Unlock secured MK70FX512VMJ15

[lucaiser]

Hello,

I have accidentally secured a MK70FX512VMJ15 device. I was trying erase flash block command and i have accidentally erased program flash memory at address 0x00000000 where are stored configuration fields.

Now i'm not able to download source code from IAR Embedded Workbench because it shows a message telling that device is in secured state. It asks me to make a mass erase but it seems to fail (it shows again and again the same message).

I've tried to use Jlink.exe command line to unlock device. Unlock command seems to be successful but, if i try to download source code, device is still secured.

Do you think is it possible to unsecure my device?

[朱葛峻]

我个人解锁芯片一直用的J-Link下载器。一般在IAR下的General options设置对芯片然后就一路狂点下去就好了。

[perlam_i_au]

Could you please write your comment in English??? I was unable to understand the message with translation :smileysad:

[朱葛峻]

Sorry. I think that the MCU can be unlocked as soon as the setting is suitable in the options ,the engineering is prepared for MK70FX512VMJ15 and using J-Link.

P.S. My English skills is very poor.

[perlam_i_au]

Don not worry about language, my Chinese is very poor, then English is a good average for both.

You mentioned you are using J-link.

Then if you are using CodeWarrior please see the video Mass erase upon connection in the folder I shared before, once you open the debug configuration window, there it should be an option with J-Link, select that option for your device (K70).

As example in video show:

If you are using J-Link commander please see the video Unlock Kinetis JLink and falow the instructions in order to erase your device.

Have a nice day :P,
Perla

-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

[kunalgaur]

Hi,

i am using MCF54415 with CW10.5.

i am facing one issue in writing to External Flash.

attached is the snapshot for the same.

please help me out of this issue. thanks in advance.

Regards,

Kunal Gaur

[朱葛峻]

Thank you,but I feel something misunderstand between us .If you read these again, you can get it.And then I still thank you，因为我会用IAR解锁，其实我是来回答的。这就是我觉得可能有误解存在的原因。Good night.

[perlam_i_au]

Hooooo now I understand what you were talking about :smileygrin:

[朱葛峻]

Good morning and thank you for your indoctrination.:smileywink:

[perlam_i_au]

Here is a zip folder with some videos that show how you can performs Mass erase in order to unlock your device

please check it out and let me know if this works for you. :smileysilly:

Have a great day,
Perla

-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

[RuiFaria]

Hi Perla,

I am having some problems when i try to unprotect or unsecure the flash of MK70FX512 using TCL scripts.

You tested in MK60 but the flash and driver are different.

%>cmdwin::fl::device -d FTFE_PFlash512 -o 64Kx64x1 -se all
%>cmdwin::fl::protect off off

Error:  Protect failed.   Flash driver reports the following error(s):  Operation Unsupported
Error:  Protect operation failed 

and

%>cmdwin::fl::device -d FTFE_PFlash512 -o 64Kx64x1 -se all
%>cmdwin::fl::secure off
Beginning Operation ...   
-------------------------
Error:  Secure/Unsecure is not supported on this device.  
Error: Secure/Unsecure is not supported on this device.

Seems to me that the flash or driver doesn't support those commands and i don't know what to do now, any suggestion? protect the flash works fine... :smileyhappy:

Thanks for the attention.

Best Regards,

Rui Faria

[lucaiser]

Is it possible to lock permanently a kinetis device just making an accidentally block erase to address 0x00000000? If all memory is erased to 0xFF, device should be secured but mass erase should be enabled. Is this right?

[lothar]

hi

Yes thats right. Would not be a nice feature to completely lock the device when a mass erase is used.

The address in you're error msg is not in Flash memory region so this isn't correlating anyway.

The address is 64kByte below 0x2000 0000, hence the very first address of the first SRAM partition.

I guess you have 128kByte SRAM, otherwise this could be the error.

[lucaiser]

I'm not sure to understand what you are talking about. I was working with IAR and a custom board with a MK70FX512VMJ15R. I was writing a flash driver for this microcontroller and trying block erase command i have accidentally launched this command with address 0x00000000.

From that moment the device is secured and i'm not able to download a new application with IAR. It shows me a message asking if i want to unsecure my device making a mass erase. If i click YES then IAR shows again the same message and seems to fail this operation.

Then i've tried to downalod .srec file (produced with IAR) using flash programmer in CodeWarrior and the message is that one of my second answer in this thread.

If i try to create a new simple project in CodeWarrior and to run it into my secured device, it shows the following message:

Failed to resume target process.

ARM GDI Protocol Adapter : An error occurred while trying to write memory. The Debugger can not write memory.

This is all. I can't understand why is not possible to make a mass erase to unsecure my device.

[mjbcswitzerland]

Hi

Lothar is pointing out that the debugger error message is saying that it can't write to SRAM at 0x1fff0000. Since all K70F parts have 128k SRAM (and this address is the first there) there is no configuration error (which could have been the case if trying to perform operations with a part with 64k but incorrectly configured). [The adapter will be loading a small program to SRAM which will then do the erase/unsecure work but it doesn't manage that].

It is also correct that a deleted first flash sector will cause the Kinetis to start in secure mode but without any protection of mass erasing or against communicating with JTAG.

This does look like the processor is not allowing code to be written into its SRAM, but the JTAG looks to be working since the debuggers seem to know that the chips is secured (and possibly have been able to read the chip's ID? - with CW you may see a message when attempting to delete concerning the chip's ID having been read correctly which would confirm this).

However the messages that debuggers give when there is a problem are very often only of use to the person which wrote the program since they are "generally" quite poor. Whatever the debugger suggests is wrong "could" have absolutely nothing to do with the issue. It may be that your USB driver has a problem even if the error messages suggest that it is something at the processor itself - often strange problems go away after re-installing the adapter's USB driver so that is the first thing to attempt (as well as trying a different USB port, restarting the IDE, rebooting the PC). Check that a differnet HW can still be programmed normally to be sure that it is restricted to one board.

In the worst case I would try with EZPORT (if possible) since then there is no confusion as to what is actually happening. I can't imaging that the JTAG is locked out but otherwise can't explain why secure mode can not simply be existed with the standard tools.

Regards

Mark

[lucaiser]

Thank you for your reply.

I want to add more informations about my problem. I've tried to execute "Erase Whole Device" command with CW Flash programmer. This command works with an unsecured device. When i try to execute it with my secured device it shows this log message in Console window:

fl::target -lc "LC for Simple Flash"

fl::target -b 0x1fff0000 0x20000

fl::target -v off -l off

cmdwin::fl::device -d "FTFE_PFlash512" -o "64Kx64x1" -a 0x0 0x7ffff

cmdwin::fl::erase all

Beginning Operation ...   

-------------------------

Performing target initialization ...   

failed on register write: LR

failed on register write: DEMCR

failed on register write: DWT_FUNCTION0

failed on register write: DWT_FUNCTION1

failed on register write: DWT_FUNCTION2

failed on register write: DWT_FUNCTION3

failed on register write: FP_COMP0

failed on register write: FP_COMP1

failed on register write: FP_COMP2

failed on register write: FP_COMP3

failed on register write: FP_COMP4

failed on register write: FP_COMP5

failed on register write: DWT_CTRL

failed on register write: DWT_CYCCNT

failed on register write: DWT_CPICNT

failed on register write: DWT_EXCCNT

failed on register write: DWT_SLEEPCNT

failed on register write: DWT_LSUCNT

failed on register write: DWT_FOLDCNT

failed on register write: DWT_COMP0

failed on register write: DWT_COMP1

failed on register write: DWT_COMP2

failed on register write: DWT_COMP3

failed on register write: DWT_MASK0

failed on register write: DWT_MASK1

failed on register write: DWT_MASK2

failed on register write: DWT_MASK3

failed on register write: ITM_LAR

failed on register write: ITM_TER

failed on register write: ITM_TPR

failed on register write: ITM_TCR

failed on register write: ITM_LAR

failed on register write: ETF_FCR

failed on register write: MCM_ETBCC

failed on register write: MCM_ETBRL

failed on register write: SCB_VTOR

Downloading Flash Device Driver ...  

Error:  Couldn't write flash driver to target.  Can not read target memory at location: 0x000000001FFF0000.Please make sure that the chip selects are properly configured.

The CWPP response code is: ARM GDI Protocol Adapter : An error occurred while trying to write memory. The Debugger can not write m

emory..

An error occurred while trying to write memory. The Debugger can not write memory.(ARM GDI Protocol Adapter)

Error: Couldn't write flash driver to target.Can not read target memory at location: 0x000000001FFF0000.

Please make sure that the chip selects are properly configured.

The CWPP response code is: ARM GDI Protocol Adapter : An error occurred while trying to write memory. The Debugger can not write m

emory..

I hope this will be useful to understand what's happening.

Unfortunately i can't use EZport bulk erase because in this custom board that signals are not provided.

[mjbcswitzerland]

Hi

When the devices are delivered the flash is not completely blank - there is a single bit in the flash configuration area which unsecures it.

However a 'real' erase of the first sector will always secure the device.

IAR should be able to unsecure it but it looks not to be working - this is more likely a tool problem that a Kinetis problem. If you have installed Codewarrior it will also detect the secure mode and ask whether you want to unsecure it - this has always worked reliably for me.

EZPORT is the other solution since it allows a bulk erase and then the bit to be reset in the flash configuration.

Regards

Mark

[lucaiser]

Hi

I've tried to unlock with CodeWarrior. It requires a mass erase but show me this error:

Error executing task K70FX512.

Error:  Couldn't write flash driver to target.  Can not read target memory at location: 0x000000001FFF0000.Please make sure that the chip selects are properly configured.

The CWPP response code is: ARM GDI Protocol Adapter : An error occurred while trying to write memory. The Debugger can not write m

emory..<s>thread exit: Running, 0x0, 0x0, cpuARMLittle, Unknown (state, tid, pid, cpu, target)</s>

An error occurred while trying to write memory. The Debugger can not write memory.(ARM GDI Protocol Adapter)

Error: Couldn't write flash driver to target.Can not read target memory at location: 0x000000001FFF0000.

Please make sure that the chip selects are properly configured.

The CWPP response code is: ARM GDI Protocol Adapter : An error occurred while trying to write memory. The Debugger can not write m

emory..