Motorola ColdFire MCF5281 - Manual (Page 135)

ColdFire Flash Module (CFM)
Freescale Semiconductor 6-23
6.5.1 Back Door Access
If the KEYEN bit is set, security can be bypassed by:
1. Setting the KEYACC bit in the CFM configuration register (CFMMCR).
2. Writing the correct 8-byte back door comparison key to the CFM array at addresses 0x0000_0400
to 0x0000_0407. This operation must consist of two 32-bit writes to address 0x0000_0400 and
0x0000_0404 in that order. The two back door write cycles can be separated by any number of
bus cycles.
3. Clearing the KEYACC bit.
4. If all 8 bytes written match the array contents at addresses 0x0000_0400 to 0x0000_0407, then
security is bypassed until the next reset.
NOTE
The security of the Flash as defined by the Flash security longword at
address 0x0000_0414 is not changed by the back door method of unsecuring
the device. After the next reset the device is again secured and the same back
door key remains in effect unless changed by program or erase operations.
The back door method of unsecuring the device has no effect on the program
and erase protections defined by the CFM protection register (CFMPROT).
6.5.2 Erase Verify Check
Security can be disabled by verifying that the CFM array is blank. If required, the mass erase command
can be executed for each pair of Flash physical blocks that comprise the array. The erase verify command
must then be executed for all Flash physical blocks within the array. The CFM will be unsecured if the
erase verify command determines that the entire array is blank. After the next reset, the security state of
the CFM will be determined by the Flash security longword, which, after being erased, will read
0xffff_ffff, thus unsecuring the module.
6.6 Reset
The CFM array is not accessible for any operations via the address and data buses during reset. If a reset
occurs while any command is in progress that command will immediately abort. The state of any longword
being programmed or any erase pages/physical blocks being erased is not guaranteed.
6.7 Interrupts
The CFM module can request an interrupt when all commands are completed or when the address, data,
and command buffers are empty.
Table 6-14 shows the CFM interrupt mechanism.
Table 6-14. CFM Interrupt Sources
Interrupt Source Interrupt Flag Local Enable
Command, data and address
buffers empty CBEIF
(CFMUSTAT)
CBEIE
(CFMCR)
MCF5282 and MCF5216 ColdFire Microcontroller User’s Manual, Rev. 3