![](http://datasheet.mmic.net.cn/370000/P9S12XEP100J1VVLR_datasheet_16728329/P9S12XEP100J1VVLR_913.png)
Chapter 23 1024 KByte Flash Module (S12XFTM1024K5V2)
MC9S12XE-Family Reference Manual Rev. 1.07
Freescale Semiconductor
913
The EPROT register (see
Section 23.3.2.10
) is loaded from the EEE protection byte during the reset
sequence. All writes to a protected area of the buffer RAM EEE partition will result in a protection
violation in MCU normal operating modes.
23.5.2.2
MCU Special Operating Modes
In MCU special modes with the Flash module secure, NVM command mode allows the following Flash
commands:
0x01 - Erase Verify All Blocks
0x02 - Erase Verify Block
0x08 - Erase All Blocks
0x0B - Unsecure Flash
0x13 - Enable EEPROM Emulation
0x14 - Disable EEPROM Emulation
0x15 - EEPROM Emulation Query
0x20 - Partition D-Flash
The FPROT register (see
Section 23.3.2.9
) is loaded from the Flash protection byte during the reset
sequence. Writes to the FPROT register are not restricted in MCU special operating modes. The Erase All
Blocks (0x08) command will cause a protection violation if protection is enabled in P-Flash memory in
MCU special operating modes.
The EPROT register (see
Section 23.3.2.10
) is loaded from the EEE protection byte during the reset
sequence. Writes to the EPROT register are not restricted in MCU special operating modes. All writes to
a protected area of the buffer RAM EEE partition will result in a protection violation in MCU special
operating modes.
23.5.3
Unsecuring the MCU using Backdoor Key Access
The MCU may be unsecured by using the backdoor key access feature which requires knowledge of the
contents of the backdoor keys (four 16-bit words programmed at addresses 0x7F_FF00–0x7F_FF07). If
the KEYEN[1:0] bits are in the enabled state (see
Section 23.3.2.2
), the Verify Backdoor Access Key
command allows the user to present four prospective keys for comparison to the keys stored in the Flash
memory via the Memory Controller. If the keys presented in the Verify Backdoor Access Key command
matchesthebackdoorkeysstoredintheFlashmemory,theMCUwillbeunsecured.Keyvaluesof0x0000
and 0xFFFF are not permitted as backdoor keys. While the Verify Backdoor Access Key command is
active, Flash block 0 will not be available for read access and will return invalid data.
The user code stored in the P-Flash memory must have a method of receiving the backdoor keys from an
external stimulus. This external stimulus would typically be through one of the on-chip serial ports.
If the KEYEN[1:0] bits are in the enabled state (see
Section 23.3.2.2
), the MCU can be unsecured by the
backdoor key access sequence described below:
1. Follow the command sequence for the Verify Backdoor Access Key command as explained in
Section 23.4.2.12