MC9S08QD4 Datasheet, PDF (46/202 Pages) Freescale Semiconductor, Inc – Microcontrollers

Chapter 4 Memory Map and Register Definition
is no way to disengage security without completely erasing all flash locations. If KEYEN is 1, a secure
user program can temporarily disengage security by:
1. Writing 1 to KEYACC in the FCNFG register. This makes the flash module interpret writes to the
backdoor comparison key locations (NVBACKKEY through NVBACKKEY+7) as values to be
compared against the key rather than as the first step in a flash program or erase command.
2. Writing the user-entered key values to the NVBACKKEY through NVBACKKEY+7 locations.
These writes must be performed in order starting with the value for NVBACKKEY and ending
with NVBACKKEY+7. STHX must not be used for these writes because these writes cannot be
performed on adjacent bus cycles. User software normally would get the key codes from outside
the MCU system through a communication interface such as a serial I/O.
3. Writing 0 to KEYACC in the FCNFG register. If the 8-byte key that was written matches the key
stored in the flash locations, SEC01:SEC00 are automatically changed to 1:0 and security will be
disengaged until the next reset.
The security key can be written only from secure memory (either RAM or flash), so it cannot be entered
through background commands without the cooperation of a secure user program.
The backdoor comparison key (NVBACKKEY through NVBACKKEY+7) is located in flash memory
locations in the nonvolatile register space so users can program these locations exactly as they would
program any other flash memory location. The nonvolatile registers are in the same 512-byte block of flash
as the reset and interrupt vectors, so block protecting that space also block protects the backdoor
comparison key. Block protects cannot be changed from user application programs, so if the vector space
is block protected, the backdoor security key mechanism cannot permanently change the block protect,
security settings, or the backdoor key.
Security can always be disengaged through the background debug interface by taking these steps:
1. Disable any block protections by writing FPROT. FPROT can be written only with background
debug commands, not from application software.
2. Mass erase flash if necessary.
3. Blank check flash. Provided flash is completely erased, security is disengaged until the next reset.
To avoid returning to secure mode after the next reset, program NVOPT so SEC01:SEC00 = 1:0.
4.7 Flash Registers and Control Bits
The flash module has nine 8-bit registers in the high-page register space, two locations (NVOPT,
NVPROT) in the nonvolatile register space in flash memory are copied into corresponding high-page
control registers (FOPT, FPROT) at reset. There is also an 8-byte comparison key in flash memory. Refer
to Table 4-3 and Table 4-4 for the absolute address assignments for all flash registers. This section refers
to registers and control bits only by their names. A Freescale Semiconductor-provided equate or header
file normally is used to translate these names into the appropriate absolute addresses.
4.7.1 Flash Clock Divider Register (FCDIV)
Before any erase or programming operations are possible, write to this register to set the frequency of the
clock for the nonvolatile memory system within acceptable limits.
MC9S08QD4 Series MCU Data Sheet, Rev. 3
46
Freescale Semiconductor