How to uncensor MPC5674F

[snehakalkhair]

Hi,

Can anyone please help me with the code to uncensor MPC5674F.

And also help me understand the process.

Regards,

Sneha.

[davidtosenovjan]

Here I have shared example code for MPC5674F.

https://community.nxp.com/servlet/JiveServlet/download/813028-1-386922/MPC5674F_Censorship.zip

The example consists of 2 parts and document describes how to access censored device via JTAG with using of PeMicro or Lauterbach debugger.

WARNING: Use censorship feature very carefully, because an inappropriate usage can lead in making the device useless!!! Thoroughly read all instructions before use!!!

If you accidentally erase shadow flash there is no chance to recover it (unless it had been though about before).

If your device is censored and you don’t have any pre-prepared recovery code located in the internal flash memory, there is no way how to unlock it and everything you can do is to order new sample, and re-solder it instead of the censored one.

Thus it is very simple to permanently lock-down the device, for instance if you erase

censorship control words (or the whole shadow flash), your device will be permanently locked out.

For instance if you write to address 0x00FF_FDE0 value 0xBABA (any value except

0x55AA) and to address 0x00FF_FDE2 value 0xBABA as well, you will have following (for various BOOTCFG configuration):

00: Internal - Censored - internal flash enabled, nexus disabled => internal flash not accesible from outside as nexus is disabled

01: Serial - Public Password - internal flash disabled, nexus enabled => internal flash not accesible as it is completely disabled, code can run only from SRAM (downloaded by eSCI or CAN before execution)

10/11: EBI - Flash not censored - internal flash disabled, nexus enabled => internal flash not accesible as it is completely disabled, code can run only form EBI

In any of the cases above internal flash code cannot be stolen as either nexus or internal flash is in disabled state.

[snehakalkhair]

Hi David,

Following is the sequence of the errors i get when i try to execute the flash erase program.

Can i try uncensoring it using the serial boot mode?

[NicolasH]

Hello,
Following the application note AN3787.pdf and the code example given by @davidtosenovjan , i have to tried to erase the shadow flash A and instantanly rewrite it on a MPC5674F.

The goal was testing a way to disable and re-enable the JTAG access.

However, the device seems to be locked, and JTAG access through IC5700 seems not possible anymore.

#define W32(addr, value) (*((volatile unsigned int *) (addr)) = (value))

#define SHADOW_ADDRESS 0x00FFFC00

#define CENSORSHIP_ADDR 0x00FFFDE0

#define SERIAL_BOOT1_ADDR 0x00FFFDD8

#define SERIAL_BOOT2_ADDR 0x00FFFDDC

#define SERIAL_PASSWORD1 0xFEEDFACE

#define SERIAL_PASSWORD2 0xCAFEBEEF

.....

    FLASH_A.LMLR.R = 0xA1A11111;

    FLASH_A.LMLR.R = 0x000303FF;

    FLASH_A.SLMLR.R = 0xC3C33333;

    FLASH_A.SLMLR.R = 0x000303FF;

//Erase

    FLASH_A.MCR.B.ERS = 1;

    W32(SHADOW_ADDRESS, 0xFFFFFFFF); //interlock write

    FLASH_A.MCR.B.EHV = 1;

    while (FLASH_A.MCR.B.DONE==0){};

    FLASH_A.MCR.B.EHV = 0; //clear EHV

    FLASH_A.MCR.B.ERS = 0; //clear ERS

    for(i=0x00FFC000;i<0x00FFFFFF; i=i+4)

    {

        if(*(unsigned int*)i != 0xFFFFFFFF)

            while(1){}; //shadow flash not erased!

    }

.....

//Rewrite

    FLASH_A.MCR.B.PGM = 1;

    W32(SERIAL_BOOT1_ADDR, SERIAL_PASSWORD1); //interlock write

    W32(SERIAL_BOOT2_ADDR, SERIAL_PASSWORD2); //interlock write

    FLASH_A.MCR.B.EHV = 1;

    while (FLASH_A.MCR.B.DONE==0) ;

    FLASH_A.MCR.B.EHV = 0; //clear EHV

    FLASH_A.MCR.B.PGM = 0; //clear PGM

    FLASH_A.MCR.B.PGM = 1;

    W32(CENSORSHIP_ADDR, 0x55aa55aa); //interlock write

    W32(CENSORSHIP_ADDR+4, 0xffffffff); //interlock write

    FLASH_A.MCR.B.EHV = 1;

    while (FLASH_A.MCR.B.DONE==0);

    FLASH_A.MCR.B.EHV = 0; //clear EHV

    FLASH_A.MCR.B.PGM = 0; //clear PGM

Do you have any clue about the reason?
Is there a way to recover from that situation and enable anew the JTAG access?

Regards,

Nicolas