unlocking kinetis (KL25Z) with the jlink console

I locked my KL25Z board using pyOCD gdb yesterday, was not able to connect to the chip with ULINK, neither with CMSIS-DAP interface on KL25Z (K20). Because I am using older bootloader on openSDA interface, the board does not recognize jlink openSDA binary file. The only option left for me was to test it with an external jlink. So you need an external jlink to follow. I am not aware that ulink can do this. If you are, leave a comment!

To start with this, enter to the bootloader mode, if you are using openSDA hardware interface. So no any other interface is active which would block an access to the target.

I connected my jlink to it, shown error while connecting to the chip. Usually when I locked kinetis chip, at least jlink was able to connect to MCU. This time I assumed the mass erase protection bit was set. Thus I followed just simple steps find out what is the state of my core. I got lucky, the mass erase bit was not set, jlink was able to unlock the kinetis. If mass erase bit is set, it would fail. I accidentally selected KL26Z chip.

SEGGER J-Link Commander V4.76f ('?' for help)
Compiled Sep 27 2013 16:54:08
DLL version V4.76f, compiled Sep 27 2013 16:53:51
Firmware: J-Link Lite-FSL V1 compiled Jun 25 2012 16:40:07
Hardware: V1.00
S/N: 361000149
VTarget = 2.874V
Info: Could not measure total IR len. TDO is constant high.
Info: Could not measure total IR len. TDO is constant high.
No devices found on JTAG chain. Trying to find device on SWD.
Info: Found SWD-DP with ID 0x0BC11477

****** Error: Error while identifying Cortex-M core.
Info: Found SWD-DP with ID 0x0BC11477
No device found on SWD.
Failed to identify target. Trying again with slow (4 kHz) speed.
Info: Could not measure total IR len. TDO is constant high.
Info: Could not measure total IR len. TDO is constant high.
No devices found on JTAG chain. Trying to find device on SWD.
Info: Found SWD-DP with ID 0x0BC11477

****** Error: Error while identifying Cortex-M core.
Info: Found SWD-DP with ID 0x0BC11477
No device found on SWD.

J-Link>device ?
Info: Device "MKL26Z128XXX4" selected (128 KB flash, 16 KB RAM).
Reconnecting to target...
Info: Could not measure total IR len. TDO is constant high.
Info: Could not measure total IR len. TDO is constant high.
J-Link>unlock kinetis
Unlocking device...O.K.

J-Link>SWDReadAP 0x1000000
Read AP register 16777216 = 0x00000000
J-Link>SWDReadAP 0x1000000
Read AP register 16777216 = 0x00000031

J-Link>erase
Info: Found SWD-DP with ID 0x0BC11477
Info: Found SWD-DP with ID 0x0BC11477
Info: Found Cortex-M0 r0p0, Little endian.
Info: FPUnit: 2 code (BP) slots and 0 literal slots
Info: Kinetis L-series (setup): Disabling watchdog.
Erasing device (MKL26Z128xxx4)...
Info: J-Link: Flash download: Flash programming performed for 1 range (1024 byte
s)
Info: J-Link: Flash download: Total time needed: 1.086s (Prepare: 0.465s, Compar
e: 0.143s, Erase: 0.017s, Program: 0.047s, Verify: 0.012s, Restore: 0.399s)
Erasing done.
J-Link>

To read further about MDM-AP Control register (check the output SWDReadAP), see chapter 9.3.1 MDM-AP Control Register where all bits are described.

Update1:
I am testing the KL46Z interface, got locked today, but was not able to revive it with the same procedure as above, unlocking failed firstly. I invoked erase, passed with a error, and the unlock. My chip is again alive!

SEGGER J-Link Commander V4.76f ('?' for help)
Compiled Sep 27 2013 16:54:08
DLL version V4.76f, compiled Sep 27 2013 16:53:51
Firmware: J-Link Lite-FSL V1 compiled Jun 25 2012 16:40:07
Hardware: V1.00
S/N: 361000149
VTarget = 3.280V
Info: Could not measure total IR len. TDO is constant high.
Info: Could not measure total IR len. TDO is constant high.
No devices found on JTAG chain. Trying to find device on SWD.
Info: Found SWD-DP with ID 0x0BC11477

****** Error: Error while identifying Cortex-M core.
Info: Found SWD-DP with ID 0x0BC11477
No device found on SWD.
Failed to identify target. Trying again with slow (4 kHz) speed.
Info: Could not measure total IR len. TDO is constant high.
Info: Could not measure total IR len. TDO is constant high.
No devices found on JTAG chain. Trying to find device on SWD.
Info: Found SWD-DP with ID 0x0BC11477

****** Error: Error while identifying Cortex-M core.
Info: Found SWD-DP with ID 0x0BC11477
No device found on SWD.
J-Link>device ?
Info: Device "MKL46Z256XXX4 (ALLOW SECURITY)" selected (256 KB flash, 32 KB RAM)
.
Reconnecting to target...
Info: Could not measure total IR len. TDO is constant high.
Info: Could not measure total IR len. TDO is constant high.
J-Link>unlock kinetis
Unlocking device...Timeout while unlocking device.
J-Link>unlock kinetis
Unlocking device...Timeout while unlocking device.
J-Link>unlock kinetis
Unlocking device...Timeout while unlocking device.
J-Link>erase
Info: Found SWD-DP with ID 0x0BC11477

****** Error: Kinetis (connect): Timeout while halting CPU. CPU does not stop.
Erasing device (MKL46Z256xxx4 (allow security))...
Info: Found SWD-DP with ID 0x0BC11477
Info: Found SWD-DP with ID 0x0BC11477
Info: Found Cortex-M0 r0p0, Little endian.
Info: FPUnit: 2 code (BP) slots and 0 literal slots
Info: Kinetis L-series (setup): Disabling watchdog.
Info: J-Link: Flash download: Flash programming performed for 1 range (1024 byte
s)
Info: J-Link: Flash download: Total time needed: 1.173s (Prepare: 0.481s, Compar
e: 0.245s, Erase: 0.016s, Program: 0.001s, Verify: 0.010s, Restore: 0.417s)
Erasing done.
J-Link>unlock kinetis
Unlocking device...O.K.
J-Link>

mbed GCC with eclipse KL25Z (Part 2)

This is finally the debugging part which I described in one of my comments. There are at least 3 options to debug KL25Z with GCC:
CMSIS-DAP with openOCD, external Jlink or openSDA Jlink firmware.

CMSIS-DAP is still in a development, according to the site cmsis-dap: add initial cmsis-dap support [openocd.zylin.com]. Thus I went straight to Jlink's options. The last option is the most useful for many users. I will describe to process how to set it and be able to debug your KL25Z with no external parts needed.

1. step - download Jlink firmware
Visit a webpage SEGGER openSDA Jlink [http://www.segger.com], there are links on the bottom of the webpage. Be aware of some limitations which are stated there.

Download OpenSDA Jlink firmware http://www.segger.com/admin/uploads/userfiles/file/J-Link/JLink_OpenSDA.zip

2. step - get serial number of openSDA
Switch your KL25Z to the bootloader mode (unconnect usb, hold reset button, plug it back in while holding button, release button). Copy there unzipped file JLink_OpenSDA.sda
Restart the board, then plug it back to your PC.

In case you don't have installed jlink software (gdb, jlink console). Get this program from here which will display the serial number of your openSDA jlink in order to download the jlink software (you need jlink's serial number which we obviously don't know as we don't have external tool).

3. step - install JLink software
Download Jlink firmware here JLink software [http://www.segger.com]

This will install  Jlink configurator, check serial number, type it in the page pasted above and download jlink software.

After installing jlink software,  navigate to a jlink's folder in my case c:\Program Files\Segger\JLinkARM_V472a, open JLink.exe program. It will display this warning, check the below button, it won't display today, and press accept.

This should be an output if your board is connected and the jlink driver was installed properly:
 

Jlink is connected, we proceed to the eclipse project we created in part 1.

4. step - run jlink gdb server
The program is located again in the Segger Jlink software folder, named JLinkGDBServer. Execute the program, it pops the config window, set it as it is shown on the picture:

Press OK and it should display the following lines

As you see, it's connected to my freedom board. Keep it running, we will connect to it once we complete debug settings in Eclipse.

5. step - set eclipse project
Before going further, your eclipse must have installed GDB Hardware Debugging plugin. If not, please find a tutorial how to install that plugin.

Open your mbed KL25Z project, select your project, click on the green bug (the top right corner on the picture) and select Debug configuration.

Click with your right mouse button on GDB Hardware Debugging, create New one

On the bottom of the window it is "Using GDB (DSF) Hardware .... Select other . Click on select other and we need to check button Use configuration specific and select Standard GDB Hardware

Now we are back in Debug configurations, select Debugger tab and fill details according to the picture below

The tab Startup needs this details
The first input window (Initialization Commands) contain on my side the following commands
target remote localhost:2331
monitor clrbp
monitor endian little
monitor speed 1000
monitor reset
monitor sleep 100
monitor speed auto

The last input window (Run Commands) (Note: I prefer to put a breakpoint in Reset_Handler)
break main
continue

I assume your jlink gdb server is running, click on the debug icon on the bottom of Debug configurations window.

This should be your window (breakpoint is set in main, thus it stops there).

Now led should be blinking.

The debugging part over ! There are tutorials how to work with gdb. If anything not correct, please use comments below or contact me on mbed. I'll add this to my notepad there.