MKV31F512 is locked in secure state

[alexeykazartesv]

Hello.
I have a problem with MKV31F51 controller. During debug session it's stucked in secured state. A lot of reprogrammings have been done successfully but after last one "Secured Kinetis device detected" message appeared during device programming. I agrreed with prompt to mass erase device but it not help. I've tried to access device by Segger J-link debugger. AP status register (1) value was read as "0x3E" (mass erase enabled, no reset, secure is enabled), AP command register value was 0x0.
I forced mass erase by writing 0x1 value ("Flash mass erase in progress" bit) to AP command register and value from it was read as 0x1, but i received no ack about erase end, AP reg 1 value is stucked in 0x1. After half an hour a checked again and value was the same.
How can I unlock device?

[Hui_Ma]

Hi

Have you tried to use Segger J-Link commander tool "unlock Kinetis"  command to unlock the KV31 chip?

And below is a similar thread about how to use J-Link unlock Kinetis product:

https://community.nxp.com/message/810487?commentID=810487#comment-810487 

Wish it helps.

Have a great day,
Ma Hui
-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

[alexeykazartesv]

Hi!

Yes, I've tried it but with no result:

It's a second time when this problem occured. First time it happens when I cancel chip programming in the middle of the process. We just resolder another chip. This is that chip - worked for some time but after reassemble work stand it fell to "security state" too.

[Hui_Ma]

Hi

Customer could try with attached J-Link script.

The Kinetis Kxx Cortex-M4 erase all and unsecure manual in Chinese, I add the translation for your reference.

Wish it helps.

Have a great day,
Ma Hui
-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

[alexeykazartesv]

Hi!

Sadly, but it doesnt help. I ran script with reset pin hold active. Jlink at first trying to unlock device by itself a lot of times with no success and finally script ran with no required result too.

But - reset pin after this configuration hold in 1.6V (without forcing it low, this pin has external 4.7k pullup to 3.3V)

*only SWD is available as a debug interface

Script running log (first automatical tries of unlocking is removed):

****** Error: Kinetis (connect): Timeout while unsecuring device. Erase never st
arts.
Kinetis (connect): Failed to unsecure Kinetis device.

Found SWD-DP with ID 0x2BA01477
Found SWD-DP with ID 0x2BA01477

****** Error: Kinetis (connect): Timeout while unsecuring device. Erase never st
arts.
Kinetis (connect): Failed to unsecure Kinetis device.

UND: R13=00000000, R14=00000000, SPSR=00000000

Sleep(1000)

Disconnecting from J-Link...O.K.
Selecting SWD as current target interface.

Sleep(10)

Select SWD by sending SWD switching sequence.
Found SWD-DP with ID 0x2BA01477

Sleep(10)

Write DP register 2 = 0x01000000

Sleep(10)

Read AP register 0 = 0x00000036

Sleep(10)

Read AP register 0 = 0x00000036

Sleep(10)

Read AP register 1 = 0x00000036

Sleep(10)

Read AP register 1 = 0x00000001

Sleep(10)

Read AP register 0 = 0x00000001

Sleep(10)

Read AP register 0 = 0x00000036

Sleep(10)

Write AP register 1 = 0x00000001

Sleep(1000)

Read AP register 0 = 0x00000036

Sleep(10)

Read AP register 0 = 0x00000036

Sleep(10)

Read AP register 1 = 0x00000036

Sleep(10)

Read AP register 1 = 0x00000001

Sleep(100)

Write DP register 2 = 0x00000000

Sleep(1000)

Selecting JTAG as current target interface.

Sleep(100)

Target connection not established yet but required for command.
Device position in JTAG chain (IRPre,DRPre) <Default>: -1,-1 => Auto-detect
JTAGConf>
Device "MKV31F512XXX12" selected.

TotalIRLen = ?, IRPrint = 0x..000000000000000000000000

Can not connect to target.
TotalIRLen = ?, IRPrint = 0x..000000000000000000000000

Reset delay: 0 ms
Reset type UNKNOWN: ???
TotalIRLen = ?, IRPrint = 0x..000000000000000000000000

Script processing completed.

[Hui_Ma]

Hi

I translate the Kinetis lock issue document attached for your reference.

Wish it helps.

Have a great day,
Ma Hui
-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

[kalpesh_dodiya]

Hello Ma Hui,

I studied the Kinetis Lock issue analysis and unlock way.pdf in which you have mentioned that blank controller (without programmed) has saw tooth wave on its reset pin. May i know the reason?

Regards

Kalpesh Dodiya

[Hui_Ma]

Hi Kalpesh,

The reason is internal WDOG was default enabled and cause the system reset when WDOG timeout.

best regards,

Mike

[kalpesh_dodiya]

Thank you Hui_Ma,

So, How can i differentiate by looking at my Hardware or through debugging it whether controller is damaged or it is locked/secured?

Regards

Kalpesh

[Hui_Ma]

Hi,

I would recommend our discussion go back to your submitted thread here. Thanks.

Have a great day,
Mike

-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

[alexeykazartesv]

Hi

Thanks a lot for a translation, it's much better then raw google-translate!

But problem is still here.. I run your script several times with grounded/pullup reset but result was the same - flag "mass erase request" is set, but "mass erase ack" has never be received. In some cases flag "flash ready" fell too.

But I found one weak point in hardware design that may cause this error (possibly not good timing between reset and power-up).

I'll try some more combinations of software, scripts, commands etc.

[armaram]

Hi Alexey,

Any luck unlocking your device? We too have the same problem and none of the methods described above have been helpful so far.

Thanks,

[davicampos_le]

Hi

Do you have any success in unlocking the kinetis?
I'm having the same problem.

[Hui_Ma]

Hi

Please try with this script more times and check if it could unlock KV31 chip successfully.

If there still could not works, customer also could try with update J-Link hardware firmware and J-Link software.

And if customer has the P&E USB Multilink tool, customer could try use this tool .

There is an document about Kinetis lock issue analysis , while it was written in Chinese.

There shows using above script could unlock most situation locked Kinetis chips.

Please let me know if there still with problem.

Wish it helps.

Have a great day,
Ma Hui
-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------