AN2400 Freescale Semiconductor / Motorola, AN2400 Datasheet - Page 44

• Manufacturer Part Number: AN2400
• Description: HCS12 NVM Guidelines
• Manufacturer: Freescale Semiconductor / Motorola

AN2400/D
Unsecuring the
Microcontroller
Backdoor Key Access
Backdoor Key
Access Sequence:
44
NOTE:
NOTE:
When secure, the microcontroller can be unsecured by one of the following
methods.
In Normal modes (Single Chip and Expanded), security can be temporarily
disabled by means of the Backdoor Key access method. This method requires
that:
The Backdoor Key values themselves would not normally be stored within the
application data, and so the application program would have to be designed to
receive the Backdoor Key values from an external source, through a serial port
for example. It is not possible to download the backdoor keys using
Background Debug Mode.
The Backdoor Key Access method is useful because it allows debugging of a
secured microcontroller, without having to erase the Flash. This is particularly
useful for failure analysis.
No word of the Backdoor Key is allowed to have the value $0000 or $FFFF.
Flash cannot be read while KEYACC is set. Therefore the code for the
Backdoor Key access sequence must exceute from RAM.
If all four 16-bit words match the Flash contents at $FF00 to $FF07, the
microcontroller will be unsecured and the security bits SEC[1:0] in the Flash
Security register FSEC will be forced to the unsecured state, ‘10’. The contents
of the Flash Options/Security byte are not changed by this procedure, and so
the microcontroller will revert to the secure state after the next reset, unless
further action is taken as detailed below.
If any of the four 16-bit words do not match the Flash contents at $FF00 to
$FF07, the microcontroller will remain secured.
1. Set the KEYACC bit in the Flash Configuration register FCNFG.
2. Write the first 16-bit word of the backdoor key to $FF00.
3. Write the second 16-bit word of the backdoor key to $FF02.
4. Write the third 16-bit word of the backdoor key to $FF04.
5. Write the fourth 16-bit word of the backdoor key to $FF06.
6. Clear the KEYACC bit in the Flash Configuration register FCNFG.
•
•
•
Freescale Semiconductor, Inc.
For More Information On This Product,
The Backdoor Key at $FF00 to $FF07 has been programmed to a valid
value.
The KEYEN[1:0] bits within the Flash Options/Security byte select
‘enabled’.
In Single Chip mode, the application program programmed into the
microcontroller must be designed to have the capability to write to the
Backdoor Key locations.
Go to: www.freescale.com
HCS12 NVM Guidelines
MOTOROLA