MKE14Z128 - Can't reprogram/debug after erasing Flash through bootloader

cakira · ‎06-01-2020

Hi!

My colleague and I are developing a application to update the firmware in a MKE14Z128 using the ROM Bootloader.

After we used the bootloader to erase a big chunk of memory, we were not able to use the debug interface to connect to the microcontroller anymore.

We tried the solution described in this post, https://community.nxp.com/thread/440212#comment-859331 (jlink.exe erase_all_pin.jlk), but it failed because JLINK wasn't able to connect to the chip. The microcontroller doesn't reply to the bootloader ping commands either.

Is there another way to unbrick it?

Thank you!

kerryzhou · ‎06-01-2020

Hi Cleber Akira Nakandakare ,

Do you use the JLINK as the debugger right?

If yes, when you meet the issues, please use the JLINK commander to connect your issue board through the SWD interface, can you find the ARM core or not after the ROM mass erase?

You can share the JLINK commander connect result with me.

If it can't find the ARM core, please input: unlock kinetis

Whether you can connect your ARM again after the JLINK mass erase.

BTW, do you test the related NXP official board:

FRDM-KE15Z Platform|Freedom Development Board | NXP

Can you also reproduce the issue like your MKE14Z?

Waiting for your updated information.

Kerry

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!

- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------

cakira · ‎06-02-2020

Hi, kerryzhou‌,

I tested again right now and it had a result I didn't see before:

J-Link>connect
Please specify device / core. <Default>: MKE14Z128XXX7 (ALLOW SECURITY)
Type '?' for selection dialog
Device>
Please specify target interface:
  J) JTAG (Default)
  S) SWD
  T) cJTAG
TIF>s
Specify target interface speed [kHz]. <Default>: 4000 kHz
Speed>
Device "MKE14Z128XXX7 (ALLOW SECURITY)" selected.

Connecting to target via SWD
InitTarget() start
InitTarget()

A window popped up asking if I wanted to unsecure a memory region. I clicked "Yes".

Device will be unsecured now.
Timeout while unsecuring device. Erase never starts.
InitTarget() end
Found SW-DP with ID 0x0BC11477
DPIDR: 0x0BC11477
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x04770031)
AP[1]: JTAG-AP (IDR: 0x001C0020)
Iterating through AP map to find AHB-AP to use
AP[0]: Skipped. Could not read CPUID register
AP[1]: Skipped. Not an AHB-AP
InitTarget() start
InitTarget()

Another window popped up asking again if I wanted to unsecure a memory region. I clicked "Yes".
Device will be unsecured now.Timeout while unsecuring device. Erase never starts.
InitTarget() end
Found SW-DP with ID 0x0BC11477
DPIDR: 0x0BC11477
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x04770031)
AP[1]: JTAG-AP (IDR: 0x001C0020)
Iterating through AP map to find AHB-AP to use
AP[0]: Skipped. Could not read CPUID register
AP[1]: Skipped. Not an AHB-AP

****** Error: Could not find core in Coresight setup

InitTarget() start
InitTarget()
Readout protection is set and mass erase is disabled. J-Link cannot unprotect the device.
InitTarget() end
Found SW-DP with ID 0x0BC11477
DPIDR: 0x0BC11477
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x04770031)
AP[1]: JTAG-AP (IDR: 0x001C0020)
Iterating through AP map to find AHB-AP to use
AP[0]: Skipped. Could not read CPUID register
AP[1]: Skipped. Not an AHB-AP
InitTarget() start
InitTarget()
Readout protection is set and mass erase is disabled. J-Link cannot unprotect the device.
InitTarget() end
Found SW-DP with ID 0x0BC11477
DPIDR: 0x0BC11477
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x04770031)
AP[1]: JTAG-AP (IDR: 0x001C0020)
Iterating through AP map to find AHB-AP to use
AP[0]: Skipped. Could not read CPUID register
AP[1]: Skipped. Not an AHB-AP

****** Error: Could not find core in Coresight setup

Cannot connect to target.

So, I tried again with unlock kinetis

J-Link>unlock kinetis
Found SWD-DP with ID 0x0BC11477
Unlocking device...Timeout while unlocking device.

Does the line "Readout protection is set and mass erase is disabled. J-Link cannot unprotect the device." means it's game over for this chip?

We don't have the development board. We are developing directly in the prototype.

Thank you!

kerryzhou · ‎06-03-2020

Hi Cleber Akira Nakandakare,

The normal unlock result should like my following picture, it is from the FRDM-KE15Z board.

If your board even can't be unlocked, the mass erase maybe also disabled.

If you didn't do the secure operation, you need to read this pdf:

https://community.nxp.com/servlet/JiveServlet/download/859331-1-397057/Kinetis+Lock+issue+analysis+a...

Check whether you meet all the related requirement, the solder temperature, the debugger wire, etc.

When you first time use the board, it works OK right? Just after the ROM bootloader mass erase, then the debugger can't connect?

Do you have FRDM-KE15Z board on your side, can you use the same step and reproduce it in the NXP official board?

If you can reproduce it, I will check it on my side.

Kerry

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!

- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------