AnsweredAssumed Answered

Ezport broken when MCU security status is secure

Question asked by Rick Bronson on Jul 18, 2016
Latest reply on Aug 9, 2016 by Rick Bronson

  We have been seeing an issue with the MK20FN1M0VMD12 that happens very

randomly that ends up causing the Ezport to be broken.  The only way

we have figured out to get out of this scenario is using "unlock

kinetis" via the JLINK debugger.

  Unfortunately, we have not figured out what causes the part to get

into this mode but we are working on it.  Separately, I was able to

get the part into this mode via the JLINK with these commands:

 

J-Link>loadfile file1.bin

J-Link>r

J-Link>g

J-Link>loadfile file2.bin

 

  Nothing special about these two files, they are both valid K20

executables.

 

  At this point the JLINK spits out:

 

J-Link: Flash download: Restarting flash programming due to program error (possibly skipped erasure of half-way erased sector).

J-Link: Flash download: Skip optimizations disabled for second try.

Error while programming flash: Programming failed.

 

  The following debug output yields (I annotated some stuff below with

--->):

 

r0 //system reset 

writedp 2, 0x01000000           //select MDM-AP 

readap 0 

sleep 10 

readap 0 // read MDM-AP register status

Reading AP register 0 = 0x00000037 (0 read repetitions needed)

---> System Security bit set

 

J-Link>mem 0x40020000 20 // FTFE memory map

40020000 = 90 06 CA 11 00 10 01 09 00 00 00 00 00 00 00 00

40020010 = CB 11 00 00 00 00 00 00 00 00 00 00 00 00 00 00

--->Flash Option Register(40020003)=EzPort operation is enabled

--->Flash Protection Violation Flag

--->Freescale Failure Analysis Access Code=Freescale factory access denied

--->Program Flash Protection Registers=different

--->Backdoor Access Key Enable(40020002)=Backdoor key access disabled

 

J-Link>mem 0x400 10

00000400 = FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF

--->Flash Security Register=MCU security status is secure

 

  So at this point when the Ezport is used to program, not even this

command:

 

EZPORT_RDSR  0x05  /* Read Status Register */

 

  works.  The return value is 0xff.  According to Table 31-2 of

K20P144M120SF3RM.pdf, this command should function even if the part is

secure.

 

  Any ideas/comments greatly appreciated.

 

  Rick

Outcomes