MKV31F512 is locked in secure state

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

MKV31F512 is locked in secure state

48,266 Views
alexeykazartesv
Contributor I

Hello.
I have a problem with MKV31F51 controller. During debug session it's stucked in secured state. A lot of reprogrammings have been done successfully but after last one "Secured Kinetis device detected" message appeared during device programming. I agrreed with prompt to mass erase device but it not help. I've tried to access device by Segger J-link debugger. AP status register (1) value was read as "0x3E" (mass erase enabled, no reset, secure is enabled), AP command register value was 0x0.
I forced mass erase by writing 0x1 value ("Flash mass erase in progress" bit) to AP command register and value from it was read as 0x1, but i received no ack about erase end, AP reg 1 value is stucked in 0x1. After half an hour a checked again and value was the same.
How can I unlock device?

Labels (1)
0 Kudos
13 Replies

44,873 Views
Hui_Ma
NXP TechSupport
NXP TechSupport

Hi

Have you tried to use Segger J-Link commander tool "unlock Kinetis"  command to unlock the KV31 chip?

pastedImage_1.png

And below is a similar thread about how to use J-Link unlock Kinetis product:

https://community.nxp.com/message/810487?commentID=810487#comment-810487 


Wish it helps.

Have a great day,
Ma Hui
-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

0 Kudos

44,873 Views
alexeykazartesv
Contributor I

Hi!

Yes, I've tried it but with no result:

pastedImage_1.png

It's a second time when this problem occured. First time it happens when I cancel chip programming in the middle of the process. We just resolder another chip. This is that chip - worked for some time but after reassemble work stand it fell to "security state" too.

0 Kudos

44,873 Views
Hui_Ma
NXP TechSupport
NXP TechSupport

Hi

Customer could try with attached J-Link script.

The Kinetis Kxx Cortex-M4 erase all and unsecure manual in Chinese, I add the translation for your reference.


Wish it helps.

Have a great day,
Ma Hui
-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

0 Kudos

44,872 Views
alexeykazartesv
Contributor I

Hi!

Sadly, but it doesnt help. I ran script with reset pin hold active. Jlink at first trying to unlock device by itself a lot of times with no success and finally script ran with no required result too.

But - reset pin after this configuration hold in 1.6V (without forcing it low, this pin has external 4.7k pullup to 3.3V)

*only SWD is available as a debug interface

Script running log (first automatical tries of unlocking is removed):

****** Error: Kinetis (connect): Timeout while unsecuring device. Erase never st
arts.
Kinetis (connect): Failed to unsecure Kinetis device.

Found SWD-DP with ID 0x2BA01477
Found SWD-DP with ID 0x2BA01477

****** Error: Kinetis (connect): Timeout while unsecuring device. Erase never st
arts.
Kinetis (connect): Failed to unsecure Kinetis device.

UND: R13=00000000, R14=00000000, SPSR=00000000

Sleep(1000)

Disconnecting from J-Link...O.K.
Selecting SWD as current target interface.

Sleep(10)

Select SWD by sending SWD switching sequence.
Found SWD-DP with ID 0x2BA01477

Sleep(10)

Write DP register 2 = 0x01000000

Sleep(10)

Read AP register 0 = 0x00000036

Sleep(10)

Read AP register 0 = 0x00000036

Sleep(10)

Read AP register 1 = 0x00000036

Sleep(10)

Read AP register 1 = 0x00000001

Sleep(10)

Read AP register 0 = 0x00000001

Sleep(10)

Read AP register 0 = 0x00000036

Sleep(10)

Write AP register 1 = 0x00000001

Sleep(1000)

Read AP register 0 = 0x00000036

Sleep(10)

Read AP register 0 = 0x00000036

Sleep(10)

Read AP register 1 = 0x00000036

Sleep(10)

Read AP register 1 = 0x00000001

Sleep(100)

Write DP register 2 = 0x00000000

Sleep(1000)


Selecting JTAG as current target interface.

Sleep(100)

Target connection not established yet but required for command.
Device position in JTAG chain (IRPre,DRPre) <Default>: -1,-1 => Auto-detect
JTAGConf>
Device "MKV31F512XXX12" selected.


TotalIRLen = ?, IRPrint = 0x..000000000000000000000000

Can not connect to target.
TotalIRLen = ?, IRPrint = 0x..000000000000000000000000

Reset delay: 0 ms
Reset type UNKNOWN: ???
TotalIRLen = ?, IRPrint = 0x..000000000000000000000000


Script processing completed.

0 Kudos

44,871 Views
Hui_Ma
NXP TechSupport
NXP TechSupport

Hi

I translate the Kinetis lock issue document attached for your reference.


Wish it helps.

Have a great day,
Ma Hui
-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

44,871 Views
kalpesh_dodiya
Contributor I

Hello Ma Hui,

I studied the Kinetis Lock issue analysis and unlock way.pdf in which you have mentioned that blank controller (without programmed) has saw tooth wave on its reset pin. May i know the reason?

Regards

Kalpesh Dodiya

0 Kudos

44,869 Views
Hui_Ma
NXP TechSupport
NXP TechSupport

Hi Kalpesh,

The reason is internal WDOG was default enabled and cause the system reset when WDOG timeout.

best regards,

Mike

0 Kudos

44,869 Views
kalpesh_dodiya
Contributor I

Thank you Hui_Ma,

So, How can i differentiate by looking at my Hardware or through debugging it whether controller is damaged or it is locked/secured?

Regards

Kalpesh

0 Kudos

44,871 Views
Hui_Ma
NXP TechSupport
NXP TechSupport

Hi,

I would recommend our discussion go back to your submitted thread here. Thanks.


Have a great day,
Mike

-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

0 Kudos

44,871 Views
alexeykazartesv
Contributor I

Hi

Thanks a lot for a translation, it's much better then raw google-translate!

But problem is still here.. I run your script several times with grounded/pullup reset but result was the same - flag "mass erase request" is set, but "mass erase ack" has never be received. In some cases flag "flash ready" fell too.

But I found one weak point in hardware design that may cause this error (possibly not good timing between reset and power-up).

I'll try some more combinations of software, scripts, commands etc.

0 Kudos

44,872 Views
armaram
Contributor III

Hi Alexey,

Any luck unlocking your device? We too have the same problem and none of the methods described above have been helpful so far.

Thanks,

0 Kudos

44,872 Views
davicampos_le
Contributor I

Hi

Do you have any success in unlocking the kinetis?
I'm having the same problem.

0 Kudos

44,872 Views
Hui_Ma
NXP TechSupport
NXP TechSupport

Hi

Please try with this script more times and check if it could unlock KV31 chip successfully.

If there still could not works, customer also could try with update J-Link hardware firmware and J-Link software.

And if customer has the P&E USB Multilink tool, customer could try use this tool .

There is an document about Kinetis lock issue analysis , while it was written in Chinese.

There shows using above script could unlock most situation locked Kinetis chips.

Please let me know if there still with problem.


Wish it helps.

Have a great day,
Ma Hui
-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

0 Kudos