Maxim Integrated MAXQ7666 - Manual (Page 320)

12.3 JTAG Bootloader Operation
The MAXQ7665/MAXQ7666 JTAG bootloader uses the same status bit handshaking hardware as is used for in-circuit debugging.
When the SPE bit of the system programming buffer (SPB) is set to 1 and JTAG is selected as the programming source (PSS1:PSS0 =
00b), the background and active-debug-mode state machines are disabled. Once the host loads the debug instruction into the TAP
instruction register (IR2:IR0), the 10-bit shift register interfaces to ICDB and the status bits becomes available for host-to-ROM boot-
loader communication. The status bits should be interpreted as noted in Table 12-2 for a JTAG bootloader operation.
When the using the JTAG bootloader option (SPE = 1, PSS1:PSS0 = 00b), the sole purpose of the debug hardware is to simultaneously
transfer the data byte shifted in from the host into the ICDB register and transfer the contents of an internal holding register (loaded by
ROM code writes of ICDB) into the shift register for output to the host. This transfer takes place on the falling edge of TCK at the update-
DR state. The debug hardware additionally clears the TXC bit at this point in the state diagram. The ROM-loader code controls the sta-
tus bit output to the host by asserting TXC = 1 when it has valid data to be shifted out. The ROM code can flexibly implement what-
ever communication protocol and command set it wishes within the data byte portion of the shifted 10-bit word. The communication
protocol implemented as part of the MAXQ7665/MAXQ7666 utility ROM JTAG bootloader is described in
Section 12.5.
12.4 Password-Protected Access
Some applications require preventive measures to protect against simple access and viewing of program code memory. To address
this need for code protection, the MAXQ7665/MAXQ7666 utility ROM that manages in-system programming, in-application program-
ming, or in-circuit debugging grants full access to those utilities only after a password has been supplied. The password is defined as
the 16 words of physical program memory at addresses 0010h to 001Fh. Note that using these memory locations as a password does
not exclude their usage for general code space if a unique password is not needed. A single password-lock bit (PWL) is implement-
ed in the SC register. When the PWL is set to 1, a password is required to access the in-circuit debug and in-system programming
ROM routines that allow reading or writing of internal memory. When PWL is cleared to 0, these utilities are fully accessible through the
utility ROM without a password.
The PWL bit defaults to 1 by a power-on reset. To access the ROM utilities, a correct password is needed; otherwise, access to the
ROM utilities is denied. Once the user supplies the correct password, the ROM clears the password lock. The PWL remains clear until
either a power-on reset occurs or it is set to logic 1 by user software.
For the MAXQ7665/MAXQ7666, the password is always known for a fully erased device since the unprogrammed state of these mem-
ories is all ones. Password data set to all ones or all zeros for all 16 words at addresses 0010h to 001Fh will remove the password lock,
regardless of the state of the PWL bit. Once the memory has been programmed, a password is established and can be used for access
protection. The utility ROM code denies access to the protected routines when PWL indicates a locked state.
MAXQ7665/MAXQ7666 User’s Guide
12-5
Table 12-2. JTAG Status Decode
BITS (1:0) STATUS CONDITION
0 0 Reserved Invalid condition
0 1 Reserved Invalid condition
1 0 Loader-Busy
ROM loader is busy executing code or
processing the current command.
1 1 Loader-Valid
ROM loader is supplying valid output data to
the host in current shift operation.
Maxim Integrated