PC912XDP512F0MPVR datasheet(1144/1348 Pages) FREESCALE

1144 / 1348 page

Chapter 27 512 Kbyte Flash Module (S12XFTX512K4V2)

MC9S12XDP512 Data Sheet, Rev. 2.21

1146

Freescale Semiconductor

27.6.1

Unsecuring the MCU using Backdoor Key Access

The MCU may be unsecured by using the backdoor key access feature which requires knowledge of the

contents of the backdoor keys (four 16-bit words programmed at addresses 0x7F_FF00–0x7F_FF07). If

the KEYEN[1:0] bits are in the enabled state (see Section 27.3.2.2, “Flash Security Register (FSEC)”) and

the KEYACC bit is set, a write to a backdoor key address in the Flash memory triggers a comparison

between the written data and the backdoor key data stored in the Flash memory. If all four words of data

are written to the correct addresses in the correct order and the data matches the backdoor keys stored in

the Flash memory, the MCU will be unsecured. The data must be written to the backdoor keys sequentially

starting with 0x7F_FF00–1 and ending with 0x7F_FF06–7. 0x0000 and 0xFFFF are not permitted as

backdoor keys. While the KEYACC bit is set, reads of the Flash memory will return invalid data.

The user code stored in the Flash memory must have a method of receiving the backdoor keys from an

external stimulus. This external stimulus would typically be through one of the on-chip serial ports.

If the KEYEN[1:0] bits are in the enabled state (see Section 27.3.2.2, “Flash Security Register (FSEC)”),

the MCU can be unsecured by the backdoor key access sequence described below:

1. Set the KEYACC bit in the Flash Conﬁguration Register (FCNFG).

2. Write the correct four 16-bit words to Flash addresses 0xFF00–0xFF07 sequentially starting with

0x7F_FF00.

3. Clear the KEYACC bit. Depending on the user code used to write the backdoor keys, a wait cycle

(NOP) may be required before clearing the KEYACC bit.

4. If all four 16-bit words match the backdoor keys stored in Flash addresses

0x7F_FF00–0x7F_FF07, the MCU is unsecured and the SEC[1:0] bits in the FSEC register are

forced to the unsecure state of 1:0.

The backdoor key access sequence is monitored by an internal security state machine. An illegal operation

during the backdoor key access sequence will cause the security state machine to lock, leaving the MCU

in the secured state. A reset of the MCU will cause the security state machine to exit the lock state and

allow a new backdoor key access sequence to be attempted. The following operations during the backdoor

key access sequence will lock the security state machine:

1. If any of the four 16-bit words does not match the backdoor keys programmed in the Flash array.

2. If the four 16-bit words are written in the wrong sequence.

3. If more than four 16-bit words are written.

4. If any of the four 16-bit words written are 0x0000 or 0xFFFF.

5. If the KEYACC bit does not remain set while the four 16-bit words are written.

6. If any two of the four 16-bit words are written on successive MCU clock cycles.

After the backdoor keys have been correctly matched, the MCU will be unsecured. Once the MCU is

unsecured, the Flash security byte can be programmed to the unsecure state, if desired.

In the unsecure state, the user has full control of the contents of the backdoor keys by programming

addresses 0x7F_FF00–0x7F_FF07 in the Flash Conﬁguration Field.

The security as deﬁned in the Flash security byte (0x7F_FF0F) is not changed by using the backdoor key

access sequence to unsecure. The backdoor keys stored in addresses 0x7F_FF00–0x7F_FF07 are

PC912XDP512F0MPVR 데이터시트(PDF) 1144 Page - Freescale Semiconductor, Inc

PC912XDP512F0MPVR 데이터시트(HTML) 1144 Page - Freescale Semiconductor, Inc

Html Pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 ...More

데이터시트 다운로드

링크 URL