The MPC5XXX processors implement a censorship feature. When enabled, the JTAG debugger is locked out and debugging or tracing is impossible.
The debug implementation on the MPC5XXX does not allow detecting if a processor is censored or not. The indication of active censorship is that reading the JTAGID works, but any further accesses, fail. The debugger will report a Debug Port Fail error and the additional error description in the message AREA will look like follows:
JTAGID=0x______1D
Error: received invalid OSR (0x000)
is the device censored?
If the processor was censored on intention, it is possible to regain access using this command sequence:
SYStem.DETECT CPU
SYStem.Option.KEYCODE 0xFEEDFACECAFEBEEF
SYStem.Up
Note:
- If the password (keycode) is unknown or illegal (e.g. after accidentally erasing the shadow row), the processor is locked forever and can not be recovered, unless the application in flash provides a feature to unlock the processor (e.g. via CAN).
- Some processors require the upper and lower 32-bit parts to be exchanged for SYStem.Option.KEYCODE (e.g. 0xCAFEBEEFFEEDFACE instead of 0xFEEDFACECAFEBEEF)
Add a comment