| Copyright © 2005, 2006, 2008. All rights reserved. | ARM DDI 0360F |
| Non-Confidential | |
 PDF version | |
| Home > Debug Test Access Port > Debug registers > Scan chains |
| |||
| Home > Debug Test Access Port > Debug registers > Scan chains | |||
To access the debug scan chains you must:
Load the Scan_N instruction
into the IR. Now SCREG is selected between CPUTDI and TDO.
Load the number of the required scan chain. For example, load b00101 to access scan chain 5.
Load either INTEST or EXTEST into
the IR.
Go through the DR leg of the DBGTAPSM to access the scan chain.
You must use INTEST and EXTEST as
follows:
Use INTEST for
reading the active scan chain. Data is captured into the shift register
at the Capture-DR state. The previous value of the scan chain is
shifted out during the Shift-DR state, while a new value is shifted in.
The scan chain is not updated during Update-DR. Those bits or fields that
are defined as cleared on read are only cleared if INTEST is
selected, even when EXTEST also captures their values.
Use EXTEST for
writing the active scan chain. Data is captured into the shift register
at the Capture-DR state. The previous value of the scan chain is
shifted out during the Shift-DR state, while a new value is shifted in.
The scan chain is updated with the new value during Update-DR.
Debug.
8 + 32 = 40 bits.
Debug identification.
This scan chain accesses CP14 debug register 0, the Debug ID Register.
Additionally, the eight most significant bits of this scan chain
contain an implementor code. This field is hardwired to 0x41, the
implementor code for ARM Limited, as specified in the ARM Architecture
Reference Manual. This register is read-only. Therefore, EXTEST has
the same effect as INTEST.
Figure 13.6 shows the bit order in scan chain 0.
Debug.
32 bits.
This scan
chain accesses CP14 register 1, the DSCR. This is mostly a read/write
register, although certain bits are read-only for the Debug Test Access
Port. See CP14 c1, Debug Status and Control
Register (DSCR) for
details of DSCR bit definitions, and for read/write attributes for
each bit. Those bits defined as cleared on read are only cleared
if INTEST is selected.
Figure 13.7 shows the bit order in scan chain 1.
The following DSCR bits affect the operation of other scan chains:
rDTRfull and wDTRfull flags. These indicate the status of the rDTR and wDTR registers. They are copies of the rDTRempty (NOT rDTRfull) and wDTRfull bits that the DBGTAP debugger sees in scan chain 5.
Execute ARM instruction enable bit. This bit enables the mechanism used for executing instructions in debug state. It changes the behavior of the rDTR and wDTR registers, the sticky precise Data Abort bit, rDTRempty, wDTRfull, and InstCompl flags. See Scan chain 5.
Sticky precise Data Abort flag. If the core is in debug state and the DSCR[13] execute ARM instruction enable bit is HIGH, then this flag is set on precise Data Aborts. See CP14 c1, Debug Status and Control Register (DSCR).
Unlike DSCR[6], DSCR [7] sticky imprecise Data Aborts flag does not affect the operation of the other scan chains.
Debug.
1 + 32 = 33 bits.
This scan chain accesses the Instruction Transfer Register (ITR), used to send instructions to the core through the Prefetch Unit (PU). It consists of 32 bits of information, plus an additional bit to indicate the completion of the instruction sent to the core (InstCompl). The InstCompl bit is read-only.
While in debug state, an instruction loaded into the ITR can be issued to the core by making the DBGTAPSM go through the Run-Test/Idle state. The InstCompl flag is cleared when the instruction is issued to the core and set when the instruction completes.
For an instruction to be issued when going through Run-Test/Idle state, you must ensure the following conditions are met:
The processor must be in debug state.
The DSCR[13] execute ARM instruction enable bit must be set. For details of the DSCR see CP14 c1, Debug Status and Control Register (DSCR).
Scan chain 4 or 5 must be selected.
INTEST or EXTEST must
be selected.
Ready flag must be captured set. That is, the last time the DBGTAPSM went through Capture-DR the InstCompl flag must have been set.
The DSCR[6] sticky precise Data Abort flag must be clear. This flag is set on precise Data Aborts.
For an instruction to be loaded into the ITR when going through Update-DR, you must ensure the following conditions are met:
The processor can be in any state.
The value of DSCR[13] execute ARM instruction enable bit does not matter.
Scan chain 4 must be selected.
EXTEST must be selected.
Ready flag must be captured set. That is, the last time the DBGTAPSM went through Capture-DR the InstCompl flag must have been set.
The value of DSCR[6] sticky precise Data Abort flag does not matter.
Figure 13.8 shows the bit order in scan chain 4.
It is important to distinguish between the InstCompl flag and the Ready flag:
The InstCompl flag signals the completion of an instruction.
The Ready flag is the captured version of the InstCompl flag, captured at the Capture-DR state. The Ready flag conditions the execution of instructions and the update of the ITR.
The following points apply to the use of scan chain 4:
When an instruction is issued to the core in debug state, the PC is not incremented. It is only changed if the instruction being executed explicitly writes to the PC. For example, branch instructions and move to PC instructions.
If CP14 debug register c5 is a source register for the instruction to be executed, the DBGTAP debugger must set up the data in the rDTR before issuing the coprocessor instruction to the core. See Scan chain 5.
Setting DSCR[13] the execute ARM instruction enable bit when the core is not in debug state leads to Unpredictable behavior.
The ITR is write-only. When going through the Capture-DR state, an Unpredictable value is loaded into the shift register.
Debug.
1 + 1 + 32 = 34 bits.
This scan chain accesses CP14 register c5, the data transfer registers, rDTR and wDTR. The rDTR is used to transfer words from the DBGTAP debugger to the core, and is read-only to the core and write-only to the DBGTAP debugger. The wDTR is used to transfer words from the core to the DBGTAP debugger, and is read-only to the DBGTAP debugger and write-only to the core.
The DBGTAP controller only sees one (read/write) register
through scan chain 5, and the appropriate register is chosen depending
on the instruction used. INTEST selects the wDTR, and EXTEST selects
the rDTR.
Additionally, scan chain 5 contains some status flags. These are nRetry, Valid, and Ready, which are the captured versions of the rDTRempty, wDTRfull, and InstCompl flags respectively. All are captured at the Capture-DR state.
Figure 13.9 shows the bit
order in scan chain 5 with EXTEST selected Figure 13.10 shows the bit
order in scan chain 5 with INTEST selected.
You can use scan chain 5 for two purposes:
As part of the Debug Communications Channel (DCC). The DBGTAP debugger uses scan chain 5 to exchange data with software running on the core. The software accesses the rDTR and wDTR using coprocessor instructions.
For examining and modifying the processor state while the core is halted. For example, to read the value of an ARM register:
Issue an MCR cp14, 0,
Rd, c0, c5, 0 instruction to the core to transfer the register
contents to the CP14 debug c5 register.
Scan out the wDTR.
The DBGTAP debugger can use the DSCR[13] execute ARM instruction enable bit to indicate to the core that it is going to use scan chain 5 as part of the DCC or for examining and modifying the processor state. DSCR[13] = 0 indicates DCC use. The behavior of the rDTR and wDTR registers, the sticky precise Data Abort, rDTRempty, wDTRfull, and InstCompl flags changes accordingly:
DSCR[13] = 0:
The wDTRfull flag is set when
the core writes a word of data to the DTR and cleared when the DBGTAP
debugger goes through the Capture-DR state with INTEST selected.
Valid indicates the state of the wDTR register, and is the captured
version of wDTRfull. Although the value of wDTR is captured into
the shift register, regardless of INTEST or EXTEST,
wDTRfull is only cleared if INTEST is selected.
The rDTR empty flag is cleared when the DBGTAP debugger writes a word of data to the rDTR, and set when the core reads it. nRetry is the captured version of rDTRempty.
rDTR overwrite protection is controlled by the nRetry flag. If the nRetry flag is sampled clear, meaning that the rDTR is full, when going through the Capture-DR state, then the rDTR is not updated at the Update-DR state.
The InstCompl flag is always set.
The sticky precise Data Abort flag is Unpredictable. See CP14 c1, Debug Status and Control Register (DSCR).
DSCR[13] = 1:
The wDTRfull flag behaves as if DSCR[13] is clear. However, the Ready flag can be used for handshaking in this mode.
The rDTR empty flag status behaves as if DSCR[13] is clear. However, the Ready flag can be used for handshaking in this mode.
rDTR overwrite protection is controlled by the Ready flag. If the InstCompl flag is sampled clear when going through Capture-DR, then the rDTR is not updated at the Update-DR state. This prevents an instruction that uses the rDTR as a source operand from having it modified before it has time to complete.
The InstCompl flag changes from 1 to 0 when an instruction is issued to the core, and from 0 to 1 when the instruction completes execution.
The sticky precise Data Abort flag is set on precise Data Aborts.
The behavior of the rDTR and wDTR registers, the sticky precise Data Abort, rDTRempty, wDTRfull, and InstCompl flags when the core changes state is as follows:
The DSCR[13] execute ARM instruction enable bit must be clear when the core is not in debug state. Otherwise, the behavior of the rDTR and wDTR registers, and the flags, is Unpredictable.
When the core enters debug state, none of the registers and flags are altered.
When the DSCR[13] execute ARM instruction enable bit is changed from 0 to 1:
None of the registers and flags are altered.
Ready flag can be used for handshaking.
The InstCompl flag must be set when the DSCR[13] execute ARM instruction enable bit is changed from 1 to 0. Otherwise, the behavior of the core is Unpredictable. If the DSCR[13] flag is cleared correctly, none of the registers and flags are altered.
When the core leaves debug state, none of the registers and flags are altered.
Debug.
7 + 32 + 1 = 40 bits.
Scan chain 7 accesses the VCR, PC, BRPs, and WRPs. The accesses are performed with the help of read or write request commands. A read request copies the data held by the addressed register into scan chain 7. A write request copies the data held by the scan chain into the addressed register. When a request is finished the ReqCompl flag is set. The DBGTAP debugger must poll it and check it is set before another request can be issued.The exact behavior of the scan chain is as follows:
Either EXTEST or INTEST have
to be selected. They have the same meaning in this scan chain.
If the value captured by the Ready/nRW bit at the Capture-DR state is 1, the data that is being shifted in generates a request at the Update-DR state. The Address field indicates the register being accessed (see Table 13.2), the Data field contains the data to be written and the Ready/nRW bit holds the read/write information (0=read and 1=write). If the request is a read, the Data field is ignored.
When a request is placed, the Address and Data sections of the scan chain are frozen. That is, their contents are not shifted until the request is completed. This means that, if the value captured in the Ready/nRW field at the Capture-DR state is 0, the shifted-in data is ignored and the shifted-out value is all 0s.
After a read request has been placed, if the DBGTAPSM goes through the Capture-DR state and a logic 1 is captured in the Ready/nRW field, this means that the shift register has also captured the requested register contents. Therefore, they are shifted out at the same time as the Ready/nRW bit. The Data field is corrupted as new data is shifted in.
After a write request has been placed, if the DBGTAPSM goes through the Capture-DR state and a logic 1 is captured in the Ready/nRW field, this means that the requested write has completed successfully.
If the Address field is all 0s (address of the NULL register) at the Update-DR state, then no request is generated.
A request to a reserved register generates Unpredictable behavior.
Figure 13.11 shows the bit order in scan chain 7.
A typical sequence for writing registers is as follows:
Scan in the address of a first register, the data to write, and a 1 to indicate that this is a write request.
Scan in the address of a second register, the data to write, and a 1 to indicate that this is a write request.
Scan out 40 bits. If Ready/nRW is 0 repeat this step. If Ready/nRW is 1, the first write request has completed successfully and the second has been placed.
Scan in the address 0. The rest of the fields are not important.
Scan out 40 bits. If Ready/nRW is 0 repeat this step. If Ready/nRW is 1, the second write request has completed successfully. The scanned-in null request has avoided the generation of another request.
A typical sequence for reading registers is as follows:
Scan in the address of a first register and a 0 to indicate that this is a read request. The Data field is not important.
Scan in the address of a second register and a 0 to indicate that this is a read request.
Scan out 40 bits. If Ready/nRW is 0 then repeat this step. If Ready/nRW is 1, the first read request has completed successfully and the next scanned-out 32 bits are the requested value. The second read request was placed at the Update-DR state.
Scan in the address 0 (the rest of the fields are not important).
Scan out 40 bits. If Ready/nRW is 0 then repeat this step. If Ready/nRW is 1, the second read request has completed successfully and the next scanned-out 32 bits are the requested value. The scanned-in null request has avoided the generation of another request.
Table 13.2 shows the register map scan chain 7 register map. This is similar to the CP14 debug register map.
Table 13.2. Scan chain 7 register map
| Address[6:0] | Register number | Abbreviation | Register name |
|---|---|---|---|
| b0000000 | 0 | NULL | No request register |
| b0000001-b0000110 | 1-6 | - | Reserved |
| b0000111 | 7 | VCR | Vector Catch Register |
| b0001000 | 8 | PC | Program counter |
| b0010011-b0111111 | 19-63 | - | Reserved |
| b1000000-b1000101 | 64-69 | BVRy[1] | Breakpoint Value Registers |
| b1000110-b1001111 | 70-79 | - | Reserved |
| b1010000-b1010101 | 80-85 | BCRya | Breakpoint Control Registers |
| b1010110-b1011111 | 86-95 | - | Reserved |
| b1100000-b1100001 | 96-97 | WVRya | Watchpoint Value Registers |
| b1100010-1b101111 | 98-111 | - | Reserved |
| b1110000-b1110001 | 112-113 | WCRya | Watchpoint Control Registers |
| b1110010-b1111111 | 114-127 | - | Reserved |
[1] y is the decimal representation for the binary number Address[3:0] | |||
The following points apply to the use of scan chain 7:
Every time there is a request to read the PC, a sample of its value is copied into scan chain 7. Writes are ignored. The sampled value can be used for profiling of the code. See Interpreting the PC samples for details of how to interpret the sampled value.
When accessing registers using scan chain 7, the processor can be either in debug state or in normal state. This implies that breakpoints, watchpoints, and vector catches can be programmed through the Debug Test Access Port even if the processor is running. However, although a PC read can be requested in debug state, the result is Undefined.
The PC values read correspond to instructions committed for execution, including those that failed their condition code. However, these values are offset as described in Table 12.15. These offsets are different for different processor states, so additional information is required:
If a read request to the PC completes and Data[1:0] equals b00, the read value corresponds to an ARM state instruction whose 30 most significant bits of the offset address (instruction address + 8) are given in Data[31:2].
If a read request to the PC completes and Data[0] equals b1, the read value corresponds to a Thumb state instruction whose 31 most significant bits of the offset address (instruction address + 4) are given in Data[31:1].
If a read request to the PC completes and Data[1:0] equals b10, the read value corresponds to a Jazelle state instruction whose 30 most significant bits of its address are given in Data[31:2] (the offset is 0). Because of the state encoding, the lower two bits of the Java address are not sampled. However, the information provided is enough for profiling the code.
If the PC is read while the processor is in debug state, the result is Unpredictable.
| Copyright © 2005, 2006, 2008. All rights reserved. | ARM DDI 0360F |
| Non-Confidential | |
| PDF version | |
| Home > Debug Test Access Port > Debug registers > Scan chains |