![](http://datasheet.mmic.net.cn/Freescale-Semiconductor/MM912H634CM1AER2_datasheet_99021/MM912H634CM1AER2_187.png)
MM912_634 Advance Information, Rev. 10.0
Freescale Semiconductor
187
5.31.3.3
Family ID Assignment
The family ID is an 8-bit value located in the BDM ROM in active BDM (at global address: 0x3_FF0F). The read-only value is a
unique family ID which is 0xC2 for devices with an HCS12S core.
5.31.4
Functional Description
The BDM receives and executes commands from a host via a single wire serial interface. There are two types of BDM commands:
hardware and firmware commands.
Hardware commands are used to read and write target system memory locations and to enter active background debug mode,
Firmware commands are used to read and write CPU resources and to exit from active background debug mode, see
register (X), Y index register (Y), stack pointer (SP), and program counter (PC).
Hardware commands can be executed at any time and in any mode excluding a few exceptions as highlighted (see
commands can only be executed when the system is not secure and is in active background debug mode (BDM).
5.31.4.1
Security
If the user resets into special single chip mode with the system secured, a secured mode BDM firmware lookup table is brought
into the map overlapping a portion of the standard BDM firmware lookup table. The secure BDM firmware verifies that the on-chip
Flash EEPROM are erased. This being the case, the UNSEC and ENBDM bit will get set. The BDM program jumps to the start
of the standard BDM firmware and the secured mode BDM firmware is turned off and all BDM commands are allowed. If the Flash
do not verify as erased, the BDM firmware sets the ENBDM bit, without asserting UNSEC, and the firmware enters a loop. This
causes the BDM hardware commands to become enabled, but does not enable the firmware commands. This allows the BDM
hardware to be used to erase the Flash.
BDM operation is not possible in any other mode than special single chip mode when the device is secured. The device can only
be unsecured via BDM serial interface in special single chip mode. For more information regarding security, please see the
S12S_9SEC Block Guide.
5.31.4.2
Enabling and Activating BDM
The system must be in active BDM to execute standard BDM firmware commands. BDM can be activated only after being
enabled. BDM is enabled by setting the ENBDM bit in the BDM status (BDMSTS) register. The ENBDM bit is set by writing to the
BDM status (BDMSTS) register, via the single-wire interface, using a hardware command such as
WRITE_BD_BYTE.After being enabled, BDM is activated by one of the followin
g(177):
Hardware BACKGROUND command
CPU BGND instruction
Breakpoint force or tag mechanism
(178)When BDM is activated, the CPU finishes executing the current instruction and then begins executing the firmware in the
standard BDM firmware lookup table. When BDM is activated by a breakpoint, the type of breakpoint used determines if BDM
becomes active before or after execution of the next instruction.
Note:
177. BDM is enabled and active immediately out of special single-chip reset.
178. This method is provided by the S12S_DBG module.
Table 266. BDMPPR Field Descriptions
Field
Description
7
BPAE
BDM Program Page Access Enable Bit
— BPAE enables program page access for BDM hardware and firmware read/write
instructions. The BDM hardware commands used to access the BDM registers
(READ_BD and
WRITE_BD) can not be used
for global accesses even if the BGAE bit is set.
0
BDM Program Paging disabled
1
BDM Program Paging enabled
3–0
BPP[3:0]
BDM Program Page Index Bits 3–0
— These bits define the selected program page. For more detailed information regarding
the program page window scheme, please refer to the S12S_MMC Block Guide.