AN2153 Freescale Semiconductor / Motorola, AN2153 Datasheet - Page 9

• Manufacturer Part Number: AN2153
• Description: A Serial Bootloader for Reprogramming the MC9S12DP256 FLASH Memory
• Manufacturer: Freescale Semiconductor / Motorola

Utilizing the
FLASH Security
Back Door
AN2153
MOTOROLA
The second method requires the microcontroller to be connected to
external memory devices and reset in expanded mode where a program
can be executed from the external memory to erase the FLASH and
EEPROM. This method may be preferred before parts are placed in a
target system.
As shown in
least significant bits in the security byte. Because the only unsecured
combination is when SEC1 has a value of 1 and SEC0 has a value of 0,
the microcontroller will remain secured even after the FLASH and
EEPROM are erased, since the erased state of the security byte is $FF.
As previously explained, even though the device is secured after being
erased, the part may be reset in special single-chip mode, allowing
manipulation of the microcontroller via the BDM interface. However,
after erasing the FLASH and EEPROM, the microcontroller can be
placed in the unsecured state by programming the security byte with a
value of $FE. Note that because the FLASH must be programmed one
aligned word at a time and because the security byte resides at an odd
address ($FF0F), the word at $FF0E must be programmed with a value
of $FFFE.
In normal single-chip or normal expanded operating modes, the security
mechanism may be temporarily disabled only through the use of the
back door key access feature. Because the back door mechanism
requires support by the target firmware, it is impossible for the back door
mechanism to be used to defeat device security unless the capability is
designed into the target application. To disable security, the firmware
must have access to the 64-bit value stored in the security back door
comparison key located in FLASH memory from $FF00–$FF07. If
Freescale Semiconductor, Inc.
For More Information On This Product,
Go to: www.freescale.com
Figure
5, the security mechanism is controlled by the two
SEC[1:0]
Figure 5. Security Bits
0:0
0:1
1:0
1:1
Overview of the MC9S12DP256’s FLASH
Security State
Unsecured
Secured
Secured
Secured
Application Note
9