
128 KByte Flash Module (S12FTMRC128K1V1)
S12P-Family Reference Manual, Rev. 1.07
Freescale Semiconductor
PRELIMINARY
457
The Verify Backdoor Access Key command is monitored by the Memory Controller and an illegal key will
prohibit future use of the Verify Backdoor Access Key command. A reset of the MCU is the only method
to re-enable the Verify Backdoor Access Key command.
After the backdoor keys have been correctly matched, the MCU will be unsecured. After the MCU is
unsecured, the sector containing the Flash security byte can be erased and the Flash security byte can be
reprogrammed to the unsecure state, if desired.
In the unsecure state, the user has full control of the contents of the backdoor keys by programming
addresses 0x3_FF00-0x3_FF07 in the Flash conguration eld.
The security as dened in the Flash security byte (0x3_FF0F) is not changed by using the Verify Backdoor
Access Key command sequence. The backdoor keys stored in addresses 0x3_FF00-0x3_FF07 are
unaffected by the Verify Backdoor Access Key command sequence. After the next reset of the MCU, the
security state of the Flash module is determined by the Flash security byte (0x3_FF0F). The Verify
Backdoor Access Key command sequence has no effect on the program and erase protections dened in
the Flash protection register, FPROT.
13.5.2
Unsecuring the MCU in Special Single Chip Mode using BDM
The MCU can be unsecured in special single chip mode by erasing the P-Flash and D-Flash memory by
the following method:
Reset the MCU into special single chip mode, delay while the erase test is performed by the BDM,
send BDM commands to disable protection in the P-Flash and D-Flash memory, and execute the
Erase All Blocks command write sequence to erase the P-Flash and D-Flash memory.
After the CCIF ag sets to indicate that the Erase All Blocks operation has completed, reset the MCU into
special single chip mode. The BDM will execute the Erase Verify All Blocks command write sequence to
verify that the P-Flash and D-Flash memory is erased. If the P-Flash and D-Flash memory are verified as
erased the MCU will be unsecured. All BDM commands will be enabled and the Flash security byte may
be programmed to the unsecure state by the following method:
Send BDM commands to execute a ‘Program P-Flash’ command sequence to program the Flash
security byte to the unsecured state and reset the MCU.
13.5.3
Mode and Security Effects on Flash Command Availability
The availability of Flash module commands depends on the MCU operating mode and security state as
13.6
Initialization
On each system reset the flash module executes an initialization sequence which establishes initial values
for the Flash Block Configuration Parameters, the FPROT and DFPROT protection registers, and the
FOPT and FSEC registers. The initialization routine reverts to built-in default values that leave the module
in a fully protected and secured state if errors are encountered during execution of the reset sequence. If a
double bit fault is detected during the reset sequence, both MGSTAT bits in the FSTAT register will be set.