MPC5604B Censorship cannot be changed from SRAM

[MichaelSun]

I want to change the cencorship using the BAM mode. 

I write the code refer to "Example MPC5604B Censorship CW210". Because i can see the data out from uart port  ,  i managed to use "BAM code transfers execution to user code in SRAM". But when i check the shadow flash , nothing changed. Could you please tell me the reason ?

uint8_t i;
unsigned int *uartchange;
ME.RUNPC[0].R=0xFE;/*peripherals active in all RUN modes including DRUN mode*/
ME.MCTL.R =0x30005AF0;/*request to enter DRUN(0x3) mode with control key(0x5AF0)*/
ME.MCTL.R =0x3000A50F;/*request to enter DRUN(0x3) mode with control inverted key(0xA50F)*/
while(ME.GS.B.S_CURRENTMODE != 0x3); /*wait MCU totransmit to DRUN mode*/

SIU.PCR[LED1_GPIO_PAD].R = 0x203; /*enable output buffer with internal pull-up enable*/

SIU.PCR[LED2_GPIO_PAD].R = 0x203; /*enable output buffer with internal pull-up enable*/

SWT_DisableWatchDog();
SYSTEM_Init();
init_SIU();
LINFlex0_init();



/* Unlock SHADOW flash */
if(CFLASH.LML.B.TSLK) /* Check Test/Shadow flash lock status */
{
CFLASH.LML.R = 0xA1A11111; /* Password to unlock LML */
CFLASH.LML.B.TSLK = 0; /* Test/Shadow Lock Bit */
}
if(CFLASH.SLL.B.STSLK) /* Check Secondary Test/Shadow flash lock status */
{
CFLASH.SLL.R = 0xC3C33333; /* Password to unlock SLL */
CFLASH.SLL.B.STSLK = 0; /* Secondary Test/Shadow Lock Bit */
}

/* Erase SHADOW flash */
CFLASH.MCR.R = 0x00000004; /* Set ERS in MCR: Select Operation */
*((uint32_t*) 0x00200000) = 0xFFFFFFFF; /* Latch a CFlash Shadow Address with any data */
CFLASH.MCR.R = 0x00000005; /* Set EHV in MCR: Operation Start */
while(!CFLASH.MCR.B.DONE); /* Check DONE flag */
while(!CFLASH.MCR.B.PEG); /* Check PEG flag */
CFLASH.MCR.R = 0x00000004; /* Reset EHV in MCR: Operation End */
CFLASH.MCR.R = 0x00000000; /* Reset ERS in MCR: Deselect Operation */

/* Program SHADOW flash */
CFLASH.MCR.R = 0x00000010; /* Set PGM in MCR: Select Operation */
*((uint32_t*) 0x203DD8) = 0xFEEDFACE; /* Latch Address and 32 MSB data */
*((uint32_t*) 0x203DDC) = 0xCAFEBEEF; /* Latch Address and 32 LSB data */
CFLASH.MCR.R = 0x00000011; /* Set EHV in MCR: Operation Start */
while(!CFLASH.MCR.B.DONE); /* Check DONE flag */
while(!CFLASH.MCR.B.PEG); /* Check PEG flag */
CFLASH.MCR.R = 0x00000010; /* Reset EHV in MCR: Operation End */
CFLASH.MCR.R = 0x00000000; /* Reset PGM in MCR: Deselect Operation */

/* Program SHADOW flash */
CFLASH.MCR.R = 0x00000010; /* Set PGM in MCR: Select Operation */
*((uint32_t*) 0x203DE0) = 0x55AA55AA; /* Latch Address and 32 MSB data */
*((uint32_t*) 0x203DE4) = 0x55AA55AA; /* Latch Address and 32 LSB data */
CFLASH.MCR.R = 0x00000011; /* Set EHV in MCR: Operation Start */
while(!CFLASH.MCR.B.DONE); /* Check DONE flag */
while(!CFLASH.MCR.B.PEG); /* Check PEG flag */
CFLASH.MCR.R = 0x00000010; /* Reset EHV in MCR: Operation End */
CFLASH.MCR.R = 0x00000000; /* Reset PGM in MCR: Deselect Operation */

/* Lock SHADOW flash */
CFLASH.LML.B.TSLK = 1; /* Test/Shadow Lock Bit */
CFLASH.SLL.B.STSLK = 1; /* Secondary Test/Shadow Lock Bit */


while(1)
UART0_TX(2);

[davidtosenovjan]

I am not sure if I understand your question.

"BAM code transfers execution to user code in SRAM" means that the whole serial boot sequence happens successfully including entering of valid password (with reverse order). Then MCU is temporarily uncensored what's allow to execute code sequence loaded to SRAM over serial port. This sequence can re-program shadow flash content in order to disable censorship.

We don't have example code for this operation, I have only tested enabling debug over JTAG.

Regarding serial boot, I could recommend to see following discussion:

https://www.nxp.com/docs/en/application-note/AN4674.pdf