Home

Microcontrollers On Chip Debug Support

1. Monitor to Host Data Transfer Receive The CRSYNC bit signals the monitor CPU that the external host wants to receive a new COMDATA value It is set in Communication Mode with the active rd request signal for the IO READ WORD instruction The CRSYNC bit is automatically cleared when the monitor CPU writes to COMDATA independent of the mode Communication Mode or RW Mode The host can request data CRSYNC is not reset during Update DR do something in RW Mode and then fetch the requested data with the next receive cycle Table 4 3 CRSYNC bit CRSYNC Description 1 Host requests monitor to write a value to COMDATA 0 No read requests pending Host to Monitor Data Transfer Send The CWSYNC bit signals the monitor CPU that the external host has written a new value to the COMDATA register It is set in Communication Mode with the IO WRITE WORD instruction The CWSYNC bit is cleared when the monitor CPU sets the CW ACK acknowledge bit in IOSR independent of the mode Communication Mode or RW Mode This allows sending data in Communication Mode switching to RW Mode and then doing some other operations without having to wait until the monitor User s Manual 48 V 1 1 2001 08 OCDS C166S V 1 0 _ On Chip Debug Support C Infineon C166S Cerberus Module has read COMDATA The next time that Communication Mode is entered busy bits are output when COMDATA was not already read by the monitor Note t
2. C Infineon C166S JTAG API User s Manual 58 V 1 1 2001 08 OCDS C1665 V 1 0 Infineon goes for Business Excellence Business excellence means intelligent approaches and clearly defined processes which are both constantly under review and ultimately lead to good operating results Better operating results and business excellence mean less idleness and wastefulness for all of us more professional success more accurate information a better overview and thereby less frustration and more satisfaction Dr Ulrich Schumacher http www infineon com Published by Infineon Technologies AG
3. If a debug monitor is interrupted by a user task with higher priority the DEBUG_STATE and OCDS_P_SUSPEND bits and the peripheral suspend signal are not changed The EVENT_SOURCE bits are set independently from the EVENT_ACTION field in the associated debug event control register with the exception 000 None These bits must be reset by the debugger Note For the equal comparisons the TRGEVT_E_CMPx bits are set only when the associated comparison was enabled SELECT_E field in DTREVT These bits must be reset by the debugger 2 6 3 Task ID Register DTIDR DTIDR Task ID Register Reset value 00004 la a ee Me 10 na NG AG 2 lot TASKID oo Field Bits Type Description TASKID 15 0 rw Input to the hardware trigger event generation unit Chapter 2 4 1 Intended to be used by advanced real time operating systems to store the task ID of the active task User s Manual 20 V 1 1 2001 08 OCDS C1668 V 1 0 lt On Chip Debug Support C Infineon C166S OCDS Module 2 6 4 Instruction Pointer Register DIP and DIPX These registers are provided to make the instruction pointer PC visible when the CPU is in Halt Mode Chapter 2 5 3 DIP Instruction Pointer Register Reset value 0000 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 IP l rh l ji Field Bits Type Description IP 15 0 rh Bits 15 0 of the current instruction pointer in Halt Mode Note
4. features of the C166S CPU by the application programmer is not intended Their use is reserved for professional debugger and emulation tools OCDS Module Features e Hardware software and external pin breakpoints e Up to four instruction pointer breakpoints e Masked comparisons for hardware breakpoints e The OCDS can also be configured by a monitor e Single stepping with monitor or CPU halt e PC is visible in Halt Mode e Compliant to Nexus Class 1 and higher User s Manual 3 V 1 1 2001 08 OCDS C1668 V 1 0 _ On Chip Debug Support C Infineon C166S Overview Features and Applications OCDS Module Applications The purpose of OCDS is to debug the user software running on the CPU in the customer s system This is done with an external debugger that controls the OCDS via the independent debug port Cerberus Features e Generic serial link to access the whole 24 bit user address space e Efficient high performance protocol e External host controls all transactions e JTAG Interface is used as control and data channel e Generic memory read write functionality RW Mode e Full support for communication between monitor and external debugger e Optional error protection e Security mechanism to allow authorized access only e Low end tracing through reads writes triggered by the OCDS e Fast tracing through transfer to external bus e Analysis register for internal bus locking situations e Several Cerberusses can be
5. trigger combination Hardware triggers Debug event Execution ofa processing DEBUG instruction Break pin input HH4W _ Figure 2 1 OCDS Module Block Diagram Debug events e Hardware trigger combination e Execution of a DEBUG instruction e Break pin input Debug event actions e Halt the CPU e Call a monitor e Trigger a data transfer DPEC executed by Cerberus e Activate external pin User s Manual 5 OCDS C1668 V 1 0 Event Actions Halt Monitor DPEC Activate pin V 1 1 2001 08 lt On Chip Debug Support C Infineon C166S OCDS Module Register Overview Table 2 1 OCDS Register Overview Register Description DBGSR Debug status register DEXEVT Specifies action if external break pin asserted DSWEVT Specifies action if a DEBUG instruction is executed DTREVT Combination criteria for hardware triggers and resulting action DCMPDP Data programming register for the compare registers DCMPx DCMPSP Select and programming register for the compare registers DCMPx DCMPO Hardware event equal comparison register 0 DCMP1 Hardware event equal comparison register 1 DCMP2 Hardware event equal comparison register 2 DCMPG Hardware event range comparison register greater DCMPL Hardware event range comparison register less DIP Instruction pointer register DIPX Instruction pointer register extension DTIDR Task ID
6. 000033h tdi tdo 10001111111100110000000000000000000 01000111101110011000000000000000000 Figure 4 5 Example IO SET ADDRESS Figure 4 6 shows the behavior of the JTAG I O Interface for the IO WRITE WORD instruction There is 1 busy bit and the first data bit is shifted in parallel with the start bit Note that in this case the TDI TDO behavior is the same as for a JTAG BYPASS instruction To avoid this under all circumstances the external host has to shift in 1 bit after the I O instruction until it the start bit occurs on TDO Example 2 in Figure 4 5 IO WRITE WORD IOCONF 01h RWDATA 1234h IOADDR 000033h td tdo 00101000101100010010000 00010100010110001001000 Figure 4 6 Example IO WRITE WORD User s Manual 40 V 1 1 2001 08 OCDS C166S V 1 0 _ On Chip Debug Support C Infineon C166S Cerberus Module Figure 4 7 shows the behavior of the JTAG I O Interface for the IO READ WORD instruction There are 3 busy bits followed by the start bit The following bits on TDO are the data value In the second case the read data is shifted out twice for error protection including upper unused byte 1 O READ WORD IOCONF 01h RWDATA 1234h IOADDR 000033h tdi 1010111111111111111111111 tdo 0101011100010110001001000 2 IO READ WORD IOCONF 01h RWDATA 1234h IOADDR 000033h tdi 101011111111111111111111111111111111111111111111111111111 tdo 010101110001011000100100
7. 1 0 15 V 1 1 2001 08 _ On Chip Debug Support C Infineon C166S OCDS Module 2 6 1 Debug Event Control Registers DEXEVT DSWEVT DTREVT Each possible source of a debug event has an associated register that defines which action should be taken when that debug event is raised The debug event control registers have the same structure for all currently defined sources DEXEVT DSWEVT Break Pin and Software Debug Event Control Registers Reset value 0000 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 ACT PER 0 0 0 0 0 0 0 0 0 0 pin O stp EVENT ACTION rw rw rw Field Bits Type Description EVENT_ACTION 2 0 rw Defines action taken on debug event 000 None 001 Software Debug Mode 010 Halt Debug Mode 011 Reserved 100 Reserved 101 Execute DPEC 110 Reserved 111 Set event source bit in DBGSR only PERIPHERALS STOP 3 rw 0 Peripherals are not affected by this event 1 Sensitive peripherals suspend operation if event occurs 4 0 Reserved ACTIVATE PIN 5 rw 0 External pin always inactive 1 External pin is active during debug event 15 6 0 Reserved EVENT ACTION specifies what happens when the associated debug event is raised The event specifier can have one of the indicated values For Software and Halt Mode the lower two bits of the EVENT ACTION set the DEBUG STATE field in DBGSR The PERIPHERALS STOP bit controls
8. 8 7 6 5 4 3 2 1 0 RST RST olololojo o olojo 0 0 0 o o HET Aer Ww Ww Field Bits Type Description RST_HLT 0 W Halt after reset 0 No effect 1 Halt mode after reset RST HLT P 1 W 0 Bit protection RST HLT unchanged 1 RST HLT will be changed 15 2 0 Reserved User s Manual 33 V 1 1 2001 08 OCDS C166S V 1 0 _ On Chip Debug Support C Infineon C166S JTAG Module 3 4 Steps to Initialize the JTAG Module 1 JTAG Reset TRSTN pin is set active low and then inactive again 2 Set CCONF Register IR Scan Shift in CCONF SET 104 instruction DR Scan Shift 00034 in CCONF register for halt after reset otherwise 0000p Note Due to the delay flip flop for CCONF also as in Figure 3 4 17 bits need to be shifted in effectively in the DR scan LSB first 3 SetlO PATH Register IR Scan Shift in JTAG IO SELECT PATH C0y instruction DR Scan Shift 10g in CCONF register Note Due to the delay flip flop Figure 3 4 3 bits need to be shifted in effectively in the DR scan LSB first 4 Set Cerberus Data Scan IR Scan Shift in JTAG IO INSTRUCTION1 C1pj instruction Now Cerberus is selected and ready to operate User s Manual 34 V 1 1 2001 08 OCDS C1665 V 1 0 On Chip Debug Support C Infineon C166S Cerberus Module 4 Cerberus Module Cerberus is a versatile and high performance access port using the JTAG pins
9. El G B 0 E STATE O EN wh rwh mh mh rwh rwh rwh Field Bits Type Description DEBUG ENABLED 0 rwh 0 OCDS is disabled 1 OCDS is enabled 1 0 Reserved DEBUG_STATE 3 2 rwh_ Current debug state 00 User Mode 01 Software Debug Mode 10 Halt Debug Mode 11 Reserved OCDS P SUSPEND 4 mh 0 No effect 1 Sensitive peripherals suspend their operation 6 5 0 Reserved TRGEVT R CMP 7 rwh 0 Range comparison did not match 1 Comparison matched for the current event TRGEVT E CMPO 8 rwh 0 Equal comparison 0 did not match 1 Comparison matched for the current event TRGEVT E CMP1 9 rwh 0 Equal comparison 1 did not match 1 Comparison matched for the current event User s Manual 19 V 1 1 2001 08 OCDS C1668 V 1 0 _ On Chip Debug Support C Infineon C166S OCDS Module Field Bits Type Description TRGEVT E CMP2 10 rwh 0 Equal comparison 2 did not match 1 Comparison matched for the current event 12 11 0 Reserved EVENT SOURCE 15 13 rwh Reports source of the last debug event xx1 External break pin DEXEVT x1x DEBUG instruction executed DSWEVT 1xx Hardware trigger combination DTREVT The OCDS P SUSPEND bit controls the peripheral suspend signal If set to 1 all sensitive peripherals will suspend This bit is set by a debug event according to the associated PERIPHERALS_STOP bit in the active debug event control register This bit must be reset by the debugger Note
10. Instructions of Write Type IO Instruction IO SET ADDRESS Delayed UN Delayed TDI ja IO WRITE BLOCK IO WRITE WORD IO WRITE BYTE IO SET TRADDR TDO IO instr 1 write data ela busy bits start optional bit IO Instructions of Read Type ma e a 1 TDI as above don t care dc 4 O READ BLOCK ii IO READ WORD IO CLIENT ID IO SUPERVISOR roo saw o waaa start bit Figure 4 2 Serial Bit Stream Syntax for TDI and TDO in Shift DR State 4 1 3 1 0 Instructions Table 4 1 lists the I O instructions Unlike the JTAG instructions of the JTAG Module Chapter 3 2 they are not transferred to the JTAG instruction register with an IR Scan but are the first four bits of a DR Scan to the shift register of Cerberus Table 4 1 Cerberus 1 0 Instructions Instructions Code Type Description IO CONFIG Oy W Set the configuration register IOCONF IO SET ADDRESS 14 W Set the address register IOADDR IO WRITE BLOCK 24 W Write data block starting with the address in IOADDR IO READ BLOCK 3 R Read data block starting with the address in IOADDR IO WRITE WORD 44 W RW mode Write word Com mode Send word IO READ WORD 5y R RW mode Read word Com mode Request word Reserved 7y 6y User s Manual 37 V 1 1 2001 08 OCDS C1665 V 1 0 _ On Chip Debug Support C Infineon C166S Cerberus Module Table 4 1 Cerberus I O Instructions cont d Instructions Code
11. MASK_E 12 rw 0 Unmasked equal comparison Figure 2 2 1 Masked equal comparison SELECT_E 14 13 rw Select equal comparison Table 2 7 COM_RE 15 rw Equal and range comparison combination 0 ocds trgevt signal is trg_r OR trg_e 1 ocds trgevt signal is trg_r AND trg e User s Manual 17 V 1 1 2001 08 OCDS C166S V 1 0 On Chip Debug Support C Infineon C166S OCDS Module 1 The first option OR is intended to be used for the case mux_r mux_e only and in particular to have four IP triggers In case of different comparison sources this option results in a complex behavior because the triggers of for instance IP and W_ADR are created in different pipeline stages of the CPU The COM R field enables the range comparison to be included in the ocds trgevt generation Figure 2 2 For in range comparisons DCMPG is used as the upper boundary and DCMPL is the lower boundary For out of range comparisons it is the other way round Table 2 6 lists the options Table 2 6 COM R Field of DTREVT Value trg_r signal 00 0 not enabled 01 In range 1 if DCMPG gt input gt DCMPL otherwise 0 10 Reserved 11 Out of range 1 if DCMPG gt input or input gt DCMPL otherwise 0 The MASK_E bit distinguishes between masked or unmasked input for the equal comparison Figure 2 2 In the masked case DCMPO controls the relevant bits for the comparison All bits of the input signal where the a
12. Mode is enabled already or not because it is not affected by a chip reset The application of RW ENABLED is described in Chapter 4 5 CRSYNC CWSYNC CW_ACK and COM SYNC bits are used in Communication Mode Chapter 4 3 2 The DBG ON bit indicates whether an external debugger is present It is directly controlled by the internal JTAG reset signal The application of DBG ON is described in Chapter 4 5 The CLNT ON bit indicates whether this Cerberus is currently selected by the external debugger It is directly controlled by the Cerberus select signal that is set with the IOPATH register in the JTAG Module The application of CLNT ON is described in Chapter 4 3 5 The MTR CTRL field can be used by a monitor to control the tracing of memory locations Chapter 4 3 5 Note that this feature may be used only if no external debugger controls Cerberus across the JTAG Interface User s Manual 46 V 1 1 2001 08 OCDS C166S V 1 0 sa On Chip Debug Support C Infineon C166S Cerberus Module 4 3 Operation Modes 4 3 1 RW Mode RW Mode is used by the external host to read or write memory locations In RW Mode the instructions IO READ WORD lO WRITE WORD IO READ BLOCK IO WRITE BLOCK and IO WRITE BYTE are used in their generic meaning The data address is in IOADDR and is set with IO SET ADDRESS RW Mode needs the DPEC Interface to actively request data reads or writes Entering RW Mode RW Mode is entered when the RW ENABLED bit
13. State Machine is the heart of the JTAG Module It is also referred to as the Test Access Port TAP Controller All state transitions occur on a positive TCK clock edge and are controlled by the TMS pin Figure 3 3 After reset TRSTN the state machine is in reset testlogic state With TMS low and a positive edge on TCK it is brought to run test idle state All further state transitions are done in a similar manner The JTAG state machine has two parallel control paths One is for the JTAG instruction register located in the JTAG Module Figure 3 2 the other is for the selected data scan register The instruction register selects the scan chain for the next data scan The JTAG scanning scheme allows scan registers of arbitrary length to be captured and updated gt ShiftDR p e Figure 3 3 JTAG Controller State Machine User s Manual 29 V 1 1 2001 08 OCDS C1668 V 1 0 Infineon technologies 3 2 On Chip Debug Support C166S JTAG Instructions JTAG Module The instructions listed in Table 3 1 are transferred to the JTAG instruction register of the JTAG Module during a JTAG IR scan Table 3 1 JTAG Instructions Opcode Range Type Instruction Select signal 0000 0000 004 074 IEEE1149 EXTEST 0000 0001 8 instr INTEST 0000 0010 SAMPLE PRELOAD 0000 0011 RUNBIST 0000 0100 IDCODE 0000 0101 USERCODE 0000 0110 CLAMP 0000 0111
14. This is to be used in critical routines where the system cannot be interrupted to signal to the external world that a particular event has happened This feature could also be useful to synchronize the internal and external debug hardware or to do profiling In most cases the break out pin is active O for as long as the trigger condition is met 2 5 5 Single Stepping Single stepping can be done in Halt Mode or with a debug monitor Single Stepping in Halt Mode For this behavior the trigger condition is set to be always true example trigger on IP range with DCMPL 000000 DCMPG 0000014 COM_R 11g and COM RE Op and the BREAK_AFTER_MAKE bit is set in DTREVT After every restart the CPU will be halted again when the next instruction has been executed Single Stepping with a Debug Monitor The advantage of this type of single stepping is that the system can serve high priority interrupt requests Chapter 2 5 2 The basic approach is similar to the single stepping in Halt Mode with two differences e The event action is set to Call a monitor e The code of the interrupt service routines and of the debug monitor may not be part of the IP address trigger range It is recommended to adjust the IP address trigger range to the current C function of the user code This results in a step over behavior if sub functions are called within this function If a step in behavior is required an additional single IP address trigger can be set to
15. Type Description IO_WRITE_BYTE 8 W RW mode Write byte Com mode Reserved Reserved 94 IO SET TRADDR Ay W Set the TRADDR register IO SUPERVISOR By R Acknowledge resets and analyze bus locking situations Reserved Ey Cy IO CLIENT ID Fu R Read the Client ID IO CONFIG is used to abort RW Mode write operations and to configure Cerberus with the IOCONF register The IO CONFIG instruction never produces any busy bits Note that when the IO CONFIG instruction becomes active the last RW mode write operation is aborted soft reset IO SET ADDRESS sets the address IOADDR for the next RW Mode access IO READ WORD is used to read data in RW Mode or to receive data in Communication Mode IO READ BLOCK is for RW Mode only The only difference from IO READ WORD is that the address for IO READ BLOCK is post incremented by a word address Read instructions can be aborted when the external host sets the Update DR state For IO READ WORD in Communication Mode at least 4 shift cycles must occur after the output of the start bit to acknowledge the read This prevents the loss of read data words IO WRITE WORD is used to write data in RW Mode or to send data in Communication Mode IO WRITE BLOCK is used in RW Mode only The only difference from IO WRITE WORD is that the address for IO WRITE BLOCK is post incremented by a word address For all write instructions also for IO WRITE BYTE at least 4 shift cycl
16. devices or systems are intended to be implanted in the human body or to support and or maintain and sustain and or protect human life If they fail it is reasonable to assume that the health of the user or other persons may be endangered C1668 On Chip Debug Support Infineon technologies thinking C166S Revision History 2001 08 V 1 1 Previous Version V1 0 Page Subjects major changes since last revision 23 Common Considerations on Accessing OCDS Registers 24 General Workaround to Avoid Software Problems with OCDS Language corrections We Listen to Your Comments Any information within this document that you feel is wrong unclear or missing at all Your feedback will help us to continuously improve the quality of this document Please send your proposal including a reference to this document to ce cmd infineon com pa _ On Chip Debug Support C Infineon C166S 1 Overview Features and Applications 3 2 OCDSModule 5 2 1 LER maana es mata e e ls Sone a s be eee ee ee 5 2 2 Enabling and Disabling the OCDS 7 2 3 Reset to Halt Mode 8 2 4 Debug Event Sources 9 2 4 1 Hardware Trigger Combinations 9 2 4 2 Executio
17. generation unit is programmable with the DTREVT debug event control register It consists of two paths The upper path is for one range comparisons and the lower path for three equal comparisons The equal path can be optionally configured for two masked equal comparisons The configuration options are described in detail in Chapter 2 6 1 User s Manual 9 V 1 1 2001 08 OCDS C1668 V 1 0 afin On Chip Debug Support C Infineon aes OCDS Module com_r mask_e TASKID Figure 2 2 Hardware Trigger Generation Unit User s Manual 10 V 1 1 2001 08 OCDS C1668 V 1 0 gs On Chip Debug Support C Infineon C166S OCDS Module 2 4 2 Execution of a DEBUG Instruction There is a mechanism through which software can explicitly generate a debug event This can be used for instance by a debugger to patch code held in RAM in order to implement breakpoints A special DEBUG opcode D140 instruction is defined that is a User Mode instruction and its operation is dependent on whether OCDS is enabled If OCDS is enabled the DEBUG instruction causes a debug event to be raised and the action specified in the DSWEVT debug control register is taken If OCDS is not enabled the DEBUG instruction is treated as a NOP 2 4 3 Break Pin Input An external debug break pin is provided to allow the debugger to asynchronously interrupt the processor The action taken when this signal is asserted is specified in the DEXEVT debug co
18. host wants to send IO WRITE WORD or receive IO READ WORD a value The monitor must poll this I O status register IOSR The IOADDR register is not used Host and monitor exchange data directly with the COMDATA register For the synchronization of host and monitor accesses there are four associated control bits CRSYNC CWSYNC CW ACK and COM SYNC in Cerberus status register IOSR User s Manual 47 V 1 1 2001 08 OCDS C1665 V 1 0 On Chip Debug Support C Infineon C166S Cerberus Module CRSYNC CWSYNC and COM SYNC are set and cleared by hardware but can be read by the monitor CPU On the JTAG side they affect the start biton TDO CW ACK is set by the monitor and acknowledges that the sent value was read from COMDATA Communication Mode assures that all send and receive transactions are served under all conditions in the correct sequence even if Cerberus changes to RW Mode in the meantime For bidirectional communication the host simply switches between the IO READ WORD and IO WRITE WORD instructions Entering Communication Mode Communication Mode is the default mode after reset If Cerberus is in RW Mode Communication Mode is entered when the external host writes a O to the MODE bit in the IOCONF register Communication Mode Instructions Communication Mode uses only the IO WRITE WORD and IO READ WORD instructions An IO SET ADDRESS instruction sets IOADDR just as in RW Mode no effect for Communication Mode
19. only 4 1 Operational Overview Cerberus is operated by the external debugger across the JTAG Module Block Diagram The Cerberus Core contains the JTAG Shift Core as a sub block shown in Figure 4 1 The JTAG Shift Core is controlled by the JTAG signals and therefore is asynchronous to the other parts of the Cerberus Core Cerberus dirty_bit io_tdo_o wr_request tck i PD Bus Interface Control ig request jm_reset_n_i jm shift dr i jm update dr i JTAG Shift io instr C jm sel io i tdi i Figure 4 1 Cerberus Block Diagram User s Manual 35 V 1 1 2001 08 OCDS C1668 V 1 0 _ On Chip Debug Support C Infineon C166S Cerberus Module 4 1 1 Definitions RW Mode and Communication Mode Cerberus can be used for two different purposes The first is to read and write memory locations I O Mode and the second is to exchange data with a program monitor running on the CPU Communication Mode Error Protection The JTAG Standard does not include any error protection for serial transmission TDI and TDO pins and control TMS pin However there are some ways to include error protection without extending too much beyond the JTAG framework Error protection for input data TDI is achieved by making it directly observable on the output pin TDO with one clock cycle delay Output data can be shifted out twice multiple and then compared for maximum error protection Busy Cerberus is co
20. the TDO output is the TDI input delayed by one TCK cycle 3 3 2 ID Register The ID register is not part of the JTAG Module its implementation is a product specific decision This allows maintenance of one central version and part number register that can be accessed either from the CPU as an SFR or across JTAG with the IDCODE instruction According to the JTAG Standard the IDCODE instruction must have the following structure ID JTAG ID Register Reset value UUUU UUUU 31 28 27 12 11 1 0 VERSION PART NUMBER MANUFACTURER ID F l l l F I l li F F User s Manual 31 V 1 1 2001 08 OCDS C166S V 1 0 _ On Chip Debug Support C Infineon C166S JTAG Module Field Bits Type Description VERSION 31 28 PART NUMBER 27 12 MANUFACTURER ID 11 0 Version of the chip Part number of the chip Manufacturer ID according to the JEDEC Standard Manufacturer s Identification Code JEP 106 G Infineon devices 0C 1p 3 3 3 IOPATH Register The IOPATH register is a modified JTAG scan register to provide error protection For IOPATH the TDO signal represents the input of the IOPATH register Figure 3 4 not the output This allows detection of transmission bit errors The TDI TDO behavior is the same as for a JTAG BYPASS instruction except that the first bit output state Capture DR is 1 not 0 This difference is important in the case that there
21. the entry of the sub function and when it is entered the IP address trigger range is changed to cover the sub function User s Manual 14 V 1 1 2001 08 OCDS C1668 V 1 0 _ Infineon technologies On Chip Debug Support C166S OCDS Module 2 6 Registers Table 2 5 OCDS Register Summary Name ESFR Type Description DBGSR FOFC h Debug status register DIPX FOFA ih Instruction pointer register extension DIP FOF8 h Instruction pointer register DSWEVT FOF4 Specifies action if DEBUG instruction is executed DEXEVT FOF2 Specifies action if external break pin is asserted DTREVT FOFO Specifies hardware triggers and action DCMPDP FOEE Data programming register for DCMPx DCMPSP FOEC Select and programming register for DCMPx DTIDR FoD8y a Task ID register DCMPO 1 Hardware event equal comparison register 0 DCMP1 sh Hardware event egual comparison register 1 DCMP2 Hardware event equal comparison register 2 DCMPG Hardware event range comparison register greater DCMPL Hardware event range comparison register less 1 Accessed with DCMPSP and DCMPDP The register ESFR addresses of OCDS are not product specific This is possible because there will be always only one OCDS in the address space The fixed addresses also eliminate the need for the external debugger to have product specific information to operate the OCDS User s Manual OCDS C1668 V
22. the operation mode of the peripherals when the associated debug event is raised If this bit is set the OCDS P SUSPEND bit in DBGSR will be set this causes sensitive peripherals to suspend User s Manual 16 V 1 1 2001 08 OCDS C1665 V 1 0 On Chip Debug Support C Infineon C166S OCDS Module Note Presently OCDS P SUSPEND is set only when the associated EVENT ACTION is either Halt Mode or Software Debug Mode This may change in future versions of OCDS DTREVT Hardware Trigger Combination Debug Event Control Reset value 0000 3 2 1 0 15 14 13 12 11 10 9 8 7 6 5 4 B COM SELECT M ACT PER a i E COMR MUKE MUXR iy A 548 EVENT ACTION rw rw rw rw rw rw rw rw rw rw Field Bits Type Description EVENT_ACTION 2 0 rw Identical to EVENT_ACTION in DEXEVT PERIPHERALS STOP 3 rw Identical to PERIPHERALS STOP in DEXEVT BREAK AFTER MAKE 4 rw 0 Break before make IP only 1 Break after make IP only ACTIVATE PIN 5 rw Identical to ACTIVATE PIN in DEXEVT MUX R 7 6 rw Range comparison input mux Figure 2 2 00 Instruction pointer IP 01 Data value DA 10 Write address W ADR 11 Read address R ADR MUX E 9 8 rw Equal comp input mux Figure 2 2 control 00 Instruction pointer IP 01 Data value DA 10 Write address W_ADR 11 Task ID TASKID COM_R 11 10 rw Select range comparison Table 2 6
23. was a bit error when the JTAG instruction was shifted in In the most probable case that this faulty JTAG instruction is not implemented the JTAG Module would set the BYPASS mode which could not otherwise be distinguished from the JTAG IO SELECT PATH instruction Single Cycle Delay Flip flop IORATH TDO Q Kk Figure 3 4 lIOPATH Register The IOPATH register is used to select Cerberus If the JTAG instruction is in the I O address range and not CO Table 3 1 the associated select signal is active IOPATH register is 2 bits wide and is set like a regular JTAG scan chain register with the JTAG_IO_SELECT_PATH instruction To select Cerberus it must be set with 10 this is the recommended hardware default implementation User s Manual 32 V 1 1 2001 08 OCDS C1668 V 1 0 lt On Chip Debug Support C Infineon C166S JTAG Module 3 3 4 CCONF Register The CCONF register is provided to configure special chip states It can be considered as an alternative mechanism to reset configurations All configuration bits have associated protection bits This allows different tools sharing the JTAG interface to have very straightforward access to their dedicated bits The CCONF register is set with the CCONF SET JTAG instruction Table 3 1 with the same behavior as IOPATH Figure 3 4 The bit RST HLT has a dedicated meaning all others are reserved CCONF Chip Configuration Register Reset value 0000 15 14 13 12 11 10 9
24. writing to an OCDS control register i e DBGSR instructions which execution does not depend on the new settings can follow Writing to DBGSR Thad Non critical instruction s DBGSR still holds the old value Taya Any instruction new DBGSR is already effective The simplest way to assure some time to set is to insert enough no operations before the next critical instruction extr 1 EFSR area mov DTREVT 02200h select e 01 mux_e 10 repeat 10 nop dummy loop of 10 NOPs endr extr 1 new DTREVT is already effective mov DBGSR 00001h g enable OCDS The difficulty here is to estimate what is the enough time to have write completed and effective more at different PD bus speeds programmed The above example is true for f PD f CPU 1 8 for lower ratio even more NOPs will be needed read after write operation Immediately after writing to the OCDS register an dummy read operation from the same address can follow extr 2 EFSR area mov DBGSR 00803h enable trigger SW debug mode execute 1 instruction after RET mov R7 DBGSR new DBGSR is already effective reti exit monitor Such way it is assured that new DBGSR value is already effective before to continue with the next instruction More this is independent of the PD bus speed because the CPU takes care write operation to be completed before to continue with the following read from the same l
25. 0xxxxxxxx0010110001001000xxxxxxxx Figure 4 7 Example IO READ WORD User s Manual 41 V 1 1 2001 08 OCDS C1668 V 1 0 cc li Infineon technologies On Chip Debug Support C166S Cerberus Module 4 2 Registers Table 4 2 Cerberus Register Summary Register Width Address Description CLIENT ID 16 1 Client ID IOADDR 24 1 Address for next RW mode accesses IOCONF 8 1 Configuration register IOINFO 16 1 Chip state analysis register TRADDR 4 HI External bus trace mode address COMDATA 16 F068 Communication Mode data register RWDATA 16 FOGA RW mode data register IOSR 16 FO6C Status register 1 Only accessible from the JTAG port 4 2 1 CLIENT_ID Register The CLIENT_ID register allows that the external debugger checks the hardware in an auto configuration mode CLIENT_ID Client Type Identification Register Reset value 01UU 15 14 13 2 n 10 9 8 7 6 5 4 3 2 1 o TYPE 014 VERSION REVISION Field Bits Type Description REVISION 3 0 ir Silicon revision VERSION 7 4 r Cerberus Version TYPE 15 8 r Client type 00 Reserved 014 Cerberus_C166S 024 CERBERUS FPI 034 CERBERUS_FPI16B Reserved User s Manual 42 V 1 1 2001 08 OCDS C1668 V 1 0 a On Chip Debug Support C Infineon C166S Cerberus Module 4 2 2 IOADDR Register The IOADDR register holds the 24 bit address for the next Cerbe
26. EX BUS TRACE bit enables triggered transfers to an external bus address Chapter 4 3 4 User s Manual 43 V 1 1 2001 08 OCDS C1665 V 1 0 Infineon technologies 4 2 4 IOINFO Register The IOINFO register is provided to analyze bus locking situations or certain other chip internal error states It is not a physical register but represents certain chip state information After an IO SUPERVISOR instruction this information is shifted out Note that the captured signals are usually static only during these locking and error situations This means that IOINFO should not be used during normal operation and if used in error situations no start bit for RW mode operation it should be read out several times to ensure that the sampled values are static On Chip Debug Support C166S Cerberus Module IOINFO State Information for Error Analysis Reset value 0000 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 P_ LM EXT pwr 0 0 0 0 0 0 0 0 0 0 0 BUS BUS BUS DWN IDLE HLD HLD HLD r r r r r Field Bits Type Description IDLE 0 r Chip is in idle state POWER DOWN 1 r Chip is in power down state EXTBUS HOLD 2 r Ext X bus is busy LMBUS HOLD 3 r Local Memory Bus is busy PBUS HOLD 4 r Peripheral Bus is busy 7 5 0 Reserved 15 8 0 Reserved Product specific 4 2 5 TRADDR Register The 4bit wide TRADDR register is used for tracing with external bus address Ch
27. HIGHZ 0000 1000 084 OF Reserved ies 8 instr 0001 0000 104 Chip config CCONF_SET 0001 0010 114 BFy Reserved a 174 instr 1100 0000 CO CF JTAG IO mode JTAG IO SELECT PATH 1100 0001 16 instr JTAG_IO_INSTRUCTION1 jm_sel_iox JTAG_IO_INSTRUCTION15 1101 0000 DO FEy Reserved MG 47 instr 11111111 FF IEEE1149 BYPASS 1 Defined by the contents of the IOPATH register User s Manual 30 V 1 1 2001 08 OCDS C1668 V 1 0 _ On Chip Debug Support C Infineon C166S JTAG Module 3 3 Registers The JTAG Module contains the standard JTAG INSTRUCTION 8 bits and BYPASS registers and the two specific CCONF and IOPATH registers Table 3 2 JTAG Module Register Overview Register Width Reset Description TRSTN BYPASS tbit X JTAG standard Bypass Register If selected BYPASS instruction the TDO output is equal to TDI delayed by one TCK cycle CCONF 16 bit 0000 Chip Configuration Register ID 32 bit Optional JTAG standard Chip ID register The ID is shifted out when INSTRUCTION contains the IDCODE instruction INSTRUCTION 8 bit 044 JTAG standard Instruction Register Unlike all other registers it is set with an IR scan The reset value is the IDCODE instruction IOPATH 2bit 00 Selects the Cerberus Note All JTAG registers are shifted in and out with the LSB first 3 3 1 BYPASS Register This is a mandatory JTAG register If selected
28. K 31 3 3 2 ID REQSI PT 31 3 3 3 IOPATH REgISt r ei Bre t eu iria i nE li a NDI YE KUNG NLA 32 3 3 4 CCONF Register 33 34 Steps to Initialize the JTAG Module 34 4 Cerberus Module 35 4 1 Operational Overview 35 4 1 1 Definitions 36 4 1 2 Serial Bit Stream Syntax TDI TDO 36 4 1 3 KO Instructions 37 4 1 4 Shift Register Behavior 39 4 1 5 Data Transfer Examples 39 User s Manual l 1 V 1 1 2001 08 OCDS C1668 V 1 0 On Chip Debug Support C Infineon C166S 4 2 FIGUISICNS sevi hemem duke bk ilk ed heen BB de e ei e 42 4 2 1 CUENT ID Register 42 4 2 2 IOADDR Register 43 4 2 3 IOCONF Register 43 4 2 4 IOINFO Register 44 4 2 5 TRADDR Register 44 4 2 6 COMDATA and RWDATA Registers 44 4 2 7 IOSR Register 45 4 3 Operation Modes 47 4 3 1 RW MOG lt 622220082204 ni nenne E ne ERRER EE
29. Programming Register for DCMPx Reset value 0000 15 14 13 12 WG 8 7 6 gt ABE 1 0 0 0 0 0 SELECT DCMP DCMP DATA oe Field Bits Type Description DCMP DATA X 7 0 W Sets bits 23 16 of selected SELECT DCMP DCMP register SELECT DCMP 11 8 w Select the Comparison Register 0000 Select DCMPO 0001 Select DCMP1 0010 Select DCMP2 0011 Reserved 0100 Select DCMPL 0101 Select DCMPG Reserved 15 12 0 Reserved User s Manual 22 V 1 1 2001 08 OCDS C166S V 1 0 _ On Chip Debug Support C Infineon C166S OCDS Module DCMPDP Data Programming Register for DCMPx Reset value 0000 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 DCMP_DATA W Field Bits Type Description DCMP DATA 15 0 w Sets bits 15 0 of selected SELECT DCMP DCMP register 2 6 6 Common Considerations on Accessing OCDS Registers The functions of OCDS are generally controlled by writing to the Debug Status Register DBGSR To be executed correctly any debug step needs the respective bitfields to be properly and at a time set As DBGSR is accessed over the PD bus time needed to have new values effective depends on the speed of that bus This becomes as more important as the bus speed becomes lower compared to the core speed i e to the speed of executing instructions Other important thing is the instance of C166S as a pipelined machine with the different operations read write
30. User s Manual V 1 1 August 2001 C1668 On Chip Debug Support Microcontrollers Never stop thinking Edition 2001 08 Published by Infineon Technologies AG St Martin Strasse 53 D 81541 Munchen Germany Infineon Technologies AG 2001 All Rights Reserved Attention please The information herein is given to describe certain components and shall not be considered as warranted characteristics Terms of delivery and rights to technical change reserved We hereby disclaim any and all warranties including but not limited to warranties of non infringement regarding circuits descriptions and charts stated herein Infineon Technologies is an approved CECC manufacturer Information For further information on technology delivery terms and conditions and prices please contact your nearest Infineon Technologies Office in Germany or our Infineon Technologies Representatives worldwide see address list Warnings Due to technical requirements components may contain dangerous substances For information on the types in question please contact your nearest Infineon Technologies Office Infineon Technologies Components may only be used in life support devices or systems with the express written approval of Infineon Technologies if a failure of such components can reasonably be expected to cause the failure of that life support device or system or to affect the safety or effectiveness of that device or system Life support
31. a 10 bits for the JTAG state machine I O instruction and start bit and 4 bits for the synchronization between the transfer trigger and the shift out If the trigger rate is higher some accesses are lost To notify the external debugger about these missed events the dirty_bit read tag is set This bit is appended to the read data when it is shifted out Table 4 5 dirty_bit Read Tag Value Description 1 At least one missed transfer trigger event between the last triggered read and the current 0 Not the case above 4 3 4 Tracing with External Bus Address This is a special operating mode of the DPEC Interface for faster tracing In this mode the data is not written to RWDATA and shifted out via the JTAG port but is directly written to an external bus address The data is then captured from the external bus by the debugger trace box This kind of tracing can be enabled in Communication Mode only and can be used in parallel to it The condition for transfers is that MODE 0 TRIGGER ENABLE 1 EX_BUS_TRACE 1 all in IOCONF and a transfer trigger exists The external bus address is defined by 23 0 The TRADDR register sets the most significant bits the rest is hardwired to OFO6Ay User s Manual 50 V 1 1 2001 08 OCDS C1668 V 1 0 _ On Chip Debug Support C Infineon C166S Cerberus Module 4 3 5 Monitor Controlled Tracing Monitor controlled tracing is provided for tracing in the end pro
32. apter 4 3 4 It defines the uppermost 4 bits of the external bus address It is set with the IO SET TRADDR instruction by the external host 4 2 6 COMDATA and RWDATA Registers The RWDATA register is used as the data register for both read and write transfers in RW Mode COMDATA is the equivalent for Communication Mode User s Manual 44 OCDS C166S V 1 0 V 1 1 2001 08 i On Chip Debug Support C Infineon C166S Cerberus Module 4 2 7 IOSR Register The IOSR register is used in Communication Mode Chapter 4 3 2 to disable Cerberus from the CPU side for security reasons Chapter 4 5 and to do monitor controlled tracing Chapter 4 3 5 The IOSR register is only accessible from the CPU side IOSR Status and Control Register Reset value 0000 00UU 0000 0U00g 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 MTR COM CW CR RW RW RW RW MTR CLT DBG CW gat CTL 9 0 0 0 ON ON SY Jack S SY EN ENA DIS DISA NC NC NC P BLD P BLE W rw rh rh rh W rh rh w rw h w rw Field Bits Type Description RW_DISABLE 0 r w RW mode protection 0 RW mode is enabled 1 RW mode is disabled RW DIS P 1 W 0 Bit protection RW DISABLE unchanged 1 RW DISABLE will be changed RW ENABLED 2 rw h Used by user program for security Reset by a JTAG reset h only and not by a CPU reset RW EN P 3 Ww 0 Bit protection RW_ENABLED unchanged 1 RW_ENABLED w
33. beka emme 47 4 3 2 Communication Mode 47 4 3 3 Triggered Transfers DPEC 49 4 3 4 Tracing with External Bus Address 50 4 3 5 Monitor Controlled Tracing 51 4 4 Error Handling ue ae mee kee AA 53 4 5 System Security 54 4 6 PowerSaving 55 4 7 Reset Behavior cam Bo Gaede orcs Wa MEn ce eek e oes ii es 56 5 JTAG API occu vie AA PE BEN R AKU ie kaa 57 User s Manual I 2 V 1 1 2001 08 OCDS C166S V 1 0 _ On Chip Debug Support C Infineon C166S Overview Features and Applications 1 Overview Features and Applications On Chip Debug Support OCDS provides key hardware emulation features to a broad range of customers at minimal cost It allows breakpoints to be set and memory locations to be observed during run time OCDS Module Emulator C166S CPU Core Debugger Cerberus Debug Port THA 5 Signals Figure 1 1 OCDS System Overview The overall OCDS system consists of three blocks e Break generation unit OCDS Module e Cerberus debug port e JTAG Module Application programmers and system integrators obtain the benefits of OCDS through the debugger and emulation tools of Infineon s tool partners Note To ensure the correct function of the debugger tools direct usage of the OCDS
34. controlled tracing is equivalent to triggered transfers Chapter 4 3 3 but is controlled by a monitor running on the CPU It can be used to move an arbitrary memory location on an OCDS core DPEC event action Chapter 2 5 1 The transfer is executed when Cerberus is not selected CLNT ON 0 MTR_CTRL is set and there is a transfer trigger Source and target addresses are programmed with MTR SELECT ADDR MTR ADDR X and MTR ADDR in the registers RWDATA and COMDATA With a write to RWDATA the address source or target is selected MTR_SELECT_ADDR and the highest byte of the address is written The lower 16 bits can then be programmed with COMDATA The following C source code example shows how a monitor enables the trace Trace source address 0x543210 unsigned trace_source_ptr_ext 0x54 unsigned trace_source_ptr 0x3210 Trace target address OxABCDEF unsigned trace target ptr ext OxAB unsigned trace target ptr OxCDEF Setting the trace source address RWDATA 0x0100 trace source ptr ext COMDATA trace source ptr Setting the trace target address RWDATA 0x0200 trace target ptr ext COMDATA trace target ptr Starting the monitor controlled trace with MTR CTRL IOSR 0xC000 Programming the OCDS to create DPEC triggers User s Manual 52 V 1 1 2001 08 OCDS C1668 V 1 0 _ On Chip Debug Support C Infineon C166S Cerberus Module 4 4 Error Handling Cerb
35. duct when it is mechanically inconvenient to make the JTAG Interface accessible Note It is very important that the monitor uses this feature only when no external debugger is connected to Cerberus across JTAG Otherwise errors will occur because this feature shares resources COMDATA RWDATA with the normal modes used by the external debugger Monitor controlled tracing is not a security risk Even if it is unintentionally enabled by a user program a transfer occurs only when the OCDS triggers it The enabling of the OCDS is very well protected Chapter 2 2 COMDATA COMDATA Usage in Monitor Controlled Tracing Mode Reset value 0000 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 MTR ADDR Field Bits Type Description MTR ADDR 15 0 w Sets bits 15 0 of selected MTR SELECT ADDR address register RWDATA RWDATA Usage in Monitor Controlled Tracing Mode Reset value 0000H 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 MTR SELECT MTR ADDR X ADDR W W Field Bits Type Description MTR ADDR X 7 0 W Sets bits 23 16 of selected MTR SELECT ADDR address register MTR SELECT A 9 8 w 00 No selection DDR 01 Select MTR source address 10 Select MTR target address 11 Reserved 15 10 0 Reserved User s Manual 51 V 1 1 2001 08 OCDS C166S V 1 0 gm On Chip Debug Support C Infineon C166S Cerberus Module Monitor
36. erus enters the error state on all chip internal resets except JTAG reset It can be left with the IO SUPERVISOR instruction While in error state every instruction except IO SUPERVISOR responds with an indefinite number of busy bits Another error state is when the chip internal bus is blocked for DPEC transfers If this condition occurs the IO SUPERVISOR instruction can be used to read the IOINFO register which provides analysis information User s Manual 53 V 1 1 2001 08 OCDS C1668 V 1 0 _ On Chip Debug Support C Infineon C166S Cerberus Module 4 5 System Security After reset Cerberus is in Communication Mode and needs at least 30 TCK clock cycles to be brought into RW Mode 10 cycles to acknowledge the reset with IO SUPERVISOR and 20 cycles to set IOCONF If the user program running on the CPU sets the RST HLT immediately after reset there is no way to from the outside to get Cerberus into RW Mode via the JTAG Interface To have a protected system in the field that can be accessed by authorized users the following solution can be used all bits are in the IOSR register First Instruction of the user program after reset disables RW Mode with RST HLT 1 if RW_ENABLED is 0 The user program checks DBG_ON to determine if an external debugger is present If not it just continues with the regular code External debugger sends key numbers n x 16 bits in Communication Mode User program starts to accept and compa
37. es must occur after the output of the start bit for the write that is actually requested in the Update DR state This allows the success of the last write start bit to be checked without initiating a new write The IO WRITE BYTE instruction is a special case of IO WRITE WORD for writing bytes For IO WRITE BYTE it is required that a complete 16 bit word must be shifted in from which the lower byte is always written for even and uneven addresses The IO SET TRADDR instruction sets the TRADDR register which is used for tracing with external bus address Chapter 4 3 4 The IO SUPERVISOR instruction is used to release RW Mode and Communication Mode from the Error state Chapter 4 4 This instruction also outputs the IOINFO register after a start bit IO CLIENT ID returns a client specific ID code from register CLIENT ID User s Manual 38 V 1 1 2001 08 OCDS C166S V 1 0 a On Chip Debug Support C Infineon C166S Cerberus Module 4 1 4 Shift Register Behavior Figure 4 3 shows the relationships among TDI TDO and the Shift Register content of Cerberus after the client instruction has been shifted in MUX1 is controlled by the active instruction MUX2 is controlled by the status of the client busy or operation finished In the case of I O write type instructions after the TDO start bit occurs the delayed data is shifted into the shift register and in parallel is output on TDO In the case of I O read type instructions t
38. event is raised This can be used in critical routines where the system cannot be interrupted to transfer a memory location to the RWDATA register and read it trace through the Cerberus debug port 2 5 2 Call a Monitor Calling a monitor with a special debug hardware trap trap number 8 vector location 204 is one of the possible actions to be taken when a debug event is raised This trap has the highest priority but the monitor routine can reduce its own priority level by resetting the debug flag bit DEBTRAP in the trap flag register TFR and writing the priority to the ILVL field in the PSW register This short entry to an interruptible monitor allows a flexible debug environment to be defined that is capable of satisfying many of the requirements for efficient debugging of a real time system For example safety critical code can be served while the debugger is active The monitor is ended with a regular RETI instruction The debug flag bit DEBTRAP has to be cleared on exiting the TRAP routine otherwise it will be called again User s Manual 12 V 1 1 2001 08 OCDS C1668 V 1 0 afin On Chip Debug Support C Infineon aes OCDS Module Highest Interrupt A oe ii Interrupt B Interrupt B Lowest Priority Monitor has highest Interrupt A has higher priority priority in the system so debug than monitor and hence will process cannot be interrupted be served Figure 2 3 Simple and Advanced Debug Model Structure of a non interru
39. executed at different pipeline stages The basic potential problem to be kept in mind is the new DBGSR value the same is true for any SFR can not be as a rule effective for the instruction immediately following its modification The delay in terms of core instructions executed still under the old DBGSR value has a fixed part in most cases one instruction and a predominant variable part depending on the PD bus speed The most critical points for possible conflicts are e setting up and enabling OCDS For proper operation DBGSR must be set after the DTREVT register already holds the new value programmed e exiting the monitor All updates to DBGSR must be effective before returning to the user program Otherwise a possibility exists that a breakpoint in code will be reached before DBGSR holds the proper settings This can cause a variety of problems like calling the monitor after executing the breakpoint or immediate stepping over the breakpoint instead of breaking before User s Manual 23 V 1 1 2001 08 OCDS C1665 V 1 0 a On Chip Debug Support C Infineon C166S OCDS Module 2 6 7 General Workaround to Avoid Software Problems with OCDS The principal solution to avoid problems on accessing OCDS registers is to assure that after an instruction writing to a register the instruction which uses the new value will be executed only when new settings are really effective e use non critical instructions After
40. hat in the case of a send IO WRITE WORD followed by receive IO READ WORD both bits CWSYNC and CRSYNC are set and must be served by the monitor in this sequence Note that a previous receive request blocks the send This means that a requested value must be fetched by the host before it issues a new send command Table 4 4 CWSYNC bit CWSYNC Description 1 Host requests monitor to read a value from COMDATA 0 COMDATA not valid or COMDATA read by the monitor CPU Aborting Requests If the monitor CPU does not serve the request read or write COMDATA the CWSYNC and CRSYNC bits can be reset with the COM MODE RST bit in the IOCONF register High Level Synchronization To improve the robustness of the communication channel it is very helpful to distinguish between commands from the debugger and regular data exchange For example if the debugger aborts its request just when the monitor responds the high level synchronization between host and monitor would be lost To prevent this aCOM SYNC bit is provided to synchronize the communication channel between debugger and monitor on a higher level It is set in the IOCONF register and can be read in IOSR by the debugger The debugger monitor can simply use this bit to reset the communication channel or for a more advanced use can use this bit to tag data from the debugger to the monitor as instructions 4 3 3 Triggered Transfers DPEC Triggered transfers are an OCDS spec
41. he captured data is shifted out via MUX1 and MUX2 The shift register forms a circular buffer that can be used for double shift out for error protection IO READ BLOCK IO READ WORD Shift Register Single Cycle IO CONFIG Delay FlipfloplO SET ADDRESS IO WRITE BLOCK N IO WRITE WORD start bit 0 5 IO WRITE BYTE gt busy bit 1 5 8 Figure 4 3 Shift Register Behavior in the Shift DR State 4 1 5 Data Transfer Examples Figure 4 4 shows the behavior of the JTAG I O Interface for the IO_CONFIG instruction In this figure the TDI TDO output is shown only for the Shift_DR state IO CONFIG IOCONF 01h RWDATA 0000h IOADDR 000000h tdi 00000100000000 tdo 00000010000000 Figure 4 4 Example IO CONFIG User s Manual 39 V 1 1 2001 08 OCDS C1668 V 1 0 a On Chip Debug Support C Infineon C166S Cerberus Module Figure 4 5 shows the behavior of the JTAG I O Interface for the IO SET ADDRESS instruction for two cases In the first case there are no busy bits and the first address bit is shifted i external h n parallel with the start bit In the second case there are four busy bits and the ost starts to shift in the address one cycle after the start bit The result of both cases is exactly the same KI IO SET ADDRESS IOCONF 01h RWDATA 0000h IOADDR 000033h Edi tdo 100011100110000000000000000000 010000110011000000000000000000 2 IO SET ADDRESS IOCONF 01h RWDATA 0000h IOADDR
42. ific feature of Cerberus They can be used to read or write a certain memory location when an OCDS trigger becomes active Triggered transfers are executed when Cerberus is in RW Mode the TRIGGER_ENABLE bit in IOCONF is 1 the JTAG Shift Core has requested a transaction and an OCDS DPEC event action Chapter 2 5 1 occurs Triggered transfers behave like normal transfers except that there must also be a transfer trigger after the JTAG Shift Core requests the transfer User s Manual 49 V 1 1 2001 08 OCDS C1668 V 1 0 _ On Chip Debug Support C Infineon C166S Cerberus Module Tracing of Memory Locations The main application for triggered transfers is to trace a certain memory location This can be done when the OCDS core activates the DPEC event action if this memory location is written by the user program Cerberus is configured to read the location on this trigger The maximum transfer rate that can be reached is defined by 30 in a Bis AN 4 1 Es JTAG Ninstr is the number of instruction cycles that need to be between two CPU accesses to the memory location T instris the instruction cycle time of the CPU and fj746 is the clock rate of the JTAG Interface TCK For instance if Tips 2 100 ns and fjr4g 10 MHz accesses in every 30th instruction cycle can be fully traced In many cases this will be sufficient to trace something for instance the task ID register The factor 30 is the sum of 16 bits for the dat
43. ill be changed CRSYNC 4 rh Read sync bit for Communication Mode 0 No receive request pending 1 External debugger requests value COMDATA CWSYNC 5 rh Write sync bit for Communication Mode 0 No send request pending 1 External debugger offers value COMDATA CW ACK 6 W Write request acknowledge in Communication Mode 0 No action 1 Acknowledge that send value was read from COMDATA by the monitor COM SYNC 7 rh High level sync bit for Communication Mode 0 COM SYNC in IOCONF is 0 1 COM SYNC is 1 DBG ON 8 rh 0 No external debugger present 1 External debugger present User s Manual 45 V 1 1 2001 08 OCDS C1665 V 1 0 _ On Chip Debug Support C Infineon C166S Cerberus Module Field Bits Type Description CLNT ON 9 rh 0 Client not selected 1 Client selected 11 13 0 Reserved MTR_CTRL 14 rw 0 Monitor controlled tracing disabled 1 Enabled MTR_CTRL_P 15 W 0 Bit protection MTR CTRL unchanged 1 MTR CTRL will be changed 1 Can be written in Communication Mode only The RW DISABLE bit is used to prevent Cerberus from entering RW Mode It can only be set by the CPU in Communication Mode If Cerberus has already entered RW Mode all attempts by the CPU to set this bit are ignored The application of RW DISABLE is described in Chapter 4 5 The RW ENABLED bit has no effect on Cerberus behavior It is provided to the user program to store whether RW
44. in IOSR is 0 and the external host writes a 1 to the MODE bit in the IOCONF register Data Type Support The default data type is a 16 bit word and it is used for single word transfers and block transfers If the external host wants to read a single byte it must read the associated word IO READ WORD and extract the needed byte by itself Writes to bytes are supported with the IO WRITE BYTE instruction Also for this instruction the external host must shift in the full 16 bit word but only the selected byte is actually written Its position is defined by the lowest address bit in IOADDR DPEC Interface The DPEC Interface does the actual read or write of memory locations It is configured with the IOCONF register and the transactions are requested by the JTAG Shift Core Figure 4 1 The data is transferred to from the RWDATA register DPECs always have the highest CPU priority but they can not interrupt ATOMIC EXTx sequences 4 3 2 Communication Mode Communication Mode is a mode of Cerberus for communication between an external host debugger and a program monitor running on the CPU Also in this mode the external host is master of all transactions The external host requests the monitor to write or read a value to from COMDATA The difference from RW mode is that in Communication Mode the read or write request is not actively executed by Cerberus but it sets request bits in a CPU accessible register to signal the monitor that the
45. nofaDEBUGInstructilon 11 2 4 3 Break Pin Input 11 2 4 4 Event Prioritizing 11 2 5 Debug Event Actions 12 2 5 1 Trigger Data Transfer DPEC 12 2 5 2 CallaMonitor 12 2 5 3 Hali MODE iii AAA IIIA 13 2 54 Activate External Pin 14 2 5 5 Single Stepping 14 2 6 MAJI aa aa ka eee WAA ai gus aus 15 2 6 1 Debug Event Control Registers DEKEVT DSWEVT DTREVT 16 2 6 2 Debug StatusRegisterDBGSR 19 2 6 3 Task ID Register DTIDR 20 2 6 4 Instruction Pointer Register DIP and DIPX 21 2 6 5 Hardware Trigger Comparison Registers 21 2 6 6 Common Considerations on Accessing OCDS Registers 23 2 6 7 General Workaround to Avoid Software Problems with OCDS 24 2 7 Reset Behavior 25 3 JTAG Module 27 3 1 JTAG Controller State Machine 29 3 2 JTAG Instructions 30 3 3 REGIS ETS x aa IA KA WA E aki NAKAKA 3i 3 3 1 BYPASS Registe iaoi toid maaa a a a a E a A E
46. nsidered busy when the requested read or write operation has not yet been finalized LSB First All data and addresses are shifted in and out with LSB first External Host is Master The external host is master of all transactions initiating the transfers for both directions 41 2 Serial Bit Stream Syntax TDI TDO When Cerberus is selected it is controlled with the TDI bit stream with the JTAG sequence Capture DR multiple Shift DRs and Update DR Figure 3 3 The first 4 bits shifted in are the I O instruction Figure 4 2 The next bits busy bits are ignored until a start bit occurs on TDO Busy bits can occur for all I O instructions except IO CONFIG when the previous operation has not yet finished If the instruction is a write type instruction Table 4 1 the TDI bit in parallel to the start bit is used as the first data bit followed by the rest of the data and ending with a don t care bit If more data bits are shifted in than required the first superfluous data bits are ignored and the last are used for the update If the instruction is a read type instruction Table 4 1 all TDI bits after the instruction are ignored After the start bit on TDO the read data is shifted out If the instruction is undefined or not implemented the client responds with an indefinite number of busy bits User s Manual 36 V 1 1 2001 08 OCDS C1665 V 1 0 On Chip Debug Support C Infineon C166S Cerberus Module 10
47. ntrol registers This input is sensitive on a negative clock edge followed by at least two CPU clock cycles where it is 0 2 4 4 Event Prioritizing It is possible that more than one event may be raised in a single cycle In this case the priority of events to be handled is based on the sequence in which the events appear in the event sources list those listed first are handled before those listed later Table 2 3 Debug Event Priority Event Debug Event Control Register Priority Break pin input DEXEVT 1 highest Execution of a DEBUG instruction DSWEVT 2 Hardware trigger combination DTREVT 3 User s Manual 11 V 1 1 2001 08 OCDS C1668 V 1 0 lt On Chip Debug Support C Infineon C166S OCDS Module 2 5 Debug Event Actions When the OCDS is enabled and a debug event is generated one of the actions listed in Table 2 4 is taken These actions are explained in detail in the following sections Table 2 4 Debug Event Actions Debug Event Action User Resources Interruptible Break before make Activate external pin Trigger data transfer DPEC Cycle stealing for DPEC Only for Call a monitor Stack Yes program User address space after entry address Interrupt address triggers Halt 5 No 2 5 1 Trigger Data Transfer DPEC Triggering Cerberus to execute a pending transfer Chapter 4 3 3 is one of the actions that can be specified to occur when a debug
48. ocation So in fact this is the easiest and most reliable decision to assure proper OCDS operation User s Manual 24 V 1 1 2001 08 OCDS C1665 V 1 0 _ On Chip Debug Support C Infineon C166S OCDS Module 2 7 Reset Behavior If OCDS is disabled usually when JTAG Module is in reset state OCDS Module and all its registers are reset with every CPU reset otherwise it is never reset This behavior allows a defined reset in the cases when no debugger is connected or the debugger controls the OCDS indirectly with a monitor In the other case when the debugger controls the OCDS directly the OCDS registers are not affected by user program or system environment resets This permits very unfriendly systems to be debugged as well User s Manual 25 V 1 1 2001 08 OCDS C166S V 1 0 On Chip Debug Support C Infineon C166S OCDS Module User s Manual 26 V 1 1 2001 08 OCDS C1665 V 1 0 a On Chip Debug Support C Infineon C166S JTAG Module 3 JTAG Module The JTAG Module is the link between the JTAG pins and Cerberus Note The JTAG Module is not part of the C166S CPU macro therefore the actual behavior might differ slightly from the description in this chapter depending on the system architecture This chapter refers to e IEEE JTAG Standard IEEE Standard 1149 October 21 1993 e JEDEC Standard Manufacturer s Identification Code JEP 106 G The JTAG port is a dedicated interface standardized fo
49. operated across a single JTAG Interface e An API is provided to allow easy multi core debugging Cerberus Applications e Control and data transfer mechanism for OCDS e Data transfer channel for programming on and off chip non volatile memory e Very robust access port for on and off chip across external bus controller system analysis and configuration e Data channel that is independent from user resources independent for applications such as manufacturing line flash memory programming or for system calibration purposes The target application of the Cerberus is use of the JTAG Interface as an independent port for OCDS The external debug hardware can access the OCDS registers and arbitrary memory locations The system architecture is also very well suited for multi core debugging across a single JTAG Interface Up to four Cerberusses can be connected to the JTAG Module and operated from standard debuggers in one debug session The JTAG API provides a straightforward and proven interface for standard debuggers and arbitrates the access of the JTAG Interface in a transparent way User s Manual 4 V 1 1 2001 08 OCDS C1665 V 1 0 _ C166S Infineon On Chip Debug Support technologies 2 OCDS Module 2 1 Introduction Basic Concept OCDS Module The debug concept addresses both the generation of debug events and the definition of event actions taken when a debug event is generated Debug Events Programmable
50. port C Infineon C166S OCDS Module 2 3 Reset to Halt Mode The CPU can be forced directly to Halt Mode Chapter 2 5 3 after reset This is controlled by the CCONF RST_HLT bit in the JTAG Module The reset to Halt Mode requires three steps 1 Set CCONF RST_HLT before the CPU reset goes inactive 2 Set DBGSR DEBUG STATE to Halt Mode after the reset is released 3 Clear CCONF RST_HLT To remove the CPU from Halt Mode DBGSR DEBUG STATE must be set to User Mode Note This feature Reset to Halt Mode might be disabled or controlled by another mechanism depending on the system architecture since the JTAG Module is not a part of the CPU macro and can be modified User s Manual 8 V 1 1 2001 08 OCDS C1668 V 1 0 _ On Chip Debug Support C Infineon C166S OCDS Module 2 4 Debug Event Sources 2 4 1 Hardware Trigger Combinations Table 2 2 lists the possible hardware trigger sources Table 2 2 Hardware Triggers Trigger source Size Description TASKID 16 bits TASKID in DTIDR register IP 24 bits Instruction Pointer R ADR 24 bits Data address of reads W ADR 24 bits Data address of writes DA 16 bits Data value reads or writes TASKID is the contents of the DTIDR register It is used by advanced real time operating systems to store the Task ID of the active task The trigger sources are compared and combined in the hardware trigger generation unit Figure 2 2 The hardware trigger
51. ptible Monitor Routine 1 Do processing non interruptible 2 Set DBGSR 0000 3 Clear the DEBTRAP bit in TFR 4 Return to user program with RETI instruction Structure of an interruptible Monitor Routine 1 Set DBGSR DEBUG STATE 00p User Mode 2 Clear the DEBTRAP bit in TFR 3 Reduce the interrupt level ILVL in W 4 Do Processing 5 Set DBGSR 0000 6 Return to user program with RETI instruction Note The reduction of the interrupt priority of the monitor can cause stack overflows If the task that causes the debug event has a higher priority than the monitor the monitor will be pushed onto the stack again and again Note Care must be taken that the monitor does not cause an event itself Otherwise it will be started again and again and cause stack overflows 2 5 3 Halt Mode The system suspends execution by halting the instruction flow and will not respond to any interrupts It then relies on the external debug system to interrogate the target entirely by reading and updating through the Cerberus debug port The CPU resumes User s Manual 13 V 1 1 2001 08 OCDS C1668 V 1 0 _ On Chip Debug Support C Infineon C166S OCDS Module in User Mode when the external debug hardware resets the DEBUG STATE in DBGSR to User Mode It also should reset the OCDS P SUSPEND and EVENT SOURCE bits in DBGSR 2 5 4 Activate External Pin An external pin assertion can be specified as a debug event action
52. r boundary scan Additionally it can be used for chip internal tests Because neither of these applications is used during normal operation of a device in a system the JTAG port is well suited to be an interface for special user modes Note This chapter describes only the Cerberus related parts of the JTAG Module It does not contain all JTAG specific details as specified in the IEEE JTAG Standard Features e Implementation is based on the IEEE 1149 JTAG Standard e 8 bit wide JTAG instruction register JTAG Port TDO TRSTN tck tdi Cerberus jm_reset_n JTAG Module TMS jm shift dr jm update dr jm sel io2 TCK TDI Figure 3 1 JTAG Port JTAG Module and Cerberus Connections User s Manual 27 V 1 1 2001 08 OCDS C1668 V 1 0 eo i On Chip Debug Support C Infineon C166S JTAG Module Block Diagram Figure 3 2 shows a block diagram with all Cerberus related signals of the JTAG Module jm instr 4 0 jm update dr c 2 L amp ka PATH B Ez Register N X other selects jm sel io0 jm sel io3 im cconf im shift dr Instruction Decoder IEEE 1149 JTAG Controller JTAG Module tck a LA enable l E TRSTN Kk gt trstn 5 5 3 8 Figure 3 2 JTAG Module Block Diagram User s Manual 28 V 1 1 2001 08 OCDS C1668 V 1 0 o On Chip Debug Support C Infineon C166S JTAG Module 3 1 JTAG Controller State Machine The JTAG Controller
53. re these number some time ty after reset This time must be long enough about 100 ms to allow even a slow 5 kHz JTAG driver to shift in the send request Additionally it is recommended to poll CRSYNC in reasonable distances to allow a hot attach of the external debugger If all numbers are correct the user program resets RST HLT and sets RW_ENABLED Now the user program knows RW_ENABLED that Cerberus has been enabled once and thus does not prevent the enabling after the next resets Note Average time to crack the system for n 2 and ty 1 s 29 1s 2 1634 years User s Manual 54 V 1 1 2001 08 OCDS C1668 V 1 0 _ On Chip Debug Support C Infineon C166S Cerberus Module 4 6 Power Saving Cerberus is in Power Saving Mode when it is not selected from the JTAG side The only register that is always accessible and working is IOSR If the monitor controlled tracing mode Chapter 4 3 5 is enabled the required resources are functional User s Manual 55 V 1 1 2001 08 OCDS C1668 V 1 0 i On Chip Debug Support C Infineon C166S Cerberus Module 4 7 Reset Behavior Reset from the JTAG Side If the internal JTAG reset becomes active all RW Mode and Communication Mode requests are aborted and also the CRSYNC and CWSYNC bits are reset The behavior of the registers is specified in Table 4 6 Reset from the Chip CPU Side In this case all I O instructions except IO CONFIG are responded
54. register 1 Accessed with DCMPSP and DCMPDP User s Manual 6 V 1 1 2001 08 OCDS C1668 V 1 0 On Chip Debug Support C Infineon C166S OCDS Module 2 2 Enabling and Disabling the OCDS By default the OCDS is disabled in order to protect the system during normal execution Events can be generated only when the OCDS is enabled The OCDS Module has an enable signal that is normally connected to the chip internal JTAG reset This means that the OCDS is enabled when the JTAG Module is not in reset state This is always the case when the external debugger uses Cerberus Note Depending on the system architecture the enable signal may be controlled by another source The OCDS Module can also be optionally enabled by software To avoid an unintentional enabling by an incorrect user program the following conditions must be true 1 OCDS is disabled 2 DTREVT MUX E 105 3 DTREVT SELECT_E 00p enables the equal comparators 4 DCMPO comparison matches independent of SELECT EF 5 Currently written DBGSR DEBUG ENABLED 1p Thus a monitor must do the following 1 Write FOFCy to DCMPO address of DBGSR 2 Write 2200 to DTREVT 3 Write 0001p to DBGSR If the OCDS was enabled by software it can be disabled by a reset only Note This feature OCDS enabling by software might be disabled depending on the system architecture User s Manual 7 V 1 1 2001 08 OCDS C1665 V 1 0 lt On Chip Debug Sup
55. rus access IOADDR is updated in the Update DR state with the shift register contents when the IO SET ADDRESS instruction is active or incremented by two 16 bit word if an IO READ BLOCK or IO WRITE BLOCK instruction has been executed 4 2 3 IOCONF Register The IOCONF register is used to configure Cerberus The IOCONF register is write only for the host and is not accessible from the CPU side IOCONF Configuration Register Reset value 00 7 6 5 4 3 2 1 0 COM EX BUS TRIGGER COM 0 0 0 TRACE ENABLE SYNC MODE MODE WwW Ww WwW WwW W Field Bits Type Description MODE 0 W If 0 Communication Mode otherwise RW Mode COM MODE RST 1 w If 1 CRSYNC and CWSYNC are reset in CLIENT_ID COM_SYNC 2 w Sets the COM_SYNC bit in CLIENT_ID TRIGGER ENABLE 3 w If 1 the next transfers must be triggered by the DPEC event action Chapter 2 5 1 provided by the OCDS Module RW Mode only EX_BUS TRACE 4 W Enable trace with external bus address 7 5 0 Reserved The MODE bit determines whether Cerberus is in RW Chapter 4 3 1 or in Communication Mode Chapter 4 3 2 The COM MODE RST bit is provided to reset the CRSYNC and CWSYNC bits in CLIENT ID to abort requests in Communication Mode This reset is not static it is only done once when the IOCONF register is updated The COM SYNC bit sets the associated bit in CLIENT ID The TRIGGER ENABLE bit enables triggered transfers in RW Mode Chapter 4 3 3 The
56. ssociated DCMPO bit is O are also set to O prior to the comparison Note that the comparison values in DCMP1 and DCMP2 must also be O where the DCMPO mask is 0 Otherwise the comparison will not match The SELECT_E field enables the equal comparisons to be included in the ocds_trgevt generation and selects which is used Figure 2 2 Note that for masked comparisons the SELECT_E field must be set to 10g or 11p Table 2 7 lists the options Table 2 7 SELECT E Field Value mask e trg e signal 00 0 0 not enabled 01 1 if DCMPO matches otherwise 0 10 1 if DCMPO or DCMP1 match otherwise 0 11 1 if DCMPO or DCMP1 or DCMP2 match otherwise 0 00 1 0 not enabled 01 0 always 10 1 if DCMP1 matches otherwise 0 11 1 if DCMP1 or DCMP2 match otherwise 0 User s Manual 18 V 1 1 2001 08 OCDS C1668 V 1 0 lt Infineon technologies On Chip Debug Support C166S 2 6 2 OCDS Module Debug Status Register DBGSR Debug status register DBGSR contains several types of information about the current status of the OCDS including e A bit to indicate whether the debug support is enabled e The source of the last debug event e The system debug state DBGSR Debug Status Register Reset value 00004 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 VEN TU To TOT 0 EVENT DEBUG DBG SOURCE 0 0 EF
57. that IP is valid in Halt Mode only DIPX Instruction Pointer Register Extension Reset value 3000 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 VERSION 0 0 0 0 IPK F rh Field Bits Type Description IPX 7 0 rh Bits 23 16 of the current instruction pointer in Halt Mode Extends IP 11 8 0 Reserved VERSION 15 12 r Version of OCDS_C166S The VERSION field is used by debuggers to adapt to the specific version of the OCDS 2 6 5 Hardware Trigger Comparison Registers The DCMPn registers are used in the hardware trigger event generation unit Chapter 2 4 1 as reference values for the comparisons They can be programmed with the two SFR registers DCMPSP and DCMPDP SELECT _DCMP selects the comparison register and writes its highest byte The lower 16 bits can then be written by an access to register DCMPDP User s Manual 21 V 1 1 2001 08 OCDS C166S V 1 0 aii On Chip Debug Support C Infineon C166S OCDS Module DCMPO DCMP1 DCMP2 DCMPG DCMPL Hardware Trigger Comparison Registers Reset value 0000 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 CMP VALUE Field Bits Type Description CMP VALUE 23 0 rw Comparison value for the hardware trigger event generation unit Chapter 2 4 1 Can be written only indirectly with DCMPSP and DCMPDP DCMPSP Select and
58. to with an indefinite number of busy bits Error state The external host must acknowledge this state with the IO SUPERVISOR instruction as described in Chapter 4 4 This is done to notify the external host that something possibly unexpected has happened and that it must check such things as the communication channel to the monitor Table 4 6 Register Reset Behavior Register JTAG Reset Chip CPU Reset CLIENT ID Hardwired Hardwired COMDATA Unchanged 0000 IOADDR 000000 Unchanged IOCONF 007 Unchanged IOINFO Chip specific Chip specific IOSR UUUU UUUU UUUU UQUUp 0000 0000 0000 0U00g SW UUUU UU00 UUUU UOUUg SW 0000 OOUU 0000 OU00p RWDATA Unchanged 0000 TRADDR Oy Unchanged 1 From the software point of view bits 9 8 have this behavior because their origin is in the JTAG reset controlled domain Only their synchronization in flip flops is connected to the chip CPU reset Note A JTAG reset always requires a following CPU reset to ensure that the JTAG Shift Core and the control part of Cerberus are in a defined state under all conditions User s Manual 56 V 1 1 2001 08 OCDS C1668 V 1 0 On Chip Debug Support C Infineon C166S JTAG API 5 JTAG API For convenient usage of the Cerberus features Infineon has designed an API and can also provide a reference implementation of it on request User s Manual 57 V 1 1 2001 08 OCDS C1668 V 1 0 On Chip Debug Support

Microcontrollers On Chip Debug Support

Contents

Download Pdf Manuals

Related Search

Related Contents