MK20DX256VLH7 Jlink Problem readout protection

[flesky]

Dear all,

i have some problems with my mk20dx256vlh7 boards. Some of them work perfectly, but i have boards they seem to by protected.i have checked the soldering, vbat, reset and connector everything is fine. i use the segger jlink flash tool. is there any reset script or an other trick to remove the protection?

thank you very much

Connecting ...
- Connecting via USB to probe/ programmer device 0
- Probe/ Programmer firmware: J-Link EDU Mini V1 compiled Jan 4 2021 16:18:35
- Device "MK20DX256XXX7" selected.
- Target interface speed: 4000 kHz (Fixed)
- VTarget = 3.299V
- InitTarget()
- Connect Under Reset
- Communication error while accessing MDM-AP.
- Connect Under Reset
- InitTarget()
- Connect Under Reset
- Communication error while accessing MDM-AP.
- Connect Under Reset
- ERROR: InitTarget(): PCode returned with error code -1
- ERROR: Failed to connect.
Could not establish a connection to target.
Connecting ...
- Connecting via USB to probe/ programmer device 0
- Probe/ Programmer firmware: J-Link EDU Mini V1 compiled Jan 4 2021 16:18:35
- Device "MK20DX256XXX7" selected.
- Target interface speed: 4000 kHz (Fixed)
- VTarget = 3.298V
- InitTarget()
- Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.

- Executing default behavior previously saved in the registry.
- Device will be unsecured now.
- Timeout while unsecuring device. Erase never starts.
- Found SW-DP with ID 0x2BA01477
- DPIDR: 0x2BA01477
- Scanning AP map to find all available APs
- AP[2]: Stopped AP scan as end of AP map has been reached
- AP[0]: AHB-AP (IDR: 0x24770011)
- AP[1]: JTAG-AP (IDR: 0x001C0000)
- Iterating through AP map to find AHB-AP to use
- AP[0]: Skipped. Could not read CPUID register
- AP[1]: Skipped. Not an AHB-AP
- InitTarget()
- Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.

- Executing default behavior previously saved in the registry.
- Device will be unsecured now.
- Timeout while unsecuring device. Erase never starts.
- Found SW-DP with ID 0x2BA01477
- DPIDR: 0x2BA01477
- Scanning AP map to find all available APs
- AP[2]: Stopped AP scan as end of AP map has been reached
- AP[0]: AHB-AP (IDR: 0x24770011)
- AP[1]: JTAG-AP (IDR: 0x001C0000)
- Iterating through AP map to find AHB-AP to use
- AP[0]: Skipped. Could not read CPUID register
- AP[1]: Skipped. Not an AHB-AP
- ERROR: Could not find core in Coresight setup
code -1
- ERROR: Failed to connect.
Could not establish a connection to target.

[flesky]

hi

i had replaced the broken MCUs with new ones. problem is that if you do a erase chip !! do not do this!

please read here:

https://forum.segger.com/index.php/Thread/2390-JLink-on-unsecure-and-erase-Kinetis-FLASH/

Hope that helps

[flesky]

@diego_charles any other ideas? if not, i have to rework 15boards

Thanks and best regards

[diego_charles]

Hi @flesky 

Thank you for letting me know,

Check that your application firmware do not have any configuration in the flash configuration settings. They are  described in the following  post How (not) to Secure my Microcontroller  ( I am not sure if you are getting this error only with  several boards of your batch , or if all of them are failing)

Regarding physical connection , check that  the PINs corresponding to SWD do not have any other functionality, , or that they are not muxed to be digital pins for example.

Depending on your  IDE  and available debuggers in your workbench there are other procedures that may help .For example, the MCUxpresso IDE has the GUI Flash tool that lets you resurrect locked MCUs by overwriting the memory contents of at the 0x400 offset.  

(The GUI Flash tool supports Segger, CMSIS DAP and PE- Micro debug probes)

My apologies for the delay (unfortunately I had missed your reply)

Let me know your findings.

Diego.

[diego_charles]

Hi @flesky 

Could you try yo use the J-Link commander to try to unlock your chip?

After typing connect, and ? to open the following  device selection window.

Make sure to select the part with the  ALLOW SECURITY option.

Then , type the  unlock kinetis command. 

Here is an example of me using unlocking a secured KL03Z (In my case I actually enabled flash protection features previously)

After performing the unlock and see the ok return status , I use to continue with the erase command, 

Then I if the debug is enabled again.

Wish this helps,

Diego

[flesky]

Hi Diego!

Thank you very much for your Help. Do you have an other idea? After i connect via SWD it automatical fails on timeout while unsecuring devices. so i cannot enter unsecure kinetis

Best Regards

[chhsu0229]

Hi flesky,

Do you fix this issue, Jlink program readout protection? And how fix?

Thanks

[Analtino-inside]

Have the same problem, could you find the ansewere

Firmware: J-Link V12 compiled Dec  4 2024 17:53:50
Hardware version: V12.00
J-Link uptime (since boot): 0d 02h 49m 14s
S/N: 822000059
License(s): GDB
USB speed mode: High speed (480 MBit/s)
VTref=3.290V

Type "connect" to establish a target connection, '?' for help
J-Link>connect
Please specify device / core. <Default>: MKE06Z128XXX4
Type '?' for selection dialog
Device>
Please specify target interface:
  J) JTAG (Default)
  S) SWD
  T) cJTAG
TIF>SWD
Specify target interface speed [kHz]. <Default>: 4000 kHz
Speed>
Device "MKE06Z128XXX4" selected.

Connecting to target via SWD
ConfigTargetSettings() start
ConfigTargetSettings() end - Took 14us
InitTarget() start
InitTarget()
SWD selected. Executing JTAG -> SWD switching sequence.
Device will be unsecured now.
Device will be unsecured now.
InitTarget() end - Took 4.92s
Found SW-DP with ID 0x0BC11477
DPIDR: 0x0BC11477
CoreSight SoC-400 or earlier
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x04770031, ADDR: 0x00000000)
AP[1]: JTAG-AP (IDR: 0x001C0020, ADDR: 0x01000000)
Iterating through AP map to find AHB-AP to use
AP[0]: Skipped. Could not read CPUID register
AP[1]: Skipped. Not an AHB-AP
Attach to CPU failed. Executing connect under reset.
Failed to power up DAP
ConfigTargetSettings() start
ConfigTargetSettings() end - Took 18us
InitTarget() start
InitTarget()
SWD selected. Executing JTAG -> SWD switching sequence.
Device will be unsecured now.
InitTarget() end - Took 3.06s
Found SW-DP with ID 0x0BC11477
DPIDR: 0x0BC11477
CoreSight SoC-400 or earlier
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x04770031, ADDR: 0x00000000)
AP[1]: JTAG-AP (IDR: 0x001C0020, ADDR: 0x01000000)
Iterating through AP map to find AHB-AP to use
AP[0]: Skipped. Could not read CPUID register
AP[1]: Skipped. Not an AHB-AP
Attach to CPU failed. Executing connect under reset.
Failed to power up DAP