Unlocking K20

mofo · ‎11-27-2014

I have been using the K20 on a small project and I had the unlocking problem that is widely reported almost every single time but this last board I believe does not want to be unlocked.

Following is the output from the erase_all_pin.jlk when run keeping the reset pin grounded, can you please help?

SEGGER J-Link Commander V4.90c ('?' for help)

Compiled Aug 29 2014 09:52:38

Script file read successfully.

DLL version V4.90c, compiled Aug 29 2014 09:52:33

Firmware: J-Link ARM-OB STM32 compiled Aug 22 2012 19:52:04

Hardware: V7.00

S/N: 20090928

Feature(s): RDI,FlashDL,FlashBP,JFlash,GDBFull

VTarget = 3.300V

Info: Could not measure total IR len. TDO is constant high.

No devices found on JTAG chain. Trying to find device on SWD.

Info: Found SWD-DP with ID 0x2BA01477

****** Error: Error while identifying Cortex-M core.

Info: Found SWD-DP with ID 0x2BA01477

No device found on SWD.

Failed to identify target. Trying again with slow (4 kHz) speed.

Info: Could not measure total IR len. TDO is constant high.

No devices found on JTAG chain. Trying to find device on SWD.

Info: Found SWD-DP with ID 0x2BA01477

****** Error: Error while identifying Cortex-M core.

Info: Found SWD-DP with ID 0x2BA01477

No device found on SWD.

No device found at all. Selecting JTAG as default target interface.

Processing script file...

Target interface speed: 1000 kHz

Sleep(10)

Info: Could not measure total IR len. TDO is constant high.

Reset type UNKNOWN: ???

Info: Could not measure total IR len. TDO is constant high.

Reset delay: 0 ms

Reset type UNKNOWN: ???

Info: Could not measure total IR len. TDO is constant high.

PC: (R15) = 00000000, CPSR = 00000000 (Unknown mode, ARM)

Info: Could not measure total IR len. TDO is constant high.

R0 = 00000000, R1 = 00000000, R2 = 00000000, R3 = 00000000

R4 = 00000000, R5 = 00000000, R6 = 00000000, R7 = 00000000

Info: Could not measure total IR len. TDO is constant high.

USR: R8 =00000000, R9 =00000000, R10=00000000, R11 =00000000, R12 =00000000

Info: Could not measure total IR len. TDO is constant high.

R13=00000000, R14=00000000

Info: Could not measure total IR len. TDO is constant high.

FIQ: R8 =00000000, R9 =00000000, R10=00000000, R11 =00000000, R12 =00000000

Info: Could not measure total IR len. TDO is constant high.

R13=00000000, R14=00000000, SPSR=00000000

Info: Could not measure total IR len. TDO is constant high.

SVC: R13=00000000, R14=00000000, SPSR=00000000

Info: Could not measure total IR len. TDO is constant high.

ABT: R13=00000000, R14=00000000, SPSR=00000000

Info: Could not measure total IR len. TDO is constant high.

IRQ: R13=00000000, R14=00000000, SPSR=00000000

Info: Could not measure total IR len. TDO is constant high.

UND: R13=00000000, R14=00000000, SPSR=00000000

Sleep(1000)

Selecting SWD as current target interface.

Setting target interface speed to 1MHz. Use "Speed" to change.

Sleep(10)

Select SWD by sending SWD switching sequence.

Found SWD-DP with ID 0x2BA01477

Sleep(10)

Write DP register 2 = 0x01000000

Sleep(10)

Read AP register 0 = 0x00000000

Sleep(10)

Read AP register 0 = 0x00000034

Sleep(10)

Read AP register 1 = 0x0000003E

Sleep(10)

Read AP register 1 = 0x00000000

Sleep(10)

Read AP register 0 = 0x00000000

Sleep(10)

Read AP register 0 = 0x00000036

Sleep(10)

Write AP register 1 = 0x00000001

Sleep(1000)

Read AP register 0 = 0x00000036

Sleep(10)

Read AP register 0 = 0x00000034

Sleep(10)

Read AP register 1 = 0x00000034

Sleep(10)

Read AP register 1 = 0x00000001

Sleep(100)

Write DP register 2 = 0x00000000

Sleep(1000)

Selecting JTAG as current target interface.

Setting target interface speed to 1MHz. Use "Speed" to change.

Sleep(100)

Info: Could not measure total IR len. TDO is constant high.

Reset delay: 0 ms

Reset type UNKNOWN: ???

Info: Could not measure total IR len. TDO is constant high.

Script processing completed.

################################################################################

Edit after some experiments:

connected the reset to GND and re-run the script and I can see that the device is indeed secured but it seems like the mass erase is enabled if I read this register correctly.

Read AP register 0 = 0x00000036

Now if I try to force a mass erase setting bit 0 of the control register I assume I should see mass erase start with bit 0 of th status register confirming (Flash Mass Erase Acknowledge) that but I do not see that like the chip is not taking the command.

Write AP register 1 = 0x00000001

Read AP register 0 = 0x00000036

Sleep(10)

Read AP register 0 = 0x00000036

Has anyone seen something like this? Is there a way to get out of it?

Message was edited by: Gianluca Barbieri

Hui_Ma · ‎11-30-2014

Hi,

From MDM-AP status register value 0x36, it shows the K20 chip is secured.

Customer can try to use Segger provided J-Link Commander tool and run "unlock Kinetis" commander to unsecure the K20 chip.

Wish it helps.
best regards
Ma Hui

-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

mofo · ‎11-30-2014

Here is what happen when I add the "unlock kinetis" in the script:

****** Error: Kinetis (connect): Timeout while unsecuring device. Erase never starts.

Kinetis (connect): Failed to unsecure Kinetis device.

Info: Found SWD-DP with ID 0x2BA01477

Info: Secured Kinetis device detected. For debugger connection the device needs to be unsecured.

Device will be unsecured now.

Note: Unsecuring will trigger a mass erase of the internal flash.

****** Error: Kinetis (connect): Timeout while unsecuring device. Erase never starts.

Kinetis (connect): Failed to unsecure Kinetis device.

Info: Found SWD-DP with ID 0x2BA01477

Info: Secured Kinetis device detected. For debugger connection the device needs to be unsecured.

Device will be unsecured now.

Note: Unsecuring will trigger a mass erase of the internal flash.

As I could reproduce manually the mass erase does not start for some reason even if enabled. Is it possible that there is another flag somewhere else that is preventing the Flash to be erased like the MEEN or SEC? is it possible to access those registers with the CPU in reset?

Hui_Ma · ‎12-01-2014

Hi,

If K20 was secured, the chip registers could not be accessed via JTAG/SWD interface.

best regards,

Ma Hui

huishao2 · ‎12-08-2014

Hi Hui

I am using IAR 7.20 and I-jet for k20d50m. Is there a way to unlock my devices through I-jet? I have read through many threads on this community for unlocking, but most of them are using J-link.

thanks!

Hui Shao

Hui_Ma · ‎12-08-2014

Hi Hui Shao,

We don't have I-Jet tool on hand, we don't have chance to try if I-Jet tool could unlock the Kinetis chip.

While, I had contacted with IAR about this issue before, the feedback is there with new firmware for I-Jet tool, which could support unlock the Kinetis chip.

So, Please check with IAR engineer about I-Jet firmware update issue with below link:

http://www.iar.com/Service-Center/Technical-Support/

Wish it helps.
best regards
Ma Hui

-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

Hui_Ma · ‎12-01-2014

The Flash configuration field (flash address 0x40C) value will be loaded to FTFE_FSEC register during the K20 boot up.

The [MEEN] bit with value 0b10 to set mass erase be disabled, that will cause the debug write MDM-AP control register bit0 operation unavailable.

Customer can check Flash programmed image at flash address 0x40C value to check FTFE_FSEC [MEEN] bit value.

Wish it helps.
best regards
Ma Hui

-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

mofo · ‎11-30-2014

Hi,

Here is the problem when I try to connect with JLinkExe it fails because it cannot unlock the device and switches to JTAG. Now after that when I try to bring it back to SWD it fails because it says it cannot write Control/Status register .. here is an example:

Select SWD by sending SWD switching sequence.

ERROR: Could not write Ctrl/Stat register.

Sleep(10)

So since I cannot at that point switch to SWD I cannot even try to use the unlock command.

Isn't the unlock_all_pin.jlk script supposed to do the exact same thing?

Let me know it I can try something else ... It appears that I incur in this quite a few times but in the past I have been lucky and everything went back to ok after a few attempts

Unlocking K20

Unlocking K20

Kinetis K Series MCUs