I have Kinetis K10s that need to be unsecured by a flasher. Our firmware image secures the chip but leaves the mass erase option available. The factory programming equipment does not have a data connection to the Flasher, just a button hooked up to the trigger input. I need the Flasher to unsecure, then mass erase every time it programs parts.

Other posts in this forum says the Flasher should automatically unsecure, but it doesn't. I've tried setting AutoPerformsUnsecure in the .jflash project but that doesn't unsecure the parts, either. The Freescale docs just say to set the Mass Erase bit in the MDM-AP control register. I can do this via wjc and wjd commands in the J-Link Commander, but that alone doesn't do the job. The only method that seems to unlock the K10 is to execute 'unlock kinetis' three times in the J-Link Commander. (DLL 4.70A, J-Trace HW 3.10, FW 6/27/13)

It looks like I need to duplicate what "unlock kinetis' does as a series of init steps (e.g, WriteIR, WriteDR) that I can put into the .jflash project, so I'm down to grabbing USB commands to the JLink while it executes "unlock kinetis" to suss out how this command unlocks the K10. If that doesn't work, I'm down to logic analyzer traces on the JTAG lines.

Ideally, if Segger has an unsecure kinetis .jflashscript, or can publish what "unsecure Kinetis" actually sends, that would get me a lot further down the road.

Agreed, normally the factory works with blank parts. However, the factory occasionally has to rework or reprogram a device that has already been programmed, especially during line bringup. However if they put a programmed device back on the line and attempt to flash it again (say, with newer FW or diagnostic FW), the Flasher does not or cannot unsecure it to erase it.

Therefore I am looking for a way to modify the Flasher project to explicitly attempt to unsecure every chip prior to programming it. My current approach is to write a .jflashscript file to replace InitTarget() with a script that will unsecure the device before programming. The question is what to put in that script.

Freescale has sent me a set of .jflash steps that perform a series of SWD-mode commands to unsecure the device. Unfortunately, the jflashscript API apparently doesn't support SWD mode writes, so I need to duplicate those steps using JTAG IR and DR writes.

As to the Commander reference, I am using a J-Trace for ARM Coretex-M to investigate how the Commander's "Unlock Kinetis" command works, and turn these into IR and DR command sequences that can be sent to the device. I've since discovered that the first thing that "Unlock Kinetis" does is put the device in SWD mode and then unlocks it with SWD writes. Either way, it looks like I have to convert SWD jflash steps into JTAG IR/DR writes that can be used in the Flasher.

OK so I almost have this working using Init Steps, but I cannot find a way to hold the nRST pin during connect in stand-alone mode. These init steps work fine in connected mode:

Reset (3,0) // Reset hold during connection
Delay (10)
Write JTAG IR (0x0A) // DPACC
Delay (10)
Write JTAG DR (0x04, 3) // Set SELECT, Write
Write JTAG DR (0x01000000, 32) // Set MDM-AP, Bank 0
Delay (100)
Write JTAG IR (0x0B) // APACC
Delay (10)
Write JTAG DR (0x02, 3) // Write MDM-AP Control
Write JTAG DR (0x01, 32) // Mass Erase
Delay (1000)
Write JTAG IR (0x0A) // DPACC
Delay (10)
Write JTAG DR (0x04, 3) // Set SELECT, Write
Write JTAG DR (0x00, 32) // Set AHB-AP, Bank 0
Delay (1000)
Reset (2,0) // Normal reset
Delay (10)

In stand-alone mode, the nRST line is released before connecting, but in connected mode nRST is held as it should be on a reset type 3.

Is there a way to script nRST control?