Maxim Integrated MAXQ7667 - Manual (Page 16)

2-11 __________________________________________________________________________________________________________
MAXQ7667 User’s Guide
ing address of the utility ROM. The default IP setting of 8000h is assigned to allow initial in-system programming to be accomplished
with utility ROM code assistance. The utility ROM code interrogates a specific register bit in order to decide whether to execute in-sys-
tem programming or jump immediately to user code starting at 0000h. The user code reset vector should always be stored in the low-
est bytes of the program memory.
2.2.3.2 Utility ROM
A utility ROM (4K x 16) is normally placed in the upper 32KWord program memory space starting at address 8000h. This utility ROM
potentially provides the following system utility functions:
• Reset vector
• Bootstrap function for system initialization
• In-application programming
• In-circuit debug
Following each reset, the processor automatically starts execution at address 8000h in the utility ROM, allowing ROM code to perform
any necessary system support functions.
After a reset, the MAXQ7667 instruction pointer jumps to the ROM bootloader (0x8000). At this point the password location gets
checked for a valid entry. If the password space (0x0010 to 0x001F) in flash is populated by all 0s or 1s (implying that no password
has been set), the PWL bit (in SC register) is set to 0, allowing access to all the bootloader functions. Otherwise, the PWL bit gets set
to 1, preventing access to the password-protected family of commands (more on this later) and eventually the user must provide the
password to clear PWL to access all the bootloader functions.
The processor then looks for a request from the JTAG port. The JTAG port is established as the programming port before the MAXQ7667
is released from reset. While the MAXQ7667 is in reset, the SPE bit is set to 1 via the JTAG/TAP port. If the request is valid (i.e., SPE =
1, PSS = 00), the processor establishes communication between the ROM bootloader and the JTAG port. Otherwise, the UART is mon-
itored for an autobaud character: 0x0D (carriage return). If the autobaud character is detected, the UART is established as the boot-
loader communication port and the MAXQ7667 responds with 0x3E. 0x3E is the acknowledgement that a loader command has been
completed. After this, some or all of the bootloader functions are accessible through the UART, depending on password settings.
The processor jumps to the flash program space 0x0000 and starts executing application code when there is no JTAG request and a
valid password is found (PWL =1). The code execution also jumps to 0x0000 when the autobaud routine does not receive the 0x0D
character within the 5-second built-in wait.
It is still possible to load a new program through the UART or the JTAG, after the MAXQ7667 begins executing code in the flash pro-
gram space. To load code through the JTAG would merely require resetting the device and holding the device in reset while the SPE
bit is set to 1 through the JTAG/TAP port, once the reset is released the device executes in the bootloader (SPE = 1, PSS = 00). To load
new code through the UART would require the application code to call the UARTloader function in the utility ROM, which eventually
passes control to the bootloader (more on this later).
If the MAXQ7667’s password-protection feature is being used, it is important to note that setting the PWL (password lock) bit to 0
makes the MAXQ7667 vulnerable to attacks. It is recommended that after a communication link is established between the host and
the MAXQ7667, the Password Match command (03h) be executed to access the password-protected family of commands.
2.2.3.3 Data Memory
The MAXQ7667 contains 2K x 16 (4096 bytes) of on-chip data SRAM that can be mapped into either program or data space. The con-
tents of this SRAM are indeterminate after power-on reset, but are maintained during stop mode and across non-POR resets, as long
as the DVDD (CORE) supply stays within the acceptable range.
On-chip data memory begins at address x0000h and is contiguous through the internal data memory. Data memory is accessed via
indirect register addressing through a Data Pointer (@DP[n]) or Frame Pointer (@BP[OFFS]). The Data Pointer is used as one of the
operands in a MOVE instruction. If the Data Pointer is used as source, the core performs a Load operation that reads data from the
data memory location addressed by the Data Pointer. If the Data Pointer is used as destination, the core executes a Store operation
that writes data to the data memory location addressed by the Data Pointer. The Data Pointer can be directly accessed by the user
software.
The core incorporates two 16-bit Data Pointers (DP[0] and DP[1]) to support data memory accessing. All Data Pointers support indi-
rect addressing mode and indirect addressing with autoincrement or autodecrement. Data Pointers DP[0] and DP[1] can be used as
post increment/decrement source pointers by a MOVE instruction or pre increment/decrement destination pointers by a MOVE instruc-