S912XHZ512F1VAG Datasheet, PDF (327/978 Pages) Freescale Semiconductor, Inc – Covers MC9S12XHZ384, MC9S12XHZ256

Chapter 6 Security (S12X9SECV2)
• The KEYEN[1:0] bits within the Flash options/security byte select ‘enabled’.
• In single chip mode, the application program programmed into the microcontroller must be
designed to have the capability to write to the backdoor key locations.
The backdoor key values themselves would not normally be stored within the application data, which
means the application program would have to be designed to receive the backdoor key values from an
external source (e.g. through a serial port). It is not possible to download the backdoor keys using
background debug mode.
The backdoor key access method allows debugging of a secured microcontroller without having to erase
the Flash. This is particularly useful for failure analysis.
NOTE
No word of the backdoor key is allowed to have the value 0x0000 or
0xFFFF.
6.1.5.2 Backdoor Key Access Sequence
These are the necessary steps for a successful backdoor key access sequence:
1. Set the KEYACC bit in the Flash configuration register FCNFG.
2. Write the first 16-bit word of the backdoor key to 0xFF00 (0x7F_FF00).
3. Write the second 16-bit word of the backdoor key to 0xFF02 (0x7F_FF02).
4. Write the third 16-bit word of the backdoor key to 0xFF04 (0x7F_FF04).
5. Write the fourth 16-bit word of the backdoor key to 0xFF06 (0x7F_FF06).
6. Clear the KEYACC bit in the Flash Configuration register FCNFG.
NOTE
Flash cannot be read while KEYACC is set. Therefore the code for the
backdoor key access sequence must execute from RAM.
If all four 16-bit words match the Flash contents at 0xFF00–0xFF07 (0x7F_FF00–0x7F_FF07), the
microcontroller will be unsecured and the security bits SEC[1:0] in the Flash Security register FSEC will
be forced to the unsecured state (‘10’). The contents of the Flash options/security byte are not changed by
this procedure, and so the microcontroller will revert to the secure state after the next reset unless further
action is taken as detailed below.
If any of the four 16-bit words does not match the Flash contents at 0xFF00–0xFF07
(0x7F_FF00–0x7F_FF07), the microcontroller will remain secured.
6.1.6 Reprogramming the Security Bits
In normal single chip mode (NS), security can also be disabled by erasing and reprogramming the security
bits within Flash options/security byte to the unsecured value. Because the erase operation will erase the
entire sector from 0xFE00–0xFFFF (0x7F_FE00–0x7F_FFFF), the backdoor key and the interrupt vectors
will also be erased; this method is not recommended for normal single chip mode. The application
software can only erase and program the Flash options/security byte if the Flash sector containing the Flash
MC9S12XHZ512 Data Sheet, Rev. 1.06
Freescale Semiconductor
327