Security Features
MC56F825x/MC56F824x Digital Signal Controller, Rev. 3
Freescale Semiconductor
47
word ensures that the device remains secure after the next reset (caused, for example, by the device powering down). Refer to
the flash memory section of the device’s reference manual for details.
When flash security mode is enabled, the MC56F825x/MC56F824x disables the core’s EOnCE debug capabilities. Normal
program execution is otherwise unaffected.
6.2
Flash Access Lock and Unlock Mechanisms
Several methods effectively lock or unlock the on-chip flash.
6.2.1
Disabling EOnCE Access
You can read on-chip flash by issuing commands across the EOnCE port, which is the debug interface for the 56800E core. The
TCK, TMS, TDO, and TDI pins compose a JTAG interface onto which the EOnCE port functionality is mapped. When the
device boots, the chip-level JTAG port is active and provides the chip’s boundary scan capability and access to the ID register.
However, proper implementation of flash security blocks any attempt to access the internal flash memory via the EOnCE port
when security is enabled. This protection is effective when the device comes out of reset, even prior to the execution of any
code at startup.
6.2.2
Flash Lockout Recovery Using JTAG
If the device is secured, one lockout recovery mechanism is the complete erasure of the internal flash contents, including the
configuration field. The erasure disables security by clearing the protection register. This approach does not compromise
security. The entire contents of your secured code stored in flash are erased before the next reset or power-up sequence, when
security becomes disabled.
To start the lockout recovery sequence via JTAG, first shift the JTAG public instruction (LOCKOUT_RECOVERY) into the
chip-level TAP controller’s instruction register. Then shift the clock divider value into the corresponding 7-bit data register.
Finally, the TAP controller must enter the RUN-TEST/IDLE state for the lockout sequence to commence. The controller must
remain in this state until the erase sequence is complete. Refer to the device’s reference manual for details, or contact Freescale.
NOTE
After completion of the lockout recovery sequence, you must reset the JTAG TAP
controller and the device to return to normal unsecured operation. A power-on reset resets
both.
6.2.3
Flash Lockout Recovery Using CodeWarrior
You can use CodeWarrior to unlock a device by selecting the following items in the indicated sequence:
1. Debug menu
2. DSP56800E
3. Unlock Flash
You can accomplish the same task with another CodeWarrior mechanism that uses the device’s memory configuration file: the
command “Unlock_Flash_on_Connect 1” in the .cfg file.
This lockout recovery mechanism completely erases the internal flash contents, including the configuration field, thereby
disabling security (the protection register is cleared).