How to reset FPROT register

[beejondlam]

Hi all,

I want to update the bootloader in the flash area from 0xE000 to 0xFFFF of the MC9S12DP512. The guys before me had protected this area by programming the FPROT register to 0xD7. To update this bootloader I have a program for maintenance running in RAM. It has to erase this flash area and write the new booloader. But with the protection in the FPROT register, this flash area cannot be erased.

Does someone know how to reset the FPROT register to 0xFF to unlock the flash area or how to mass erase the whole flash if needed. I don't mind what is in the flash memory of the MCU, everything can be erased. I have set the FPROT to 0xFF in my maintenance program but it does not change.

I don't have USBDM but only a serial line RS232 to upload the maintenance program into RAM.

Let me know if you need more information.

Thanks a lot

[bradsevers]

We have run into a similar predicament in our application. Would it be possible to:

1. Make a temporary copy of just the sector containing the FPROT registers (0xFC00-0xFFFF)
2. Do a sector erase on (0xFC00-0xFFFF). BTW - how is the desired sector specified to be erased?
3. Modify the portion of the temporary copy corresponding to the FPROT registers, setting them to 0xFF.
4. Write the temporary copy to the now-erased sector.

[lama]

I am sorry for delay caused by vacation.

I have another idea. You have to connect debugger to the device in the special single chip mode (MODC=1, MODB=MODA=0). Then also write once registers are writeable. FPROT can also be written as you want and you also can change content of FLASH. The procedure can be similar as the CodeWarrior uses in the p&e_erase_unsecure_hcs12.cmd   file presented below. You only omit mas erase code and you can rewrite flash as well as FPROT reg.

// ver 1.1 (7/7/04)

// HCS12X Core erasing + unsecuring command file:

// These commands mass erase the chip then program the security byte to 0xFE (unsecured state).

// Evaluate the clock divider to set in ECLKDIV/FCLKDIV registers:

DEFINEVALUEDLG "Information required to unsecure the device" "CLKDIV" 0x49 "To unsecure the device, the command script needs \nthe correct value for ECLKDIV/FCLKDIV onchip\nregisters.\nIf the bus frequency is less than 10 MHz, the value\nto store in ECLKDIV/FCLKDIV is equal to:\n \"bus frequency (kHz) / 175\"\n\nIf the bus frequency is higher than 10 MHz, the value\nto store in ECLKDIV/FCLKDIV is equal to:\n \" bus frequency (kHz) / 1400  + 64\"\n(+64 (0x40) is to set PRDIV8 flag)\n\nDatasheet proposed values:\n\nbus frequency\t\tE/FCLKDIV value (decimal)\n\n 16 \tMHz\t\t73\n  8 \tMHz\t\t39\n  4 \tMHz\t\t19\n  2 \tMHz\t\t9\n  1 \tMHz\t\t4\n"

// An average programming clock of 175 kHz is chosen.

// If the oscillator frequency is less than 10 MHz, the value to store

// in ECLKDIV/FCLKDIV is equal to " oscillator frequency (kHz) / 175 ".

// If the oscillator frequency is higher than 10 MHz, the value to store

// in ECLKDIV/FCLKDIV is equal to " oscillator frequency (kHz) / 1400  + 0x40 (to set PRDIV8 flag)".

// Datasheet proposed values:

//

// oscillator frequency     ECLKDIV/FCLKDIV value (hexadecimal)

//

//  16 MHz                    $49

//   8 MHz                    $27

//   4 MHz                    $13

//   2 MHz                     $9

//   1 MHz                     $4

FLASH RELEASE   // do not interact with regular flash programming monitor

//mass erase flash

reset

wb 0x03c 0x00     //disable cop

wait 20

wb 0x100 CLKDIV  // set FCLKDIV clock divider

wb 0x104 0xFF    // FPROT all protection disabled

wb 0x105 0x30    // clear PVIOL and ACCERR in FSTAT register

wb 0x102 0x00    // clear the WRALL bit in FTSTMOD

wb 0x105 0x02

wb 0x102 0x10    // set the WRALL bit in FTSTMOD to affect all blocks

ww 0x108 0xFFFE

ww 0x10A 0xFFFF

wb 0x106 0x41    // write MASS ERASE command in FCMD register

wb 0x105 0x80    // clear CBEIF in FSTAT register to execute the command

wait 20          // wait for command to complete

//mass erase eeprom

wb 0x110 CLKDIV  // set ECLKDV clock divider

wb 0x114 0xFF    // EPROT all protection disabled

wb 0x115 0x30    // clear PVIOL and ACCERR in ESTAT register

wb 0x112 0x00    // clear the WRALL bit in FTSTMOD

wb 0x115 0x02

ww 0x118 0x0C00  // write to EADDR eeprom address register

ww 0x11A 0x0000  // write to EDATA eeprom data register

wb 0x116 0x41    // write MASS ERASE command in ECMD register

wb 0x115 0x80    // clear CBEIF in ESTAT register to execute the command

wait 20          // wait for command to complete

//reprogram Security byte to Unsecure state

reset

wb 0x03c 0x00    //disable cop

wait 20

wb 0x102 0x00    // clear the WRALL bit in FTSTMOD

wb 0x105 0x02

wb 0x100 CLKDIV  // set FCLKDIV clock divider

wb 0x100 CLKDIV  // set FCLKDIV clock divider

wb 0x104 0xFF    // FPROT all protection disabled

wb 0x105 0x30    // clear PVIOL and ACCERR in FSTAT register

wb 0x102 0x00    // clear the WRALL bit in FTSTMOD

wb 0x105 0x02

ww 0xFF0E 0xFFFE // write security byte to "Unsecured" state

wb 0x106 0x20    // write MEMORY PROGRAM command in FCMD register

wb 0x105 0x80    // clear CBEIF in FSTAT register to execute the command

wait 20          // wait for command to complete

reset

undef CLKDIV     // undefine variable

best regards,

Ladislav

[lama]

I am very sorry I do not have good news for you.

If we are able to unprotect the flash then protection loses sense. The protection can only be increased by changing FPROT. The protection also protects flash protection option field FF0A~FF0D so you are not able to avoid protection setup during reset if the protection is set by flash configuration field.

The only case when we are able to play a game with FPROT is in the special mode when FROT register can be written to any value.

The only possibility is a mass erase command which erases entire flash memory. If you use this command you must think about flash security byte (@ address FF0F) rewriting. (I hope you know difference between security and protection) After mass erase is executed the flash security byte is 0xFF which means the bits FSEC1 and FSEC0 has combination 0B11 so the MCU will be after next reset secured and you will not be able to acces the flash. The only possibility will be mass erase command (also almost all BDM commands are disabled). Correct value for these bits is 0B10 - the device is unsecured.

If your maintenance program is able to load some code to RAM and run it from it then there is possibility to erase entire flash by mass erase. Note, after reset, your maintenance code will disappear from RAM, flash is already erased so the MCU is clear and the only possibility to do anything is BDM.

If you see this answer as correct answer please mark it as correct and helpful to help others to find good answers faster. Thank you in advance.

Best Regards, Ladislav