December 3, 2013

unlocking kinetis (KL25Z) with the jlink console

I locked my KL25Z board using pyOCD gdb yesterday, was not able to connect to the chip with ULINK, neither with CMSIS-DAP interface on KL25Z (K20). Because I am using older bootloader on openSDA interface, the board does not recognize jlink openSDA binary file. The only option left for me was to test it with an external jlink. So you need an external jlink to follow. I am not aware that ulink can do this. If you are, leave a comment!

To start with this, enter to the bootloader mode, if you are using openSDA hardware interface. So no any other interface is active which would block an access to the target.

I connected my jlink to it, shown error while connecting to the chip. Usually when I locked kinetis chip, at least jlink was able to connect to MCU. This time I assumed the mass erase protection bit was set. Thus I followed just simple steps find out what is the state of my core. I got lucky, the mass erase bit was not set, jlink was able to unlock the kinetis. If mass erase bit is set, it would fail. I accidentally selected KL26Z chip.

SEGGER J-Link Commander V4.76f ('?' for help)
Compiled Sep 27 2013 16:54:08
DLL version V4.76f, compiled Sep 27 2013 16:53:51
Firmware: J-Link Lite-FSL V1 compiled Jun 25 2012 16:40:07
Hardware: V1.00
S/N: 361000149
VTarget = 2.874V
Info: Could not measure total IR len. TDO is constant high.
Info: Could not measure total IR len. TDO is constant high.
No devices found on JTAG chain. Trying to find device on SWD.
Info: Found SWD-DP with ID 0x0BC11477

****** Error: Error while identifying Cortex-M core.
Info: Found SWD-DP with ID 0x0BC11477
No device found on SWD.
Failed to identify target. Trying again with slow (4 kHz) speed.
Info: Could not measure total IR len. TDO is constant high.
Info: Could not measure total IR len. TDO is constant high.
No devices found on JTAG chain. Trying to find device on SWD.
Info: Found SWD-DP with ID 0x0BC11477

****** Error: Error while identifying Cortex-M core.
Info: Found SWD-DP with ID 0x0BC11477
No device found on SWD.

J-Link>device ?
Info: Device "MKL26Z128XXX4" selected (128 KB flash, 16 KB RAM).
Reconnecting to target...
Info: Could not measure total IR len. TDO is constant high.
Info: Could not measure total IR len. TDO is constant high.
J-Link>unlock kinetis
Unlocking device...O.K.
J-Link>SWDReadAP 0x1000000
Read AP register 16777216 = 0x00000000
J-Link>SWDReadAP 0x1000000
Read AP register 16777216 = 0x00000031
J-Link>erase
Info: Found SWD-DP with ID 0x0BC11477
Info: Found SWD-DP with ID 0x0BC11477
Info: Found Cortex-M0 r0p0, Little endian.
Info: FPUnit: 2 code (BP) slots and 0 literal slots
Info: Kinetis L-series (setup): Disabling watchdog.
Erasing device (MKL26Z128xxx4)...
Info: J-Link: Flash download: Flash programming performed for 1 range (1024 byte
s)
Info: J-Link: Flash download: Total time needed: 1.086s (Prepare: 0.465s, Compar
e: 0.143s, Erase: 0.017s, Program: 0.047s, Verify: 0.012s, Restore: 0.399s)
Erasing done.
J-Link>

To read further about MDM-AP Control register (check the output SWDReadAP), see chapter 9.3.1 MDM-AP Control Register where all bits are described.

Update1:
I am testing the KL46Z interface, got locked today, but was not able to revive it with the same procedure as above, unlocking failed firstly. I invoked erase, passed with a error, and the unlock. My chip is again alive!

SEGGER J-Link Commander V4.76f ('?' for help)
Compiled Sep 27 2013 16:54:08
DLL version V4.76f, compiled Sep 27 2013 16:53:51
Firmware: J-Link Lite-FSL V1 compiled Jun 25 2012 16:40:07
Hardware: V1.00
S/N: 361000149
VTarget = 3.280V
Info: Could not measure total IR len. TDO is constant high.
Info: Could not measure total IR len. TDO is constant high.
No devices found on JTAG chain. Trying to find device on SWD.
Info: Found SWD-DP with ID 0x0BC11477

****** Error: Error while identifying Cortex-M core.
Info: Found SWD-DP with ID 0x0BC11477
No device found on SWD.
Failed to identify target. Trying again with slow (4 kHz) speed.
Info: Could not measure total IR len. TDO is constant high.
Info: Could not measure total IR len. TDO is constant high.
No devices found on JTAG chain. Trying to find device on SWD.
Info: Found SWD-DP with ID 0x0BC11477

****** Error: Error while identifying Cortex-M core.
Info: Found SWD-DP with ID 0x0BC11477
No device found on SWD.
J-Link>device ?
Info: Device "MKL46Z256XXX4 (ALLOW SECURITY)" selected (256 KB flash, 32 KB RAM)
.
Reconnecting to target...
Info: Could not measure total IR len. TDO is constant high.
Info: Could not measure total IR len. TDO is constant high.
J-Link>unlock kinetis
Unlocking device...Timeout while unlocking device.
J-Link>unlock kinetis
Unlocking device...Timeout while unlocking device.
J-Link>unlock kinetis
Unlocking device...Timeout while unlocking device.
J-Link>erase
Info: Found SWD-DP with ID 0x0BC11477

****** Error: Kinetis (connect): Timeout while halting CPU. CPU does not stop.
Erasing device (MKL46Z256xxx4 (allow security))...
Info: Found SWD-DP with ID 0x0BC11477
Info: Found SWD-DP with ID 0x0BC11477
Info: Found Cortex-M0 r0p0, Little endian.
Info: FPUnit: 2 code (BP) slots and 0 literal slots
Info: Kinetis L-series (setup): Disabling watchdog.
Info: J-Link: Flash download: Flash programming performed for 1 range (1024 byte
s)
Info: J-Link: Flash download: Total time needed: 1.173s (Prepare: 0.481s, Compar
e: 0.245s, Erase: 0.016s, Program: 0.001s, Verify: 0.010s, Restore: 0.417s)
Erasing done.
J-Link>unlock kinetis
Unlocking device...O.K.
J-Link>