  unlock kinetis command. 

Here is an example of me using unlocking a secured KL03Z (In my case I actually enabled flash protection features previously)

After performing the unlock and see the ok return status , I use to continue with the erase command, 

Then I if the debug is enabled again.

Wish this helps,

Diego

[flesky]

Hi Diego!

Thank you very much for your Help. Do you have an other idea? After i connect via SWD it automatical fails on timeout while unsecuring devices. so i cannot enter unsecure kinetis

Best Regards

[chhsu0229]

Hi flesky,

Do you fix this issue, Jlink program readout protection? And how fix?

Thanks