| As of August 2020 the site you are on (wiki.newae.com) is deprecated, and content is now at rtfm.newae.com. |
Difference between revisions of "CW308T-MPC5748G"
From ChipWhisperer Wiki
| Line 19: | Line 19: | ||
* Various solder jumpers for variety of power analysis options. | * Various solder jumpers for variety of power analysis options. | ||
| − | Intended Usage | + | =Intended Usage= |
| − | + | == Demo Application == | |
| − | + | ||
| − | Demo Application | + | |
The demo application provides examples of: | The demo application provides examples of: | ||
| Line 34: | Line 32: | ||
== Offered Variants == | == Offered Variants == | ||
| − | The product is available in | + | The product is available in one variant: |
| − | * The "NORMAL" variant. This variant has the following setup: | + | * The "NORMAL" variant which is normally shipped (i.e., P/N NAE-CW308T-MPC5748G). This variant has the following setup: |
** HSM is not programmed. We cannot provide details on this usage without a NDA. | ** HSM is not programmed. We cannot provide details on this usage without a NDA. | ||
** The four OTP password groups have been programmed with 4 known passwords you can use for experimentation. | ** The four OTP password groups have been programmed with 4 known passwords you can use for experimentation. | ||
| − | ** Device lifecycle is progressed to the "OEM Production" stage. This will prevent you from doing certain updates to the memory, but for most "normal" uses will not prevent reloading of code etc. | + | ** Device lifecycle is progressed to the "OEM Production" stage. This will prevent you from doing certain updates to the memory, but for most "normal" uses will not prevent reloading of code etc. This progression is done since it is required to use the password/censorship features. |
| − | ** The demo application is loaded which includes ability to execute code loaded over the serial port (but is NOT a full bootloader). | + | ** The demo application is loaded which includes ability to execute code loaded over the serial port and change/read memory locations (but is NOT a full bootloader). |
** Device censorship is disabled (this can be turned on using an external programmer). | ** Device censorship is disabled (this can be turned on using an external programmer). | ||
| − | ** The JTAG port has a known password, but is not locked (this can be turned on using an external programmer). | + | ** The JTAG port has a known password, but is not locked (this can be turned on using an external programmer or via load functions). |
| + | == Programming == | ||
| − | + | The device is designed to use an external programmer for reflashing, as it does not include a bootloader. The suggested programmer (scripts are provided in the GIT repo) is the PE-Micro which requires purchasing: | |
| − | + | *PEMicro USB Multilink or USB Mulilink FX | |
| − | + | *PEMicro PROGPPCNEXUS (Programmer SW only) or PEMicro PowerPC Nexus Development Kit (includes Debugger). You may be able to use a GDB server instead but we haven't tested this. | |
| − | ** | + | |
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | You can use the MPC5748G-DEVKIT instead with invasive hardware mods - the devkit has an on-board programmer, but it uses buffers such it cannot be routed to any available header pins. You would need to solder small jumper wires to small SMD pins for this to work. However as the dev-kit is very cheap, it may be worthwhile to scrap one and convert into an external programmer. | |
== Random Useful Tips == | == Random Useful Tips == | ||
Revision as of 06:15, 14 March 2018
This requires a programmer for the MPC5748G to reload code.
| CW308T-MPC5748G | |
|---|---|
 | |
| Target Device | NXP MPC5748G |
| Target Architecture | PowerPC, Triple-Core |
| Hardware Crypto | Possible |
The MPC5748G target uses the NXP MPC5748G device, which is a triple-core PowerPC microcontroller for automotive applications. This target board has a number of interesting features including:
- Two CAN interfaces, with with DB9.
- Two serial ports (usable as LIN).
- Various solder jumpers for variety of power analysis options.
Contents
Intended Usage
Demo Application
The demo application provides examples of:
- Using serial interface (implements Simple-Serial).
- Using CAN interface.
- Enabling all three cores, and communicating between cores with shared memory.
- Running software AES on main core.
- Running password-check (XOR) on main core.
- Setup of clock network for using external clock from ChipWhisperer.
Offered Variants
The product is available in one variant:
- The "NORMAL" variant which is normally shipped (i.e., P/N NAE-CW308T-MPC5748G). This variant has the following setup:
- HSM is not programmed. We cannot provide details on this usage without a NDA.
- The four OTP password groups have been programmed with 4 known passwords you can use for experimentation.
- Device lifecycle is progressed to the "OEM Production" stage. This will prevent you from doing certain updates to the memory, but for most "normal" uses will not prevent reloading of code etc. This progression is done since it is required to use the password/censorship features.
- The demo application is loaded which includes ability to execute code loaded over the serial port and change/read memory locations (but is NOT a full bootloader).
- Device censorship is disabled (this can be turned on using an external programmer).
- The JTAG port has a known password, but is not locked (this can be turned on using an external programmer or via load functions).
Programming
The device is designed to use an external programmer for reflashing, as it does not include a bootloader. The suggested programmer (scripts are provided in the GIT repo) is the PE-Micro which requires purchasing:
- PEMicro USB Multilink or USB Mulilink FX
- PEMicro PROGPPCNEXUS (Programmer SW only) or PEMicro PowerPC Nexus Development Kit (includes Debugger). You may be able to use a GDB server instead but we haven't tested this.
You can use the MPC5748G-DEVKIT instead with invasive hardware mods - the devkit has an on-board programmer, but it uses buffers such it cannot be routed to any available header pins. You would need to solder small jumper wires to small SMD pins for this to work. However as the dev-kit is very cheap, it may be worthwhile to scrap one and convert into an external programmer.
Random Useful Tips
Disassembling Source
If you are having trouble debugging, it can be useful to read out a memory segment and dissassemble it. This is possible with the included S32DS tools. The following shows the required command line:
E:\nxp\S32DS_Power_v2017.R1\Cross_Tools\powerpc-eabivle-4_9\bin>powerpc-eabivle-objdump.exe -mpowerpc -Me200z4 -D -b srec -EB MPC5748G.s19 > MPC5748G.txt
