MC9S12KG128 Datasheet, PDF (114/600 Pages) Freescale Semiconductor, Inc – Microcontrollers

Chapter 2 128 Kbyte ECC Flash Module (FTS128K1ECCV1)
In the unsecure state, the user has full control of the contents of the backdoor keys by programming
addresses 0xFF00–0xFF07 in the Flash configuration field.
The security as defined in the Flash security byte (0xFF0F) is not changed by using the backdoor key
access sequence to unsecure. The backdoor keys stored in addresses 0xFF00–0xFF07 are unaffected by
the backdoor key access sequence. After the next reset of the MCU, the security state of the Flash module
is determined by the Flash security byte (0xFF0F). The backdoor key access sequence has no effect on the
program and erase protections defined in the Flash protection register.
It is not possible to unsecure the MCU in special single-chip mode by using the backdoor key access
sequence via the background debug mode (BDM).
2.6.2 Unsecuring the Flash Module in Special Single-Chip Mode using
BDM
The MCU can be unsecured in special single-chip mode by erasing the Flash module by the following
method :
• Reset the MCU into special single-chip mode, delay while the erase test is performed by the BDM
secure ROM, send BDM commands to disable protection in the Flash module, and execute a mass
erase command write sequence to erase the Flash memory.
After the CCIF flag sets to indicate that the mass operation has completed, reset the MCU into special
single-chip mode. The BDM secure ROM will verify that the Flash memory is erased and will assert the
UNSEC bit in the BDM status register. This BDM action will cause the MCU to override the Flash security
state and the MCU will be unsecured. All BDM commands will be enabled and the Flash security byte
may be programmed to the unsecure state by the following method:
• Send BDM commands to execute a word program sequence to program the Flash security byte to
the unsecured state and reset the MCU.
2.7 Resets
2.7.1 Flash Reset Sequence
On each reset, the Flash module executes a reset sequence to hold CPU activity while loading the following
registers from the Flash memory according to Table 2-1:
• FPROT — Flash Protection Register (see Section 2.3.2.5).
If a double bit fault is detected during the read of the protection field as part of the reset sequence,
the FPOPEN bit in the FPROT register will be clear and remaining bits will be set leaving the Flash
block fully protected from program and erase.
• FSEC — Flash Security Register (see Section 2.3.2.2).
If a double bit fault is detected during the read of the security field as part of the reset sequence, all
bits in the FSEC register will be set leaving the Flash module in a secure state with Backdoor Key
Access disabled.
MC9S12KG128 Data Sheet, Rev. 1.15
114
Freescale Semiconductor