Catch a write to PPAGE

[sebasira]

Hi all!

I'm having this problem, sometimes, my application freezes... Like if it has jump to and invalid address or something like that. I couldn`t find a condition that always causes this, and it's very difficult for me to find. But I've notice that, in HiWave, everytime it happens, PPAGE = 9

So I guess I could set a watchpoint on PPAGE address (0x0030 on my HCS12A256), with the condition _PPAGE == 0x09. 

The porblem is that no matter what condition I put, the MCU seems to be running very slowly. Maybe it is because it checks the condition permanently and the application come and go from one page to another. I mean, it runs because whe I halted it stops in different places of my code. The problem is that keyboard (IRQ) is not responding.

Is there other way I can see why (and when) PPAGE values changes to 9?

As said befores, I'm using HCS12A256 and CW4.6

Thanks in advance

[kef]

Hi, Sebasira.

Interesting questions should be answered :smileyhappy:. And here is what I have to say:

Yes, debuggers watchpoint with break condition entered seems slowing execution enormously. But if you read all S12 docs (S12BKPV? module), then you should be aware that S12 breakpoints hardware allows breaking on some certain byte read or written to some certain address. So in theory you can detect and break on PPAGE set to weird value.

But problem is that debugger doesn't support all possible HW breakpoint modes and you need to set up S12BKP hardware "by hand". There are two choices

1) Doing it from code. You hit run in debugger, and your code should execute lines below. Since this will overwrite debuggers breakpoint settings, you shouldn't stop and run again after these lines are executed.

   BKP0X = 0;   // full PPAGE address,  0x00030
   BKP0H = 0;
   BKP0L = 0x30;
  
   BKP1H = 9;   // Data to be compared. since PPAGE is at even address,
                // data to be compared should be placed into H part of
                // BKP1

   BKPCT1 =   BKPCT1_BK0MBH_MASK * 0 // full address match of PPAGE
            | BKPCT1_BK0MBL_MASK * 0 //

            | BKPCT1_BK1MBH_MASK * 0   // compare high part of data bus, PPAGE is at even address
            | BKPCT1_BK1MBL_MASK * 1   //

            | BKPCT1_BK0RWE_MASK * 1 // compare R/W signal
            | BKPCT1_BK0RW_MASK  * 0 // only write cycle is important
            | BKPCT1_BK1RWE_MASK * 0
            | BKPCT1_BK1RW_MASK  * 0
          ;//

   BKPCT0 = 0xE0; // enable breakpoint, full mode, BDM on breakpoint, non tag

At least on S12D64 it is working.  

2). It is possible to do the same using debuggers GUI:

1. Go HC12MultilinkCyclonePro -> Set Hardware BP... menu and set Breakpoint Module mode to User Controlled.

2. Go to 22-bits Break Module tab and set it up as attached

What I noticed in CW5.1 debugger, every time you reset target, User Mode BKP settings are not resent to target and you need to open and then close HC12MultilinkCyclonePro -> Set Hardware BP... dialog. After dialog is closed, you hit run and it should break after PPAGE=9.

There's one more problem, debugger seems stopping few instructions past write to PPAGE. It seems that CPU first finishes executing queued instructions, and only then enters active BDM mode.

 Hope it helps.

[sebasira]

Hi Kef!

Thanks for your reply!

I'm having problems in doing as you explain me... I try both methods and non of them seems to be working.

For method (1) I just copy-paste your lines into main function (just after it enters it, before all inits). Then, I start "playing" with the equipment until it hangs... Indeed, it did, but it did it as always. I can see PPAGE = 9, but it seems that the BP didn't work.

Method (2), I set the values as in your images, but same thing as above, happend.

Maybe what I said in my first post is "not true". I mean, could be that something hangs the software, and when it does it shows (not write) PPAGE = 9? Maybe PPAGE is never written, but and incorrect value is displayed in HiWave.

Thanks!

[sebasira]

I didn't find the doc you mentioned. Do you have a link to it?

I've try to test method (1) with a know write event, just to see/test how this method works. Well, it didn't. Maybe I'm missing something.

I've got a variable at address 0x325E (RAM), so I modifed the above piece of code to fit it and halt the MCU when it value is 0x01. (note that 0x325E remains an even address)

 BKP0X = 0;   // full PPAGE address,  0x00030 BKP0H = 0x32; BKP0L = 0x5E;   BKP1H = 1;   // Data to be compared. since PPAGE is at even address,                // data to be compared should be placed into H part of                // BKP1  BKPCT1 =   BKPCT1_BK0MBH_MASK * 0 // full address match of PPAGE            | BKPCT1_BK0MBL_MASK * 0 //            | BKPCT1_BK1MBH_MASK * 0   // compare high part of data bus, PPAGE is at even address            | BKPCT1_BK1MBL_MASK * 1   //            | BKPCT1_BK0RWE_MASK * 1 // compare R/W signal            | BKPCT1_BK0RW_MASK  * 0 // only write cycle is important            | BKPCT1_BK1RWE_MASK * 0            | BKPCT1_BK1RW_MASK  * 0          ;// BKPCT0 = 0xE0; // enable breakpoint, full mode, BDM on breakpoint, non tag

As said before, I put it right after main function is entered.

Hope you can help me here.

PS: About PPAGE not been writting, I check address 0x00030 and it values was 9 indeed. Unless that's not the real value

[kef]

Document S12BKPV1.pdf in this zip file :

http://cache.freescale.com/files/microcontrollers/doc/data_sheet/9S12DT256_ZIP.zip

The same BKP module is on S12D64, also the same on S12A???. If it worked for me, then it should work also for you, unless your code on runaway overwrites BKP registers.

Since PPAGE register bits 6 and 7 are always read as zero... and since BKP module captures not how it reads, but what appears during write cycle on the data bus, you should try the method with all 4 possible values: 0x9, 0x49, 0x89 and 0xC9. It should catch one of these.

Regarding variable at 0x325E. Is it 8 bit variable and you write 1 to it? Hm, It should work. I tested PPAGE=9, also a call to not existing routine in PPAGE=9, also different PPAGE=x value. All times it worked. When it stopped on this breakpoint, I saw "unknown breakpoint" message in command window.

[sebasira]

Thanks for your quick reply kef, and thank you for the links. That document help me understand how does it work... Well, I was creating a dumb project just to test it (hoping it fails and show you) when for my sourprise it worked!

So I was guessing why it wouldn't in the other? The variable at 0x325E, was really a word starting at 0x325D, but I as I only care for the low byte, I guessed it would be the same. Now I've learnt it won't. I think that's because write access is done to the entery word and no single byte. That's why full compare of address won't work with 0x325E, because it would access 0x325D.

Then  (before I realize that) I tried an odd address, and didn't work because I only change BKP1H for BKP1L; and did not change BK1MB to match the low byte. 

Now it works, and rigth now I'm trying to catch the write to PPAGE. I'll try those values you suggested.

Thanks, and I'll let you know what happens!

Best Regards!

[sebasira]

Well, I've manage to found where the illegal address was executed. I found it manually. I place logs and I simplify code just to find that error.

Kef: I couldn't make it work for writte cycles to PPAGE, it works on other variables. Anyway, you have gave me a very important tool, I hope I can use in the future, so although it wasn't the solution, it was a very important post for me. 

Kudos for you!!

Best Regars!

[kef]

Sebastian,

I'm sorry it didn't help. Yes, it seems you had to try also word write to 0x2F with PPAGE byte in lower half of this word. Word write 0x09XX to 0x30 is detected with code above, but not 0xXX09 to 0x2F. In BKP set up you should modify BKP address to 0x2F and keep BK1MBL bits the same (still to match higher order byte of data bus, it is still a byte at even address).

@0x2F there is BKP1L :smileyhappy:. Luckily it doesn't need to be compared, so no problem detecting misaligned word write to PPAGE

I'm attaching a demo, which demonstrates breakpoint on RTC, CALL instructions, also direct 8bit write to PPAGE, also misaligned word write to PPAGE.

• Then  (before I realize that) I tried an odd address, and didn't work because I only
• change BKP1H for BKP1L; and did not change BK1MB to match the low byte.

No. BKP1H vs BKP1L, also BK1MB bits depend only on oddity of address of specific byte. Odd byte addresses appear in lower half of data bus bits, so it is BKP1L and BK1MB bits = 1:0. Byte at even address appears in higher half of data bus, so BKP1H and BK1MB=0:1.

[kef]

BTW quite old S12C has much more sofisticated debug module. It has not only 3 (vs 2 on S12D/S12A) breakpoints, but also onchip trace module. CW PRO + P&E multilink supports nearly all features of S12C DBG module. Coverage, profiler, full-mode breakpoints like we are discussing, etc all it is supported. For some weird reason newer derivatives like S12X or S12P, which have the same and even more capabilities, are not supported such well. No profiler, no coverage, no address+data breakpoints. :smileysad:

See screen shots, S12C vs quite fresh S12P

[sebasira]

Thanks Kef!

Sometimes I'm amaze of how much you know!

I''l test the code you posted and hope to learn a bit more!

Best Regards!