mcf51ac256a Freescale Semiconductor, Inc, mcf51ac256a Datasheet - Page 79

• Manufacturer Part Number: mcf51ac256a
• Description: Mcf51ac Flexis
• Manufacturer: Freescale Semiconductor, Inc

4.4.7.1
The MCU may be unsecured by using the backdoor key access feature which requires knowledge of the
contents of the backdoor keys (see
Section
a comparison between the written data and the backdoor key data stored in the flash memory. If all
backdoor keys are written to the correct addresses in the correct order and the data matches the backdoor
keys stored in the flash memory, the MCU will be unsecured. The data must be written to the backdoor
keys sequentially. Values 0x0000_0000 and 0xFFFF_FFFF are not permitted as backdoor keys. While the
KEYACC bit is set, reads of the flash memory will return valid data.
The user code stored in the flash memory must have a method of receiving the backdoor keys from an
external stimulus. This external stimulus would typically be through one of the on-chip serial ports.
If the KEYEN[1:0] bits are in the enabled state (see
backdoor key access sequence described below:
The backdoor key access sequence is monitored by an internal security state machine. An illegal operation
during the backdoor key access sequence will cause the security state machine to lock, leaving the MCU
in the secured state. A reset of the MCU will cause the security state machine to exit the lock state and
allow a new backdoor key access sequence to be attempted. The following operations during the backdoor
key access sequence will lock the security state machine:
After the backdoor keys have been correctly matched, the MCU will be unsecured. Once the MCU is
unsecured, the flash security byte can be programmed to the unsecure state, if desired.
In the unsecure state, the user has full control of the contents of the backdoor keys by programming the
associated addresses in the flash configuration field (see
The security as defined in the flash security byte is not changed by using the backdoor key access sequence
to unsecure. The stored backdoor keys are unaffected by the backdoor key access sequence. After the next
reset of the MCU, the security state of the flash module is determined by the flash security byte. The
backdoor key access sequence has no effect on the program and erase protections defined in the flash
protection register (FPROT).
Freescale Semiconductor
1. Set the KEYACC bit in the flash configuration register (FCNFG).
2. Sequentially write the correct two longwords to the flash addresses containing the backdoor keys.
3. Clear the KEYACC bit. Depending on the user code used to write the backdoor keys, a wait cycle
4. If all data written match the backdoor keys, the MCU is unsecured and the SEC[1:0] bits in the
1. If any of the keys written does not match the backdoor keys programmed in the flash array.
2. If the keys are written in the wrong sequence.
3. If the keys written are all 0s or all 1s.
4. If the KEYACC bit does not remain set while the keys are written.
5. If any of the keys is written on successive MCU clock cycles.
6. Executing a STOP instruction before all keys have been written.
(NOP) may be required before clearing the KEYACC bit.
NVOPT register are forced to an unsecured state.
4.4.2.2) and the KEYACC bit is set, a write to a backdoor key address in the flash memory triggers
Unsecuring the MCU using Backdoor Key Access
MCF51AC256 ColdFire Integrated Microcontroller Reference Manual, Rev. 5
Section
4.2.2). If the KEYEN[1:0] bits are in the enabled state (see
Section
Section
4.4.2.2), the MCU can be unsecured by the
4.2.2).
Memory
4-35