AN4035 datasheet(26/42 Pages) STMICROELECTRONICS

26 / 42 page

On-Chip Emulation (OnCE)

AN4035

26/41

Doc ID 022669 Rev 2

saved GPR and WBBRlow, and then restoring the GPR. As an example, to read SPR 624,

first save r31. Then execute mfspr r31, 624. The value that was in SPR 624 is now in

WBBRlow of the CPUSCR and can be read by the external tool. Finally r31 should be

restored.

To write an SPR, single step over a mtspr instruction with the value to write to the SPR in

WBBRlow and the CTL[FFRA] bit set. For example, to write SPR 624 with the value

0x10050000, single step over mtspr 624, X with the value to write to SPR 624 in WBBRlow

and CTL[FFRA] set. The X in the instruction is replaced by WBBRlow.

DBCR0-3, DBSR, DBCNT, IAC1-4, DAC1-2 cannot be written by single stepping over mtspr

like the other SPRs while in external debug mode. They can however be written by the

method detailed in Section 3.2: OnCE register access.

3.12

OnCE memory access

There are two ways to access memory mapped locations on the SPC56x devices: one is

through the OnCE module, and the other is through the Nexus R/W access block. The

OnCE module method requires that the CPU be in debug mode. The Nexus R/W access

block does not require that the CPU be in debug mode. The Nexus R/W access block is also

the faster method of accessing memory. This section covers access to memory mapped

locations using the OnCE method. The Nexus R/W access block is covered in a following

section.

Writing a memory location is achieved by first reading the contents of a GPR and saving that

value, writing that GPR with the value to be written to memory, and single stepping over a

stw, sth, or stb instruction with the address to write in WBBRlow and the CTL[FFRA] bit set.

The GPR that was previously saved should be used as the rS field of the store instruction.

After single stepping over the store instruction, the saved GPR value should then be

restored. For example, to write the word 0xA5A5A5A5 to location 0x40000000, first save the

value in a r31. Then write the value 0xA5A5A5A5 to r31. The next step is to step over the

instruction stw r31, 0(X) with 0x40000000 in WBBRlow and the CTL[FFRA] bit set. The X in

the instruction is replaced by the WBBRlow register. GPR r31 should then be restored to its

saved value.

Reading a memory location is achieved by first reading the contents of a GPR and saving

that value, then single stepping a lwz, lhz, or lbz with the address to be read in WBBRlow

and the CTL[FFRA] bit set. The GPR that was previously saved should be used as the rD

field of the load instruction. The value read from the memory location is then in both the

WBBRlow and the GPR whose value was previously saved.

After single stepping the load instruction and getting the read data from WBBRlow, the saved

GPR value should then be restored. For example, to read a word from address location

0x40000000, first save the value in r31. Then single step over the instruction lwz r31, 0(X)

with 0x40000000 in WBBRlow and the CTL[FFRA] bit set. The X in the instruction is

replaced by the WBBRlow register. After the single step is complete, the data read from

memory can be read by the external tool from WBBRlow. GPR r31 should then be restored

to its saved value.

3.13

Breakpoints

The OnCE debug module provides the capability for both software and hardware

breakpoints to be set at a particular address.

As a reference, instruction address hardware breakpoints is also discussed in this section.

AN4035 Datasheet(PDF) 26 Page - STMicroelectronics

AN4035 Datasheet(HTML) 26 Page - STMicroelectronics

Html Pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42

Datasheet Download

Link URL