Hello,
we have decided to protect our SPC572L based system via JTAG password protection, therefore we programmed the following data into flash:
The 256 bit /8*32 bit JTAG password:
00400120 11 12 13 14 21 22 23 24 31 32 33 34 41 42 43 44
00400130 51 52 53 54 61 62 63 64 71 72 73 74 81 82 83 84
The lifecycle (to "in field"):
00400200 55 aa 50 af 55 aa 50 af 55 aa 50 af 55 aa 50 af
00400210 55 aa 50 af 55 aa 50 af 55 aa 50 af 55 aa 50 af
00400220 55 aa 50 af 55 aa 50 af 55 aa 50 af 55 aa 50 af
00400230 55 aa 50 af 55 aa 50 af ff ff ff ff ff ff ff ff
And the DCF records to set up the PASS module:
00400300 05 aa 55 af 00 00 00 00 00 00 00 00 00 10 01 00
00400310 00 00 00 00 00 10 01 04 00 00 00 00 00 10 01 08
00400320 40 00 00 00 00 10 01 0c 00 00 00 00 00 10 01 10
...
After a powercycle the chip is properly locked. But unfortunately I can't reopen it via JTAG (using the JTAG_PASSWORD register), neither with a Lauterbach Trace32 nor with a special JTAG toll we use.
The (simplified) Tarce32 Script to try the unlock is as follows:
system.cpu spc572l64
system.option.keycode 0x11121314 0x21222324 0x31323334 0x41424344 0x51525354 0x61626364 0x71727374
system.up
Now my big questions:
- Any hint on how to make Trace32 to unlock the flash?
- Is there something to observe regarding the bit/byte/word/XXX order for the "system.option.keycode" command when passing the unlock values to it?
- And, looking on the low level JTAG transfers: Any information regarding the proper order to shift the JTAG_PASSWORD into its JTAG_PASSWORD register?
