mc9s08ac32 Freescale Semiconductor, Inc, mc9s08ac32 Datasheet - Page 57

• Manufacturer Part Number: mc9s08ac32
• Description: Hcs08 Microcontrollers
• Manufacturer: Freescale Semiconductor, Inc

The security key can be written only from RAM, so it cannot be entered through background commands
without the cooperation of a secure user program. The FLASH memory cannot be accessed by read
operations while KEYACC is set.
The backdoor comparison key (NVBACKKEY through NVBACKKEY+7) is located in FLASH memory
locations in the nonvolatile register space so users can program these locations just as they would program
any other FLASH memory location. The nonvolatile registers are in the same 512-byte block of FLASH
as the reset and interrupt vectors, so block protecting that space also block protects the backdoor
comparison key. Block protects cannot be changed from user application programs, so if the vector space
is block protected, the backdoor security key mechanism cannot permanently change the block protect,
security settings, or the backdoor key.
Security can always be disengaged through the background debug interface by performing these steps:
4.6
The FLASH module has nine 8-bit registers in the high-page register space, three locations in the
nonvolatile register space in FLASH memory that are copied into three corresponding high-page control
registers at reset. There is also an 8-byte comparison key in FLASH memory. Refer to
Table 4-4
control bits only by their names. A Freescale-provided equate or header file normally is used to translate
these names into the appropriate absolute addresses.
4.6.1
Bit 7 of this register is a read-only status flag. Bits 6 through 0 may be read at any time but can be written
only one time. Before any erase or programming operations are possible, write to this register to set the
frequency of the clock for the nonvolatile memory system within acceptable limits.
Freescale Semiconductor
2. Writing the user-entered key values to the NVBACKKEY through NVBACKKEY+7 locations.
3. Writing 0 to KEYACC in the FCNFG register. If the 8-byte key that was just written matches the
1. Disable any block protections by writing FPROT. FPROT can be written only with background
2. Mass erase FLASH, if necessary.
3. Blank check FLASH. Provided FLASH is completely erased, security is disengaged until the next
These writes must be done in order, starting with the value for NVBACKKEY and ending with
NVBACKKEY+7. STHX should not be used for these writes because these writes cannot be done
on adjacent bus cycles. User software normally would get the key codes from outside the MCU
system through a communication interface such as a serial I/O.
key stored in the FLASH locations, SEC01:SEC00 are automatically changed to 1:0 and security
will be disengaged until the next reset.
debug commands, not from application software.
reset.
To avoid returning to secure mode after the next reset, program NVOPT so SEC01:SEC00 = 1:0.
FLASH Registers and Control Bits
for the absolute address assignments for all FLASH registers. This section refers to registers and
FLASH Clock Divider Register (FCDIV)
MC9S08AC60 Series Data Sheet, Rev. 2
Table 4-3
Chapter 4 Memory
and
57