Cart New Account Login

HomeAbout usProductsSupportForumsBlogCustomer Service

search inside this forum
MPC5605B: How to enable censorship and uncensor the device
Sateesh . Dec 2, 2015 at 02:36 AM (02:36 hours)
Staff: Takao Y.

  • My requirement is at production time we are expected to Censor the JTAG with a password to unlock.
    From the reference manual understood the censor mechanism, but how to program the shadow sector?
    Tried flashing the algorithm Freescale_MPC5605BK_1x32x4k_Shadow.PCP using the PE micro on our target. But it completely blocked the device to further access.
    Can some one provide proper steps to censor the device and uncensor the same using a password as explained in manual.




    Comments

  • I might be experiencing something similar with a MPC5604B.
    I'm able to censor the device as the reference manual suggests, and I've been able to verify the censorship configuration by reading the flash before actually resetting.

    Once reset I experience problems with unlocking the device with the password I programmed.
    What happens is that the first time I supply the password I get through the initialization of stackpointers etc without a problem. But when the download of the code is starting the password is asked for AGAIN, but this time it fails and says "Cannot enter background mode.".

    If I power on reset the device right before entering the password the second time I get through the code download as well, but it fails as soon as the debug session is about to start.

  • Greetings,

    As Jonas has suggested, please read the reference manual on how to censor the chip within the shadow block. If you incorrectly program the shadow, you will most likely brick the unit and never be able to recover it. You need a legitimate password by following the rules, and setup the protection registers. All of this is in the chip's reference manual.

    Jonas, what software are you using to flash program and debug your project? The password should only need to be asked once right before flash programming starts.


    Takao Yamada

    • I'm currently using CodeWarrior for MCU Version: 10.6 to flash and debug.

      The following is shown in the cmd window of codewarrior when the unlocking fails:

      ----------------------------------------------------
      Starting 3rd party flash programming...
      GDI: Mtwks Callback(MTWKS_CB_PROJECTACCESS, Section : STARTUP, Entry : SPECIFY_NETWORKCARD_ENABLED, Value : 0, R) => DI_OK
      INF: Copyright 2012 P&E Microcomputer Systems,Inc.
      INF: Command Line :"C:\Freescale\CW MCU v10.6\eclipse\..\MCU\bin\de.exe" -noni -language en -ORBendPoint giop:tcp:127.0.0.1: -ORBtraceLevel 0
      INF: CMD>RE
      INF: Initializing.
      INF: Cannot enter background mode. Check connections.
      ERR: Error Resetting device for programming.

      ----------------------------------------------------

      And it's right at the point where it says "INF: Initializing." where it asks for the password the second time.

      And to clarify Sateesh, my way of programming the shadow section is to have code that during runtime does this for me. Meaning, my algorithm for erasing and programming the appropriate addresses in the shadow section is embedded in the application code itself and not done through a flashing algorithm explicitly as in your case if I understood correct. Don't know if my way is the preffered way of doing it but it works for my usage cases at least.

  • Greetings,

    So MPC560xB is the only device that has this very weird behavior concerning censorship. After a number of attempts to uncensor the chip with a password, the chip just stops responding and you need to power cycle the chip. Freescale only implemented on this chip family and went away with future designs.

    Basically every time the chip is reset a password needs to be sent. Which means before flash programming and after flash programming. However there should not be any more resets afterwards.

    One thing you could try is within Debug Configurations is to not flash program every time. Within Debug Configurations, Go to the Debugger Tab -> Download. Here uncheck the "Perform standard download" and start a debug session. The debugger will not flash program and try to debug the code with whatever is already flashed on the chip. See if this at least gets you to the point of debugging instead of being stuck with passwords.


    Takao Yamada

    • Thank for your reply,

      As Jonas explained the two ways to "program the shadow section registers"
      a)To have the code running in application code
      OR
      b)Using the flashing program/algorithm explicitly.

      Through reference manual I understood how to censor the chip that we have to modify the registers. But It is not clear for me which way is a possible one (a) OR (b).

      Actually I was expecting something from the flashing tool (PE Micro) using an algorithm should be able to set a password and reprogram the shadow section.
      And if tried again for flashing or debug it should allow only after giving rite password.

      When I read(show module) the algorithm Freescale_MPC5605BK_1x32x4k_Shadow.PCP using the tool I could see the respective registers values
      FE ED FA CE CA FE BE EF 55 AA 55 AA 55 AA 55 AA.
      Could you let me know is it possible to change these registers and flash the shadow section using the flashing tool algorithm.

      • Greetings,

        Yes indeed it is possible to using the shadow algorithm to program the password. As you saw, the password is 64-bit (16 hex characters) and then another 64-bits for security configurations.

        Follow the rules for passwords (cannot be all zeros or all FF's). For the security/BAM boot mode configurations you need to check the table of what you wish to be protected. (If you do not see any tables, go talk with Freescale, they may give you more details about censorship. The information I have is for internal use only from Freescale).


        Takao Yamada

    • Okay, that's unfortunate if that is the case.

      I've actually managed to program new code in the meanwhile, one or two times using the Multilink Universal FX when I changed around in some settings (by activating and changing the “Delay after Reset and before communicating to target for” delay to 2000 ms from 0 ms). This only worked a few times and now it doesn't work anymore.

      What I can do is to use my Coclone Max, connected over USB to my computer, to program AND debug if I provide the password when prompted.

      In my eyes this indicates a issue with either the Multilink Universal FX or my settings of it.

      Summary:
      * Multilink Universal FX succeeded a few times after modifying timing parameter but stopped working
      * Cyclone Max succeed every time so far

      • Greetings,

        This is very interesting. Could you go to Support page -> Support requests and create a ticket about this. I will pick the ticket up and I would like to replicate this if possible. I may need an example project from you that does the security within the application instead of using the shadow algorithm.


        Takao Yamada

Add comment


   Want to comment? Please login or create a new PEMicro account.







© 2017 P&E Microcomputer Systems Inc.
Website Terms of Use and Sales Agreement