
FTS64K Block User Guide — Version V01.00
36
WARNING
As active commands are immediately aborted when the MCU enters STOP mode, it is strongly
recommended that the user does not use the STOP command during program and erase execution.
4.4 Background Debug Mode
In Background Debug Mode (BDM), the FPROT registers are writable. If the chip is unsecured then all
Flash commands listed in
Table 4-1
can be executed. In special single chip mode if the chip is secured
then the only possible command to execute is Mass Erase.
4.5 Flash Security
The Flash module provides the necessary security information to the rest of the chip. After each reset, the
Flash module determines the security state of the microcontroller as defined in section
3.3.2
.
The contents of the Flash Protection/Options byte at $FF0F in the Flash Protection/Options Field must be
changed directly by programming $FF0F when the device is unsecured and the higher address sector is
unprotected. If the Flash Protection/Options byte is left in the secure state, any reset will cause the
microcontroller to return to the secure operating mode
4.5.1 Unsecuring the Flash via the Backdoor Key Access
The microcontroller may only be unsecured by using the Backdoor Key Access feature. This requires
knowledge of the contents of the backdoor keys, four 16-bit words programmed in the Flash at addresses
$FF00 - $FF07. With the KEYEN and KEYACC bits set, a write to a backdoor key address triggers a
comparison between the written data and the backdoor key data stored in the Flash. If all four words of
data are written to the correct addresses in the correct order and the data matches the backdoor keys stored
in the Flash the microcontroller will be unsecured. The data must be written to the backdoor keys
sequentially staring with $FF00-1 and ending with $FF06-7.When the KEYACC bit is set reads of the
Flash array will return invalid data.
The user code stored in the Flash must have a method of receiving the backdoor key from an external
stimulus. This external stimulus would typically be through one of the on-chip serial ports.
If the KEYEN bit is set in the FCNFG register, the flash can be unsecured by the following Back Door
Access Sequence:
1.
Set the KEYACC bit in the Flash Configuration Register FCNFG.
2.
Write the correct four 16-bit words backdoor keys to Flash addresses $FF00 - $FF07 sequentially
starting with $FF00.
3.
Clear the KEYACC bit.
4.
If all four 16-bit words match the Flash content, the MCU is unsecured and bits SEC[1:0] in the
FSEC register are forced to the unsecure state, ‘10’.
F
For More Information On This Product,
Go to: www.freescale.com
n
.