Problem flashing k24 jlink

[inakimartinez]

Hello,

I'm trying to flash a k24 using the jlink segger tool. I execute the next commands, and after the loadbin I check if the image has been written correctly with verifybin and I get the error you see at the end. The verify is failing at 0x40C0 address. Do someone know why is this? Am I using the correct address? If I use 0x5000 the verify works ok but the program is not starting neither.

Thank you,

J-Link>unlock kinetis
Found SWD-DP with ID 0x2BA01477
Unlocking device...O.K.
J-Link>speed 12000
Selecting 12000 kHz as target interface speed
J-Link>device MK24FN1M0xxx12
Disconnecting from J-Link...O.K.
Device "MK24FN1M0XXX12" selected.


Connecting to target via SWD
InitTarget()
Found SW-DP with ID 0x2BA01477
AP map detection skipped. Manually configured AP map found.
AP[0]: AHB-AP (IDR: Not set)
AP[0]: Core found
AP[0]: AHB-AP ROM base: 0xE00FF000
CPUID register: 0x410FC241. Implementer code: 0x41 (ARM)
Found Cortex-M4 r0p1, Little endian.
FPUnit: 6 code (BP) slots and 2 literal slots
CoreSight components:
ROMTbl[0] @ E00FF000
ROMTbl[0][0]: E000E000, CID: B105E00D, PID: 000BB00C SCS-M7
ROMTbl[0][1]: E0001000, CID: B105E00D, PID: 003BB002 DWT
ROMTbl[0][2]: E0002000, CID: B105E00D, PID: 002BB003 FPB
ROMTbl[0][3]: E0000000, CID: B105E00D, PID: 003BB001 ITM
ROMTbl[0][4]: E0040000, CID: B105900D, PID: 000BB9A1 TPIU
ROMTbl[0][5]: E0041000, CID: B105900D, PID: 000BB925 ETM
ROMTbl[0][6]: E0042000, CID: B105900D, PID: 003BB907 ETB
ROMTbl[0][7]: E0043000, CID: B105900D, PID: 001BB908 CSTF
Cortex-M4 identified.
J-Link>jtagconf -1, -1
J-Link>r
Reset delay: 0 ms
Reset type NORMAL: Resets core & peripherals via SYSRESETREQ & VECTRESET bit.
Reset: Halt core after reset via DEMCR.VC_CORERESET.
Reset: Reset device via AIRCR.SYSRESETREQ.
AfterResetTarget()
J-Link>loadbin zl_flash_dump.raw.bin 00000000
Downloading file [zl_flash_dump.raw.bin]...
Comparing flash   [100%] Done.
Erasing flash     [100%] Done.
Programming flash [100%] Done.
Verifying flash   [100%] Done.
J-Link: Flash download: Bank 0 @ 0x00000000: 1 range affected (77824 bytes)
J-Link: Flash download: Total time needed: 1.000s (Prepare: 0.032s, Compare: 0.009s, Erase: 0.007s, Program: 0.923s, Verify: 0.005s, Restore: 0.021s)
O.K.
J-Link>verifybin zl_flash_dump.raw.bin 00000000
Loading binary file zl_flash_dump.raw.bin
Reading 77192 bytes data from target memory @ 0x00000000.
Verify failed @ address 0x0000040C.
Expected 7B read 7A
ERROR: Verify failed.

[Pavel_Hernandez]

Hello, my name is Pavel, and I will be supporting your case, I review your information, and could you tell me if you are using a custom bootloader? did you use another flash config? if yes, could you tell me about this config? did you try at first to erase all the MCU and then flash?

Best regards,
Pavel

[inakimartinez]

Hello Pavel,

Yes Im using a custom bootloader.

I don't know what you mean by "flash config".

If it helps, I have tried to flash the .bin file using MCUXpresso IDE and I get the same result if I introduce a verifybin in the process.

Executing flash operation 'Program' (Program executable into flash zl_flash_dump.raw.bin) - Tue Apr 04 09:53:26 CEST 2023
Checking MCU info...
Scanning for targets...
Executing flash action...
SEGGER J-Link Commander V7.86e (Compiled Mar 22 2023 16:27:49)
DLL version V7.86e, compiled Mar 22 2023 16:27:33
J-Link Command File read successfully.
Processing script file...
J-Link>ExitOnError 1
J-Link Commander will now exit on Error
J-Link>r
J-Link connection not established yet but required for command.
Connecting to J-Link via USB...O.K.
Firmware: J-Link V9 compiled May  7 2021 16:26:12
Hardware version: V9.30
J-Link uptime (since boot): N/A (Not supported by this model)
S/N: 59304712
License(s): GDB
VTref=3.314V
Target connection not established yet but required for command.
Device "MK24FN1M0XXX12" selected.
Connecting to target via SWD
InitTarget()
SWD selected. Executing JTAG -> SWD switching sequence.
Protection bytes in flash at addr. 0x400 - 0x40F indicate that readout protection is set.
For debugger connection the device needs to be unsecured.
Unsecuring will trigger a mass erase of the internal flash.
Executing default behavior previously saved in the registry.
Device will be unsecured now.
Found SW-DP with ID 0x2BA01477
DPIDR: 0x2BA01477
CoreSight SoC-400 or earlier
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x001C0000)
Iterating through AP map to find AHB-AP to use
AP[0]: Core found
AP[0]: AHB-AP ROM base: 0xE00FF000
CPUID register: 0x410FC241. Implementer code: 0x41 (ARM)
Found Cortex-M4 r0p1, Little endian.
FPUnit: 6 code (BP) slots and 2 literal slots
CoreSight components:
ROMTbl[0] @ E00FF000
[0][0]: E000E000 CID B105E00D PID 000BB00C SCS-M7
[0][1]: E0001000 CID B105E00D PID 003BB002 DWT
[0][2]: E0002000 CID B105E00D PID 002BB003 FPB
[0][3]: E0000000 CID B105E00D PID 003BB001 ITM
[0][4]: E0040000 CID B105900D PID 000BB9A1 TPIU
[0][5]: E0041000 CID B105900D PID 000BB925 ETM
[0][6]: E0042000 CID B105900D PID 003BB907 ETB
[0][7]: E0043000 CID B105900D PID 001BB908 CSTF
Memory zones:
"Default" Description: Default access mode
Cortex-M4 identified.
Reset delay: 0 ms
Reset type NORMAL: Resets core & peripherals via SYSRESETREQ & VECTRESET bit.
Reset: Halt core after reset via DEMCR.VC_CORERESET.
Reset: Reset device via AIRCR.SYSRESETREQ.
AfterResetTarget()
J-Link>h
PC = FFFFFFFE, CycleCnt = 00000000
R0 = 00000000, R1 = 00000000, R2 = 00000000, R3 = 00000000
R4 = 00000000, R5 = 00000000, R6 = 00000000, R7 = 00000000
R8 = 00000000, R9 = 00000000, R10= 00000000, R11= 00000000
R12= 00000000
SP(R13)= FFFFFFFC, MSP= FFFFFFFC, PSP= 00000000, R14(LR) = FFFFFFFF
XPSR = 01000000: APSR = nzcvq, EPSR = 01000000, IPSR = 000 (NoException)
CFBP = 00000000, CONTROL = 00, FAULTMASK = 00, BASEPRI = 00, PRIMASK = 00
FPS0 = 00000000, FPS1 = 00000000, FPS2 = 00000000, FPS3 = 00000000
FPS4 = 00000000, FPS5 = 00000000, FPS6 = 00000000, FPS7 = 00000000
FPS8 = 00000000, FPS9 = 00000000, FPS10= 00000000, FPS11= 00000000
FPS12= 00000000, FPS13= 00000000, FPS14= 00000000, FPS15= 00000000
FPS16= 00000000, FPS17= 00000000, FPS18= 00000000, FPS19= 00000000
FPS20= 00000000, FPS21= 00000000, FPS22= 00000000, FPS23= 00000000
FPS24= 00000000, FPS25= 00000000, FPS26= 00000000, FPS27= 00000000
FPS28= 00000000, FPS29= 00000000, FPS30= 00000000, FPS31= 00000000
FPSCR= 00000000
J-Link>loadfile "/home/inaki/dev/zoslp/zoslp/output/current/build/libzl/zl_flash_dump.raw.bin" 0x0
'loadfile': Performing implicit reset & halt of MCU.
Reset: Halt core after reset via DEMCR.VC_CORERESET.
Reset: Reset device via AIRCR.SYSRESETREQ.
AfterResetTarget()
Downloading file [/home/inaki/dev/zoslp/zoslp/output/current/build/libzl/zl_flash_dump.raw.bin]...
J-Link: Flash download: Bank 0 @ 0x00000000: 1 range affected (77824 bytes)
J-Link: Flash download: Total: 3.598s (Prepare: 2.249s, Compare: 0.348s, Erase: 0.023s, Program & Verify: 0.942s, Restore: 0.034s)
J-Link: Flash download: Program & Verify speed: 80 KB/s
O.K.
J-Link>verifybin "/home/inaki/dev/zoslp/zoslp/output/current/build/libzl/zl_flash_dump.raw.bin" 0x0
Loading binary file /home/inaki/dev/zoslp/zoslp/output/current/build/libzl/zl_flash_dump.raw.bin
Reading 77252 bytes data from target memory @ 0x00000000.
Verify failed @ address 0x0000040C.
Expected 7B read 7A
ERROR: Verify failed.
Script processing completed.
Unable to perform operation!
Command failed with exit code 1

Yes I have tried to execute an erase and the loadbin. It didn't work.

Regards,

[Pavel_Hernandez]

Hello, I was referring to this section, about the Flash config.

The code that you mentioned has some relation with this security section. Chapter 29.3.1 from the reference manual.

if you are working with security this app note could help you.

Using Kinetis Security and Flash Protection Features (nxp.com)

Best regards,
Pavel