MC9S08EL32 Datasheet, PDF (53/356 Pages) Freescale Semiconductor, Inc – 8-Bit HCS08 Central Processor Unit (CPU)

Chapter 4 Memory
4.5.7 Block Protection
The block protection feature prevents the protected region of FLASH or EEPROM from program or erase
changes. Block protection is controlled through the FLASH and EEPROM protection register (FPROT).
The EPS bits determine the protected region of EEPROM and the FPS bits determine the protected region
of FLASH. See Section 4.5.11.4, “FLASH and EEPROM Protection Register (FPROT and NVPROT)”.
After exit from reset, FPROT is loaded with the contents of the NVPROT location, which is in the
nonvolatile register block of the FLASH memory. FPROT cannot be changed directly from application
software so a runaway program cannot alter the block protection settings. Because NVPROT is within the
last sector of FLASH, if any amount of memory is protected, NVPROT is itself protected and cannot be
altered (intentionally or unintentionally) by the application software. FPROT can be written through
background debug commands, which provides a way to erase and reprogram protected FLASH memory.
One use for block protection is to block protect an area of FLASH memory for a bootloader program. This
bootloader program can call a routine outside of FLASH that can sector erase the rest of the FLASH
memory and reprogram it. The bootloader is protected even if MCU power is lost during an erase and
reprogram operation.
4.5.8 Vector Redirection
Whenever any FLASH is block protected, the reset and interrupt vectors will be protected. Vector
redirection allows users to modify interrupt vector information without unprotecting bootloader and reset
vector space. Vector redirection is enabled by programming the FNORED bit in the NVOPT register
located at address 0xFFBF to 0. For redirection to occur, at least some portion of the FLASH memory must
be block protected by programming the NVPROT register located at address 0xFFBD. All interrupt
vectors (memory locations 0xFFC0–0xFFFD) are redirected, though the reset vector (0xFFFE:0xFFFF) is
not.
For example, if 1024 bytes of FLASH are protected, the protected address region is from 0xFC00 through
0xFFFF. The interrupt vectors (0xFFC0–0xFFFD) are redirected to the locations 0xFBC0–0xFBFD. If
vector redirection is enabled and an interrupt occurs, the values in the locations 0xFBE0:0xFBE1 are used
for the vector instead of the values in the locations 0xFFE0:0xFFE1. This allows the user to reprogram the
unprotected portion of the FLASH with new program code including new interrupt vector values while
leaving the protected area, which includes the default vector locations, unchanged.
4.5.9 Security
The MC9S08EL32 Series and MC9S08SL16 Series includes circuitry to prevent unauthorized access to
the contents of FLASH, EEPROM, and RAM memory. When security is engaged, FLASH, EEPROM, and
RAM are considered secure resources. Direct-page registers, high-page registers, and the background
debug controller are considered unsecured resources. Programs executing within secure memory have
normal access to any MCU memory locations and resources. Attempts to access a secure memory location
with a program executing from an unsecured memory space or through the background debug interface
are blocked (writes are ignored and reads return all 0s).
Security is engaged or disengaged based on the state of two register bits (SEC[1:0]) in the FOPT register.
During reset, the contents of the nonvolatile location NVOPT are copied from FLASH into the working
MC9S08EL32 Series and MC9S08SL16 Series Data Sheet, Rev. 3
Freescale Semiconductor
53