Changing The Security State; Unsecuring The Chip Using Backdoor Key Access - NXP Semiconductors freescale KV4 Series Reference Manual

Chapter 32 Flash Memory Module (FTFA)
Flash security features are discussed further in AN4507: Using the Kinetis Security and
Flash Protection Features . Note that not all features described in the application note are
available on this device.
Table 32-69. FSEC register fields
FSEC field Description
KEYEN Backdoor Key Access
MEEN Mass Erase Capability
FSLACC Freescale Factory Access
SEC MCU security

32.4.11.1 Changing the Security State

The security state out of reset can be permanently changed by programming the security
byte of the flash configuration field. This assumes that you are starting from a mode
where the necessary program flash erase and program commands are available and that
the region of the program flash containing the flash configuration field is unprotected. If
the flash security byte is successfully programmed, its new value takes affect after the
next chip reset.

32.4.11.1.1 Unsecuring the Chip Using Backdoor Key Access

The chip can be unsecured by using the backdoor key access feature, which requires
knowledge of the contents of the 8-byte backdoor key value stored in the Flash
Configuration Field (see Flash Configuration Field Description). If the FSEC[KEYEN]
bits are in the enabled state, the Verify Backdoor Access Key command (see Verify
Backdoor Access Key Command) can be run; it allows the user to present prospective
keys for comparison to the stored keys. If the keys match, the FSEC[SEC] bits are
changed to unsecure the chip. The entire 8-byte key cannot be all 0s or all 1s; that is,
0000_0000_0000_0000h and FFFF_FFFF_FFFF_FFFFh are not accepted by the Verify
Backdoor Access Key command as valid comparison values. While the Verify Backdoor
Access Key command is active, program flash memory is not available for read access
and returns invalid data.
The user code stored in the program flash memory must have a method of receiving the
backdoor keys from an external stimulus. This external stimulus would typically be
through one of the on-chip serial ports.
If the KEYEN bits are in the enabled state, the chip can be unsecured by the following
backdoor key access sequence:
KV4x Reference Manual, Rev. 2, 02/2015
Preliminary
Freescale Semiconductor, Inc. 649