MSS60 Research

[hobbit382]

I've succeeded to clear the censor bits of my injection processor. I have now 40 FF 00 FF instead of 43 FF 00 FF in the 2FC800 register but I don't succeed to set the first byte to 41. However I set before the 2FC808 register to 58 00 00 42 but then, when I try to change the first byte of the 2FC800 register from 40 to 41, the value stay at 40. It is like I am not allowed to set the censor bits and I don't understand why.

what tool did you use?

[MpowerE36]

I've succeeded to clear the censor bits of my injection processor. I have now 40 FF 00 FF instead of 43 FF 00 FF in the 2FC800 register but I don't succeed to set the first byte to 41. However I set before the 2FC808 register to 58 00 00 42 but then, when I try to change the first byte of the 2FC800 register from 40 to 41, the value stay at 40. It is like I am not allowed to set the censor bits and I don't understand why.

[MpowerE36]

You can send debug commands with ICDPPCZ

But yeah, I'm overall pretty annoyed with Freescale and PEMicro. There's a reason all the manufacturers switched to tricore CPUs. All the debugging features functionality can be accessed with simple TTL and JTAG interfaces.

Did you already use ICDPPCZ ? Do you know if it works fine ?

[terra]

You can send debug commands with ICDPPCZ

But yeah, I'm overall pretty annoyed with Freescale and PEMicro. There's a reason all the manufacturers switched to tricore CPUs. All the debugging features functionality can be accessed with simple TTL and JTAG interfaces.

[MpowerE36]

I have an old Cyclone Max which does support the MPC5xx/8xx, but of the devices they sell currently, it needs to be either the Multilink FX or the Cyclone FX. They're dropping support for the old devices too (even now when you buy the debugger, you have to email them for a version that supports the "legacy" licensing, so I don't recommend looking for a used older device)

I tried with my old USB PowerPC BDM Multilink which is for mpc5xx and mpc8xx and the PROGPPCZ software but I have the same problem you had in the past : the CC UC3F censor function seems to work to clear censor bits but not to set them to 01.

I am very disappointed about this software because it seems it is not possible to send read and write commands directly to the shadow registers, as it is possible in the OCD commander software.

[terra]

Will you use your PEMicro's debugging software with the Multilink Universal FX ? Do you think the Multilink Universal would be good enough ?

Edit : hum MPC5xx/MPC8xx seem to be FX only

I have an old Cyclone Max which does support the MPC5xx/8xx, but of the devices they sell currently, it needs to be either the Multilink FX or the Cyclone FX. They're dropping support for the old devices too (even now when you buy the debugger, you have to email them for a version that supports the "legacy" licensing, so I don't recommend looking for a used older device)

[MpowerE36]

The censor can be set without erasing the contents of the flash memory, but it cannot be cleared without erasing the flash memory. In theory it might be possible to write a program that runs in RAM and then restores the flash, but that's beyond my skillset.

In other news, I ended up just spending the money to buy PEMicro's debugging software. Syntax is a little different than macraigor's, but overall has the same capabilities (really more). Once I verify I have the right sequence of commands down pat, I'll post them here.

Will you use your PEMicro's debugging software with the Multilink Universal FX ? Do you think the Multilink Universal would be good enough ?

Edit : hum MPC5xx/MPC8xx seem to be FX only

[MpowerE36]

read the text below the table. Access can only be set while the professor is uncensored mode. It can only be cleared in censored mode.

Yes I've just seen that

[terra]

Would it not be easiest to directly set the ACCESS bit (status byte 47 for the injection processor) ? It is the same result as a status byte 41 or 42 whatever are the FIC and CENSOR bits : “No censorship, UC3F array accesses allowed”. Would it be possible to set it without erasing the contents of the flash memory ?

read the text below the table. Access can only be set while the professor is uncensored mode. It can only be cleared in censored mode.

[MpowerE36]

The censor can be set without erasing the contents of the flash memory, but it cannot be cleared without erasing the flash memory. In theory it might be possible to write a program that runs in RAM and then restores the flash, but that's beyond my skillset.

In other news, I ended up just spending the money to buy PEMicro's debugging software. Syntax is a little different than macraigor's, but overall has the same capabilities (really more). Once I verify I have the right sequence of commands down pat, I'll post them here.

Would it not be easiest to directly set the ACCESS bit (status byte 47 for the injection processor) ? It is the same result as a status byte 41 or 42 whatever are the FIC and CENSOR bits : “No censorship, UC3F array accesses allowed”. Would it be possible to set it without erasing the contents of the flash memory ?

[terra]

Could we not flash with bdm once the censor is cleared?

Well clearing the censor sets the status byte to 40. It needs to be then set to 41 or 42 to be uncensored. I’ve also found that the internal flash disables itself when resetting the censor and that you have to set the special registers to reenable it.

I don’t think it’s impossible to do all that with a program running in ram. But at that point it’d make sense to have the program restore a backup.

[hobbit382]

The censor can be set without erasing the contents of the flash memory, but it cannot be cleared without erasing the flash memory. In theory it might be possible to write a program that runs in RAM and then restores the flash, but that's beyond my skillset.

In other news, I ended up just spending the money to buy PEMicro's debugging software. Syntax is a little different than macraigor's, but overall has the same capabilities (really more). Once I verify I have the right sequence of commands down pat, I'll post them here.

Could we not flash with bdm once the censor is cleared?

[terra]

The censor can be set without erasing the contents of the flash memory, but it cannot be cleared without erasing the flash memory. In theory it might be possible to write a program that runs in RAM and then restores the flash, but that's beyond my skillset.

In other news, I ended up just spending the money to buy PEMicro's debugging software. Syntax is a little different than macraigor's, but overall has the same capabilities (really more). Once I verify I have the right sequence of commands down pat, I'll post them here.

[MpowerE36]

The lock of the CPU seems to be in the 47594C subroutine. Indeed, the content of the 2FC800 address is ORed with (0x0300||0x0000). In binary, it is : 00000011 00000000 00000000 00000000

[MpowerE36]

In subroutines 475334 and 47549C, three addresses are used : 2FC00E, 2FC800 and 2FC808.