AnsweredAssumed Answered

TWR-K65F180M board unintentionally secured

Question asked by petec20 on May 19, 2016
Latest reply on Jun 10, 2016 by petec20

I've been using IAR Embedded workbench v7.30 to program a tower system for a few months and everything has been okay.

Target is TWR-K65F180M. JTAG probe is Segger and using the JTAG interface. The Segger software is up to date.

I powered down the system to change a wire connection, powered it back up again, went to reload the MCU flash, and got an IAR message saying that it had detected a 'secure Kinetis device' and that it needed to unsecure the device. I clicked okay and it said 'timeout while unsecuring device. Erase never starts'.

 

I'm wondering how this can happen when the memory range 0x400-0x40F is initialised to disable the MCU security. I checked this in the binary and it confirmed it.

JFlash_0x400-0x40F_from_BIN.jpg

I've also tried the 'unlock kinetis' function in Jlink commander. That also said that the unlock feature had timed out.

 

Then I tried the technique mentioned here: https://community.freescale.com/thread/300407

Which gave the following output:

 

SEGGER J-Link Commander V4.94c ('?' for help)

Compiled Oct 31 2014 20:00:06

 

Script file read successfully.

DLL version V4.94c, compiled Oct 31 2014 19:59:57

Firmware: J-Link V9 compiled Apr 21 2015 18:10:40

Hardware: V9.30

S/N: 269302xxx

OEM: SEGGER-EDU

Feature(s): FlashBP, GDB

VTarget = 3.267V

Info: TotalIRLen = 4, IRPrint = 0x01

 

****** Error: Error while identifying Cortex-M device. Wrong AHB ID. Expected 0x04770001, found 0x00000000

Info: TotalIRLen = 4, IRPrint = 0x01

No devices found on JTAG chain. Trying to find device on SWD.

Info: Found SWD-DP with ID 0x2BA01477

 

****** Error: Error while identifying Cortex-M core.

Info: Found SWD-DP with ID 0x2BA01477

No device found on SWD.

Trying to find device on FINE interface.

No device found on FINE interface.

Did not find any core.

Failed to identify target. Trying again with slow (4 kHz) speed.

No devices found on JTAG chain. Trying to find device on SWD.

Info: Found SWD-DP with ID 0x2BA01477

 

****** Error: Error while identifying Cortex-M core.

Info: Found SWD-DP with ID 0x2BA01477

No device found on SWD.

Trying to find device on FINE interface.

No device found on FINE interface.

Did not find any core.

No device found at all. Selecting JTAG as default target interface.

Processing script file...

 

Target interface speed: 1000 kHz

 

Sleep(10)

 

Info: TotalIRLen = 4, IRPrint = 0x01

 

****** Error: Error while identifying Cortex-M device. Wrong AHB ID. Expected 0x04770001, found 0x00000000

Reset type UNKNOWN: ???

 

Info: TotalIRLen = 4, IRPrint = 0x01

 

****** Error: Error while identifying Cortex-M device. Wrong AHB ID. Expected 0x04770001, found 0x00000000

Reset delay: 0 ms

Reset type UNKNOWN: ???

Info: TotalIRLen = 4, IRPrint = 0x01

 

Info: TotalIRLen = 4, IRPrint = 0x01

 

****** Error: Error while identifying Cortex-M device. Wrong AHB ID. Expected 0x04770001, found 0x00000000

Info: TotalIRLen = 4, IRPrint = 0x01

Info: TotalIRLen = 4, IRPrint = 0x01

PC: (R15) = 00000000, CPSR = 00000000 (Unknown mode, ARM)

Info: TotalIRLen = 4, IRPrint = 0x01

Info: TotalIRLen = 4, IRPrint = 0x01

Info: TotalIRLen = 4, IRPrint = 0x01

Info: TotalIRLen = 4, IRPrint = 0x01

Info: TotalIRLen = 4, IRPrint = 0x01

Info: TotalIRLen = 4, IRPrint = 0x01

Info: TotalIRLen = 4, IRPrint = 0x01

Info: TotalIRLen = 4, IRPrint = 0x01

R0 = 00000000, R1 = 00000000, R2 = 00000000, R3 = 00000000

R4 = 00000000, R5 = 00000000, R6 = 00000000, R7 = 00000000

Info: TotalIRLen = 4, IRPrint = 0x01

Info: TotalIRLen = 4, IRPrint = 0x01

Info: TotalIRLen = 4, IRPrint = 0x01

Info: TotalIRLen = 4, IRPrint = 0x01

Info: TotalIRLen = 4, IRPrint = 0x01

USR: R8 =00000000, R9 =00000000, R10=00000000, R11 =00000000, R12 =00000000

Info: TotalIRLen = 4, IRPrint = 0x01

Info: TotalIRLen = 4, IRPrint = 0x01

     R13=00000000, R14=00000000

Info: TotalIRLen = 4, IRPrint = 0x01

Info: TotalIRLen = 4, IRPrint = 0x01

Info: TotalIRLen = 4, IRPrint = 0x01

Info: TotalIRLen = 4, IRPrint = 0x01

Info: TotalIRLen = 4, IRPrint = 0x01

FIQ: R8 =00000000, R9 =00000000, R10=00000000, R11 =00000000, R12 =00000000

Info: TotalIRLen = 4, IRPrint = 0x01

Info: TotalIRLen = 4, IRPrint = 0x01

Info: TotalIRLen = 4, IRPrint = 0x01

     R13=00000000, R14=00000000, SPSR=00000000

Info: TotalIRLen = 4, IRPrint = 0x01

Info: TotalIRLen = 4, IRPrint = 0x01

Info: TotalIRLen = 4, IRPrint = 0x01

SVC: R13=00000000, R14=00000000, SPSR=00000000

Info: TotalIRLen = 4, IRPrint = 0x01

Info: TotalIRLen = 4, IRPrint = 0x01

Info: TotalIRLen = 4, IRPrint = 0x01

ABT: R13=00000000, R14=00000000, SPSR=00000000

Info: TotalIRLen = 4, IRPrint = 0x01

Info: TotalIRLen = 4, IRPrint = 0x01

Info: TotalIRLen = 4, IRPrint = 0x01

IRQ: R13=00000000, R14=00000000, SPSR=00000000

Info: TotalIRLen = 4, IRPrint = 0x01

Info: TotalIRLen = 4, IRPrint = 0x01

Info: TotalIRLen = 4, IRPrint = 0x01

UND: R13=00000000, R14=00000000, SPSR=00000000

 

Sleep(1000)

Selecting SWD as current target interface.

Setting target interface speed to 1MHz. Use "Speed" to change.

Sleep(10)

Select SWD by sending SWD switching sequence.

Found SWD-DP with ID 0x2BA01477

Sleep(10)

Write DP register 2 = 0x01000000

Sleep(10)

Read AP register 0 = 0xE00FF003

Sleep(10)

Read AP register 0 = 0x00000036

Sleep(10)

Read AP register 1 = 0x00000036

Sleep(10)

Read AP register 1 = 0x00000000

Sleep(10)

Read AP register 0 = 0x00000000

Sleep(10)

Read AP register 0 = 0x00000036

Sleep(10)

Write AP register 1 = 0x00000001

Sleep(1000)

Read AP register 0 = 0x00000036

Sleep(10)

Read AP register 0 = 0x00000036

Sleep(10)

Read AP register 1 = 0x00000036

Sleep(10)

Read AP register 1 = 0x00000001

Sleep(100)

Write DP register 2 = 0x00000000

Sleep(1000)

 

Selecting JTAG as current target interface.

Setting target interface speed to 1MHz. Use "Speed" to change.

Sleep(100)

Info: TotalIRLen = 4, IRPrint = 0x01

****** Error: Error while identifying Cortex-M device. Wrong AHB ID. Expected 0x04770001, found 0x00000000

Reset delay: 0 ms

Reset type UNKNOWN: ???

Info: TotalIRLen = 4, IRPrint = 0x01

 

Script processing completed.

 

When I look at the reset line with no JTAG probe attached the MCU resets every 2.2mS I assume this is due to the watchdog and the 100nF capacitor on the reset line, as a soon as it resets it ramps again and the cycle repeats. In the code the first thing it does is disables the watchdog in the correct sequence. The code then runs a short setup sequence and ends in an endless loop. So even if I can't get into the part I'm wondering why it watchdogs.

 

QUESTIONS

1) Are there any other techniques to try to unlock the part?

2) From above can anybody tell me if the part is recoverable?

3) How did the MCU become secured in the first place, when the memory range 0x400-0x40F is being initialised as above to prevent this?

4) As the internal code disables the watchdog why does it appear to be active?

Outcomes