HCS08 datasheet(56/290 Pages) MOTOROLA

56 / 290 page

Memory

MC9S08GB/GT

MOTOROLA

is no way to disengage security without completely erasing all FLASH locations. If KEYEN is 1, a secure

user program can temporarily disengage security by:

1. Writing 1 to KEYACC in the FCNFG register. This makes the FLASH module interpret writes to

the backdoor comparison key locations (NVBACKKEY through NVBACKKEY+7) as values to

be compared against the key rather than as the first step in a FLASH program or erase command.

2. Writing the user-entered key values to the NVBACKKEY through NVBACKKEY+7 locations.

These writes must be done in order starting with the value for NVBACKKEY and ending with

NVBACKKEY+7. STHX should not be used for these writes because these writes cannot be done

on adjacent bus cycles. User software normally would get the key codes from outside the MCU

system through a communication interface such as a serial I/O.

Writing 0 to KEYACC in the FCNFG register. If the 8-byte key that was just written matches the

key stored in the FLASH locations, SEC01:SEC00 are automatically changed to 1:0 and security

will be disengaged until the next reset.

The security key can be written only from RAM, so it cannot be entered through background commands

without the cooperation of a secure user program. The FLASH memory cannot be accessed by read

operations while KEYACC is set.

The backdoor comparison key (NVBACKKEY through NVBACKKEY+7) is located in FLASH memory

locations in the nonvolatile register space so users can program these locations just as they would program

any other FLASH memory location. The nonvolatile registers are in the same 512-byte block of FLASH

as the reset and interrupt vectors, so block protecting that space also block protects the backdoor

comparison key. Block protects cannot be changed from user application programs, so if the vector space

is block protected, the backdoor security key mechanism cannot permanently change the block protect,

security settings, or the backdoor key.

Security can always be disengaged through the background debug interface by following these steps:

Disable any block protections by writing FPROT. FPROT can be written only with background

debug commands, not from application software.

Mass erase FLASH if necessary.

Blank check FLASH. Provided FLASH is completely erased, security is disengaged until the next

reset.

To avoid returning to secure mode after the next reset, program NVOPT so SEC01:SEC00 = 1:0.

4.6 FLASH Registers and Control Bits

The FLASH module has nine 8-bit registers in the high-page register space, three locations in the

nonvolatile register space in FLASH memory which are copied into three corresponding high-page control

registers at reset. There is also an 8-byte comparison key in FLASH memory. Refer to Table 4-3 and

Table 4-4 for the absolute address assignments for all FLASH registers. This section refers to registers

and control bits only by their names. A Motorola-provided equate or header file normally is used to

translate these names into the appropriate absolute addresses.

HCS08 데이터시트(PDF) 56 Page - Motorola, Inc