Permanent Device Lock of Freescale Kinetis K60Xxxx

Introduction

When you create a new project from scratch in IAR Embedded Workbench for Arm version 6.30.3 and older, for a Freescale Kinetis K60Xxxx device, using Target -> Core: "Cortex-M4", or Device -> "Freescale K60Xxxx", the default linker configuration file "generic_cortex.icf" will be selected.
This linker configuration file may cause a permanent device secure (i.e. the device is made impossible to re-program), when you download your code to the board.

In IAR Embedded Workbench for Arm version 6.30.4 and newer, another default linker configuration file (Freescale\MK60xxxx.icf) will automatically be selected, which prevents this issue.

Solution

IAR Embedded Workbench for Arm 6.30.3 and older:

Use the following linker configuration file for K60Xxxx devices:

$TOOLKIT_DIR$\examples\Freescale\K60\
TWR-K60\GettingStarted\config\K60X_Flash.icf

IAR Embedded Workbench for Arm 6.30.4 and newer:

Use the default linker configuration file (automatically selected) located in:

$TOOLKIT_DIR$\config\linker\Freescale

Background

The default linker configuration file for Arm Cortex in IAR Embedded Workbench IDE (version 6.30.3 and older) places code starting at location 0. The problem is that once the code grows to encompass address 0x40C, the NVFSEC register will be programmed.

There are two bits in the NVFSEC register that can permanently disable the mass erase functionality on the chip. These bits are called Mass Erase Enable Bits (MEEN). In this same register there are also two bits that controls the Flash security (SEC). When used in conjunction, they can permanently lock the device.

Note that when selecting Options -> Target -> Device: Freescale K60Xxxx in IAR Embedded Workbench for Arm version 6.30.3 and older, the option Linker -> Config -> "Linker configuration file" is set to "generic_cortex.icf" by default.

To change the settings, see the pictures.

Note 1:
All example projects included in the IAR K60N512 kit overrides the default linker configuration file with either "K60X_ram.icf" or "K60X_Flash.icf", and the device lock problem does not occur.

Note 2:
The example projects provided with Freescale MQX includes a vector table in "vector.c" that is extended to cover the flash config area and sets the proper values.

Note 3:
If the device has been locked with the Flash security bits only, you can unlock the device using the J-Link Commander (jlink.exe) command:

J-Link> unlock Kinetis

Note 4:

With I-jet and IAR Embedded Workbench for Arm version 8.40.1 and newer, unlocking is performed automatically with debugger macros from arm\config\debugger\NXP.
Using the View > Macros > Debugger Macros window, you will find a MassErase() macro there. You can execute the macro manually with the View > Macros > Macro Quicklaunch window.

With IAR Embedded Workbench for Arm version 6.60.1 to 8.32.3, you can use I-jet and the following command::

<installation dir>\arm\bin\jet\bin\Kinetis_unlock_swd.bat

Note 5:

In recent versions of IAR Embedded Workbench for Arm, the flash loader has a built-in write-protection of the NVFSEC register. To be able to write to this protected flash area, you will have to specify the following option in Project > Options > Debugger > Download > Override default .board file > Edit... > Extra parameters:

--enable_config_write

Parameter description:

Allow programming of 0x40C - 0x40F with user supplied data, in other case flashloader after erase of block 0 will write 0xFFFFFFFE (unsecure state).

All product names are trademarks or registered trademarks of their respective owners.