eCOG1X User Manual - Appendix F eICE Debug Interface

Figure 143: eICE connections at eCOG1 device level

** The eICE_LOADB signal is a single point connection of two open drain signals at a pull-up resistor, as shown in the diagram below. This enables a handshake sequence to take place with eICE_LOADB as a bidirectional signal and either the master or the slave controlling the single pin. The eICE_MISO signal is also used as part of the handshake, see Section F.2, Handshake.

Figure 144: Open drain connection for eICE_LOADB

F.1 Signal Functions

When eICE_LOADB is high, the eICE_MISO serial stream contains the data read from the previous eICE command. When eICE_LOADB is low, the eICE_MISO signal is used as part of the master/slave handshaking as described below.

eICE_CLK is the clock signal used to shift in the eICE command and data, and is provided by the master. This is not a free running clock and is required to be suspended by the master, after the appropriate number of bits are shifted.

eICE_LOADB is both a control and handshake signal for eICE. It is an open drain signal which is driven low by the master and/or the slave to control transfers.

F.2 Handshake

The eICE communication handshake and eICE command/data shift in procedure works as follows.

Normally eICE_LOADB is released high by both the master and the slave.

Whilst eICE_LOADB is high, the master can shift in the frame (eICE command and data) to the slave. When the master finishes shifting the frame to the slave, it holds eICE_CLK low and then pulls eICE_LOADB low.

At this point, the slave sets eICE_MISO high. eICE_MISO remains high until the slave has recognised the presence of the frame sent by the master. Once the slave has recognised the frame it holds eICE_LOADB low and then sets eICE_MISO low. When the master sees the low going transition on eICE_MISO it releases eICE_LOADB. Since the slave is holding eICE_LOADB low, the master has an indication that the slave has received, and is executing, the eICE command. When the slave has completed the eICE command, it releases eICE_LOADB, the master observes eICE_LOADB going high and can then shift out the eICE command response and/or shift in a new eICE command. It is possible to shift out the response concurrently with shifting in a new eICE command. See the eICE handshake diagram below.

Figure 145: eICE handshake

F.3 Abort

The master may abort a pending eICE command while eICE_LOADB is held low by the slave. This is done by the master issuing 32 clock pulses on the eICE_CLK signal while eICE_LOADB is held low.

When the eCOG1 eICE detects an abort condition, it aborts the current instruction and returns the internal hardware to a safe state. The abort condition may therefore also be used to initialise the eCOG1 eICE after a power on. It is recommended that the external eICE master performs this initialisation when connecting to the eICE slave.

F.4 eICE Command and Data Shift

The eICE_MOSI serial stream contains the serial eICE command and data from master to slave as described in Section F.8, eICE Commands. Commands are shifted into the eICE slave, which then decodes and executes the received eICE command.

Note that the eICE command field contains the Read/Write bit in the MSB (bit 31). For eCOG1 this bit should be set to '1' for a read and '0' for a write.

For example, a write to register AH requires an eICE command field of 0x02000100, and a read of register AH requires an eICE command field of 0x82000100. The eICE command field is fixed at 32 bits and the data field is also 32 bits.

F.4.1 Shift In Sequence

The sequence of the shift in operation from the master is first the data field, then the eICE command field, MSB first. For 32-bit data and command, the sequence is data[31] first, followed by the remaining 31 bits of data, then command bit [31] (R/W bit) followed by the remaining 31 bits of the eICE command. See Figure 146, eICE timing for a write to slave. The master supplies the necessary number of clock pulses on eICE_CLK, i.e. 64 clocks for a 32 + 32 bit shift.

F.4.2 Shift Out Sequence

The sequence of the shift out operation from the slave is also controlled by the master, since it supplies eICE_CLK. The bit order of the serial shift out is first the data field starting from the MSB (bit 31), followed by the eICE command field starting from the MSB (bit 31). See Figure 147, eICE timing for a read from slave. Note that for a single word (16 bit) read, the read data appears in the least significant 16 bits.

A 'tag' read operation is one where the eICE command is a read of a single word (16 bit) memory location. By initialising the msb_rd_src field in the Mode register before the command is issued, it is possible to 'tag' a read of a 16 bit register into the spare 16 bits of the data field. Where a 'tag' read has been performed, the 'tag' data appears in the 16 most significant bits, with the normal read data again in the 16 least significant bits.

Figure 146: eICE timing for a write to slave

Figure 147: eICE timing for a read from slave

F.5 Clocking and Initial Operation

The eICE Master drives eICE_CLK to shift in eICE command and data words to the eCOG1. This clock is used to fill the eICE shift register in eCOG1. However, all other slave eICE logic is clocked by the asynchronous CPU clock.

The input stream (data and command) and the output stream are timed from the leading edge of eICE_CLK. The shift register inside the eCOG1 eICE captures data on the trailing edge of eICE_CLK and shifts data out on the leading edge of eICE_CLK. This means that both the input stream (write data and command) and the output stream (read data) are timed from the leading edge of eICE_CLK.

It should be noted that immediately after a power-on reset, the CPU clock may be running slowly from a low-speed crystal oscillator. This means that some care must be taken with initial eICE operations. The eICE_CLK may be clocked faster than the CPU clock, but the eICE handshake protocol must be observed and there should be 4 CPU clock periods between eICE transactions. The CPU clock frequency may be increased by writing a suitable value to the cpu_clk_div field in the ssm.cpu register via eICE. Once the CPU clock rate is increased, the rate of eICE transactions may also be increased, limited only by the handshake protocol which remains fundamentally dependent on 4 CPU clock cycles.

F.6 eICE_LOADB and Reset

The level of the eICE_LOADB input signal is sampled as the processor comes out of reset. If the signal is high, then the processor enters the RUN state and programme execution starts from the reset vector. If the eICE_LOADB_IN is low when the CPU comes out of reset, then the processor enters the STOP state and no programme execution occurs.

This is useful to prevent the CPU from attempting to execute code from an unprogrammed flash, or if there is erroneous code programmed into the flash memory that prevents eICE communication when execution starts after reset.

F.7 eICE Registers

There are two registers available specifically for eICE control and status. These registers are not CPU or I/O mapped registers but are specifically and solely for the use of eICE. They are accessed only with specific eICE commands, see table later in this section.

F.7.1 Mode Register

The mode register is used to configure and control the operation of subsequent eICE cycles. The following table describes the operation of each bit field. This register is read and written through eICE.

Table 147: eICE mode register

Bits	Name	Description
15:8	magic	This field must be set to 0x0e for mode register write operations, otherwise the mode bits are not updated.
7:6		Reserved.
5	clr_sts	When set to '1', the address error and abort status bits in the eICE status register are cleared. This bit must be reset to '0' to allow these status bits to be set again.
4	dbl_mem_wait	When set to '1', a double (32 bit) memory access only completes after the next two SIF instructions. Otherwise the double memory access completes on the next SIF instruction. This bit is only operative if the non_intr bit is at '0'.
3	non_intr	When set to '1', eICE accesses complete on the next CPU cycle instead of waiting for a SIF instruction (embedded in the code). If necessary the next CPU cycle has wait states inserted.
2:1	msb_rd_src	This field selects the tag data source** for 16 bit memory access cycles. '00' All zero '01' Contents of the lower 16 bits of PC '10' Contents of AH register '11' Reserved
0		This bit defaults to '0' and must always be written with a '0'.

** If an eICE command for a single word memory read is required, it is possible to 'tag' a read of the AH register or the PC program counter (lower 16 bits only) into the unused most significant 16 bits of data in the 32-bit data field.

F.7.2 Status Register

A 10 bit status register is provided for eICE. The following table outlines the operation of each bit. See the relevant eICE command in Section F.8. This register is read only.

Table 148: eICE status register

Bits	Name	Description
9	addr_err	Set when an eICE cycle causes an address error.
8	abort	Set when an eICE cycle is aborted. An eICE cycle is aborted by sending 32 eICE clocks with the eICE_LOADB signal held low.
7	cpu_wakeup	Shows the state of the eICE wakeup signal.
6	cpu_step	Indicates the status of the core control mode step bit. Set when the CPU is commanded to execute a single step or run to a breakpoint, cleared when commanded to run normally or stop.
5	cpu_run	Indicates the status of the core control mode run bit. Set when the CPU is commanded to run normally or to a breakpoint, cleared when commanded to stop or execute a single step.
4	break_status	Set when the CPU stops because of a Code Address, Data Address Read or Data Address Write break.
3	cpu_break	Shows the state of the CPU_Break input pin.
2	cpu_sleep	Set when the CPU is sleeping.
1	cpu_stop	Set when the CPU is stopped.
0	debug_en	Shows the state of the eICE Debug Enable bit (DE). (see Section F.8, eICE Commands below). This bit must be set in order to execute any debug commands or access CPU core registers. Memory (code and data) and peripheral registers are accessible via eICE without this bit set.

F.7.3 Break Registers

The eCOG1X eICE block implements five Code Address hardware breakpoints and one Data Value/Address hardware breakpoint.

The code space addresses for the five Code Address breakpoints are stored in registers BRKREG0 to BRKREG4 as 24-bit values. These can be read and written either as one 8-bit and one 16-bit value, or as a single 24-bit value. When the program counter matches the code space address value in one of the Code Address break registers and (for BRKREG1 to BRKREG4) the breakpoint is enabled, a break occurs and program execution stops before the instruction at this address is executed.

The Data Value/Address breakpoint is controlled by four registers, each containing a 16-bit value. These are arranged as two pairs, one for the address and one for the data value, each pair comprising a match register and a mask register. When a data space access occurs, both the address and the data value are ANDed with their mask register values and then checked against their match register values. Bit positions set to '0' in the mask register are compared, while bit positions set to '1' in the mask register are ignored. If all address and data bits included in the comparison are the same as those set in the match registers, then a break occurs and execution stops.

When a break occurs, the break_status bit in the eICE status register is set. This bit is cleared when a Stop command is received.

The BRKENABLE register controls which breakpoints are enabled and disabled.

Note that the first code address breakpoint in BRKREG0 is always enabled.

The register contains the following fields.

Table 149: eICE break enable register

Bits	Name	Description
5	brk_wr_en	Set to '1' to enable the data breakpoint on write cycles.
4	brk_rd_en	Set to '1' to enable the data breakpoint on read cycles.
3	brk4_en	Set to '1' to enable the code breakpoint in BRKREG4.
2	brk3_en	Set to '1' to enable the code breakpoint in BRKREG3.
1	brk2_en	Set to '1' to enable the code breakpoint in BRKREG2.
0	brk1_en	Set to '1' to enable the code breakpoint in BRKREG1.

F.8 eICE Commands

The following table contains the eICE commands that the eICE debugger performs. Note that the hexadecimal code is defined for the full 32-bit eICE command, and assumes that the R/W bit (bit 31) is set to '0' for a write.

Table 150: eICE commands

eICE command (32 bits)	R/W	DE state	Data (32 bits)	Action
0x03100000	W	X	0xD0FF	Debug Disable (clears the DE state bit)
0x03100001	W	X	0x0DBE	Debug Enable (sets the DE state bit)
0x02000000	-	1	-	Reset CPU
0x02000001	-	1	-	Stop
0x02000002	-	1	-	Single Step
0x02000003	-	1	-	Run to Break
0x02000004	-	1	-	Run
0x02000005	-	1	-	Wakeup
0x82000100	RW	X	0xXXXX	AH Register Read
0x02000100	RW	X	0xXXXX	AH Register Write
0x82000101	RW	X	0xXXXX	AL Register Read
0x02000101	RW	X	0xXXXX	AL Register Write
0x82000102	RW	X	0x00XX	UXH Register Read
0x02000102	RW	X	0x00XX	UXH Register Write
0x82000103	RW	X	0xXXXX	UX Register Read
0x02000103	RW	X	0xXXXX	UX Register Write
0x82000104	RW	X	0xXXXX	UY Register Read
0x02000104	RW	X	0xXXXX	UY Register Write
0x82000105	RW	X	0x00XX	IXH Register Read
0x02000105	RW	X	0x00XX	IXH Register Write
0x82000106	RW	X	0xXXXX	IX Register Read
0x82000106	RW	X	0xXXXX	IX Register Write
0x82000107	RW	X	0xXXXX	IY Register Read
0x02000107	RW	X	0xXXXX	IY Register Write
0x82000108	RW	X	0x00XX	FLAGS Register Read
0x02000108	RW	X	0x00XX	FLAGS Register Write
0x82000109	RW	X	0x00XX	PCH Register Read
0x02000109	RW	X	0x00XX	PCH Register Write
0x8200010A	RW	X	0xXXXX	PCL Register Read
0x0200010A	RW	X	0xXXXX	PCL Register Write
0x8200010B	RW	X	0x00XX	BRKREG0H Register Read
0x0200010B	RW	X	0x00XX	BRKREG0H Register Write
0x8200010C	RW	X	0xXXXX	BRKREG0L Register Read
0x0200010C	RW	X	0xXXXX	BRKREG0L Register Write
0x0200010D	W	X	0xXXXXXX	PC 24 bit write
0x0200010E	W	X	0xXXXXXX	BRKREG0 24 bit write
0x8200010F	RW	X	0x00XX	BRKREG1H Register Read
0x0200010F	RW	X	0x00XX	BRKREG1H Register Write
0x82000110	RW	X	0xXXXX	BRKREG1L Register Read
0x02000110	RW	X	0xXXXX	BRKREG1L Register Write
0x02000111	W	X	0xXXXXXX	BRKREG1 24 bit write
0x82000112	RW	X	0x00XX	BRKREG2H Register Read
0x02000112	RW	X	0x00XX	BRKREG2H Register Write
0x82000113	RW	X	0xXXXX	BRKREG2L Register Read
0x02000113	RW	X	0xXXXX	BRKREG2L Register Write
0x02000114	W	X	0xXXXXXX	BRKREG2 24 bit write
0x82000115	RW	X	0x00XX	BRKREG3H Register Read
0x02000115	RW	X	0x00XX	BRKREG3H Register Write
0x82000116	RW	X	0xXXXX	BRKREG3L Register Read
0x02000116	RW	X	0xXXXX	BRKREG3L Register Write
0x02000117	W	X	0xXXXXXX	BRKREG3 24 bit write
0x82000118	RW	X	0x00XX	BRKREG4H Register Read
0x02000118	RW	X	0x00XX	BRKREG4H Register Write
0x82000119	RW	X	0xXXXX	BRKREG4L Register Read
0x02000119	RW	X	0xXXXX	BRKREG4L Register Write
0x0200011A	W	X	0xXXXXXX	BRKREG4 24 bit write
0x8200011B	RW	X	0xXXXX	DATABRKVAL Register Read
0x0200011B	RW	X	0xXXXX	DATABRKVAL Register Write
0x8200011C	RW	X	0xXXXX	DATABRKVALMASK Register Read
0x0200011C	RW	X	0xXXXX	DATABRKVALMASK Register Write
0x8200011D	RW	X	0xXXXX	DATABRKADDR Register Read
0x0200011D	RW	X	0xXXXX	DATABRKADDR Register Write
0x8200011E	RW	X	0xXXXX	DATABRKADDRMASK Register Read
0x0200011E	RW	X	0xXXXX	DATABRKADDRMASK Register Write
0x8200011F	RW	X	0x00XX	BRKENABLE Register Read
0x0200011F	RW	X	0x00XX	BRKENABLE Register Write
0x82000200	RW	X	0x0000XX	eICE Mode Register Read
0x02000200	RW	X	0x0000XX	eICE Mode Register Write
0x82000201	R	X	0x0000XX	eICE Version Register Read
0x82000400	R	1	0x00XX	eICE Status Register read
0x8000****	RW	X	0x[IP]XXXX	Data Memory Single Word Read
0x0000****	RW	X	0xXXXX	Data Memory Single Word Write
0x81******	RW	X	0x[IP]XXXX	Program Memory Single Word Read
0x01******	RW	X	0xXXXX	Program Memory Single Word Write
0x8400****	RW	X	0xXXXXXXXX	Data Memory Double Word Read
0x0400****	RW	X	0xXXXXXXXX	Data Memory Double Word Write
0x85******	RW	X	0xXXXXXXXX	Program Memory Double Word Read
0x05******	RW	X	0xXXXXXXXX	Program Memory Double Word Write
0x9000****	RW	X	0x[IP]XXXX	I/O Register Word Read
0x1000****	RW	X	0xXXXX	I/O Register Word Write

Notes

[IP] Refers to the tag data which is available in the high 16 bits of the 32-bit data value returned for a single word read.
Fields marked **** in the eICE command word are for addresses.
Double word accesses to code space or data space memory should be made only to even word addresses. The upper 16 bits are read from or written to the even address and the lower 16 bits are read from or written to the next odd address, consistent with the eCOG1 big-endian data format.

eICE_MOSI	Master Out Slave In, the serial debug data stream into eCOG1.
eICE_MISO	Master In Slave Out, the serial debug data stream from eCOG1. **
eICE_CLK	The debug clock, provided by the master.
eICE_LOADB	The Load control and handshake signal for eICE. **