S912XEQ384BVALR

MC9S12XEP100 Reference Manual Covers MC9S12XE Family HCS12X Microcontrollers MC9S12XEP100RMV1 Rev. 1.25 02/2013 freescale.com To provide the most up-to-date information, the document revision on the World Wide Web is the most current. A printed copy may be an earlier revision. To verif, refer to: freescale.com This document contains information for the complete S12XE-Family and thus includes a set of separate FTM module sections to cover the whole family. A full list of family members and options is included in the appendices. This document contains information for all constituent modules, with the exception of the S12X CPU. For S12X CPU information please refer to CPU12XV2 in the CPU12/CPU12X Reference Manual. Revision History. Refer to module section revision history tables for more information. Date Revision Description 1.18 Updated NVM timing parameter section for brownout case Specified time delay from RESET to start of CPU code execution Added NVM patch Part IDs Enhanced ECT GPIO / timer function transitioning description Dec, 2008 1.19 Updated 208MAPBGA thermal parameters Revised TIM flag clearing procedure Corrected CRG register address Added maskset identifier suffix for ATMC fab Fixed typos Aug, 2009 1.20 Added 208MAPBGA disclaimer Added VREAPI to PT5. Added LVR Note to electricals. Updates to TIM/ECT/XGATE/SCI/MSCAN (see embedded rev. history) Apr, 2010 1.21 FTM section (see FTM revision history) PIM section (see PIM revision history) May, 2010 1.22 ECT and TIM sections (see ECT, TIM revision history tables) BDM Alternate clock source defined in device overview Sep, 2010 1.23 Added S12XEG256 option. Updated MSCAN section Aug, 2012 1.24 Added bandgap voltage to electricals Added new maskset and Part ID numbers Minor updates to MSCAN,SCI and S12XINT sections Removed BGA disclaimer Feb, 2013 1.25 Updated MSCAN section Formatting updates and minor corrections in PWM, CRG, BDM, DBG sections Updated Ordering Information Sep, 2008 Chapter 1 Device Overview MC9S12XE-Family. . . . . . . . . . . . . . . . . . . . . 27 Chapter 2 Port Integration Module (S12XEP100PIMV1) . . . . . . . . . . . . . . 89 Chapter 3 Memory Mapping Control (S12XMMCV4) . . . . . . . . . . . . . . . . 187 Chapter 4 Memory Protection Unit (S12XMPUV1) . . . . . . . . . . . . . . . . . 227 Chapter 5 External Bus Interface (S12XEBIV4) . . . . . . . . . . . . . . . . . . . . 241 Chapter 6 Interrupt (S12XINTV2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261 Chapter 7 Background Debug Module (S12XBDMV2) . . . . . . . . . . . . . . 279 Chapter 8 S12X Debug (S12XDBGV3) Module . . . . . . . . . . . . . . . . . . . . 305 Chapter 9 Security (S12XE9SECV2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 347 Chapter 10 XGATE (S12XGATEV3). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 353 Chapter 11 S12XE Clocks and Reset Generator (S12XECRGV1) . . . . . . 469 Chapter 12 Pierce Oscillator (S12XOSCLCPV2) . . . . . . . . . . . . . . . . . . . . 499 Chapter 13 Analog-to-Digital Converter (ADC12B16CV1) . . . . . . . . . . . . 503 Chapter 14 Enhanced Capture Timer (ECT16B8CV3). . . . . . . . . . . . . . . . 527 Chapter 15 Inter-Integrated Circuit (IICV3) Block Description. . . . . . . . . 579 Chapter 16 Scalable Controller Area Network (S12MSCANV3) . . . . . . . . 605 Chapter 17 Periodic Interrupt Timer (S12PIT24B8CV2) . . . . . . . . . . . . . . 659 Chapter 18 Periodic Interrupt Timer (S12PIT24B4CV2) . . . . . . . . . . . . . . 677 Chapter 19 Pulse-Width Modulator (S12PWM8B8CV1) . . . . . . . . . . . . . . 691 Chapter 20 Serial Communication Interface (S12SCIV5) . . . . . . . . . . . . . 723 Chapter 21 Serial Peripheral Interface (S12SPIV5) . . . . . . . . . . . . . . . . . . 761 Chapter 22 Timer Module (TIM16B8CV2) Block Description . . . . . . . . . . 787 Chapter 23 Voltage Regulator (S12VREGL3V3V1) . . . . . . . . . . . . . . . . . . 815 Chapter 24 128 KByte Flash Module (S12XFTM128K2V1) . . . . . . . . . . . . 832 Chapter 25 256 KByte Flash Module (S12XFTM256K2V1) . . . . . . . . . . . . 891 MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 3 Chapter 26 384 KByte Flash Module (S12XFTM384K2V1) . . . . . . . . . . . . 953 Chapter 27 512 KByte Flash Module (S12XFTM512K3V1) . . . . . . . . . . . 1016 Chapter 28 768 KByte Flash Module (S12XFTM768K4V2) . . . . . . . . . . . 1077 Chapter 29 1024 KByte Flash Module (S12XFTM1024K5V2) . . . . . . . . . 1140 Appendix A Electrical Characteristics. . . . . . . . . . . . . . . . . . . . . . . . . . . . 1201 Appendix B Package Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1258 Appendix C PCB Layout Guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1260 Appendix D Derivative Differences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1268 Appendix E Detailed Register Address Map. . . . . . . . . . . . . . . . . . . . . . . 1271 Appendix F Ordering Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1322 MC9S12XE-Family Reference Manual Rev. 1.25 4 Freescale Semiconductor Blank Page MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 5 Blank Page MC9S12XE-Family Reference Manual Rev. 1.25 6 Freescale Semiconductor Chapter 1 Device Overview MC9S12XE-Family 1.1 1.2 1.3 1.4 1.5 1.6 1.7 1.8 1.9 1.10 1.11 1.12 1.13 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 1.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 1.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 1.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 1.1.4 Device Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 1.1.5 Address Mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 1.1.6 Detailed Register Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 1.1.7 Part ID Assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 1.2.1 Device Pinout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 1.2.2 Pin Assignment Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 1.2.3 Detailed Signal Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 1.2.4 Power Supply Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 System Clock Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76 1.4.1 Chip Configuration Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76 1.4.2 Power Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 1.4.3 Freeze Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 1.4.4 System States . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 Resets and Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 1.6.1 Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 1.6.2 Vectors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 1.6.3 Effects of Reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 ADC0 Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86 1.7.1 External Trigger Input Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86 1.7.2 ADC0 Channel[17] Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86 ADC1 External Trigger Input Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86 MPU Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 VREG Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 1.10.1 Temperature Sensor Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 BDM Clock Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 S12XEPIM Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 Oscillator Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 Chapter 2 Port Integration Module (S12XEPIMV1) 2.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 7 2.2 2.3 2.1.1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 2.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 2.3.1 Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 2.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 2.3.3 Port A Data Register (PORTA) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 2.3.4 Port B Data Register (PORTB) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 2.3.5 Port A Data Direction Register (DDRA) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 2.3.6 Port B Data Direction Register (DDRB) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 2.3.7 Port C Data Register (PORTC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 2.3.8 Port D Data Register (PORTD) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111 2.3.9 Port C Data Direction Register (DDRC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111 2.3.10 Port D Data Direction Register (DDRD) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112 2.3.11 Port E Data Register (PORTE) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 2.3.12 Port E Data Direction Register (DDRE) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114 2.3.13 S12X_EBI ports, BKGD pin Pull-up Control Register (PUCR) . . . . . . . . . . . . . . . . . . 114 2.3.14 S12X_EBI ports Reduced Drive Register (RDRIV) . . . . . . . . . . . . . . . . . . . . . . . . . . . 116 2.3.15 ECLK Control Register (ECLKCTL) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117 2.3.16 PIM Reserved Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118 2.3.17 IRQ Control Register (IRQCR) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119 2.3.18 PIM Reserved Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119 2.3.19 Port K Data Register (PORTK) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120 2.3.20 Port K Data Direction Register (DDRK) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120 2.3.21 Port T Data Register (PTT) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121 2.3.22 Port T Input Register (PTIT) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 2.3.23 Port T Data Direction Register (DDRT) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 2.3.24 Port T Reduced Drive Register (RDRT) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 2.3.25 Port T Pull Device Enable Register (PERT) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 2.3.26 Port T Polarity Select Register (PPST) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124 2.3.27 PIM Reserved Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124 2.3.28 PIM Reserved Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124 2.3.29 Port S Data Register (PTS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125 2.3.30 Port S Input Register (PTIS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126 2.3.31 Port S Data Direction Register (DDRS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126 2.3.32 Port S Reduced Drive Register (RDRS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127 2.3.33 Port S Pull Device Enable Register (PERS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128 2.3.34 Port S Polarity Select Register (PPSS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128 2.3.35 Port S Wired-Or Mode Register (WOMS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129 2.3.36 PIM Reserved Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129 2.3.37 Port M Data Register (PTM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130 2.3.38 Port M Input Register (PTIM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131 2.3.39 Port M Data Direction Register (DDRM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132 2.3.40 Port M Reduced Drive Register (RDRM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134 2.3.41 Port M Pull Device Enable Register (PERM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134 MC9S12XE-Family Reference Manual Rev. 1.25 8 Freescale Semiconductor 2.3.42 2.3.43 2.3.44 2.3.45 2.3.46 2.3.47 2.3.48 2.3.49 2.3.50 2.3.51 2.3.52 2.3.53 2.3.54 2.3.55 2.3.56 2.3.57 2.3.58 2.3.59 2.3.60 2.3.61 2.3.62 2.3.63 2.3.64 2.3.65 2.3.66 2.3.67 2.3.68 2.3.69 2.3.70 2.3.71 2.3.72 2.3.73 2.3.74 2.3.75 2.3.76 2.3.77 2.3.78 2.3.79 2.3.80 2.3.81 2.3.82 2.3.83 2.3.84 2.3.85 2.3.86 Port M Polarity Select Register (PPSM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135 Port M Wired-Or Mode Register (WOMM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135 Module Routing Register (MODRR) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136 Port P Data Register (PTP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137 Port P Input Register (PTIP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138 Port P Data Direction Register (DDRP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139 Port P Reduced Drive Register (RDRP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140 Port P Pull Device Enable Register (PERP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140 Port P Polarity Select Register (PPSP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141 Port P Interrupt Enable Register (PIEP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141 Port P Interrupt Flag Register (PIFP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142 Port H Data Register (PTH) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142 Port H Input Register (PTIH) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144 Port H Data Direction Register (DDRH) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144 Port H Reduced Drive Register (RDRH) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146 Port H Pull Device Enable Register (PERH) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147 Port H Polarity Select Register (PPSH) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147 Port H Interrupt Enable Register (PIEH) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148 Port H Interrupt Flag Register (PIFH) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148 Port J Data Register (PTJ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149 Port J Input Register (PTIJ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150 Port J Data Direction Register (DDRJ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150 Port J Reduced Drive Register (RDRJ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152 Port J Pull Device Enable Register (PERJ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153 Port J Polarity Select Register (PPSJ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153 Port J Interrupt Enable Register (PIEJ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154 Port J Interrupt Flag Register (PIFJ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154 Port AD0 Data Register 0 (PT0AD0) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155 Port AD0 Data Register 1 (PT1AD0) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155 Port AD0 Data Direction Register 0 (DDR0AD0) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156 Port AD0 Data Direction Register 1 (DDR1AD0) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156 Port AD0 Reduced Drive Register 0 (RDR0AD0) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157 Port AD0 Reduced Drive Register 1 (RDR1AD0) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158 Port AD0 Pull Up Enable Register 0 (PER0AD0) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158 Port AD0 Pull Up Enable Register 1 (PER1AD0) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159 Port AD1 Data Register 0 (PT0AD1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159 Port AD1 Data Register 1 (PT1AD1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160 Port AD1 Data Direction Register 0 (DDR0AD1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160 Port AD1 Data Direction Register 1 (DDR1AD1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161 Port AD1 Reduced Drive Register 0 (RDR0AD1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162 Port AD1 Reduced Drive Register 1 (RDR1AD1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162 Port AD1 Pull Up Enable Register 0 (PER0AD1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163 Port AD1 Pull Up Enable Register 1 (PER1AD1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163 Port R Data Register (PTR) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164 Port R Input Register (PTIR) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164 MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 9 2.4 2.5 2.3.87 Port R Data Direction Register (DDRR) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165 2.3.88 Port R Reduced Drive Register (RDRR) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165 2.3.89 Port R Pull Device Enable Register (PERR) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166 2.3.90 Port R Polarity Select Register (PPSR) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166 2.3.91 PIM Reserved Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167 2.3.92 Port R Routing Register (PTRRR) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167 2.3.93 Port L Data Register (PTL) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168 2.3.94 Port L Input Register (PTIL) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170 2.3.95 Port L Data Direction Register (DDRL) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170 2.3.96 Port L Reduced Drive Register (RDRL) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171 2.3.97 Port L Pull Device Enable Register (PERL) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171 2.3.98 Port L Polarity Select Register (PPSL) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172 2.3.99 Port L Wired-Or Mode Register (WOML) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172 2.3.100Port L Routing Register (PTLRR) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173 2.3.101Port F Data Register (PTF) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173 2.3.102Port F Input Register (PTIF) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175 2.3.103Port F Data Direction Register (DDRF) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175 2.3.104Port F Reduced Drive Register (RDRF) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176 2.3.105Port F Pull Device Enable Register (PERF) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176 2.3.106Port F Polarity Select Register (PPSF) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177 2.3.107PIM Reserved Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177 2.3.108Port F Routing Register (PTFRR) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178 2.4.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178 2.4.2 Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178 2.4.3 Pins and Ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181 2.4.4 Pin interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185 Initialization Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186 2.5.1 Port Data and Data Direction Register writes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186 Chapter 3 Memory Mapping Control (S12XMMCV4) 3.1 3.2 3.3 3.4 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187 3.1.1 Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188 3.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188 3.1.3 S12X Memory Mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189 3.1.4 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189 3.1.5 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192 3.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192 3.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 204 3.4.1 MCU Operating Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 204 3.4.2 Memory Map Scheme . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205 MC9S12XE-Family Reference Manual Rev. 1.25 10 Freescale Semiconductor 3.5 3.4.3 Chip Access Restrictions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217 3.4.4 Chip Bus Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217 Initialization/Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218 3.5.1 CALL and RTC Instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218 3.5.2 Port Replacement Registers (PRRs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220 3.5.3 On-Chip ROM Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221 Chapter 4 Memory Protection Unit (S12XMPUV1) 4.1 4.2 4.3 4.4 4.5 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227 4.1.1 Preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227 4.1.2 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227 4.1.3 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 228 4.1.4 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229 4.3.1 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237 4.4.1 Protection Descriptors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237 4.4.2 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239 Initialization/Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239 4.5.1 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239 Chapter 5 External Bus Interface (S12XEBIV4) 5.1 5.2 5.3 5.4 5.5 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 241 5.1.1 Glossary or Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242 5.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242 5.1.3 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242 5.1.4 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245 5.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245 5.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248 5.4.1 Operating Modes and External Bus Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248 5.4.2 Internal Visibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249 5.4.3 Accesses to Port Replacement Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253 5.4.4 Stretched External Bus Accesses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253 5.4.5 Data Select and Data Direction Signals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 254 5.4.6 Low-Power Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 256 Initialization/Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 256 5.5.1 Normal Expanded Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 256 5.5.2 Emulation Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257 MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 11 Chapter 6 Interrupt (S12XINTV2) 6.1 6.2 6.3 6.4 6.5 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261 6.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262 6.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262 6.1.3 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263 6.1.4 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 264 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 264 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265 6.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265 6.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 266 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271 6.4.1 S12X Exception Requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 272 6.4.2 Interrupt Prioritization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 272 6.4.3 XGATE Requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273 6.4.4 Priority Decoders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273 6.4.5 Reset Exception Requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 274 6.4.6 Exception Priority . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 274 Initialization/Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 275 6.5.1 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 275 6.5.2 Interrupt Nesting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 275 6.5.3 Wake Up from Stop or Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 276 Chapter 7 Background Debug Module (S12XBDMV2) 7.1 7.2 7.3 7.4 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279 7.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279 7.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 280 7.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 281 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 281 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 282 7.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 282 7.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 282 7.3.3 Family ID Assignment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 287 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 287 7.4.1 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 288 7.4.2 Enabling and Activating BDM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 288 7.4.3 BDM Hardware Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289 7.4.4 Standard BDM Firmware Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 290 7.4.5 BDM Command Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 291 7.4.6 BDM Serial Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 293 7.4.7 Serial Interface Hardware Handshake Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 296 7.4.8 Hardware Handshake Abort Procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 298 7.4.9 SYNC — Request Timed Reference Pulse . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 301 MC9S12XE-Family Reference Manual Rev. 1.25 12 Freescale Semiconductor 7.4.10 Instruction Tracing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 302 7.4.11 Serial Communication Time Out . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 303 Chapter 8 S12X Debug (S12XDBGV3) Module 8.1 8.2 8.3 8.4 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 305 8.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 305 8.1.2 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 306 8.1.3 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 306 8.1.4 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 307 8.1.5 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 308 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 308 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 308 8.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 308 8.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 310 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 326 8.4.1 S12XDBG Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 327 8.4.2 Comparator Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 327 8.4.3 Trigger Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 331 8.4.4 State Sequence Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 332 8.4.5 Trace Buffer Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 333 8.4.6 Tagging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 341 8.4.7 Breakpoints . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 342 Chapter 9 Security (S12XE9SECV2) 9.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 347 9.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 347 9.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 348 9.1.3 Securing the Microcontroller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 348 9.1.4 Operation of the Secured Microcontroller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 349 9.1.5 Unsecuring the Microcontroller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 350 9.1.6 Reprogramming the Security Bits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 351 9.1.7 Complete Memory Erase (Special Modes) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 351 Chapter 10 XGATE (S12XGATEV3) 10.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 353 10.1.1 Glossary of Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 353 10.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 354 10.1.3 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 355 10.1.4 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 355 10.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 356 10.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 356 MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 13 10.4 10.5 10.6 10.7 10.8 10.9 10.3.1 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 356 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 373 10.4.1 XGATE RISC Core . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 374 10.4.2 Programmer’s Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 374 10.4.3 Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 375 10.4.4 Semaphores . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 376 10.4.5 Software Error Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 378 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 379 10.5.1 Incoming Interrupt Requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 379 10.5.2 Outgoing Interrupt Requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 379 Debug Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 379 10.6.1 Debug Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 379 10.6.2 Leaving Debug Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 381 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 381 Instruction Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 382 10.8.1 Addressing Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 382 10.8.2 Instruction Summary and Usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 385 10.8.3 Cycle Notation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 387 10.8.4 Thread Execution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 388 10.8.5 Instruction Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 388 10.8.6 Instruction Coding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 461 Initialization and Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 463 10.9.1 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 463 10.9.2 Code Example (Transmit "Hello World!" on SCI) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 463 10.9.3 Stack Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 466 Chapter 11 S12XE Clocks and Reset Generator (S12XECRGV1) 11.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 469 11.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 469 11.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 470 11.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 470 11.2 Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 471 11.2.1 VDDPLL, VSSPLL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 471 11.2.2 RESET . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 471 11.3 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 472 11.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 472 11.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 473 11.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 486 11.4.1 Functional Blocks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 486 11.4.2 Operation Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 491 11.4.3 Low Power Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 492 11.5 Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 494 11.5.1 Description of Reset Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 495 11.6 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 497 MC9S12XE-Family Reference Manual Rev. 1.25 14 Freescale Semiconductor 11.6.1 Description of Interrupt Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 498 Chapter 12 Pierce Oscillator (S12XOSCLCPV2) 12.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 499 12.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 499 12.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 499 12.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 500 12.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 500 12.2.1 VDDPLL and VSSPLL — Operating and Ground Voltage Pins . . . . . . . . . . . . . . . . . . . . 500 12.2.2 EXTAL and XTAL — Input and Output Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 500 12.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 502 12.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 502 12.4.1 Gain Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 502 12.4.2 Clock Monitor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 502 12.4.3 Wait Mode Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 502 12.4.4 Stop Mode Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 502 Chapter 13 Analog-to-Digital Converter (ADC12B16CV1) 13.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 503 13.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 503 13.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 504 13.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 505 13.2 Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 506 13.2.1 Detailed Signal Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 506 13.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 506 13.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 506 13.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 508 13.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 523 13.4.1 Analog Sub-Block . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 523 13.4.2 Digital Sub-Block . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 524 13.5 Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 525 13.6 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 525 Chapter 14 Enhanced Capture Timer (ECT16B8CV3) 14.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 527 14.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 527 14.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 528 14.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 529 14.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 529 14.2.1 IOC7 — Input Capture and Output Compare Channel 7 . . . . . . . . . . . . . . . . . . . . . . . . 529 14.2.2 IOC6 — Input Capture and Output Compare Channel 6 . . . . . . . . . . . . . . . . . . . . . . . . 529 MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 15 14.2.3 IOC5 — Input Capture and Output Compare Channel 5 . . . . . . . . . . . . . . . . . . . . . . . . 530 14.2.4 IOC4 — Input Capture and Output Compare Channel 4 . . . . . . . . . . . . . . . . . . . . . . . . 530 14.2.5 IOC3 — Input Capture and Output Compare Channel 3 . . . . . . . . . . . . . . . . . . . . . . . . 530 14.2.6 IOC2 — Input Capture and Output Compare Channel 2 . . . . . . . . . . . . . . . . . . . . . . . . 530 14.2.7 IOC1 — Input Capture and Output Compare Channel 1 . . . . . . . . . . . . . . . . . . . . . . . . 530 14.2.8 IOC0 — Input Capture and Output Compare Channel 0 . . . . . . . . . . . . . . . . . . . . . . . . 530 14.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 530 14.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 530 14.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 530 14.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 566 14.4.1 Enhanced Capture Timer Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 573 14.4.2 Reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 577 14.4.3 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 577 Chapter 15 Inter-Integrated Circuit (IICV3) Block Description 15.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 579 15.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 579 15.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 580 15.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 580 15.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 580 15.2.1 IIC_SCL — Serial Clock Line Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 580 15.2.2 IIC_SDA — Serial Data Line Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 580 15.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 581 15.3.1 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 581 15.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 593 15.4.1 I-Bus Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 593 15.4.2 Operation in Run Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 598 15.4.3 Operation in Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 598 15.4.4 Operation in Stop Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 598 15.5 Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 598 15.6 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 598 15.7 Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 599 15.7.1 IIC Programming Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 599 Chapter 16 Freescale’s Scalable Controller Area Network (S12MSCANV3) 16.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 605 16.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 606 16.1.2 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 606 16.1.3 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 607 16.1.4 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 607 16.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 608 16.2.1 RXCAN — CAN Receiver Input Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 608 MC9S12XE-Family Reference Manual Rev. 1.25 16 Freescale Semiconductor 16.2.2 TXCAN — CAN Transmitter Output Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 608 16.2.3 CAN System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 608 16.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 609 16.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 609 16.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 611 16.3.3 Programmer’s Model of Message Storage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 630 16.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 641 16.4.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 641 16.4.2 Message Storage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 641 16.4.3 Identifier Acceptance Filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 644 16.4.4 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 650 16.4.5 Low-Power Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 652 16.4.6 Reset Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 656 16.4.7 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 656 16.5 Initialization/Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 658 16.5.1 MSCAN initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 658 16.5.2 Bus-Off Recovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 658 Chapter 17 Periodic Interrupt Timer (S12PIT24B8CV2) 17.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 659 17.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 659 17.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 659 17.1.3 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 659 17.1.4 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 660 17.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 660 17.3 Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 661 17.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 671 17.4.1 Timer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 672 17.4.2 Interrupt Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 673 17.4.3 Hardware Trigger . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 673 17.5 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 674 17.5.1 Startup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 674 17.5.2 Shutdown . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 674 17.5.3 Flag Clearing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 674 17.6 Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 674 Chapter 18 Periodic Interrupt Timer (S12PIT24B4CV2) 18.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 677 18.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 677 18.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 677 18.1.3 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 677 18.1.4 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 678 MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 17 18.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 678 18.3 Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 678 18.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 687 18.4.1 Timer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 687 18.4.2 Interrupt Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 689 18.4.3 Hardware Trigger . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 689 18.5 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 689 18.5.1 Startup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 689 18.5.2 Shutdown . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 689 18.5.3 Flag Clearing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 689 18.6 Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 690 Chapter 19 Pulse-Width Modulator (S12PWM8B8CV1) 19.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 691 19.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 691 19.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 691 19.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 692 19.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 692 19.2.1 PWM7 — PWM Channel 7 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 692 19.2.2 PWM6 — PWM Channel 6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 693 19.2.3 PWM5 — PWM Channel 5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 693 19.2.4 PWM4 — PWM Channel 4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 693 19.2.5 PWM3 — PWM Channel 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 693 19.2.6 PWM3 — PWM Channel 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 693 19.2.7 PWM3 — PWM Channel 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 693 19.2.8 PWM3 — PWM Channel 0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 693 19.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 693 19.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 693 19.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 694 19.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 709 19.4.1 PWM Clock Select . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 709 19.4.2 PWM Channel Timers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 712 19.5 Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 720 19.6 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 721 Chapter 20 Serial Communication Interface (S12SCIV5) 20.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 723 20.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 723 20.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 724 20.1.3 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 724 20.1.4 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 725 20.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 726 MC9S12XE-Family Reference Manual Rev. 1.25 18 Freescale Semiconductor 20.2.1 TXD — Transmit Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 726 20.2.2 RXD — Receive Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 726 20.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 726 20.3.1 Module Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 726 20.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 727 20.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 739 20.4.1 Infrared Interface Submodule . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 740 20.4.2 LIN Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 740 20.4.3 Data Format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 741 20.4.4 Baud Rate Generation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 742 20.4.5 Transmitter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 743 20.4.6 Receiver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 748 20.4.7 Single-Wire Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 756 20.4.8 Loop Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 757 20.5 Initialization/Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 757 20.5.1 Reset Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 757 20.5.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 757 20.5.3 Interrupt Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 758 20.5.4 Recovery from Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 760 20.5.5 Recovery from Stop Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 760 Chapter 21 Serial Peripheral Interface (S12SPIV5) 21.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 761 21.1.1 Glossary of Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 761 21.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 761 21.1.3 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 761 21.1.4 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 762 21.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 763 21.2.1 MOSI — Master Out/Slave In Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 763 21.2.2 MISO — Master In/Slave Out Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 763 21.2.3 SS — Slave Select Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 764 21.2.4 SCK — Serial Clock Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 764 21.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 764 21.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 764 21.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 765 21.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 773 21.4.1 Master Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 774 21.4.2 Slave Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 775 21.4.3 Transmission Formats . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 776 21.4.4 SPI Baud Rate Generation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 781 21.4.5 Special Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 782 21.4.6 Error Conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 783 21.4.7 Low Power Mode Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 784 MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 19 Chapter 22 Timer Module (TIM16B8CV2) Block Description 22.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 787 22.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 788 22.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 788 22.1.3 Block Diagrams . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 789 22.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 791 22.2.1 IOC7 — Input Capture and Output Compare Channel 7 Pin . . . . . . . . . . . . . . . . . . . . 791 22.2.2 IOC6 — Input Capture and Output Compare Channel 6 Pin . . . . . . . . . . . . . . . . . . . . 791 22.2.3 IOC5 — Input Capture and Output Compare Channel 5 Pin . . . . . . . . . . . . . . . . . . . . 791 22.2.4 IOC4 — Input Capture and Output Compare Channel 4 Pin . . . . . . . . . . . . . . . . . . . . 791 22.2.5 IOC3 — Input Capture and Output Compare Channel 3 Pin . . . . . . . . . . . . . . . . . . . . 791 22.2.6 IOC2 — Input Capture and Output Compare Channel 2 Pin . . . . . . . . . . . . . . . . . . . . 791 22.2.7 IOC1 — Input Capture and Output Compare Channel 1 Pin . . . . . . . . . . . . . . . . . . . . 792 22.2.8 IOC0 — Input Capture and Output Compare Channel 0 Pin . . . . . . . . . . . . . . . . . . . . 792 22.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 792 22.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 792 22.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 792 22.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 809 22.4.1 Prescaler . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 810 22.4.2 Input Capture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 811 22.4.3 Output Compare . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 811 22.4.4 Pulse Accumulator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 812 22.4.5 Event Counter Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 812 22.4.6 Gated Time Accumulation Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 813 22.5 Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 813 22.6 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 813 22.6.1 Channel [7:0] Interrupt (C[7:0]F) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 814 22.6.2 Pulse Accumulator Input Interrupt (PAOVI) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 814 22.6.3 Pulse Accumulator Overflow Interrupt (PAOVF) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 814 22.6.4 Timer Overflow Interrupt (TOF) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 814 Chapter 23 Voltage Regulator (S12VREGL3V3V1) 23.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 815 23.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 815 23.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 815 23.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 816 23.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 818 23.2.1 VDDR — Regulator Power Input Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 818 23.2.2 VDDA, VSSA — Regulator Reference Supply Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . 818 23.2.3 VDD, VSS — Regulator Output1 (Core Logic) Pins . . . . . . . . . . . . . . . . . . . . . . . . . . 818 23.2.4 VDDF — Regulator Output2 (NVM Logic) Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 819 23.2.5 VDDPLL, VSSPLL — Regulator Output3 (PLL) Pins . . . . . . . . . . . . . . . . . . . . . . . . . 819 MC9S12XE-Family Reference Manual Rev. 1.25 20 Freescale Semiconductor 23.2.6 VDDX — Power Input Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 819 23.2.7 VREGEN — Optional Regulator Enable Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 819 23.2.8 VREG_API — Optional Autonomous Periodical Interrupt Output Pin . . . . . . . . . . . . . . 819 23.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 819 23.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 820 23.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 820 23.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 826 23.4.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 826 23.4.2 Regulator Core (REG) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 826 23.4.3 Low-Voltage Detect (LVD) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 826 23.4.4 Power-On Reset (POR) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 827 23.4.5 Low-Voltage Reset (LVR) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 827 23.4.6 HTD - High Temperature Detect . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 827 23.4.7 Regulator Control (CTRL) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 827 23.4.8 Autonomous Periodical Interrupt (API) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 827 23.4.9 Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 828 23.4.10Description of Reset Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 828 23.4.11Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 828 Chapter 24 128 KByte Flash Module (S12XFTM128K2V1) 24.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 832 24.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 832 24.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 833 24.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 834 24.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 835 24.3 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 836 24.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 836 24.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 841 24.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 862 24.4.1 Flash Command Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 862 24.4.2 Flash Command Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 867 24.4.3 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 887 24.4.4 Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 888 24.4.5 Stop Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 888 24.5 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 888 24.5.1 Unsecuring the MCU using Backdoor Key Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . 889 24.5.2 Unsecuring the MCU in Special Single Chip Mode using BDM . . . . . . . . . . . . . . . . . 890 24.5.3 Mode and Security Effects on Flash Command Availability . . . . . . . . . . . . . . . . . . . . . 890 24.6 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 890 Chapter 25 256 KByte Flash Module (S12XFTM256K2V1) 25.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 891 MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 21 25.2 25.3 25.4 25.5 25.6 25.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 892 25.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 893 25.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 894 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 895 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 896 25.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 896 25.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 901 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 922 25.4.1 Flash Command Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 922 25.4.2 Flash Command Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 927 25.4.3 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 948 25.4.4 Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 949 25.4.5 Stop Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 949 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 949 25.5.1 Unsecuring the MCU using Backdoor Key Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . 950 25.5.2 Unsecuring the MCU in Special Single Chip Mode using BDM . . . . . . . . . . . . . . . . . 951 25.5.3 Mode and Security Effects on Flash Command Availability . . . . . . . . . . . . . . . . . . . . . 951 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 951 Chapter 26 384 KByte Flash Module (S12XFTM384K2V1) 26.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 953 26.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 954 26.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 955 26.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 956 26.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 957 26.3 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 958 26.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 958 26.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 963 26.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 984 26.4.1 Flash Command Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 984 26.4.2 Flash Command Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 989 26.4.3 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1011 26.4.4 Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1012 26.4.5 Stop Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1012 26.5 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1012 26.5.1 Unsecuring the MCU using Backdoor Key Access . . . . . . . . . . . . . . . . . . . . . . . . . . . 1013 26.5.2 Unsecuring the MCU in Special Single Chip Mode using BDM . . . . . . . . . . . . . . . . 1014 26.5.3 Mode and Security Effects on Flash Command Availability . . . . . . . . . . . . . . . . . . . . 1014 26.6 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1014 Chapter 27 512 KByte Flash Module (S12XFTM512K3V1) 27.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1016 MC9S12XE-Family Reference Manual Rev. 1.25 22 Freescale Semiconductor 27.2 27.3 27.4 27.5 27.6 27.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1016 27.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1017 27.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1018 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1019 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1020 27.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1020 27.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1025 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1046 27.4.1 Flash Command Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1046 27.4.2 Flash Command Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1051 27.4.3 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1072 27.4.4 Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1073 27.4.5 Stop Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1073 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1073 27.5.1 Unsecuring the MCU using Backdoor Key Access . . . . . . . . . . . . . . . . . . . . . . . . . . . 1074 27.5.2 Unsecuring the MCU in Special Single Chip Mode using BDM . . . . . . . . . . . . . . . . 1075 27.5.3 Mode and Security Effects on Flash Command Availability . . . . . . . . . . . . . . . . . . . . 1075 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1075 Chapter 28 768 KByte Flash Module (S12XFTM768K4V2) 28.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1077 28.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1078 28.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1079 28.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1080 28.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1081 28.3 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1082 28.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1082 28.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1087 28.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1108 28.4.1 Flash Command Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1108 28.4.2 Flash Command Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1113 28.4.3 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1135 28.4.4 Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1136 28.4.5 Stop Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1136 28.5 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1136 28.5.1 Unsecuring the MCU using Backdoor Key Access . . . . . . . . . . . . . . . . . . . . . . . . . . . 1137 28.5.2 Unsecuring the MCU in Special Single Chip Mode using BDM . . . . . . . . . . . . . . . . 1138 28.5.3 Mode and Security Effects on Flash Command Availability . . . . . . . . . . . . . . . . . . . . 1138 28.6 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1138 Chapter 29 1024 KByte Flash Module (S12XFTM1024K5V2) 29.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1140 MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 23 29.2 29.3 29.4 29.5 29.6 29.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1140 29.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1141 29.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1142 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1143 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1144 29.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1144 29.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1150 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1171 29.4.1 Flash Command Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1171 29.4.2 Flash Command Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1176 29.4.3 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1197 29.4.4 Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1198 29.4.5 Stop Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1198 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1198 29.5.1 Unsecuring the MCU using Backdoor Key Access . . . . . . . . . . . . . . . . . . . . . . . . . . . 1199 29.5.2 Unsecuring the MCU in Special Single Chip Mode using BDM . . . . . . . . . . . . . . . . 1200 29.5.3 Mode and Security Effects on Flash Command Availability . . . . . . . . . . . . . . . . . . . . 1200 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1200 Appendix A Electrical Characteristics A.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1201 A.1.1 Parameter Classification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1201 A.1.2 Power Supply . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1201 A.1.3 Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1202 A.1.4 Current Injection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1203 A.1.5 Absolute Maximum Ratings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1203 A.1.6 ESD Protection and Latch-up Immunity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1204 A.1.7 Operating Conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1206 A.1.8 Power Dissipation and Thermal Characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1207 A.1.9 I/O Characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1209 A.1.10 Supply Currents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1214 A.2 ATD Characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1219 A.2.1 ATD Operating Characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1219 A.2.2 Factors Influencing Accuracy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1219 A.2.3 ATD Accuracy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1221 A.3 NVM, Flash and Emulated EEPROM. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1224 A.3.1 Timing Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1224 A.3.2 NVM Reliability Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1231 A.4 Voltage Regulator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1234 A.5 Output Loads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1235 A.5.1 Resistive Loads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1235 A.5.2 Capacitive Loads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1235 A.5.3 Chip Power-up and Voltage Drops . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1235 A.6 Reset, Oscillator and PLL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1236 MC9S12XE-Family Reference Manual Rev. 1.25 24 Freescale Semiconductor A.6.1 Startup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1236 A.6.2 Oscillator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1238 A.6.3 Phase Locked Loop . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1239 A.7 External Interface Timing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1241 A.7.1 MSCAN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1241 A.7.2 SPI Timing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1241 A.7.3 External Bus Timing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1247 Appendix B Package Information B.1 B.2 B.3 B.4 208 MAPBGA. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1259 144-Pin LQFP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1259 112-Pin LQFP Package . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1261 80-Pin QFP Package . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1262 Appendix C PCB Layout Guidelines Appendix D Derivative Differences D.1 Memory Sizes and Package Options S12XE - Family . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1268 D.2 Pinout explanations: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1270 Appendix E Detailed Register Address Map Appendix F Ordering Information MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 25 MC9S12XE-Family Reference Manual Rev. 1.25 26 Freescale Semiconductor Chapter 1 Device Overview MC9S12XE-Family 1.1 Introduction The MC9S12XE-Family of micro controllers is a further development of the S12XD-Family including new features for enhanced system integrity and greater functionality. These new features include a Memory Protection Unit (MPU) and Error Correction Code (ECC) on the Flash memory together with enhanced EEPROM functionality (EEE), an enhanced XGATE, an Internally filtered, frequency modulated Phase Locked Loop (IPLL) and an enhanced ATD. The E-Family extends the S12X product range up to 1MB of Flash memory with increased I/O capability in the 208-pin version of the flagship MC9S12XE100. The MC9S12XE-Family delivers 32-bit performance with all the advantages and efficiencies of a 16 bit MCU. It retains the low cost, power consumption, EMC and code-size efficiency advantages currently enjoyed by users of Freescale’s existing 16-Bit MC9S12 and S12X MCU families. There is a high level of compatibility between the S12XE and S12XD families. The MC9S12XE-Family features an enhanced version of the performance-boosting XGATE co-processor which is programmable in “C” language and runs at twice the bus frequency of the S12X with an instruction set optimized for data movement, logic and bit manipulation instructions and which can service any peripheral module on the device. The new enhanced version has improved interrupt handling capability and is fully compatible with the existing XGATE module. The MC9S12XE-Family is composed of standard on-chip peripherals including up to 64Kbytes of RAM, eight asynchronous serial communications interfaces (SCI), three serial peripheral interfaces (SPI), an 8channel IC/OC enhanced capture timer (ECT), two 16-channel, 12-bit analog-to-digital converters, an 8channel pulse-width modulator (PWM), five CAN 2.0 A, B software compatible modules (MSCAN12), two inter-IC bus blocks (IIC), an 8-channel 24-bit periodic interrupt timer (PIT) and an 8-channel 16-bit standard timer module (TIM). The MC9S12XE-Family uses 16-bit wide accesses without wait states for all peripherals and memories. The non-multiplexed expanded bus interface available on the 144/208-Pin versions allows an easy interface to external memories. In addition to the I/O ports available in each module, up to 26 further I/O ports are available with interrupt capability allowing Wake-Up from STOP or WAIT modes. The MC9S12XE-Family is available in 208Pin MAPBGA, 144-Pin LQFP, 112-Pin LQFP or 80-Pin QFP options. 1.1.1 Features Features of the MC9S12XE-Family are listed here. Please see Table D-2.for memory options and Table D2. for the peripheral features that are available on the different family members. MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 27 Chapter 1 Device Overview MC9S12XE-Family • • • • • • • • • • 16-Bit CPU12X — Upward compatible with MC9S12 instruction set with the exception of five Fuzzy instructions (MEM, WAV, WAVR, REV, REVW) which have been removed — Enhanced indexed addressing — Access to large data segments independent of PPAGE INT (interrupt module) — Eight levels of nested interrupts — Flexible assignment of interrupt sources to each interrupt level. — External non-maskable high priority interrupt (XIRQ) — Internal non-maskable high priority Memory Protection Unit interrupt — Up to 24 pins on ports J, H and P configurable as rising or falling edge sensitive interrupts EBI (external bus interface)(available in 208-Pin and 144-Pin packages only) — Up to four chip select outputs to select 16K, 1M, 2M and up to 4MByte address spaces — Each chip select output can be configured to complete transaction on either the time-out of one of the two wait state generators or the deassertion of EWAIT signal MMC (module mapping control) DBG (debug module) — Monitoring of CPU and/or XGATE busses with tag-type or force-type breakpoint requests — 64 x 64-bit circular trace buffer captures change-of-flow or memory access information BDM (background debug mode) MPU (memory protection unit) — 8 address regions definable per active program task — Address range granularity as low as 8-bytes — No write / No execute Protection Attributes — Non-maskable interrupt on access violation XGATE — Programmable, high performance I/O coprocessor module — Transfers data to or from all peripherals and RAM without CPU intervention or CPU wait states — Performs logical, shifts, arithmetic, and bit operations on data — Can interrupt the HCS12X CPU signalling transfer completion — Triggers from any hardware module as well as from the CPU possible — Two interrupt levels to service high priority tasks — Hardware support for stack pointer initialisation OSC_LCP (oscillator) — Low power loop control Pierce oscillator utilizing a 4MHz to 16MHz crystal — Good noise immunity — Full-swing Pierce option utilizing a 2MHz to 40MHz crystal — Transconductance sized for optimum start-up margin for typical crystals IPLL (Internally filtered, frequency modulated phase-locked-loop clock generation) MC9S12XE-Family Reference Manual Rev. 1.25 28 Freescale Semiconductor Chapter 1 Device Overview MC9S12XE-Family • • • • • • • — No external components required — Configurable option to spread spectrum for reduced EMC radiation (frequency modulation) CRG (clock and reset generation) — COP watchdog — Real time interrupt — Clock monitor — Fast wake up from STOP in self clock mode Memory Options — 128K, 256k, 384K, 512K, 768K and 1M byte Flash — 2K, 4K byte emulated EEPROM — 12K, 16K, 24K, 32K, 48K and 64K Byte RAM Flash General Features — 64 data bits plus 8 syndrome ECC (Error Correction Code) bits allow single bit failure correction and double fault detection — Erase sector size 1024 bytes — Automated program and erase algorithm D-Flash Features — Up to 32 Kbytes of D-Flash memory with 256 byte sectors for user access. — Dedicated commands to control access to the D-Flash memory over EEE operation. — Single bit fault correction and double bit fault detection within a word during read operations. — Automated program and erase algorithm with verify and generation of ECC parity bits. — Fast sector erase and word program operation. — Ability to program up to four words in a burst sequence Emulated EEPROM Features — Automatic EEE file handling using an internal Memory Controller. — Automatic transfer of valid EEE data from D-Flash memory to buffer RAM on reset. — Ability to monitor the number of outstanding EEE related buffer RAM words left to be programmed into D-Flash memory. — Ability to disable EEE operation and allow priority access to the D-Flash memory. — Ability to cancel all pending EEE operations and allow priority access to the D-Flash memory. Two 16-channel, 12-bit Analog-to-Digital Converters — 8/10/12 Bit resolution — 3µs, 10-bit single conversion time — Left/right, signed/unsigned result data — External and internal conversion trigger capability — Internal oscillator for conversion in Stop modes — Wake from low power modes on analog comparison > or ... Access #0 Access #1 Access #2 1 2 3 ... MC9S12XE-Family Reference Manual Rev. 1.25 252 Freescale Semiconductor Chapter 5 External Bus Interface (S12XEBIV4) Table 5-18. Interleaved Read-Write-Read Accesses (1 Cycle) (continued) ECLK phase ... ADDR[22:20] / ACC[2:0] ... ADDR[19:16] / IQSTAT[3:0] ... ADDR[15:0] / IVD[15:0] ... DATA[15:0] (internal read) ... high low addr 0 iqstat -1 high low addr 1 iqstat 0 acc 0 ... acc 2 ... addr 2 iqstat 1 ... x ... z ... (write) data 1 z ... 0 1 ... ivd 0 z z DATA[15:0] (external read) ... ? z data 0 RW ... 1 1 0 5.4.3 low acc 1 ? ? high (write) data 1 1 Accesses to Port Replacement Registers All read and write accesses to PRR addresses take two bus clock cycles independent of the operating mode. If writing to these addresses in emulation modes, the access is directed to both, the internal register and the external resource while reads will be treated external. The XEBI control registers also belong to this category. 5.4.4 Stretched External Bus Accesses In order to allow fast internal bus cycles to coexist in a system with slower external resources, the XEBI supports stretched external bus accesses (wait states) for each external address range related to one of the 4 chip select lines individually. This feature is available in normal expanded mode and emulation expanded mode for accesses to all external addresses except emulation memory and PRR. In these cases the fixed access times are 1 or 2 cycles, respectively. Stretched accesses are controlled by: 1. EXSTR1[2:0] and EXSTR0[2:0] bits in the EBICTL1 register configuring a fixed amount of stretch cycles individually for each CSx line in MMCCTL0 2. Activation of the external wait feature for each CSx line MMCCTL0 register 3. Assertion of the external EWAIT signal when at least one CSx line is configured for EWAIT The EXSTRx[2:0] control bits can be programmed for generation of a fixed number of 1 to 8 stretch cycles. If the external wait feature is enabled, the minimum number of additional stretch cycles is 2. An arbitrary amount of stretch cycles can be added using the EWAIT input. EWAIT needs to be asserted at least for a minimal specified time window within an external access cycle for the internal logic to detect it and add a cycle (refer to electrical characteristics). Holding it for additional cycles will cause the external bus access to be stretched accordingly. Write accesses are stretched by holding the initiator in its current state for additional cycles as programmed and controlled by external wait after the data have been driven out on the external bus. This results in an extension of time the bus signals and the related control signals are valid externally. Read data are not captured by the system in normal expanded mode until the specified setup time before the RE rising edge. MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 253 Chapter 5 External Bus Interface (S12XEBIV4) Read data are not captured in emulation expanded mode until the specified setup time before the falling edge of ECLK. In emulation expanded mode, accesses to the internal flash or the emulation memory (determined by EROMON and ROMON bits; see S12X_MMC section for details) always take 1 cycle and stretching is not supported. In case the internal flash is taken out of the map in user applications, accesses are stretched as programmed and controlled by external wait. 5.4.5 Data Select and Data Direction Signals The S12X_EBI supports byte and word accesses at any valid external address. The big endian system of the MCU is extended to the external bus; however, word accesses are restricted to even aligned addresses. The only exception is the visibility of misaligned word accesses to addresses in the internal RAM as this module exclusively supports these kind of accesses in a single cycle. With the above restriction, a fixed relationship is implied between the address parity and the dedicated bus halves where the data are accessed: DATA[15:8] is related to even addresses and DATA[7:0] is related to odd addresses. In expanded modes the data access type is externally determined by a set of control signals, i.e., data select and data direction signals, as described below. The data select signals are not available if using the external bus interface with an 8-bit data bus. 5.4.5.1 Normal Expanded Mode In normal expanded mode, the external signals RE, WE, UDS, LDS indicate the access type (read/write), data size and alignment of an external bus access (Table 5-19). Table 5-19. Access in Normal Expanded Mode DATA[15:8] Access DATA[7:0] RE WE UDS LDS I/O data(addr) I/O data(addr) Word write of data on DATA[15:0] at an even and even+1 address 1 0 0 0 Out data(even) Out Byte write of data on DATA[7:0] at an odd address 1 0 1 0 Byte write of data on DATA[15:8] at an even address 1 0 0 1 In x Word read of data on DATA[15:0] at an even and even+1 address 0 1 0 0 In data(even) In data(odd) Byte read of data on DATA[7:0] at an odd address 0 1 1 0 In x In data(odd) Byte read of data on DATA[15:8] at an even address 0 1 0 1 In data(even) In x In x Out data(even) Out data(odd) data(odd) Indicates No Access 1 1 1 1 In x In x Unimplemented 1 1 1 0 In x In x 1 1 0 1 In x In x 5.4.5.2 Emulation Modes and Special Test Mode In emulation modes and special test mode, the external signals LSTRB, RW, and ADDR0 indicate the access type (read/write), data size and alignment of an external bus access. Misaligned accesses to the MC9S12XE-Family Reference Manual Rev. 1.25 254 Freescale Semiconductor Chapter 5 External Bus Interface (S12XEBIV4) internal RAM and misaligned XGATE PRR accesses in emulation modes are the only type of access that are able to produce LSTRB = ADDR0 = 1. This is summarized in Table 5-20. Table 5-20. Access in Emulation Modes and Special Test Mode DATA[15:8] Access DATA[7:0] RW LSTRB ADDR0 I/O data(addr) I/O data(addr) Word write of data on DATA[15:0] at an even and even+1 address 0 0 0 Out data(even) Out data(odd) Byte write of data on DATA[7:0] at an odd address 0 0 1 In x Out data(odd) Byte write of data on DATA[15:8] at an even address 0 1 0 Out data(odd) In x Word write at an odd and odd+1 internal RAM address (misaligned — only in emulation modes) 0 1 1 Out data(odd+1) Out Word read of data on DATA[15:0] at an even and even+1 address 1 0 0 In Byte read of data on DATA[7:0] at an odd address 1 0 1 Byte read of data on DATA[15:8] at an even address 1 1 0 Word read at an odd and odd+1 internal RAM address (misaligned - only in emulation modes) 1 1 1 data(odd) data(even) In data(even+1) In x In data(odd) In data(even) In x In data(odd+1) In data(odd) MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 255 Chapter 5 External Bus Interface (S12XEBIV4) 5.4.6 Low-Power Options The XEBI does not support any user-controlled options for reducing power consumption. 5.4.6.1 Run Mode The XEBI does not support any options for reducing power in run mode. Power consumption is reduced in single-chip modes due to the absence of the external bus interface. Operation in expanded modes results in a higher power consumption, however any unnecessary toggling of external bus signals is reduced to the lowest indispensable activity by holding the previous states between external accesses. 5.4.6.2 Wait Mode The XEBI does not support any options for reducing power in wait mode. 5.4.6.3 Stop Mode The XEBI will cease to function in stop mode. 5.5 Initialization/Application Information This section describes the external bus interface usage and timing. Typical customer operating modes are normal expanded mode and emulation modes, specifically to be used in emulator applications. Taking the availability of the external wait feature into account the use cases are divided into four scenarios: • Normal expanded mode — External wait feature disabled – External wait feature enabled • Emulation modes – Emulation single-chip mode (without wait states) – Emulation expanded mode (with optional access stretching) Normal single-chip mode and special single-chip mode do not have an external bus. Special test mode is used for factory test only. Therefore, these modes are omitted here. All timing diagrams referred to throughout this section are available in the Electrical Characteristics appendix of the SoC section. 5.5.1 Normal Expanded Mode This mode allows interfacing to external memories or peripherals which are available in the commercial market. In these applications the normal bus operation requires a minimum of 1 cycle stretch for each external access. MC9S12XE-Family Reference Manual Rev. 1.25 256 Freescale Semiconductor Chapter 5 External Bus Interface (S12XEBIV4) 5.5.1.1 Example 1a: External Wait Feature Disabled The first example of bus timing of an external read and write access with the external wait feature disabled is shown in • Figure ‘Example 1a: Normal Expanded Mode — Read Followed by Write’ The associated supply voltage dependent timing are numbers given in • Table ‘Example 1a: Normal Expanded Mode Timing VDD5 = 5.0 V (EWAIT disabled)’ • Table ‘Example 1a: Normal Expanded Mode Timing VDD5 = 3.0 V (EWAIT disabled)’ Systems designed this way rely on the internal programmable access stretching. These systems have predictable external memory access times. The additional stretch time can be programmed up to 8 cycles to provide longer access times. 5.5.1.2 Example 1b: External Wait Feature Enabled The external wait operation is shown in this example. It can be used to exceed the amount of stretch cycles over the programmed number in EXSTR[2:0]. The feature must be enabled by configuring at least one CSx line for EWAIT. If the EWAIT signal is not asserted, the number of stretch cycles is forced to a minimum of 2 cycles. If EWAIT is asserted within the predefined time window during the access it will be strobed active and another stretch cycle is added. If strobed inactive, the next cycle will be the last cycle before the access is finished. EWAIT can be held asserted as long as desired to stretch the access. An access with 1 cycle stretch by EWAIT assertion is shown in • Figure ‘Example 1b: Normal Expanded Mode — Stretched Read Access’ • Figure ‘Example 1b: Normal Expanded Mode — Stretched Write Access’ The associated timing numbers for both operations are given in • Table ‘Example 1b: Normal Expanded Mode Timing VDD5 = 5.0 V (EWAIT enabled)’ • Table ‘Example 1b: Normal Expanded Mode Timing VDD5 = 3.0 V (EWAIT enabled)’ It is recommended to use the free-running clock (ECLK) at the fastest rate (bus clock rate) to synchronize the EWAIT input signal. 5.5.2 Emulation Modes In emulation mode applications, the development systems use a custom PRU device to rebuild the singlechip or expanded bus functions which are lost due to the use of the external bus with an emulator. Accesses to a set of registers controlling the related ports in normal modes (refer to SoC section) are directed to the external bus in emulation modes which are substituted by PRR as part of the PRU. Accesses to these registers take a constant time of 2 cycles. Depending on the setting of ROMON and EROMON (refer to S12X_MMC section), the program code can be executed from internal memory or an optional external emulation memory (EMULMEM). No wait MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 257 Chapter 5 External Bus Interface (S12XEBIV4) state operation (stretching) of the external bus access is done in emulation modes when accessing internal memory or emulation memory addresses. In both modes observation of the internal operation is supported through the external bus (internal visibility). 5.5.2.1 Example 2a: Emulation Single-Chip Mode This mode is used for emulation systems in which the target application is operating in normal single-chip mode. Figure 5-5 shows the PRU connection with the available external bus signals in an emulator application. S12X_EBI Emulator ADDR[22:0]/IVD[15:0] DATA[15:0] EMULMEM PRU PRR Ports LSTRB RW ADDR[22:20]/ACC[2:0] ADDR[19:16]/ IQSTAT[3:0] ECLK ECLKX2 Figure 5-5. Application in Emulation Single-Chip Mode The timing diagram for this operation is shown in: • Figure ‘Example 2a: Emulation Single-Chip Mode — Read Followed by Write’ The associated timing numbers are given in: • Table ‘Example 2a: Emulation Single-Chip Mode Timing (EWAIT disabled)’ Timing considerations: • Signals muxed with address lines ADDRx, i.e., IVDx, IQSTATx and ACCx, have the same timing. • LSTRB has the same timing as RW. MC9S12XE-Family Reference Manual Rev. 1.25 258 Freescale Semiconductor Chapter 5 External Bus Interface (S12XEBIV4) • • ECLKX2 rising edges have the same timing as ECLK edges. The timing for accesses to PRU registers, which take 2 cycles to complete, is the same as the timing for an external non-PRR access with 1 cycle of stretch as shown in example 2b. 5.5.2.2 Example 2b: Emulation Expanded Mode This mode is used for emulation systems in which the target application is operating in normal expanded mode. If the external bus is used with a PRU, the external device rebuilds the data select and data direction signals UDS, LDS, RE, and WE from the ADDR0, LSTRB, and RW signals. Figure 5-6 shows the PRU connection with the available external bus signals in an emulator application. S12X_EBI Emulator ADDR[22:0]/IVD[15:0] DATA[15:0] EMULMEM PRU PRR LSTRB RW Ports UDS LDS RE WE ADDR[22:20]/ACC[2:0] ADDR[19:16]/ IQSTAT[3:0] CS[3:0] EWAIT ECLK ECLKX2 Figure 5-6. Application in Emulation Expanded Mode The timings of accesses with 1 stretch cycle are shown in • Figure ‘Example 2b: Emulation Expanded Mode — Read with 1 Stretch Cycle’ • Figure ‘Example 2b: Emulation Expanded Mode — Write with 1 Stretch Cycle’ The associated timing numbers are given in MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 259 Chapter 5 External Bus Interface (S12XEBIV4) • Table ‘Example 2b: Emulation Expanded Mode Timing VDD5 = 5.0 V (EWAIT disabled)’ (this also includes examples for alternative settings of 2 and 3 additional stretch cycles) Timing considerations: • If no stretch cycle is added, the timing is the same as in Emulation Single-Chip Mode. MC9S12XE-Family Reference Manual Rev. 1.25 260 Freescale Semiconductor Chapter 6 Interrupt (S12XINTV2) Table 6-1. Revision History Revision Number Revision Date Sections Affected V02.00 01 Jul 2005 6.1.2/6-262 V02.04 11 Jan 2007 6.3.2.2/6-267 6.3.2.4/6-268 V02.05 20 Mar 2007 6.4.6/6-274 V02.07 13 Dec 2011 6.5.3.1/6-276 6.1 Description of Changes Initial V2 release, added new features: - XGATE threads can be interrupted. - SYS instruction vector. - Access violation interrupt vectors. - Added Notes for devices without XGATE module. - Fixed priority definition for software exceptions. - Re-worded for difference of Wake-up feature between STOP and WAIT modes. Introduction The XINT module decodes the priority of all system exception requests and provides the applicable vector for processing the exception to either the CPU or the XGATE module. The XINT module supports: • I bit and X bit maskable interrupt requests • One non-maskable unimplemented op-code trap • One non-maskable software interrupt (SWI) or background debug mode request • One non-maskable system call interrupt (SYS) • Three non-maskable access violation interrupts • One spurious interrupt vector request • Three system reset vector requests Each of the I bit maskable interrupt requests can be assigned to one of seven priority levels supporting a flexible priority scheme. For interrupt requests that are configured to be handled by the CPU, the priority scheme can be used to implement nested interrupt capability where interrupts from a lower level are automatically blocked if a higher level interrupt is being processed. Interrupt requests configured to be handled by the XGATE module can be nested one level deep. NOTE The HPRIO register and functionality of the original S12 interrupt module is no longer supported. It is superseded by the 7-level interrupt request priority scheme. MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 261 Chapter 6 Interrupt (S12XINTV2) 6.1.1 Glossary The following terms and abbreviations are used in the document. Table 6-2. Terminology Term CCR Condition Code Register (in the S12X CPU) DMA Direct Memory Access INT Interrupt IPL Interrupt Processing Level ISR Interrupt Service Routine MCU XGATE IRQ XIRQ 6.1.2 • • • • • • • • • • • • • • Meaning Micro-Controller Unit refers to the XGATE co-processor; XGATE is an optional feature refers to the interrupt request associated with the IRQ pin refers to the interrupt request associated with the XIRQ pin Features Interrupt vector base register (IVBR) One spurious interrupt vector (at address vector base1 + 0x0010). One non-maskable system call interrupt vector request (at address vector base + 0x0012). Three non-maskable access violation interrupt vector requests (at address vector base + 0x0014− 0x0018). 2–109 I bit maskable interrupt vector requests (at addresses vector base + 0x001A–0x00F2). Each I bit maskable interrupt request has a configurable priority level and can be configured to be handled by either the CPU or the XGATE module2. I bit maskable interrupts can be nested, depending on their priority levels. One X bit maskable interrupt vector request (at address vector base + 0x00F4). One non-maskable software interrupt request (SWI) or background debug mode vector request (at address vector base + 0x00F6). One non-maskable unimplemented op-code trap (TRAP) vector (at address vector base + 0x00F8). Three system reset vectors (at addresses 0xFFFA–0xFFFE). Determines the highest priority XGATE and interrupt vector requests, drives the vector to the XGATE module or to the bus on CPU request, respectively. Wakes up the system from stop or wait mode when an appropriate interrupt request occurs or whenever XIRQ is asserted, even if X interrupt is masked. XGATE can wake up and execute code, even with the CPU remaining in stop or wait mode. 1. The vector base is a 16-bit address which is accumulated from the contents of the interrupt vector base register (IVBR, used as upper byte) and 0x00 (used as lower byte). 2. The IRQ interrupt can only be handled by the CPU MC9S12XE-Family Reference Manual Rev. 1.25 262 Freescale Semiconductor Chapter 6 Interrupt (S12XINTV2) 6.1.3 • • • • Modes of Operation Run mode This is the basic mode of operation. Wait mode In wait mode, the XINT module is frozen. It is however capable of either waking up the CPU if an interrupt occurs or waking up the XGATE if an XGATE request occurs. Please refer to Section 6.5.3, “Wake Up from Stop or Wait Mode” for details. Stop Mode In stop mode, the XINT module is frozen. It is however capable of either waking up the CPU if an interrupt occurs or waking up the XGATE if an XGATE request occurs. Please refer to Section 6.5.3, “Wake Up from Stop or Wait Mode” for details. Freeze mode (BDM active) In freeze mode (BDM active), the interrupt vector base register is overridden internally. Please refer to Section 6.3.2.1, “Interrupt Vector Base Register (IVBR)” for details. MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 263 Chapter 6 Interrupt (S12XINTV2) 6.1.4 Block Diagram Figure 6-1 shows a block diagram of the XINT module. Peripheral Interrupt Requests Wake Up CPU Non I Bit Maskable Channels Priority Decoder Interrupt Requests PRIOLVL2 PRIOLVL1 PRIOLVL0 RQST IVBR New IPL To CPU Vector Address IRQ Channel Current IPL One Set Per Channel (Up to 108 Channels) INT_XGPRIO XGATE Requests Priority Decoder Wake up XGATE Vector ID XGATE Interrupts To XGATE Module RQST XGATE Request Route, PRIOLVLn Priority Level = bits from the channel configuration in the associated configuration register INT_XGPRIO = XGATE Interrupt Priority IVBR = Interrupt Vector Base IPL = Interrupt Processing Level Figure 6-1. XINT Block Diagram 6.2 External Signal Description The XINT module has no external signals. MC9S12XE-Family Reference Manual Rev. 1.25 264 Freescale Semiconductor Chapter 6 Interrupt (S12XINTV2) 6.3 Memory Map and Register Definition This section provides a detailed description of all registers accessible in the XINT module. 6.3.1 Module Memory Map Table 6-3 gives an overview over all XINT module registers. Table 6-3. XINT Memory Map Address Use Access 0x0120 RESERVED — 0x0121 Interrupt Vector Base Register (IVBR) R/W 0x0122–0x0125 RESERVED — 0x0126 XGATE Interrupt Priority Configuration Register (INT_XGPRIO) R/W 0x0127 Interrupt Request Configuration Address Register (INT_CFADDR) R/W 0x0128 Interrupt Request Configuration Data Register 0 (INT_CFDATA0) R/W 0x0129 Interrupt Request Configuration Data Register 1 (INT_CFDATA1) R/W 0x012A Interrupt Request Configuration Data Register 2 (INT_CFDATA2 R/W 0x012B Interrupt Request Configuration Data Register 3 (INT_CFDATA3) R/W 0x012C Interrupt Request Configuration Data Register 4 (INT_CFDATA4) R/W 0x012D Interrupt Request Configuration Data Register 5 (INT_CFDATA5) R/W 0x012E Interrupt Request Configuration Data Register 6 (INT_CFDATA6) R/W 0x012F Interrupt Request Configuration Data Register 7 (INT_CFDATA7) R/W MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 265 Chapter 6 Interrupt (S12XINTV2) 6.3.2 Register Descriptions This section describes in address order all the XINT module registers and their individual bits. Address Register Name 0x0121 IVBR Bit 7 6 5 R INT_XGPRIO R 3 2 0 0 0 0 0 INT_CFADDR R R W 0x0129 INT_CFDATA1 R W 0x012A INT_CFDATA2 R W 0x012B INT_CFDATA3 R W 0x012C INT_CFDATA4 R W 0x012D INT_CFDATA5 R W 0x012E INT_CFDATA6 R W 0x012F INT_CFDATA7 R W 0 INT_CFADDR[7:4] W 0x0128 INT_CFDATA0 Bit 0 XILVL[2:0] W 0x0127 1 IVB_ADDR[7:0]7 W 0x0126 4 RQST RQST RQST RQST RQST RQST RQST RQST 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 PRIOLVL[2:0] PRIOLVL[2:0] PRIOLVL[2:0] PRIOLVL[2:0] PRIOLVL[2:0] PRIOLVL[2:0] PRIOLVL[2:0] PRIOLVL[2:0] = Unimplemented or Reserved Figure 6-2. XINT Register Summary MC9S12XE-Family Reference Manual Rev. 1.25 266 Freescale Semiconductor Chapter 6 Interrupt (S12XINTV2) 6.3.2.1 Interrupt Vector Base Register (IVBR) Address: 0x0121 7 6 5 R 3 2 1 0 1 1 1 IVB_ADDR[7:0] W Reset 4 1 1 1 1 1 Figure 6-3. Interrupt Vector Base Register (IVBR) Read: Anytime Write: Anytime Table 6-4. IVBR Field Descriptions Field Description 7–0 Interrupt Vector Base Address Bits — These bits represent the upper byte of all vector addresses. Out of IVB_ADDR[7:0] reset these bits are set to 0xFF (i.e., vectors are located at 0xFF10–0xFFFE) to ensure compatibility to previous S12 microcontrollers. Note: A system reset will initialize the interrupt vector base register with “0xFF” before it is used to determine the reset vector address. Therefore, changing the IVBR has no effect on the location of the three reset vectors (0xFFFA–0xFFFE). Note: If the BDM is active (i.e., the CPU is in the process of executing BDM firmware code), the contents of IVBR are ignored and the upper byte of the vector address is fixed as “0xFF”. 6.3.2.2 XGATE Interrupt Priority Configuration Register (INT_XGPRIO) Address: 0x0126 R 7 6 5 4 3 0 0 0 0 0 0 0 0 0 2 0 0 XILVL[2:0] W Reset 1 0 0 1 = Unimplemented or Reserved Figure 6-4. XGATE Interrupt Priority Configuration Register (INT_XGPRIO) Read: Anytime Write: Anytime Table 6-5. INT_XGPRIO Field Descriptions Field Description 2–0 XILVL[2:0] XGATE Interrupt Priority Level — The XILVL[2:0] bits configure the shared interrupt level of the XGATE interrupts coming from the XGATE module. Out of reset the priority is set to the lowest active level (“1”). Note: If the XGATE module is not available on the device, write accesses to this register are ignored and read accesses to this register will return all 0. MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 267 Chapter 6 Interrupt (S12XINTV2) Table 6-6. XGATE Interrupt Priority Levels Priority low high 6.3.2.3 XILVL2 XILVL1 XILVL0 Meaning 0 0 0 Interrupt request is disabled 0 0 1 Priority level 1 0 1 0 Priority level 2 0 1 1 Priority level 3 1 0 0 Priority level 4 1 0 1 Priority level 5 1 1 0 Priority level 6 1 1 1 Priority level 7 Interrupt Request Configuration Address Register (INT_CFADDR) Address: 0x0127 7 R 5 4 INT_CFADDR[7:4] W Reset 6 0 0 0 1 3 2 1 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 6-5. Interrupt Configuration Address Register (INT_CFADDR) Read: Anytime Write: Anytime Table 6-7. INT_CFADDR Field Descriptions Field Description 7–4 Interrupt Request Configuration Data Register Select Bits — These bits determine which of the 128 INT_CFADDR[7:4] configuration data registers are accessible in the 8 register window at INT_CFDATA0–7. The hexadecimal value written to this register corresponds to the upper nibble of the lower byte of the address of the interrupt vector, i.e., writing 0xE0 to this register selects the configuration data register block for the 8 interrupt vector requests starting with vector at address (vector base + 0x00E0) to be accessible as INT_CFDATA0–7. Note: Writing all 0s selects non-existing configuration registers. In this case write accesses to INT_CFDATA0–7 will be ignored and read accesses will return all 0. 6.3.2.4 Interrupt Request Configuration Data Registers (INT_CFDATA0–7) The eight register window visible at addresses INT_CFDATA0–7 contains the configuration data for the block of eight interrupt requests (out of 128) selected by the interrupt configuration address register (INT_CFADDR) in ascending order. INT_CFDATA0 represents the interrupt configuration data register of the vector with the lowest address in this block, while INT_CFDATA7 represents the interrupt configuration data register of the vector with the highest address, respectively. MC9S12XE-Family Reference Manual Rev. 1.25 268 Freescale Semiconductor Chapter 6 Interrupt (S12XINTV2) Address: 0x0128 7 R W Reset RQST 0 6 5 4 3 0 0 0 0 0 0 0 0 2 1 0 PRIOLVL[2:0] 0 0 1(1) = Unimplemented or Reserved Figure 6-6. Interrupt Request Configuration Data Register 0 (INT_CFDATA0) 1. Please refer to the notes following the PRIOLVL[2:0] description below. Address: 0x0129 7 R W Reset RQST 0 6 5 4 3 0 0 0 0 0 0 0 0 2 1 0 PRIOLVL[2:0] 0 0 1(1) = Unimplemented or Reserved Figure 6-7. Interrupt Request Configuration Data Register 1 (INT_CFDATA1) 1. Please refer to the notes following the PRIOLVL[2:0] description below. Address: 0x012A 7 R W Reset RQST 0 6 5 4 3 0 0 0 0 0 0 0 0 2 1 0 PRIOLVL[2:0] 0 0 1(1) = Unimplemented or Reserved Figure 6-8. Interrupt Request Configuration Data Register 2 (INT_CFDATA2) 1. Please refer to the notes following the PRIOLVL[2:0] description below. Address: 0x012B 7 R W Reset RQST 0 6 5 4 3 0 0 0 0 0 0 0 0 2 1 0 PRIOLVL[2:0] 0 0 1(1) = Unimplemented or Reserved Figure 6-9. Interrupt Request Configuration Data Register 3 (INT_CFDATA3) 1. Please refer to the notes following the PRIOLVL[2:0] description below. MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 269 Chapter 6 Interrupt (S12XINTV2) Address: 0x012C 7 R W Reset RQST 0 6 5 4 3 0 0 0 0 0 0 0 0 2 1 0 PRIOLVL[2:0] 0 0 1(1) = Unimplemented or Reserved Figure 6-10. Interrupt Request Configuration Data Register 4 (INT_CFDATA4) 1. Please refer to the notes following the PRIOLVL[2:0] description below. Address: 0x012D 7 R W Reset RQST 0 6 5 4 3 0 0 0 0 0 0 0 0 2 1 0 PRIOLVL[2:0] 0 0 1(1) = Unimplemented or Reserved Figure 6-11. Interrupt Request Configuration Data Register 5 (INT_CFDATA5) 1. Please refer to the notes following the PRIOLVL[2:0] description below. Address: 0x012E 7 R W Reset RQST 0 6 5 4 3 0 0 0 0 0 0 0 0 2 1 0 PRIOLVL[2:0] 0 0 1(1) = Unimplemented or Reserved Figure 6-12. Interrupt Request Configuration Data Register 6 (INT_CFDATA6) 1. Please refer to the notes following the PRIOLVL[2:0] description below. Address: 0x012F 7 R W Reset RQST 0 6 5 4 3 0 0 0 0 0 0 0 0 2 1 0 PRIOLVL[2:0] 0 0 1(1) = Unimplemented or Reserved Figure 6-13. Interrupt Request Configuration Data Register 7 (INT_CFDATA7) 1. Please refer to the notes following the PRIOLVL[2:0] description below. Read: Anytime Write: Anytime MC9S12XE-Family Reference Manual Rev. 1.25 270 Freescale Semiconductor Chapter 6 Interrupt (S12XINTV2) Table 6-8. INT_CFDATA0–7 Field Descriptions Field Description 7 RQST XGATE Request Enable — This bit determines if the associated interrupt request is handled by the CPU or by the XGATE module. 0 Interrupt request is handled by the CPU 1 Interrupt request is handled by the XGATE module Note: The IRQ interrupt cannot be handled by the XGATE module. For this reason, the configuration register for vector (vector base + 0x00F2) = IRQ vector address) does not contain a RQST bit. Writing a 1 to the location of the RQST bit in this register will be ignored and a read access will return 0. Note: If the XGATE module is not available on the device, writing a 1 to the location of the RQST bit in this register will be ignored and a read access will return 0. 2–0 Interrupt Request Priority Level Bits — The PRIOLVL[2:0] bits configure the interrupt request priority level of PRIOLVL[2:0] the associated interrupt request. Out of reset all interrupt requests are enabled at the lowest active level (“1”) to provide backwards compatibility with previous S12 interrupt controllers. Please also refer to Table 6-9 for available interrupt request priority levels. Note: Write accesses to configuration data registers of unused interrupt channels will be ignored and read accesses will return all 0. For information about what interrupt channels are used in a specific MCU, please refer to the Device Reference Manual of that MCU. Note: When vectors (vector base + 0x00F0–0x00FE) are selected by writing 0xF0 to INT_CFADDR, writes to INT_CFDATA2–7 (0x00F4–0x00FE) will be ignored and read accesses will return all 0s. The corresponding vectors do not have configuration data registers associated with them. Note: When vectors (vector base + 0x0010–0x001E) are selected by writing 0x10 to INT_CFADDR, writes to INT_CFDATA1–INT_CFDATA4 (0x0012–0x0018) will be ignored and read accesses will return all 0s. The corresponding vectors do not have configuration data registers associated with them. Note: Write accesses to the configuration register for the spurious interrupt vector request (vector base + 0x0010) will be ignored and read accesses will return 0x07 (request is handled by the CPU, PRIOLVL = 7). Table 6-9. Interrupt Priority Levels Priority low high 6.4 PRIOLVL2 PRIOLVL1 PRIOLVL0 Meaning 0 0 0 Interrupt request is disabled 0 0 1 Priority level 1 0 1 0 Priority level 2 0 1 1 Priority level 3 1 0 0 Priority level 4 1 0 1 Priority level 5 1 1 0 Priority level 6 1 1 1 Priority level 7 Functional Description The XINT module processes all exception requests to be serviced by the CPU module. These exceptions include interrupt vector requests and reset vector requests. Each of these exception types and their overall priority level is discussed in the subsections below. MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 271 Chapter 6 Interrupt (S12XINTV2) 6.4.1 S12X Exception Requests The CPU handles both reset requests and interrupt requests. The XINT module contains registers to configure the priority level of each I bit maskable interrupt request which can be used to implement an interrupt priority scheme. This also includes the possibility to nest interrupt requests. A priority decoder is used to evaluate the priority of a pending interrupt request. 6.4.2 Interrupt Prioritization After system reset all interrupt requests with a vector address lower than or equal to (vector base + 0x00F2) are enabled, are set up to be handled by the CPU and have a pre-configured priority level of 1. Exceptions to this rule are the non-maskable interrupt requests and the spurious interrupt vector request at (vector base + 0x0010) which cannot be disabled, are always handled by the CPU and have a fixed priority levels. A priority level of 0 effectively disables the associated I bit maskable interrupt request. If more than one interrupt request is configured to the same interrupt priority level the interrupt request with the higher vector address wins the prioritization. The following conditions must be met for an I bit maskable interrupt request to be processed. 1. The local interrupt enabled bit in the peripheral module must be set. 2. The setup in the configuration register associated with the interrupt request channel must meet the following conditions: a) The XGATE request enable bit must be 0 to have the CPU handle the interrupt request. b) The priority level must be set to non zero. c) The priority level must be greater than the current interrupt processing level in the condition code register (CCR) of the CPU (PRIOLVL[2:0] > IPL[2:0]). 3. The I bit in the condition code register (CCR) of the CPU must be cleared. 4. There is no access violation interrupt request pending. 5. There is no SYS, SWI, BDM, TRAP, or XIRQ request pending. NOTE All non I bit maskable interrupt requests always have higher priority than I bit maskable interrupt requests. If an I bit maskable interrupt request is interrupted by a non I bit maskable interrupt request, the currently active interrupt processing level (IPL) remains unaffected. It is possible to nest non I bit maskable interrupt requests, e.g., by nesting SWI or TRAP calls. 6.4.2.1 Interrupt Priority Stack The current interrupt processing level (IPL) is stored in the condition code register (CCR) of the CPU. This way the current IPL is automatically pushed to the stack by the standard interrupt stacking procedure. The new IPL is copied to the CCR from the priority level of the highest priority active interrupt request channel which is configured to be handled by the CPU. The copying takes place when the interrupt vector is fetched. The previous IPL is automatically restored by executing the RTI instruction. MC9S12XE-Family Reference Manual Rev. 1.25 272 Freescale Semiconductor Chapter 6 Interrupt (S12XINTV2) 6.4.3 XGATE Requests If the XGATE module is implemented on the device, the XINT module is also used to process all exception requests to be serviced by the XGATE module. The overall priority level of those exceptions is discussed in the subsections below. 6.4.3.1 XGATE Request Prioritization An interrupt request channel is configured to be handled by the XGATE module, if the RQST bit of the associated configuration register is set to 1 (please refer to Section 6.3.2.4, “Interrupt Request Configuration Data Registers (INT_CFDATA0–7)”). The priority level configuration (PRIOLVL) for this channel becomes the XGATE priority which will be used to determine the highest priority XGATE request to be serviced next by the XGATE module. Additionally, XGATE interrupts may be raised by the XGATE module by setting one or more of the XGATE channel interrupt flags (by using the SIF instruction). This will result in an CPU interrupt with vector address vector base + (2 * channel ID number), where the channel ID number corresponds to the highest set channel interrupt flag, if the XGIE and channel RQST bits are set. The shared interrupt priority for the XGATE interrupt requests is taken from the XGATE interrupt priority configuration register (please refer to Section 6.3.2.2, “XGATE Interrupt Priority Configuration Register (INT_XGPRIO)”). If more than one XGATE interrupt request channel becomes active at the same time, the channel with the highest vector address wins the prioritization. 6.4.4 Priority Decoders The XINT module contains priority decoders to determine the priority for all interrupt requests pending for the respective target. There are two priority decoders, one for each interrupt request target, CPU or XGATE. The function of both priority decoders is basically the same with one exception: the priority decoder for the XGATE module does not take the current XGATE thread processing level into account. Instead, XGATE requests are handed to the XGATE module including a 1-bit priority identifier. The XGATE module uses this additional information to decide if the new request can interrupt a currently running thread. The 1-bit priority identifier corresponds to the most significant bit of the priority level configuration of the requesting channel. This means that XGATE requests with priority levels 4, 5, 6 or 7 can interrupt running XGATE threads with priority levels 1, 2 and 3. A CPU interrupt vector is not supplied until the CPU requests it. Therefore, it is possible that a higher priority interrupt request could override the original exception which caused the CPU to request the vector. In this case, the CPU will receive the highest priority vector and the system will process this exception instead of the original request. If the interrupt source is unknown (for example, in the case where an interrupt request becomes inactive after the interrupt has been recognized, but prior to the vector request), the vector address supplied to the CPU will default to that of the spurious interrupt vector. MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 273 Chapter 6 Interrupt (S12XINTV2) NOTE Care must be taken to ensure that all exception requests remain active until the system begins execution of the applicable service routine; otherwise, the exception request may not get processed at all or the result may be a spurious interrupt request (vector at address (vector base + 0x0010)). 6.4.5 Reset Exception Requests The XINT module supports three system reset exception request types (for details please refer to the Clock and Reset Generator module (CRG)): 1. Pin reset, power-on reset, low-voltage reset, or illegal address reset 2. Clock monitor reset request 3. COP watchdog reset request 6.4.6 Exception Priority The priority (from highest to lowest) and address of all exception vectors issued by the XINT module upon request by the CPU is shown in Table 6-10. Generally, all non-maskable interrupts have higher priorities than maskable interrupts. Please note that between the three software interrupts (Unimplemented op-code trap request, SWI/BGND request, SYS request) there is no real priority defined because they cannot occur simultaneously (the S12XCPU executes one instruction at a time). Table 6-10. Exception Vector Map and Priority Vector Address(1) Source 0xFFFE Pin reset, power-on reset, low-voltage reset, illegal address reset 0xFFFC Clock monitor reset 0xFFFA COP watchdog reset (Vector base + 0x00F8) Unimplemented op-code trap (Vector base + 0x00F6) Software interrupt instruction (SWI) or BDM vector request (Vector base + 0x0012) System call interrupt instruction (SYS) (Vector base + 0x0018) (reserved for future use) (Vector base + 0x0016) XGATE Access violation interrupt request(2) (Vector base + 0x0014) CPU Access violation interrupt request(3) (Vector base + 0x00F4) XIRQ interrupt request (Vector base + 0x00F2) IRQ interrupt request (Vector base + 0x00F0–0x001A) Device specific I bit maskable interrupt sources (priority determined by the associated configuration registers, in descending order) (Vector base + 0x0010) Spurious interrupt 1. 16 bits vector address based 2. only implemented if device features both a Memory Protection Unit (MPU) and an XGATE co-processor 3. only implemented if device features a Memory Protection Unit (MPU) MC9S12XE-Family Reference Manual Rev. 1.25 274 Freescale Semiconductor Chapter 6 Interrupt (S12XINTV2) 6.5 6.5.1 Initialization/Application Information Initialization After system reset, software should: • Initialize the interrupt vector base register if the interrupt vector table is not located at the default location (0xFF10–0xFFF9). • Initialize the interrupt processing level configuration data registers (INT_CFADDR, INT_CFDATA0–7) for all interrupt vector requests with the desired priority levels and the request target (CPU or XGATE module). It might be a good idea to disable unused interrupt requests. • If the XGATE module is used, setup the XGATE interrupt priority register (INT_XGPRIO) and configure the XGATE module (please refer the XGATE Block Guide for details). • Enable I maskable interrupts by clearing the I bit in the CCR. • Enable the X maskable interrupt by clearing the X bit in the CCR (if required). 6.5.2 Interrupt Nesting The interrupt request priority level scheme makes it possible to implement priority based interrupt request nesting for the I bit maskable interrupt requests handled by the CPU. • I bit maskable interrupt requests can be interrupted by an interrupt request with a higher priority, so that there can be up to seven nested I bit maskable interrupt requests at a time (refer to Figure 614 for an example using up to three nested interrupt requests). I bit maskable interrupt requests cannot be interrupted by other I bit maskable interrupt requests per default. In order to make an interrupt service routine (ISR) interruptible, the ISR must explicitly clear the I bit in the CCR (CLI). After clearing the I bit, I bit maskable interrupt requests with higher priority can interrupt the current ISR. An ISR of an interruptible I bit maskable interrupt request could basically look like this: • Service interrupt, e.g., clear interrupt flags, copy data, etc. • Clear I bit in the CCR by executing the instruction CLI (thus allowing interrupt requests with higher priority) • Process data • Return from interrupt by executing the instruction RTI MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 275 Chapter 6 Interrupt (S12XINTV2) 0 Stacked IPL IPL in CCR 0 0 4 0 0 0 4 7 4 3 1 0 7 6 RTI L7 5 4 RTI Processing Levels 3 L3 (Pending) 2 L4 RTI 1 L1 (Pending) 0 RTI Reset Figure 6-14. Interrupt Processing Example 6.5.3 6.5.3.1 Wake Up from Stop or Wait Mode CPU Wake Up from Stop or Wait Mode Only I bit maskable interrupt requests which are configured to be handled by the CPU are capable of waking the MCU from wait mode. Since bus and core clocks are disabled in stop mode, only interrupt requests that can be generated without these clocks can wake the MCU from stop mode. These are listed in the device overview interrupt vector table. Only I bit maskable interrupt requests which are configured to be handled by the CPU are capable of waking the MCU from stop mode. To determine whether an I bit maskable interrupt is qualified to wake up the CPU or not, the same settings as in normal run mode are applied during stop or wait mode: • If the I bit in the CCR is set, all I bit maskable interrupts are masked from waking up the MCU. • An I bit maskable interrupt is ignored if it is configured to a priority level below or equal to the current IPL in CCR. • I bit maskable interrupt requests which are configured to be handled by the XGATE module are not capable of waking up the CPU. The X bit maskable interrupt request can wake up the MCU from stop or wait mode at anytime, even if the X bit in CCR is set. If the X bit maskable interrupt request is used to wake-up the MCU with the X bit in the CCR set, the associated ISR is not called. The CPU then resumes program execution with the instruction following the WAI or STOP instruction. This features works following the same rules like any interrupt request, i.e. care must be taken that the X interrupt request used for wake-up remains active at least until the system begins execution of the instruction following the WAI or STOP instruction; otherwise, wake-up may not occur. MC9S12XE-Family Reference Manual Rev. 1.25 276 Freescale Semiconductor Chapter 6 Interrupt (S12XINTV2) 6.5.3.2 XGATE Wake Up from Stop or Wait Mode Interrupt request channels which are configured to be handled by the XGATE module are capable of waking up the XGATE module. Interrupt request channels handled by the XGATE module do not affect the state of the CPU. MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 277 Chapter 6 Interrupt (S12XINTV2) MC9S12XE-Family Reference Manual Rev. 1.25 278 Freescale Semiconductor Chapter 7 Background Debug Module (S12XBDMV2) Table 7-1. Revision History Revision Number Revision Date V02.00 07 Mar 2006 - First version of S12XBDMV2 V02.01 14 May 2008 - Introduced standardized Revision History Table V02.02 12 Sep 2012 - Minor formatting corrections 7.1 Sections Affected Description of Changes Introduction This section describes the functionality of the background debug module (BDM) sub-block of the HCS12X core platform. The background debug module (BDM) sub-block is a single-wire, background debug system implemented in on-chip hardware for minimal CPU intervention. All interfacing with the BDM is done via the BKGD pin. The BDM has enhanced capability for maintaining synchronization between the target and host while allowing more flexibility in clock rates. This includes a sync signal to determine the communication rate and a handshake signal to indicate when an operation is complete. The system is backwards compatible to the BDM of the S12 family with the following exceptions: • TAGGO command no longer supported by BDM • External instruction tagging feature now part of DBG module • BDM register map and register content extended/modified • Global page access functionality • Enabled but not active out of reset in emulation modes (if modes available) • CLKSW bit set out of reset in emulation modes (if modes available). • Family ID readable from firmware ROM at global address 0x7FFF0F (value for HCS12X devices is 0xC1) 7.1.1 Features The BDM includes these distinctive features: • Single-wire communication with host development system • Enhanced capability for allowing more flexibility in clock rates • SYNC command to determine communication rate • GO_UNTIL command MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 279 Chapter 7 Background Debug Module (S12XBDMV2) • • • • • • • • • • • • • Hardware handshake protocol to increase the performance of the serial communication Active out of reset in special single chip mode Nine hardware commands using free cycles, if available, for minimal CPU intervention Hardware commands not requiring active BDM 14 firmware commands execute from the standard BDM firmware lookup table Software control of BDM operation during wait mode Software selectable clocks Global page access functionality Enabled but not active out of reset in emulation modes (if modes available) CLKSW bit set out of reset in emulation modes (if modes available). When secured, hardware commands are allowed to access the register space in special single chip mode, if the non-volatile memory erase test fail. Family ID readable from firmware ROM at global address 0x7FFF0F (value for HCS12X devices is 0xC1) BDM hardware commands are operational until system stop mode is entered (all bus masters are in stop mode) 7.1.2 Modes of Operation BDM is available in all operating modes but must be enabled before firmware commands are executed. Some systems may have a control bit that allows suspending thefunction during background debug mode. 7.1.2.1 Regular Run Modes All of these operations refer to the part in run mode and not being secured. The BDM does not provide controls to conserve power during run mode. • Normal modes General operation of the BDM is available and operates the same in all normal modes. • Special single chip mode In special single chip mode, background operation is enabled and active out of reset. This allows programming a system with blank memory. • Emulation modes (if modes available) In emulation mode, background operation is enabled but not active out of reset. This allows debugging and programming a system in this mode more easily. 7.1.2.2 Secure Mode Operation If the device is in secure mode, the operation of the BDM is reduced to a small subset of its regular run mode operation. Secure operation prevents BDM and CPU accesses to non-volatile memory (Flash and/or EEPROM) other than allowing erasure. For more information please see Section 7.4.1, “Security”. MC9S12XE-Family Reference Manual Rev. 1.25 280 Freescale Semiconductor Chapter 7 Background Debug Module (S12XBDMV2) 7.1.2.3 Low-Power Modes The BDM can be used until all bus masters (e.g., CPU or XGATE or others depending on which masters are available on the SOC) are in stop mode. When CPU is in a low power mode (wait or stop mode) all BDM firmware commands as well as the hardware BACKGROUND command can not be used respectively are ignored. In this case the CPU can not enter BDM active mode, and only hardware read and write commands are available. Also the CPU can not enter a low power mode during BDM active mode. If all bus masters are in stop mode, the BDM clocks are stopped as well. When BDM clocks are disabled and one of the bus masters exits from stop mode the BDM clocks will restart and BDM will have a soft reset (clearing the instruction register, any command in progress and disable the ACK function). The BDM is now ready to receive a new command. 7.1.3 Block Diagram A block diagram of the BDM is shown in Figure 7-1. Host System Serial Interface BKGD Data 16-Bit Shift Register Control Register Block Address TRACE BDMACT Instruction Code and Execution Bus Interface and Control Logic Data Control Clocks ENBDM SDV UNSEC CLKSW Standard BDM Firmware LOOKUP TABLE Secured BDM Firmware LOOKUP TABLE BDMSTS Register Figure 7-1. BDM Block Diagram 7.2 External Signal Description A single-wire interface pin called the background debug interface (BKGD) pin is used to communicate with the BDM system. During reset, this pin is a mode select input which selects between normal and special modes of operation. After reset, this pin becomes the dedicated serial interface pin for the background debug mode. MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 281 Chapter 7 Background Debug Module (S12XBDMV2) 7.3 Memory Map and Register Definition 7.3.1 Module Memory Map Table 7-2 shows the BDM memory map when BDM is active. Table 7-2. BDM Memory Map 7.3.2 Global Address Module Size (Bytes) 0x7FFF00–0x7FFF0B BDM registers 12 0x7FFF0C–0x7FFF0E BDM firmware ROM 3 0x7FFF0F Family ID (part of BDM firmware ROM) 1 0x7FFF10–0x7FFFFF BDM firmware ROM 240 Register Descriptions A summary of the registers associated with the BDM is shown in Figure 7-2. Registers are accessed by host-driven communications to the BDM hardware using READ_BD and WRITE_BD commands. Global Address Register Name 0x7FFF00 Reserved R Bit 7 6 5 4 3 2 1 Bit 0 X X X X X X 0 0 BDMACT 0 SDV TRACE UNSEC 0 X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X CCR7 CCR6 CCR5 CCR4 CCR3 CCR2 CCR1 CCR0 W 0x7FFF01 BDMSTS R W 0x7FFF02 Reserved R ENBDM CLKSW W 0x7FFF03 Reserved R W 0x7FFF04 Reserved R W 0x7FFF05 Reserved R W 0x7FFF06 BDMCCRL R W = Unimplemented, Reserved X = Indeterminate = Implemented (do not alter) 0 = Always read zero Figure 7-2. BDM Register Summary MC9S12XE-Family Reference Manual Rev. 1.25 282 Freescale Semiconductor Chapter 7 Background Debug Module (S12XBDMV2) Global Address Register Name 0x7FFF07 Bit 7 6 5 4 3 0 0 0 0 0 BGAE BGP6 BGP5 BGP4 0 0 0 0 0 0 0 BDMCCRH R 2 1 Bit 0 CCR10 CCR9 CCR8 BGP3 BGP2 BGP1 BGP0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 W 0x7FFF08 BDMGPR R W 0x7FFF09 Reserved R W 0x7FFF0A Reserved R W 0x7FFF0B Reserved R W = Unimplemented, Reserved = Indeterminate X = Implemented (do not alter) = Always read zero 0 Figure 7-2. BDM Register Summary (continued) 7.3.2.1 BDM Status Register (BDMSTS) Register Global Address 0x7FFF01 7 R W ENBDM 6 5 4 3 BDMACT 0 SDV TRACE 1 0 0 0 2 1 0 UNSEC 0 0 0(3) 0 1(2) 0 0 0 0 0 CLKSW Reset Special Single-Chip Mode Emulation Modes 0(1) 1 0 0 0 0 0 0 0 0 (if modes available) All Other Modes 0 = Unimplemented, Reserved = Implemented (do not alter) 0 = Always read zero 1. ENBDM is read as 1 by a debugging environment in special single chip mode when the device is not secured or secured but fully erased (non-volatile memory). This is because the ENBDM bit is set by the standard firmware before a BDM command can be fully transmitted and executed. 2. CLKSW is read as 1 by a debugging environment in emulation modes when the device is not secured and read as 0 when secured if emulation modes available. 3. UNSEC is read as 1 by a debugging environment in special single chip mode when the device is secured and fully erased, else it is 0 and can only be read if not secure (see also bit description). Figure 7-3. BDM Status Register (BDMSTS) MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 283 Chapter 7 Background Debug Module (S12XBDMV2) Read: All modes through BDM operation when not secured Write: All modes through BDM operation when not secured, but subject to the following: — ENBDM should only be set via a BDM hardware command if the BDM firmware commands are needed. (This does not apply in special single chip and emulation modes). — BDMACT can only be set by BDM hardware upon entry into BDM. It can only be cleared by the standard BDM firmware lookup table upon exit from BDM active mode. — CLKSW can only be written via BDM hardware WRITE_BD commands. — All other bits, while writable via BDM hardware or standard BDM firmware write commands, should only be altered by the BDM hardware or standard firmware lookup table as part of BDM command execution. Table 7-3. BDMSTS Field Descriptions Field Description 7 ENBDM Enable BDM — This bit controls whether the BDM is enabled or disabled. When enabled, BDM can be made active to allow firmware commands to be executed. When disabled, BDM cannot be made active but BDM hardware commands are still allowed. 0 BDM disabled 1 BDM enabled Note: ENBDM is set by the firmware out of reset in special single chip mode. In emulation modes (if modes available) the ENBDM bit is set by BDM hardware out of reset. In special single chip mode with the device secured, this bit will not be set by the firmware until after the non-volatile memory erase verify tests are complete. In emulation modes (if modes available) with the device secured, the BDM operations are blocked. 6 BDMACT BDM Active Status — This bit becomes set upon entering BDM. The standard BDM firmware lookup table is then enabled and put into the memory map. BDMACT is cleared by a carefully timed store instruction in the standard BDM firmware as part of the exit sequence to return to user code and remove the BDM memory from the map. 0 BDM not active 1 BDM active 4 SDV Shift Data Valid — This bit is set and cleared by the BDM hardware. It is set after data has been transmitted as part of a firmware or hardware read command or after data has been received as part of a firmware or hardware write command. It is cleared when the next BDM command has been received or BDM is exited. SDV is used by the standard BDM firmware to control program flow execution. 0 Data phase of command not complete 1 Data phase of command is complete 3 TRACE TRACE1 BDM Firmware Command is Being Executed — This bit gets set when a BDM TRACE1 firmware command is first recognized. It will stay set until BDM firmware is exited by one of the following BDM commands: GO or GO_UNTIL. 0 TRACE1 command is not being executed 1 TRACE1 command is being executed MC9S12XE-Family Reference Manual Rev. 1.25 284 Freescale Semiconductor Chapter 7 Background Debug Module (S12XBDMV2) Table 7-3. BDMSTS Field Descriptions (continued) Field Description 2 CLKSW Clock Switch — The CLKSW bit controls which clock the BDM operates with. It is only writable from a hardware BDM command. A minimum delay of 150 cycles at the clock speed that is active during the data portion of the command send to change the clock source should occur before the next command can be send. The delay should be obtained no matter which bit is modified to effectively change the clock source (either PLLSEL bit or CLKSW bit). This guarantees that the start of the next BDM command uses the new clock for timing subsequent BDM communications. Table 7-4 shows the resulting BDM clock source based on the CLKSW and the PLLSEL (PLL select in the CRG module, the bit is part of the CLKSEL register) bits. Note: The BDM alternate clock source can only be selected when CLKSW = 0 and PLLSEL = 1. The BDM serial interface is now fully synchronized to the alternate clock source, when enabled. This eliminates frequency restriction on the alternate clock which was required on previous versions. Refer to the device specification to determine which clock connects to the alternate clock source input. Note: If the acknowledge function is turned on, changing the CLKSW bit will cause the ACK to be at the new rate for the write command which changes it. Note: In emulation modes (if modes available), the CLKSW bit will be set out of RESET. 1 UNSEC Unsecure — If the device is secured this bit is only writable in special single chip mode from the BDM secure firmware. It is in a zero state as secure mode is entered so that the secure BDM firmware lookup table is enabled and put into the memory map overlapping the standard BDM firmware lookup table. The secure BDM firmware lookup table verifies that the non-volatile memories (e.g. on-chip EEPROM and/or Flash EEPROM) are erased. This being the case, the UNSEC bit is set and the BDM program jumps to the start of the standard BDM firmware lookup table and the secure BDM firmware lookup table is turned off. If the erase test fails, the UNSEC bit will not be asserted. 0 System is in a secured mode. 1 System is in a unsecured mode. Note: When UNSEC is set, security is off and the user can change the state of the secure bits in the on-chip Flash EEPROM. Note that if the user does not change the state of the bits to “unsecured” mode, the system will be secured again when it is next taken out of reset.After reset this bit has no meaning or effect when the security byte in the Flash EEPROM is configured for unsecure mode. Table 7-4. BDM Clock Sources PLLSEL CLKSW BDMCLK 0 0 Bus clock dependent on oscillator 0 1 Bus clock dependent on oscillator 1 0 Alternate clock (refer to the device specification to determine the alternate clock source) 1 1 Bus clock dependent on the PLL MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 285 Chapter 7 Background Debug Module (S12XBDMV2) 7.3.2.2 BDM CCR LOW Holding Register (BDMCCRL) Register Global Address 0x7FFF06 7 6 5 4 3 2 1 0 CCR7 CCR6 CCR5 CCR4 CCR3 CCR2 CCR1 CCR0 Special Single-Chip Mode 1 1 0 0 1 0 0 0 All Other Modes 0 0 0 0 0 0 0 0 R W Reset Figure 7-4. BDM CCR LOW Holding Register (BDMCCRL) Read: All modes through BDM operation when not secured Write: All modes through BDM operation when not secured NOTE When BDM is made active, the CPU stores the content of its CCRL register in the BDMCCRL register. However, out of special single-chip reset, the BDMCCRL is set to 0xD8 and not 0xD0 which is the reset value of the CCRL register in this CPU mode. Out of reset in all other modes the BDMCCRL register is read zero. When entering background debug mode, the BDM CCR LOW holding register is used to save the low byte of the condition code register of the user’s program. It is also used for temporary storage in the standard BDM firmware mode. The BDM CCR LOW holding register can be written to modify the CCR value. 7.3.2.3 BDM CCR HIGH Holding Register (BDMCCRH) Register Global Address 0x7FFF07 R 7 6 5 4 3 0 0 0 0 0 0 0 0 0 0 W Reset 2 1 0 CCR10 CCR9 CCR8 0 0 0 = Unimplemented or Reserved Figure 7-5. BDM CCR HIGH Holding Register (BDMCCRH) Read: All modes through BDM operation when not secured Write: All modes through BDM operation when not secured When entering background debug mode, the BDM CCR HIGH holding register is used to save the high byte of the condition code register of the user’s program. The BDM CCR HIGH holding register can be written to modify the CCR value. MC9S12XE-Family Reference Manual Rev. 1.25 286 Freescale Semiconductor Chapter 7 Background Debug Module (S12XBDMV2) 7.3.2.4 BDM Global Page Index Register (BDMGPR) Register Global Address 0x7FFF08 R W Reset 7 6 5 4 3 2 1 0 BGAE BGP6 BGP5 BGP4 BGP3 BGP2 BGP1 BGP0 0 0 0 0 0 0 0 0 Figure 7-6. BDM Global Page Register (BDMGPR) Read: All modes through BDM operation when not secured Write: All modes through BDM operation when not secured Table 7-5. BDMGPR Field Descriptions Field Description 7 BGAE BDM Global Page Access Enable Bit — BGAE enables global page access for BDM hardware and firmware read/write instructions The BDM hardware commands used to access the BDM registers (READ_BD_ and WRITE_BD_) can not be used for global accesses even if the BGAE bit is set. 0 BDM Global Access disabled 1 BDM Global Access enabled 6–0 BGP[6:0] BDM Global Page Index Bits 6–0 — These bits define the extended address bits from 22 to 16. For more detailed information regarding the global page window scheme, please refer to the S12X_MMC Block Guide. 7.3.3 Family ID Assignment The family ID is a 8-bit value located in the firmware ROM (at global address: 0x7FFF0F). The read-only value is a unique family ID which is 0xC1 for S12X devices. 7.4 Functional Description The BDM receives and executes commands from a host via a single wire serial interface. There are two types of BDM commands: hardware and firmware commands. Hardware commands are used to read and write target system memory locations and to enter active background debug mode, see Section 7.4.3, “BDM Hardware Commands”. Target system memory includes all memory that is accessible by the CPU. Firmware commands are used to read and write CPU resources and to exit from active background debug mode, see Section 7.4.4, “Standard BDM Firmware Commands”. The CPU resources referred to are the accumulator (D), X index register (X), Y index register (Y), stack pointer (SP), and program counter (PC). Hardware commands can be executed at any time and in any mode excluding a few exceptions as highlighted (see Section 7.4.3, “BDM Hardware Commands”) and in secure mode (see Section 7.4.1, “Security”). Firmware commands can only be executed when the system is not secure and is in active background debug mode (BDM). MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 287 Chapter 7 Background Debug Module (S12XBDMV2) 7.4.1 Security If the user resets into special single chip mode with the system secured, a secured mode BDM firmware lookup table is brought into the map overlapping a portion of the standard BDM firmware lookup table. The secure BDM firmware verifies that the on-chip non-volatile memory (e.g. EEPROM and Flash EEPROM) is erased. This being the case, the UNSEC and ENBDM bit will get set. The BDM program jumps to the start of the standard BDM firmware and the secured mode BDM firmware is turned off and all BDM commands are allowed. If the non-volatile memory does not verify as erased, the BDM firmware sets the ENBDM bit, without asserting UNSEC, and the firmware enters a loop. This causes the BDM hardware commands to become enabled, but does not enable the firmware commands. This allows the BDM hardware to be used to erase the non-volatile memory. BDM operation is not possible in any other mode than special single chip mode when the device is secured. The device can be unsecured via BDM serial interface in special single chip mode only. More information regarding security is provided in the security section of the device documentation. 7.4.2 Enabling and Activating BDM The system must be in active BDM to execute standard BDM firmware commands. BDM can be activated only after being enabled. BDM is enabled by setting the ENBDM bit in the BDM status (BDMSTS) register. The ENBDM bit is set by writing to the BDM status (BDMSTS) register, via the single-wire interface, using a hardware command such as WRITE_BD_BYTE. After being enabled, BDM is activated by one of the following1: • Hardware BACKGROUND command • CPU BGND instruction • External instruction tagging mechanism2 • Breakpoint force or tag mechanism2 When BDM is activated, the CPU finishes executing the current instruction and then begins executing the firmware in the standard BDM firmware lookup table. When BDM is activated by a breakpoint, the type of breakpoint used determines if BDM becomes active before or after execution of the next instruction. NOTE If an attempt is made to activate BDM before being enabled, the CPU resumes normal instruction execution after a brief delay. If BDM is not enabled, any hardware BACKGROUND commands issued are ignored by the BDM and the CPU is not delayed. In active BDM, the BDM registers and standard BDM firmware lookup table are mapped to addresses 0x7FFF00 to 0x7FFFFF. BDM registers are mapped to addresses 0x7FFF00 to 0x7FFF0B. The BDM uses these registers which are readable anytime by the BDM. However, these registers are not readable by user programs. 1. BDM is enabled and active immediately out of special single-chip reset. 2. This method is provided by the S12X_DBG module. MC9S12XE-Family Reference Manual Rev. 1.25 288 Freescale Semiconductor Chapter 7 Background Debug Module (S12XBDMV2) 7.4.3 BDM Hardware Commands Hardware commands are used to read and write target system memory locations and to enter active background debug mode. Target system memory includes all memory that is accessible by the CPU on the SOC which can be on-chip RAM, non-volatile memory (e.g. EEPROM, Flash EEPROM), I/O and control registers, and all external memory. Hardware commands are executed with minimal or no CPU intervention and do not require the system to be in active BDM for execution, although, they can still be executed in this mode. When executing a hardware command, the BDM sub-block waits for a free bus cycle so that the background access does not disturb the running application program. If a free cycle is not found within 128 clock cycles, the CPU is momentarily frozen so that the BDM can steal a cycle. When the BDM finds a free cycle, the operation does not intrude on normal CPU operation provided that it can be completed in a single cycle. However, if an operation requires multiple cycles the CPU is frozen until the operation is complete, even though the BDM found a free cycle. The BDM hardware commands are listed in Table 7-6. The READ_BD and WRITE_BD commands allow access to the BDM register locations. These locations are not normally in the system memory map but share addresses with the application in memory. To distinguish between physical memory locations that share the same address, BDM memory resources are enabled just for the READ_BD and WRITE_BD access cycle. This allows the BDM to access BDM locations unobtrusively, even if the addresses conflict with the application memory map. Table 7-6. Hardware Commands Opcode (hex) Data BACKGROUND 90 None Enter background mode if firmware is enabled. If enabled, an ACK will be issued when the part enters active background mode. ACK_ENABLE D5 None Enable Handshake. Issues an ACK pulse after the command is executed. ACK_DISABLE D6 None Disable Handshake. This command does not issue an ACK pulse. READ_BD_BYTE E4 16-bit address Read from memory with standard BDM firmware lookup table in map. 16-bit data out Odd address data on low byte; even address data on high byte. READ_BD_WORD EC 16-bit address Read from memory with standard BDM firmware lookup table in map. 16-bit data out Must be aligned access. READ_BYTE E0 16-bit address Read from memory with standard BDM firmware lookup table out of map. 16-bit data out Odd address data on low byte; even address data on high byte. READ_WORD E8 16-bit address Read from memory with standard BDM firmware lookup table out of map. 16-bit data out Must be aligned access. WRITE_BD_BYTE C4 16-bit address Write to memory with standard BDM firmware lookup table in map. 16-bit data in Odd address data on low byte; even address data on high byte. WRITE_BD_WORD CC 16-bit address Write to memory with standard BDM firmware lookup table in map. 16-bit data in Must be aligned access. WRITE_BYTE C0 16-bit address Write to memory with standard BDM firmware lookup table out of map. 16-bit data in Odd address data on low byte; even address data on high byte. Command Description MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 289 Chapter 7 Background Debug Module (S12XBDMV2) Table 7-6. Hardware Commands (continued) Command WRITE_WORD Opcode (hex) C8 Data Description 16-bit address Write to memory with standard BDM firmware lookup table out of map. 16-bit data in Must be aligned access. NOTE: If enabled, ACK will occur when data is ready for transmission for all BDM READ commands and will occur after the write is complete for all BDM WRITE commands. 7.4.4 Standard BDM Firmware Commands Firmware commands are used to access and manipulate CPU resources. The system must be in active BDM to execute standard BDM firmware commands, see Section 7.4.2, “Enabling and Activating BDM”. Normal instruction execution is suspended while the CPU executes the firmware located in the standard BDM firmware lookup table. The hardware command BACKGROUND is the usual way to activate BDM. As the system enters active BDM, the standard BDM firmware lookup table and BDM registers become visible in the on-chip memory map at 0x7FFF00–0x7FFFFF, and the CPU begins executing the standard BDM firmware. The standard BDM firmware watches for serial commands and executes them as they are received. The firmware commands are shown in Table 7-7. MC9S12XE-Family Reference Manual Rev. 1.25 290 Freescale Semiconductor Chapter 7 Background Debug Module (S12XBDMV2) Table 7-7. Firmware Commands Command(1) Opcode (hex) Data Description READ_NEXT(2) 62 16-bit data out Increment X index register by 2 (X = X + 2), then read word X points to. READ_PC 63 16-bit data out Read program counter. READ_D 64 16-bit data out Read D accumulator. READ_X 65 16-bit data out Read X index register. READ_Y 66 16-bit data out Read Y index register. READ_SP 67 16-bit data out Read stack pointer. WRITE_NEXT 42 16-bit data in Increment X index register by 2 (X = X + 2), then write word to location pointed to by X. WRITE_PC 43 16-bit data in Write program counter. WRITE_D 44 16-bit data in Write D accumulator. WRITE_X 45 16-bit data in Write X index register. WRITE_Y 46 16-bit data in Write Y index register. WRITE_SP 47 16-bit data in Write stack pointer. GO 08 none Go to user program. If enabled, ACK will occur when leaving active background mode. GO_UNTIL(3) 0C none Go to user program. If enabled, ACK will occur upon returning to active background mode. TRACE1 10 none Execute one user instruction then return to active BDM. If enabled, ACK will occur upon returning to active background mode. TAGGO -> GO 18 none (Previous enable tagging and go to user program.) This command will be deprecated and should not be used anymore. Opcode will be executed as a GO command. 1. If enabled, ACK will occur when data is ready for transmission for all BDM READ commands and will occur after the write is complete for all BDM WRITE commands. 2. When the firmware command READ_NEXT or WRITE_NEXT is used to access the BDM address space the BDM resources are accessed rather than user code. Writing BDM firmware is not possible. 3. System stop disables the ACK function and ignored commands will not have an ACK-pulse (e.g., CPU in stop or wait mode). The GO_UNTIL command will not get an Acknowledge if CPU executes the wait or stop instruction before the “UNTIL” condition (BDM active again) is reached (see Section 7.4.7, “Serial Interface Hardware Handshake Protocol” last Note). 7.4.5 BDM Command Structure Hardware and firmware BDM commands start with an 8-bit opcode followed by a 16-bit address and/or a 16-bit data word depending on the command. All the read commands return 16 bits of data despite the byte or word implication in the command name. 8-bit reads return 16-bits of data, of which, only one byte will contain valid data. If reading an even address, the valid data will appear in the MSB. If reading an odd address, the valid data will appear in the LSB. MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 291 Chapter 7 Background Debug Module (S12XBDMV2) 16-bit misaligned reads and writes are generally not allowed. If attempted by BDM hardware command, the BDM will ignore the least significant bit of the address and will assume an even address from the remaining bits. For devices with external bus: The following cycle count information is only valid when the external wait function is not used (see wait bit of EBI sub-block). During an external wait the BDM can not steal a cycle. Hence be careful with the external wait function if the BDM serial interface is much faster than the bus, because of the BDM softreset after time-out (see Section 7.4.11, “Serial Communication Time Out”). For hardware data read commands, the external host must wait at least 150 bus clock cycles after sending the address before attempting to obtain the read data. This is to be certain that valid data is available in the BDM shift register, ready to be shifted out. For hardware write commands, the external host must wait 150 bus clock cycles after sending the data to be written before attempting to send a new command. This is to avoid disturbing the BDM shift register before the write has been completed. The 150 bus clock cycle delay in both cases includes the maximum 128 cycle delay that can be incurred as the BDM waits for a free cycle before stealing a cycle. For firmware read commands, the external host should wait at least 48 bus clock cycles after sending the command opcode and before attempting to obtain the read data. This includes the potential of extra cycles when the access is external and stretched (+1 to maximum +7 cycles) or to registers of the PRU (port replacement unit) in emulation modes (if modes available). The 48 cycle wait allows enough time for the requested data to be made available in the BDM shift register, ready to be shifted out. NOTE This timing has increased from previous BDM modules due to the new capability in which the BDM serial interface can potentially run faster than the bus. On previous BDM modules this extra time could be hidden within the serial time. For firmware write commands, the external host must wait 36 bus clock cycles after sending the data to be written before attempting to send a new command. This is to avoid disturbing the BDM shift register before the write has been completed. The external host should wait at least for 76 bus clock cycles after a TRACE1 or GO command before starting any new serial command. This is to allow the CPU to exit gracefully from the standard BDM firmware lookup table and resume execution of the user code. Disturbing the BDM shift register prematurely may adversely affect the exit from the standard BDM firmware lookup table. NOTE If the bus rate of the target processor is unknown or could be changing or the external wait function is used, it is recommended that the ACK (acknowledge function) is used to indicate when an operation is complete. When using ACK, the delay times are automated. Figure 7-7 represents the BDM command structure. The command blocks illustrate a series of eight bit times starting with a falling edge. The bar across the top of the blocks indicates that the BKGD line idles in the high state. The time for an 8-bit command is 8 × 16 target clock cycles.1 MC9S12XE-Family Reference Manual Rev. 1.25 292 Freescale Semiconductor Chapter 7 Background Debug Module (S12XBDMV2) Hardware Read 8 Bits AT ~16 TC/Bit 16 Bits AT ~16 TC/Bit Command Address 150-BC Delay 16 Bits AT ~16 TC/Bit Data Next Command 150-BC Delay Hardware Write Command Address Next Command Data 48-BC DELAY Firmware Read Command Next Command Data 36-BC DELAY Firmware Write Command Data Next Command 76-BC Delay GO, TRACE Command Next Command BC = Bus Clock Cycles TC = Target Clock Cycles Figure 7-7. BDM Command Structure 7.4.6 BDM Serial Interface The BDM communicates with external devices serially via the BKGD pin. During reset, this pin is a mode select input which selects between normal and special modes of operation. After reset, this pin becomes the dedicated serial interface pin for the BDM. The BDM serial interface is timed using the clock selected by the CLKSW bit in the status register see Section 7.3.2.1, “BDM Status Register (BDMSTS)”. This clock will be referred to as the target clock in the following explanation. The BDM serial interface uses a clocking scheme in which the external host generates a falling edge on the BKGD pin to indicate the start of each bit time. This falling edge is sent for every bit whether data is transmitted or received. Data is transferred most significant bit (MSB) first at 16 target clock cycles per bit. The interface times out if 512 clock cycles occur between falling edges from the host. The BKGD pin is a pseudo open-drain pin and has an weak on-chip active pull-up that is enabled at all times. It is assumed that there is an external pull-up and that drivers connected to BKGD do not typically drive the high level. Since R-C rise time could be unacceptably long, the target system and host provide brief driven-high (speedup) pulses to drive BKGD to a logic 1. The source of this speedup pulse is the host for transmit cases and the target for receive cases. The timing for host-to-target is shown in Figure 7-8 and that of target-to-host in Figure 7-9 and Figure 7-10. All four cases begin when the host drives the BKGD pin low to generate a falling edge. Since the host and target are operating from separate clocks, it can take the target system up to one full clock 1. Target clock cycles are cycles measured using the target MCU’s serial clock rate. See Section 7.4.6, “BDM Serial Interface” and Section 7.3.2.1, “BDM Status Register (BDMSTS)” for information on how serial clock rate is selected. MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 293 Chapter 7 Background Debug Module (S12XBDMV2) cycle to recognize this edge. The target measures delays from this perceived start of the bit time while the host measures delays from the point it actually drove BKGD low to start the bit up to one target clock cycle earlier. Synchronization between the host and target is established in this manner at the start of every bit time. Figure 7-8 shows an external host transmitting a logic 1 and transmitting a logic 0 to the BKGD pin of a target system. The host is asynchronous to the target, so there is up to a one clock-cycle delay from the host-generated falling edge to where the target recognizes this edge as the beginning of the bit time. Ten target clock cycles later, the target senses the bit level on the BKGD pin. Internal glitch detect logic requires the pin be driven high no later that eight target clock cycles after the falling edge for a logic 1 transmission. Since the host drives the high speedup pulses in these two cases, the rising edges look like digitally driven signals. BDM Clock (Target MCU) Host Transmit 1 Host Transmit 0 Perceived Start of Bit Time Target Senses Bit 10 Cycles Synchronization Uncertainty Earliest Start of Next Bit Figure 7-8. BDM Host-to-Target Serial Bit Timing The receive cases are more complicated. Figure 7-9 shows the host receiving a logic 1 from the target system. Since the host is asynchronous to the target, there is up to one clock-cycle delay from the hostgenerated falling edge on BKGD to the perceived start of the bit time in the target. The host holds the BKGD pin low long enough for the target to recognize it (at least two target clock cycles). The host must release the low drive before the target drives a brief high speedup pulse seven target clock cycles after the perceived start of the bit time. The host should sample the bit level about 10 target clock cycles after it started the bit time. MC9S12XE-Family Reference Manual Rev. 1.25 294 Freescale Semiconductor Chapter 7 Background Debug Module (S12XBDMV2) BDM Clock (Target MCU) Host Drive to BKGD Pin Target System Speedup Pulse High-Impedance High-Impedance High-Impedance Perceived Start of Bit Time R-C Rise BKGD Pin 10 Cycles 10 Cycles Host Samples BKGD Pin Earliest Start of Next Bit Figure 7-9. BDM Target-to-Host Serial Bit Timing (Logic 1) MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 295 Chapter 7 Background Debug Module (S12XBDMV2) Figure 7-10 shows the host receiving a logic 0 from the target. Since the host is asynchronous to the target, there is up to a one clock-cycle delay from the host-generated falling edge on BKGD to the start of the bit time as perceived by the target. The host initiates the bit time but the target finishes it. Since the target wants the host to receive a logic 0, it drives the BKGD pin low for 13 target clock cycles then briefly drives it high to speed up the rising edge. The host samples the bit level about 10 target clock cycles after starting the bit time. BDM Clock (Target MCU) Host Drive to BKGD Pin High-Impedance Speedup Pulse Target System Drive and Speedup Pulse Perceived Start of Bit Time BKGD Pin 10 Cycles 10 Cycles Host Samples BKGD Pin Earliest Start of Next Bit Figure 7-10. BDM Target-to-Host Serial Bit Timing (Logic 0) 7.4.7 Serial Interface Hardware Handshake Protocol BDM commands that require CPU execution are ultimately treated at the MCU bus rate. Since the BDM clock source can be asynchronously related to the bus frequency, when CLKSW = 0, it is very helpful to provide a handshake protocol in which the host could determine when an issued command is executed by the CPU. The alternative is to always wait the amount of time equal to the appropriate number of cycles at the slowest possible rate the clock could be running. This sub-section will describe the hardware handshake protocol. The hardware handshake protocol signals to the host controller when an issued command was successfully executed by the target. This protocol is implemented by a 16 serial clock cycle low pulse followed by a brief speedup pulse in the BKGD pin. This pulse is generated by the target MCU when a command, issued by the host, has been successfully executed (see Figure 7-11). This pulse is referred to as the ACK pulse. After the ACK pulse has finished: the host can start the bit retrieval if the last issued command was a read command, or start a new command if the last command was a write command or a control command (BACKGROUND, GO, GO_UNTIL or TRACE1). The ACK pulse is not issued earlier than 32 serial clock cycles after the BDM command was issued. The end of the BDM command is assumed to be the 16th tick of the last bit. This minimum delay assures enough time for the host to perceive the ACK pulse. Note also that, there is no upper limit for the delay between the command and the related ACK pulse, since the command execution depends upon the CPU bus frequency, which in some cases could be very slow MC9S12XE-Family Reference Manual Rev. 1.25 296 Freescale Semiconductor Chapter 7 Background Debug Module (S12XBDMV2) compared to the serial communication rate. This protocol allows a great flexibility for the POD designers, since it does not rely on any accurate time measurement or short response time to any event in the serial communication. BDM Clock (Target MCU) 16 Cycles Target Transmits ACK Pulse High-Impedance High-Impedance 32 Cycles Speedup Pulse Minimum Delay From the BDM Command BKGD Pin Earliest Start of Next Bit 16th Tick of the Last Command Bit Figure 7-11. Target Acknowledge Pulse (ACK) NOTE If the ACK pulse was issued by the target, the host assumes the previous command was executed. If the CPU enters wait or stop prior to executing a hardware command, the ACK pulse will not be issued meaning that the BDM command was not executed. After entering wait or stop mode, the BDM command is no longer pending. Figure 7-12 shows the ACK handshake protocol in a command level timing diagram. The READ_BYTE instruction is used as an example. First, the 8-bit instruction opcode is sent by the host, followed by the address of the memory location to be read. The target BDM decodes the instruction. A bus cycle is grabbed (free or stolen) by the BDM and it executes the READ_BYTE operation. Having retrieved the data, the BDM issues an ACK pulse to the host controller, indicating that the addressed byte is ready to be retrieved. After detecting the ACK pulse, the host initiates the byte retrieval process. Note that data is sent in the form of a word and the host needs to determine which is the appropriate byte based on whether the address was odd or even. Target BKGD Pin READ_BYTE Host Byte Address Host (2) Bytes are Retrieved New BDM Command Host Target Target BDM Issues the ACK Pulse (out of scale) BDM Decodes the Command BDM Executes the READ_BYTE Command Figure 7-12. Handshake Protocol at Command Level MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 297 Chapter 7 Background Debug Module (S12XBDMV2) Differently from the normal bit transfer (where the host initiates the transmission), the serial interface ACK handshake pulse is initiated by the target MCU by issuing a negative edge in the BKGD pin. The hardware handshake protocol in Figure 7-11 specifies the timing when the BKGD pin is being driven, so the host should follow this timing constraint in order to avoid the risk of an electrical conflict in the BKGD pin. NOTE The only place the BKGD pin can have an electrical conflict is when one side is driving low and the other side is issuing a speedup pulse (high). Other “highs” are pulled rather than driven. However, at low rates the time of the speedup pulse can become lengthy and so the potential conflict time becomes longer as well. The ACK handshake protocol does not support nested ACK pulses. If a BDM command is not acknowledge by an ACK pulse, the host needs to abort the pending command first in order to be able to issue a new BDM command. When the CPU enters wait or stop while the host issues a hardware command (e.g., WRITE_BYTE), the target discards the incoming command due to the wait or stop being detected. Therefore, the command is not acknowledged by the target, which means that the ACK pulse will not be issued in this case. After a certain time the host (not aware of stop or wait) should decide to abort any possible pending ACK pulse in order to be sure a new command can be issued. Therefore, the protocol provides a mechanism in which a command, and its corresponding ACK, can be aborted. NOTE The ACK pulse does not provide a time out. This means for the GO_UNTIL command that it can not be distinguished if a stop or wait has been executed (command discarded and ACK not issued) or if the “UNTIL” condition (BDM active) is just not reached yet. Hence in any case where the ACK pulse of a command is not issued the possible pending command should be aborted before issuing a new command. See the handshake abort procedure described in Section 7.4.8, “Hardware Handshake Abort Procedure”. 7.4.8 Hardware Handshake Abort Procedure The abort procedure is based on the SYNC command. In order to abort a command, which had not issued the corresponding ACK pulse, the host controller should generate a low pulse in the BKGD pin by driving it low for at least 128 serial clock cycles and then driving it high for one serial clock cycle, providing a speedup pulse. By detecting this long low pulse in the BKGD pin, the target executes the SYNC protocol, see Section 7.4.9, “SYNC — Request Timed Reference Pulse”, and assumes that the pending command and therefore the related ACK pulse, are being aborted. Therefore, after the SYNC protocol has been completed the host is free to issue new BDM commands. For Firmware READ or WRITE commands it can not be guaranteed that the pending command is aborted when issuing a SYNC before the corresponding ACK pulse. There is a short latency time from the time the READ or WRITE access begins until it is finished and the corresponding ACK pulse is issued. The latency time depends on the firmware READ or WRITE command that is issued and if the serial interface is running on a different clock rate than the bus. When the SYNC command starts during this latency time the READ or WRITE command will not be aborted, but the corresponding ACK pulse will be aborted. A pending GO, TRACE1 or MC9S12XE-Family Reference Manual Rev. 1.25 298 Freescale Semiconductor Chapter 7 Background Debug Module (S12XBDMV2) GO_UNTIL command can not be aborted. Only the corresponding ACK pulse can be aborted by the SYNC command. Although it is not recommended, the host could abort a pending BDM command by issuing a low pulse in the BKGD pin shorter than 128 serial clock cycles, which will not be interpreted as the SYNC command. The ACK is actually aborted when a negative edge is perceived by the target in the BKGD pin. The short abort pulse should have at least 4 clock cycles keeping the BKGD pin low, in order to allow the negative edge to be detected by the target. In this case, the target will not execute the SYNC protocol but the pending command will be aborted along with the ACK pulse. The potential problem with this abort procedure is when there is a conflict between the ACK pulse and the short abort pulse. In this case, the target may not perceive the abort pulse. The worst case is when the pending command is a read command (i.e., READ_BYTE). If the abort pulse is not perceived by the target the host will attempt to send a new command after the abort pulse was issued, while the target expects the host to retrieve the accessed memory byte. In this case, host and target will run out of synchronism. However, if the command to be aborted is not a read command the short abort pulse could be used. After a command is aborted the target assumes the next negative edge, after the abort pulse, is the first bit of a new BDM command. NOTE The details about the short abort pulse are being provided only as a reference for the reader to better understand the BDM internal behavior. It is not recommended that this procedure be used in a real application. Since the host knows the target serial clock frequency, the SYNC command (used to abort a command) does not need to consider the lower possible target frequency. In this case, the host could issue a SYNC very close to the 128 serial clock cycles length. Providing a small overhead on the pulse length in order to assure the SYNC pulse will not be misinterpreted by the target. See Section 7.4.9, “SYNC — Request Timed Reference Pulse”. Figure 7-13 shows a SYNC command being issued after a READ_BYTE, which aborts the READ_BYTE command. Note that, after the command is aborted a new command could be issued by the host computer. READ_BYTE CMD is Aborted by the SYNC Request (Out of Scale) BKGD Pin READ_BYTE Host Memory Address Target BDM Decode and Starts to Execute the READ_BYTE Command SYNC Response From the Target (Out of Scale) READ_STATUS Host Target New BDM Command Host Target New BDM Command Figure 7-13. ACK Abort Procedure at the Command Level NOTE Figure 7-13 does not represent the signals in a true timing scale Figure 7-14 shows a conflict between the ACK pulse and the SYNC request pulse. This conflict could occur if a POD device is connected to the target BKGD pin and the target is already in debug active mode. MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 299 Chapter 7 Background Debug Module (S12XBDMV2) Consider that the target CPU is executing a pending BDM command at the exact moment the POD is being connected to the BKGD pin. In this case, an ACK pulse is issued along with the SYNC command. In this case, there is an electrical conflict between the ACK speedup pulse and the SYNC pulse. Since this is not a probable situation, the protocol does not prevent this conflict from happening. At Least 128 Cycles BDM Clock (Target MCU) ACK Pulse Target MCU Drives to BKGD Pin Host Drives SYNC To BKGD Pin High-Impedance Host and Target Drive to BKGD Pin Electrical Conflict Speedup Pulse Host SYNC Request Pulse BKGD Pin 16 Cycles Figure 7-14. ACK Pulse and SYNC Request Conflict NOTE This information is being provided so that the MCU integrator will be aware that such a conflict could eventually occur. The hardware handshake protocol is enabled by the ACK_ENABLE and disabled by the ACK_DISABLE BDM commands. This provides backwards compatibility with the existing POD devices which are not able to execute the hardware handshake protocol. It also allows for new POD devices, that support the hardware handshake protocol, to freely communicate with the target device. If desired, without the need for waiting for the ACK pulse. The commands are described as follows: • ACK_ENABLE — enables the hardware handshake protocol. The target will issue the ACK pulse when a CPU command is executed by the CPU. The ACK_ENABLE command itself also has the ACK pulse as a response. • ACK_DISABLE — disables the ACK pulse protocol. In this case, the host needs to use the worst case delay time at the appropriate places in the protocol. The default state of the BDM after reset is hardware handshake protocol disabled. All the read commands will ACK (if enabled) when the data bus cycle has completed and the data is then ready for reading out by the BKGD serial pin. All the write commands will ACK (if enabled) after the data has been received by the BDM through the BKGD serial pin and when the data bus cycle is complete. See Section 7.4.3, “BDM Hardware Commands” and Section 7.4.4, “Standard BDM Firmware Commands” for more information on the BDM commands. MC9S12XE-Family Reference Manual Rev. 1.25 300 Freescale Semiconductor Chapter 7 Background Debug Module (S12XBDMV2) The ACK_ENABLE sends an ACK pulse when the command has been completed. This feature could be used by the host to evaluate if the target supports the hardware handshake protocol. If an ACK pulse is issued in response to this command, the host knows that the target supports the hardware handshake protocol. If the target does not support the hardware handshake protocol the ACK pulse is not issued. In this case, the ACK_ENABLE command is ignored by the target since it is not recognized as a valid command. The BACKGROUND command will issue an ACK pulse when the CPU changes from normal to background mode. The ACK pulse related to this command could be aborted using the SYNC command. The GO command will issue an ACK pulse when the CPU exits from background mode. The ACK pulse related to this command could be aborted using the SYNC command. The GO_UNTIL command is equivalent to a GO command with exception that the ACK pulse, in this case, is issued when the CPU enters into background mode. This command is an alternative to the GO command and should be used when the host wants to trace if a breakpoint match occurs and causes the CPU to enter active background mode. Note that the ACK is issued whenever the CPU enters BDM, which could be caused by a breakpoint match or by a BGND instruction being executed. The ACK pulse related to this command could be aborted using the SYNC command. The TRACE1 command has the related ACK pulse issued when the CPU enters background active mode after one instruction of the application program is executed. The ACK pulse related to this command could be aborted using the SYNC command. 7.4.9 SYNC — Request Timed Reference Pulse The SYNC command is unlike other BDM commands because the host does not necessarily know the correct communication speed to use for BDM communications until after it has analyzed the response to the SYNC command. To issue a SYNC command, the host should perform the following steps: 1. Drive the BKGD pin low for at least 128 cycles at the lowest possible BDM serial communication frequency (the lowest serial communication frequency is determined by the crystal oscillator or the clock chosen by CLKSW.) 2. Drive BKGD high for a brief speedup pulse to get a fast rise time (this speedup pulse is typically one cycle of the host clock.) 3. Remove all drive to the BKGD pin so it reverts to high impedance. 4. Listen to the BKGD pin for the sync response pulse. Upon detecting the SYNC request from the host, the target performs the following steps: 1. Discards any incomplete command received or bit retrieved. 2. Waits for BKGD to return to a logic one. 3. Delays 16 cycles to allow the host to stop driving the high speedup pulse. 4. Drives BKGD low for 128 cycles at the current BDM serial communication frequency. 5. Drives a one-cycle high speedup pulse to force a fast rise time on BKGD. 6. Removes all drive to the BKGD pin so it reverts to high impedance. The host measures the low time of this 128 cycle SYNC response pulse and determines the correct speed for subsequent BDM communications. Typically, the host can determine the correct communication speed MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 301 Chapter 7 Background Debug Module (S12XBDMV2) within a few percent of the actual target speed and the communication protocol can easily tolerate speed errors of several percent. As soon as the SYNC request is detected by the target, any partially received command or bit retrieved is discarded. This is referred to as a soft-reset, equivalent to a time-out in the serial communication. After the SYNC response, the target will consider the next negative edge (issued by the host) as the start of a new BDM command or the start of new SYNC request. Another use of the SYNC command pulse is to abort a pending ACK pulse. The behavior is exactly the same as in a regular SYNC command. Note that one of the possible causes for a command to not be acknowledged by the target is a host-target synchronization problem. In this case, the command may not have been understood by the target and so an ACK response pulse will not be issued. 7.4.10 Instruction Tracing When a TRACE1 command is issued to the BDM in active BDM, the CPU exits the standard BDM firmware and executes a single instruction in the user code. Once this has occurred, the CPU is forced to return to the standard BDM firmware and the BDM is active and ready to receive a new command. If the TRACE1 command is issued again, the next user instruction will be executed. This facilitates stepping or tracing through the user code one instruction at a time. If an interrupt is pending when a TRACE1 command is issued, the interrupt stacking operation occurs but no user instruction is executed. Once back in standard BDM firmware execution, the program counter points to the first instruction in the interrupt service routine. Be aware when tracing through the user code that the execution of the user code is done step by step but all peripherals are free running. Hence possible timing relations between CPU code execution and occurrence of events of other peripherals no longer exist. Do not trace the CPU instruction BGND used for soft breakpoints. Tracing the BGND instruction will result in a return address pointing to BDM firmware address space. When tracing through user code which contains stop or wait instructions the following will happen when the stop or wait instruction is traced: The CPU enters stop or wait mode and the TRACE1 command can not be finished before leaving the low power mode. This is the case because BDM active mode can not be entered after CPU executed the stop instruction. However all BDM hardware commands except the BACKGROUND command are operational after tracing a stop or wait instruction and still being in stop or wait mode. If system stop mode is entered (all bus masters are in stop mode) no BDM command is operational. As soon as stop or wait mode is exited the CPU enters BDM active mode and the saved PC value points to the entry of the corresponding interrupt service routine. In case the handshake feature is enabled the corresponding ACK pulse of the TRACE1 command will be discarded when tracing a stop or wait instruction. Hence there is no ACK pulse when BDM active mode is entered as part of the TRACE1 command after CPU exited from stop or wait mode. All valid commands sent during CPU being in stop or wait mode or after CPU exited from stop or wait mode will have an ACK pulse. The handshake feature becomes disabled only when system stop mode has been reached. Hence MC9S12XE-Family Reference Manual Rev. 1.25 302 Freescale Semiconductor Chapter 7 Background Debug Module (S12XBDMV2) after a system stop mode the handshake feature must be enabled again by sending the ACK_ENABLE command. 7.4.11 Serial Communication Time Out The host initiates a host-to-target serial transmission by generating a falling edge on the BKGD pin. If BKGD is kept low for more than 128 target clock cycles, the target understands that a SYNC command was issued. In this case, the target will keep waiting for a rising edge on BKGD in order to answer the SYNC request pulse. If the rising edge is not detected, the target will keep waiting forever without any time-out limit. Consider now the case where the host returns BKGD to logic one before 128 cycles. This is interpreted as a valid bit transmission, and not as a SYNC request. The target will keep waiting for another falling edge marking the start of a new bit. If, however, a new falling edge is not detected by the target within 512 clock cycles since the last falling edge, a time-out occurs and the current command is discarded without affecting memory or the operating mode of the MCU. This is referred to as a soft-reset. If a read command is issued but the data is not retrieved within 512 serial clock cycles, a soft-reset will occur causing the command to be disregarded. The data is not available for retrieval after the time-out has occurred. This is the expected behavior if the handshake protocol is not enabled. However, consider the behavior where the BDM is running in a frequency much greater than the CPU frequency. In this case, the command could time out before the data is ready to be retrieved. In order to allow the data to be retrieved even with a large clock frequency mismatch (between BDM and CPU) when the hardware handshake protocol is enabled, the time out between a read command and the data retrieval is disabled. Therefore, the host could wait for more then 512 serial clock cycles and still be able to retrieve the data from an issued read command. However, once the handshake pulse (ACK pulse) is issued, the time-out feature is reactivated, meaning that the target will time out after 512 clock cycles. Therefore, the host needs to retrieve the data within a 512 serial clock cycles time frame after the ACK pulse had been issued. After that period, the read command is discarded and the data is no longer available for retrieval. Any negative edge in the BKGD pin after the time-out period is considered to be a new command or a SYNC request. Note that whenever a partially issued command, or partially retrieved data, has occurred the time out in the serial communication is active. This means that if a time frame higher than 512 serial clock cycles is observed between two consecutive negative edges and the command being issued or data being retrieved is not complete, a soft-reset will occur causing the partially received command or data retrieved to be disregarded. The next negative edge in the BKGD pin, after a soft-reset has occurred, is considered by the target as the start of a new BDM command, or the start of a SYNC request pulse. MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 303 Chapter 7 Background Debug Module (S12XBDMV2) MC9S12XE-Family Reference Manual Rev. 1.25 304 Freescale Semiconductor Chapter 8 S12X Debug (S12XDBGV3) Module Table 8-1. Revision History Revision Number Revision Date Sections Affected V03.20 14 Sep 2007 8.3.2.7/8-317 - Clarified reserved State Sequencer encodings. V03.21 23 Oct 2007 8.4.2.2/8-329 8.4.2.4/8-330 - Added single databyte comparison limitation information - Added statement about interrupt vector fetches whilst tagging. V03.22 12 Nov 2007 8.4.5.2/8-334 8.4.5.5/8-341 - Removed LOOP1 tracing restriction NOTE. - Added pin reset effect NOTE. V03.23 13 Nov 2007 General V03.24 04 Jan 2008 8.4.5.3/8-336 V03.25 14 May 2008 General - Updated Revision History Table format. Corrected other paragraph formats. V03.26 12 Sep 2012 General - Added missing full stops. Removed redundant quotation marks. 8.1 Description of Changes - Text readability improved, typo removed. - Corrected bit name. Introduction The S12XDBG module provides an on-chip trace buffer with flexible triggering capability to allow nonintrusive debug of application software. The S12XDBG module is optimized for the S12X 16-bit architecture and allows debugging of CPU12Xand XGATE module operations. Typically the S12XDBG module is used in conjunction with the S12XBDM module, whereby the user configures the S12XDBG module for a debugging session over the BDM interface. Once configured the S12XDBG module is armed and the device leaves BDM Mode returning control to the user program, which is then monitored by the S12XDBG module. Alternatively the S12XDBG module can be configured over a serial interface using SWI routines. 8.1.1 Glossary Table 8-2. Glossary Of Terms Term Definition COF Change Of Flow. Change in the program flow due to a conditional branch, indexed jump or interrupt BDM Background Debug Mode DUG Device User Guide, describing the features of the device into which the DBG is integrated WORD 16-bit data entity MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 305 Chapter 8 S12X Debug (S12XDBGV3) Module Table 8-2. Glossary Of Terms (continued) Term Definition Data Line 64-bit data entity CPU CPU12X module Tag Tags can be attached to XGATE or CPU opcodes as they enter the instruction pipe. If the tagged opcode reaches the execution stage a tag hit occurs. 8.1.2 Overview The comparators monitor the bus activity of the CPU12X and XGATE. When a match occurs the control logic can trigger the state sequencer to a new state. On a transition to the Final State, bus tracing is triggered and/or a breakpoint can be generated. Independent of comparator matches a transition to Final State with associated tracing and breakpoint can be triggered by the external TAGHI and TAGLO signals, or by an XGATE module S/W breakpoint request or by writing to the TRIG control bit. The trace buffer is visible through a 2-byte window in the register address map and can be read out using standard 16-bit word reads. Tracing is disabled when the MCU system is secured. 8.1.3 • • • • • Features Four comparators (A, B, C, and D) — Comparators A and C compare the full address bus and full 16-bit data bus — Comparators A and C feature a data bus mask register — Comparators B and D compare the full address bus only — Each comparator can be configured to monitor CPU12X or XGATE buses — Each comparator features selection of read or write access cycles — Comparators B and D allow selection of byte or word access cycles — Comparisons can be used as triggers for the state sequencer Three comparator modes — Simple address/data comparator match mode — Inside address range mode, Addmin ≤ Address ≤ Addmax — Outside address range match mode, Address < Addmin or Address > Addmax Two types of triggers — Tagged — This triggers just before a specific instruction begins execution — Force — This triggers on the first instruction boundary after a match occurs. The following types of breakpoints — CPU12X breakpoint entering BDM on breakpoint (BDM) — CPU12X breakpoint executing SWI on breakpoint (SWI) — XGATE breakpoint External CPU12X instruction tagging trigger independent of comparators MC9S12XE-Family Reference Manual Rev. 1.25 306 Freescale Semiconductor Chapter 8 S12X Debug (S12XDBGV3) Module • • • XGATE S/W breakpoint request trigger independent of comparators TRIG Immediate software trigger independent of comparators Four trace modes — Normal: change of flow (COF) PC information is stored (see Section 8.4.5.2.1) for change of flow definition. — Loop1: same as Normal but inhibits consecutive duplicate source address entries — Detail: address and data for all cycles except free cycles and opcode fetches are stored — Pure PC: All program counter addresses are stored. 4-stage state sequencer for trace buffer control — Tracing session trigger linked to Final State of state sequencer — Begin, End, and Mid alignment of tracing to trigger • 8.1.4 Modes of Operation The S12XDBG module can be used in all MCU functional modes. During BDM hardware accesses and whilst the BDM module is active, CPU12X monitoring is disabled. Thus breakpoints, comparators, and CPU12X bus tracing are disabled but XGATE bus monitoring accessing the S12XDBG registers, including comparator registers, is still possible. While in active BDM or during hardware BDM accesses, XGATE activity can still be compared, traced and can be used to generate a breakpoint to the XGATE module. When the CPU12X enters active BDM Mode through a BACKGROUND command, with the S12XDBG module armed, the S12XDBG remains armed. The S12XDBG module tracing is disabled if the MCU is secure. However, breakpoints can still be generated if the MCU is secure. Table 8-3. Mode Dependent Restriction Summary BDM Enable BDM Active MCU Secure Comparator Matches Enabled Breakpoints Possible Tagging Possible Tracing Possible x x 1 Yes Yes Yes No 0 0 0 Yes Only SWI Yes Yes 0 1 0 1 0 0 Yes Yes Yes Yes 1 1 0 XGATE only XGATE only XGATE only XGATE only Active BDM not possible when not enabled MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 307 Chapter 8 S12X Debug (S12XDBGV3) Module 8.1.5 Block Diagram TAGS TAGHITS EXTERNAL TAGHI / TAGLO BREAKPOINT REQUESTS XGATE S/W BREAKPOINT REQUEST CPU12X & XGATE XGATE BUS COMPARATOR A COMPARATOR B COMPARATOR C COMPARATOR D MATCH0 COMPARATOR MATCH CONTROL CPU12X BUS BUS INTERFACE SECURE MATCH1 TAG & TRIGGER CONTROL LOGIC TRIGGER STATE STATE SEQUENCER STATE MATCH2 MATCH3 TRACE CONTROL TRIGGER TRACE BUFFER READ TRACE DATA (DBG READ DATA BUS) Figure 8-1. Debug Module Block Diagram 8.2 External Signal Description The S12XDBG sub-module features two external tag input signals. See Device User Guide (DUG) for the mapping of these signals to device pins. These tag pins may be used for the external tagging in emulation modes only. Table 8-4. External System Pins Associated With S12XDBG Pin Name Pin Functions TAGHI (See DUG) TAGHI When instruction tagging is on, tags the high half of the instruction word being read into the instruction queue. TAGLO (See DUG) TAGLO When instruction tagging is on, tags the low half of the instruction word being read into the instruction queue. TAGLO (See DUG) Unconditional Tagging Enable In emulation modes, a low assertion on this pin in the 7th or 8th cycle after the end of reset enables the Unconditional Tagging function. 8.3 8.3.1 Description Memory Map and Registers Module Memory Map A summary of the registers associated with the S12XDBG sub-block is shown in Table 8-2. Detailed descriptions of the registers and bits are given in the subsections that follow. MC9S12XE-Family Reference Manual Rev. 1.25 308 Freescale Semiconductor Chapter 8 S12X Debug (S12XDBGV3) Module Address Name Bit 7 6 0 TRIG 5 4 XGSBPE BDM 0 0 3 2 1 Bit 0 0x0020 DBGC1 R W 0x0021 DBGSR R W 0x0022 DBGTCR R W 0x0023 DBGC2 R W 0 0 0 0 0x0024 DBGTBH R W Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9 Bit 8 0x0025 DBGTBL R W Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0x0026 DBGCNT R W 0 0x0027 DBGSCRX 0 0 0 0 SC3 SC2 SC1 SC0 0x0027 DBGMFR R W R W 0 0 0 0 MC3 MC2 MC1 MC0 NDB TAG BRK RW RWE SRC COMPE SZ TAG BRK RW RWE SRC COMPE Bit 22 21 20 19 18 17 Bit 16 0x00281 0x00282 DBGXCTL R (COMPA/C) W DBGXCTL R (COMPB/D) W ARM TBF EXTF TSOURCE 0 SZE 0 DBGBRK 0 TRANGE COMRV SSF2 SSF1 SSF0 TRCMOD TALIGN CDCM ABCM CNT 0x0029 DBGXAH R W 0x002A DBGXAM R W Bit 15 14 13 12 11 10 9 Bit 8 0x002B DBGXAL R W Bit 7 6 5 4 3 2 1 Bit 0 0x002C DBGXDH R W Bit 15 14 13 12 11 10 9 Bit 8 0x002D DBGXDL R W Bit 7 6 5 4 3 2 1 Bit 0 0x002E DBGXDHM R W Bit 15 14 13 12 11 10 9 Bit 8 1 Bit 0 R Bit 7 6 5 4 3 2 W 1 This represents the contents if the Comparator A or C control register is blended into this address. 2 This represents the contents if the Comparator B or D control register is blended into this address 0x002F DBGXDLM Figure 8-2. Quick Reference to S12XDBG Registers MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 309 Chapter 8 S12X Debug (S12XDBGV3) Module 8.3.2 Register Descriptions This section consists of the S12XDBG control and trace buffer register descriptions in address order. Each comparator has a bank of registers that are visible through an 8-byte window between 0x0028 and 0x002F in the S12XDBG module register address map. When ARM is set in DBGC1, the only bits in the S12XDBG module registers that can be written are ARM, TRIG, and COMRV[1:0]. 8.3.2.1 Debug Control Register 1 (DBGC1) Address: 0x0020 7 R W Reset 6 ARM 0 0 TRIG 0 5 4 XGSBPE BDM 0 0 3 2 1 DBGBRK 0 0 COMRV 0 0 0 Figure 8-3. Debug Control Register (DBGC1) Read: Anytime Write: Bits 7, 1, 0 anytime Bit 6 can be written anytime but always reads back as 0. Bits 5:2 anytime S12XDBG is not armed. NOTE If a write access to DBGC1 with the ARM bit position set occurs simultaneously to a hardware disarm from an internal trigger event, then the ARM bit is cleared due to the hardware disarm. NOTE When disarming the S12XDBG by clearing ARM with software, the contents of bits[5:2] are not affected by the write, since up until the write operation, ARM = 1 preventing these bits from being written. These bits must be cleared using a second write if required. Table 8-5. DBGC1 Field Descriptions Field Description 7 ARM Arm Bit — The ARM bit controls whether the S12XDBG module is armed. This bit can be set and cleared by user software and is automatically cleared on completion of a tracing session, or if a breakpoint is generated with tracing not enabled. On setting this bit the state sequencer enters State1. 0 Debugger disarmed 1 Debugger armed 6 TRIG Immediate Trigger Request Bit — This bit when written to 1 requests an immediate trigger independent of comparator or external tag signal status. When tracing is complete a forced breakpoint may be generated depending upon DBGBRK and BDM bit settings. This bit always reads back a 0. Writing a 0 to this bit has no effect. If TSOURCE are clear no tracing is carried out. If tracing has already commenced using BEGIN- or MID trigger alignment, it continues until the end of the tracing session as defined by the TALIGN bit settings, thus TRIG has no affect. In secure mode tracing is disabled and writing to this bit has no effect. 0 Do not trigger until the state sequencer enters the Final State. 1 Trigger immediately . MC9S12XE-Family Reference Manual Rev. 1.25 310 Freescale Semiconductor Chapter 8 S12X Debug (S12XDBGV3) Module Table 8-5. DBGC1 Field Descriptions (continued) Field 5 XGSBPE Description XGATE S/W Breakpoint Enable — The XGSBPE bit controls whether an XGATE S/W breakpoint request is passed to the CPU12X. The XGATE S/W breakpoint request is handled by the S12XDBG module, which can request an CPU12X breakpoint depending on the state of this bit. 0 XGATE S/W breakpoint request is disabled 1 XGATE S/W breakpoint request is enabled 4 BDM Background Debug Mode Enable — This bit determines if an S12X breakpoint causes the system to enter Background Debug Mode (BDM) or initiate a Software Interrupt (SWI). If this bit is set but the BDM is not enabled by the ENBDM bit in the BDM module, then breakpoints default to SWI. 0 Breakpoint to Software Interrupt if BDM inactive. Otherwise no breakpoint. 1 Breakpoint to BDM, if BDM enabled. Otherwise breakpoint to SWI 3–2 DBGBRK S12XDBG Breakpoint Enable Bits — The DBGBRK bits control whether the debugger will request a breakpoint to either CPU12X or XGATE or both upon reaching the state sequencer Final State. If tracing is enabled, the breakpoint is generated on completion of the tracing session. If tracing is not enabled, the breakpoint is generated immediately. Please refer to Section 8.4.7 for further details. XGATE software breakpoints are independent of the DBGBRK bits. XGATE software breakpoints force a breakpoint to the CPU12X independent of the DBGBRK bit field configuration. See Table 8-6. 1–0 COMRV Comparator Register Visibility Bits — These bits determine which bank of comparator register is visible in the 8-byte window of the S12XDBG module address map, located between 0x0028 to 0x002F. Furthermore these bits determine which register is visible at the address 0x0027. See Table 8-7. Table 8-6. DBGBRK Encoding DBGBRK Resource Halted by Breakpoint 00 No breakpoint generated 01 XGATE breakpoint generated 10 CPU12X breakpoint generated 11 Breakpoints generated for CPU12X and XGATE Table 8-7. COMRV Encoding COMRV Visible Comparator Visible Register at 0x0027 00 Comparator A DBGSCR1 01 Comparator B DBGSCR2 10 Comparator C DBGSCR3 11 Comparator D DBGMFR MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 311 Chapter 8 S12X Debug (S12XDBGV3) Module 8.3.2.2 Debug Status Register (DBGSR) Address: 0x0021 R 7 6 5 4 3 2 1 0 TBF EXTF 0 0 0 SSF2 SSF1 SSF0 — 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 W Reset POR = Unimplemented or Reserved Figure 8-4. Debug Status Register (DBGSR) Read: Anytime Write: Never Table 8-8. DBGSR Field Descriptions Field Description 7 TBF Trace Buffer Full — The TBF bit indicates that the trace buffer has stored 64 or more lines of data since it was last armed. If this bit is set, then all 64 lines will be valid data, regardless of the value of DBGCNT bits CNT[6:0]. The TBF bit is cleared when ARM in DBGC1 is written to a one. The TBF is cleared by the power on reset initialization. Other system generated resets have no affect on this bit. 6 EXTF External Tag Hit Flag — The EXTF bit indicates if a tag hit condition from an external TAGHI/TAGLO tag was met since arming. This bit is cleared when ARM in DBGC1 is written to a one. 0 External tag hit has not occurred 1 External tag hit has occurred 2–0 SSF[2:0] State Sequencer Flag Bits — The SSF bits indicate in which state the State Sequencer is currently in. During a debug session on each transition to a new state these bits are updated. If the debug session is ended by software clearing the ARM bit, then these bits retain their value to reflect the last state of the state sequencer before disarming. If a debug session is ended by an internal trigger, then the state sequencer returns to state0 and these bits are cleared to indicate that state0 was entered during the session. On arming the module the state sequencer enters state1 and these bits are forced to SSF[2:0] = 001. See Table 8-9. Table 8-9. SSF[2:0] — State Sequence Flag Bit Encoding SSF[2:0] Current State 000 State0 (disarmed) 001 State1 010 State2 011 State3 100 Final State 101,110,111 Reserved MC9S12XE-Family Reference Manual Rev. 1.25 312 Freescale Semiconductor Chapter 8 S12X Debug (S12XDBGV3) Module 8.3.2.3 Debug Trace Control Register (DBGTCR) Address: 0x0022 7 6 R TSOURCE W Reset 5 0 4 3 TRANGE 0 0 2 1 TRCMOD 0 0 0 TALIGN 0 0 0 Figure 8-5. Debug Trace Control Register (DBGTCR) Read: Anytime Write: Bits 7:6 only when S12XDBG is neither secure nor armed. Bits 5:0 anytime the module is disarmed. Table 8-10. DBGTCR Field Descriptions Field 7–6 TSOURCE Description Trace Source Control Bits — The TSOURCE bits select the data source for the tracing session. If the MCU system is secured, these bits cannot be set and tracing is inhibited. See Table 8-11. 5–4 TRANGE Trace Range Bits — The TRANGE bits allow filtering of trace information from a selected address range when tracing from the CPU12X in Detail Mode. The XGATE tracing range cannot be narrowed using these bits. To use a comparator for range filtering, the corresponding COMPE and SRC bits must remain cleared. If the COMPE bit is not clear then the comparator will also be used to generate state sequence triggers. If the corresponding SRC bit is set the comparator is mapped to the XGATE buses, the TRANGE bits have no effect on the valid address range, memory accesses within the whole memory map are traced. See Table 8-12. 3–2 TRCMOD Trace Mode Bits — See Section 8.4.5.2 for detailed Trace Mode descriptions. In Normal Mode, change of flow information is stored. In Loop1 Mode, change of flow information is stored but redundant entries into trace memory are inhibited. In Detail Mode, address and data for all memory and register accesses is stored. See Table 8-13. 1–0 TALIGN Trigger Align Bits — These bits control whether the trigger is aligned to the beginning, end or the middle of a tracing session. See Table 8-14. Table 8-11. TSOURCE — Trace Source Bit Encoding TSOURCE Tracing Source 00 No tracing requested 01 CPU12X (1) 10 XGATE 1,(2) Both CPU12X and XGATE 11 1. No range limitations are allowed. Thus tracing operates as if TRANGE = 00. 2. No Detail Mode tracing supported. If TRCMOD = 10, no information is stored. MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 313 Chapter 8 S12X Debug (S12XDBGV3) Module Table 8-12. TRANGE Trace Range Encoding TRANGE Tracing Range 00 Trace from all addresses (No filter) 01 Trace only in address range from $00000 to Comparator D 10 Trace only in address range from Comparator C to $7FFFFF 11 Trace only in range from Comparator C to Comparator D Table 8-13. TRCMOD Trace Mode Bit Encoding TRCMOD Description 00 Normal 01 Loop1 10 Detail 11 Pure PC Table 8-14. TALIGN Trace Alignment Encoding 8.3.2.4 TALIGN Description 00 Trigger at end of stored data 01 Trigger before storing data 10 Trace buffer entries before and after trigger 11 Reserved Debug Control Register2 (DBGC2) Address: 0x0023 R 7 6 5 4 0 0 0 0 0 0 0 3 0 1 CDCM W Reset 2 0 0 ABCM 0 0 0 = Unimplemented or Reserved Figure 8-6. Debug Control Register2 (DBGC2) Read: Anytime Write: Anytime the module is disarmed. This register configures the comparators for range matching. Table 8-15. DBGC2 Field Descriptions Field Description 3–2 CDCM[1:0] C and D Comparator Match Control — These bits determine the C and D comparator match mapping as described in Table 8-16. 1–0 ABCM[1:0] A and B Comparator Match Control — These bits determine the A and B comparator match mapping as described in Table 8-17. MC9S12XE-Family Reference Manual Rev. 1.25 314 Freescale Semiconductor Chapter 8 S12X Debug (S12XDBGV3) Module Table 8-16. CDCM Encoding CDCM Description 00 Match2 mapped to comparator C match....... Match3 mapped to comparator D match. 01 Match2 mapped to comparator C/D inside range....... Match3 disabled. 10 Match2 mapped to comparator C/D outside range....... Match3 disabled. 11 Reserved(1) 1. Currently defaults to Match2 mapped to comparator C : Match3 mapped to comparator D Table 8-17. ABCM Encoding ABCM Description 00 Match0 mapped to comparator A match....... Match1 mapped to comparator B match. 01 Match 0 mapped to comparator A/B inside range....... Match1 disabled. 10 Match 0 mapped to comparator A/B outside range....... Match1 disabled. 11 Reserved(1) 1. Currently defaults to Match0 mapped to comparator A : Match1 mapped to comparator B 8.3.2.5 Debug Trace Buffer Register (DBGTBH:DBGTBL) Address: 0x0024, 0x0025 15 R W 14 13 12 11 10 9 Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9 8 7 6 5 4 3 2 1 0 Bit 8 Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 POR X X X X X X X X X X X X X X X X Other Resets — — — — — — — — — — — — — — — — Figure 8-7. Debug Trace Buffer Register (DBGTB) Read: Only when unlocked AND not secured AND not armed AND with a TSOURCE bit set. Write: Aligned word writes when disarmed unlock the trace buffer for reading but do not affect trace buffer contents. Table 8-18. DBGTB Field Descriptions Field Description 15–0 Bit[15:0] Trace Buffer Data Bits — The Trace Buffer Register is a window through which the 64-bit wide data lines of the Trace Buffer may be read 16 bits at a time. Each valid read of DBGTB increments an internal trace buffer pointer which points to the next address to be read. When the ARM bit is written to 1 the trace buffer is locked to prevent reading. The trace buffer can only be unlocked for reading by writing to DBGTB with an aligned word write when the module is disarmed. The DBGTB register can be read only as an aligned word, any byte reads or misaligned access of these registers will return 0 and will not cause the trace buffer pointer to increment to the next trace buffer address. The same is true for word reads while the debugger is armed. The POR state is undefined Other resets do not affect the trace buffer contents. . MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 315 Chapter 8 S12X Debug (S12XDBGV3) Module 8.3.2.6 Debug Count Register (DBGCNT) Address: 0x0026 7 R 6 5 4 0 3 2 1 0 — 0 — 0 — 0 CNT W Reset POR 0 0 — 0 — 0 — 0 — 0 = Unimplemented or Reserved Figure 8-8. Debug Count Register (DBGCNT) Read: Anytime Write: Never Table 8-19. DBGCNT Field Descriptions Field Description 6–0 CNT[6:0] Count Value — The CNT bits [6:0] indicate the number of valid data 64-bit data lines stored in the Trace Buffer. Table 8-20 shows the correlation between the CNT bits and the number of valid data lines in the Trace Buffer. When the CNT rolls over to zero, the TBF bit in DBGSR is set and incrementing of CNT will continue in endtrigger or mid-trigger mode. The DBGCNT register is cleared when ARM in DBGC1 is written to a one. The DBGCNT register is cleared by power-on-reset initialization but is not cleared by other system resets. Thus should a reset occur during a debug session, the DBGCNT register still indicates after the reset, the number of valid trace buffer entries stored before the reset occurred. The DBGCNT register is not decremented when reading from the trace buffer. Table 8-20. CNT Decoding Table TBF (DBGSR) CNT[6:0] Description 0 0000000 No data valid 0 0000001 32 bits of one line valid(1) 0 0000010 0000100 0000110 .. 1111100 1 line valid 2 lines valid 3 lines valid .. 62 lines valid 0 1111110 63 lines valid 1 0000000 64 lines valid; if using Begin trigger alignment, ARM bit will be cleared and the tracing session ends. 64 lines valid, 0000010 oldest data has been overwritten by most recent data .. .. 1111110 1. This applies to Normal/Loop1/PurePC Modes when tracing from either CPU12X or XGATE only. 1 MC9S12XE-Family Reference Manual Rev. 1.25 316 Freescale Semiconductor Chapter 8 S12X Debug (S12XDBGV3) Module 8.3.2.7 Debug State Control Registers There is a dedicated control register for each of the state sequencer states 1 to 3 that determines if transitions from that state are allowed, depending upon comparator matches or tag hits, and defines the next state for the state sequencer following a match. The three debug state control registers are located at the same address in the register address map (0x0027). Each register can be accessed using the COMRV bits in DBGC1 to blend in the required register. The COMRV = 11 value blends in the match flag register (DBGMFR). Table 8-21. State Control Register Access Encoding 8.3.2.7.1 COMRV Visible State Control Register 00 DBGSCR1 01 DBGSCR2 10 DBGSCR3 11 DBGMFR Debug State Control Register 1 (DBGSCR1) Address: 0x0027 R 7 6 5 4 0 0 0 0 0 0 0 W Reset 0 3 2 1 0 SC3 SC2 SC1 SC0 0 0 0 0 = Unimplemented or Reserved Figure 8-9. Debug State Control Register 1 (DBGSCR1) Read: If COMRV[1:0] = 00 Write: If COMRV[1:0] = 00 and S12XDBG is not armed. This register is visible at 0x0027 only with COMRV[1:0] = 00. The state control register 1 selects the targeted next state whilst in State1. The matches refer to the match channels of the comparator match control logic as depicted in Figure 8-1 and described in Section 8.3.2.8.1. Comparators must be enabled by setting the comparator enable bit in the associated DBGXCTL control register. Table 8-22. DBGSCR1 Field Descriptions Field 3–0 SC[3:0] Description These bits select the targeted next state whilst in State1, based upon the match event. Table 8-23. State1 Sequencer Next State Selection SC[3:0] 0000 0001 0010 Description Any match triggers to state2 Any match triggers to state3 Any match triggers to Final State MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 317 Chapter 8 S12X Debug (S12XDBGV3) Module Table 8-23. State1 Sequencer Next State Selection (continued) SC[3:0] 0011 0100 0101 0110 0111 1000 1001 1010 1011 1100 1101 1110 1111 Description Match2 triggers to State2....... Other matches have no effect Match2 triggers to State3....... Other matches have no effect Match2 triggers to Final State....... Other matches have no effect Match0 triggers to State2....... Match1 triggers to State3....... Other matches have no effect Match1 triggers to State3....... Match0 triggers Final State....... Other matches have no effect Match0 triggers to State2....... Match2 triggers to State3....... Other matches have no effect Match2 triggers to State3....... Match0 triggers Final State....... Other matches have no effect Match1 triggers to State2....... Match3 triggers to State3....... Other matches have no effect Match3 triggers to State3....... Match1 triggers to Final State....... Other matches have no effect Match3 has no effect....... All other matches (M0,M1,M2) trigger to State2 Reserved. (No match triggers state sequencer transition) Reserved. (No match triggers state sequencer transition) Reserved. (No match triggers state sequencer transition) The trigger priorities described in Table 8-42 dictate that in the case of simultaneous matches, the match on the lower channel number (0,1,2,3) has priority. The SC[3:0] encoding ensures that a match leading to final state has priority over all other matches. 8.3.2.7.2 Debug State Control Register 2 (DBGSCR2) Address: 0x0027 R 7 6 5 4 0 0 0 0 0 0 0 0 W Reset 3 2 1 0 SC3 SC2 SC1 SC0 0 0 0 0 = Unimplemented or Reserved Figure 8-10. Debug State Control Register 2 (DBGSCR2) Read: If COMRV[1:0] = 01 Write: If COMRV[1:0] = 01 and S12XDBG is not armed. This register is visible at 0x0027 only with COMRV[1:0] = 01. The state control register 2 selects the targeted next state whilst in State2. The matches refer to the match channels of the comparator match control logic as depicted in Figure 8-1 and described in Section 8.3.2.8.1. Comparators must be enabled by setting the comparator enable bit in the associated DBGXCTL control register. Table 8-24. DBGSCR2 Field Descriptions Field 3–0 SC[3:0] Description These bits select the targeted next state whilst in State2, based upon the match event. Table 8-25. State2 —Sequencer Next State Selection SC[3:0] 0000 Description Any match triggers to state1 MC9S12XE-Family Reference Manual Rev. 1.25 318 Freescale Semiconductor Chapter 8 S12X Debug (S12XDBGV3) Module Table 8-25. State2 —Sequencer Next State Selection (continued) SC[3:0] 0001 0010 0011 0100 0101 0110 0111 1000 1001 1010 1011 1100 1101 1110 1111 Description Any match triggers to state3 Any match triggers to Final State Match3 triggers to State1....... Other matches have no effect Match3 triggers to State3....... Other matches have no effect Match3 triggers to Final State....... Other matches have no effect Match0 triggers to State1....... Match1 triggers to State3....... Other matches have no effect Match1 triggers to State3....... Match0 triggers Final State....... Other matches have no effect Match0 triggers to State1....... Match2 triggers to State3....... Other matches have no effect Match2 triggers to State3....... Match0 triggers Final State....... Other matches have no effect Match1 triggers to State1....... Match3 triggers to State3....... Other matches have no effect Match3 triggers to State3....... Match1 triggers Final State....... Other matches have no effect Match2 triggers to State1..... Match3 trigger to Final State Match2 has no affect, all other matches (M0,M1,M3) trigger to Final State Reserved. (No match triggers state sequencer transition) Reserved. (No match triggers state sequencer transition) The trigger priorities described in Table 8-42 dictate that in the case of simultaneous matches, the match on the lower channel number (0,1,2,3) has priority. The SC[3:0] encoding ensures that a match leading to final state has priority over all other matches. 8.3.2.7.3 Debug State Control Register 3 (DBGSCR3) Address: 0x0027 R 7 6 5 4 0 0 0 0 0 0 0 W Reset 0 3 2 1 0 SC3 SC2 SC1 SC0 0 0 0 0 = Unimplemented or Reserved Figure 8-11. Debug State Control Register 3 (DBGSCR3) Read: If COMRV[1:0] = 10 Write: If COMRV[1:0] = 10 and S12XDBG is not armed. This register is visible at 0x0027 only with COMRV[1:0] = 10. The state control register three selects the targeted next state whilst in State3. The matches refer to the match channels of the comparator match control logic as depicted in Figure 8-1 and described in Section 8.3.2.8.1. Comparators must be enabled by setting the comparator enable bit in the associated DBGXCTL control register. Table 8-26. DBGSCR3 Field Descriptions Field 3–0 SC[3:0] Description These bits select the targeted next state whilst in State3, based upon the match event. MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 319 Chapter 8 S12X Debug (S12XDBGV3) Module Table 8-27. State3 — Sequencer Next State Selection SC[3:0] 0000 0001 0010 0011 0100 0101 0110 0111 1000 1001 1010 1011 1100 1101 1110 1111 Description Any match triggers to state1 Any match triggers to state2 Any match triggers to Final State Match0 triggers to State1....... Other matches have no effect Match0 triggers to State2....... Other matches have no effect Match0 triggers to Final State.......Match1 triggers to State1...Other matches have no effect Match1 triggers to State1....... Other matches have no effect Match1 triggers to State2....... Other matches have no effect Match1 triggers to Final State....... Other matches have no effect Match2 triggers to State2....... Match0 triggers to Final State....... Other matches have no effect Match1 triggers to State1....... Match3 triggers to State2....... Other matches have no effect Match3 triggers to State2....... Match1 triggers to Final State....... Other matches have no effect Match2 triggers to Final State....... Other matches have no effect Match3 triggers to Final State....... Other matches have no effect Reserved. (No match triggers state sequencer transition) Reserved. (No match triggers state sequencer transition) The trigger priorities described in Table 8-42 dictate that in the case of simultaneous matches, the match on the lower channel number (0,1,2,3) has priority. The SC[3:0] encoding ensures that a match leading to final state has priority over all other matches. 8.3.2.7.4 Debug Match Flag Register (DBGMFR) Address: 0x0027 R 7 6 5 4 3 2 1 0 0 0 0 0 MC3 MC2 MC1 MC0 0 0 0 0 0 0 0 W Reset 0 = Unimplemented or Reserved Figure 8-12. Debug Match Flag Register (DBGMFR) Read: If COMRV[1:0] = 11 Write: Never DBGMFR is visible at 0x0027 only with COMRV[1:0] = 11. It features four flag bits each mapped directly to a channel. Should a match occur on the channel during the debug session, then the corresponding flag is set and remains set until the next time the module is armed by writing to the ARM bit. Thus the contents are retained after a debug session for evaluation purposes. These flags cannot be cleared by software, they are cleared only when arming the module. A set flag does not inhibit the setting of other flags. Once a flag is set, further triggers on the same channel have no affect. MC9S12XE-Family Reference Manual Rev. 1.25 320 Freescale Semiconductor Chapter 8 S12X Debug (S12XDBGV3) Module 8.3.2.8 Comparator Register Descriptions Each comparator has a bank of registers that are visible through an 8-byte window in the S12XDBG module register address map. Comparators A and C consist of 8 register bytes (3 address bus compare registers, two data bus compare registers, two data bus mask registers and a control register). Comparators B and D consist of four register bytes (three address bus compare registers and a control register). Each set of comparator registers is accessible in the same 8-byte window of the register address map and can be accessed using the COMRV bits in the DBGC1 register. If the Comparators B or D are accessed through the 8-byte window, then only the address and control bytes are visible, the 4 bytes associated with data bus and data bus masking read as zero and cannot be written. Furthermore the control registers for comparators B and D differ from those of comparators A and C. Table 8-28. Comparator Register Layout 0x0028 CONTROL Read/Write Comparators A,B,C,D 0x0029 ADDRESS HIGH Read/Write Comparators A,B,C,D 0x002A ADDRESS MEDIUM Read/Write Comparators A,B,C,D 0x002B ADDRESS LOW Read/Write Comparators A,B,C,D 0x002C DATA HIGH COMPARATOR Read/Write Comparator A and C only 0x002D DATA LOW COMPARATOR Read/Write Comparator A and C only 0x002E DATA HIGH MASK Read/Write Comparator A and C only 0x002F DATA LOW MASK Read/Write Comparator A and C only 8.3.2.8.1 Debug Comparator Control Register (DBGXCTL) The contents of this register bits 7 and 6 differ depending upon which comparator registers are visible in the 8-byte window of the DBG module register address map. Address: 0x0028 7 R 0 W Reset 0 6 5 4 3 2 1 0 NDB TAG BRK RW RWE SRC COMPE 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 8-13. Debug Comparator Control Register (Comparators A and C) Address: 0x0028 R W Reset 7 6 5 4 3 2 1 0 SZE SZ TAG BRK RW RWE SRC COMPE 0 0 0 0 0 0 0 0 Figure 8-14. Debug Comparator Control Register (Comparators B and D) Read: Anytime. See Table 8-29 for visible register encoding. MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 321 Chapter 8 S12X Debug (S12XDBGV3) Module Write: If DBG not armed. See Table 8-29 for visible register encoding. The DBGC1_COMRV bits determine which comparator control, address, data and datamask registers are visible in the 8-byte window from 0x0028 to 0x002F as shown in Section Table 8-29. Table 8-29. Comparator Address Register Visibility COMRV Visible Comparator 00 DBGACTL, DBGAAH ,DBGAAM, DBGAAL, DBGADH, DBGADL, DBGADHM, DBGADLM 01 DBGBCTL, DBGBAH, DBGBAM, DBGBAL 10 DBGCCTL, DBGCAH, DBGCAM, DBGCAL, DBGCDH, DBGCDL, DBGCDHM, DBGCDLM 11 DBGDCTL, DBGDAH, DBGDAM, DBGDAL Table 8-30. DBGXCTL Field Descriptions Field Description 7 SZE (Comparators B and D) Size Comparator Enable Bit — The SZE bit controls whether access size comparison is enabled for the associated comparator. This bit is ignored if the TAG bit in the same register is set. 0 Word/Byte access size is not used in comparison 1 Word/Byte access size is used in comparison 6 NDB (Comparators A and C Not Data Bus — The NDB bit controls whether the match occurs when the data bus matches the comparator register value or when the data bus differs from the register value. Furthermore data bus bits can be individually masked using the comparator data mask registers. This bit is only available for comparators A and C. This bit is ignored if the TAG bit in the same register is set. This bit position has an SZ functionality for comparators B and D. 0 Match on data bus equivalence to comparator register contents 1 Match on data bus difference to comparator register contents 6 SZ (Comparators B and D) Size Comparator Value Bit — The SZ bit selects either word or byte access size in comparison for the associated comparator. This bit is ignored if the SZE bit is cleared or if the TAG bit in the same register is set. This bit position has NDB functionality for comparators A and C 0 Word access size will be compared 1 Byte access size will be compared 5 TAG Tag Select — This bit controls whether the comparator match will cause a trigger or tag the opcode at the matched address. Tagged opcodes trigger only if they reach the execution stage of the instruction queue. 0 Trigger immediately on match 1 On match, tag the opcode. If the opcode is about to be executed a trigger is generated 4 BRK Break — This bit controls whether a channel match terminates a debug session immediately, independent of state sequencer state. To generate an immediate breakpoint the module breakpoints must be enabled using DBGBRK. 0 The debug session termination is dependent upon the state sequencer and trigger conditions. 1 A match on this channel terminates the debug session immediately; breakpoints if active are generated, tracing, if active, is terminated and the module disarmed. 3 RW Read/Write Comparator Value Bit — The RW bit controls whether read or write is used in compare for the associated comparator . The RW bit is not used if RWE = 0. 0 Write cycle will be matched 1 Read cycle will be matched 2 RWE Read/Write Enable Bit — The RWE bit controls whether read or write comparison is enabled for the associated comparator. This bit is not used for tagged operations. 0 Read/Write is not used in comparison 1 Read/Write is used in comparison MC9S12XE-Family Reference Manual Rev. 1.25 322 Freescale Semiconductor Chapter 8 S12X Debug (S12XDBGV3) Module Table 8-30. DBGXCTL Field Descriptions (continued) Field Description 1 SRC Determines mapping of comparator to CPU12X or XGATE 0 The comparator is mapped to CPU12X buses 1 The comparator is mapped to XGATE address and data buses 0 COMPE Determines if comparator is enabled 0 The comparator is not enabled 1 The comparator is enabled for state sequence triggers or tag generation Table 8-31 shows the effect for RWE and RW on the comparison conditions. These bits are not useful for tagged operations since the trigger occurs based on the tagged opcode reaching the execution stage of the instruction queue. Thus these bits are ignored if tagged triggering is selected. Table 8-31. Read or Write Comparison Logic Table 8.3.2.8.2 RWE Bit RW Bit RW Signal Comment 0 x 0 RW not used in comparison 0 x 1 RW not used in comparison 1 0 0 Write 1 0 1 No match 1 1 0 No match 1 1 1 Read Debug Comparator Address High Register (DBGXAH) Address: 0x0029 7 R 0 W Reset 0 6 5 4 3 2 1 0 Bit 22 Bit 21 Bit 20 Bit 19 Bit 18 Bit 17 Bit 16 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 8-15. Debug Comparator Address High Register (DBGXAH) Read: Anytime. See Table 8-29 for visible register encoding. Write: If DBG not armed. See Table 8-29 for visible register encoding. Table 8-32. DBGXAH Field Descriptions Field Description 6–0 Bit[22:16] Comparator Address High Compare Bits — The Comparator address high compare bits control whether the selected comparator will compare the address bus bits [22:16] to a logic one or logic zero. This register byte is ignored for XGATE compares. 0 Compare corresponding address bit to a logic zero 1 Compare corresponding address bit to a logic one MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 323 Chapter 8 S12X Debug (S12XDBGV3) Module 8.3.2.8.3 Debug Comparator Address Mid Register (DBGXAM) Address: 0x002A R W Reset 7 6 5 4 3 2 1 0 Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9 Bit 8 0 0 0 0 0 0 0 0 Figure 8-16. Debug Comparator Address Mid Register (DBGXAM) Read: Anytime. See Table 8-29 for visible register encoding. Write: If DBG not armed. See Table 8-29 for visible register encoding. Table 8-33. DBGXAM Field Descriptions Field 7–0 Bit[15:8] Description Comparator Address Mid Compare Bits— The Comparator address mid compare bits control whether the selected comparator will compare the address bus bits [15:8] to a logic one or logic zero. 0 Compare corresponding address bit to a logic zero 1 Compare corresponding address bit to a logic one 8.3.2.8.4 Debug Comparator Address Low Register (DBGXAL) Address: 0x002B R W Reset 7 6 5 4 3 2 1 0 Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0 0 0 0 0 0 0 0 Figure 8-17. Debug Comparator Address Low Register (DBGXAL) Read: Anytime. See Table 8-29 for visible register encoding. Write: If DBG not armed. See Table 8-29 for visible register encoding. Table 8-34. DBGXAL Field Descriptions Field 7–0 Bits[7:0] Description Comparator Address Low Compare Bits — The Comparator address low compare bits control whether the selected comparator will compare the address bus bits [7:0] to a logic one or logic zero. 0 Compare corresponding address bit to a logic zero 1 Compare corresponding address bit to a logic one MC9S12XE-Family Reference Manual Rev. 1.25 324 Freescale Semiconductor Chapter 8 S12X Debug (S12XDBGV3) Module 8.3.2.8.5 Debug Comparator Data High Register (DBGXDH) Address: 0x002C R W Reset 7 6 5 4 3 2 1 0 Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9 Bit 8 0 0 0 0 0 0 0 0 Figure 8-18. Debug Comparator Data High Register (DBGXDH) Read: Anytime. See Table 8-29 for visible register encoding. Write: If DBG not armed. See Table 8-29 for visible register encoding. Table 8-35. DBGXAH Field Descriptions Field Description 7–0 Bits[15:8] Comparator Data High Compare Bits — The Comparator data high compare bits control whether the selected comparator compares the data bus bits [15:8] to a logic one or logic zero. The comparator data compare bits are only used in comparison if the corresponding data mask bit is logic 1. This register is available only for comparators A and C. 0 Compare corresponding data bit to a logic zero 1 Compare corresponding data bit to a logic one 8.3.2.8.6 Debug Comparator Data Low Register (DBGXDL) Address: 0x002D R W Reset 7 6 5 4 3 2 1 0 Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0 0 0 0 0 0 0 0 Figure 8-19. Debug Comparator Data Low Register (DBGXDL) Read: Anytime. See Table 8-29 for visible register encoding. Write: If DBG not armed. See Table 8-29 for visible register encoding. Table 8-36. DBGXDL Field Descriptions Field Description 7–0 Bits[7:0] Comparator Data Low Compare Bits — The Comparator data low compare bits control whether the selected comparator compares the data bus bits [7:0] to a logic one or logic zero. The comparator data compare bits are only used in comparison if the corresponding data mask bit is logic 1. This register is available only for comparators A and C. 0 Compare corresponding data bit to a logic zero 1 Compare corresponding data bit to a logic one MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 325 Chapter 8 S12X Debug (S12XDBGV3) Module 8.3.2.8.7 Debug Comparator Data High Mask Register (DBGXDHM) Address: 0x002E R W Reset 7 6 5 4 3 2 1 0 Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9 Bit 8 0 0 0 0 0 0 0 0 Figure 8-20. Debug Comparator Data High Mask Register (DBGXDHM) Read: Anytime. See Table 8-29 for visible register encoding. Write: If DBG not armed. See Table 8-29 for visible register encoding. Table 8-37. DBGXDHM Field Descriptions Field Description 7–0 Bits[15:8] Comparator Data High Mask Bits — The Comparator data high mask bits control whether the selected comparator compares the data bus bits [15:8] to the corresponding comparator data compare bits. This register is available only for comparators A and C. 0 Do not compare corresponding data bit 1 Compare corresponding data bit 8.3.2.8.8 Debug Comparator Data Low Mask Register (DBGXDLM) Address: 0x002F R W Reset 7 6 5 4 3 2 1 0 Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0 0 0 0 0 0 0 0 Figure 8-21. Debug Comparator Data Low Mask Register (DBGXDLM) Read: Anytime. See Table 8-29 for visible register encoding. Write: If DBG not armed. See Table 8-29 for visible register encoding. Table 8-38. DBGXDLM Field Descriptions Field Description 7–0 Bits[7:0] Comparator Data Low Mask Bits — The Comparator data low mask bits control whether the selected comparator compares the data bus bits [7:0] to the corresponding comparator data compare bits. This register is available only for comparators A and C. 0 Do not compare corresponding data bit 1 Compare corresponding data bit 8.4 Functional Description This section provides a complete functional description of the S12XDBG module. If the part is in secure mode, the S12XDBG module can generate breakpoints but tracing is not possible. MC9S12XE-Family Reference Manual Rev. 1.25 326 Freescale Semiconductor Chapter 8 S12X Debug (S12XDBGV3) Module 8.4.1 S12XDBG Operation Arming the S12XDBG module by setting ARM in DBGC1 allows triggering, and storing of data in the trace buffer and can be used to cause breakpoints to the CPU12X or the XGATE module. The DBG module is made up of four main blocks, the comparators, control logic, the state sequencer, and the trace buffer. The comparators monitor the bus activity of the CPU12X and XGATE. Comparators can be configured to monitor address and databus. Comparators can also be configured to mask out individual data bus bits during a compare and to use R/W and word/byte access qualification in the comparison. When a match with a comparator register value occurs the associated control logic can trigger the state sequencer to another state (see Figure 8-22). Either forced or tagged triggers are possible. Using a forced trigger, the trigger is generated immediately on a comparator match. Using a tagged trigger, at a comparator match, the instruction opcode is tagged and only if the instruction reaches the execution stage of the instruction queue is a trigger generated. In the case of a transition to Final State, bus tracing is triggered and/or a breakpoint can be generated. Tracing of both CPU12X and/or XGATE bus activity is possible. Independent of the state sequencer, a breakpoint can be triggered by the external TAGHI / TAGLO signals or by an XGATE S/W breakpoint request or by writing to the TRIG bit in the DBGC1 control register. The trace buffer is visible through a 2-byte window in the register address map and can be read out using standard 16-bit word reads. 8.4.2 Comparator Modes The S12XDBG contains four comparators, A, B, C, and D. Each comparator can be configured to monitor CPU12X or XGATE buses. Each comparator compares the selected address bus with the address stored in DBGXAH, DBGXAM, and DBGXAL. Furthermore, comparators A and C also compare the data buses to the data stored in DBGXDH, DBGXDL and allow masking of individual data bus bits. S12X comparator matches are disabled in BDM and during BDM accesses. The comparator match control logic configures comparators to monitor the buses for an exact address or an address range. The comparator configuration is controlled by the control register contents and the range control by the DBGC2 contents. On a match a trigger can initiate a transition to another state sequencer state (see Section 8.4.3”). The comparator control register also allows the type of access to be included in the comparison through the use of the RWE, RW, SZE, and SZ bits. The RWE bit controls whether read or write comparison is enabled for the associated comparator and the RW bit selects either a read or write access for a valid match. Similarly the SZE and SZ bits allows the size of access (word or byte) to be considered in the compare. Only comparators B and D feature SZE and SZ. The TAG bit in each comparator control register is used to determine the triggering condition. By setting TAG, the comparator will qualify a match with the output of opcode tracking logic and a trigger occurs before the tagged instruction executes (tagged-type trigger). Whilst tagging, the RW, RWE, SZE, and SZ bits are ignored and the comparator register must be loaded with the exact opcode address. If the TAG bit is clear (forced type trigger) a comparator match is generated when the selected address appears on the system address bus. If the selected address is an opcode address, the match is generated MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 327 Chapter 8 S12X Debug (S12XDBGV3) Module when the opcode is fetched from the memory. This precedes the instruction execution by an indefinite number of cycles due to instruction pipe lining. For a comparator match of an opcode at an odd address when TAG = 0, the corresponding even address must be contained in the comparator register. Thus for an opcode at odd address (n), the comparator register must contain address (n–1). Once a successful comparator match has occurred, the condition that caused the original match is not verified again on subsequent matches. Thus if a particular data value is verified at a given address, this address may not still contain that data value when a subsequent match occurs. Comparators C and D can also be used to select an address range to trace from. This is determined by the TRANGE bits in the DBGTCR register. The TRANGE encoding is shown in Table 8-12. If the TRANGE bits select a range definition using comparator D, then comparator D is configured for trace range definition and cannot be used for address bus comparisons. Similarly if the TRANGE bits select a range definition using comparator C, then comparator C is configured for trace range definition and cannot be used for address bus comparisons. Match[0, 1, 2, 3] map directly to Comparators[A, B, C, D] respectively, except in range modes (see Section 8.3.2.4). Comparator priority rules are described in the trigger priority section (Section 8.4.3.6). 8.4.2.1 Exact Address Comparator Match (Comparators A and C) With range comparisons disabled, the match condition is an exact equivalence of address/data bus with the value stored in the comparator address/data registers. Further qualification of the type of access (R/W, word/byte) is possible. Comparators A and C do not feature SZE or SZ control bits, thus the access size is not compared. Table 840 lists access considerations without data bus compare. Table 8-39 lists access considerations with data bus comparison. To compare byte accesses DBGxDH must be loaded with the data byte, the low byte must be masked out using the DBGxDLM mask register. On word accesses the data byte of the lower address is mapped to DBGxDH. Table 8-39. Comparator A and C Data Bus Considerations Access Address DBGxDH DBGxDL DBGxDHM DBGxDLM Example Valid Match Word ADDR[n] Data[n] Byte ADDR[n] Data[n] Data[n+1] $FF $FF MOVW #$WORD ADDR[n] config1 x $FF $00 MOVB #$BYTE ADDR[n] config2 Word ADDR[n] Data[n] x $FF $00 MOVW #$WORD ADDR[n] config2 Word ADDR[n] x Data[n+1] $00 $FF MOVW #$WORD ADDR[n] config3 Code may contain various access forms of the same address, i.e. a word access of ADDR[n] or byte access of ADDR[n+1] both access n+1. At a word access of ADDR[n], address ADDR[n+1] does not appear on the address bus and so cannot cause a comparator match if the comparator contains ADDR[n]. Thus it is not possible to monitor all data accesses of ADDR[n+1] with one comparator. To detect an access of ADDR[n+1] through a word access of ADDR[n] the comparator can be configured to ADDR[n], DBGxDL is loaded with the data pattern and DBGxDHM is cleared so only the data[n+1] is compared on accesses of ADDR[n]. MC9S12XE-Family Reference Manual Rev. 1.25 328 Freescale Semiconductor Chapter 8 S12X Debug (S12XDBGV3) Module NOTE Using this configuration, a byte access of ADDR[n] can cause a comparator match if the databus low byte by chance contains the same value as ADDR[n+1] because the databus comparator does not feature access size comparison and uses the mask as a “don’t care” function. Thus masked bits do not prevent a match. Comparators A and C feature an NDB control bit to determine if a match occurs when the data bus differs to comparator register contents or when the data bus is equivalent to the comparator register contents. 8.4.2.2 Exact Address Comparator Match (Comparators B and D) Comparators B and D feature SZ and SZE control bits. If SZE is clear, then the comparator address match qualification functions the same as for comparators A and C. If the SZE bit is set the access size (word or byte) is compared with the SZ bit value such that only the specified type of access causes a match. Thus if configured for a byte access of a particular address, a word access covering the same address does not lead to match. Table 8-40. Comparator Access Size Considerations Comparator Address SZE SZ8 Condition For Valid Match Comparators A and C ADDR[n] — — Word and byte accesses of ADDR[n](1) MOVB #$BYTE ADDR[n] MOVW #$WORD ADDR[n] Comparators B and D ADDR[n] 0 X Word and byte accesses of ADDR[n]1 MOVB #$BYTE ADDR[n] MOVW #$WORD ADDR[n] Comparators B and D ADDR[n] 1 0 Word accesses of ADDR[n]1 MOVW #$WORD ADDR[n] Comparators ADDR[n] 1 1 Byte accesses of ADDR[n] B and D MOVB #$BYTE ADDR[n] 1. A word access of ADDR[n-1] also accesses ADDR[n] but does not generate a match. The comparator address register must contain the exact address used in the code. 8.4.2.3 Data Bus Comparison NDB Dependency Comparators A and C each feature an NDB control bit, which allows data bus comparators to be configured to either trigger on equivalence or trigger on difference. This allows monitoring of a difference in the contents of an address location from an expected value. When matching on an equivalence (NDB=0), each individual data bus bit position can be masked out by clearing the corresponding mask bit (DBGxDHM/DBGxDLM), so that it is ignored in the comparison. A match occurs when all data bus bits with corresponding mask bits set are equivalent. If all mask register bits are clear, then a match is based on the address bus only, the data bus is ignored. When matching on a difference, mask bits can be cleared to ignore bit positions. A match occurs when any data bus bit with corresponding mask bit set is different. Clearing all mask bits, causes all bits to be ignored and prevents a match because no difference can be detected. In this case address bus equivalence does not cause a match. MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 329 Chapter 8 S12X Debug (S12XDBGV3) Module Table 8-41. NDB and MASK bit dependency 8.4.2.4 NDB DBGxDHM[n] / DBGxDLM[n] Comment 0 0 Do not compare data bus bit. 0 1 Compare data bus bit. Match on equivalence. 1 0 Do not compare data bus bit. 1 1 Compare data bus bit. Match on difference. Range Comparisons When using the AB comparator pair for a range comparison, the data bus can also be used for qualification by using the comparator A data and data mask registers. Furthermore the DBGACTL RW and RWE bits can be used to qualify the range comparison on either a read or a write access. The corresponding DBGBCTL bits are ignored. Similarly when using the CD comparator pair for a range comparison, the data bus can also be used for qualification by using the comparator C data and data mask registers. Furthermore the DBGCCTL RW and RWE bits can be used to qualify the range comparison on either a read or a write access if tagging is not selected. The corresponding DBGDCTL bits are ignored. The SZE and SZ control bits are ignored in range mode. The comparator A and C TAG bits are used to tag range comparisons for the AB and CD ranges respectively. The comparator B and D TAG bits are ignored in range modes. In order for a range comparison using comparators A and B, both COMPEA and COMPEB must be set; to disable range comparisons both must be cleared. Similarly for a range CD comparison, both COMPEC and COMPED must be set. If a range mode is selected SRCA and SRCC select the source (S12X or XGATE), SRCB and SRCD are ignored. The comparator A and C BRK bits are used for the AB and CD ranges respectively, the comparator B and D BRK bits are ignored in range mode. When configured for range comparisons and tagging, the ranges are accurate only to word boundaries. 8.4.2.4.1 Inside Range (CompAC_Addr ≤ address ≤ CompBD_Addr) In the Inside Range comparator mode, either comparator pair A and B or comparator pair C and D can be configured for range comparisons by the control register (DBGC2). The match condition requires that a valid match for both comparators happens on the same bus cycle. A match condition on only one comparator is not valid. An aligned word access which straddles the range boundary will cause a trigger only if the aligned address is inside the range. 8.4.2.4.2 Outside Range (address < CompAC_Addr or address > CompBD_Addr) In the Outside Range comparator mode, either comparator pair A and B or comparator pair C and D can be configured for range comparisons. A single match condition on either of the comparators is recognized as valid. An aligned word access which straddles the range boundary will cause a trigger only if the aligned address is outside the range. Outside range mode in combination with tagged triggers can be used to detect if the opcode fetches are from an unexpected range. In forced trigger modes the outside range trigger would typically be activated at any interrupt vector fetch or register access. This can be avoided by setting the upper or lower range limit to $7FFFFF or $000000 respectively. Interrupt vector fetches do not cause taghits MC9S12XE-Family Reference Manual Rev. 1.25 330 Freescale Semiconductor Chapter 8 S12X Debug (S12XDBGV3) Module When comparing the XGATE address bus in outside range mode, the initial vector fetch as determined by the vector contained in the XGATE XGVBR register should be taken into consideration. The XGVBR register and hence vector address can be modified. 8.4.3 Trigger Modes Trigger modes are used as qualifiers for a state sequencer change of state. The control logic determines the trigger mode and provides a trigger to the state sequencer. The individual trigger modes are described in the following sections. 8.4.3.1 Forced Trigger On Comparator Match If a forced trigger comparator match occurs, the trigger immediately initiates a transition to the next state sequencer state whereby the corresponding flags in DBGSR are set. The state control register for the current state determines the next state for each trigger. Forced triggers are generated as soon as the matching address appears on the address bus, which in the case of opcode fetches occurs several cycles before the opcode execution. For this reason a forced trigger at an opcode address precedes a tagged trigger at the same address by several cycles. 8.4.3.2 Trigger On Comparator Related Taghit If a CPU12X or XGATE taghit occurs, a transition to another state sequencer state is initiated and the corresponding DBGSR flags are set. For a comparator related taghit to occur, the S12XDBG must first generate tags based on comparator matches. When the tagged instruction reaches the execution stage of the instruction queue a taghit is generated by the CPU12X/XGATE. The state control register for the current state determines the next state for each trigger. 8.4.3.3 External Tagging Trigger The TAGLO and TAGHI pins (mapped to device pins) can be used to tag an instruction. This function can be used as another breakpoint source. When the tagged opcode reaches the execution stage of the instruction queue a transition to the disarmed state0 occurs, ending the debug session and generating a breakpoint, if breakpoints are enabled. External tagging is only possible in device emulation modes. 8.4.3.4 Trigger On XGATE S/W Breakpoint Request The XGATE S/W breakpoint request issues a forced breakpoint request to the CPU12X immediately and triggers the state sequencer into the disarmed state. Active tracing sessions are terminated immediately, thus if tracing has not yet begun, no trace information is stored. XGATE generated breakpoints are independent of the DBGBRK bits. The XGSBPE bit in DBGC1 determines if the XGATE S/W breakpoint function is enabled. The BDM bit in DBGC1 determines if the XGATE requested breakpoint causes the system to enter BDM Mode or initiate a software interrupt (SWI). 8.4.3.5 TRIG Immediate Trigger Independent of comparator matches or external tag signals it is possible to initiate a tracing session and/or breakpoint by writing the TRIG bit in DBGC1 to a logic “1”. If configured for begin or mid aligned tracing, MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 331 Chapter 8 S12X Debug (S12XDBGV3) Module this triggers the state sequencer into the Final State, if configured for end alignment, setting the TRIG bit disarms the module, ending the session. If breakpoints are enabled, a forced breakpoint request is issued immediately (end alignment) or when tracing has completed (begin or mid alignment). 8.4.3.6 Trigger Priorities In case of simultaneous triggers, the priority is resolved according to Table 8-42. The lower priority trigger is suppressed. It is thus possible to miss a lower priority trigger if it occurs simultaneously with a trigger of a higher priority. The trigger priorities described in Table 8-42 dictate that in the case of simultaneous matches, the match on the lower channel number (0,1,2,3) has priority. The SC[3:0] encoding ensures that a match leading to final state has priority over all other matches in each state sequencer state. When configured for range modes a simultaneous match of comparators A and C generates an active match0 whilst match2 is suppressed. If a write access to DBGC1 with the ARM bit position set occurs simultaneously to a hardware disarm from an internal trigger event, then the ARM bit is cleared due to the hardware disarm. Table 8-42. Trigger Priorities Priority Source Action Highest XGATE BKP Immediate forced breakpoint......(Tracing terminated immediately). TRIG Trigger immediately to final state (begin or mid aligned tracing enabled) Trigger immediately to state 0 (end aligned or no tracing enabled) External TAGHI/TAGLO Enter State0 Match0 (force or tag hit) Trigger to next state as defined by state control registers Match1 (force or tag hit) Trigger to next state as defined by state control registers Match2 (force or tag hit) Trigger to next state as defined by state control registers Match3 (force or tag hit) Trigger to next state as defined by state control registers Lowest 8.4.4 State Sequence Control ARM = 0 State 0 (Disarmed) ARM = 1 State1 State2 ARM = 0 Session Complete (Disarm) Final State State3 ARM = 0 Figure 8-22. State Sequencer Diagram The state sequencer allows a defined sequence of events to provide a trigger point for tracing of data in the trace buffer. Once the S12XDBG module has been armed by setting the ARM bit in the DBGC1 register, MC9S12XE-Family Reference Manual Rev. 1.25 332 Freescale Semiconductor Chapter 8 S12X Debug (S12XDBGV3) Module then state1 of the state sequencer is entered. Further transitions between the states are then controlled by the state control registers and depend upon a selected trigger mode condition being met. From Final State the only permitted transition is back to the disarmed state0. Transition between any of the states 1 to 3 is not restricted. Each transition updates the SSF[2:0] flags in DBGSR accordingly to indicate the current state. Alternatively by setting the TRIG bit in DBGSC1, the state machine can be triggered to state0 or Final State depending on tracing alignment. A tag hit through TAGHI/TAGLO brings the state sequencer immediately into state0, causes a breakpoint, if breakpoints are enabled, and ends tracing immediately independent of the trigger alignment bits TALIGN[1:0]. Independent of the state sequencer, each comparator channel can be individually configured to generate an immediate breakpoint when a match occurs through the use of the BRK bits in the DBGxCTL registers. Thus it is possible to generate an immediate breakpoint on selected channels, whilst a state sequencer transition can be initiated by a match on other channels. If a debug session is ended by a trigger on a channel with BRK = 1, the state sequencer transitions through Final State for a clock cycle to state0. This is independent of tracing and breakpoint activity, thus with tracing and breakpoints disabled, the state sequencer enters state0 and the debug module is disarmed. An XGATE S/W breakpoint request, if enabled causes a transition to the State0 and generates a breakpoint request to the CPU12X immediately 8.4.4.1 Final State On entering Final State a trigger may be issued to the trace buffer according to the trace position control as defined by the TALIGN field (see Section 8.3.2.3). If TSOURCE in the trace control register DBGTCR are cleared then the trace buffer is disabled and the transition to Final State can only generate a breakpoint request. In this case or upon completion of a tracing session when tracing is enabled, the ARM bit in the DBGC1 register is cleared, returning the module to the disarmed state0. If tracing is enabled, a breakpoint request can occur at the end of the tracing session. If neither tracing nor breakpoints are enabled then when the final state is reached it returns automatically to state0 and the debug module is disarmed. 8.4.5 Trace Buffer Operation The trace buffer is a 64 lines deep by 64-bits wide RAM array. The S12XDBG module stores trace information in the RAM array in a circular buffer format. The RAM array can be accessed through a register window (DBGTBH:DBGTBL) using 16-bit wide word accesses. After each complete 64-bit trace buffer line is read, an internal pointer into the RAM is incremented so that the next read will receive fresh information. Data is stored in the format shown in Table 8-43. After each store the counter register bits DBGCNT[6:0] are incremented. Tracing of CPU12X activity is disabled when the BDM is active but tracing of XGATE activity is still possible. Reading the trace buffer whilst the DBG is armed returns invalid data and the trace buffer pointer is not incremented. MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 333 Chapter 8 S12X Debug (S12XDBGV3) Module 8.4.5.1 Trace Trigger Alignment Using the TALIGN bits (see Section 8.3.2.3) it is possible to align the trigger with the end, the middle, or the beginning of a tracing session. If End or Mid tracing is selected, tracing begins when the ARM bit in DBGC1 is set and State1 is entered. The transition to Final State if End is selected signals the end of the tracing session. The transition to Final State if Mid is selected signals that another 32 lines will be traced before ending the tracing session. Tracing with Begin-Trigger starts at the opcode of the trigger. 8.4.5.1.1 Storing with Begin-Trigger Storing with Begin-Trigger, data is not stored in the Trace Buffer until the Final State is entered. Once the trigger condition is met the S12XDBG module will remain armed until 64 lines are stored in the Trace Buffer. If the trigger is at the address of the change-of-flow instruction the change of flow associated with the trigger will be stored in the Trace Buffer. Using Begin-trigger together with tagging, if the tagged instruction is about to be executed then the trace is started. Upon completion of the tracing session the breakpoint is generated, thus the breakpoint does not occur at the tagged instruction boundary. 8.4.5.1.2 Storing with Mid-Trigger Storing with Mid-Trigger, data is stored in the Trace Buffer as soon as the S12XDBG module is armed. When the trigger condition is met, another 32 lines will be traced before ending the tracing session, irrespective of the number of lines stored before the trigger occurred, then the S12XDBG module is disarmed and no more data is stored. Using Mid-trigger with tagging, if the tagged instruction is about to be executed then the trace is continued for another 32 lines. Upon tracing completion the breakpoint is generated, thus the breakpoint does not occur at the tagged instruction boundary. 8.4.5.1.3 Storing with End-Trigger Storing with End-Trigger, data is stored in the Trace Buffer until the Final State is entered, at which point the S12XDBG module will become disarmed and no more data will be stored. If the trigger is at the address of a change of flow instruction the trigger event will not be stored in the Trace Buffer. 8.4.5.2 Trace Modes The S12XDBG module can operate in four trace modes. The mode is selected using the TRCMOD bits in the DBGTCR register. In each mode tracing of XGATE or CPU12X information is possible. The source for the trace is selected using the TSOURCE bits in the DBGTCR register. The modes are described in the following subsections. The trace buffer organization is shown in Table 8-43. 8.4.5.2.1 Normal Mode In Normal Mode, change of flow (COF) program counter (PC) addresses will be stored. COF addresses are defined as follows for the CPU12X: • Source address of taken conditional branches (long, short, bit-conditional, and loop primitives) • Destination address of indexed JMP, JSR, and CALL instruction MC9S12XE-Family Reference Manual Rev. 1.25 334 Freescale Semiconductor Chapter 8 S12X Debug (S12XDBGV3) Module • • Destination address of RTI, RTS, and RTC instructions. Vector address of interrupts, except for SWI and BDM vectors LBRA, BRA, BSR, BGND as well as non-indexed JMP, JSR, and CALL instructions are not classified as change of flow and are not stored in the trace buffer. COF addresses are defined as follows for the XGATE: • Source address of taken conditional branches • Destination address of indexed JAL instructions. • First XGATE code address in a thread Change-of-flow addresses stored include the full 23-bit address bus of CPU12X, the 16-bit address bus for the XGATE module and an information byte, which contains a source/destination bit to indicate whether the stored address was a source address or destination address. NOTE When an CPU12X COF instruction with destination address is executed, the destination address is stored to the trace buffer on instruction completion, indicating the COF has taken place. If an interrupt occurs simultaneously then the next instruction carried out is actually from the interrupt service routine. The instruction at the destination address of the original program flow gets exectuted after the interrupt service routine. In the following example an IRQ interrupt occurs during execution of the indexed JMP at address MARK1. The BRN at the destination (SUB_1) is not executed until after the IRQ service routine but the destination address is entered into the trace buffer to indicate that the indexed JMP COF has taken place. MARK1 MARK2 LDX JMP NOP #SUB_1 0,X SUB_1 BRN * ADDR1 NOP DBNE A,PART5 IRQ_ISR LDAB STAB RTI #$F0 VAR_C1 ; IRQ interrupt occurs during execution of this ; ; JMP Destination address TRACE BUFFER ENTRY 1 ; RTI Destination address TRACE BUFFER ENTRY 3 ; ; Source address TRACE BUFFER ENTRY 4 ; IRQ Vector $FFF2 = TRACE BUFFER ENTRY 2 ; The execution flow taking into account the IRQ is as follows MARK1 IRQ_ISR SUB_1 ADDR1 LDX JMP LDAB STAB RTI BRN NOP DBNE #SUB_1 0,X #$F0 VAR_C1 ; ; ; * A,PART5 ; ; MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 335 Chapter 8 S12X Debug (S12XDBGV3) Module 8.4.5.2.2 Loop1 Mode Loop1 Mode, similarly to Normal Mode also stores only COF address information to the trace buffer, it however allows the filtering out of redundant information. The intent of Loop1 Mode is to prevent the Trace Buffer from being filled entirely with duplicate information from a looping construct such as delays using the DBNE instruction or polling loops using BRSET/BRCLR instructions. Immediately after address information is placed in the Trace Buffer, the S12XDBG module writes this value into a background register. This prevents consecutive duplicate address entries in the Trace Buffer resulting from repeated branches. Loop1 Mode only inhibits consecutive duplicate source address entries that would typically be stored in most tight looping constructs. It does not inhibit repeated entries of destination addresses or vector addresses, since repeated entries of these would most likely indicate a bug in the user’s code that the S12XDBG module is designed to help find. 8.4.5.2.3 Detail Mode In Detail Mode, address and data for all memory and register accesses is stored in the trace buffer. In the case of XGATE tracing this means that initialization of the R1 register during a vector fetch is not traced. This mode also features information byte entries to the trace buffer, for each address byte entry. The information byte indicates the size of access (word or byte) and the type of access (read or write). When tracing CPU12X activity in Detail Mode, all cycles are traced except those when the CPU12X is either in a free or opcode fetch cycle. In this mode the XGATE program counter is also traced to provide a snapshot of the XGATE activity. CXINF information byte bits indicate the type of XGATE activity occurring at the time of the trace buffer entry. When tracing CPU12X activity alone in Detail Mode, the address range can be limited to a range specified by the TRANGE bits in DBGTCR. This function uses comparators C and D to define an address range inside which CPU12X activity should be traced (see Table 8-43). Thus the traced CPU12X activity can be restricted to particular register range accesses. When tracing XGATE activity in Detail Mode, all load and store cycles are traced. Additionally the CPU12X program counter is stored at the time of the XGATE trace buffer entry to provide a snapshot of CPU12X activity. 8.4.5.2.4 Pure PC Mode In Pure PC Mode, tracing from the CPU the PC addresses of all executed opcodes, including illegal opcodes, are stored. In Pure PC Mode, tracing from the XGATE the PC addresses of all executed opcodes are stored. 8.4.5.3 Trace Buffer Organization Referring to Table 8-43. An X prefix denotes information from the XGATE module, a C prefix denotes information from the CPU12X. ADRH, ADRM, ADRL denote address high, middle and low byte respectively. INF bytes contain control information (R/W, S/D etc.). The numerical suffix indicates which tracing step. The information format for Loop1 Mode and PurePC Mode is the same as that of Normal Mode. Whilst tracing from XGATE or CPU12X only, in Normal or Loop1 modes each array line contains MC9S12XE-Family Reference Manual Rev. 1.25 336 Freescale Semiconductor Chapter 8 S12X Debug (S12XDBGV3) Module 2 data entries, thus in this case the DBGCNT[0] is incremented after each separate entry. In Detail mode DBGCNT[0] remains cleared whilst the other DBGCNT bits are incremented on each trace buffer entry. XGATE and CPU12X COFs occur independently of each other and the profile of COFs for the two sources is totally different. When both sources are being traced in Normal or Loop1 mode, for each COF from one source, there may be many COFs from the other source, depending on user code. COF events could occur far from each other in the time domain, on consecutive cycles or simultaneously. When a COF occurs in either source (S12X or XGATE) a trace buffer entry is made and the corresponding CDV or XDV bit is set. The current PC of the other source is simultaneously stored to the trace buffer even if no COF has occurred, in which case CDV/XDV remains cleared indicating the address is not associated with a COF, but is simply a snapshot of the PC contents at the time of the COF from the other source. Single byte data accesses in Detail Mode are always stored to the low byte of the trace buffer (CDATAL or XDATAL) and the high byte is cleared. When tracing word accesses, the byte at the lower address is always stored to trace buffer byte3 and the byte at the higher address is stored to byte2. Table 8-43. Trace Buffer Organization Mode 8-Byte Wide Word Buffer 7 6 5 4 3 2 1 0 XGATE Detail CXINF1 CADRH1 CADRM1 CADRL1 XDATAH1 XDATAL1 XADRM1 XADRL1 CXINF2 CADRH2 CADRM2 CADRL2 XDATAH2 XDATAL2 XADRM2 XADRL2 CPU12X Detail CXINF1 CADRH1 CADRM1 CADRL1 CDATAH1 CDATAL1 XADRM1 XADRL1 CXINF2 CADRH2 CADRM2 CADRL2 CDATAH2 CDATAL2 XADRM2 XADRL2 Both Other Modes XINF0 XPCM0 XPCL0 CINF0 CPCH0 CPCM0 CPCL0 XINF1 XPCM1 XPCL1 CINF1 CPCH1 CPCM1 CPCL1 XGATE Other Modes XINF1 XPCM1 XPCL1 XINF0 XPCM0 XPCL0 XINF3 XPCM3 XPCL3 XINF2 XPCM2 XPCL2 CPU12X Other Modes CINF1 CPCH1 CPCM1 CPCL1 CINF0 CPCH0 CPCM0 CPCL0 CINF3 CPCH3 CPCM3 CPCL3 CINF2 CPCH2 CPCM2 CPCL2 MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 337 Chapter 8 S12X Debug (S12XDBGV3) Module 8.4.5.3.1 Information Byte Organization The format of the control information byte is dependent upon the active trace mode as described below. In Normal, Loop1, or Pure PC modes tracing of XGATE activity, XINF is used to store control information. In Normal, Loop1, or Pure PC modes tracing of CPU12X activity, CINF is used to store control information. In Detail Mode, CXINF contains the control information. XGATE Information Byte Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 XSD XSOT XCOT XDV 0 0 0 0 Figure 8-23. XGATE Information Byte XINF Table 8-44. XINF Field Descriptions Field Description 7 XSD Source Destination Indicator — This bit indicates if the corresponding stored address is a source or destination address. This is only used in Normal and Loop1 mode tracing. 0 Source address 1 Destination address or Start of Thread or Continuation of Thread 6 XSOT Start Of Thread Indicator — This bit indicates that the corresponding stored address is a start of thread address. This is only used in Normal and Loop1 mode tracing. NOTE. This bit only has effect on devices where the XGATE module supports multiple interrupt levels. 0 Stored address not from a start of thread 1 Stored address from a start of thread 5 XCOT Continuation Of Thread Indicator — This bit indicates that the corresponding stored address is the first address following a return from a higher priority thread. This is only used in Normal and Loop1 mode tracing. NOTE. This bit only has effect on devices where the XGATE module supports multiple interrupt levels. 0 Stored address not from a continuation of thread 1 Stored address from a continuation of thread 4 XDV Data Invalid Indicator — This bit indicates if the trace buffer entry is invalid. It is only used when tracing from both sources in Normal, Loop1 and Pure PC modes, to indicate that the XGATE trace buffer entry is valid. 0 Trace buffer entry is invalid 1 Trace buffer entry is valid XGATE info bit setting XGATE FLOW SOT1 SOT2 JAL RTS COT1 RTS XSD XSOT XCOT Figure 8-24. XGATE info bit setting Figure 8-24 indicates the XGATE information bit setting when switching between threads, the initial thread starting at SOT1 and continuing at COT1 after the higher priority thread2 has ended. MC9S12XE-Family Reference Manual Rev. 1.25 338 Freescale Semiconductor Chapter 8 S12X Debug (S12XDBGV3) Module CPU12X Information Byte Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 CSD CVA 0 CDV 0 0 0 0 Figure 8-25. CPU12X Information Byte CINF Table 8-45. CINF Field Descriptions Field Description 7 CSD Source Destination Indicator — This bit indicates if the corresponding stored address is a source or destination address. This is only used in Normal and Loop1 mode tracing. 0 Source address 1 Destination address 6 CVA Vector Indicator — This bit indicates if the corresponding stored address is a vector address. Vector addresses are destination addresses, thus if CVA is set, then the corresponding CSD is also set. This is only used in Normal and Loop1 mode tracing. This bit has no meaning in Pure PC mode. 0 Indexed jump destination address 1 Vector destination address 4 CDV Data Invalid Indicator — This bit indicates if the trace buffer entry is invalid. It is only used when tracing from both sources in Normal, Loop1 and Pure PC modes, to indicate that the CPU12X trace buffer entry is valid. 0 Trace buffer entry is invalid 1 Trace buffer entry is valid CXINF Information Byte Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 CFREE CSZ CRW COCF XACK XSZ XRW XOCF Figure 8-26. Information Byte CXINF This describes the format of the information byte used only when tracing in Detail Mode. When tracing from the CPU12X in Detail Mode, information is stored to the trace buffer on all cycles except opcode fetch and free cycles. The XGATE entry stored on the same line is a snapshot of the XGATE program counter. In this case the CSZ and CRW bits indicate the type of access being made by the CPU12X, whilst the XACK and XOCF bits indicate if the simultaneous XGATE cycle is a free cycle (no bus acknowledge) or opcode fetch cycle. Similarly when tracing from the XGATE in Detail Mode, information is stored to the trace buffer on all cycles except opcode fetch and free cycles. The CPU12X entry stored on the same line is a snapshot of the CPU12X program counter. In this case the XSZ and XRW bits indicate the type of access being made by the XGATE, whilst the CFREE and COCF bits indicate if the simultaneous CPU12X cycle is a free cycle or opcode fetch cycle. Table 8-46. CXINF Field Descriptions Field Description 7 CFREE CPU12X Free Cycle Indicator — This bit indicates if the stored CPU12X address corresponds to a free cycle. This bit only contains valid information when tracing the XGATE accesses in Detail Mode. 0 Stored information corresponds to free cycle 1 Stored information does not correspond to free cycle MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 339 Chapter 8 S12X Debug (S12XDBGV3) Module Table 8-46. CXINF Field Descriptions (continued) Field Description 6 CSZ Access Type Indicator — This bit indicates if the access was a byte or word size access.This bit only contains valid information when tracing CPU12X activity in Detail Mode. 0 Word Access 1 Byte Access 5 CRW Read Write Indicator — This bit indicates if the corresponding stored address corresponds to a read or write access. This bit only contains valid information when tracing CPU12X activity in Detail Mode. 0 Write Access 1 Read Access 4 COCF CPU12X Opcode Fetch Indicator — This bit indicates if the stored address corresponds to an opcode fetch cycle. This bit only contains valid information when tracing the XGATE accesses in Detail Mode. 0 Stored information does not correspond to opcode fetch cycle 1 Stored information corresponds to opcode fetch cycle 3 XACK XGATE Access Indicator — This bit indicates if the stored XGATE address corresponds to a free cycle. This bit only contains valid information when tracing the CPU12X accesses in Detail Mode. 0 Stored information corresponds to free cycle 1 Stored information does not correspond to free cycle 2 XSZ Access Type Indicator — This bit indicates if the access was a byte or word size access. This bit only contains valid information when tracing XGATE activity in Detail Mode. 0 Word Access 1 Byte Access 1 XRW Read Write Indicator — This bit indicates if the corresponding stored address corresponds to a read or write access. This bit only contains valid information when tracing XGATE activity in Detail Mode. 0 Write Access 1 Read Access 0 XOCF XGATE Opcode Fetch Indicator — This bit indicates if the stored address corresponds to an opcode fetch cycle.This bit only contains valid information when tracing the CPU12X accesses in Detail Mode. 0 Stored information does not correspond to opcode fetch cycle 1 Stored information corresponds to opcode fetch cycle 8.4.5.4 Reading Data from Trace Buffer The data stored in the Trace Buffer can be read using either the background debug module (BDM) module, the XGATE or the CPU12X provided the S12XDBG module is not armed, is configured for tracing and the system not secured. When the ARM bit is written to 1 the trace buffer is locked to prevent reading. The trace buffer can only be unlocked for reading by an aligned word write to DBGTB when the module is disarmed. The Trace Buffer can only be read through the DBGTB register using aligned word reads, any byte or misaligned reads return 0 and do not cause the trace buffer pointer to increment to the next trace buffer address. The Trace Buffer data is read out first-in first-out. By reading CNT in DBGCNT the number of valid 64-bit lines can be determined. DBGCNT will not decrement as data is read. Whilst reading an internal pointer is used to determine the next line to be read. After a tracing session, the pointer points to the oldest data entry, thus if no overflow has occurred, the pointer points to line0, otherwise it points to the line with the oldest entry. The pointer is initialized by each aligned write to DBGTBH to point to the oldest data again. This enables an interrupted trace buffer read sequence to be easily restarted from the oldest data entry. MC9S12XE-Family Reference Manual Rev. 1.25 340 Freescale Semiconductor Chapter 8 S12X Debug (S12XDBGV3) Module The least significant word of each 64-bit wide array line is read out first. This corresponds to the bytes 1 and 0 of Table 8-43. The bytes containing invalid information (shaded in Table 8-43) are also read out. Reading the Trace Buffer while the S12XDBG module is armed will return invalid data and no shifting of the RAM pointer will occur. 8.4.5.5 Trace Buffer Reset State The Trace Buffer contents are not initialized by a system reset. Thus should a system reset occur, the trace session information from immediately before the reset occurred can be read out. The DBGCNT bits are not cleared by a system reset. Thus should a reset occur, the number of valid lines in the trace buffer is indicated by DBGCNT. The internal pointer to the current trace buffer address is initialized by unlocking the trace buffer thus points to the oldest valid data even if a reset occurred during the tracing session. Generally debugging occurrences of system resets is best handled using mid or end trigger alignment since the reset may occur before the trace trigger, which in the begin trigger alignment case means no information would be stored in the trace buffer. NOTE An external pin RESET that occurs simultaneous to a trace buffer entry can, in very seldom cases, lead to either that entry being corrupted or the first entry of the session being corrupted. In such cases the other contents of the trace buffer still contain valid tracing information. The case occurs when the reset assertion coincides with the trace buffer entry clock edge. 8.4.6 Tagging A tag follows program information as it advances through the instruction queue. When a tagged instruction reaches the head of the queue a tag hit occurs and triggers the state sequencer. Each comparator control register features a TAG bit, which controls whether the comparator match will cause a trigger immediately or tag the opcode at the matched address. If a comparator is enabled for tagged comparisons, the address stored in the comparator match address registers must be an opcode address for the trigger to occur. Both CPU12X and XGATE opcodes can be tagged with the comparator register TAG bits. Using Begin trigger together with tagging, if the tagged instruction is about to be executed then the transition to the next state sequencer state occurs. If the transition is to the Final State, tracing is started. Only upon completion of the tracing session can a breakpoint be generated. Similarly using Mid trigger with tagging, if the tagged instruction is about to be executed then the trace is continued for another 32 lines. Upon tracing completion the breakpoint is generated. Using End trigger, when the tagged instruction is about to be executed and the next transition is to Final State then a breakpoint is generated immediately, before the tagged instruction is carried out. Read/Write (R/W), access size (SZ) monitoring and data bus monitoring is not useful if tagged triggering is selected, since the tag is attached to the opcode at the matched address and is not dependent on the data bus nor on the type of access. Thus these bits are ignored if tagged triggering is selected. When configured for range comparisons and tagging, the ranges are accurate only to word boundaries. MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 341 Chapter 8 S12X Debug (S12XDBGV3) Module S12X tagging is disabled when the BDM becomes active. XGATE tagging is possible when the BDM is active. 8.4.6.1 External Tagging using TAGHI and TAGLO External tagging using the external TAGHI and TAGLO pins can only be used to tag CPU12X opcodes; tagging of XGATE code using these pins is not possible. An external tag triggers the state sequencer into state0 when the tagged opcode reaches the execution stage of the instruction queue. The pins operate independently, thus the state of one pin does not affect the function of the other. External tagging is possible in emulation modes only. The presence of logic level 0 on either pin at the rising edge of the external clock (ECLK) performs the function indicated in the Table 8-47. It is possible to tag both bytes of an instruction word. If a taghit occurs, a breakpoint can be generated as defined by the DBGBRK and BDM bits in DBGC1. Each time TAGHI or TAGLO are low on the rising edge of ECLK, the old tag is replaced by a new one. Table 8-47. Tag Pin Function TAGHI 1 1 0 0 8.4.6.2 TAGLO 1 0 1 0 Tag No tag Low byte High byte Both bytes Unconditional Tagging Function In emulation modes a low assertion of PE5/TAGLO/MODA in the 7th or 8th bus cycle after reset enables the unconditional tagging function, allowing immediate tagging via TAGHI/TAGLO with breakpoint to BDM independent of the ARM, BDM and DBGBRK bits. Conversely these bits are not affected by unconditional tagging. The unconditional tagging function remains enabled until the next reset. This function allows an immediate entry to BDM in emulation modes before user code execution. The TAGLO assertion must be in the 7th or 8th bus cycle following the end of reset, whereby the prior RESET pin assertion lasts the full 192 bus cycles. 8.4.7 Breakpoints Breakpoints can be generated as follows. • Through XGATE software breakpoint requests. • From comparator channel triggers to final state. • Using software to write to the TRIG bit in the DBGC1 register. • From taghits generated using the external TAGHI and TAGLO pins. Breakpoints generated by the XGATE module or via the BDM BACKGROUND command have no affect on the CPU12X in STOP or WAIT mode. MC9S12XE-Family Reference Manual Rev. 1.25 342 Freescale Semiconductor Chapter 8 S12X Debug (S12XDBGV3) Module 8.4.7.1 XGATE Software Breakpoints The XGATE software breakpoint instruction BRK can request a CPU12X breakpoint, via the S12XDBG module. In this case, if the XGSBPE bit is set, the S12XDBG module immediately generates a forced breakpoint request to the CPU12X, the state sequencer is returned to state0 and tracing, if active, is terminated. If configured for BEGIN trigger and tracing has not yet been triggered from another source, the trace buffer contains no information. Breakpoint requests from the XGATE module do not depend upon the state of the DBGBRK or ARM bits in DBGC1. They depend solely on the state of the XGSBPE and BDM bits. Thus it is not necessary to ARM the DBG module to use XGATE software breakpoints to generate breakpoints in the CPU12X program flow, but it is necessary to set XGSBPE. Furthermore, if a breakpoint to BDM is required, the BDM bit must also be set. When the XGATE requests an CPU12X breakpoint, the XGATE program flow stops by default, independent of the S12XDBG module. 8.4.7.2 Breakpoints From Internal Comparator Channel Final State Triggers Breakpoints can be generated when internal comparator channels trigger the state sequencer to the Final State. If configured for tagging, then the breakpoint is generated when the tagged opcode reaches the execution stage of the instruction queue. If a tracing session is selected by TSOURCE, breakpoints are requested when the tracing session has completed, thus if Begin or Mid aligned triggering is selected, the breakpoint is requested only on completion of the subsequent trace (see Table 8-48). If no tracing session is selected, breakpoints are requested immediately. If the BRK bit is set on the triggering channel, then the breakpoint is generated immediately independent of tracing trigger alignment. Table 8-48. Breakpoint Setup For Both XGATE and CPU12X Breakpoints BRK TALIGN DBGBRK[n] Breakpoint Alignment 0 00 0 Fill Trace Buffer until trigger (no breakpoints — keep running) 0 00 1 Fill Trace Buffer until trigger, then breakpoint request occurs 0 01 0 Start Trace Buffer at trigger (no breakpoints — keep running) 0 01 1 Start Trace Buffer at trigger A breakpoint request occurs when Trace Buffer is full 0 10 0 Store a further 32 Trace Buffer line entries after trigger (no breakpoints — keep running) 0 10 1 Store a further 32 Trace Buffer line entries after trigger Request breakpoint after the 32 further Trace Buffer entries 1 00,01,10 1 Terminate tracing and generate breakpoint immediately on trigger 1 00,01,10 0 Terminate tracing immediately on trigger x 11 x Reserved MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 343 Chapter 8 S12X Debug (S12XDBGV3) Module 8.4.7.3 Breakpoints Generated Via The TRIG Bit If a TRIG triggers occur, the Final State is entered. If a tracing session is selected by TSOURCE, breakpoints are requested when the tracing session has completed, thus if Begin or Mid aligned triggering is selected, the breakpoint is requested only on completion of the subsequent trace (see Table 8-48). If no tracing session is selected, breakpoints are requested immediately. TRIG breakpoints are possible even if the S12XDBG module is disarmed. 8.4.7.4 Breakpoints Via TAGHI Or TAGLO Pin Taghits Tagging using the external TAGHI/TAGLO pins always ends the session immediately at the tag hit. It is always end aligned, independent of internal channel trigger alignment configuration. 8.4.7.5 S12XDBG Breakpoint Priorities XGATE software breakpoints have the highest priority. Active tracing sessions are terminated immediately. If a TRIG trigger occurs after Begin or Mid aligned tracing has already been triggered by a comparator instigated transition to Final State, then TRIG no longer has an effect. When the associated tracing session is complete, the breakpoint occurs. Similarly if a TRIG is followed by a subsequent trigger from a comparator channel, it has no effect, since tracing has already started. If a comparator tag hit occurs simultaneously with an external TAGHI/TAGLO hit, the state sequencer enters state0. TAGHI/TAGLO triggers are always end aligned, to end tracing immediately, independent of the tracing trigger alignment bits TALIGN[1:0]. 8.4.7.5.1 S12XDBG Breakpoint Priorities And BDM Interfacing Breakpoint operation is dependent on the state of the S12XBDM module. If the S12XBDM module is active, the CPU12X is executing out of BDM firmware and S12X breakpoints are disabled. In addition, while executing a BDM TRACE command, tagging into BDM is disabled. If BDM is not active, the breakpoint will give priority to BDM requests over SWI requests if the breakpoint coincides with a SWI instruction in the user’s code. On returning from BDM, the SWI from user code gets executed. Table 8-49. Breakpoint Mapping Summary DBGBRK[1] (DBGC1[3]) BDM Bit (DBGC1[4]) BDM Enabled BDM Active S12X Breakpoint Mapping 0 X X X No Breakpoint 1 0 X 0 Breakpoint to SWI 1 0 X 1 No Breakpoint 1 1 0 X Breakpoint to SWI 1 1 1 0 Breakpoint to BDM 1 1 1 1 No Breakpoint BDM cannot be entered from a breakpoint unless the ENABLE bit is set in the BDM. If entry to BDM via a BGND instruction is attempted and the ENABLE bit in the BDM is cleared, the CPU12X actually MC9S12XE-Family Reference Manual Rev. 1.25 344 Freescale Semiconductor Chapter 8 S12X Debug (S12XDBGV3) Module executes the BDM firmware code. It checks the ENABLE and returns if ENABLE is not set. If not serviced by the monitor then the breakpoint is re-asserted when the BDM returns to normal CPU12X flow. If the comparator register contents coincide with the SWI/BDM vector address then an SWI in user code and DBG breakpoint could occur simultaneously. The CPU12X ensures that BDM requests have a higher priority than SWI requests. Returning from the BDM/SWI service routine care must be taken to avoid re triggering a breakpoint. NOTE When program control returns from a tagged breakpoint using an RTI or BDM GO command without program counter modification it will return to the instruction whose tag generated the breakpoint. To avoid re triggering a breakpoint at the same location reconfigure the S12XDBG module in the SWI routine, if configured for an SWI breakpoint, or over the BDM interface by executing a TRACE command before the GO to increment the program flow past the tagged instruction. An XGATE software breakpoint is forced immediately, the tracing session terminated and the XGATE module execution stops. The user can thus determine if an XGATE breakpoint has occurred by reading out the XGATE program counter over the BDM interface. MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 345 Chapter 8 S12X Debug (S12XDBGV3) Module MC9S12XE-Family Reference Manual Rev. 1.25 346 Freescale Semiconductor Chapter 9 Security (S12XE9SECV2) Table 9-1. Revision History Revision Number Revision Date V02.00 27 Aug 2004 - Reviewed and updated for S12XD architecture V02.01 21 Feb 2007 - Added S12XE, S12XF and S12XS architectures V02.02 19 Apr 2007 - Corrected statement about Backdoor key access via BDM on XE, XF, XS 9.1 Sections Affected Description of Changes Introduction This specification describes the function of the security mechanism in the S12XE chip family (9SEC). NOTE No security feature is absolutely secure. However, Freescale’s strategy is to make reading or copying the FLASH and/or EEPROM difficult for unauthorized users. 9.1.1 Features The user must be reminded that part of the security must lie with the application code. An extreme example would be application code that dumps the contents of the internal memory. This would defeat the purpose of security. At the same time, the user may also wish to put a backdoor in the application program. An example of this is the user downloads a security key through the SCI, which allows access to a programming routine that updates parameters stored in another section of the Flash memory. The security features of the S12XE chip family (in secure mode) are: • Protect the content of non-volatile memories (Flash, EEPROM) • Execution of NVM commands is restricted • Disable access to internal memory via background debug module (BDM) • Disable access to internal Flash/EEPROM in expanded modes • Disable debugging features for the CPU and XGATE MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 347 Chapter 9 Security (S12XE9SECV2) 9.1.2 Modes of Operation Table 9-2 gives an overview over availability of security relevant features in unsecure and secure modes. Table 9-2. Feature Availability in Unsecure and Secure Modes on S12XE Unsecure Mode Secure Mode NS SS NX ES EX ST NS SS NX ES EX ST Flash Array Access ✔ ✔ ✔(1) ✔1 ✔1 ✔1 ✔ ✔ — — — — EEPROM Array Access ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ — — — — ✔ 2 ✔ ✔ 2 2 ✔ ✔ 2 ✔ 2 ✔ ✔ 2 2 ✔ ✔ 2 ✔2 NVM Commands ✔ (2) BDM ✔ ✔ ✔ ✔ ✔ ✔ — ✔(3) — — — — DBG Module Trace ✔ ✔ ✔ ✔ ✔ ✔ — — — — — — XGATE Debugging ✔ ✔ ✔ ✔ ✔ ✔ — — — — — — External Bus Interface — — ✔ ✔ ✔ ✔ — — ✔ ✔ ✔ ✔ Internal status visible multiplexed on external bus — — — ✔ ✔ — — — — ✔ ✔ — Internal accesses visible — — — — — ✔ — — — — — ✔ on external bus 1. Availability of Flash arrays in the memory map depends on ROMCTL/EROMCTL pins and/or the state of the ROMON/EROMON bits in the MMCCTL1 register. Please refer to the S12X_MMC block guide for detailed information. 2. Restricted NVM command set only. Please refer to the NVM wrapper block guides for detailed information. 3. BDM hardware commands restricted to peripheral registers only. 9.1.3 Securing the Microcontroller Once the user has programmed the Flash and EEPROM, the chip can be secured by programming the security bits located in the options/security byte in the Flash memory array. These non-volatile bits will keep the device secured through reset and power-down. The options/security byte is located at address 0xFF0F (= global address 0x7F_FF0F) in the Flash memory array. This byte can be erased and programmed like any other Flash location. Two bits of this byte are used for security (SEC[1:0]). On devices which have a memory page window, the Flash options/security byte is also available at address 0xBF0F by selecting page 0x3F with the PPAGE register. The contents of this byte are copied into the Flash security register (FSEC) during a reset sequence. 0xFF0F 7 6 5 4 3 2 1 0 KEYEN1 KEYEN0 NV5 NV4 NV3 NV2 SEC1 SEC0 Figure 9-1. Flash Options/Security Byte The meaning of the bits KEYEN[1:0] is shown in Table 9-3. Please refer to Section 9.1.5.1, “Unsecuring the MCU Using the Backdoor Key Access” for more information. MC9S12XE-Family Reference Manual Rev. 1.25 348 Freescale Semiconductor Chapter 9 Security (S12XE9SECV2) Table 9-3. Backdoor Key Access Enable Bits KEYEN[1:0] Backdoor Key Access Enabled 00 0 (disabled) 01 0 (disabled) 10 1 (enabled) 11 0 (disabled) The meaning of the security bits SEC[1:0] is shown in Table 9-4. For security reasons, the state of device security is controlled by two bits. To put the device in unsecured mode, these bits must be programmed to SEC[1:0] = ‘10’. All other combinations put the device in a secured mode. The recommended value to put the device in secured state is the inverse of the unsecured state, i.e. SEC[1:0] = ‘01’. Table 9-4. Security Bits SEC[1:0] Security State 00 1 (secured) 01 1 (secured) 10 0 (unsecured) 11 1 (secured) NOTE Please refer to the Flash block guide for actual security configuration (in section “Flash Module Security”). 9.1.4 Operation of the Secured Microcontroller By securing the device, unauthorized access to the EEPROM and Flash memory contents can be prevented. However, it must be understood that the security of the EEPROM and Flash memory contents also depends on the design of the application program. For example, if the application has the capability of downloading code through a serial port and then executing that code (e.g. an application containing bootloader code), then this capability could potentially be used to read the EEPROM and Flash memory contents even when the microcontroller is in the secure state. In this example, the security of the application could be enhanced by requiring a challenge/response authentication before any code can be downloaded. Secured operation has the following effects on the microcontroller: 9.1.4.1 • • • • Normal Single Chip Mode (NS) Background debug module (BDM) operation is completely disabled. Execution of Flash and EEPROM commands is restricted. Please refer to the NVM block guide for details. Tracing code execution using the DBG module is disabled. Debugging XGATE code (breakpoints, single-stepping) is disabled. MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 349 Chapter 9 Security (S12XE9SECV2) 9.1.4.2 • • • • • Special Single Chip Mode (SS) BDM firmware commands are disabled. BDM hardware commands are restricted to the register space. Execution of Flash and EEPROM commands is restricted. Please refer to the NVM block guide for details. Tracing code execution using the DBG module is disabled. Debugging XGATE code (breakpoints, single-stepping) is disabled. Special single chip mode means BDM is active after reset. The availability of BDM firmware commands depends on the security state of the device. The BDM secure firmware first performs a blank check of both the Flash memory and the EEPROM. If the blank check succeeds, security will be temporarily turned off and the state of the security bits in the appropriate Flash memory location can be changed If the blank check fails, security will remain active, only the BDM hardware commands will be enabled, and the accessible memory space is restricted to the peripheral register area. This will allow the BDM to be used to erase the EEPROM and Flash memory without giving access to their contents. After erasing both Flash memory and EEPROM, another reset into special single chip mode will cause the blank check to succeed and the options/security byte can be programmed to “unsecured” state via BDM. While the BDM is executing the blank check, the BDM interface is completely blocked, which means that all BDM commands are temporarily blocked. 9.1.4.3 • • • • • Expanded Modes (NX, ES, EX, and ST) BDM operation is completely disabled. Internal Flash memory and EEPROM are disabled. Execution of Flash and EEPROM commands is restricted. Please refer to the FTM block guide for details. Tracing code execution using the DBG module is disabled. Debugging XGATE code (breakpoints, single-stepping) is disabled 9.1.5 Unsecuring the Microcontroller Unsecuring the microcontroller can be done by three different methods: 1. Backdoor key access 2. Reprogramming the security bits 3. Complete memory erase (special modes) 9.1.5.1 Unsecuring the MCU Using the Backdoor Key Access In normal modes (single chip and expanded), security can be temporarily disabled using the backdoor key access method. This method requires that: • The backdoor key at 0xFF00–0xFF07 (= global addresses 0x7F_FF00–0x7F_FF07) has been programmed to a valid value. MC9S12XE-Family Reference Manual Rev. 1.25 350 Freescale Semiconductor Chapter 9 Security (S12XE9SECV2) • • The KEYEN[1:0] bits within the Flash options/security byte select ‘enabled’. In single chip mode, the application program programmed into the microcontroller must be designed to have the capability to write to the backdoor key locations. The backdoor key values themselves would not normally be stored within the application data, which means the application program would have to be designed to receive the backdoor key values from an external source (e.g. through a serial port). The backdoor key access method allows debugging of a secured microcontroller without having to erase the Flash. This is particularly useful for failure analysis. NOTE No word of the backdoor key is allowed to have the value 0x0000 or 0xFFFF. 9.1.6 Reprogramming the Security Bits In normal single chip mode (NS), security can also be disabled by erasing and reprogramming the security bits within Flash options/security byte to the unsecured value. Because the erase operation will erase the entire sector from 0xFE00–0xFFFF (0x7F_FE00–0x7F_FFFF), the backdoor key and the interrupt vectors will also be erased; this method is not recommended for normal single chip mode. The application software can only erase and program the Flash options/security byte if the Flash sector containing the Flash options/security byte is not protected (see Flash protection). Thus Flash protection is a useful means of preventing this method. The microcontroller will enter the unsecured state after the next reset following the programming of the security bits to the unsecured value. This method requires that: • The application software previously programmed into the microcontroller has been designed to have the capability to erase and program the Flash options/security byte, or security is first disabled using the backdoor key method, allowing BDM to be used to issue commands to erase and program the Flash options/security byte. • The Flash sector containing the Flash options/security byte is not protected. 9.1.7 Complete Memory Erase (Special Modes) The microcontroller can be unsecured in special modes by erasing the entire EEPROM and Flash memory contents. When a secure microcontroller is reset into special single chip mode (SS), the BDM firmware verifies whether the EEPROM and Flash memory are erased. If any EEPROM or Flash memory address is not erased, only BDM hardware commands are enabled. BDM hardware commands can then be used to write to the EEPROM and Flash registers to mass erase the EEPROM and all Flash memory blocks. When next reset into special single chip mode, the BDM firmware will again verify whether all EEPROM and Flash memory are erased, and this being the case, will enable all BDM commands, allowing the Flash options/security byte to be programmed to the unsecured value. The security bits SEC[1:0] in the Flash security register will indicate the unsecure state following the next reset. MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 351 Chapter 9 Security (S12XE9SECV2) MC9S12XE-Family Reference Manual Rev. 1.25 352 Freescale Semiconductor Chapter 10 XGATE (S12XGATEV3) Table 10-1. Revision History Revision Number V03.22 06 Oct 2005 V03.23 14 Dec 2005 V03.24 17 Jan 2006 10.1 Sections Affected Revision Date Description of Changes - Internal updates 10.9.2/10-463 - Updated code example - Internal updates Introduction The XGATE module is a peripheral co-processor that allows autonomous data transfers between the MCU’s peripherals and the internal memories. It has a built in RISC core that is able to pre-process the transferred data and perform complex communication protocols. The XGATE module is intended to increase the MCU’s data throughput by lowering the S12X_CPU’s interrupt load. Figure 10-1 gives an overview on the XGATE architecture. This document describes the functionality of the XGATE module, including: • XGATE registers (Section 10.3, “Memory Map and Register Definition”) • XGATE RISC core (Section 10.4.1, “XGATE RISC Core”) • Hardware semaphores (Section 10.4.4, “Semaphores”) • Interrupt handling (Section 10.5, “Interrupts”) • Debug features (Section 10.6, “Debug Mode”) • Security (Section 10.7, “Security”) • Instruction set (Section 10.8, “Instruction Set”) 10.1.1 Glossary of Terms XGATE Request A service request from a peripheral module which is directed to the XGATE by the S12X_INT module (see Figure 10-1). Each XGATE request attempts to activate a XGATE channel at a certain priority level. XGATE Channel The resources in the XGATE module (i.e. Channel ID number, Priority level, Service Request Vector, Interrupt Flag) which are associated with a particular XGATE Request. MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 353 Chapter 10 XGATE (S12XGATEV3) XGATE Channel ID A 7-bit identifier associated with an XGATE channel. In S12XE designs valid Channel IDs range from $0D to $78. XGATE Priority Level A priority ranging from 1 to 7 which is associated with an XGATE channel. The priority level of an XGATE channel is selected in the S12X_INT module. XGATE Register Bank A register bank consists of registers R1-R7, CCR and the PC. Each interrupt level is associated with one register bank. XGATE Channel Interrupt An S12X_CPU interrupt that is triggered by a code sequence running on the XGATE module. XGATE Software Channel Special XGATE channel that is not associated with any peripheral service request. A Software Channel is triggered by its Software Trigger Bit which is implemented in the XGATE module. XGATE Semaphore A set of hardware flip-flops that can be exclusively set by either the S12X_CPU or the XGATE. (see Section 10.4.4, “Semaphores”) XGATE Thread A code sequence which is executed by the XGATE’s RISC core after receiving an XGATE request. XGATE Debug Mode A special mode in which the XGATE’s RISC core is halted for debug purposes. This mode enables the XGATE’s debug features (see Section 10.6, “Debug Mode”). XGATE Software Error The XGATE is able to detect a number of error conditions caused by erratic software (see Section 10.4.5, “Software Error Detection”). These error conditions will cause the XGATE to seize program execution and flag an Interrupt to the S12X_CPU. Word A 16 bit entity. Byte An 8 bit entity. 10.1.2 Features The XGATE module includes these features: • Data movement between various targets (i.e. Flash, RAM, and peripheral modules) • Data manipulation through built in RISC core MC9S12XE-Family Reference Manual Rev. 1.25 354 Freescale Semiconductor Chapter 10 XGATE (S12XGATEV3) • • • • • • Provides up to 108 XGATE channels, including 8 software triggered channels Interruptible thread execution Two register banks to support fast context switching between threads Hardware semaphores which are shared between the S12X_CPU and the XGATE module Able to trigger S12X_CPU interrupts upon completion of an XGATE transfer Software error detection to catch erratic application code 10.1.3 Modes of Operation There are four run modes on S12XE devices. • • Run mode, wait mode, stop mode The XGATE is able to operate in all of these three system modes. Clock activity will be automatically stopped when the XGATE module is idle. Freeze mode (BDM active) In freeze mode all clocks of the XGATE module may be stopped, depending on the module configuration (see Section 10.3.1.1, “XGATE Control Register (XGMCTL)”). 10.1.4 Block Diagram Figure 10-1 shows a block diagram of the XGATE. Peripheral Interrupts XGATE Requests XGATE XGATE Interrupts (XGIF) S12X_INT Interrupt Flags Semaphores RISC Core Software Triggers Software Triggers SWE Interrupt Data/Code Software Error Logic S12X_DBG Peripherals S12X_MMC Figure 10-1. XGATE Block Diagram MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 355 Chapter 10 XGATE (S12XGATEV3) 10.2 External Signal Description The XGATE module has no external pins. 10.3 Memory Map and Register Definition This section provides a detailed description of address space and registers used by the XGATE module. The memory map for the XGATE module is given below in Figure 10-2.The address listed for each register is the sum of a base address and an address offset. The base address is defined at the SoC level and the address offset is defined at the module level. Reserved registers read zero. Write accesses to the reserved registers have no effect. 10.3.1 Register Descriptions This section consists of register descriptions in address order. Each description includes a standard register diagram with an associated figure number. Details of register bits and field functions follow the register diagrams, in bit order. Register Name 0x0000 R XGMCTL 15 14 13 12 11 10 9 8 0 0 0 0 0 0 0 0 XG XG XG XGEM XGSSM W FRZM DBGM FACTM XG SWEFM XGIEM 7 6 5 4 XGE XGFRZ XGDBG XGSS 3 XG FACT 0x0002 R XGCHID W 0 0x0003 R XGCHPL W 0 0 0 0 0 0 0 0 0 0 2 0 1 0 XG XGIE SWEF XGCHID[6:0] XGCHPL[2:0] 0x0004 R Reserved W 0x0005 R XGISPSEL W 0x0006 R XGISP74 W XGISP74[15:1] 0x0006 R XGISP31 W XGISP31[15:1] 0x0006 XGVBR R XGVBR[15:1] W 0 XGISPSEL[1:0] 0 0 0 = Unimplemented or Reserved Figure 10-2. XGATE Register Summary (Sheet 1 of 3) MC9S12XE-Family Reference Manual Rev. 1.25 356 Freescale Semiconductor Chapter 10 XGATE (S12XGATEV3) 0x0008 XGIF R 127 126 125 124 123 122 121 0 0 0 0 0 0 0 W 113 112 110 109 108 107 106 105 104 103 102 101 100 99 98 97 96 94 93 92 91 90 89 88 87 86 85 84 83 82 81 80 78 77 76 75 74 73 72 71 70 69 68 67 66 65 64 XGIF_4F XGIF_4E XGIF_4D XGIF_4C XGIF_4B XGIF_4A XGIF_49 XGIF_48 XGF _47 XGIF_46 XGIF_45 XGIF_44 XGIF_43 XGIF_42 XGIF_41 XGIF_40 62 61 60 59 58 57 56 55 54 53 52 51 50 49 48 R W XGIF_3F XGIF_3E XGIF_3D XGIF_3C XGIF_3B XGIF_3A XGIF_39 XGIF_38 XGF _37 XGIF_36 XGIF_35 XGIF_34 XGIF_33 XGIF_32 XGIF_31 XGIF_30 46 45 44 43 42 41 40 39 38 37 36 35 34 33 32 R W XGIF_2F XGIF_2E XGIF_2D XGIF_2C XGIF_2B XGIF_2A XGIF_29 XGIF_28 XGF _27 XGIF_26 XGIF_25 XGIF_24 XGIF_23 XGIF_22 XGIF_21 XGIF_20 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 R W XGIF_1F XGIF_1E XGIF_1D XGIF_1C XGIF_1B XGIF_1A XGIF_19 XGIF_18 XGF _17 XGIF_16 XGIF_15 XGIF_14 XGIF_13 XGIF_12 XGIF_11 XGIF_10 15 0x0016 XGIF 114 R 31 0x0014 XGIF 115 XGIF_5F XGIF_5E XGIF_5D XGIF_5C XGIF_5B XGIF_5A XGIF_59 XGIF_58 XGF_57 XGIF_56 XGIF_55 XGIF_54 XGIF_53 XGIF_52 XGIF_51 XGIF_50 47 0x0012 XGIF 116 R W 63 0x0010 XGIF 117 XGIF_6F XGIF_6E XGIF_6D XGIF_6C XGIF_6B XGIF_6A XGIF_69 XGIF_68 XGF_67 XGIF_66 XGIF_65 XGIF_64 XGIF_63 XGIF_62 XGIF_61 XGIF_60 79 0x000E XGIF 118 R W 95 0x000C XGIF 119 XGIF_78 XGF_77 XGIF_76 XGIF_75 XGIF_74 XGIF_73 XGIF_72 XGIF_71 XGIF_70 W 111 0x000A XGIF 120 14 13 R W 12 11 10 9 8 7 6 5 4 3 2 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 XGIF_0F XGIF_0E XGIF_0D = Unimplemented or Reserved Figure 10-2. XGATE Register Summary (Sheet 2 of 3) MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 357 Chapter 10 XGATE (S12XGATEV3) 15 14 13 0x0018 R XGSWTM W 0 0 0 0x001A R XGSEMM W 0 12 11 10 9 8 0 0 0 0 0 0 0 0 7 6 5 0 0 0 3 2 1 0 XGSWT[7:0] XGSWTM[7:0] 0 4 XGSEM[7:0] XGSEMM[7:0] 0x001C R Reserved W 0x001D XGCCR 0x001E XGPC R 0 0 0 0 W R XGN XGZ XGV XGC XGPC W 0x0020 R Reserved W 0x0021 R Reserved W 0x0022 XGR1 0x0024 XGR2 R R XGR2 W 0x0026 XGR3 W 0x0028 XGR4 W 0x002A XGR5 XGR1 W R XGR3 R XGR4 R XGR5 W 0x002C XGR6 R W 0x002E XGR7 W XGR6 R XGR7 = Unimplemented or Reserved Figure 10-2. XGATE Register Summary (Sheet 3 of 3) MC9S12XE-Family Reference Manual Rev. 1.25 358 Freescale Semiconductor Chapter 10 XGATE (S12XGATEV3) 10.3.1.1 XGATE Control Register (XGMCTL) All module level switches and flags are located in the XGATE Module Control Register Figure 10-3. Module Base +0x00000 15 14 13 12 11 10 9 8 0 0 0 0 0 0 0 0 XG SSM XG FACTM 0 0 R W XGEM Reset 0 XG XG FRZM DBGM 0 0 7 0 0 5 4 3 2 0 XG XGIEM SWEFM 0 6 XGE XGFRZ XGDBG XGSS XGFACT 0 0 0 0 0 0 1 0 XG SWEF XGIE 0 0 = Unimplemented or Reserved Figure 10-3. XGATE Control Register (XGMCTL) Read: Anytime Write: Anytime Table 10-2. XGMCTL Field Descriptions (Sheet 1 of 3) Field Description 15 XGEM XGE Mask — This bit controls the write access to the XGE bit. The XGE bit can only be set or cleared if a "1" is written to the XGEM bit in the same register access. Read: This bit will always read "0". Write: 0 Disable write access to the XGE in the same bus cycle 1 Enable write access to the XGE in the same bus cycle 14 XGFRZM XGFRZ Mask — This bit controls the write access to the XGFRZ bit. The XGFRZ bit can only be set or cleared if a "1" is written to the XGFRZM bit in the same register access. Read: This bit will always read "0". Write: 0 Disable write access to the XGFRZ in the same bus cycle 1 Enable write access to the XGFRZ in the same bus cycle 13 XGDBGM XGDBG Mask — This bit controls the write access to the XGDBG bit. The XGDBG bit can only be set or cleared if a "1" is written to the XGDBGM bit in the same register access. Read: This bit will always read "0". Write: 0 Disable write access to the XGDBG in the same bus cycle 1 Enable write access to the XGDBG in the same bus cycle 12 XGSSM XGSS Mask — This bit controls the write access to the XGSS bit. The XGSS bit can only be set or cleared if a "1" is written to the XGSSM bit in the same register access. Read: This bit will always read "0". Write: 0 Disable write access to the XGSS in the same bus cycle 1 Enable write access to the XGSS in the same bus cycle MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 359 Chapter 10 XGATE (S12XGATEV3) Table 10-2. XGMCTL Field Descriptions (Sheet 2 of 3) Field 11 XGFACTM Description XGFACT Mask — This bit controls the write access to the XGFACT bit. The XGFACT bit can only be set or cleared if a "1" is written to the XGFACTM bit in the same register access. Read: This bit will always read "0". Write: 0 Disable write access to the XGFACT in the same bus cycle 1 Enable write access to the XGFACT in the same bus cycle 9 XGSWEF Mask — This bit controls the write access to the XGSWEF bit. The XGSWEF bit can only be cleared XGSWEFM if a "1" is written to the XGSWEFM bit in the same register access. Read: This bit will always read "0". Write: 0 Disable write access to the XGSWEF in the same bus cycle 1 Enable write access to the XGSWEF in the same bus cycle 8 XGIEM XGIE Mask — This bit controls the write access to the XGIE bit. The XGIE bit can only be set or cleared if a "1" is written to the XGIEM bit in the same register access. Read: This bit will always read "0". Write: 0 Disable write access to the XGIE in the same bus cycle 1 Enable write access to the XGIE in the same bus cycle 7 XGE XGATE Module Enable (Request Enable)— This bit enables incoming XGATE requests from the S12X_INT module. If the XGE bit is cleared, pending XGATE requests will be ignored. The thread that is executed by the RISC core while the XGE bit is cleared will continue to run. Read: 0 Incoming requests are disabled 1 Incoming requests are enabled Write: 0 Disable incoming requests 1 Enable incoming requests 6 XGFRZ Halt XGATE in Freeze Mode — The XGFRZ bit controls the XGATE operation in Freeze Mode (BDM active). Read: 0 RISC core operates normally in Freeze (BDM active) 1 RISC core stops in Freeze Mode (BDM active) Write: 0 Don’t stop RISC core in Freeze Mode (BDM active) 1 Stop RISC core in Freeze Mode (BDM active) 5 XGDBG XGATE Debug Mode — This bit indicates that the XGATE is in Debug Mode (see Section 10.6, “Debug Mode”). Debug Mode can be entered by Software Breakpoints (BRK instruction), Tagged or Forced Breakpoints (see S12X_DBG Section), or by writing a "1" to this bit. Read: 0 RISC core is not in Debug Mode 1 RISC core is in Debug Mode Write: 0 Leave Debug Mode 1 Enter Debug Mode Note: Freeze Mode and Software Error Interrupts have no effect on the XGDBG bit. MC9S12XE-Family Reference Manual Rev. 1.25 360 Freescale Semiconductor Chapter 10 XGATE (S12XGATEV3) Table 10-2. XGMCTL Field Descriptions (Sheet 3 of 3) Field 4 XGSS Description XGATE Single Step — This bit forces the execution of a single instruction.(1) Read: 0 No single step in progress 1 Single step in progress Write 0 No effect 1 Execute a single RISC instruction Note: Invoking a Single Step will cause the XGATE to temporarily leave Debug Mode until the instruction has been executed. 3 XGFACT Fake XGATE Activity — This bit forces the XGATE to flag activity to the MCU even when it is idle. When it is set the MCU will never enter system stop mode which assures that peripheral modules will be clocked during XGATE idle periods Read: 0 XGATE will only flag activity if it is not idle or in debug mode. 1 XGATE will always signal activity to the MCU. Write: 0 Only flag activity if not idle or in debug mode. 1 Always signal XGATE activity. 1 XGSWEF XGATE Software Error Flag — This bit signals a software error. It is set whenever the RISC core detects an error condition(2). The RISC core is stopped while this bit is set. Clearing this bit will terminate the current thread and cause the XGATE to become idle. Read: 0 No software error detected 1 Software error detected Write: 0 No effect 1 Clears the XGSWEF bit 0 XGIE XGATE Interrupt Enable — This bit acts as a global interrupt enable for the XGATE module Read: 0 All outgoing XGATE interrupts disabled (except software error interrupts) 1 All outgoing XGATE interrupts enabled Write: 0 Disable all outgoing XGATE interrupts (except software error interrupts) 1 Enable all outgoing XGATE interrupts 1. Refer to Section 10.6.1, “Debug Features” 2. Refer to Section 10.4.5, “Software Error Detection” 10.3.1.2 XGATE Channel ID Register (XGCHID) The XGATE Channel ID Register (Figure 10-4) shows the identifier of the XGATE channel that is currently active. This register will read “$00” if the XGATE module is idle. In debug mode this register can be used to start and terminate threads. Refer to Section 10.6.1, “Debug Features” for further information. MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 361 Chapter 10 XGATE (S12XGATEV3) Module Base +0x0002 7 R 6 5 4 0 3 2 1 0 0 0 0 XGCHID[6:0] W Reset 0 0 0 0 0 = Unimplemented or Reserved Figure 10-4. XGATE Channel ID Register (XGCHID) Read: Anytime Write: In Debug Mode1 Table 10-3. XGCHID Field Descriptions Field Description 6–0 Request Identifier — ID of the currently active channel XGCHID[6:0] 10.3.1.3 XGATE Channel Priority Level (XGCHPL) The XGATE Channel Priority Level Register (Figure 10-5) shows the priority level of the current thread. In debug mode this register can be used to select a priority level when launching a thread (see Section 10.6.1, “Debug Features”). Module Base +0x0003 R 7 6 5 4 3 0 0 0 0 0 0 0 0 0 2 1 0 XGCHPL[2:0] W Reset 0 0 0 0 = Unimplemented or Reserved Figure 10-5. XGATE Channel Priority Level Register (XGCHPL) Read: Anytime Write: In Debug Mode1 Table 10-4. XGCHPL Field Descriptions Field 2-0 XGCHPL[2:0] 10.3.1.4 Description Priority Level— Priority level of the currently active channel XGATE Initial Stack Pointer Select Register (XGISPSEL) The XGATE Initial Stack Pointer Select Register (Figure 10-6) determines the register which is mapped to address “Module Base +0x0006”. A value of zero selects the Vector Base Register (XGVBR). Setting 1. Refer to Section 10.6.1, “Debug Features” MC9S12XE-Family Reference Manual Rev. 1.25 362 Freescale Semiconductor Chapter 10 XGATE (S12XGATEV3) this register to a channel priority level (non-zero value) selects the corresponding Initial Stack Pointer Registers XGISP74 or XGISP31 (see Table 10-6). Module Base +0x0005 R 7 6 5 4 3 2 0 0 0 0 0 0 0 0 0 0 0 1 XGISPSEL[1:0] W Reset 0 0 0 0 = Unimplemented or Reserved Figure 10-6. XGATE Initial Stack Pointer Select Register (XGISPSEL) Read: Anytime Write: Anytime Table 10-5. XGISPSEL Field Descriptions Field Description 1-0 Register select— Determines whether XGISP74, XGISP31, or XGVBR is mapped to “Module Base +0x0006”. XGISPSEL[1:0] See Table 10-6. Table 10-6. XGISP74, XGISP31, XGVBR Mapping 10.3.1.5 XGISPSEL[1:0] Register Mapped to “Module Base +0x0006“ 3 Reserved 2 XGISP74 1 XGISP31 0 XGVBR XGATE Initial Stack Pointer for Interrupt Priorities 7 to 4 (XGISP74) The XGISP74 register is intended to point to the stack region that is used by XGATE channels of priority 7 to 4. Every time a thread of such priority is started, RISC core register R7 will be initialized with the content of XGISP74. Module Base +0x0006 15 14 13 12 11 10 R 8 7 6 5 4 3 2 1 0 0 0 0 0 0 0 0 0 0 0 XGISP74[15:1] W Reset 9 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 10-7. XGATE Initial Stack Pointer for Interrupt Priorities 7 to 4 (XGISP74) Read: Anytime Write: Only if XGATE requests are disabled (XGE = 0) and idle (XGCHID = $00)) MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 363 Chapter 10 XGATE (S12XGATEV3) Table 10-7. XGISP74 Field Descriptions Field 15–1 XBISP74[15:1] 10.3.1.6 Description Initial Stack Pointer— The XGISP74 register holds the initial value of RISC core register R7, for threads of priority 7 to 4. XGATE Initial Stack Pointer for Interrupt Priorities 3 to 1 (XGISP31) The XGISP31 register is intended to point to the stack region that is used by XGATE channels of priority 3 to 1. Every time a thread of such priority is started, RISC core register R7 will be initialized with the content of XGISP31. Module Base +0x0006 15 14 13 12 11 10 R 8 7 6 5 4 3 2 1 0 0 0 0 0 0 0 0 0 0 0 XGISP31[15:1] W Reset 9 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 10-8. XGATE Initial Stack Pointer for Interrupt Priorities 3 to 1 (XGISP31) Read: Anytime Write: Only if XGATE requests are disabled (XGE = 0) and idle (XGCHID = $00)) Table 10-8. XGISP31 Field Descriptions Field 15–1 XBISP31[15:1] 10.3.1.7 Description Initial Stack Pointer— The XGISP31 register holds the initial value of RISC core register R7, for threads of priority 3 to 1. XGATE Vector Base Address Register (XGVBR) The Vector Base Address Register (Figure 10-9) determines the location of the XGATE vector block (see Section Figure 10-23., “XGATE Vector Block). Module Base +0x0006 15 14 13 12 11 10 9 R 7 6 5 4 3 2 1 1 1 1 1 1 1 1 0 0 0 XGVBR[15:1] W Reset 8 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 10-9. XGATE Vector Base Address Register (XGVBR) Read: Anytime Write: Only if XGATE requests are disabled (XGE = 0) and idle (XGCHID = $00)) MC9S12XE-Family Reference Manual Rev. 1.25 364 Freescale Semiconductor Chapter 10 XGATE (S12XGATEV3) Table 10-9. XGVBR Field Descriptions Field Description 15–1 Vector Base Address — The XGVBR register holds the start address of the vector block in the XGATE XBVBR[15:1] memory map. 10.3.1.8 XGATE Channel Interrupt Flag Vector (XGIF) The XGATE Channel Interrupt Flag Vector (Figure 10-10) provides access to the interrupt flags of all channels. Each flag may be cleared by writing a "1" to its bit location. Refer to Section 10.5.2, “Outgoing Interrupt Requests” for further information. Module Base +0x0008 R 127 126 125 124 123 122 121 0 0 0 0 0 0 0 120 119 XGIF_78 XGF_77 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 111 110 109 108 107 106 105 104 103 102 101 100 99 98 97 96 W Reset R W Reset R W Reset R W Reset XGIF_6F XGIF_6E XGIF_6D XGIF_6C XGIF_6B XGIF_6A XGIF_69 XGIF_68 XGF_67 118 117 116 115 114 113 112 XGIF_76 XGIF_75 XGIF_74 XGIF_73 XGIF_72 XGIF_71 XGIF_70 XGIF_66 XGIF_65 XGIF_64 XGIF_63 XGIF_62 XGIF_61 XGIF_60 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 95 94 93 92 91 90 89 88 87 86 85 84 83 82 81 80 XGIF_5F XGIF_5E XGIF_5D XGIF_5C XGIF_5B XGIF_5A XGIF_59 XGIF_58 XGF_57 XGIF_56 XGIF_55 XGIF_54 XGIF_53 XGIF_52 XGIF_51 XGIF_50 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 79 78 77 76 75 74 73 72 71 70 69 68 67 66 65 64 XGIF_4F XGIF_4E XGIF_4D XGIF_4C XGIF_4B XGIF_4A XGIF_49 XGIF_48 XGF _47 XGIF_46 XGIF_45 XGIF_44 XGIF_43 XGIF_42 XGIF_41 XGIF_40 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Figure 10-10. XGATE Channel Interrupt Flag Vector (XGIF) MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 365 Chapter 10 XGATE (S12XGATEV3) 63 R W 62 0 47 W Reset R W Reset R W Reset 60 59 58 57 56 55 54 53 52 51 50 49 48 XGIF_3F XGIF_3E XGIF_3D XGIF_3C XGIF_3B XGIF_3A XGIF_39 XGIF_38 XGF _37 XGIF_36 XGIF_35 XGIF_34 XGIF_33 XGIF_32 XGIF_31 XGIF_30 Reset R 61 0 46 0 45 0 44 0 43 0 42 0 41 0 40 0 39 0 38 0 37 0 36 0 35 0 34 0 33 0 32 XGIF_2F XGIF_2E XGIF_2D XGIF_2C XGIF_2B XGIF_2A XGIF_29 XGIF_28 XGF _27 XGIF_26 XGIF_25 XGIF_24 XGIF_23 XGIF_22 XGIF_21 XGIF_20 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 XGIF_1F XGIF_1E XGIF_1D XGIF_1C XGIF_1B XGIF_1A XGIF_19 XGIF_18 XGF _17 XGIF_16 XGIF_15 XGIF_14 XGIF_13 XGIF_12 XGIF_11 XGIF_10 0 0 0 0 0 0 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 XGIF_0F XGIF_0E XGIF_0D 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 10-10. XGATE Channel Interrupt Flag Vector (XGIF) (continued) Read: Anytime Write: Anytime Table 10-10. XGIV Field Descriptions Field Description 127–9 XGIF[78:9] Channel Interrupt Flags — These bits signal pending channel interrupts. They can only be set by the RISC core (see SIF instruction on page 10-449). Each flag can be cleared by writing a "1" to its bit location. Unimplemented interrupt flags will always read "0". Section “Interrupts” of the device overview for a list of implemented Interrupts. Read: 0 Channel interrupt is not pending 1 Channel interrupt is pending if XGIE is set Write: 0 No effect 1 Clears the interrupt flag MC9S12XE-Family Reference Manual Rev. 1.25 366 Freescale Semiconductor Chapter 10 XGATE (S12XGATEV3) NOTE Suggested Mnemonics for accessing the interrupt flag vector on a word basis are: XGIF_7F_70 (XGIF[127:112]), XGIF_6F_60 (XGIF[111:96]), XGIF_5F_50 (XGIF[95:80]), XGIF_4F_40 (XGIF[79:64]), XGIF_3F_30 (XGIF[63:48]), XGIF_2F_20 (XGIF[47:32]), XGIF_1F_10 (XGIF[31:16]), XGIF_0F_00 (XGIF[15:0]) 10.3.1.9 XGATE Software Trigger Register (XGSWT) The eight software triggers of the XGATE module can be set and cleared through the XGATE Software Trigger Register (Figure 10-11). The upper byte of this register, the software trigger mask, controls the write access to the lower byte, the software trigger bits. These bits can be set or cleared if a "1" is written to the associated mask in the same bus cycle. Refer to Section 10.5.2, “Outgoing Interrupt Requests” for further information. Module Base +0x00018 R 15 14 13 12 11 10 9 8 0 0 0 0 0 0 0 0 0 0 0 6 5 0 0 0 0 0 4 3 2 1 0 0 0 0 XGSWT[7:0] XGSWTM[7:0] W Reset 7 0 0 0 0 0 Figure 10-11. XGATE Software Trigger Register (XGSWT) Read: Anytime Write: Anytime MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 367 Chapter 10 XGATE (S12XGATEV3) Table 10-11. XGSWT Field Descriptions Field Description 15–8 Software Trigger Mask — These bits control the write access to the XGSWT bits. Each XGSWT bit can only XGSWTM[7:0] be written if a "1" is written to the corresponding XGSWTM bit in the same access. Read: These bits will always read "0". Write: 0 Disable write access to the XGSWT in the same bus cycle 1 Enable write access to the corresponding XGSWT bit in the same bus cycle 7–0 XGSWT[7:0] Software Trigger Bits — These bits act as interrupt flags that are able to trigger XGATE software channels. They can only be set and cleared by software. Read: 0 No software trigger pending 1 Software trigger pending if the XGIE bit is set Write: 0 Clear Software Trigger 1 Set Software Trigger NOTE The XGATE channel IDs that are associated with the eight software triggers are determined on chip integration level. (see Section “Interrupts“ of the device overview) XGATE software triggers work like any peripheral interrupt. They can be used as XGATE requests as well as S12X_CPU interrupts. The target of the software trigger must be selected in the S12X_INT module. 10.3.1.10 XGATE Semaphore Register (XGSEM) The XGATE provides a set of eight hardware semaphores that can be shared between the S12X_CPU and the XGATE RISC core. Each semaphore can either be unlocked, locked by the S12X_CPU or locked by the RISC core. The RISC core is able to lock and unlock a semaphore through its SSEM and CSEM instructions. The S12X_CPU has access to the semaphores through the XGATE Semaphore Register (Figure 10-12). Refer to section Section 10.4.4, “Semaphores” for details. Module Base +0x0001A R 15 14 13 12 11 10 9 8 0 0 0 0 0 0 0 0 0 0 0 W Reset 7 6 5 0 0 0 0 3 2 1 0 0 0 0 XGSEM[7:0] XGSEMM[7:0] 0 4 0 0 0 0 0 Figure 10-12. XGATE Semaphore Register (XGSEM) Read: Anytime Write: Anytime (see Section 10.4.4, “Semaphores”) MC9S12XE-Family Reference Manual Rev. 1.25 368 Freescale Semiconductor Chapter 10 XGATE (S12XGATEV3) Table 10-12. XGSEM Field Descriptions Field Description 15–8 Semaphore Mask — These bits control the write access to the XGSEM bits. XGSEMM[7:0] Read: These bits will always read "0". Write: 0 Disable write access to the XGSEM in the same bus cycle 1 Enable write access to the XGSEM in the same bus cycle 7–0 XGSEM[7:0] Semaphore Bits — These bits indicate whether a semaphore is locked by the S12X_CPU. A semaphore can be attempted to be set by writing a "1" to the XGSEM bit and to the corresponding XGSEMM bit in the same write access. Only unlocked semaphores can be set. A semaphore can be cleared by writing a "0" to the XGSEM bit and a "1" to the corresponding XGSEMM bit in the same write access. Read: 0 Semaphore is unlocked or locked by the RISC core 1 Semaphore is locked by the S12X_CPU Write: 0 Clear semaphore if it was locked by the S12X_CPU 1 Attempt to lock semaphore by the S12X_CPU 10.3.1.11 XGATE Condition Code Register (XGCCR) The XGCCR register (Figure 10-13) provides access to the RISC core’s condition code register. Module Base +0x001D R 7 6 5 4 0 0 0 0 0 0 0 0 W Reset 3 2 1 0 XGN XGZ XGV XGC 0 0 0 0 = Unimplemented or Reserved Figure 10-13. XGATE Condition Code Register (XGCCR) Read: In debug mode if unsecured and not idle (XGCHID ≠ 0x00) Write: In debug mode if unsecured and not idle (XGCHID ≠ 0x00) Table 10-13. XGCCR Field Descriptions Field Description 3 XGN Sign Flag — The RISC core’s Sign flag 2 XGZ Zero Flag — The RISC core’s Zero flag 1 XGV Overflow Flag — The RISC core’s Overflow flag 0 XGC Carry Flag — The RISC core’s Carry flag MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 369 Chapter 10 XGATE (S12XGATEV3) 10.3.1.12 XGATE Program Counter Register (XGPC) The XGPC register (Figure 10-14) provides access to the RISC core’s program counter. Module Base +0x0001E 15 14 13 12 11 10 9 8 R 6 5 4 3 2 1 0 0 0 0 0 0 0 0 0 XGPC W Reset 7 0 0 0 0 0 0 0 0 Figure 10-14. XGATE Program Counter Register (XGPC) Read: In debug mode if unsecured and not idle (XGCHID ≠ 0x00) Write: In debug mode if unsecured and not idle (XGCHID ≠ 0x00) Table 10-14. XGPC Field Descriptions Field 15–0 XGPC[15:0] Description Program Counter — The RISC core’s program counter 10.3.1.13 XGATE Register 1 (XGR1) The XGR1 register (Figure 10-15) provides access to the RISC core’s register 1. Module Base +0x00022 15 14 13 12 11 10 9 8 R 6 5 4 3 2 1 0 0 0 0 0 0 0 0 0 XGR1 W Reset 7 0 0 0 0 0 0 0 0 Figure 10-15. XGATE Register 1 (XGR1) Read: In debug mode if unsecured and not idle (XGCHID ≠ 0x00) Write: In debug mode if unsecured and not idle (XGCHID ≠ 0x00) Table 10-15. XGR1 Field Descriptions Field 15–0 XGR1[15:0] Description XGATE Register 1 — The RISC core’s register 1 MC9S12XE-Family Reference Manual Rev. 1.25 370 Freescale Semiconductor Chapter 10 XGATE (S12XGATEV3) 10.3.1.14 XGATE Register 2 (XGR2) The XGR2 register (Figure 10-16) provides access to the RISC core’s register 2. Module Base +0x00024 15 14 13 12 11 10 9 8 R 6 5 4 3 2 1 0 0 0 0 0 0 0 0 0 XGR2 W Reset 7 0 0 0 0 0 0 0 0 Figure 10-16. XGATE Register 2 (XGR2) Read: In debug mode if unsecured and not idle (XGCHID ≠ 0x00) Write: In debug mode if unsecured and not idle (XGCHID ≠ 0x00) Table 10-16. XGR2 Field Descriptions Field 15–0 XGR2[15:0] Description XGATE Register 2 — The RISC core’s register 2 10.3.1.15 XGATE Register 3 (XGR3) The XGR3 register (Figure 10-17) provides access to the RISC core’s register 3. Module Base +0x00026 15 14 13 12 11 10 9 8 R 6 5 4 3 2 1 0 0 0 0 0 0 0 0 0 XGR3 W Reset 7 0 0 0 0 0 0 0 0 Figure 10-17. XGATE Register 3 (XGR3) Read: In debug mode if unsecured and not idle (XGCHID ≠ 0x00) Write: In debug mode if unsecured and not idle (XGCHID ≠ 0x00) Table 10-17. XGR3 Field Descriptions Field 15–0 XGR3[15:0] Description XGATE Register 3 — The RISC core’s register 3 MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 371 Chapter 10 XGATE (S12XGATEV3) 10.3.1.16 XGATE Register 4 (XGR4) The XGR4 register (Figure 10-18) provides access to the RISC core’s register 4. Module Base +0x00028 15 14 13 12 11 10 9 8 R 6 5 4 3 2 1 0 0 0 0 0 0 0 0 0 XGR4 W Reset 7 0 0 0 0 0 0 0 0 Figure 10-18. XGATE Register 4 (XGR4) Read: In debug mode if unsecured and not idle (XGCHID ≠ 0x00) Write: In debug mode if unsecured and not idle (XGCHID ≠ 0x00) Table 10-18. XGR4 Field Descriptions Field 15–0 XGR4[15:0] Description XGATE Register 4 — The RISC core’s register 4 10.3.1.17 XGATE Register 5 (XGR5) The XGR5 register (Figure 10-19) provides access to the RISC core’s register 5. Module Base +0x0002A 15 14 13 12 11 10 9 8 R 6 5 4 3 2 1 0 0 0 0 0 0 0 0 0 XGR5 W Reset 7 0 0 0 0 0 0 0 0 Figure 10-19. XGATE Register 5 (XGR5) Read: In debug mode if unsecured and not idle (XGCHID ≠ 0x00) Write: In debug mode if unsecured and not idle (XGCHID ≠ 0x00) Table 10-19. XGR5 Field Descriptions Field 15–0 XGR5[15:0] Description XGATE Register 5 — The RISC core’s register 5 MC9S12XE-Family Reference Manual Rev. 1.25 372 Freescale Semiconductor Chapter 10 XGATE (S12XGATEV3) 10.3.1.18 XGATE Register 6 (XGR6) The XGR6 register (Figure 10-20) provides access to the RISC core’s register 6. Module Base +0x0002C 15 14 13 12 11 10 9 8 R 6 5 4 3 2 1 0 0 0 0 0 0 0 0 0 XGR6 W Reset 7 0 0 0 0 0 0 0 0 Figure 10-20. XGATE Register 6 (XGR6) Read: In debug mode if unsecured and not idle (XGCHID ≠ 0x00) Write: In debug mode if unsecured and not idle (XGCHID ≠ 0x00) Table 10-20. XGR6 Field Descriptions Field Description 15–0 XGR6[15:0] XGATE Register 6 — The RISC core’s register 6 10.3.1.19 XGATE Register 7 (XGR7) The XGR7 register (Figure 10-21) provides access to the RISC core’s register 7. Module Base +0x0002E 15 14 13 12 11 10 9 8 R 6 5 4 3 2 1 0 0 0 0 0 0 0 0 0 XGR7 W Reset 7 0 0 0 0 0 0 0 0 Figure 10-21. XGATE Register 7 (XGR7) Read: In debug mode if unsecured and not idle (XGCHID ≠ 0x00) Write: In debug mode if unsecured and not idle (XGCHID ≠ 0x00) Table 10-21. XGR7 Field Descriptions Field Description 15–0 XGR7[15:0] 10.4 XGATE Register 7 — The RISC core’s register 7 Functional Description The core of the XGATE module is a RISC processor which is able to access the MCU’s internal memories and peripherals (see Figure 10-1). The RISC processor always remains in an idle state until it is triggered by an XGATE request. Then it executes a code sequence (thread) that is associated with the requested XGATE channel. Each thread can run on a priority level ranging from 1 to 7. Refer to the S12X_INT MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 373 Chapter 10 XGATE (S12XGATEV3) Section for information on how to select priority levels for XGATE threads. Low priority threads (interrupt levels 1 to 3) can be interrupted by high priority threads (interrupt levels 4 to 7). High priority threads are not interruptible. The register content of an interrupted thread is maintained and restored by the XGATE hardware. To signal the completion of a task the XGATE is able to send interrupts to the S12X_CPU. Each XGATE channel has its own interrupt vector. Refer to the S12X_INT Section for detailed information. The XGATE module also provides a set of hardware semaphores which are necessary to ensure data consistency whenever RAM locations or peripherals are shared with the S12X_CPU. The following sections describe the components of the XGATE module in further detail. 10.4.1 XGATE RISC Core The RISC core is a 16 bit processor with an instruction set that is well suited for data transfers, bit manipulations, and simple arithmetic operations (see Section 10.8, “Instruction Set”). It is able to access the MCU’s internal memories and peripherals without blocking these resources from the S12X_CPU1. Whenever the S12X_CPU and the RISC core access the same resource, the RISC core will be stalled until the resource becomes available again.1 The XGATE offers a high access rate to the MCU’s internal RAM. Depending on the bus load, the RISC core can perform up to two RAM accesses per S12X_CPU bus cycle. Bus accesses to peripheral registers or flash are slower. A transfer rate of one bus access per S12X_CPU cycle can not be exceeded. The XGATE module is intended to execute short interrupt service routines that are triggered by peripheral modules or by software. 10.4.2 Programmer’s Model Register Block 15 15 R7 (Stack Pointer) R6 15 R5 15 R4 15 R3 15 R2 15 R1(Data Pointer) 15 R0 = 0 Program Counter 0 15 PC 0 0 0 0 0 Condition Code Register NZVC 3 2 1 0 0 0 0 Figure 10-22. Programmer’s Model 1. With the exception of PRR registers (see Section “S12X_MMC”). MC9S12XE-Family Reference Manual Rev. 1.25 374 Freescale Semiconductor Chapter 10 XGATE (S12XGATEV3) The programmer’s model of the XGATE RISC core is shown in Figure 10-22. The processor offers a set of seven general purpose registers (R1 - R7), which serve as accumulators and index registers. An additional eighth register (R0) is tied to the value “$0000”. Registers R1 and R7 have additional functionality. R1 is preloaded with the initial data pointer of the channel’s service request vector (see Figure 10-23). R7 is either preloaded with the content of XGISP74 if the interrupt priority of the current channel is in the range 7 to 4, or it is with preloaded the content of XGISP31 if the interrupt priority of the current channel is in the range 3 to 1. The remaining general purpose registers will be reset to an unspecified value at the beginning of each thread. The 16 bit program counter allows the addressing of a 64 kbyte address space. The condition code register contains four bits: the sign bit (S), the zero flag (Z), the overflow flag (V), and the carry bit (C). The initial content of the condition code register is undefined. 10.4.3 Memory Map The XGATE’s RISC core is able to access an address space of 64K bytes. The allocation of memory blocks within this address space is determined on chip level. Refer to the S12X_MMC Section for a detailed information. The XGATE vector block assigns a start address and a data pointer to each XGATE channel. Its position in the XGATE memory map can be adjusted through the XGVBR register (see Section 10.3.1.7, “XGATE Vector Base Address Register (XGVBR)”). Figure 10-23 shows the layout of the vector block. Each vector consists of two 16 bit words. The first contains the start address of the service routine. This value will be loaded into the program counter before a service routine is executed. The second word is a pointer to the service routine’s data space. This value will be loaded into register R1 before a service routine is executed. MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 375 Chapter 10 XGATE (S12XGATEV3) XGVBR +$0000 unused Code +$0024 Channel $09 Initial Program Counter Channel $09 Initial Data Pointer +$0028 Channel $0A Initial Program Counter Data Channel $0A Initial Data Pointer +$002C Channel $0B Initial Program Counter Channel $0B Initial Data Pointer +$0030 Channel $0C Initial Program Counter Code Channel $0C Initial Data Pointer +$01E0 Channel $78 Initial Program Counter Data Channel $78 Initial Data Pointer Figure 10-23. XGATE Vector Block 10.4.4 Semaphores The XGATE module offers a set of eight hardware semaphores. These semaphores provide a mechanism to protect system resources that are shared between two concurrent threads of program execution; one thread running on the S12X_CPU and one running on the XGATE RISC core. Each semaphore can only be in one of the three states: “Unlocked”, “Locked by S12X_CPU”, and “Locked by XGATE”. The S12X_CPU can check and change a semaphore’s state through the XGATE semaphore register (XGSEM, see Section 10.3.1.10, “XGATE Semaphore Register (XGSEM)”). The RISC core does this through its SSEM and CSEM instructions. IFigure 10-24 illustrates the valid state transitions. MC9S12XE-Family Reference Manual Rev. 1.25 376 Freescale Semiconductor Chapter 10 XGATE (S12XGATEV3) set_xgsem: clr_xgsem: ssem: csem: 1 is written to XGSEM[n] (and 1 is written to XGSEMM[n]) 0 is written to XGSEM[n] (and 1 is written to XGSEMM[n]) Executing SSEM instruction (on semaphore n) Executing CSEM instruction (on semaphore n) clr_xgsem csem LOCKED BY S12X_CPU LOCKED BY XGATE clr_xgsem csem ssem & set_xgsem ssem UNLOCKED ssem & set_xgsem Figure 10-24. Semaphore State Transitions Figure 10-25 gives an example of the typical usage of the XGATE hardware semaphores. Two concurrent threads are running on the system. One is running on the S12X_CPU and the other is running on the RISC core. They both have a critical section of code that accesses the same system resource. To guarantee that the system resource is only accessed by one thread at a time, the critical code sequence must be embedded in a semaphore lock/release sequence as shown. MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 377 Chapter 10 XGATE (S12XGATEV3) S12X_CPU XGATE ......... ......... 1 ⇒ XGSEM[n] SSEM XGSEM[n] 1? BCC? critical code sequence 0 ⇒ XGSEM[n] ......... critical code sequence CSEM ......... Figure 10-25. Algorithm for Locking and Releasing Semaphores 10.4.5 Software Error Detection Upon detecting an error condition caused by erratic application code, the XGATE module will immediately terminate program execution and trigger a non-maskable interrupt to the S12X_CPU. There are three error conditions: • Execution of an illegal opcode • Illegal opcode fetches • Illegal load or store accesses All opcodes which are not listed in section Section 10.8, “Instruction Set” are illegal opcodes. Illegal opcode fetches as well as illegal load and store accesses are defined on chip level. Refer to the S12X_MMC Section for a detailed information. NOTE When executing a branch (BCC, BCS,...), a jump (JAL) or an RTS instruction, the XGATE prefetches and discards the opcode of the following instruction. The XGATE will perform its software error handling actions (see above) if this opcode fetch is illegal. MC9S12XE-Family Reference Manual Rev. 1.25 378 Freescale Semiconductor Chapter 10 XGATE (S12XGATEV3) 10.5 10.5.1 Interrupts Incoming Interrupt Requests XGATE threads are triggered by interrupt requests which are routed to the XGATE module (see S12X_INT Section). Only a subset of the MCU’s interrupt requests can be routed to the XGATE. Which specific interrupt requests these are and which channel ID they are assigned to is documented in Section “Interrupts” of the device overview. 10.5.2 Outgoing Interrupt Requests There are three types of interrupt requests which can be triggered by the XGATE module: 4. Channel interrupts For each XGATE channel there is an associated interrupt flag in the XGATE interrupt flag vector (XGIF, see Section 10.3.1.8, “XGATE Channel Interrupt Flag Vector (XGIF)”). These flags can be set through the "SIF" instruction by the RISC core. They are typically used to flag an interrupt to the S12X_CPU when the XGATE has completed one of its task. 5. Software triggers Software triggers are interrupt flags, which can be set and cleared by software (see Section 10.3.1.9, “XGATE Software Trigger Register (XGSWT)”). They are typically used to trigger XGATE tasks by the S12X_CPU software. However these interrupts can also be routed to the S12X_CPU (see S12X_INT Section) and triggered by the XGATE software. 6. Software error interrupt The software error interrupt signals to the S12X_CPU the detection of an error condition in the XGATE application code (see Section 10.4.5, “Software Error Detection”). This is a non-maskable interrupt. Executing the interrupt service routine will automatically reset the interrupt line. All outgoing XGATE interrupts, except software error interrupts, can be disabled by the XGIE bit in the XGATE module control register (XGMCTL, see Section 10.3.1.1, “XGATE Control Register (XGMCTL)”). 10.6 Debug Mode The XGATE debug mode is a feature to allow debugging of application code. 10.6.1 Debug Features In debug mode the RISC core will be halted and the following debug features will be enabled: • Read and Write accesses to RISC core registers (XGCCR, XGPC, XGR1–XGR7)1 All RISC core registers can be modified. Leaving debug mode will cause the RISC core to continue program execution with the modified register values. 1. Only possible if MCU is unsecured MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 379 Chapter 10 XGATE (S12XGATEV3) • • Single Stepping Writing a "1" to the XGSS bit will call the RISC core to execute a single instruction. All RISC core registers will be updated accordingly. Write accesses to the XGCHID register and the XGCHPL register XGATE threads can be initiated and terminated through a 16 write access to the XGCHID and the XGCHPL register or through a 8 bit write access to the XGCHID register. Detailed operation is shown in Table 10-22. Once a thread has been initiated it’s code can be either single stepped or it can be executed by leaving debug mode. Table 10-22. Initiating and Terminating Threads in Debug Mode Register Content Single Cycle Write Access to... Action XGCHID XGCHPL XGCHID XGCHPL 0 0 1..127 -(1) Set new XGCHID Set XGCHPL to 0x01 Initiate new thread 0 0 1..127 0..7 Set new XGCHID Set new XGCHPL Initiate new thread 4..7 Interrupt current thread Set new XGCHID Set new XGCHPL Initiate new thread 1..127 0..3 1..127 1..127 0..7 0 0..7 All other combinations 1. 8 bit write access to XGCHID -1 Terminate current thread. Resume interrupted thread or become idle if no interrupted thread is pending No action NOTE Even though zero is not a valid interrupt priority level of the S12X_INT module, a thread of priority level 0 can be initiated in debug mode. The XGATE handles requests of priority level 0 in the same way as it handles requests of priority levels 1 to 3. NOTE All channels 1 to 127 can be initiated by writing to the XGCHID register, even if they are not assigned to any peripheral module. NOTE In Debug Mode the XGATE will ignore all requests from peripheral modules. 10.6.1.0.1 Entering Debug Mode Debug mode can be entered in four ways: 1. Setting XGDBG to "1" MC9S12XE-Family Reference Manual Rev. 1.25 380 Freescale Semiconductor Chapter 10 XGATE (S12XGATEV3) Writing a "1" to XGDBG and XGDBGM in the same write access causes the XGATE to enter debug mode upon completion of the current instruction. NOTE After writing to the XGDBG bit the XGATE will not immediately enter debug mode. Depending on the instruction that is executed at this time there may be a delay of several clock cycles. The XGDBG will read "0" until debug mode is entered. 2. Software breakpoints XGATE programs which are stored in the internal RAM allow the use of software breakpoints. A software breakpoint is set by replacing an instruction of the program code with the "BRK" instruction. As soon as the program execution reaches the "BRK" instruction, the XGATE enters debug mode. Additionally a software breakpoint request is sent to the S12X_DBG module (see section 4.9 of the S12X_DBG Section). Upon entering debug mode, the program counter will point to the "BRK" instruction. The other RISC core registers will hold the result of the previous instruction. To resume program execution, the "BRK" instruction must be replaced by the original instruction before leaving debug mode. 3. Tagged Breakpoints The S12X_DBG module is able to place tags on fetched opcodes. The XGATE is able to enter debug mode right before a tagged opcode is executed (see section 4.9 of the S12X_DBG Section). Upon entering debug mode, the program counter will point to the tagged instruction. The other RISC core registers will hold the result of the previous instruction. 4. Forced Breakpoints Forced breakpoints are triggered by the S12X_DBG module (see section 4.9 of the S12X_DBG Section). When a forced breakpoint occurs, the XGATE will enter debug mode upon completion of the current instruction. 10.6.2 Leaving Debug Mode Debug mode can only be left by setting the XGDBG bit to "0". If a thread is active (XGCHID has not been cleared in debug mode), program execution will resume at the value of XGPC. 10.7 Security In order to protect XGATE application code on secured S12X devices, a few restrictions in the debug features have been made. These are: • Registers XGCCR, XGPC, and XGR1–XGR7 will read zero on a secured device • Registers XGCCR, XGPC, and XGR1–XGR7 can not be written on a secured device • Single stepping is not possible on a secured device MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 381 Chapter 10 XGATE (S12XGATEV3) 10.8 Instruction Set 10.8.1 Addressing Modes For the ease of implementation the architecture is a strict Load/Store RISC machine, which means all operations must have one of the eight general purpose registers R0 … R7 as their source as well their destination. All word accesses must work with a word aligned address, that is A[0] = 0! 10.8.1.1 Naming Conventions RD RD.L RD.H RS, RS1, RS2 RS.L, RS1.L, RS2.L RS.H, RS1.H, RS2.H RB RI RI+ –RI Destination register, allowed range is R0–R7 Low byte of the destination register, bits [7:0] High byte of the destination register, bits [15:8] Source register, allowed range is R0–R7 Low byte of the source register, bits [7:0] High byte of the source register, bits[15:8] Base register for indexed addressing modes, allowed range is R0–R7 Offset register for indexed addressing modes with register offset, allowed range is R0–R7 Offset register for indexed addressing modes with register offset and post-increment, Allowed range is R0–R7 (R0+ is equivalent to R0) Offset register for indexed addressing modes with register offset and pre-decrement, Allowed range is R0–R7 (–R0 is equivalent to R0) NOTE Even though register R1 is intended to be used as a pointer to the data segment, it may be used as a general purpose data register as well. Selecting R0 as destination register will discard the result of the instruction. Only the condition code register will be updated 10.8.1.2 Inherent Addressing Mode (INH) Instructions that use this addressing mode either have no operands or all operands are in internal XGATE registers. Examples: BRK RTS MC9S12XE-Family Reference Manual Rev. 1.25 382 Freescale Semiconductor Chapter 10 XGATE (S12XGATEV3) 10.8.1.3 Immediate 3-Bit Wide (IMM3) Operands for immediate mode instructions are included in the instruction stream and are fetched into the instruction queue along with the rest of the 16 bit instruction. The ’#’ symbol is used to indicate an immediate addressing mode operand. This address mode is used for semaphore instructions. Examples: CSEM SSEM 10.8.1.4 #1 #3 ; Unlock semaphore 1 ; Lock Semaphore 3 Immediate 4 Bit Wide (IMM4) The 4 bit wide immediate addressing mode is supported by all shift instructions. RD = RD ∗ IMM4 Examples: LSL LSR 10.8.1.5 R4,#1 R4,#3 ; R4 = R4 > 3; shift register R4 by 3 bits to the right Immediate 8 Bit Wide (IMM8) The 8 bit wide immediate addressing mode is supported by four major commands (ADD, SUB, LD, CMP). RD = RD ∗ imm8 Examples: ADDL SUBL LDH CMPL 10.8.1.6 R1,#1 R2,#2 R3,#3 R4,#4 ; ; ; ; adds an 8 bit value to register R1 subtracts an 8 bit value from register R2 loads an 8 bit immediate into the high byte of Register R3 compares the low byte of register R4 with an immediate value Immediate 16 Bit Wide (IMM16) The 16 bit wide immediate addressing mode is a construct to simplify assembler code. Instructions which offer this mode are translated into two opcodes using the eight bit wide immediate addressing mode. RD = RD ∗ IMM16 Examples: LDW ADD 10.8.1.7 R4,#$1234 R4,#$5678 ; translated to LDL R4,#$34; LDH R4,#$12 ; translated to ADDL R4,#$78; ADDH R4,#$56 Monadic Addressing (MON) In this addressing mode only one operand is explicitly given. This operand can either be the source (f(RD)), the target (RD = f()), or both source and target of the operation (RD = f(RD)). Examples: JAL SIF R1 R2 ; PC = R1, R1 = PC+2 ; Trigger IRQ associated with the channel number in R2.L MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 383 Chapter 10 XGATE (S12XGATEV3) 10.8.1.8 Dyadic Addressing (DYA) In this mode the result of an operation between two registers is stored in one of the registers used as operands. RD = RD ∗ RS is the general register to register format, with register RD being the first operand and RS the second. RD and RS can be any of the 8 general purpose registers R0 … R7. If R0 is used as the destination register, only the condition code flags are updated. This addressing mode is used only for shift operations with a variable shift value Examples: LSL LSR 10.8.1.9 R4,R5 R4,R5 ; R4 = R4 > R5 Triadic Addressing (TRI) In this mode the result of an operation between two or three registers is stored into a third one. RD = RS1 ∗ RS2 is the general format used in the order RD, RS1, RS1. RD, RS1, RS2 can be any of the 8 general purpose registers R0 … R7. If R0 is used as the destination register RD, only the condition code flags are updated. This addressing mode is used for all arithmetic and logical operations. Examples: ADC SUB R5,R6,R7 R5,R6,R7 ; R5 = R6 + R7 + Carry ; R5 = R6 - R7 10.8.1.10 Relative Addressing 9-Bit Wide (REL9) A 9-bit signed word address offset is included in the instruction word. This addressing mode is used for conditional branch instructions. Examples: BCC BEQ REL9 REL9 ; PC = PC + 2 + (REL9 R2;arithmetic shift register R4 right by the amount ; of bits contained in R2[3:0]. MC9S12XE-Family Reference Manual Rev. 1.25 386 Freescale Semiconductor Chapter 10 XGATE (S12XGATEV3) 10.8.2.5 Bit Field Operations This addressing mode is used to identify the position and size of a bit field for insertion or extraction. The width and offset are coded in the lower byte of the source register 2, RS2. The content of the upper byte is ignored. An offset of 0 denotes the right most position and a width of 0 denotes 1 bit. These instructions are very useful to extract, insert, clear, set or toggle portions of a 16 bit word 7 4 3 W4 O4 5 2 W4=3, O4=2 15 0 RS2 0 RS1 Bit Field Extract Bit Field Insert 15 3 0 RD Figure 10-26. Bit Field Addressing BFEXT 10.8.2.6 R3,R4,R5 ; R5: W4+1 bits with offset O4, will be extracted from R4 into R3 Special Instructions for DMA Usage The XGATE offers a number of additional instructions for flag manipulation, program flow control and debugging: 1. SIF: Set a channel interrupt flag 2. SSEM: Test and set a hardware semaphore 3. CSEM: Clear a hardware semaphore 4. BRK: Software breakpoint 5. NOP: No Operation 6. RTS: Terminate the current thread 10.8.3 Cycle Notation Table 10-23 show the XGATE access detail notation. Each code letter equals one XGATE cycle. Each letter implies additional wait cycles if memories or peripherals are not accessible. Memories or peripherals are not accessible if they are blocked by the S12X_CPU. In addition to this Peripherals are only accessible every other XGATE cycle. Uppercase letters denote 16 bit operations. Lowercase letters denote 8 bit operations. The XGATE is able to perform two bus or wait cycles per S12X_CPU cycle. MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 387 Chapter 10 XGATE (S12XGATEV3) Table 10-23. Access Detail Notation V — Vector fetch: always an aligned word read, lasts for at least one RISC core cycle P — Program word fetch: always an aligned word read, lasts for at least one RISC core cycle r — 8 bit data read: lasts for at least one RISC core cycle R — 16 bit data read: lasts for at least one RISC core cycle w — 8 bit data write: lasts for at least one RISC core cycle W — 16 bit data write: lasts for at least one RISC core cycle A — Alignment cycle: no read or write, lasts for zero or one RISC core cycles f — Free cycle: no read or write, lasts for one RISC core cycles Special Cases PP/P — Branch: PP if branch taken, P if not 10.8.4 Thread Execution When the RISC core is triggered by an interrupt request (see Figure 10-1) it first executes a vector fetch sequence which performs three bus accesses: 1. A V-cycle to fetch the initial content of the program counter. 2. A V-cycle to fetch the initial content of the data segment pointer (R1). 3. A P-cycle to load the initial opcode. Afterwards a sequence of instructions (thread) is executed which is terminated by an "RTS" instruction. If further interrupt requests are pending after a thread has been terminated, a new vector fetch will be performed. Otherwise the RISC core will either resume a previous thread (beginning with a P-cycle to refetch the interrupted opcode) or it will become idle until a new interrupt request is received. A thread can only be interrupted by an interrupt request of higher priority. 10.8.5 Instruction Glossary This section describes the XGATE instruction set in alphabetical order. MC9S12XE-Family Reference Manual Rev. 1.25 388 Freescale Semiconductor Chapter 10 XGATE (S12XGATEV3) ADC ADC Add with Carry Operation RS1 + RS2 + C ⇒ RD Adds the content of register RS1, the content of register RS2 and the value of the Carry bit using binary addition and stores the result in the destination register RD. The Zero Flag is also carried forward from the previous operation allowing 32 and more bit additions. Example: ADD ADC BCC R6,R2,R2 R7,R3,R3 ; R7:R6 = R5:R4 + R3:R2 ; conditional branch on 32 bit addition CCR Effects N Z V C ∆ ∆ ∆ ∆ N: Z: V: C: Set if bit 15 of the result is set; cleared otherwise. Set if the result is $0000 and Z was set before this operation; cleared otherwise. Set if a two´s complement overflow resulted from the operation; cleared otherwise. RS1[15] & RS2[15] & RD[15]new | RS1[15] & RS2[15] & RD[15]new Set if there is a carry from bit 15 of the result; cleared otherwise. RS1[15] & RS2[15] | RS1[15] & RD[15]new | RS2[15] & RD[15]new Code and CPU Cycles Source Form ADC RD, RS1, RS2 Address Mode TRI Machine Code 0 0 0 1 1 RD RS1 Cycles RS2 1 1 P MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 389 Chapter 10 XGATE (S12XGATEV3) ADD ADD Add without Carry Operation RS1 + RS2 ⇒ RD RD + IMM16 ⇒ RD (translates to ADDL RD, #IMM16[7:0]; ADDH RD, #IMM16[15:8]) Performs a 16 bit addition and stores the result in the destination register RD. NOTE When using immediate addressing mode (ADD RD, #IMM16), the V-flag and the C-Flag of the first instruction (ADDL RD, #IMM16[7:0]) are not considered by the second instruction (ADDH RD, #IMM16[15:8]). ⇒ Don’t rely on the V-Flag if RD + IMM16[7:0] ≥ 215. ⇒ Don’t rely on the C-Flag if RD + IMM16[7:0] ≥ 216. CCR Effects N Z V C ∆ ∆ ∆ ∆ N: Z: V: C: Set if bit 15 of the result is set; cleared otherwise. Set if the result is $0000; cleared otherwise. Set if a two´s complement overflow resulted from the operation; cleared otherwise. RS1[15] & RS2[15] & RD[15]new | RS1[15] & RS2[15] & RD[15]new Refer to ADDH instruction for #IMM16 operations. Set if there is a carry from bit 15 of the result; cleared otherwise. RS1[15] & RS2[15] | RS1[15] & RD[15]new | RS2[15] & RD[15]new Refer to ADDH instruction for #IMM16 operations. Code and CPU Cycles Source Form Address Mode Machine Code RS1 Cycles ADD RD, RS1, RS2 TRI 0 0 0 1 1 RD RS2 1 0 P ADD RD, #IMM16 IMM8 1 1 1 0 0 RD IMM16[7:0] P IMM8 1 1 1 0 1 RD IMM16[15:8] P MC9S12XE-Family Reference Manual Rev. 1.25 390 Freescale Semiconductor Chapter 10 XGATE (S12XGATEV3) ADDH Add Immediate 8 bit Constant (High Byte) ADDH Operation RD + IMM8:$00 ⇒ RD Adds the content of high byte of register RD and a signed immediate 8 bit constant using binary addition and stores the result in the high byte of the destination register RD. This instruction can be used after an ADDL for a 16 bit immediate addition. Example: ADDL ADDH R2,#LOWBYTE R2,#HIGHBYTE ; R2 = R2 + 16 bit immediate CCR Effects N Z V C ∆ ∆ ∆ ∆ N: Z: V: C: Set if bit 15 of the result is set; cleared otherwise. Set if the result is $0000; cleared otherwise. Set if a two´s complement overflow resulted from the operation; cleared otherwise. RD[15]old & IMM8[7] & RD[15]new | RD[15]old & IMM8[7] & RD[15]new Set if there is a carry from the bit 15 of the result; cleared otherwise. RD[15]old & IMM8[7] | RD[15]old & RD[15]new | IMM8[7] & RD[15]new Code and CPU Cycles Source Form ADDH RD, #IMM8 Address Mode IMM8 Machine Code 1 1 1 0 1 RD Cycles IMM8 P MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 391 Chapter 10 XGATE (S12XGATEV3) ADDL Add Immediate 8 bit Constant (Low Byte) ADDL Operation RD + $00:IMM8 ⇒ RD Adds the content of register RD and an unsigned immediate 8 bit constant using binary addition and stores the result in the destination register RD. This instruction must be used first for a 16 bit immediate addition in conjunction with the ADDH instruction. CCR Effects N Z V C ∆ ∆ ∆ ∆ N: Z: V: C: Set if bit 15 of the result is set; cleared otherwise. Set if the result is $0000; cleared otherwise. Set if a two´s complement overflow resulted from the 8 bit operation; cleared otherwise. RD[15]old & RD[15]new Set if there is a carry from the bit 15 of the result; cleared otherwise. RD[15]old & RD[15]new Code and CPU Cycles Source Form ADDL RD, #IMM8 Address Mode IMM8 Machine Code 1 1 1 0 0 RD Cycles IMM8 P MC9S12XE-Family Reference Manual Rev. 1.25 392 Freescale Semiconductor Chapter 10 XGATE (S12XGATEV3) AND AND Logical AND Operation RS1 & RS2 ⇒ RD RD & IMM16 ⇒ RD (translates to ANDL RD, #IMM16[7:0]; ANDH RD, #IMM16[15:8]) Performs a bit wise logical AND of two 16 bit values and stores the result in the destination register RD. NOTE When using immediate addressing mode (AND RD, #IMM16), the Z-flag of the first instruction (ANDL RD, #IMM16[7:0]) is not considered by the second instruction (ANDH RD, #IMM16[15:8]). ⇒ Don’t rely on the Z-Flag. CCR Effects N Z V C ∆ ∆ 0 — N: Z: V: C: Set if bit 15 of the result is set; cleared otherwise. Set if the result is $0000; cleared otherwise. Refer to ANDH instruction for #IMM16 operations. 0; cleared. Not affected. Code and CPU Cycles Source Form AND RD, RS1, RS2 AND RD, #IMM16 Address Mode Machine Code RS1 Cycles TRI 0 0 0 1 0 RD RS2 0 0 P IMM8 1 0 0 0 0 RD IMM16[7:0] P IMM8 1 0 0 0 1 RD IMM16[15:8] P MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 393 Chapter 10 XGATE (S12XGATEV3) ANDH Logical AND Immediate 8 bit Constant (High Byte) ANDH Operation RD.H & IMM8 ⇒ RD.H Performs a bit wise logical AND between the high byte of register RD and an immediate 8 bit constant and stores the result in the destination register RD.H. The low byte of RD is not affected. CCR Effects N Z V C ∆ ∆ 0 — N: Z: V: C: Set if bit 15 of the result is set; cleared otherwise. Set if the 8 bit result is $00; cleared otherwise. 0; cleared. Not affected. Code and CPU Cycles Source Form ANDH RD, #IMM8 Address Mode IMM8 Machine Code 1 0 0 0 1 RD Cycles IMM8 P MC9S12XE-Family Reference Manual Rev. 1.25 394 Freescale Semiconductor Chapter 10 XGATE (S12XGATEV3) ANDL Logical AND Immediate 8 bit Constant (Low Byte) ANDL Operation RD.L & IMM8 ⇒ RD.L Performs a bit wise logical AND between the low byte of register RD and an immediate 8 bit constant and stores the result in the destination register RD.L. The high byte of RD is not affected. CCR Effects N Z V C ∆ ∆ 0 — N: Z: V: C: Set if bit 7 of the result is set; cleared otherwise. Set if the 8 bit result is $00; cleared otherwise. 0; cleared. Not affected. Code and CPU Cycles Source Form ANDL RD, #IMM8 Address Mode IMM8 Machine Code 1 0 0 0 0 RD Cycles IMM8 P MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 395 Chapter 10 XGATE (S12XGATEV3) ASR ASR Arithmetic Shift Right Operation n b15 RD C n = RS or IMM4 Shifts the bits in register RD n positions to the right. The higher n bits of the register RD become filled with the sign bit (RD[15]). The carry flag will be updated to the bit contained in RD[n-1] before the shift for n > 0. n can range from 0 to 16. In immediate address mode, n is determined by the operand IMM4. n is considered to be 16 if IMM4 is equal to 0. In dyadic address mode, n is determined by the content of RS. n is considered to be 16 if the content of RS is greater than 15. CCR Effects N Z V C ∆ ∆ ∆ ∆ N: Z: V: C: Set if bit 15 of the result is set; cleared otherwise. Set if the result is $0000; cleared otherwise. Set if a two´s complement overflow resulted from the operation; cleared otherwise. RD[15]old ^ RD[15]new Set if n > 0 and RD[n-1] = 1; if n = 0 unaffected. Code and CPU Cycles Source Form ASR RD, #IMM4 ASR RD, RS Address Mode Machine Code IMM4 0 0 0 0 1 RD IMM4 DYA 0 0 0 0 1 RD RS Cycles 1 1 0 0 1 P 0 0 0 1 P MC9S12XE-Family Reference Manual Rev. 1.25 396 Freescale Semiconductor Chapter 10 XGATE (S12XGATEV3) BCC BCC Branch if Carry Cleared (Same as BHS) Operation If C = 0, then PC + $0002 + (REL9 15 the upper bits are ignored. Using R0 as a RS1, this command can be used to set bits. 15 7 4 3 0 W4 O4 15 3 RS2 0 RS1 Inverted Bit Field Insert 15 5 2 0 W4=3, O4=2 RD CCR Effects N Z V C ∆ ∆ 0 — N: Z: V: C: Set if bit 15 of the result is set; cleared otherwise. Set if the result is $0000; cleared otherwise. 0; cleared. Not affected. Code and CPU Cycles Source Form BFINSI RD, RS1, RS2 Address Mode TRI Machine Code 0 1 1 1 0 RD RS1 Cycles RS2 1 1 P MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 403 Chapter 10 XGATE (S12XGATEV3) BFINSX BFINSX Bit Field Insert and XNOR Operation !(RS1[w:0] ^ RD[w+o:o]) ⇒ RD[w+o:o]; w = (RS2[7:4]) o = (RS2[3:0]) Extracts w+1 bits from register RS1 starting at position 0, performs an XNOR with RD[w+o:o] and writes the bits back to RD. The remaining bits in RD are not affected. If (o+w) > 15 the upper bits are ignored. Using R0 as a RS1, this command can be used to toggle bits. 15 7 4 3 0 W4 O4 15 3 RS2 0 RS1 Bit Field Insert XNOR 15 5 2 0 W4=3, O4=2 RD CCR Effects N Z V C ∆ ∆ 0 — N: Z: V: C: Set if bit 15 of the result is set; cleared otherwise. Set if the result is $0000; cleared otherwise. 0; cleared. Not affected. Code and CPU Cycles Source Form BFINSX RD, RS1, RS2 Address Mode TRI Machine Code 0 1 1 1 1 RD RS1 Cycles RS2 1 1 P MC9S12XE-Family Reference Manual Rev. 1.25 404 Freescale Semiconductor Chapter 10 XGATE (S12XGATEV3) BGE BGE Branch if Greater than or Equal to Zero Operation If N ^ V = 0, then PC + $0002 + (REL9 1) ;########################################### ;# INITIALIZE XGATE # ;########################################### MOVW #XGMCTL_CLEAR, XGMCTL ;clear all XGMCTL bits TST BNE XGCHID ;wait until current thread is finished INIT_XGATE_BUSY_LOOP LDX LDD STD STD STD STD STD STD STD STD #XGIF #$FFFF 2,X+ 2,X+ 2,X+ 2,X+ 2,X+ 2,X+ 2,X+ 2,X+ ;clear all channel interrupt flags CLR XGISPSEL ;set vector base register MOVW #XGATE_VECTORS_XG, XGVBR MOVW #$FF00, XGSWT ;clear all software triggers INIT_XGATE_VECTAB_LOOP ;########################################### ;# INITIALIZE XGATE VECTOR TABLE # ;########################################### LDAA #128 ;build XGATE vector table LDY #XGATE_VECTORS MOVW #XGATE_DUMMY_ISR_XG, 4,Y+ DBNE A, INIT_XGATE_VECTAB_LOOP MOVW #XGATE_CODE_XG, RAM_START+(2*SCI_VEC) MOVW #XGATE_DATA_XG, RAM_START+(2*SCI_VEC)+2 COPY_XGATE_CODE COPY_XGATE_CODE_LOOP ;########################################### ;# COPY XGATE CODE # ;########################################### LDX #XGATE_DATA_FLASH MOVW 2,X+, 2,Y+ MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 465 Chapter 10 XGATE (S12XGATEV3) MOVW MOVW MOVW CPX BLS START_XGATE ;########################################### ;# START XGATE # ;########################################### MOVW #XGMCTL_ENABLE, XGMCTL ;enable XGATE BRA * ;########################################### ;# DUMMY INTERRUPT SERVICE ROUTINE # ;########################################### RTI DUMMY_ISR XGATE_DATA_FLASH XGATE_DATA_SCI XGATE_DATA_IDX XGATE_DATA_MSG XGATE_CODE_FLASH XGATE_CODE_DONE XGATE_CODE_FLASH_END XGATE_DUMMY_ISR_XG 10.9.3 2,X+, 2,Y+ 2,X+, 2,Y+ 2,X+, 2,Y+ #XGATE_CODE_FLASH_END COPY_XGATE_CODE_LOOP CPU XGATE ;########################################### ;# XGATE DATA # ;########################################### ALIGN 1 EQU * EQU *-XGATE_DATA_FLASH DW SCI_REGS ;pointer to SCI register space EQU *-XGATE_DATA_FLASH DB XGATE_DATA_MSG ;string pointer EQU *-XGATE_DATA_FLASH FCC "Hello World! ;ASCII string DB $0D ;CR ;########################################### ;# XGATE CODE # ;########################################### ALIGN 1 LDW R2,(R1,#XGATE_DATA_SCI) ;SCI -> R2 LDB R3,(R1,#XGATE_DATA_IDX) ;msg -> R3 LDB R4,(R1,R3+) ;curr. char -> R4 STB R3,(R1,#XGATE_DATA_IDX) ;R3 -> idx LDB R0,(R2,#(SCISR1-SCI_REGS)) ;initiate SCI transmit STB R4,(R2,#(SCIDRL-SCI_REGS)) ;initiate SCI transmit CMPL R4,#$0D BEQ XGATE_CODE_DONE RTS LDL R4,#$00 ;disable SCI interrupts STB R4,(R2,#(SCICR2-SCI_REGS)) LDL R3,#XGATE_DATA_MSG;reset R3 STB R3,(R1,#XGATE_DATA_IDX) RTS EQU (XGATE_CODE_FLASH_END-XGATE_CODE_FLASH)+XGATE_CODE_XG Stack Support To simplify the implementation of a program stack the XGATE can be configured to set RISC core register R7 to the beginning of a stack region before executing a thread. Two separate stack regions can be defined: One for threads of priority level 7 to 4 (refer to Section 10.3.1.5, “XGATE Initial Stack Pointer for MC9S12XE-Family Reference Manual Rev. 1.25 466 Freescale Semiconductor Chapter 10 XGATE (S12XGATEV3) Interrupt Priorities 7 to 4 (XGISP74)”) and one for threads of priority level 3 to 1 (refer to Section 10.3.1.6, “XGATE Initial Stack Pointer for Interrupt Priorities 3 to 1 (XGISP31)”). MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 467 Chapter 10 XGATE (S12XGATEV3) MC9S12XE-Family Reference Manual Rev. 1.25 468 Freescale Semiconductor Chapter 11 S12XE Clocks and Reset Generator (S12XECRGV1) Table 11-1. Revision History Revision Number Revision Date Sections Affected V01.03 1 Sep. 2008 Table 11-14 V01.04 20 Nov. 2008 V01.05 19. Sep 2009 11.5.1/11-495 V01.06 18. Sep 2012 Table 11-14 11.5.1 11.1 Description of Changes added 100MHz example for PLL 11.3.2.4/11-475 S12XECRG Flags Register: corrected address to Module Base + 0x0003 Modified Note below Table 11-17./11-495 Added footnote concerning maximum clock frequencies to table Removed redundant examples from table Replaced reference to MMC documentation Introduction This specification describes the function of the Clocks and Reset Generator (S12XECRG). 11.1.1 Features The main features of this block are: • Phase Locked Loop (IPLL) frequency multiplier with internal filter — Reference divider — Post divider — Configurable internal filter (no external pin) — Optional frequency modulation for defined jitter and reduced emission — Automatic frequency lock detector — Interrupt request on entry or exit from locked condition — Self Clock Mode in absence of reference clock • System Clock Generator — Clock Quality Check — User selectable fast wake-up from Stop in Self-Clock Mode for power saving and immediate program execution — Clock switch for either Oscillator or PLL based system clocks • Computer Operating Properly (COP) watchdog timer with time-out clear window. • System Reset generation from the following possible sources: — Power on reset — Low voltage reset MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 469 Chapter 11 S12XE Clocks and Reset Generator (S12XECRGV1) • — Illegal address reset — COP reset — Loss of clock reset — External pin reset Real-Time Interrupt (RTI) 11.1.2 Modes of Operation This subsection lists and briefly describes all operating modes supported by the S12XECRG. • Run Mode All functional parts of the S12XECRG are running during normal Run Mode. If RTI or COP functionality is required the individual bits of the associated rate select registers (COPCTL, RTICTL) have to be set to a non zero value. • Wait Mode In this mode the IPLL can be disabled automatically depending on the PLLWAI bit. • Stop Mode Depending on the setting of the PSTP bit Stop Mode can be differentiated between Full Stop Mode (PSTP = 0) and Pseudo Stop Mode (PSTP = 1). — Full Stop Mode The oscillator is disabled and thus all system and core clocks are stopped. The COP and the RTI remain frozen. — Pseudo Stop Mode The oscillator continues to run and most of the system and core clocks are stopped. If the respective enable bits are set the COP and RTI will continue to run, else they remain frozen. • Self Clock Mode Self Clock Mode will be entered if the Clock Monitor Enable Bit (CME) and the Self Clock Mode Enable Bit (SCME) are both asserted and the clock monitor in the oscillator block detects a loss of clock. As soon as Self Clock Mode is entered the S12XECRG starts to perform a clock quality check. Self Clock Mode remains active until the clock quality check indicates that the required quality of the incoming clock signal is met (frequency and amplitude). Self Clock Mode should be used for safety purposes only. It provides reduced functionality to the MCU in case a loss of clock is causing severe system conditions. 11.1.3 Block Diagram Figure 11-1 shows a block diagram of the S12XECRG. MC9S12XE-Family Reference Manual Rev. 1.25 470 Freescale Semiconductor Chapter 11 S12XE Clocks and Reset Generator (S12XECRGV1) Illegal Address Reset S12X_MMC Power on Reset Voltage Regulator Low Voltage Reset ICRG RESET CM Fail Clock Monitor OSCCLK EXTAL Oscillator XTAL COP Timeout XCLKS Reset Generator Clock Quality Checker System Reset Bus Clock Core Clock COP RTI Oscillator Clock Registers PLLCLK VDDPLL IPLL VSSPLL Real Time Interrupt Clock and Reset Control PLL Lock Interrupt Self Clock Mode Interrupt Figure 11-1. Block diagram of S12XECRG 11.2 Signal Description This section lists and describes the signals that connect off chip. 11.2.1 VDDPLL, VSSPLL These pins provides operating voltage (VDDPLL) and ground (VSSPLL) for the IPLL circuitry. This allows the supply voltage to the IPLL to be independently bypassed. Even if IPLL usage is not required VDDPLL and VSSPLL must be connected to properly. 11.2.2 RESET RESET is an active low bidirectional reset pin. As an input it initializes the MCU asynchronously to a known start-up state. As an open-drain output it indicates that an system reset (internal to MCU) has been triggered. MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 471 Chapter 11 S12XE Clocks and Reset Generator (S12XECRGV1) 11.3 Memory Map and Registers This section provides a detailed description of all registers accessible in the S12XECRG. 11.3.1 Module Memory Map Figure 11-2 gives an overview on all S12XECRG registers. Address Name 0x0000 SYNR 0x0001 REFDV 0x0002 POSTDIV 0x0003 CRGFLG 0x0004 CRGINT 0x0005 CLKSEL 0x0006 PLLCTL 0x0007 RTICTL 0x0008 COPCTL 0x0009 FORBYP2 0x000A CTCTL2 0x000B ARMCOP Bit 7 R W R W R 6 5 4 3 VCOFRQ[1:0] SYNDIV[5:0] REFFRQ[1:0] REFDIV[5:0] 0 0 0 RTIF PORF LVRF W R W 0 0 R RTIE LOCKIF LOCKIE LOCK 0 XCLKS 0 PLLON FM1 FM0 FSTWKP RTDEC RTR6 RTR5 RTR4 RTR3 WCOP RSBCK 0 0 0 0 0 0 0 0 0 0 R 0 0 W Bit 7 Bit 6 W R W R W R W R PLLSEL PSTP CME 1 Bit 0 POSTDIV[4:0] W R 2 PLLWAI ILAF 0 0 SCMIF SCMIE SCM 0 RTIWAI COPWAI PRE PCE SCME RTR2 RTR1 RTR0 CR2 CR1 CR0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 WRTMASK W R W 2. FORBYP and CTCTL are intended for factory test purposes only. = Unimplemented or Reserved Figure 11-2. CRG Register Summary NOTE Register Address = Base Address + Address Offset, where the Base Address is defined at the MCU level and the Address Offset is defined at the module level. MC9S12XE-Family Reference Manual Rev. 1.25 472 Freescale Semiconductor Chapter 11 S12XE Clocks and Reset Generator (S12XECRGV1) 11.3.2 Register Descriptions This section describes in address order all the S12XECRG registers and their individual bits. 11.3.2.1 S12XECRG Synthesizer Register (SYNR) The SYNR register controls the multiplication factor of the IPLL and selects the VCO frequency range. Module Base + 0x0000 7 6 5 4 3 2 1 0 0 0 0 R VCOFRQ[1:0] SYNDIV[5:0] W Reset 0 0 0 0 0 Figure 11-3. S12XECRG Synthesizer Register (SYNR) Read: Anytime Write: Anytime except if PLLSEL = 1 NOTE Write to this register initializes the lock detector bit. ( SYNDIV + 1 ) f VCO = 2 × f OSC × ------------------------------------( REFDIV + 1 ) f VCO f PLL = -----------------------------------2 × POSTDIV f PLL f BUS = ------------2 NOTE fVCO must be within the specified VCO frequency lock range. F.BUS (Bus Clock) must not exceed the specified maximum. If POSTDIV = $00 then fPLL is same as fVCO (divide by one). The VCOFRQ[1:0] bit are used to configure the VCO gain for optimal stability and lock time. For correct IPLL operation the VCOFRQ[1:0] bits have to be selected according to the actual target VCOCLK frequency as shown in Table 11-2. Setting the VCOFRQ[1:0] bits wrong can result in a non functional IPLL (no locking and/or insufficient stability). Table 11-2. VCO Clock Frequency Selection VCOCLK Frequency Ranges VCOFRQ[1:0] 32MHz