The device is unlocked by default by virtue of a 128-bit visible unlock code programmed in the One-Time Programmable (OTP) address 0xF000 0000.The OTP contents are XOR-ed with the contents of the Unlock-By-Scan register. The outputs of these XOR gates are again combined with a set of secret internal tie-offs. The output of this combinational logic is compared against a secret, hard-wired, 128-bit value. A match asserts the UNLOCK signal, so that the device is now unlocked.
A user can lock the device by changing bits in the visible unlock code from 1 to 0. Changing a 0 to 1 is not possible because the visible unlock code is stored in the OTP flash region. Also, changing all the 128 bits to zeros is not a valid condition and will permanently lock the device.
Once locked, a user can unlock the device by scanning an appropriate value into the Unlock-By-Scan register of the AJSM module. This register is accessible by configuring an IR value of 0b1011 on the AJSM TAP. The value to be scanned is such that the XOR of the OTP contents and the contents of the Unlock-By-Scan register results in the original visible unlock code.
The Unlock-By-Scan register is reset only by asserting power-on reset (nPORRST).
A locked device only permits JTAG accesses to the AJSM scan chain through the Secondary TAP 2 of the ICEPick module. All other secondary TAPs, test TAPs, and the boundary scan interface are not accessible in this state.