
56F8037 Data Sheet, Rev. 4
126
Freescale Semiconductor
Preliminary
power-down of the device. Only two bytes within this field are used to enable or disable security. Refer to
the Flash Memory chapter in the 56F802x and 56F803x Peripheral Reference Manual for the state of
the security bytes and the resulting state of security. When Flash security mode is enabled in accordance
with the method described in the Flash Memory module chapter, the 56F8037 will disable the core EOnCE
debug capabilities. Normal program execution is otherwise unaffected.
7.2 Flash Access Lock and Unlock Mechanisms
The 56F8037 has several operating functional and debug modes. Effective Flash security must address
operating mode selection and anticipate modes in which the on-chip Flash can be read without explicit user
permission.
7.2.1
Disabling EOnCE Access
On-chip Flash can be read by issuing commands across the EOnCE port, which is the debug interface for
the 56800E CPU. The TCK, TMS, TDO, and TDI pins comprise a JTAG interface onto which the EOnCE
port functionality is mapped. When the 56F8037 boots, the chip-level JTAG TAP (Test Access Port) is
active and provides the chip’s boundary scan capability and access to the ID register, but proper
implementation of Flash security will block any attempt to access the internal Flash memory via the
EOnCE port when security is enabled.
7.2.2
Flash Lockout Recovery Using JTAG
If a user inadvertently enables security on the 56F8037, the only lockout recovery mechanism is the
complete erasure of the internal Flash contents, including the configuration field, and thus disables security
(the protection register is cleared). This does not compromise security, as the entire contents of the user’s
secured code stored in Flash are erased before security is disabled on the 56F8037 on the next reset or
power-up sequence.
To start the lockout recovery sequence, the JTAG public instruction (LOCKOUT_RECOVERY) must
first
be
shifted
into
the
chip-level
TAP
controller’s
instruction
register.
Once
the
LOCKOUT_RECOVERY instruction has been shifted into the instruction register, the clock divider value
must be shifted into the corresponding 7-bit data register. After the data register has been updated, the user
must transition the TAP controller into the RUN-TEST/IDLE state for the lockout sequence to commence.
The controller must remain in this state until the erase sequence has completed. Refer to the 56F802x and
56F803x Peripheral Reference Manual for more details, or contact Freescale.
Note:
Once the lockout recovery sequence has completed, the user must reset both the JTAG TAP controller
(by advancing the TAP state machine to the reset state) and the 56F8037 (by asserting external chip
reset) to return to normal unsecured operation.
7.2.3
Flash Lockout Recovery using CodeWarrior
CodeWarrior can unlock a device using the command sequence described in Section 7.2.2 by selecting the
Debug menu, then selecting DSP56800E, followed by Unlock Flash.
Another mechanism is also built into CodeWarrior using the device’s memory configuration file. The
command “Unlock_Flash_on_Connect1” in the .cfg file accomplishes the same task as using the Debug
menu.