![](http://datasheet.mmic.net.cn/370000/P9S12XEP100J1VVLR_datasheet_16728329/P9S12XEP100J1VVLR_911.png)
Chapter 23 1024 KByte Flash Module (S12XFTM1024K5V2)
MC9S12XE-Family Reference Manual Rev. 1.07
Freescale Semiconductor
911
Unsecure Flash (0x0B))
Verify Backdoor Access Key (0x0C)
Enable EEPROM Emulation (0x13)
Disable EEPROM Emulation (0x14)
EEPROM Emulation Query (0x15)
Partition D-Flash (0x20)
23.5
Security
The Flash module provides the necessary security information to the MCU. After each reset, the Flash
module determines the security state of the MCU as defined in
Section 23.3.2.2, “Flash Security Register
(FSEC)
”.
The contents of the Flash security byte at global address 0x7F_FF0F in the Flash configuration field must
be changed directly by programming 0x7F_FF0F when the MCU is unsecured and the higher address
sector is unprotected. If the Flash security byte is successfully programmed to 0x7F_FF0F, security will
be released after the next reset of the MCU. If the Flash security byte is left in a secured state, any reset
will cause the MCU to initialize to a secure operating mode.
The availability and extent of the operating modes of the Flash module depend on the state of the MCU.
How the MCU modes of operation affect Flash command availability is shown in
Table 23-29
.
This section describes security-related operation of the Flash module and covers the following subjects:
Flash Module Operation while Unsecure
Flash Module Operation while Secure
Unsecuring the MCU using Backdoor Key Access
Unsecuring the MCU in Special Single Chip Mode using BDM
23.5.1
Flash Module Operation while Unsecure
23.5.1.1
MCU Normal Operating Modes
In MCU normal operating modes with the Flash module unsecure, NVM command mode allows Flash
commands as described in
Section 23.4.2
to execute.
The FPROT register (see
Section 23.3.2.9
) is loaded from the Flash protection byte during the reset
sequence. Writes to the FPROT register are restricted to specific scenarios. The Program P-Flash (0x06),
Erase All Blocks (0x08), Erase P-Flash Block (0x09), and Erase P-Flash Sector (0x0A) commands will
cause a protection violation if the command will attempt to alter data in a protected area.
The EPROT register (see
Section 23.3.2.10
) is loaded from the EEE protection byte during the reset
sequence. All writes to a protected area of the buffer RAM EEE partition will result in a protection
violation.