MSS60 Research

[MpowerE36]

terra I remember terra saying something about using the mss65 shadow region hoping they were the same?

If I understand correctly he used the injector shadow region of a MSS65 and flash it in the injector shadow region of his MSS60. Unfortunately I don't have a MSS65, so I will read the shadow region of the ignition processor of my MSS60 in order to flash it in the injector one. I hope it will work

[hobbit382]

terra I remember terra saying something about using the mss65 shadow region hoping they were the same?

[MpowerE36]

I've finally succeeded to write 41 FF 00 FF in the 0x2FC800 register. So my injector processor is bdm unlocked. I've succeeded to flash my backup in the 2 processors and 2 external eeproms but my ecu doesn't respond by obd. I will verify the flash with a bdm read but it is strange that both mpc don't respond by obd. Indeed before debugging my injector mpc, my ignition mpc responds by obd (with ram_lesen function for example)

I think it could come from the shadow region of my injector mpc. I think I have to flash it back after the clearing and setting censor manipulations. I hope it is the same as the ignition shadow region...

[MpowerE36]

what tool did you use?

I am using PEmicro's device but I don't think it is a tool problem.

terra Do you remember if you modified some registers before doing the setting censor process ? Maybe we have to disable external interruption with the spr 81 register before ?

It is like the current value store in the censor NVM CAM cell (0x00) is constantly reloaded in censor bits. So my 0x01 value is immediately overwritten before I succeed to finalize the program sequence.

[hobbit382]

I've succeeded to clear the censor bits of my injection processor. I have now 40 FF 00 FF instead of 43 FF 00 FF in the 2FC800 register but I don't succeed to set the first byte to 41. However I set before the 2FC808 register to 58 00 00 42 but then, when I try to change the first byte of the 2FC800 register from 40 to 41, the value stay at 40. It is like I am not allowed to set the censor bits and I don't understand why.

what tool did you use?

[MpowerE36]

I've succeeded to clear the censor bits of my injection processor. I have now 40 FF 00 FF instead of 43 FF 00 FF in the 2FC800 register but I don't succeed to set the first byte to 41. However I set before the 2FC808 register to 58 00 00 42 but then, when I try to change the first byte of the 2FC800 register from 40 to 41, the value stay at 40. It is like I am not allowed to set the censor bits and I don't understand why.

[MpowerE36]

You can send debug commands with ICDPPCZ

But yeah, I'm overall pretty annoyed with Freescale and PEMicro. There's a reason all the manufacturers switched to tricore CPUs. All the debugging features functionality can be accessed with simple TTL and JTAG interfaces.

Did you already use ICDPPCZ ? Do you know if it works fine ?

[terra]

You can send debug commands with ICDPPCZ

But yeah, I'm overall pretty annoyed with Freescale and PEMicro. There's a reason all the manufacturers switched to tricore CPUs. All the debugging features functionality can be accessed with simple TTL and JTAG interfaces.

[MpowerE36]

I have an old Cyclone Max which does support the MPC5xx/8xx, but of the devices they sell currently, it needs to be either the Multilink FX or the Cyclone FX. They're dropping support for the old devices too (even now when you buy the debugger, you have to email them for a version that supports the "legacy" licensing, so I don't recommend looking for a used older device)

I tried with my old USB PowerPC BDM Multilink which is for mpc5xx and mpc8xx and the PROGPPCZ software but I have the same problem you had in the past : the CC UC3F censor function seems to work to clear censor bits but not to set them to 01.

I am very disappointed about this software because it seems it is not possible to send read and write commands directly to the shadow registers, as it is possible in the OCD commander software.

[terra]

Will you use your PEMicro's debugging software with the Multilink Universal FX ? Do you think the Multilink Universal would be good enough ?

Edit : hum MPC5xx/MPC8xx seem to be FX only

I have an old Cyclone Max which does support the MPC5xx/8xx, but of the devices they sell currently, it needs to be either the Multilink FX or the Cyclone FX. They're dropping support for the old devices too (even now when you buy the debugger, you have to email them for a version that supports the "legacy" licensing, so I don't recommend looking for a used older device)

[MpowerE36]

The censor can be set without erasing the contents of the flash memory, but it cannot be cleared without erasing the flash memory. In theory it might be possible to write a program that runs in RAM and then restores the flash, but that's beyond my skillset.

In other news, I ended up just spending the money to buy PEMicro's debugging software. Syntax is a little different than macraigor's, but overall has the same capabilities (really more). Once I verify I have the right sequence of commands down pat, I'll post them here.

Will you use your PEMicro's debugging software with the Multilink Universal FX ? Do you think the Multilink Universal would be good enough ?

Edit : hum MPC5xx/MPC8xx seem to be FX only

[MpowerE36]

read the text below the table. Access can only be set while the professor is uncensored mode. It can only be cleared in censored mode.

Yes I've just seen that

[terra]

Would it not be easiest to directly set the ACCESS bit (status byte 47 for the injection processor) ? It is the same result as a status byte 41 or 42 whatever are the FIC and CENSOR bits : “No censorship, UC3F array accesses allowed”. Would it be possible to set it without erasing the contents of the flash memory ?

read the text below the table. Access can only be set while the professor is uncensored mode. It can only be cleared in censored mode.

[MpowerE36]

The censor can be set without erasing the contents of the flash memory, but it cannot be cleared without erasing the flash memory. In theory it might be possible to write a program that runs in RAM and then restores the flash, but that's beyond my skillset.

In other news, I ended up just spending the money to buy PEMicro's debugging software. Syntax is a little different than macraigor's, but overall has the same capabilities (really more). Once I verify I have the right sequence of commands down pat, I'll post them here.

Would it not be easiest to directly set the ACCESS bit (status byte 47 for the injection processor) ? It is the same result as a status byte 41 or 42 whatever are the FIC and CENSOR bits : “No censorship, UC3F array accesses allowed”. Would it be possible to set it without erasing the contents of the flash memory ?

[terra]

Could we not flash with bdm once the censor is cleared?

Well clearing the censor sets the status byte to 40. It needs to be then set to 41 or 42 to be uncensored. I’ve also found that the internal flash disables itself when resetting the censor and that you have to set the special registers to reenable it.

I don’t think it’s impossible to do all that with a program running in ram. But at that point it’d make sense to have the program restore a backup.