Maxim Integrated MAXQ622 User Manual
MAXQ612/MAXQ622 USER’S GUIDE
MAXQ612/MAXQ622
REGULATOR
VOLTAGE
MONITOR
GPIO
USB SIE*
TXCVR
*MAXQ622 ONLY.
16-BIT MAXQ
RISC CPU
6KB ROM
CLOCK
WATCHDOG
2x
16-BIT TIMER
SECURE MMU
128KB FLASH
6KB SRAM
8kHz NANO
RING
IR DRIVER
IR TIMER
2x SPI
2x USART
I2C
For pricing, delivery, and ordering information, please contact Maxim Direct at
1-888-629-4642, or visit Maxim Integrated’s website at www.maximintegrated.com.
Rev 2; 2/13
MAXQ612/MAXQ622 User’s Guide
TABLE OF CONTENTS
SECTION 1: Overview .........................................................................1-1
SECTION 2: Architecture .......................................................................2-1
SECTION 3: Programming ......................................................................3-1
SECTION 4: System Register Description ..........................................................4-1
SECTION 5: Peripheral Register Modules ..........................................................5-1
SECTION 6: General-Purpose I/O Module..........................................................6-1
SECTION 7: Timer/Counter Type B ...............................................................7-1
SECTION 8: IR Timer ..........................................................................8-1
SECTION 9: Serial I/O Module...................................................................9-1
SECTION 10: Serial Peripheral Interface (SPI) Module ...............................................10-1
SECTION 11: I2C Interface ....................................................................11-1
SECTION 12: Universal Serial Bus (USB) Interface (MAXQ622 Only) ...................................12-1
SECTION 13: Test Access Port (TAP) ............................................................13-1
SECTION 14: In-Circuit Debug Mode ............................................................14-1
SECTION 15: In-System Programming (JTAG) .....................................................15-1
SECTION 16: MAXQ612/MAXQ622 Instruction Set Summary..........................................16-1
SECTION 17: Utility ROM......................................................................17-1
APPENDIX 1: Data Pointer Usage Examples ..................................................... A1-1
INDEX......................................................................................I-1
REVISION HISTORY.......................................................................... R-1
ii Maxim Integrated
MAXQ612/MAXQ622 User’s Guide
SECTION 1: OVERVIEW
The MAXQM family of 16-bit reduced instruction set computing (RISC) microcontrollers is targeted towards low-cost,
low-power embedded application designs. The flexible, modular architecture design used in these microcontrollers
allows development of targeted designs for specific applications with minimal effort.
1.1 Instruction Set
The MAXQ612/MAXQ622 microcontrollers use an instruction set where all instructions are fixed in length (16 bits). A
register-based, transport-triggered architecture allows all instructions to be coded as simple transfer operations. All
instructions reduce to either writing an immediate value to a destination register or memory location or moving data
between registers and/or memory locations.
This simple top-level instruction decoding allows all instructions to be executed in a single cycle. Because all CPU
operations are performed on registers only, any new functionality can be added by simply adding new register modules. The simple instruction set also provides maximum flexibility for code optimization by a compiler.
1.2 Harvard Memory Architecture
Program memory, data memory, and register space on the MAXQ612/MAXQ622 are separate from one another and
are each accessed by a separate bus. This type of memory architecture (known as Harvard architecture) has some
advantages.
First, the word lengths can be different for different types of memory. Program memory must be 16 bits wide to accommodate the instruction word size, but system and peripheral registers can be 8 bits wide or 16 bits wide as needed.
Because data memory is not required to store program code, its width can also vary and could conceivably be targeted
for a specific application.
Also, because data memory is accessed by the CPU only through appropriate registers, it is possible for register
modules to access memory entirely independent from the main processor, providing the framework for direct memory
access operations. It is also possible to have more than one type of data memory, each accessed through a different
register set.
1.3 Register Set
Because all functions in the MAXQ612/MAXQ622 are accessed through registers, common functionality is provided
through a common register set. Many of these registers provide the equivalent of higher level op codes, by directly
accessing the ALU, the loop counter registers, and the data pointer registers. Others, such as the interrupt registers,
provide common control and configuration functions that are equivalent across the MAXQ612/MAXQ622 family of
microcontrollers.
The common register set, also known as the system registers, includes the following:
• Arithmetic logic unit (ALU) access and control registers, including working accumulator registers and the processor
status flags
• Two data pointers and a frame pointer for data memory access
• Autodecrementing loop counters for fast, compact looping
• Instruction pointer and other branching control access points
• Stack pointer and an access point to the 16-bit-wide soft stack
• Interrupt vector table and priority registers
• One code pointer for quick program memory access as data
MAXQ is a registered trademark of Maxim Integrated Products, Inc.
Maxim Integrated 1-1
MAXQ612/MAXQ622 User’s Guide
Peripheral registers (module 0 to module 5) on the MAXQ612/MAXQ622 contain registers that are used to access the
peripherals, including:
• General-purpose I/O ports
• External interrupts
• Timers/counters
• USART ports
• Serial peripheral interface (SPI™) port
• USB (MAXQ622 only)
SPI is a trademark of Motorola, Inc.
1-2 Maxim Integrated
MAXQ612/MAXQ622 User’s Guide
SECTION 2: ARCHITECTURE
This section contains the following information:
2.1 Instruction Decoding .......................................................................2-4
2.2 Register Space............................................................................2-5
2.3 Memory Organization.......................................................................2-6
2.3.1 Program Memory .....................................................................2-6
2.3.2 Utility ROM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2-6
2.3.3 Data Memory ........................................................................2-7
2.3.4 Stack Memory........................................................................2-8
2.4 Memory Management Unit...................................................................2-8
2.5 Memory Mapping..........................................................................2-8
2.5.1 Memory Mapping Into Data Space .......................................................2-9
2.5.2 Memory Mapping into Code Space.......................................................2-12
2.5.3 Memory Mapping Rules ................................................................2-14
2.5.4 Code Examples ......................................................................2-15
2.6 Memory Protection .........................................................................2-16
2.6.1 Rules for System Software ..............................................................2-17
2.6.2 Privilege Exception Interrupt ............................................................2-18
2.6.3 Memory Access Protection Impact on Data Pointers (and Code Pointer) .........................2-18
2.6.4 Debugging ..........................................................................2-20
2.6.5 Enabling Memory Protection ............................................................2-20
2.6.6 Reset Procedure and Setup of Memory Protection ...........................................2-20
2.6.7 Loader Access Control ................................................................2-22
2.6.8 Disabling MAXQ612/MAXQ622-Specific Memory Access Features ..............................2-23
2.7 Clock Generation ..........................................................................2-23
2.7.1 External Clock (Crystal/Resonator) .......................................................2-23
2.7.2 External Clock (Direct Input) ............................................................2-25
2.7.3 Internal System Clock Generation ........................................................2-25
2.8 Wake-Up Timer ...........................................................................2-25
2.8.1 Using the Wake-Up Timer to Exit Stop Mode ...............................................2-26
2.9 Interrupts ................................................................................2-26
2.9.1 Servicing Interrupts ...................................................................2-26
2.9.2 Interrupt System Operation .............................................................2-26
2.9.3 Synchronous vs. Asynchronous Interrupt Sources ...........................................2-27
2.9.4 Interrupt Prioritization by Software ........................................................2-27
2.9.5 Interrupt Exception Window .............................................................2-29
2.10 Operating Modes .........................................................................2-29
2.11 Reset Mode .............................................................................2-29
2.11.1 Power-On/Power-Fail Reset ............................................................2-29
Maxim Integrated 2-1
MAXQ612/MAXQ622 User’s Guide
2.11.2 External Reset ......................................................................2-30
2.11.3 Watchdog Timer Reset................................................................2-31
2.11.4 Internal System Reset ................................................................2-31
2.12 Power-Management Mode..................................................................2-31
2.12.1 Switchback .........................................................................2-31
2.13 Stop Mode ..............................................................................2-32
LIST OF FIGURES
Figure 2-1. MAXQ612/MAXQ622 Transport-Triggered Architecture ......................................2-3
Figure 2-2. Instruction Word Format ..............................................................2-4
Figure 2-3. MAXQ612/MAXQ622 Memory Map (64KB Program Space) ..................................2-9
Figure 2-4. CDA Functions in Word Mode..........................................................2-10
Figure 2-5. CDA Functions in Byte Mode ..........................................................2-11
Figure 2-6. CPA Impact on Code Pointer Access of Program Memory ...................................2-12
Figure 2-7. MAXQ622 Memory Map and UPA.......................................................2-13
Figure 2-8. Overview of Memory Regions ..........................................................2-21
Figure 2-9. MAXQ612/MAXQ622 Clock Sources.....................................................2-24
Figure 2-10. On-Chip Crystal Oscillator............................................................2-24
LIST OF TABLES
Table 2-1. Register-to-Register Transfer Operations..................................................2-6
Table 2-2. CDA Bits to Access Program Space as Data ..............................................2-9
Table 2-3. CPA Access of Program Data with Code Pointer ...........................................2-12
Table 2-4. Memory Areas and Associated Maximum Privilege Levels ....................................2-16
Table 2-5. PRIV Register Bit Definitions............................................................2-16
Table 2-6. Privilege Level Constants ..............................................................2-16
Table 2-7. System Clock Rate Control Settings......................................................2-25
Table 2-8. Interrupt Priority .....................................................................2-28
Table 2-9. Power-Fail Reset Check Interval.........................................................2-29
2-2 Maxim Integrated
MAXQ612/MAXQ622 User’s Guide
SECTION 2: ARCHITECTURE
The MAXQ612/MAXQ622 are designed to be modular and expandable. Top-level instruction decoding is extremely
simple and based on transfers to and from registers. The registers are organized into functional modules, which are
in turn divided into the system register and peripheral register groups. Figure 2-1 illustrates the modular architecture
and the basic transport possibilities.
CLOCK CONTROL,
WATCHDOG TIMER
AND POWER MONITOR
CKCN
WDCN
IC
INTERRUPT
LOGIC
IC
IV
IPR0
STACK
MEMORY
SP
ADDRESS
GENERATION
IP
LOOP COUNTERS
LC[
n]
BOOLEAN
VARIABLE
MANIPULATION
ACCUMULATORS
(16)
AP
APC
PSF
PROGRAM
MEMORY
MEMORY MANAGEMENT
UNIT (MMU)
INSTRUCTION
DECODE
(src, dst TRANSPORT
DETERMINATION)
DATA
MEMORY
SC
MUX
SYSTEM MODULES/
REGISTERS
DATA POINTERS
DP[0], DP[1]
FP =
(BP + OFFS)
DPC
src
dst
dst
src
PERIPHERAL MODULES/REGISTERS
USART,
SPI,
2
C
I
TIMERS/
COUNTERS
Figure 2-1. MAXQ612/MAXQ622 Transport-Triggered Architecture
Maxim Integrated 2-3
GENERAL-
PURPOSE
I/O
USB
ADDITIONAL MODULES
FOR FUTURE EXPANSION
MAXQ612/MAXQ622 User’s Guide
Memory access from the MAXQ612/MAXQ622 is based on a Harvard architecture with separate address spaces
for program and data memory. The simple instruction set and transport-triggered architecture allow the MAXQ612/
MAXQ622 to decode and execute nearly all instructions in a single clock cycle. Data memory is accessed through one
of three data pointer registers. Two of these data pointers, DP[0] and DP[1], are stand-alone 16-bit pointers. The third
data pointer, FP, is composed of a 16-bit base pointer (BP) and an offset register (OFFS). All three pointers support
postincrement/decrement functionality for read operations and preincrement/decrement for write operations. For the
frame pointer (FP = BP[OFFS]), the increment/decrement operation is executed on the OFFS register and does not
affect the base pointer (BP). Stack functionality is accessible through the stack pointer (SP). Program memory is read
accessible through the code pointer (CP), which supports postincrement/decrement functionality.
2.1 Instruction Decoding
Every MAXQ instruction is encoded as a single 16-bit word according to the format shown in Figure 2-2.
format Destination source
f d d d d d d d s s s s s s s s
Figure 2-2. Instruction Word Format
Bit 15 (f) indicates the format for the source field of the instruction as follows:
• If f equals 0, the instruction is an immediate source instruction, and the source field represents an immediate 8-bit
value.
• If f equals 1, the instruction is a register source instruction, and the source field represents the register from which
the source value is read.
Bits 0 to 7 (ssssssss) represent the source for the transfer. Depending on the value of the format field, this can either
be an immediate value or a source register. If this field represents a register, the lower 4 bits contain the module specifier and the upper 4 bits contain the register index in that module.
Bits 8 to 14 (ddddddd) represent the destination for the transfer. This value always represents a destination register,
with the lower 4 bits containing the module specifier and the upper 3 bits containing the register subindex within that
module.
Because the source field is 8 bits wide and 4 bits are required to specify the module, any one of 16 registers in that
module can be specified as a source. However, the destination field has one less bit, which means that only eight
registers in a module can be specified as a destination in a single-cycle instruction.
While the asymmetry between source and destination fields of the op code can initially be considered a limitation, this
space can be used effectively. First, since read-only registers can never be specified as destinations, they can be
placed in the second eight locations in a module to give single-cycle read access. Second, there are often critical control or configuration bits associated with system and certain peripheral modules where limited write access is beneficial
(e.g., watchdog timer enable and reset bits). By placing such bits in one of the upper 24 registers of a module, this
write protection is added in a way that is virtually transparent to the assembly source code. Anytime that it is necessary
to directly select one of the upper 24 registers as a destination, the prefix register, PFX[n], is used to supply the extra
destination bits. This prefix register write is inserted automatically by the assembler/compiler and requires one
additional execution cycle.
The MAXQ architecture is transport-triggered. This means that writing to or reading from certain register locations also
causes side effects. These side effects form the basis for the higher level op codes defined by the assembler, such
as ADDC, OR, JUMP, and so on. These op codes are actually implemented as MOVE instructions between certain
register locations, while the encoding is handled by the assembler/compiler and need not be a concern to the
programmer. The registers defined in the system register and peripheral register maps operate as described in the
documentation; the unused empty locations are the ones used for these special cases.
2-4 Maxim Integrated
MAXQ612/MAXQ622 User’s Guide
The MAXQ instruction set is designed to be highly orthogonal. All arithmetic and logical operations that use two registers can use any register along with the accumulator. Data can be transferred between any two registers in a single
instruction.
2.2 Register Space
The MAXQ612/MAXQ622 provide a total of 16 register modules. Each of these modules contains 32 registers. The first
eight registers in each module can be read from or written to in a single cycle; the second eight registers can be read
from in a single cycle and written to in two cycles (by using the prefix register, PFX[n]); the last 16 registers can be
read or written in two cycles (always requiring use of the prefix register, PFX[n]).
Registers can be either 8 or 16 bits in length. Within a register, any number of bits can be implemented; bits not
implemented are fixed at zero. Data transfers between registers of different sizes are handled as shown in Table 2-1.
• If the source and destination registers are both 8 bits wide, data is transferred bit to bit accordingly.
• If the source register is 8 bits wide and the destination register is 16 bits wide, the data from the source register is
transferred into the lower 8 bits of the destination register. The upper 8 bits of the destination register are set to the
current value of the prefix register; this value is normally zero, but it can be set to a different value by the previous
instruction if needed. The prefix register reverts back to zero after one cycle, so this must be done by the instruction
immediately before the one that would be using the value.
• If the source register is 16 bits wide and the destination register is 8 bits wide, the lower 8 bits of the source are
transferred to the destination register.
• If both registers are 16 bits wide, data is copied bit to bit.
The above rules apply to all data movements between defined registers. Data transfer to/from undefined register locations has the following behavior:
• If the destination is an undefined register, the MOVE is a dummy operation, but can trigger an underlying operation
according to the source register (e.g., @DP[n]--).
• If the destination is a defined register and the source is undefined, the source data for the transfer depends upon the
source module width. If the source is from a module containing 8-bit or 8-bit and 16-bit source registers, the source
data is equal to the prefix data concatenated with 00h. If the source is from a module containing only 16-bit source
registers, 0000h source data is used for the transfer.
The 16 available register modules are broken up into two different groups. The low six modules (specifiers 0h to5h) are
known as the peripheral register modules, while the high 10 modules (specifiers 6h to 0Fh) are known as the system
register modules. These groupings are descriptive only, as there is no difference between accessing the two register
groups from a programming perspective.
The system registers define basic functionality that remains the same across all products based on the MAXQ612/
MAXQ622 architecture. This includes all register locations that are used to implement higher level op codes as well as
the following common system features:
• ALU (16 bits) and associated status flags (zero, equals, carry, sign, overflow)
• 16 working accumulator registers (16-bit width), along with associated control registers
• Instruction pointer
• Registers for interrupt control and handling
• Autodecrementing loop counters for fast, compact looping
• Two data pointer registers, a frame pointer, and a stack pointer for data memory/stack access
• One code pointer register for program memory access
The peripheral registers define additional functionality included in the MAXQ612/MAXQ622. This functionality is broken
up into discrete modules so that only the features that are required for a given product need to be included. Because
the peripheral registers add functionality outside the common MAXQ system architecture, they are not used to implement op codes.
Maxim Integrated 2-5
MAXQ612/MAXQ622 User’s Guide
Table 2-1. Register-to-Register Transfer Operations
SOURCE REGISTER
SIZE (BITS)
8 8 — Source[7:0]
8 16 No 00h Source[7:0]
8 16 Yes Prefix[7:0] Source[7:0]
16 8 — Source[7:0]
16 16 No Source[15:8] Source[7:0]
DESTINATION
REGISTER SIZE
(BITS)
PREFIX SET?
DESTINATION SET TO VALUE
HIGH 8 BITS LOW 8 BITS
2.3 Memory Organization
Beyond the internal register space, memory on the MAXQ612/MAXQ622 microcontrollers is organized according to a
Harvard architecture, with a separate address space and bus for program memory and data memory.
To provide additional memory map flexibility, program memory space can be made accessible as data space, allowing
access to constant data stored in program memory.
2.3.1 Program Memory
Program memory begins at address 0000h and is contiguous through FFFFh (128KB). Program memory is accessed
directly by the program fetching unit and is addressed by the instruction pointer register. From an implementation
perspective, system interrupts and branching instructions simply change the contents of the instruction pointer and
force the op code fetch from a new program location. The instruction pointer is direct read/write accessible by the user
software; write access to the instruction pointer forces program flow to the new address on the next cycle following
the write. The content of the instruction pointer is incremented by one automatically after each fetch operation. The
instruction pointer defaults to 8000h, which is the starting address of the utility ROM. The default IP setting of 8000h is
assigned to allow initial in-system programming to be accomplished with utility ROM code assistance. The utility ROM
code interrogates a specific register bit in order to decide whether to execute in-system programming or jump immediately to user code starting at 0000h. The user code reset vector is stored in the lowest bytes of the program memory.
Program flash memory provides in-system programming capability, but requires that the memory targeted for the write
operation be programmed (erased). The utility ROM provides routines to carry out the necessary operations (erase,
write, verify) on flash memory.
2.3.2 Utility ROM
A utility ROM is placed in the start of the upper half of the program memory space starting at address 8000h. This utility
ROM provides the following system utility functions:
• Reset vector
• Bootstrap function for system initialization
• Utility functions to match/query customer specific secrets to prevent loading and/or operation on generic MAXQ612/
MAXQ622 parts
• In-application programming (flash versions only)
• In-circuit debug (flash versions only)
2-6 Maxim Integrated
MAXQ612/MAXQ622 User’s Guide
Following each reset, the processor automatically starts execution at address 8000h in the utility ROM, allowing utility
ROM code to perform any necessary system support functions. Next, the SPE bit is examined to determine whether
system programming should commence or whether that code should be bypassed, instead forcing execution to vector
to the start of user program code. When the SPE bit is set to 1, the processor executes the prescribed bootstrap-loader
mode program that resides in utility ROM. The SPE bit defaults to 0. To enter the bootstrap loader mode, the SPE bit
can be set to 1 during reset by the JTAG interface. When in-system programming is complete, the bootstrap loader
can clear the SPE bit and reset the device such that the in-system programming routine is subsequently bypassed.
2.3.3 Data Memory
On-chip SRAM data memory begins at address 0000h and is contiguous through 0BFFh (6KB) in word mode. Data
memory is accessed by indirect register addressing through a data pointer (@DP), frame pointer (@BP[OFFS]), or
stack pointer (PUSH/POP). The data pointer is used as one of the operands in a MOVE instruction. If the data pointer is
used as source, the CPU performs a load operation that reads data from the data memory location addressed by the
data pointer. If the data pointer is used as destination, the CPU executes a store operation that writes data to the data
memory location addressed by the data pointer. The data pointer itself can be directly accessed by the user software.
The MAXQ612/MAXQ622 incorporate two 16-bit data pointers (DP[0] and DP[1]) to support data block transfers. All
data pointers support indirect addressing mode and indirect addressing with autoincrement or autodecrement. Data
pointers DP[0] and DP[1] can be used as postincrement/decrement source pointers by a MOVE instruction or preincrement/decrement destination pointers by a MOVE instruction. Using a data pointer indirectly with “++” automatically
increases the content of the active data pointer by 1 immediately following the execution of read data transfer (@
DP[n]++) or immediately preceding the execution of a write operation (@++DP[n]). Using data pointer indirectly with
“--” decreases the content of the active data pointer by 1 immediately following the execution of read data transfer (@
DP[n]--) or immediately preceding the execution of a write operation (@--DP[n]).
The frame pointer (BP[OFFS]) is formed by 16-bit unsigned addition of frame pointer base register (BP) and frame
pointer offset register (OFFS). Frame pointer can be used as a postincrement/decrement source pointer by a MOVE
instruction or as a preincrement/decrement destination pointer. Using the frame pointer indirectly with “++” (@
BP[++OFFS] for a write or @BP[OFFS++] for a read) automatically increases the content of the frame pointer offset
by 1 immediately before or after the execution of data transfer depending upon whether it is used as a destination or
source pointer respectively. Using frame pointer indirectly with “--” (@BP[--OFFS] for a write or @BP[OFFS--] for a read)
decreases the content of the frame pointer offset by 1 immediately before/after execution of data transfer depending
upon whether it is used as a destination or source pointer, respectively. Note that the increment/decrement function
affects the content of the OFFS register only, while the contents of the BP register remain unaffected by the borrow/
carryout from the OFFS register.
In addition, the MAXQ612/MAXQ622 have a code pointer (CP) to support data block transfer from flash memory. This
allows the user to access the program flash memory as data, even when execuing from the flash. In addition, there
are some restrictions on the use of the code pointer due to memory access protection. See 2.6.3 Memory Access
Protection Impact on Data Pointers (and Code Pointer) for details. The code pointer, like the normal data pointers,
supports indirect addressing mode and indirect addressing with autoincrement or autodecrement. The code pointer
can be used as postincrement/decrement source pointer by MOVE instructions. Using the code pointer indirectly with
“++” automatically increases the content of the active code pointer by 1 immediately following the execution of the read
operation (e.g., MOVE dst, @CP++). Using code pointer indirectly with “--” decreases the content of the active code
pointer by 1 immediately following the execution of the read operation (e.g., MOVE dst, @CP--).
A normal data memory cycle using DP[0], DP[1], and FP to access SRAM takes only one system clock period to support fast internal execution. This allows read or write operations on SRAM to be completed in one clock cycle. To read
program memory as data using CP requires two system clocks. Data memory mapping and access control are handled
by the memory management unit (MMU). Read/write access to the data memory can be in word or in byte.
Maxim Integrated 2-7
MAXQ612/MAXQ622 User’s Guide
2.3.4 Stack Memory
The MAXQ612/MAXQ622 implement a soft stack that uses the on-chip data memory (SRAM) for storage of program
return addresses and general-purpose use. The stack is used automatically by the processor when the CALL, RET, and
RETI instructions are executed and when an interrupt is serviced; it can also be used explicitly to store and retrieve data
by using the PUSH, POP, and POPI instructions. The POPI instruction acts identically to the POP instruction, except
that it additionally set the IPS bits.
The width of the stack is 16 bits to accommodate the instruction pointer size. As the stack pointer register, SP, is used
to hold the index of the top of the stack, the maximum size of the stack allowed for a MAXQ612/MAXQ622 is the SRAM
data memory size.
On reset, the stack pointer SP initializes to the top of the stack (03F0h). The CALL, PUSH, and interrupt vectoring
operations increase the stack depth (decrement SP) and then store a value at the memory location pointed to by SP.
The RET, RETI, POP, and POPI operations retrieve the value at @SP and then decrease the stack depth (increment SP).
2.4 Memory Management Unit
Memory allocation and access control for program and data memory is managed by the MMU.
The MAXQ612/MAXQ622 MMU supports the following:
• Flash code memory of up to 128KB; utility ROM of 6KB and data memory SRAM of 6KB.
• In-system and in-application programming of embedded flash (flash versions only).
• Access to any of the three memory areas (SRAM, code memory, utility ROM) using the data memory pointers and
the code pointer.
• Execution from any of the program memory areas (code memory, factory written and tested utility ROM routines)
and from data memory.
Given the above capabilities, the following rules apply to the memory map:
• Program memory:
Physical program memory pages (P0, P1, P2, P3) are logically mapped into data space based upon selection of
byte/word access mode and CDA[1:0] bit settings.
• Data memory:
Access can be either word or byte.
All 16 data pointer address bits are significant in either access mode (word or byte).
The MAXQ612/MAXQ622 can merge program and data into a linear memory map. This is accomplished by mapping
the data memory into the program space or mapping program memory segment into the data space.
2.5 Memory Mapping
Figure 2-3 summarizes the MAXQ612/MAXQ622 default memory maps.
2-8 Maxim Integrated
MAXQ612/MAXQ622 User’s Guide
PROGRAM
SPACE
88FFh
3K x 16
UTILITY ROM
8000h
FFFFh
64K x 16
PROGRAM FLASH
0000h
DATA SPACE
(BYTE MODE)
17FFh
x 8
DATA SRAM
0000h
Figure 2-3. MAXQ612/MAXQ622 Memory Map (64KB Program Space)
Table 2-2. CDA Bits to Access Program Space as Data
DATA SPACE
(WORD MODE)
08FFh
x 16
DATA SRAM
0000h
CDA[1:0] SELECTED PAGE IN BYTE MODE SELECTED PAGE IN WORD MODE
00 P0 P0 and P1
01 P1 P0 and P1
10 P2 P2 and P3
11 P3 P2 and P3
2.5.1 Memory Mapping Into Data Space
The MAXQ612/MAXQ622 map program memory into data space from 0000h to FFFFh. The selection of physical program memory page or pages to be logically mapped to data space is determined by the CDA1 and CDA0 bits, as
shown in Table 2-2.
Figure 2-3 summarize the default memory maps for this memory structure. The WBSn bits of the MAXQ612/MAXQ622
default to word access mode (WBSn = 1).
The upper half of the data memory map (8000h to FFFFh) is the logical area for the utility ROM when accessed as
data. Executing code from the utility ROM allows the user to map the program memory to 8000h to FFFFh by properly
selecting the CDA bits.
Figure 2-4 and 2-5 illustrate the effects of the CDA bits.
Maxim Integrated 2-9
MAXQ612/MAXQ622 User’s Guide
WORD MODE MEMORY MAP (UPA = 0, EXECUTING FROM UTILITY ROM)
PROGRAM MEMORY
15 0
xFFFF
xA000
x8000
x0000
LOGICAL SPACE
UTILITY ROM
PHYSICAL PROGRAM
(P1)
PHYSICAL PROGRAM
(P0)
P3
P2
CDA1 = 1
CDA1 = 0
WORD MODE MEMORY MAP (UPA = 0, EXECUTING FROM PHYSICAL DATA MEMORY)
15 0
xFFFF
LOGICAL SPACE
P3
DATA MEMORY
15
PHYSICAL DATA
DATA MEMORYPROGRAM MEMORY
15
0
x8000
x4000
x0000
0
xFFFF
LOGICAL SPACE
LOGICAL DATA MEMORY
xA000
UTILITY ROM
x8000
PHYSICAL PROGRAM
(P1)
PHYSICAL PROGRAM
(P0)
x0000
P2
LOGICAL UTILITY ROM
x8000
CDA1 = 1
CDA1 = 0
x0000
Figure 2-4. CDA Functions in Word Mode
2-10 Maxim Integrated
MAXQ612/MAXQ622 User’s Guide
BYTE MODE MEMORY MAP (EXECUTING FROM UTILITY ROM)
15 0 07
xFFFF
xA000
x8000
x0000
LOGICAL SPACE
UTILITY ROM
PHYSICAL PROGRAM
(P1)
PHYSICAL PROGRAM
(P0)
CDA[1:0] = 00
BYTE MODE MEMORY MAP (EXECUTING FROM PHYSICAL DATA MEMORY)
15 0 07
xFFFF
LOGICAL SPACE
DATA MEMORYPROGRAM MEMORY
xFFFF
x8000
CDA[1:0] = 01
PHYSICAL DATA
x0000
DATA MEMORYPROGRAM MEMORY
xFFFF
LOGICAL SPACE
xA000
UTILITY ROM
x8000
x0000
PHYSICAL PROGRAM
(P1)
PHYSICAL PROGRAM
(P0)
CDA[1:0] = 01
CDA[1:0] = 00
x8000
x0000
Figure 2-5. CDA Functions in Byte Mode
Maxim Integrated 2-11
MAXQ612/MAXQ622 User’s Guide
CODE POINTER ACCESS OF WORD MODE MEMORY MAP
CODE POINTER MAPPHYSICAL PROGRAM MEMORY
15 0
xFFFF
PHYSICAL PROGRAM (P3)
15 0
PHYSICAL PROGRAM (P3)
xFFFF
PHYSICAL PROGRAM (P2)
PHYSICAL PROGRAM (P1)
PHYSICAL PROGRAM (P0)
x0000
PHYSICAL PROGRAM (P2)
PHYSICAL PROGRAM (P1)
PHYSICAL PROGRAM (P0)
CODE POINTER OF BYTE MODE MEMORY MAP
PHYSICAL PROGRAM MEMORY
15 0 07
xFFFF
PHYSICAL PROGRAM (P3)
PHYSICAL PROGRAM (P2)
PHYSICAL PROGRAM (P1)
PHYSICAL PROGRAM (P0)
x0000
CPA = 1
CPA = 0
x0000
CODE POINTER MAP
xFFFF
x0000
Figure 2-6. CPA Impact on Code Pointer Access of Program Memory
Table 2-3. CPA Access of Program Data with Code Pointer
CPA BYTE MODE ACCESS WORD MODE ACCESS
0 Lower 64KB Don’t care/no effect
1 Upper 64KB Don’t care/no effect
2.5.2 Memory Mapping into Code Space
The effective program address can be anywhere in the full 128KB memory space. Program memory from 0000h to
FFFFh is the normal user code segment, followed by the utility ROM. The top of the memory is the logical area for data
memory when accessed as a code segment. Pages P2, P3 of the program memory are not accessible for program
execution by default. These pages need to be activated by user software. The upper program access (UPA) bit must
be set to 1 to activate P2 and P3. Once UPA is set, P2 and P3 occupy the upper half of the program space, and utility
ROM and physical data memory can be accessed as data only. Figure 2-7 summarizes UPA effect.
2-12 Maxim Integrated
MAXQ612/MAXQ622 User’s Guide
MAXQ612/MAXQ622 MEMORY MAP (DEFAULT, UPA = 0)
PROGRAM MEMORY
15 0
xFFFF
LOGICAL SPACE
P3
DATA MEMORY
15
0
xFFFF
xA000
UTILITY ROM
x8000
PHYSICAL PROGRAM
(P1)
PHYSICAL PROGRAM
(P0)
x0000
MAXQ612/MAXQ622 MEMORY MAP (UPA = 1)
15
xFFFF
x8000
PROGRAM MEMORY
PHYSICAL PROGRAM
(P3)
PHYSICAL PROGRAM
(P2)
P2
x8000
LOGICAL SPACE
x4000
PHYSICAL DATA
x0000
0
15
DATA MEMORY
LOGICAL UTILITY ROM
0
xFFFF
x8000
PHYSICAL PROGRAM
(P1)
PHYSICAL PROGRAM
(P0)
x0000
LOGICAL SPACE
x4000
PHYSICAL DATA
x0000
Figure 2-7. MAXQ622 Memory Map and UPA
Maxim Integrated 2-13
MAXQ612/MAXQ622 User’s Guide
2.5.3 Memory Mapping Rules
When executing program code in a particular memory segment, the same memory segment cannot be simultaneously
accessed as data.
The following is a summary of the memory mapping rules.
• When executing from the normal user code segment:
The lower 32KWords program space (P0 and P1) is always executable as program.
The upper half of the code segment (P2 and P3) is accessible as program when UPA is set to 1.
The utility ROM is an extension of the program space if the UPA bit is 0.
The physical data memory is available for access as a code segment with offset at 0A000h if the UPA bit is 0.
Load and store operations to data memory are executed normally when addressed to the physical data memory.
The utility ROM can be read as data, starting at 08000h of the data space.
• When executing from the utility ROM (only when UPA bit is 0):
The lower 32KWords program space (P0 and P1) functions as normal program memory.
Data memory is available for access as a code segment at the upper half of the program memory map, immediately
following the utility ROM segment.
Load and store operations to data memory are executed normally when addressed to the physical data memory.
P0 can be accessed as data with offset at 08000h when CDA[1:0] = 00b in byte mode or CDA1 = 0 in word mode.
P1 can be accessed as data with offset at 08000h when CDA[1:0] = 01b in byte mode or at offset 0C000h when
CDA1 = 0 in word mode.
P2 can be accessed as data with offset at 00000h when CDA[1:0] = 10b in byte mode or CDA1 = 1 in byte mode.
P3 can be accessed as data with offset at 00000h when CDA[1:0] = 11b in byte mode or at offset 0C00h when CDA1
= 1 in word mode.
• When executing from the data memory (only when UPA is 0):
Program flows freely between the lower 32KWords user code (P0 and P1) and the utility ROM segment.
The utility ROM can be accessed as data with offset at 08000h.
P0 can be accessed as data with offset at 0000h when CDA[1:0] = 00b in byte mode or CDA1 = 0 in word mode.
P1 can be accessed as data with offset at 0000h when CDA[1:0] = 01b in byte mode or at offset 04000h when CDA1
= 0 in word mode.
P2 can be accessed as data with offset at 00000h when CDA[1:0] = 10b in byte mode or CDA1 = 1 in byte mode.
P3 can be accessed as data with offset at 00000h when CDA[1:0] = 11b in byte mode or at offset 0C00h when CDA1
= 1 in word mode.
2-14 Maxim Integrated
MAXQ612/MAXQ622 User’s Guide
2.5.4 Code Examples
Because the MAXQ622 uses the maximum allowed program flash supported by this core, the most extreme example
of data pointer access would be the final bytes of the flash in byte mode. This can be accomplished by executing from
data memory (requiring the UPA bit to be cleared) and setting the CDA bits to map program segment P3 to the data
memory area. Code to read the final 3 bytes of the flash is shown below. This code would need to be executed from
data memory. Note that it is assumed that memory access protection, system clocking, etc., are all configured to allow
this access.
move SC, #00B0 ; UPA=0, CDA[1:0]=11
move DPC, #0000 ; SDPS[1:0]=00, WBS0=0
move DP[0], #07FFD ;Point to 3 addresses from top of prog mem mapped intodata
move ACC, @DP[0]++ ; Move first byte to ACC to check and post increment
call CHECKB1 ; call subroutine to check first byte
move ACC, @DP[0]++ ; Move second byte to ACC to check and post increment
call CHECKB2
move ACC, @DP[0] ; Move final byte to ACC
call CHECKB3
Alternatively, the code pointer could be used for the same purpose. The advantage of this is that no code loading to
data memory is required and the UPA bit does not affect the operation. Also, the mechanism for accessing the upper
(P3) segment is a little different, using only the CPA bit instead of the CDA bits to access the upper 64KB of program
memory (since the code pointer uses the entire 64K address space for code).
move SC, #0040 ; CPA=1
move DPC, #0000 ; CWBS=0
move CP, #0FFFD ; Point to 3 addresses from very top
move ACC, @CP++ ; Move first byte to ACC to check and post increment
call CHECKB1 ; call subroutine to check first byte
move ACC, @CP++ ; Move second byte to ACC to check and post increment
call CHECKB2
move ACC, @CP ; Move final byte to ACC
call CHECKB3
The above code could be called directly from user code in the program flash; however, each access would require two
system clock cycles to complete as opposed to the usual one cycle for data pointer access.
Maxim Integrated 2-15
MAXQ612/MAXQ622 User’s Guide
2.6 Memory Protection
The MAXQ612/MAXQ622 support privilege levels for code. When enabled, code memory is separated into three areas.
Each area has an associated privilege level. RAM/utility ROM are assigned privilege levels as well:
• Code in the system area can be confidential. Code in the user areas can be prevented from reading and writing
system code.
• The user loader can be protected from user application code.
Table 2-4. Memory Areas and Associated Maximum Privilege Levels
AREA PAGE ADDRESS MAXIMUM PRIVILEGE LEVEL
System 0 to ULDR-1 High
User Loader ULDR to UAPP-1 Medium
User Application UAPP to top Low
Utility ROM N/A High
Other (RAM) N/A Low
The PRIV register reflects the current execution privilege. Hardware guarantees that the contents of PRIV are never
higher than the maximum privilege level of the memory area the code is running from. For example, if user code were
trying to set PRIV to high, this would be prevented by hardware. However, any code can decide to lower the privilege
level at any time (see Equation 1).
PRIV = min(maxprivilege(IP), PRIV) (Equation 1)
The bit contents of the PRIV register are shown in Table 2-5. The convenient constants high/medium/low are defined
in Table 2-6, but all values from 00b to 11b can be used.
In addition to the PRIV register, the privilege level can also be set by writing to PRIVT0 and PRIVT1 in sequence. Again,
hardware guarantees that the contents of PRIVT0 are never higher than the maximum privilege level of the memory
area the code is running from.
When writing to PRIVT1, hardware modifies the PRIV register based on Equation 2.
PRIV = min(PRIVT0, argument, maxprivilege(IP)) (Equation 2)
This means that, when using PRIVT[1:0], the privilege level cannot be raised unless all code between the writes to
PRIVT0 and PRIVT1 executes. Writing to PRIV automatically resets PRIVT0 to low.
Table 2-5. PRIV Register Bit Definitions
BIT
MEANING
3 2 1 0
System Write System Read User Loader Write User Loader Read
Table 2-6. Privilege Level Constants
BIT
HIGH
MEDIUM
LOW
In addition to the PRIV register, the privilege level can also be set by writing to PRIVT0 and PRIVT1 in sequence. Again,
hardware guarantees that the contents of PRIVT0 are never higher than the maximum privilege level of the memory
area the code is running from.
When writing to PRIVT1, hardware modifies the PRIV register based on
2-16 Maxim Integrated
3 2 1 0
1 1 1 1
0 0 1 1
0 0 0 0
PRIV’ = min(PRIVT0, argument, maxprivilege(IP))
MAXQ612/MAXQ622 User’s Guide
This means that when using PRIVT0/PRIVT1, the privilege level cannot be raised unless all code between the writes to
PRIVT0 and PRIVT1 executes. Writing to PRIV automatically resets PRIVT0 to low.
2.6.1 Rules for System Software
While privilege levels are implemented in hardware, there are two ways user code could try to circumvent the memory
access protection:
• Manipulation of shared, common stack or registers
• Jumping or calling to code in system memory that is not an official entry point
To ensure a safe system and prevent these attacks, the system code programmer must follow the following rules:
• System code must not save and restore the privilege level. Instead, every interrupt and every system library function that raises the privilege must also unconditionally lower the privilege before exiting. If there are interrupts
that lower the privilege level, or interrupt code running outside of system space, any code that raises the privilege
must disable interrupts for the duration of the privileged operation.
Example:
interrupt:
move IGE, #0
move PRIV, #HIGH
… ; action
move PRIV, #LOW
move IGE, #1
reti
system_code:
move IGE, #0
move PRIV, #HIGH
... ; action
move PRIV, #LOW
move IGE, #1
ret
• An operation that requires high privilege levels must not call subroutines to raise the privilege level.
Example:
incorrect:
call raise_priv
… ; action
move PRIV, #LOW
correct:
move PRIV, #HIGH
… ; action
move PRIV, #LOW
Maxim Integrated 2-17
MAXQ612/MAXQ622 User’s Guide
• A system library function that checks arguments before raising the privilege level must do so in an atomic fashion using PRIVT0 and PRIVT1 to prevent short-circuiting the check (the rule about disabling interrupts also applies).
Example:
system_library:
move IGE, #0
move PRIVT0, #HIGH
… ; check
jump ne, exit move PRIVT1, #HIGH
; … action
exit:
move PRIV, #LOW
move IGE, #1
ret
2.6.2 Privilege Exception Interrupt
Any attempt to exceed the current privilege level causes a privilege exception interrupt that can be handled by system
code. Examples that cause an interrupt are writing high to PRIV from user code, or trying to read system code while
PRIV is low. The intent of the interrupt is to notify low priority code when an operation was denied by hardware.
2.6.3 Memory Access Protection Impact on Data Pointers (and Code Pointer)
Memory access protection complicates the use of the data and code pointers. In the MAXQ architecture, code pointers
must be activated before use in order for memory data to be available on the same cycle it is needed using synchronous RAMs. This means that data is essentially prefetched into the physical data pointer when the pointer is activated
(e.g., by loading an address to DP[0]). This can have some unintended consequences with respect to the memory
protection function.
Specifically, when MPE is enabled, and when executing from RAM, any write to the traditional MAXQ data pointers,
DP[0], DP[1], and BP, OFFS, or DPC, has the potential to generate a memory fault.
For example, a scenario in which code is executed from RAM is presented. In this particular case, the code is stored in
a serial EEPROM. The code is loaded dynamically into RAM when needed. It is assumed this code has to have access
to RAM variables, and remember we are executing from RAM.
To accomplish this without memory access protection, the customer would configure DPC and load DP[0] and then
call the utility ROM function UROM_moveDP0. The code would look like the following:
MOVE DPC, #REQUIRED_DP0_MODE ; (1)
MOVE DP[0], #REQUESTED_RAM_ADDRESS ; (2)
LCALL UROM_MOVEDP0 ; (3)
; actual ROM function
MOVE DP[0], DP[0] ; (3a)
MOVE GR, @DP[0] ; (3b)
RET ; (3c)
In the above example, (1) and (2) are both considered valid pointer activation instructions. In the MAXQ transfertriggered architecture every standard instruction represents a MOVE from a source (SRC) to a destination (DST). The
POP ACC instruction is equivalent to MOVE ACC, @SP--, JUMP LABEL is equivalent to MOVE IP, #LABEL, and so on.
With the exception of a handful of arithmetic and logical instructions, every instruction is interpreted as a MOVE DST,
SRC operation.
2-18 Maxim Integrated
MAXQ612/MAXQ622 User’s Guide
This is no different for instructions that operate on data pointers. For example, a pointer to pointer move such as MOVE
@DP[1], @DP[0] first requires the read pointer to be activated. Architecturally, this strobes the chip enable and read
signals on the memory mapped to the location in DP[0]. This value is latched internally so that it is available when @
DP[0] is used as the source operand. At that time, the internally latched data is transferred to the destination register.
This functions normally when memory protection is not enabled. However if MPE is set the same code can cause a
memory protection fault. For this example let us assume the following:
1) The code is executing from RAM
2) REQUESTED_RAM_ADDRESS is defined as #0000h
3) Flash memory is located from 0000h–7FFFh
MOVE DPC, #REQUIRED_DP0_MODE ; Activates DP[0]
; In this MMU mapping,
; addresses 0-7FFFh are in Flash
; and *if* the previous contents
; of DP[0], modified by DPC, are
; in System space, we will generate
; a memory fault
MOVE DP[0], #REQUESTED_RAM_ADDRESS ; Again, activates DP[0]
; Now we know that DP[0]
; points to address 0000h
; and in the current MMU
; mapping, we are
; definitely pointing to
; *and reading from*
; System space in flash.
; MEMORY FAULT GUARANTEED
LCALL UROM_MOVEDP0 ; Changes MMU mapping. In
; this case, addresses
; 0-7FFFh point to RAM
; actual ROM function
MOVE DP[0], DP[0] ; ACTIVATE DP[0] in RAM
; space. If we studied
; the above discussion
; carefully, we know that
; *activate* means *read*
MOVE GR, @DP[0] ; Transfer the latched
; DP[0] value to GR
RET ;
So, if MPE is enabled and the memory fault interrupt is enabled, the first two instructions generate a memory fault and
the corresponding interrupt is executed. To avoid a memory fault under these circumstances, a function must be written in flash. This function has to take as an input, the address to be accessed, but it must be passed using a nonpointer
register (such as an accumulator register). The RAM code routine would write the address into this register (e.g., A[0]).
Maxim Integrated 2-19
MAXQ612/MAXQ622 User’s Guide
Next, the RAM routine calls into the flash function. Once we are executing out of flash, we can activate the DP[0] pointer
without causing a memory fault because the MMU now maps RAM into address range 0–7FFFh and ROM to higher
addresses. None of this space is MPE protected. That flash routine would look similar to this:
// this routine must be implemented in flash
ReadRAM:
push DPC
move DPC, #18h
move DP[0], A[0]
move A[0] @DP[0]
pop DPC
ret
The corresponding RAM routine looks like:
;
; No pointer activation from RAM code
;
MOVE A[0], #REQUESTED_RAM_ADDRESS
LCALL ReadRAM
2.6.4 Debugging
Note that debugging system code (including trace, break, memory dump, etc.) is disabled once memory protection
is enabled.
2.6.5 Enabling Memory Protection
Memory protection is always enabled unless the system password is empty. Utility ROM initialization code is responsible for checking the password and clearing the memory protection enable (MPE) bit.
2.6.6 Reset Procedure and Setup of Memory Protection
Utility ROM code as well as system and user loader code is responsible for setting up the memory protection boundaries.
Both passwords and memory area boundary definitions are loaded from code memory. These values are part of the system, user loader, and user application image files, and are defined when assembling or compiling the code image files.
Example for the System Image:
org 0000h
; Reset
move CP, #usr_ldr_page
move ULDR, @CP
jump sys_init
org 000Fh
user_ldr_page:
; Starting page address of user loader
dw 0020h ; Page 32
org 0010h
; System password
dw …, …, …, …
org 0020h
interrupt0:
2-20 Maxim Integrated
MAXQ612/MAXQ622 User’s Guide
TOP (128KB)
APPL
USR APP PASSWORD
USR LDR PASSWORD
STARTUP
SYS PASSWORD
STARTUP
USR APP START
IVT IVT IVT
IVT IVT IVT
USR LDR START
UAPP
ULDR
0000
LDR
USER
SYSTEMUSER
+10h
+10h
20h
10h
RESET/STARTUP DEBUG LOCK
Figure 2-8. Overview of Memory Regions
Figure 2-8 shows the code memory with passwords and the location of the values that are programmed into the ULDR/
UAPP registers.
The user loader starting page address is located at 0Fh, one word before the system password. The user application
starting page address is stored one word before the user loader password (i.e., ULDR*Flash page size + 0Fh).
The startup sequence is as follows:
1) The system resets at 8000h and starts running utility ROM code. On a 64KB part with flash pages of 512 bytes,
ULDR and UAPP are at their reset values of 80h (end of flash memory). The PRIV register is at its reset value of
high. The MPE (memory protection enable bit) is at its reset value of 1 (enable).
2) Utility ROM initialization code checks the system password and disables MPE if the password is empty.
3) After utility ROM initialization is complete, the utility ROM passes execution to system code memory at address
0000h.
4) System code starts executing and uses a CP of 0Fh to read the user loader starting page address and writes it into
the ULDR register.
5) After system initialization is complete, system code jumps to address ULDR*Flash page size + 0000h. This jump
automatically drops PRIV to medium.
6) The user-loader code starts executing and uses a CP of ULDR*Flash page size + 0Fh to read the user application
starting page address and writes it into the UAPP register.
7) After user loader initialization is complete, user-loader code jumps to address UAPP*Flash page size + 0000h. This
jump automatically drops PRIV to low.
Maxim Integrated 2-21
MAXQ612/MAXQ622 User’s Guide
2.6.7 Loader Access Control
As stated previously, the MAXQ612/MAXQ622 have three memory regions: system, user loader, and application. The
loader maintains a context register to determine which of the regions is to be the target of the loader commands. Family
0 and Family F commands have no context. They are global in scope. For details on the nonparty-specific loader commands, refer to Application Note 4012: Implementing a JTAG Bootloader Master for the MAXQ2000 Microcontroller.
There are two Family F loader commands specific to the MAXQ612/MAXQ622:
Command 0xF0: GetContext
Input : None
Output : Context Byte – 00x00, SystemContext; 0x01, LoaderContext; 0x2, ApplicationContext
Command 0xF1” SetContext
Input : Context Byte – 0x00, SystemContext; 0x01, LoaderContext; 0x02, ApplicationContext
Output : Sets Error Code (retrieved using Getstatus bootloader command)
The bootloader sets a default context based on the lowest privileged region that exists. The default context is selected
according to the following rules:
If all three regions exist:
The user application context (UAPP_CONTEXT).
If only system and user application regions exist:
The user application context.
If only system and user loader regions exist:
The user loader context (ULDR_CONTEXT).
If only the system region exists:
The system context (SYSTEM)CONTEXT). Only the default context will have its password tested and
corresponding PWL bit cleared. The context can be changed through the Family F commands shown above, but the
password for the new region is not tested after a context change and, therefore, a password match loader command
must be sent to clear the password lock bit of the associated region even if the password for that region is clear.
If the system password has not been set, memory protection is disabled by the ROM. If word address 000Eh in the
system code region is programmed (any value other than 0xFFFF), the debug lockout condition is set by setting
SC.DBGLCK to 1 (all debug functions are disabled).
The “current context” is used by the loader to determine how to apply master erase and password-protected loader
commands. The master erase command erases pages starting at the base address of the current context and all
pages with addresses greater than the base address. Password-protected commands check the password lock bit of
the current region. The unlock password command uses the password from the current region (indicated by the current
context) to determine the state of the current region password lock.
The loader provides several commands that require a password and a master erase command that does not.
All password-protected commands check the following:
• System password match: Access to full memory
• Loader password match: Access to user memory
• Application password match: Access to user application memory
• No match: No access
Three PWL bits allow the loader to find out whether a password match was successful. The PWL bits for system and
user loader can only be written by utility ROM code (see Section 15.2 Password-Protected Access).
Master erase does not require a password and defaults to erasing the user application only. Two Family F commands
are added that allow master erase of user loader and system code:
• Master erase system: Complete system erase.
• Master erase user loader: Erases user loader and user application.
2-22 Maxim Integrated
MAXQ612/MAXQ622 User’s Guide
2.6.8 Disabling MAXQ612/MAXQ622-Specific Memory Access Features
The MAXQ612/MAXQ622 memory-protection features are specific to the MAXQ612/MAXQ622 family of parts and can
cause some confusion in the way that they impact debugging and bootloader commands when compared to MAXQ
parts. To enable users to develop initial firmware as quickly as possible, the following code can be added to your
application code to disable the memory protection features and allow code loading and debugging in the same manner as previous parts:
ORG 0
Jump Start
ORG 000eh
Debug_Lockout:
DW 0ffffh ; disable debug lockout
ORG 000fh
ULDR_PageNumber:
DW 0ffffh ; do not define a user loader page
ORG 0010h
System_PassworD:
DW offffh,offffh, offffh,offffh, offffh,offffh, offffh,offffh
DW offffh,offffh, offffh,offffh, offffh,offffh, offffh,offffh
ORG 0020h
; interrupt vectors go here
ORG 0100h
Start:
; Your application code here
;…
END
Once the memory-protection features are fully understood, this code can be removed from the user’s application code
to enable memory access control.
2.7 Clock Generation
All functional modules in the MAXQ612/MAXQ622 are synchronized to a single system clock with the exception of the
wake-up timer. The internal clock circuitry generates the system clock from one of two possible sources:
• Internal oscillator, using an external crystal or resonator
• External clock signal
The external clock and crystal are mutually exclusive since they are input through the same clock pin. Each time code
execution must start or restart (as can be the case when exiting stop mode) using the external clock source, the following sequence occurs:
• Reset the crystal warmup counter.
• Allow the required warmup delay: 8192 external clock cycles if exiting from stop mode.
• Code execution starts after the crystal warmup sequence.
2.7.1 External Clock (Crystal/Resonator)
An external quartz crystal or a ceramic resonator can be connected from HFXIN to HFXOUT determining the frequency,
as illustrated in Figure 2-10. The fundamental mode of the crystal operates as inductive reactance in parallel resonance
with external capacitance to the crystal.
Maxim Integrated 2-23
MAXQ612/MAXQ622 User’s Guide
POWER-ON
RESET
STOP
CRYSTAL KILL
HF
CRYSTAL
8kHz
RING
RESET
XDOG
STARTUP
TIMER
CLK INPUT
WAKE-UP TIMER
MAXQ612
MAXQ622
CLOCK
DIVIDER
XDOG DONE
GLITCH-FREE
DIV 1
DIV 2
SELECTOR
DIV 4
MUX
DIV 8
PMM
DEFAULT
RESET DOG
WATCHDOG
TIMER
ENABLE
CLOCK
GENERATION
RWT
RESET
WATCHDOG RESET
WATCHDOG INTERRUPT
SYSTEM CLOCK
SWB
INTERRUPT/SERIAL PORT
RESET
STOP
STOP
POWER-ON
RESET
Figure 2-9. MAXQ612/MAXQ622 Clock Sources
HFXIN
HFXOUT
C1
C2
Figure 2-10. On-Chip Crystal Oscillator
V
DD
R
F
R
= 1MΩ ±50%
F
CLOCK CIRCUITRY
STOP
MAXQ612
MAXQ622
2-24 Maxim Integrated
MAXQ612/MAXQ622 User’s Guide
Crystal specifications, operating temperature, operating voltage, and parasitic capacitance must be considered when
designing the internal oscillator. The MAXQ612/MAXQ622 are designed to operate at a 12MHz maximum frequency.
To further reduce the effects of external noise, a guard ring can be placed around the oscillator circuitry.
Pins HFXIN and HFXOUT are protected by clamping devices against on-chip electrostatic discharge. These clamping
devices are diodes parasitic to the feedback resistor RF in the oscillator’s inverter circuit. The inverter circuit is presented as a NAND gate that can disable clock generation in stop mode.
Noise at HFXIN and HFXOUT can adversely affect on-chip clock timing. It is good design practice to place the crystal
and capacitors near the oscillator circuitry and connect to HFXIN, HFXOUT, and ground with a direct shot trace. The
typical values of external capacitors vary with the type of crystal used and should be initially selected based on the
load capacitance as suggested by the crystal manufacturer.
For cost-sensitive applications, a ceramic resonator can be used instead of a crystal. Using the ceramic resonator can
require a different circuit configuration and capacitance value.
2.7.2 External Clock (Direct Input)
The MAXQ612/MAXQ622 CPU can also obtain the system clock signal directly from an external clock source. In this
configuration, the clock generation circuitry is driven directly by an external clock.
To operate the MAXQ612/MAXQ622 from an external clock, connect the clock source to HFXIN and connect HFXOUT
to GND. The clock source should be driven through a CMOS driver. If the clock driver is a TTL gate, its output must
be connected to VDD through a pullup resistor to ensure a satisfactory logic level for active clock pulses. To minimize
system noise on the clock circuitry, the external clock source must meet the maximum rise and fall times and the minimum high and low times specified for the clock source. The external noise can affect clock generation circuit if these
parameters do not meet the specification.
2.7.3 Internal System Clock Generation
The internal system clock is derived from the currently selected oscillator input. By default, one system clock cycle is
generated per oscillator cycle, but the number of oscillator cycles per system clock can also be increased by setting
the power-management mode enable (PMME) bit and the clock-divide control (CD[1:0]) register bits according to
Table 2-7.
Table 2-7. System Clock Rate Control Settings
PMME CD[1:0] CYCLES PER CLOCK
0 00 1 (default)
0 01 2
0 10 4
0 11 8
1 xx 256
2.8 Wake-Up Timer
The MAXQ612/MAXQ622 provide a simple wake-up timer that can trigger an interrupt after a user-definable number of
internal 8kHz ring cycles. Since the wake-up timer is running off the internal ring and keeps running even during stop
mode, it can be used to wake the MAXQ612/MAXQ622 up from stop mode at periodic intervals.
To use the wake-up timer, the WUT register should be written first (before the wake-up timer is started) to define the
countdown interval. Once the time interval has been defined, the wake-up timer can be started by setting the WTE bit
to 1. The time interval until the wake-up timer counts down to zero is defined by:
f
x WUT[15:0]
NANO
With the maximum possible time interval being:
f
x (216 - 1)
NANO
Maxim Integrated 2-25
MAXQ612/MAXQ622 User’s Guide
2.8.1 Using the Wake-Up Timer to Exit Stop Mode
To use the wake-up timer to exit stop mode after a predefined period of time, the following conditions must be met
before entering stop mode:
• The WUT register must be written to define the countdown interval value.
• The WTE bit must be written to 1 to start the wake-up timer.
• The IGE (IC.0) bit must be set to 1 to enable global interrupts. The wake-up timer cannot wake the MAXQ612/
MAXQ622 up from stop mode if its interrupt does not fire.
2.9 Interrupts
The MAXQ612/MAXQ622 provide a hardware interrupt handler with interrupt vector (IV) table base address register
and the interrupt control (IC) register. The IV register is fixed at 0020h and acts as the vector table base location.
Interrupts can be generated from system level sources (e.g., watchdog timer) or by sources associated the peripheral
modules. The interrupt vectors are preset at eight fixed memory address offsets from IV with hardware priority control
that can be programmed through the interrupt priority register zero (IPR0 and IPR1).
2.9.1 Servicing Interrupts
For the MAXQ612/MAXQ622 to service an interrupt, interrupt handling must be enabled globally and locally. The IGE
bit located in the IC register acts as a global interrupt mask that affects all interrupts, with the exception of the powerfail warning interrupt. This bit defaults to 0, and it must be set to 1 before any interrupt handling takes place.
The local interrupt-enable bit for a particular source is in one of the peripheral registers associated with that peripheral
module or in a system register for any system interrupt source. When an interrupt condition occurs, its individual flag
is set, even if the interrupt source is disabled at the local or global level. Interrupt flags must be cleared within the user
interrupt routine to avoid repeated interrupts from the same source.
The handler uses three levels of interrupt priorities that allow the user software to select a suitable priority for an interrupt vector source. The interrupt handler (hardware) modifies the interrupt priority status bits (IPSn) when it is servicing
an interrupt. These bits are set to 11b by the interrupt handler when executing a RETI instruction.
2.9.2 Interrupt System Operation
The interrupt handler responds to any interrupt event when it is enabled. An interrupt event occurs when an interrupt
flag is set. All interrupt requests are sampled at the rising edge of the clock, and can be served by the processor one
clock cycle later, assuming the request does not hit the interrupt exception window. The one cycle stall between detection and acknowledgement/servicing is due to the fact that the current instruction could also be accessing the stack,
or that the current instruction could be a prefix register (PFX[n]) write. For this reason, the CPU must allow the current
instruction to complete before pushing the stack and vectoring to the proper interrupt vector table address. If an interrupt exception window is generated by the currently executing instruction, the following instruction must be executed,
thus the interrupt service routine is delayed an additional cycle.
Interrupt operation in the MAXQ612/MAXQ622 CPU is essentially a state-machine-generated long CALL instruction. When the interrupt handler services an interrupt, it temporarily takes control of the CPU to perform the following
sequence of actions:
1) The next instruction fetch from program memory is cancelled.
2) The return address is pushed on to the stack.
3) The IPS bits are set to the current interrupt level to prevent recursive interrupt calls from interrupts of lower priority.
4) The instruction pointer is set to the location of the interrupt service routine as defined by the interrupt source.
5) The CPU begins executing the interrupt service routine.
Once the interrupt service routine completes, it should use the RETI instruction to return to the main program. Execution
of RETI involves the following sequence of actions:
1) The return address is popped off the stack.
2-26 Maxim Integrated
Loading...