Shadow flash erase

[Pontus Hedman]

Posted on October 05, 2017 at 16:00

I need to programatically implement censorship on a SPC560B60x.  So this would involve unlocking and erasing the shadow sector and immediately writing new values for NVPWDx/NVSCCx.

Unlocking involves LML[TSLK]/SLL[STSLK] but erasing is unclear. According to 30.6.3 Sector erase:

1. Change the value in the MCR[ERS] bit from 0 to 1.

2. Select the block(s) to be erased by writing �1�s to the appropriate bit(s) in the LMS register. If the shadow sector is to be erased, this step may be skipped, and LMS is ignored. Note that Lock and Select are independent. If a block is selected and locked, no erase will occur.3. Write to any address in flash memory. This is referred to as an erase interlock write.

...

Since LMS is not relevant in step 2, how do I indicate that it's the shadow sector I want erased?

#flash #shadow

[Erwan YVIN · Accepted solution]

Posted on October 06, 2017 at 09:38

Hello Pontus ,

Please Read carefully , the chapter 6.1.3

Bad programmation of NVSCC0/1 could lock your device

There aresome examples to enable the censorship

the code should be launched in RAM Side

/* Following sequence gets the device to Censored state */
 /* Subsequent access via JTAG password 0xCAFEBEEFFEEDFACE */
 /* Unlock SHADOW flash */
 if(CFLASH.LML.B.TSLK) /* Check Test/Shadow flash lock status */ 
 {
 CFLASH.LML.R = 0xA1A11111; /* Password to unlock LML */
 CFLASH.LML.B.TSLK = 0; /* Test/Shadow Lock Bit */
 }
 if(CFLASH.SLL.B.STSLK) /* Check Secondary Test/Shadow flash lock status */ 
 {
 CFLASH.SLL.R = 0xC3C33333; /* Password to unlock SLL */
 CFLASH.SLL.B.STSLK = 0; /* Secondary Test/Shadow Lock Bit */
 }
 /* Erase SHADOW flash */
 CFLASH.MCR.R = 0x00000004; /* Set ERS in MCR: Select Operation */
 *((uint32_t*) 0x00200000) = 0xFFFFFFFF; /* Latch a CFlash Shadow Address with any data */
 CFLASH.MCR.R = 0x00000005; /* Set EHV in MCR: Operation Start */
 while(!CFLASH.MCR.B.DONE); /* Check DONE flag */
 while(!CFLASH.MCR.B.PEG); /* Check PEG flag */
 CFLASH.MCR.R = 0x00000004; /* Reset EHV in MCR: Operation End */
 CFLASH.MCR.R = 0x00000000; /* Reset ERS in MCR: Deselect Operation */
 
 /* Program SHADOW flash */
 CFLASH.MCR.R = 0x00000010; /* Set PGM in MCR: Select Operation */
 *((uint32_t*) 0x203DD8) = 0xFEEDFACE; /* Latch Address and 32 MSB data */
 *((uint32_t*) 0x203DDC) = 0xCAFEBEEF; /* Latch Address and 32 LSB data */
 CFLASH.MCR.R = 0x00000011; /* Set EHV in MCR: Operation Start */
 while(!CFLASH.MCR.B.DONE); /* Check DONE flag */
 while(!CFLASH.MCR.B.PEG); /* Check PEG flag */
 CFLASH.MCR.R = 0x00000010; /* Reset EHV in MCR: Operation End */
 CFLASH.MCR.R = 0x00000000; /* Reset PGM in MCR: Deselect Operation */
 /* Program SHADOW flash */
 CFLASH.MCR.R = 0x00000010; /* Set PGM in MCR: Select Operation */
 *((uint32_t*) 0x203DE0) = 0x55AABABA; /* Latch Address and 32 MSB data */
 *((uint32_t*) 0x203DE4) = 0x55AABABA; /* Latch Address and 32 LSB data */
 CFLASH.MCR.R = 0x00000011; /* Set EHV in MCR: Operation Start */
 while(!CFLASH.MCR.B.DONE); /* Check DONE flag */
 while(!CFLASH.MCR.B.PEG); /* Check PEG flag */
 CFLASH.MCR.R = 0x00000010; /* Reset EHV in MCR: Operation End */
 CFLASH.MCR.R = 0x00000000; /* Reset PGM in MCR: Deselect Operation */
 /* Lock SHADOW flash */
 CFLASH.LML.B.TSLK = 1; /* Test/Shadow Lock Bit */
 CFLASH.SLL.B.STSLK = 1; /* Secondary Test/Shadow Lock Bit */
�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?

This one is to disable the censorship (to be launched in RAM)

 /* Following sequence gets the device to Uncensored state */
 /* Subsequent access is without password */
 /* Unlock SHADOW flash */
 if(CFLASH.LML.B.TSLK) /* Check Test/Shadow flash lock status */ 
 {
 CFLASH.LML.R = 0xA1A11111; /* Password to unlock LML */
 CFLASH.LML.B.TSLK = 0; /* Test/Shadow Lock Bit */
 }
 if(CFLASH.SLL.B.STSLK) /* Check Secondary Test/Shadow flash lock status */ 
 {
 CFLASH.SLL.R = 0xC3C33333; /* Password to unlock SLL */
 CFLASH.SLL.B.STSLK = 0; /* Secondary Test/Shadow Lock Bit */
 }
 /* Erase SHADOW flash */
 CFLASH.MCR.R = 0x00000004; /* Set ERS in MCR: Select Operation */
 *((uint32_t*) 0x00200000) = 0xFFFFFFFF; /* Latch a CFlash Shadow Address with any data */
 CFLASH.MCR.R = 0x00000005; /* Set EHV in MCR: Operation Start */
 while(!CFLASH.MCR.B.DONE); /* Check DONE flag */
 while(!CFLASH.MCR.B.PEG); /* Check PEG flag */
 CFLASH.MCR.R = 0x00000004; /* Reset EHV in MCR: Operation End */
 CFLASH.MCR.R = 0x00000000; /* Reset ERS in MCR: Deselect Operation */
 
 /* Program SHADOW flash */
 CFLASH.MCR.R = 0x00000010; /* Set PGM in MCR: Select Operation */
 *((uint32_t*) 0x203DD8) = 0xFEEDFACE; /* Latch Address and 32 MSB data */
 *((uint32_t*) 0x203DDC) = 0xCAFEBEEF; /* Latch Address and 32 LSB data */
 CFLASH.MCR.R = 0x00000011; /* Set EHV in MCR: Operation Start */
 while(!CFLASH.MCR.B.DONE); /* Check DONE flag */
 while(!CFLASH.MCR.B.PEG); /* Check PEG flag */
 CFLASH.MCR.R = 0x00000010; /* Reset EHV in MCR: Operation End */
 CFLASH.MCR.R = 0x00000000; /* Reset PGM in MCR: Deselect Operation */
 /* Program SHADOW flash */
 CFLASH.MCR.R = 0x00000010; /* Set PGM in MCR: Select Operation */
 *((uint32_t*) 0x203DE0) = 0x55AA55AA; /* Latch Address and 32 MSB data */
 *((uint32_t*) 0x203DE4) = 0x55AA55AA; /* Latch Address and 32 LSB data */
 CFLASH.MCR.R = 0x00000011; /* Set EHV in MCR: Operation Start */
 while(!CFLASH.MCR.B.DONE); /* Check DONE flag */
 while(!CFLASH.MCR.B.PEG); /* Check PEG flag */
 CFLASH.MCR.R = 0x00000010; /* Reset EHV in MCR: Operation End */
 CFLASH.MCR.R = 0x00000000; /* Reset PGM in MCR: Deselect Operation */
 /* Lock SHADOW flash */
 CFLASH.LML.B.TSLK = 1; /* Test/Shadow Lock Bit */
 CFLASH.SLL.B.STSLK = 1; /* Secondary Test/Shadow Lock Bit */
�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?�?

Best Regards

Erwan

[Pontus Hedman]

Posted on October 06, 2017 at 20:01

Thank you Erwan -- that's perfect!!

What was causing me doubt was this line in the documentation:

 3. Write to any address in flash memory. This is referred to as an erase interlock write.

The 'any address' part is incorrect -- it must be an address in the sector you want to erase, as in your code.

Pontus

[SIBIN THOMAS]

Posted on February 08, 2018 at 13:48

Hi,

I have tried the above code on my SPC560C50L3. I copied the censorship enable code to SPC560BCxx_RLA Flash Test Application which runs from RAM commenting the Flash test code in the example and loaded to my MCU. After loading the code using DEBUG option in UDE STK 4.8 and after power on reset, I am not able to update my code on the MCU. When trying to load, JTAG is not connecting to the target with error 'Processor is in UNKNOWN state !'. I am using the default password and tried Censorship unlocking by 0xCAFEBEEF,0xFEEDFACE also. I need help to unlock my MCU.

Thanks and Regards

Thomas