Instruction Manual

13-11 _________________________________________________________________________________________________________
MAXQ7667 User’s Guide
13.4 Password-Protected Access
Some applications require preventive measures to protect against simple access and viewing of program code memory. To address
this need for code protection, the MAXQ7667 utility ROM that manages in-system programming, in-application programming, or in-cir-
cuit debugging grants full access to those utilities only after a password has been supplied. The password is defined as the 16 words
(32 bytes) of physical program memory at addresses 0x0010 to 0x001Fh. Note that using these memory locations as a password does
not exclude their usage for general code space if a unique password is not needed. A single password-lock bit (PWL) is implement-
ed in the SC register. When the PWL is set to 1 (default at power-up when a password is found at 0010h–001Fh word), a password is
required to access the in-circuit debug and in-system programming ROM routines that allow reading or writing of internal memory.
When PWL is cleared to 0, all ROM routines are accessible without a password.
The PWL bit defaults to 1 by a power-on reset. To access the ROM utilities, a correct password is needed; otherwise, access to the
ROM utilities is denied. Once the user supplies the correct password, the ROM clears the password lock. The PWL remains clear until
either a power-on reset occurs or it is set to logic 1 by user software.
For the MAXQ7667, the password is always known for a fully erased device since the unprogrammed state of these memories is all
ones. Password data set to all ones or all zeros for all 16 words at addresses 0010h–001Fh will remove the password lock by setting
the PWL bit to 0. Once the memory has been programmed, a password is established and can be used for access protection. The util-
ity ROM code denies access to the protected routines when PWL indicates a locked state.
13.4.1 Entering a Password
A password can be entered in two ways:
• Via the UART interface. After a connection is established between the host and the bootloader through the UART, the password
command can be executed to allow access to all the family of commands. The unlock password command requires 32 bytes of
data to compare with the program memory password.
• Via the TAP interface directly by issuing the Unlock Password debug mode command. The Unlock Password command requires
32 follow-on transfer cycles each containing a byte value to be compared with the program memory password.
13.5 JTAG Bootloader Operation
Maxim’s JTAG interface board and most development tools take care of the item covered in this section, therefore this section can be
skipped by most users.
The JTAG bootloader can only be entered after a reset. To enter the bootloader, the MAXQ7667 must be held in the reset state by keep-
ing the
RESET pin low. While the RESET pin is low the MAXQ7667 core is inactive, but the JTAG/TAP is available and operational. At this
time the SPE bit can be set, and, when the RESET pin is released, the MAXQ7667 core becomes operational and the code jumps to the
bootloader and eventually looks for the SPE bit state, which if set, establishes the communication between the JTAG and the bootloader.
The following explanation shows the steps to set the SPE bit and establish a link to the bootloader. The reader must be familiar with
Section 11: Test Access Port (TAP) before proceeding further.
To enable the bootstrap loader and establish a desired communication channel, the MAXQ7667 first must be reset and the reset pin
must be kept low. Through a host device, the system programming instruction (100b) must be loaded into the TAP instruction register
using the IR-scan sequence. Once the instruction is latched in the instruction parallel buffer (IR[2:0]) and is recognized by the TAP
controller in the update-IR state, a 3-bit data shift register is activated as the communication channel for DR-scan sequences. The TAP
retains the system programming instruction until a new instruction is shifted in or the TAP controller returns to the test-logic-reset state.
This 3-bit shift register formed between the TDI and TDO pins is directly interfaced to the 3-bit Serial Programming Buffer Register
(SPB) in the TAP module (which is accessible via JTAG). The SPB register contains three bits with the following functions:
•
SPB.0: System Programming Enable (SPE). Setting this bit to logic 1 denotes that system programming is desired upon exit-
ing reset. When it is cleared to logic 0, no system programming is needed through JTAG. The reset vector examines the logic
state of SPE in the utility ROM to determine the program flow after a reset. When SPE = 1, the bootstrap loader selected by the
PSS[1:0] bits are activated to perform a bootstrap-loader function. When SPE = 0, the utility ROM can either transfer execution
control to the application code (if PWL = 1) or to the UART bootloader (if PWL = 0) routine (where further testing is done to deter-
mine if a request is pending to establish a link between UART and the bootloader).