Unlock the SWD interface via J-Link

I’ve programmed the area at offset 0x40 in NVR3 with the 0x4C6F634B lock value followed by a 16 bytes unlock key. This effectively locks the SWD interface and the RSL10 cannot be accessed anymore.
I can still issue a J-Link connect but not even the CPUID can be read.

I was wondering if there is a way to unlock the part by providing the 16 byte unlock key via J-Link.
What is the reduce capability of the SWD interface in this locked mode? If you cannot provide the unlock key via J-Link then the application must (immediately after reset) prompt with a byte then read 16 bytes from the serial interface and then write the SYSCTRL_DBG_LOCK_KEY registers. Is this the only way?

Bellow is the J-Link output when it connects to an unlocked vs. a locked part:

Connecting to target via SWD
Found SW-DP with ID 0x2BA01477
DPIDR: 0x2BA01477
Scanning AP map to find all available APs
AP[1]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
Iterating through AP map to find AHB-AP to use
AP[0]: Core found
AP[0]: AHB-AP ROM base: 0xE00FF000
CPUID register: 0x412FC231. Implementer code: 0x41 (ARM)
Found Cortex-M3 r2p1, Little endian.
FPUnit: 2 code (BP) slots and 0 literal slots
CoreSight components:
ROMTbl[0] @ E00FF000
ROMTbl[0][0]: E000E000, CID: B105E00D, PID: 000BB000 SCS
ROMTbl[0][1]: E0001000, CID: B105E00D, PID: 003BB002 DWT
ROMTbl[0][2]: E0002000, CID: B105E00D, PID: 002BB003 FPB
Cortex-M3 identified.

Connecting to target via SWD
Found SW-DP with ID 0x2BA01477
DPIDR: 0x2BA01477
Scanning AP map to find all available APs
AP[1]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
Iterating through AP map to find AHB-AP to use
AP[0]: Skipped. Invalid implementer code read from CPUIDVal[31:24] = 0x00
Found SW-DP with ID 0x2BA01477
DPIDR: 0x2BA01477
Scanning AP map to find all available APs
AP[1]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
Iterating through AP map to find AHB-AP to use
AP[0]: Skipped. Invalid implementer code read from CPUIDVal[31:24] = 0x00

****** Error: Could not find core in Coresight setup

Section 3.3.1 of the Hardware Reference Manual gives the sequence for locking and unlocking. I’d first note that these steps seem reversed:

I’ve programmed the area at offset 0x40 in NVR3 with the 0x4C6F634B lock value followed by a 16 bytes unlock key.

The key should first be set starting at 0x44, then the lock value written. To unlock, the key used to lock the device should be written to the SYSCTRL_DBG_UNLOCK_KEY registers as described in the manual:

  1. Unlocking:
    // Initiate SWD interface
    SWDSelect
    // Write to DP[2] to set APSEL to 0 (AHB-AP), and AHBBANKSEL to 0
    SWDWriteDP 2 0
    // Write to AP[0] (CSW) to set size to 32 bit and enable auto-increment
    SWDWriteAP 0 0x23000052
    // Set AP[1] (TAR) = 0x400000F0 (SYSCTRL_DBG_UNLOCK_KEY[0])
    SWDWriteAP 1 0x400000F0
    // Write key word 0 to AP[3] (DRW)
    SWDWriteAP 3
    // Write key word 1 to AP[3] (DRW)
    SWDWriteAP 3
    // Write key word 2 to AP[3] (DRW)
    SWDWriteAP 3
    // Write key word 3 to AP[3] (DRW)
    SWDWriteAP 3
1 Like

Thanks, that worked perfectly.

I’ve written a RAM application which I load and run using the JLinkExe program. The application waits for RTT commands (from host computer to RSL10) and programs the flash memory and also an external serial flash. I’m using 3 RTT buffers (one for binary data which is also CRC protected) and my own flasher linked to the libjlinkarm.so library (actually it works both in Linux and Windows).
This allows me to program both flash and serial flash very fast at 4Mbit/s.
As a last step I program the NVR3 area at 0x40 to disable SWD.

If I ever need to reprogram the part I use the above unlock sequence and load another RAM program which resets the NVR3 area to unlock the part.

No need for any other interface, excellent!

2 Likes