H
L
H
L
H
L
L
H
. . .
. . .
128-bit comparator
H
L
L
H
H
L
L
H
UNLOCK
Flash Module Output
OTP Contents
Unlock By Scan
Register
Internal Tie-Offs
(example only)
(example)
L
H
H
L
L
Internal Tie-Offs
(example only)
L
H
H
91
TMS570LS0714
www.ti.com
SPNS226E – JUNE 2013 – REVISED NOVEMBER 2016
Submit Documentation Feedback
Product Folder Links:
TMS570LS0714
System Information and Electrical Specifications
Copyright © 2013–2016, Texas Instruments Incorporated
6.20.6 Advanced JTAG Security Module
This device includes a an Advanced JTAG Security Module (AJSM) module. The AJSM provides
maximum security to the memory content of the device by letting users secure the device after
programming.
Figure 6-16. AJSM Unlock
The device is unsecure by default by virtue of a 128-bit visible unlock code programmed in the OTP
address 0xF0000000. The OTP contents are XOR-ed with the contents of the "Unlock By Scan" register.
The outputs of these XOR gates are again combined with a set of secret internal tie-offs. The output of
this combinational logic is compared against a secret hard-wired 128-bit value. A match results in the
UNLOCK signal being asserted, so that the device is now unsecure.
A user can secure the device by changing at least 1 bit in the visible unlock code from 1 to 0. Changing a
0 to 1 is not possible because the visible unlock code is stored in the One Time Programmable (OTP)
flash region. Also, changing all 128 bits to zeros is not a valid condition and will permanently secure the
device.
Once secured, a user can unsecure the device by scanning an appropriate value into the "Unlock By
Scan" register of the AJSM module. This register is accessible by configuring an IR value of 0b1011 on
the AJSM TAP. The value to be scanned is such that the XOR of the OTP contents and the Unlock-By-
Scan register contents results in the original visible unlock code.
The Unlock-By-Scan register is reset only upon asserting power-on reset (nPORRST).
A secure device only permits JTAG accesses to the AJSM scan chain through the Secondary Tap 2 of the
ICEPick module. All other secondary taps, test taps, and the boundary scan interface are not accessible in
this state.