MPC5748G UTEST cannot be rewrite after enable read protection

[Frank_Jianpeng_Zhao]

Hi, NXP,

After I have made the reading protection of UTEST, I encountered the following problems:

1. The chip is in reset state, after the restart (whether or not JTAG is connected).

2. I can view the data form UTEST by using the lauderbach after enter the Password of  JTAG and select the function of        'Halt core at power-on reset', but I cannot write new data( Unlock utest flash read protection) to UTEST flash.

UTEST flash DCF records:

issue:

1. Why I didn`t set the LOCK3[DBL] bit, but I had to enter the password of JTAG to halt the chip when enabled the UTEST Flash for read?

2. Why cannot rewrite the data on UTEST? 

Below is PASS register status：(All flash blocks are readable and writable)

Best Regards,

Frank

[v_wujie02]

Hi，Frank，

I have the same problem. Do you have a solution?

Thanks.

[Frank_Jianpeng_Zhao]

Hi, Jie,

I have submitted this problem to the relevant team, and they have already recreated the problem. Waiting for their reply.

BTW, can you tell me the HSM Firmware version you used?  and If you are just enabled the code flash read protection feature I can tell you how to recover the chip.

Best Regards,

Frank

[Frank_Jianpeng_Zhao]

Hi，

This question is closed.

Thanks.

[petervlna]

Hi,

1. The chip is in reset state, after the restart (whether or not JTAG is connected).

2. I can view the data form UTEST by using the lauderbach after enter the Password of  JTAG and select the function of        'Halt core at power-on reset', but I cannot write new data( Unlock utest flash read protection) to UTEST flash.

This looks like reset escalation based on unhandled SWT. Check the reset line if it is toggling after Power on reset to be sure. 15 resets, then permanent reset by default.

I am quite confused of what you have done from the description.

So you have programmed PASS module Rread lock from some area and also the JTAG censorship? Or?

regards,
Peter

[Frank_Jianpeng_Zhao]

Hi, Peter,

Yes, I have configured the PASS module Read lock and enabled JTAG censorship by programming the PASS DCF records.

Below is my configuration setps for PASS module to enable flash read protection:

1.Program JTAG Password and PASS Group0-3 Passwords.

2.Program PASS DCF records to set PASS Group 0-3 lock status ( In order to prevent permanent and irreversible locking of Flash blocks, setting for all lock bits is ‘0’.)

3.Program Censorship DCF records(if Censorship DCF client (data) != 0x55AA then MCU is in ‘censored’ mode

)

4.Advance Life Cycle from Customer Delivery to OEM Production

5. Program utest read protection

After rebooting, the chip died.

By the way, I didn`t have this problem when I tested code flash read protection. 

Best Regards,

Frank

[petervlna]

Ahh,

You enabled censorship and advanced life cycle but did not program JTAG password.

The chip is dead indeed.

Now you have locked micro with unknown password.

Make sure to program also JTAG password.

regards,

Peter

[Frank_Jianpeng_Zhao]

Hi Peter,

JTAG password is already written to UTEST fixed flash

1.Program JTAG Password and PASS Group0-3 Passwords.

 JTAG PASSWORD

---------------------------------------------------------------------------

Regards,

Frank

[petervlna]

After rebooting, the chip died.

What should I imagine under this explanation. It is in permanent reset? Or it is censored? Or?

Because if you enter JTAG password via debugger the PASS lock mechanism is overridden and the device become unlocked for reads.

Until you enter correct JTAG password device will run its internal SW, but will behave like there is no JTAG module to external world.

regards,

Peter