
MPXY8300 Series
Sensors
Freescale Semiconductor
23
Writing the byte program, burst program, or page erase command code (0x20, 0x25, or 0x40) with a background debug
command while the MCU is secured (The background debug controller can only do blank check and mass erase
commands when the MCU is secure.)
Writing 0 to FCBEF to cancel a partial command
4.6.6
FLASH Block Protection
The block protection feature prevents the protected region of FLASH from program or erase changes. Block protection is
controlled through the FLASH Protection Register (FPROT). When enabled, block protection begins at any 512 byte boundary
After exit from reset, FPROT is loaded with the contents of the NVPROT location which is in the nonvolatile register block of the
FLASH memory. FPROT cannot be changed directly from application software so a runaway program cannot alter the block
protection settings. Because NVPROT is within the last 512 bytes of FLASH, if any amount of memory is protected, NVPROT is
itself protected and cannot be altered (intentionally or unintentionally) by the application software. FPROT can be written through
background debug commands which allows a way to erase and reprogram a protected FLASH memory.
The block protection mechanism is illustrated below. The FPS bits are used as the upper bits of the last address of unprotected
memory. This address is formed by concatenating FPS7:FPS1 with logic 1 bits as shown. For example, in order to protect the
last 8192 bytes of memory (addresses 0xE000 through 0xFFFF), the FPS bits must be set to 1101 111 which results in the value
0xDFFF as the last address of unprotected memory. In addition to programming the FPS bits to the appropriate value, FPDIS (bit
0 of NVPROT) must be programmed to logic 0 to enable block protection. Therefore the value 0xDE must be programmed into
NVPROT to protect addresses 0xE000 through 0xFFFF.
Figure 4-4 Block Protection Mechanism
One use for block protection is to block protect an area of FLASH memory for a bootloader program. This bootloader program
then can be used to erase the rest of the FLASH memory and reprogram it. Because the bootloader is protected, it remains intact
even if MCU power is lost in the middle of an erase and reprogram operation.
4.6.7
Vector Redirection
Whenever any block protection is enabled, the reset and interrupt vectors will be protected. Vector redirection allows users to
modify interrupt vector information without unprotecting bootloader and reset vector space. Vector redirection is enabled by
programming the FNORED bit in the NVOPT register located at address 0xFFBF to zero. For redirection to occur, at least some
portion but not all of the FLASH memory must be block protected by programming the NVPROT register located at address
0xFFBD. All of the interrupt vectors (memory locations 0xFFC0–0xFFFD) are redirected, though the reset vector (0xFFFE:FFFF)
is not.
For example, if 512 bytes of FLASH are protected, the protected address region is from 0xFE00 through 0xFFFF. The interrupt
vectors (0xFFC0–0xFFFD) are redirected to the locations 0xFDC0–0xFDFD. Now, if an SPI interrupt is taken for instance, the
values in the locations 0xFDE0:FDE1 are used for the vector instead of the values in the locations 0xFFE0:FFE1. This allows
the user to reprogram the unprotected portion of the FLASH with new program code including new interrupt vector values while
leaving the protected area, which includes the default vector locations, unchanged.
4.7
Security
The MPXY8300 Series includes circuitry to prevent unauthorized access to the contents of FLASH and RAM memory. When
security is engaged, FLASH and RAM are considered secure resources. Direct-page registers, high-page registers, and the
background debug controller are considered unsecured resources. Programs executing within secure memory have normal
access to any MCU memory locations and resources. Attempts to access a secure memory location with a program executing
from an unsecured memory space or through the background debug interface are blocked (writes are ignored and reads return
all 0s).
Security is engaged or disengaged based on the state of two nonvolatile register bits (SEC01:SEC00) in the FOPT register.
During reset, the contents of the nonvolatile location NVOPT are copied from FLASH into the working FOPT register in high-page
register space. A user engages security by programming the NVOPT location, which can be done at the same time the FLASH
memory is programmed. The 1:0 state disengages security and the other three combinations engage security. Notice the erased
state (1:1) makes the MCU secure. During development, whenever the FLASH is erased, it is good practice to immediately
FPS7
FPS6
FPS5
FPS4
FPS3
FPS2
FPS1
A15
A14
A13
A12
A11
A10
A9
A8
1
A7 A6 A5 A4 A3 A2 A1 A0
111
11111