Concepts First

• Secure Debug: puts a "lock" on the chip's JTAG debug port to prevent unauthorized access to firmware and sensitive data.
• Password mode: after setting a password and triggering, JTAG connections require the password; losing it without a backup may permanently restrict the debug port.
• Flashing is unaffected: the UART/BSP download channel is independent of the JTAG password — firmware can still be flashed in password mode.

Example Overview

This page is based on the sec_dbg_password example in the official Bouffalo SDK (examples/peripherals/sec_dbg/sec_dbg_password), which demonstrates Secure Debug password protection:

• Reads and prints the current debug state: open mode (JTAG available) / password mode / close mode;
• After a 10-second delay, writes 4 debug password words and triggers the switch (Sec_Dbg_Set_Dbg_Pwd + Sec_Dbg_Set_Dbg_Trigger), then waits until the state becomes password mode;
• In password mode, JTAG connections require the password, preventing unauthorized debug access.

Operation Steps

1

Enter the Example Directory

No external wiring is needed for this page. Open a terminal and enter the secure debug example directory (prerequisite: set up the environment as in Quick Start (Linux) or Windows):

cd examples/peripherals/sec_dbg/sec_dbg_password

2

Build the Project

Run the build command. The Ai-M62 (BL616) and Ai-M61 (BL618) belong to the same series, so both use bl616:

make CHIP=bl616 BOARD=bl616dk

3

Flash the Firmware

Connect the board with a USB cable, hold the BOOT button (IO2 on the Ai-M61-32S-Kit), briefly press EN/RST to enter download mode, then flash (replace the serial port with the one on your computer):

make flash CHIP=bl616 COMX=/dev/ttyUSB0

4

Run and Verify

Open a serial tool (baud rate 2000000). The example first prints the current debug state (Sec dbg is in open mode, JTAG available); after 10 seconds it writes 4 password words and triggers, then prints the state again as password mode (JTAG needs the password).

Code Execution Flow

The complete execution flow from startup to running is shown below (loop arrows mean repeated execution):

Note

This example changes the chip's secure debug state. Confirm the password and state per your product security policy before mass production; mistakes may permanently restrict the debug port.

APIs Used by the Example

Sec_Dbg_Read_Dbg_State()

Reads the current secure debug state: SEC_DBG_STATE_OPEN_MODE / SEC_DBG_STATE_PASSWORD_MODE / SEC_DBG_STATE_CLOSE_MODE.

Parameters: none

Return: debug state enum value

Sec_Dbg_Set_Dbg_Pwd(pwd)

Writes the debug password (4 × 32-bit words).

Parameters:

• pwd: uint32_t[4] password array

Return: 0 on success; negative error code on failure

Sec_Dbg_Set_Dbg_Trigger()

Triggers the password mode to take effect.

Parameters: none

Return: 0 on success; negative error code on failure

Sec_Dbg_Wait_Ready()

Waits until the secure debug module is ready (state switch complete).

Parameters: none

Return: 0 on success; negative error code on failure

Complete Code

The complete source below matches the effect described on this page. It is based on the official example (examples/peripherals/sec_dbg/sec_dbg_password); the LED pins are adapted to the Ai-M61/62-32S-Kit onboard RGB LED. Collapsed by default, click to expand:

📜 Click to expand sec_dbg_password/main.c full code

#include "bflb_mtimer.h"
#include "board.h"
#include "bl616_sec_dbg.h"

static void bflb_show_dbg_state(void)
{
    uint32_t state;

    state = Sec_Dbg_Read_Dbg_State();

    if(state == SEC_DBG_STATE_OPEN_MODE){
        printf("Sec dbg is in open mode\r\n");
        printf("JTAG should be available\r\n");
    }else if(state == SEC_DBG_STATE_PASSWORD_MODE){
        printf("Sec dbg is in password mode, need password\r\n");
        printf("JTAG should be unavailable\r\n");
    }else if(state == SEC_DBG_STATE_CLOSE_MODE){
        printf("Sec dbg is in close mode\r\n");
    }else{
        printf("Error! Not support!\r\n");
    }
}

int main(void)
{
    uint32_t pwd[4] = {0x12345678, 0x22345678, 0x32345678, 0x42345678};

    board_init();

    printf("password case:\r\n");

    /* Password mode, JTAG can not be connected */
    bflb_show_dbg_state();

    bflb_mtimer_delay_ms(10000);

    /* Set password */
    Sec_Dbg_Set_Dbg_Pwd(pwd);
    Sec_Dbg_Set_Dbg_Trigger();
    Sec_Dbg_Wait_Ready();

    /* Open mode, JTAG can be connected */
    bflb_show_dbg_state();

    while (1) {
        bflb_mtimer_delay_ms(1000);
    }
}

FAQ

Can I still flash in password mode?

Flashing uses the UART/BSP download channel and is not affected by the JTAG password; only JTAG debugging requires the password. If the password is lost without a backup, the debug port may be unrecoverable — proceed carefully.

How do I return to open mode?

This page only demonstrates the one-way open→password switch. Returning to open mode requires the chip's official unlock flow (usually firmware/verification), per the Bouffalo security documentation.

The state prints close mode

The chip was configured as debug-closed, so JTAG is fully unavailable; this is usually written by production tools and is expected secure behavior.

Have questions?

For any other questions, visit the unified Q&A and discussion board: Ai-Thinker Discussions