C8051F040/1/2/3/4/5/6/7

Rev. 1.5 181

Figure 15.1. Flash Program Memory Map and Security Bytes

Flash Read Lock Byte

Bits7-0: Each bit locks a corresponding block of memory. (Bit7 is MSB).

0: Read operations are locked (disabled) for corresponding block across the JTAG interface.

1: Read operations are unlocked (enabled) for corresponding block across the JTAG inter-

face.

Flash Write/Erase Lock Byte

Bits7-0: Each bit locks a corresponding block of memory.

0: Write/Erase operations are locked (disabled) for corresponding block across the JTAG

interface.

1: Write/Erase operations are unlocked (enabled) for corresponding block across the JTAG

interface.

NOTE: When the highest block is locked, the security bytes may be written but not erased.

Flash access Limit Register (FLACL)

The content of this register is used as the high byte of the 16-bit Software Read Limit

address. This 16-bit read limit address value is calculated as 0xNN00 where NN is replaced

by content of this register on reset. Software running at or above this address is prohibited

from using the MOVX and MOVC instructions to read, write, or erase Flash locations below

this address. Any attempts to read locations below this limit will return the value 0x00.

0xFE00

0xFDFE

Program/Data

Memory Space

0x0000

0xFDFF

Read Lock Byte

Write/Erase Lock Byte

Software Read Limit

Reserved

0xFDFD

SFLE = 0

Bit

Memory Block

C8051F040/1/2/3/4/5 C8051F046/7

0xC000 - 0xDFFF

0xE000 - 0xFDFD

0xA000 - 0xBFFF

0x8000 - 0x9FFF

0x4000 - 0x5FFF

0x6000 - 0x7FFF

0x2000 - 0x3FFF

0x0000 - 0x1FFF

Read and Write/Erase Security Bits.

(Bit 7 is MSB.)

0x007F

0x0000

Scratchpad Memory

(Data only)

SFLE = 1

0x8000

0x7FFE

Program/Data

Memory Space

0x0000

0x7FFF

Read Lock Byte

Write/Erase Lock Byte

Software Read Limit

Reserved

0x7FFD

C8051F040/1/2/3/4/5

C8051F046/7

No effect

0x4000 - 0x5FFF

0x6000 - 0x7FFD

0x2000 - 0x3FFF

0x0000 - 0x1FFF

C8051F040/1/2/3/4/5/6/7

182 Rev. 1.5

The lock bits can always be read and cleared to logic 0 regardless of the security setting applied to the

block containing the security bytes. This allows additional blocks to be protected after the block containing

the security bytes has been locked. Important Note: The only means of removing a lock once set is to

erase the entire program memory space by performing a JTAG erase operation (i.e., cannot be

done in user firmware). Addressing either security byte while performing a JTAG erase operation

will automatically initiate erasure of the entire program memory space (except for the reserved

area). This erasure can only be performed via JTAG. If a non-security byte in the 0xFBFF-0xFDFF

(C8051F040/1/2/3/4/5) or 0x7DFF-0x7FFF (C8051F046/7) page is addressed during the JTAG era-

sure, only that page (including the security bytes) will be erased.

The Flash Access Limit security feature (see Figure 15.1) protects proprietary program code and data from

being read by software running on the C8051F04x. This feature provides support for OEMs that wish to

program the MCU with proprietary value-added firmware before distribution. The value-added firmware

can be protected while allowing additional code to be programmed in remaining program memory space

later.

The Software Read Limit (SRL) is a 16-bit address that establishes two logical partitions in the program

memory space. The first is an upper partition consisting of all the program memory locations at or above

the SRL address, and the second is a lower partition consisting of all the program memory locations start-

ing at 0x0000 up to (but excluding) the SRL address. Software in the upper partition can execute code in

the lower partition, but is prohibited from reading locations in the lower partition using the MOVC instruc-

tion. (Executing a MOVC instruction from the upper partition with a source address in the lower partition

will always return a data value of 0x00.) Software running in the lower partition can access locations in both

the upper and lower partition without restriction.

The Value-added firmware should be placed in the lower partition. On reset, control is passed to the value-

added firmware via the reset vector. Once the value-added firmware completes its initial execution, it

branches to a predetermined location in the upper partition. If entry points are published, software running

in the upper partition may execute program code in the lower partition, but it cannot read the contents of

the lower partition. Parameters may be passed to the program code running in the lower partition either

through the typical method of placing them on the stack or in registers before the call or by placing them in

prescribed memory locations in the upper partition.

The SRL address is specified using the contents of the Flash Access Register. The 16-bit SRL address is

calculated as 0xNN00, where NN is the contents of the SRL Security Register. Thus, the SRL can be

located on 256-byte boundaries anywhere in program memory space. However, the 512-byte erase sector

size essentially requires that a 512 boundary be used. The contents of a non-initialized SRL security byte

is 0x00, thereby setting the SRL address to 0x0000 and allowing read access to all locations in program

memory space by default.

C8051F040/1/2/3/4/5/6/7

Rev. 1.5 183

15.3.1. Summary of Flash Security Options

There are three Flash access methods supported on the C8051F04x devices; 1) Accessing Flash through

the JTAG debug interface, 2) Accessing Flash from firmware residing below the Flash Access Limit, and 3)

Accessing Flash from firmware residing at or above the Flash Access Limit.

Accessing Flash through the JTAG debug interface:

1. The Read and Write/Erase Lock bytes (security bytes) provide security for Flash access

through the JTAG interface.

2. Any unlocked page may be read from, written to, or erased.

3. Locked pages cannot be read from, written to, or erased.

4. Reading the security bytes is always permitted.

5. Locking additional pages by writing to t

he security bytes is always permitted.

6. If the page containing the security bytes is unloc

ked, it can be directly erased. Doing so will

reset the security bytes and unlock all pages of Flash.

7. If the page containing the security bytes is loc

ked, it cannot be directly erased. To unlock the

page containing the security bytes, a full JTAG device erase is required. A full JTAG

device erase will erase all Flash pages, including the page containing the security bytes and

the security bytes themselves.

8. The Reserved Area cannot be read from, written to, or erased at any time.

Accessing Flash from firmware residing below the Flash Access Limit:

1. The Read and Write/Erase Lock bytes (security bytes) do not

restrict Flash access from user

firmware.

2. Any page of Flash except the page containing th

e security bytes may be read from, written to,

or erased.

3. Th

e page containing the security bytes cannot be erased. Unlocking pages of Flash can

only be performed via the JTAG interface.

4. The page containing the security bytes may be re

ad from or written to. Pages of Flash can be

locked from JTAG access by writing to the security bytes.

5. The Reserved Area cannot be read from, written to, or erased at any time.

Accessing Flash from firmware residing

at or above the Flash Access Limit:

1. The Read and Write/Erase Lock bytes (security bytes) do not

restrict Flash access from user

firmware.

2. Any page of Flash at or above the Flash Access Lim

it except the page containing the security

bytes may be read from, written to, or erased.

3. Any page of Flash below the Flash Access Limit cannot be read from, written to, or erased.

4. Code branches to locations below the Flash Access Limit are permitted.

5. Th

e page containing the security bytes cannot be erased. Unlocking pages of Flash can

only be performed via the JTAG interface.

6. The page containing the security bytes may be re

ad from or written to. Pages of Flash can be

locked from JTAG access by writing to the security bytes.

7. The Reserved Area cannot be read from, written to, or erased at any time.

Part #	C8051F041-GQ
Description	MCU 8BIT CISC 64KB FLASH 3V 64TQFP - Trays
Category	IC
Availability	In Stock
Qty	2

C8051F041-GQ

Related Items

Technical Document