JP2010102743A - Microcomputer - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a microcomputer for performing overwrite control of a built-in flash memory 5 directly from a debug tool 2 to improve debug work efficiency. <P>SOLUTION: Built-in flash information stored in the built-in flash memory 5 is read by a CPU 3 from a debug tool 2 via a JTAG interface 11 and overwrite data based on the built-in flash information are input from the debut tool 2 via the JTAG interface 11; moreover, overwrite data are overwritten by the CPU 3 to the built-in flash memory 5 on the basis of an overwrite program stored in the built-in flash memory 5. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a microcomputer effective for debugging in an actual use environment.

  When debugging a microcomputer provided in a microcomputer application device or the like, a debugging tool such as an ICE (emulator) is used. When the microcomputer has a built-in flash memory, it is necessary to rewrite the data in the flash memory during debugging. However, since the conventional debugging tool does not have a rewriting function for the flash memory built in the microcomputer, the rewriting is performed using a flash writer which is a dedicated flash memory rewriting tool, or the user can A program for rewriting the flash memory was prepared, and the program was rewritten by executing the program with a debugging tool.

  Since the conventional microcomputer is configured as described above, if a flash writer is used for rewriting the flash memory, a flash writer must be prepared separately from the debugging tool. Becomes higher. In addition, since a flash writer must be used according to the configuration of the flash memory, a different flash writer must be used every time the flash memory configuration is different, resulting in problems such as reduced debugging work efficiency. there were.

  Furthermore, when a rewriting program is executed by a debugging tool, the user has to prepare a rewriting program, which causes problems such as a reduction in debugging work efficiency.

  Furthermore, in the above flash memory rewriting methods, the flash memory rewrite control cannot be performed directly from the debug tool, so that it is not possible to use a debugging function that involves rewriting the flash memory. There was a problem that the function of the debug tool was restricted, such as the inability to use the break function.

  The present invention has been made to solve the above-described problems, and provides a microcomputer capable of performing rewrite control of a built-in flash memory directly from a debug tool and capable of increasing the work efficiency of debugging. For the purpose.

  The microcomputer according to the present invention makes it possible to read the internal flash information stored in the second storage means from the debug tool via the interface, and input write data based on the internal flash information from the debug tool via the interface. And a CPU for rewriting write data in the built-in flash memory based on the rewrite program stored in the first storage means.

  In the microcomputer according to the present invention, the first storage means is provided in the built-in flash memory.

  The microcomputer according to the present invention is provided with an E / W mode transition program, an erase program, a write program, a status ready wait program, and an E / W mode end program in the rewrite program.

  In the microcomputer according to the present invention, the second storage means is provided in the built-in flash memory.

  The microcomputer according to the present invention includes the built-in flash information including block information composed of the block size and address of the built-in flash memory and rewrite program information composed of the start address of the rewrite program.

  In the microcomputer according to the present invention, the internal flash information is provided with information indicating the storage location of the security code.

  The microcomputer according to the present invention includes, in the built-in flash information, information indicating where an area used for saving a rewrite program of the built-in flash memory and temporarily holding write data is present.

  In the microcomputer according to the present invention, the built-in flash information is provided with size information of an area used to temporarily hold write data when the built-in flash memory is rewritten.

  The microcomputer according to the present invention includes a first storage means for storing a rewrite program for the internal flash memory, a second storage means for storing internal flash information related to the internal flash memory, and a debug tool via a serial interface via a serial interface. Debugging is executed based on the instruction code of the debug program held in the register 1 and the internal flash information is held in the second register so that it can be read out from the debug tool via the serial interface. And a CPU for rewriting write data based on the built-in flash information held in the third register to the built-in flash memory based on the rewrite program.

  In the microcomputer according to the present invention, the serial interface is a JTAG interface.

  The microcomputer according to the present invention includes rewrite permission means for forcibly permit rewriting of the built-in flash memory regardless of the input value of the FP terminal permitting rewrite of the built-in flash memory in the debug mode.

  The microcomputer according to the present invention includes an E / W mode transition program execution means for shifting to a mode in which the internal flash memory can be erased and written by the CPU according to a branch instruction code from the debug tool, and a branch instruction code from the debug tool The erase program is executed by the CPU in accordance with the erase program execution means for erasing the block data in accordance with the address of the internal flash memory from the debug tool, and the CPU executes the erase in accordance with the branch instruction code from the debug tool. Status ready wait program execution means that enables status information to be read from the debug tool, and erase program execution means and status ready wait according to the block to be erased in the internal flash memory where the erase execution status information is recognized as normal Program execution means after a predetermined number of times of execution, in which a E / W mode end program execution means to shift to the normal mode by the CPU in response to the branch instruction code from the debug tool.

  The microcomputer according to the present invention includes an E / W mode transition program execution means for shifting to a mode in which the internal flash memory can be erased and written by the CPU according to a branch instruction code from the debug tool, and a branch instruction code from the debug tool The erase program is executed by the CPU in accordance with the program, and erase program execution means for erasing the block data in accordance with the address of the built-in flash memory from the debug tool, and the write program by the CPU in accordance with the branch instruction code from the debug tool And write program execution means for writing the write data from the debug tool to the address of the internal flash memory from the debug tool, and write execution by the CPU according to the branch instruction code from the debug tool. Status ready waiting program execution means that makes it possible to read status information from the debug tool, and erase execution means, write program execution means and status according to the block to be rewritten in the internal flash memory where the write execution status information is recognized as normal After executing the ready waiting program execution means a predetermined number of times, an E / W mode end program execution means for shifting to the normal mode by the CPU in accordance with a branch instruction code from the debug tool is provided.

  As described above, according to the present invention, the internal flash information stored in the second storage means can be read from the debug tool via the interface, and the write data based on the internal flash information can be read from the debug tool via the interface. And a CPU that rewrites the write data into the built-in flash memory based on the rewrite program stored in the first storage means. The built-in flash memory can be directly rewritten and used, and the work efficiency of debugging can be increased.

  Further, since the built-in flash information is built into the microcomputer and the debug tool can read the built-in flash information, the debug tool can prepare write data according to the built-in flash information. Therefore, even if the microcomputers have different internal flash memory capacities, block configurations, etc., the same debug tool can be used for rewriting.

  Furthermore, the built-in flash memory rewrite program is built into the microcomputer, and the interface is such that the internal flash memory is rewritten when the debug tool starts the rewrite program. Even with a microcomputer, the same debugging tool can be used for rewriting.

  Also, according to the present invention, since the first storage means is provided in the built-in flash memory, the rewrite program is stored in the built-in flash memory, so that the rewrite program can be stored even after the microcomputer chip is manufactured. Can be written or rewritten.

  Furthermore, according to the present invention, the rewrite program is configured to include the E / W mode transition program, the erase program, the write program, the status ready wait program, and the E / W mode end program. By configuring the program module, the entire rewriting program can be reduced in size.

  Further, by dividing the program into an erasing program and a writing program, an effect of performing only the erasing of the built-in flash memory can be obtained.

  Further, according to the present invention, since the second storage means is provided in the built-in flash memory, the built-in flash information is stored in the built-in flash memory, so that the built-in flash memory is built in even after the microcomputer chip is manufactured. The effect that the flash information can be written or rewritten can be obtained.

  Furthermore, according to the present invention, since the built-in flash information includes the block information including the block size and address of the built-in flash memory and the rewrite program information including the start address of the rewrite program, the debug tool The rewrite data can be prepared according to the block information. Therefore, even if the microcomputers have different internal flash memory capacities, block configurations, arrangement addresses, etc., the same debugging tool can be used for rewriting.

  In addition, since the debug tool can read the storage location of the rewrite program in the internal flash memory, the same debug tool can be used for rewriting even if the internal flash memory rewrite program storage location is different. can get.

  Further, according to the present invention, the built-in flash information is configured to include information indicating the storage location of the security code, so that the debugging tool can be compared with the security code input by the user according to the comparison. Thus, an effect of providing a function for permitting rewriting is obtained.

  Further, according to the present invention, the internal flash information is configured to include information indicating where an area used for saving the rewrite program when rewriting the internal flash memory or temporarily holding the write data is provided. As a result, the debug tool can save the data in the temporary area and can prevent the data in the temporary area from being erased by the rewriting process of the built-in flash memory.

  Furthermore, according to the present invention, the built-in flash information is configured to include the size information of the area used to temporarily hold the write data when rewriting the built-in flash memory. As a result, it is possible to produce the write data.

  Further, according to the present invention, the first storage means storing the rewrite program of the internal flash memory, the second storage means storing the internal flash information regarding the internal flash memory, and the debug tool via the serial interface via the serial interface. Debugging is executed based on the instruction code of the debug program held in the register 1 and the internal flash information is held in the second register so that it can be read out from the debug tool via the serial interface. And a CPU that rewrites the write data based on the built-in flash information held in the third register to the built-in flash memory based on the rewrite program. This microcomputer can be debugged if the instruction code of the program is set in the first register, and the internal flash memory can be rewritten directly from the debugging tool during debugging. Efficiency can be further increased.

  Further, since the built-in flash information is built into the microcomputer and the debug tool can read the built-in flash information, the debug tool can prepare write data according to the built-in flash information. Therefore, even if the microcomputers have different internal flash memory capacities, block configurations, etc., the same debug tool can be used for rewriting.

  Furthermore, the built-in flash memory rewrite program is built into the microcomputer, and the interface is such that the internal flash memory is rewritten when the debug tool starts the rewrite program. Even with a microcomputer, the same debugging tool can be used for rewriting.

  Further, by using a serial interface, an effect of reducing the number of terminals for interface with the debug tool can be obtained.

  Furthermore, since the function that can supply the CPU instruction from the debug tool is a function that can be used for normal debugging of the microprocessor, this function can share the normal debugging and the rewriting function of the built-in flash memory. Therefore, there is an effect that no hardware dedicated to the built-in flash memory is added.

  Furthermore, according to the present invention, since the serial interface is configured as the JTAG interface, it can be shared with the JTAG interface for performing the boundary scan test, and there is no need to provide a new serial interface, and the configuration is simplified. The effect which can be done is acquired.

  Furthermore, according to the present invention, since it is configured to include the rewrite permission means for forcibly permit rewriting of the built-in flash memory regardless of the input value of the FP terminal permitting rewrite of the built-in flash memory in the debug mode. In the debug mode, there is an effect that the built-in flash memory can be rewritten by the debug tool regardless of the input value of the FP terminal.

  Furthermore, according to the present invention, an E / W mode transition program executing means for shifting to a mode in which the built-in flash memory can be erased and written by the CPU in accordance with a branch instruction code from the debug tool, and a branch instruction code from the debug tool The erase program is executed by the CPU in accordance with the erase program execution means for erasing the block data in accordance with the address of the internal flash memory from the debug tool, and the CPU executes the erase in accordance with the branch instruction code from the debug tool. Status ready wait program execution means that enables status information to be read from the debug tool, and erase program execution means and status ready wait program according to the block to be erased in the internal flash memory where the erase execution status information is recognized as normal Since the E / W mode end program executing means for shifting to the normal mode by the CPU according to the branch instruction code from the debug tool after executing the line means a predetermined number of times, the branch instruction code from the debug tool is provided. Accordingly, an effect of performing a series of erasing processes for erasing data in a predetermined block of the built-in flash memory can be obtained.

  Furthermore, according to the present invention, an E / W mode transition program executing means for shifting to a mode in which the built-in flash memory can be erased and written by the CPU in accordance with a branch instruction code from the debug tool, and a branch instruction code from the debug tool The erase program is executed by the CPU in accordance with the program, and erase program execution means for erasing the block data in accordance with the address of the built-in flash memory from the debug tool, and the write program by the CPU in accordance with the branch instruction code from the debug tool And write program execution means for writing the write data from the debug tool to the address of the built-in flash memory from the debug tool, and write execution status information by the CPU according to the branch instruction code from the debug tool Status ready waiting program execution means that can be read from the bag tool, and erase execution means, writing program execution means, and status ready waiting program according to the block to be rewritten in the internal flash memory where the write execution status information is recognized as normal Since the execution means is executed a predetermined number of times, and the E / W mode end program execution means for shifting to the normal mode by the CPU according to the branch instruction code from the debug tool is provided, the branch instruction code from the debug tool is provided. Accordingly, it is possible to execute a series of rewriting processes for rewriting write data in a predetermined block of the built-in flash memory.

It is a block diagram which shows the microcomputer by Embodiment 1 of this invention. It is a block diagram which shows the detail of CPU and a debug module of a microcomputer. It is explanatory drawing which shows the process sequence at the time of a debug event generation | occurrence | production. It is explanatory drawing which shows the area | region for debug modules mapped by the built-in area | region. It is a block diagram which shows the register structure of a monitor code supply function and a JTAG control part. It is explanatory drawing which shows the memory area of a built-in flash memory. It is explanatory drawing which shows a flash ready status register. It is explanatory drawing which shows a flash memory control register. It is explanatory drawing which shows the information regarding internal flash rewriting. It is explanatory drawing which shows the structure of a tool ROM area | region. It is explanatory drawing which shows the structure of a built-in flash information storage area. It is a flowchart which shows the operation | movement of a monitor code supply function and a JTAG control part. It is a flowchart which shows the outline | summary of the rewriting operation | movement of a built-in flash memory. It is a flowchart which shows the erase | elimination operation | movement of a built-in flash memory. 3 is a flowchart showing details of an erasing operation of a built-in flash memory. It is a flowchart which shows the write-in operation | movement of a built-in flash memory. It is a flowchart which shows the detail of write-in operation | movement of a built-in flash memory.

An embodiment of the present invention will be described below.
Embodiment 1 FIG.
FIG. 1 is a block diagram showing a microcomputer according to Embodiment 1 of the present invention. In FIG. 1, reference numeral 1 denotes a one-chip microcomputer provided in a microcomputer application device or the like, and reference numeral 2 denotes a connection when the microcomputer 1 is debugged. It is a general-purpose debugging tool. In the microcomputer 1, 3 is a CPU which is a microprocessor having 16 32-bit general purpose registers (R0 to R15), 4 is a debug module which is a feature of the first embodiment, and 5 is a first embodiment. The built-in flash memory storing the user program, which is a characteristic of the first embodiment, 6 is a built-in SRAM which is the characteristic of the first embodiment, 7 is a built-in peripheral I / O such as a DMA controller, interrupt controller, and timer, and 8 is bus control. A circuit 9 is a 32-bit internal bus connecting the modules.

  Further, in the periphery of the built-in flash memory 5, 5a is an FP terminal for inputting a flash protect signal for permitting rewrite of the built-in flash memory 5 with an input value of “1”, and for prohibiting rewrite with an input value of “0”, and 5b. An OR circuit that takes the logical sum of the flash protect signal and a mode signal that is “1” in the debug mode and “0” in the normal mode that is output from the CPU 3. The output value of the OR circuit 5 b is “1”. The internal flash memory 5 is a flash internal control circuit that permits rewriting of the internal flash memory 5 and prohibits rewriting of the internal flash memory 5 when “0”. The input value of the FP terminal 5a is determined by the OR circuit 5b and the flash internal control circuit 5c. Rewrite permission means for forcibly allowing rewriting of the built-in flash memory 5 when the debug mode is entered regardless of To configure.

  FIG. 2 is a block diagram showing details of the CPU and debug module of the microcomputer. In FIG. 2, reference numeral 11 denotes five JTAG interfaces defined by IEEE 1149.1 for connecting the debug module 4 and the external debug tool 2. Terminals (interface, serial interface), and the function of each terminal will be described below.

TCK terminal: Clock input terminal TDI terminal: Terminal for inputting test instruction code or test data serially TDO terminal: Terminal for outputting test instruction code or test data serially TMS terminal: Test mode selection for controlling state transition of test circuit TRST terminal: A terminal for inputting a test reset for asynchronously initializing the test circuit 12 is a terminal for inputting a debug interrupt to the CPU 3 from the outside of the chip.

  Further, in the CPU 3, 13a is a debug trap instruction execution function, and this debug trap instruction execution function 13a is a debug dedicated trap instruction. When the CPU 3 executes this instruction, a debug event occurs and the debug mode is entered. It is to be migrated. Reference numeral 13b denotes a program counter. The program counter 13b is a register that holds an address of an instruction executed by the CPU 3. Reference numeral 13c denotes a program counter saving register. The program counter saving register 13c is a register to which the value of the program counter 13b is saved when a debug event or the like occurs. Reference numeral 13d denotes a PSW register, and the PSW register 13d is a register indicating the state of the CPU 3. Reference numeral 13e denotes a PSW saving register, and the PSW saving register 13e is a register to which the value of the PSW register 13d is saved when a debug event or the like occurs. In addition to the above, the CPU 3 has 16 instruction execution functions and general-purpose registers 13f provided in a general CPU such as a load instruction, a store instruction, a branch instruction, and an addition instruction. Here, since it is not directly related to this embodiment, the details are omitted. Reference numeral 14 denotes a post-execution PC break function. The post-execution PC break function 14 sets a program counter value of a target instruction, a debug event occurs immediately after the execution of the instruction, and shifts to a debug mode. is there.

  In the debug module 4, reference numeral 15 denotes a JTAG control unit. The JTAG control unit 15 communicates with the debug tool 2 through the JTAG interface terminal 11 to control the debugging function. It includes an accessible debug-related control register, a TAP controller that controls access at the JTAG interface terminal 11, and the like. Reference numeral 16 denotes a monitor code supply function for executing a CPU instruction through the JTAG interface terminal 11 which is a feature of the first embodiment. Reference numeral 17 denotes an access break function. The access break function 17 sets a target data access condition. Then, data access satisfying the set condition is detected. When the condition is satisfied, a debug interrupt request is output to the CPU 3. Reference numeral 18 denotes a pre-execution PC (program counter) break function. When the pre-execution PC break function 18 sets a program counter value of a target instruction, the pre-execution PC break function 18 detects that the instruction has been fetched and A PC break request is output. When the CPU 3 receives a pre-execution PC break request, a debug event occurs immediately before the execution of the instruction, and a transition is made to the debug mode. Reference numeral 19 denotes a debug interrupt request. This debug interrupt request 19 is a debug-dedicated interrupt, and is obtained by logically ORing debug interrupt requests generated from three locations of the DBI terminal 12, the JTAG control unit 15, and the access break function 17. The data is output to the CPU 3 after the realization. When a debug request is input to the CPU 3, a debug event occurs and shifts to the debug mode.

  As described above, the microcomputer 1 has a built-in debug function, and the debug module 4 mainly controls the debug function.

Here, supplementary explanation of JTAG will be given.
In today's microcomputer-applied equipment, board-level testing has become difficult due to high-density mounting, high device integration, large scale, and narrow pitch. A JTAG (Joint Test Action Group) was formed mainly by European and American semiconductors, electronic equipment manufacturers, tester manufacturers, etc. for the purpose of solving such board-level test problems. The board-level test method proposed by JTAG is called the boundary scan method, and is currently referred to as the IEEE 1149.1 Test Port Access Standard (IEEE Standard Test Access Port and Boundary Scan Architecture (IEEE Std. 1143. 1149.1)). As standardized.

  In the boundary scan method, a scan register circuit (boundary scan) is inserted between input / output pins of each device mounted on the board and an internal circuit, and a control circuit and a dedicated pin are further provided. On the board, the boundary scan of each device is connected, and data is input and output serially using a dedicated port, thereby enabling access and control of all the scan registers. By inputting instructions and data serially and observing serially output data, the connection test between devices on the board and the internal test can be performed without contacting the test probe on the board. Can do.

The boundary scan is composed of the following components.
TAP (Test Access Port) A port for performing input / output and control of data to / from the boundary scan, and corresponds to the JTAG interface terminal 11 in FIG.

  TAP controller A state transition is performed in accordance with inputs from the TCK terminal and the TMS terminal, and the test circuit is controlled.

  Instruction register This register holds the test instruction code and decodes this value to generate a control signal for the test circuit. Test instruction codes include a SAMPLE / PRELOAD instruction, an EXTEST instruction, and a BYPASS instruction. In addition to the above commands, it is also allowed to add device-specific private commands. The microcomputer according to the first embodiment also has some private instructions for the built-in debugging function.

Data register • Bypass register This is a 1-bit register provided between the TDI terminal and the TDO terminal, and is used to bypass the test circuit.

  -Boundary scan register A series of registers in which a shift register provided between the internal circuit of the device and each pin is connected in series.

  • In addition to the above, it is allowed to add device-specific data registers. The microcomputer according to the first embodiment also has several data registers for the built-in debug function.

FIG. 3 is an explanatory diagram showing a processing procedure when a debug event occurs.
The microcomputer 1 has two execution modes, a user mode and a debug mode. The mode in which the user program is executed is the user mode. When a debug event occurs during the execution of the user program, the user mode is changed to the debug mode. Transition. In the debug mode, the monitor program supplied from the debug tool 2 is executed.

  Types of debug events include execution of a debug trap instruction, a debug interrupt request, and a pre-execution / post-execution program counter break request.

  When a debug event occurs, the CPU 3 and the debug module 4 automatically perform the following processing, and then transition to the debug mode.

The value of the program counter 13b is saved in the program counter saving register 13c. The value of the PSW register 13d is updated after saving the value of the PSW register 13d in the PSW saving register 13e. Set the flag in the JTAG register in the JTAG control unit 15 • Branch to the debug event vector address (address H'FFFF9000) After branching to the debug event vector address, the debug tool 2 uses the monitor code supply function 16 to The monitor program is executed by supplying the code to the CPU 3.

  By executing a return instruction to the user mode (RTE instruction), a transition is made from the debug mode to the user mode. When transitioning to the user mode, the CPU 3 and the debug module 4 automatically perform the following processing.

Clear the debug event occurrence factor flag Restore the value saved in the PSW save register 13e to the PSW register 13d Restore the value saved in the program counter save register 13c to the program counter 13b and its value FIG. 4 is an explanatory diagram showing a debug module area mapped to the built-in area. In FIG. 4, reference numeral 21 denotes a debug module built-in I / O area (H'FFFF8000 to H'FFFF9FFF), and 22 denotes a debug module area. This is the debug module control register area (H'FFFF8000 to H'FFFF8FFF). The pre-execution PC break function register group, the access break function register group, and the monitor code supply function register group are arranged in this area. ing. Reference numeral 23 denotes a monitor code supply area (H'FFFF9000 to H'FFFF9FFF), which is an area where the monitor code supply function can be accessed. Instruction fetches in this area all fetch instruction codes via the JTAG interface terminal 11 using the monitor code supply function. The debug event vector entry (H'FFFF9000 to H'FFFF9003) branches to this area when a debug event occurs.

  Reference numeral 24 denotes a tool ROM area (H'FF003FE0 to H'FF003FFF), which is an area for storing an address where a security code and built-in flash information are placed. Reference numeral 25 denotes a security code storage area. The address and the number of bytes of this area are specified in the tool ROM area 24. An internal flash information storage area 26 stores an entry address of an E / W mode transition program which is one of internal flash rewrite programs (hereinafter referred to as a rewrite program) and block configuration information of the internal flash memory 5. This is an area, and the address and the number of bytes of this area are specified in the tool ROM area 24.

  FIG. 5 is a block diagram showing the register configuration of the monitor code supply function and the JTAG control unit. Here, the monitor code supply function 16 supplies an instruction code to the CPU 3 from the outside using the JTAG interface terminal 11. It is a function. When a debug event occurs, the CPU 3 branches to the address H'FFFF9000 which is the head of the monitor code supply area 23 shown in FIG. 4 and executes the instruction code supplied from the monitor code supply function 16.

  In the JTAG control unit 15, 31 is a TAP controller that controls access at the JTAG interface terminal 11, and 32 is an instruction register that selects which test is performed using which register.

  Reference numeral 33 denotes a MON_CODE register (first register). The MON_CODE register 33 is used to set an instruction code supplied from the debug tool 2 when the monitor program is executed via the JTAG interface terminal 11 in the debug mode. It is a 32-bit register. The value set in the MON_CODE register 33 is transferred to the instruction code buffer 37 of the monitor code supply function 16. At this time, the input pointer of the instruction code buffer 37 is also automatically incremented.

  Reference numeral 34 denotes a MON_DATA register (second register). This MON_DATA register 34 outputs the execution result to the debug tool 2 when the monitor program is executed via the JTAG interface terminal 11 in the debug mode, or the built-in flash. This is a 32-bit register serving as an interface for outputting information to the debug tool 2. When writing to the FrontMON_DATA register 38 of the monitor code supply function 16 using a store instruction on the monitor program, the value is transferred to the MON_DATA register 34 and can be read from the debug tool 2 via the JTAG interface terminal 11.

  Reference numeral 35 denotes a MON_PARAM register (third register). The MON_PARAM register 35 is an interface for passing parameters such as rewrite data from the debug tool 2 when the monitor program is executed via the JTAG interface terminal 11 in the debug mode. This is a 32-bit register. When writing to the MON_PARAM register 35 from the debug tool 2 via the JTAG interface terminal 11, it is transferred to the FrontMON_PARAM register 39 of the monitor code supply function 16, and the value can be read using a load instruction on the monitor program.

  Reference numeral 36 denotes a MON_ACCESS register. The MON_ACCESS register 36 is a 4-bit register that sets / stores access control information when the monitor program is executed via the JTAG interface terminal 11 in the debug mode.

bit0 MNSTART Monitor code supply start bit (read / write available)
1: Instruction code set 0: Instruction code not set Setting "1" indicates that a valid value has been set in the instruction code buffer 37. That is, an instruction fetch request in the monitor code supply function 16 is accepted.

bit1 MNDTVLD FrontMON_DATA valid bit (read only)
1: FrontMON_DATA valid (There is a write to the FrontMON_DATA register 38 and the MON_DATA register 34 is not referenced)
0: FrontMON_DATA invalid (no writing to FrontMON_DATA register 38 or after referring to MON_DATA register 34)
This bit is set to “1” when there is a write to the FrontMON_DATA register 38. This bit is cleared to zero under the following conditions.

-When the MON_DATA register 34 is accessed-When an RTE instruction is executed in debug mode-When the debug control unit is reset (debug module reset)
bit2 MNPRMVLD FrontMON_PARAM valid bit (read only)
1: FrontMON_PARAM valid (MON_PARAM register 35 has been set, but FrontMON_PARAM register 39 has not been read yet)
0: FrontMON_PARAM invalid (after the MON_PARAM register 35 is not set or the FrontMON_PARAM register 39 is read)
This bit is set to “1” when the setting in the FrontMON_PARAM register 39 is performed. This bit is cleared to zero under the following conditions.

-When reading to the FrontMON_PARAM register 39-When executing an RTE instruction in debug mode-When resetting the debug controller (resetting the debug module)
bit3 MNCDBUSY MON_CODE busy bit (read only)
1: Cannot be set to MON_CODE 0: Can be set to MON_CODE This bit indicates whether or not the next instruction code may be set in the MON_CODE register 33. This bit has two meanings as follows.

Transfer from the MON_CODE register 33 to the instruction code buffer 37 = “1”, transfer completion = “0”, instruction code not fetched in the instruction code buffer 37 = “1”, not = “0”
This bit is set to “1” under the following conditions.

• When the MON_CODE register 33 is accessed • When the MNSTART bit is set to “1” This bit is cleared to zero under the following conditions.

When the value written to the MON_CODE register 33 is transferred to the instruction code buffer 37 When all the instructions stored in the instruction code buffer 37 are fetched by the CPU 3 (Note 1)
・ When executing RTE instruction in debug mode ・ When resetting the debug control unit (resetting the debug module)
(Note 1) Determination of instruction code buffer 37 fetch completion When a second instruction fetch request is issued for the first word of the instruction code buffer 37, “all instruction codes in the instruction code buffer 37 have been fetched” Judge. For example, when there is a branch instruction in the second word of the instruction code buffer 37, even if an instruction code is set in the third word and the fourth word, a branch destination instruction fetch request by the second word branch instruction However, when this occurs in the instruction code buffer 37, “all instruction codes have been fetched”. In the case of branching by the monitor code supply function 16, it is assumed that the debug tool 2 is required to be restricted so that the branch destination must be the start address of the instruction code buffer 37. That is, the branch destination address of the branch instruction set in the MON_CODE register 33 by the debug tool 2 must always be an address on a 4-word boundary (the lower 4 bits [28:31] of the address are “0000”). This restriction ensures that an instruction fetch request for the first word of the instruction code buffer 37 is always made when branching in the monitor code supply function 16.

  In the monitor code supply function 16, reference numeral 37 denotes an instruction code buffer. The instruction code buffer 37 is composed of 4 words, and the contents of the MON_CODE register 33 of the JTAG control unit 15 are transferred. The instruction code buffer 37 is mapped to (H′FFFF9000 to H′FFFF9FFF), and which word is selected is determined by the lower two bits of the address.

  Reference numeral 38 denotes a FrontMON_DATA register, and the FrontMON_DATA register 38 is a 32-bit register for passing execution results, built-in flash information, and the like to the debug tool 2. The contents of the FrontMON_DATA register 38 are transferred to the MON_DATA register 34 of the JTAG control unit 15.

  Reference numeral 39 denotes a FrontMON_PARAM register, and the FrontMON_PARAM register 39 is a 32-bit register for passing parameters such as rewrite data from the debug tool 2 to the monitor program. The contents of the MON_PARAM register 35 of the JTAG control unit 15 are transferred to the FrontMON_PARAM register 39.

9a is an address bus and 9b is a data bus.
FIG. 6 is an explanatory diagram showing a memory area of the built-in flash memory, in which 41 is a user area and 42 is a boot ROM area.

  The user area 41 of the built-in flash memory 5 is an area that can be used by a user divided into 11 blocks, with 512 Kbytes of flash memory allocated to addresses (H'00000000 to H'0007FFFF). The built-in flash memory 5 can be erased all at once or in blocks, and the built-in flash memory 5 can be written on a page basis (1 page = 256 bytes). is there. The internal flash memory 5 can be erased and written by shifting to a flash E / W enable mode described later.

  The boot ROM area 42 of the internal flash memory 5 is an area in which a 16 Kbyte flash memory is allocated to addresses (H′FF000000 to H′FF003FFF) and stores a rewrite program for the built-in flash memory 5.

  FIG. 7 is an explanatory diagram showing a flash ready status register. In the figure, 51 is a flash ready status register, which is a 32-bit register provided in the built-in flash memory 5. Reference numeral 52 denotes an FSTAT (ready status) bit provided in the flash ready status register 51, which indicates an operation state of erasing and writing to the built-in flash memory 5.

0: Erasing or writing is being executed 1: Ready state This FSTAT bit 52 is controlled by the flash internal control circuit 5c shown in FIG.

  FIG. 8 is an explanatory diagram showing the flash memory control register. In the figure, reference numeral 61 denotes a flash memory control register, which is a 32-bit register provided in the built-in flash memory 5. 62 is a FENTRY (flash mode entry) bit provided in the flash memory control register 61, and is a bit for controlling the transition to the flash E / W enable mode. Setting this bit to “1” shifts to flash E / W enable, and setting this bit to “0” returns to the normal operation mode.

  The FENTRY bit 62 is controlled by the flash internal control circuit 5c shown in FIG.

  FIG. 9 is an explanatory diagram showing information related to the internal flash rewrite. In the figure, a tool ROM area 24 is an area for storing an address where a security code or internal flash information is placed, as shown in FIG. Located in the built-in space.

  FIG. 10 is an explanatory diagram showing the configuration of the tool ROM area. As shown in the figure, the location of the tool ROM area 24 is address (H'FF003FE0 to H'FF003FFF), and each information is stored in the tool ROM area 24. Is already set, a code of a fixed value (H′DF534449) is embedded at the address (H′FF003FFC-F). The debug tool 2 uses each information in the tool ROM area 24 after confirming the value of this code.

  Further, as shown in FIGS. 9 and 10, when the security code storage area 25 and the security level information are placed and the security code is set, the security code is compared on the debug tool 2 side to match the security code. If not, restrict the operation of the tool according to the security level.

H'FF003FF0-1 address Security code byte count H'FF003FF2-3 address Security level H'0000 Level 0
Do not allow any operation other than resetting the debug tool.

H'0001 Level 1
Debug tool operation is not permitted unless the entire area of the internal flash is erased.

Address H'FF003FF4-7 Start address of security code storage area If there is no security code, it becomes (H'FFFFFFFF).

  Furthermore, as shown in FIGS. 9 and 10, the head address of the built-in flash information storage area 26 is placed.

H'FF003FE8-EB address Start address of the built-in flash information storage area If there is no built-in flash information storage area, the address becomes H'FFFFFFFF.

  FIG. 11 is an explanatory diagram showing the configuration of the internal flash information storage area. As shown in the figure, the head address of the internal flash information storage area 26 is located at address H'FF003FE8-EB in the tool ROM area 24. . The internal flash information storage area 26 stores the following information.

E / W mode transition program entry address (rewrite program information)
Start address + H'00 to H'03: E / W mode transition program entry address Number of internal flash blocks Start address + H'04 to H'07: Number of internal flash blocks Each block information start address + H '08 -H '0B address: Start address of block 0
H'0C to H'0F addresses: Number of bytes in block 0
H'10 to H'13: Start address of block 1
H'14 to H'17: Number of bytes in block 1
...
8n + H'08 to H'0B addresses: start address of block n
8n + H'0C to H'0F addresses: Number of bytes in block n (Note) Number of blocks = (n + 1) pieces Information on temporary area used when rewriting internal flash memory When rewriting internal flash memory 5, storing or writing flash rewriting program A part of the built-in SRAM 6 is used as a data buffer. The start address and the number of bytes of an area used temporarily when rewriting the built-in flash memory 5 are stored.

  When the internal flash memory 5 is rewritten during debugging, this information is stored so that the data in this area can be saved from the internal SRAM 6 on the debug tool 2 side.

8n + H'10 to H'13: start address of flash rewriting temporary area
8n + H'14 to H'17: Number of bytes in flash rewriting temporary area (Note) Number of blocks = (n + 1) pieces Size of flash write buffer (= page size) Information Number of bytes in flash write buffer (= page Size).

8n + H'18 to H'1B addresses: number of bytes of flash write buffer (= page size)
(Note) Number of blocks = (n + 1) blocks Next, the configuration of the built-in flash rewrite program (rewrite program) will be described. The rewrite program is stored in the boot ROM 42 shown in FIG. 6, and is an E / W mode transition program, a block erase program (erase program), a page write program (write program), a status ready wait program, and an E / W end program. It consists of The configuration of each program will be described below.

E / W mode transition program The E / W mode transition program is a program that must be executed at the beginning of rewriting of the built-in flash memory 5. After setting various parameters necessary for rewriting in the CPU register, the flash E / W mode Transition to enable mode.

Execution method The monitor code supply function 16 is used to branch to the address stored in the first word of the internal flash information storage area 26. At this time, setting to the MON_PARAM register 35 is not necessary.

Processing contents (1) Set each parameter in the CPU register R0: No parameter setting, debug tool 2 can be used R1: No parameter setting, debug tool 2 can be used R2: No parameter setting, debug tool 2 can be used. R3: No parameter is set, and debug tool 2 can be used. R4: H'FFFF8400 (MON_DATA register 34 address)
R5: Start address of flash write buffer −4
R6: No parameter is set and the debug tool 2 can be used. R7: Number of bytes of buffer for flash writing (= page size)
R8: Entry address of block erase program R9: Entry address of page write program R10: Entry address of program waiting for status ready R11: Entry address of E / W end program R12: No parameter setting, debug tool 2 can be used R13: No parameter setting, debug tool 2 can be used R14: No parameter setting, debug tool 2 can be used R15: No parameter setting, debug tool 2 can be used (2) On internal flash memory 5 (3) Transfer to flash E / W enable mode (4) Write program normal / error end information to MON_DATA register 34 Execution end confirmation method Gutsuru 2 reads the MON_DATA register 34, by checking the value of the MSB bit (bit0), it can be confirmed whether the E / W mode transition program was successful.

Block Erase Program The block erase program is a program that issues an erase program to a block on the built-in flash memory 5 designated by the MON_PARAM register 35. Used in flash E / W enable mode.

Execution method The monitor code supply function 16 is used to branch to the address indicated by R8. At this time, the start address of the memory block to be erased is set in the MON_PARAM register 35. The block configuration information of the built-in flash memory 5 is in the built-in flash information storage area 26.

Processing Contents (1) Issue an erase command to the memory block specified by the MON_PARAM register 35. (2) Write to the MON_DATA register 34 at the end of the program.

Execution completion confirmation method The MON_DATA register 34 is written for handshaking between the tool (debug tool 2) side and the device (microcomputer 1) side. Writing to the MON_DATA register 34 indicates the end of this program. Accordingly, the contents of the MON_DATA register 34 are meaningless, but the debug tool 2 reads the MON_DATA register 34 once and then executes the next process.

  The end of the program does not indicate that the erase is complete. In order to confirm the completion of erasure, it is necessary to execute a “status ready program”.

Page Write Program The page write program is a program that issues a page write command to the page specified by the MON_PARAM register 35. Used in flash E / W enable mode.

Execution method The monitor code supply function 16 is used to branch to the address indicated by R9. At this time, the top address of the page to be written is set in the MON_PARAM register 35. The write data is transferred to the flash write buffer area on the built-in SRAM 6 in advance. The head address of the buffer is indicated by (R5 value + 4), and the buffer size (= page size) is indicated by R7 value. This process can be realized by executing the following instruction using the monitor code supply function 16.

FFFF9000 LD R0, @ (4, R4)
: (R4 value + 4) = H′FFFF8004 is read, and the read data is stored in R0. That is, the FrontMON_PARAM value (= write data) is read and set to R0.

FFFF9004 ST R0, @ + R5
: After the value of R5 is +4, the value of R0 is stored at the address indicated by the R5 value. That is, the write data read by the above instruction is transferred to the flash write buffer.

FFFF9006 ADDI R7, # -4
: Decrease the value of R7 by -4. That is, the size of the write buffer is decremented by one word.

FFFF9008 BNEZ R7, LFFFF9000
: When the value of R7 is not zero, branch to address H'FFFF9000, and when it becomes zero, move to address H'FFFF900C. That is, it loops until the transfer for the buffer size is completed.

FFFF900C JMP R8
: Jump to the address indicated by the value of R8. That is, when the transfer is completed, the program jumps to the status ready waiting program.

FFFF900E NOP
Processing Contents (1) Issue a write command to the page specified by the MON_PARAM register 35 for the data in the flash write buffer. (2) Set the values of the CPU registers R5 and R7 to the following values. (The values of R5 and R7 can be used as they are at the time of transfer processing to the next buffer.)
R5: Start address of flash write buffer -4
R7: Number of bytes in the flash write buffer (= page size)
(3) Write to the MON_DATA register 34 at the end of the program.

Execution end confirmation method The MON_DATA register 34 is written for handshaking between the tool side and the device side. Writing to the MON_DATA register 34 indicates the end of this program. Accordingly, the contents of the MON_DATA register 34 are meaningless, but the debug tool 2 reads the MON_DATA register 34 once and then executes the next process.

  The termination of this program does not indicate that writing has been completed. To confirm the completion of writing, it is necessary to execute a “status ready waiting program”. After this program is finished, the next write data can be written in the flash write buffer.

Status Ready Waiting Program The status ready waiting program is a program for waiting until erase or writing is completed after executing a block erase program or page write program. Whether the erasure or writing has been normally completed is reflected in the MON_DATA register 34. Used in flash E / W enable mode.

Execution Method The monitor code supply function 16 is used to branch to the address indicated by R10. It is not necessary to set the MON_PARAM register 35.

Processing Contents (1) Wait until the flash erase or write operation is completed. (2) Write program normal / error end information to the MON_DATA register 34.

Execution Completion Confirmation Method The debug tool 2 can confirm whether erasure or writing has been normally performed by reading the MON_DATA register 34 and confirming the value of the MSB bit (bit 0).

E / W mode end program The E / W mode end program is a program for returning from the flash E / W mode enable mode to the normal mode. Execute at the end of the internal flash rewrite process.

Execution method The monitor code supply function 16 is used to branch to the address indicated by R11. It is not necessary to set the MON_PARAM register 35.

Processing contents (1) Transition to the normal mode (2) Write to the MON_DATA register 34 at the end of the program.

Execution end confirmation method The MON_DATA register 34 is written for handshaking between the tool side and the device side. Writing to the MON_DATA register 34 indicates the end of this program. Accordingly, the contents of the MON_DATA register 34 are meaningless, but the debug tool 2 reads the MON_DATA register 34 once and then executes the next process.

Next, the operation will be described.
1. Monitor Code Supply Function and Operation of JTAG Control Unit FIG. 12 is a flowchart showing the operation of the monitor code supply function and the JTAG control unit. First, monitor code supply with reference to the configuration diagram of FIG. 5 and the flowchart of FIG. Functions and operations of the JTAG control unit will be described.

(1) Setting Monitor Code The debug tool 2 sets an instruction code in the MON_CODE register 33 through the JTAG interface terminal 11. The instruction code set in the MON_CODE register 33 is transferred to the instruction code buffer 37. At the same time, the MNCDBUSY bit of the MON_ACCESS register 36 is set to “1”, and “0” is set when the transfer is completed. The stage in which the instruction code for one word is stored in the instruction code buffer 37 is internally controlled by the input pointer. They are stored in buffers # 0 to # 3 in the order set previously. The value of the input pointer is cleared to zero by resetting the debug module or setting the MNSTART bit to “1” (ST1).

(2) Confirmation of Transfer to Instruction Code Buffer The debug tool 2 reads the MON_ACCESS register 36 and confirms that the MNCDBUSY bit is set to “0”. If the MNCDBUSY bit is set to “0”, this indicates that the instruction code set in the MON_CODE register 33 has been transferred to the instruction code buffer 37. The next instruction code is set in the MON_CODE register 33 after confirming that the MNCDBUSY bit is set to “0” (ST2).

The processes (ST1) and (ST2) are repeated any number of times up to four times.
The instruction code in the instruction code buffer 37 is held unless the MON_CODE register 33 is accessed. Therefore, when the instruction code set in the instruction code buffer 37 is used again, there is no need to newly set it again. If “1” is set in the MNSTART bit, the instruction code held in the instruction code buffer 37 is executed again by the CPU 3.

(3) Parameter setting This process is not necessary if the monitor program does not require parameters.

  The debug tool 2 sets a parameter in the MON_PARAM register 35 through the JTAG interface terminal 11. The parameter set in the MON_PARAM register 35 is transferred to the FrontMON_PARAM register 39, and at the same time, the MNPRMVLD bit of the MON_ACCESS register 36 is set to “1”. When the CPU 3 reads the FrontMON_PARAM register 39, “0” is set to the MNPRMVLD bit. The contents of the FrontMON_PARAM register 39 are retained unless the MON_PARAM register 35 is set. If the same parameter is used many times, it is not necessary to newly set it (ST3).

(4) Start of supply of monitor code The debug tool 2 sets “1” to the MNSTART bit of the MON_ACCESS register 36 through the JTAG interface terminal 11. By setting “1” to the MNSTART bit, the CPU 3 can fetch the contents of the instruction code buffer 37 (ST4).

(5) Release of start request The debug tool 2 sets “0” to the MNSTART bit of the MON_ACCESS register 36.

(6) Confirmation that monitor code has been fetched The debug tool 2 reads the MON_ACCESS register 36 and confirms that the MNCDBUSY bit is set to “0”. If “0” is set in the MNCDBUSY bit, it indicates that all the instructions set in the instruction code buffer 37 have been fetched.

(7) Confirm that MON_PARAM has been used This process is necessary only when parameters are set.

  The debug tool 2 reads the MON_ACCESS register 36 and confirms that the MNPRMVLD bit is set to “0”. If the MNPRMVLD bit is set to “0”, it indicates that the CPU 3 has read the FrontMON_PARAM register 39.

(8) Confirmation that FrontMON_DATA has been written This process is necessary only when the monitor program writes to the FrontMON_DATA register 38.

  The debug tool 2 reads the MON_ACCESS register 36 and confirms that the MNDTVLD bit is set to “1”. If the MNDTVLD bit is set to “1”, it indicates that the CPU 3 has written to the FrontMON_DATA register 38.

(9) Reading FrontMON_DATA This process is necessary only when the monitor program performs writing to the FrontMON_DATA38.

  When the debug tool 2 reads the MON_DATA register 34 through the JTAG interface terminal 11, the MNDTVLD bit is automatically cleared. The contents of the FrontMON_DATA register 38 are retained unless data is written to the FrontMON_DATA register 38 (ST9).

2. Internal Flash Memory Rewriting Operation FIG. 13 is a flowchart showing an outline of the internal flash memory rewriting operation. Next, an outline of the internal flash memory 5 rewriting operation will be described with reference to the flowchart of FIG.

  The internal flash memory 5 is rewritten by using the JTAG control unit 15 and the monitor code supply function 16 shown in FIG. 5 to rewrite the rewrite program stored in the boot ROM area 42 in the internal flash memory 5 shown in FIG. Do by calling. Transfer of write data from the debug tool 2 is also performed using the MON_PARAM register 35 of the JTAG control unit 15.

Pre-processing (ST11)
The debug tool 2 needs to perform processing in advance before the flash rewrite processing.

-Checking the security level-Reading the block configuration information of the built-in flash-Reading the entry address of the E / W mode transition program Reading data to be held (ST12)
Writing to the built-in flash memory 5 involves erasing in units of blocks. If there is data that must be held in the block to be written, it must be read before entering the flash E / W enable mode at this stage.

Transition to flash E / W enable mode (ST13)
By executing the E / W mode transition program, the normal mode is shifted to the flash E / W enable mode.

Flash rewrite (ST14)
Processing differs depending on whether only erasing or writing is performed. A necessary program is executed in each process.

"Block erase program"
"Page writing program"
"Status Ready Program"
Return to normal mode (ST15)
By executing the “E / W mode end program”, the flash E / W enable mode returns to the normal mode.

  Next, the preprocessing (ST11) and reading of data to be held (ST12) shown in FIG. 13 will be described in detail.

  When the debug tool 2 is activated, it reads various information built in the microcomputer 1 using the JTAG control unit 15 and the monitor code supply function 16 and checks the security code.

(1) Reading tool ROM setting confirmation code
(i) An instruction code is set in the MON_CODE register 33 from the debug tool 2 via the JTAG interface terminal 11 shown in FIG.

  (ii) The instruction code set in the MON_CODE register 33 is transferred to the instruction code buffer 37 by the functions of the JTAG control unit 15 and the monitor code supply function 16.

  A program for reading the confirmation code in which the tool ROM has been set and writing it in the FrontMON_DATA register 38 is set in the instruction code buffer 37 by performing the processes (i) and (ii) four times.

  (iii) “1” is set to the MNSTART bit of the MON_ACCESS register 36 from the debug tool 2 via the JTAG interface terminal 11 shown in FIG.

  (iv) The CPU 3 shown in FIG. 5 executes a program for reading the confirmation code with the tool ROM set transferred to the instruction code buffer 37 and performs the following processing.

Read the data at address H'FF003FFC in the tool ROM area shown in FIG.
Write the read data to the FrontMON_DATA register 38 (address H'FFFF8000).

  Branch to address H'FFFF9000 and wait for the next instruction code supplied from the debug tool 2.

  (v) The data written in the FrontMON_DATA register 38 is transferred to the MON_DATA register 34 by the functions of the JTAG control unit 15 and the monitor code supply function 16.

  (vi) Data in the MON_DATA register 34 is read from the debug tool 2 via the JTAG interface terminal 11 shown in FIG.

  (vii) In the debug tool 2, processing is divided as follows according to the data in the MON_DATA register 34.

If the data is H'DF534449, the processing proceeds to the next (2).
If the data is other than H'DF534449, the reading process of the tool ROM ends.

(2) Security code reading
(i) Reading of the start address of the security code storage area The read address is changed to the address H'FF003FF4 in the tool ROM area, and the same processing as (i) to (vi) in (1) above is performed. The “start address of the security code storage area” shown in FIG.

(ii) Reading of security code byte count and security level By changing the read address to H'FF003FF0 in the tool ROM area and performing the same processing as (i) to (vi) in (1) above , “Number of bytes of security code, security level” shown in FIG. 10 is read.

(iii) Reading of security code By changing the read address to the start address of the security code storage area obtained in (i) above, and performing the same processing as (i) to (vi) in (1) above , “Security Code” is read.

  When the number of bytes of the security code exceeds 4 bytes, all the security codes are obtained by repeating the same processing as (i) to (vi) in (1) above.

(iv) Security code check The debug tool 2 asks the user who is using the debug tool 2 to key in the security code.

  The debug tool 2 compares the value input in key with the value obtained in (iii), and the processing is divided as follows according to the combination with the security level obtained in (ii).

  When the value input by key coincides with the value obtained in (iii): The process proceeds to the next (3).

  When the value input by key does not match the value obtained in (iii) and the security level = “0”: The debug tool 2 does not permit any operation other than reset of the debug tool 2.

  If the value entered in (iii) does not match and the security level is “1”: Unless the user erases the entire area of the internal flash memory 5, the debug tool 2 Do not allow operation.

  As described above, by performing the security check, it is possible to prevent a program or data on the built-in flash memory 5 from being easily read or rewritten by another person.

(3) Reading internal flash information
(i) Reading the start address of the built-in flash information storage area By changing the read address to address H'FF003FE8 in the tool ROM area and performing the same processing as (i) to (vi) in (1) above, The “start address of the built-in flash information storage area” shown in FIG. 10 is read.

(ii) Reading the entry address of the E / W mode transition program The read address is changed to the start address of the internal flash information storage area obtained in (i) above, and (i) to (vi) in (1) above. By performing the same processing as the above, the “entry address of the E / W mode transition program” shown in FIG. 11 is read.

(iii) Reading the number of blocks The read address is changed to the start address +4 of the internal flash information storage area obtained in (i) above, and the same processing as (i) to (vi) in (1) above is performed. Thus, the “number of blocks” shown in FIG. 11 is read.

(iv) Reading the start address and number of bytes of each block The read address is changed to the start address +8 of the internal flash information storage area obtained in (i) above, and (i) to (vi) in (1) above. By performing the same processing as the above, the “first address of block 0” shown in FIG. 11 is read.

  Then, the same processing as (i) to (vi) in (1) above is performed while incrementing the read address by 4, thereby reading the “start address and number of bytes of each block” shown in FIG.

The area to be read can be calculated as follows from the number of blocks obtained in (iii).
“Start address obtained in (i) +8” to “Start address obtained in (i) + (8 × n + H′0C)”, where n = (number of blocks obtained in (iii) −1)
(v) Reading the flash rewrite temporary area The read address is changed to the start address of the internal flash information storage area obtained in (i) above + (8 × n + H′10), and the above (1) (i) By performing the same processing as in (vi), the “first address of the flash rewriting temporary area” shown in FIG. 11 is read.

  Then, the read address is changed to the head address of the built-in flash information storage area obtained in (i) above + (8 × n + H′14), and the same processing as in (i) to (vi) in (1) above. To read the “number of bytes in the flash rewriting temporary area” shown in FIG.

  When the built-in flash memory 5 is erased and written, a part of the built-in SRAM 6 is used for storing a flash rewrite program and for buffering write data. This is called a flash rewrite temporary area. Since this area is used by the user who performs debugging, the debug tool 2 needs to save the data on the internal SRAM 6 used by the user before erasing and writing the internal flash memory 5. . The debug tool 2 performs a saving process using the data in the flash rewriting temporary area obtained in (v), and performs a restoration process after erasing and writing the internal flash memory 5.

(vi) Reading the number of bytes in the flash write buffer The read address is changed to the start address of the internal flash information storage area obtained in (i) + (8 × n + H′18), and the ( By performing the same processing as i) to (vi), the “number of bytes of the flash write buffer” shown in FIG. 11 is read.

  The flash write buffer is a buffer area for storing write data in the flash rewrite temporary area. When writing to the built-in flash memory 5, the debug tool 2 needs to be controlled to loop the writing process in units of page size. Since there is a possibility of different page sizes depending on the microcomputer, write data is generated using the page size information obtained in (vi).

  FIG. 14 is a flowchart showing the erase operation of the built-in flash memory. Next, the erase operation of the built-in flash memory 5 will be described with reference to the flowchart of FIG. In the flowchart shown in FIG. 14, only the erase operation of the built-in flash memory 5 is performed in the flash E / W enable mode transition (ST13), flash rewrite (ST14), and normal mode return (ST15) in FIG. This corresponds to the details.

(4) Execution of E / W mode transition program (E / W mode transition program execution means)
(i) The instruction code for branching to the E / W mode transition program is set from the debug tool 2 to the MON_CODE register 33 via the JTAG interface terminal 11 shown in FIG. 5 (ST21).

  (ii) The instruction code set in the MON_CODE register 33 is transferred to the instruction code buffer 37 by the functions of the JTAG control unit 15 and the monitor code supply function 16 (ST22).

  (iii) “1” is set from the debug tool 2 to the MNSTART bit of the MON_ACCESS register 36 via the JTAG interface terminal 11 shown in FIG. 5 (ST21).

  (iv) The CPU 3 shown in FIG. 5 executes the instruction code branching to the E / W mode transition program transferred to the instruction code buffer 37, and the E / W mode on the boot ROM area 42 shown in FIG. Branch to the migration program (ST21).

  (v) The CPU 3 executes the E / W mode transition program and performs the following processing (ST22).

  Each parameter is set in each register of the CPU 3 (refer to processing contents of the E / W mode transition program described in the configuration: R0 to R15).

  The rewrite programs (E / W mode transition program, block erase program, page write program, status ready wait program, and E / W end program) on the boot ROM 42 shown in FIG. 6 are stored on the built-in SRAM 6 shown in FIG. Forward to. The transfer of the rewrite program from the boot ROM area 42 in the built-in flash memory 5 to the built-in SRAM 6 cannot be performed from the built-in flash memory 5 when the flash E / W mode is entered. This is because the flash rewriting program on the flash memory 5 is saved on the built-in SRAM 6.

Branches to the built-in SRAM 6 and further executes the following processing.
• “1” is set to the FENTRY bit 62 of the flash memory control register 61 shown in FIG. 8, and the built-in flash memory 5 is shifted to the flash E / W enable mode.

  Write H'00000000 to the FrontMON_DATA register 38 (address H'FFFF8000) shown in FIG.

  Branch to address H'FFFF9000 and wait for the next instruction code supplied from the debug tool 2.

  (vi) The data written in the FrontMON_DATA register 38 is transferred to the MON_DATA register 34 by the functions of the JTAG control unit 15 and the monitor code supply function 16, and the MNDTVLD bit of the MON_ACCESS register 36 is set to “1” (ST22). ).

  (vii) The debug tool 2 reads the MON_ACCESS register 36 via the JTAG interface terminal 11 and checks the MNDTVLD bit. When the debug tool 2 becomes “1”, the value of the MON_DATA register 34 is read via the JTAG interface terminal 11. If the bit0 value of the read data is “0”, the next (2) block erase program is executed. If the bit0 value is “1”, error processing (ST24) is performed (ST23).

(5) Execution of block erase program (erase program execution means)
(i) The address corresponding to the block of the built-in flash memory 5 to be erased is set from the debug tool 2 to the MON_PARAM register 35 via the JTAG interface terminal 11 (ST25).

  (ii) The address set in the MON_PARAM register 35 is transferred to the FrontMON_PARAM register 39 by the functions of the JTAG control unit 15 and the monitor code supply function 16 (ST26).

  (iii) The instruction code for branching to the block erase program is set from the debug tool 2 to the MON_CODE register 33 via the JTAG interface terminal 11 (ST25).

  (iv) “1” is set from the debug tool 2 to the MNSTART bit of the MON_ACCESS register 36 via the JTAG interface terminal 11 (ST25).

  (v) The CPU 3 executes the instruction code branched to the block erase program transferred to the instruction code buffer 37, and branches to the block erase program saved on the built-in SRAM 6 (ST26).

(vi) The CPU 3 executes the block erase program and performs the following processing (ST26).
Reads the FrontMON_PARAM register 39 (address H'FFFF8004).

Issue an erase command to the built-in flash memory 5.
FIG. 15 is a flowchart showing details of the erase operation of the built-in flash memory. The operation according to the erase command will be described with reference to this flowchart.

  First, the block erase command data (H′2020) is written to an arbitrary address of the built-in flash memory 5 (ST41), and the block to be erased is read according to the address corresponding to the block to be erased read from the FrontMON_PARAM register 39. The confirmation command data (H′D0D0) is written to the final even address (ST42). Then, the flash internal control circuit 5c shown in FIG. 1 starts erasing the block to be erased (ST43).

  Write H'00000000 to the FrontMON_DATA register 38 (address H'FFFF8000).

  Branch to address H'FFFF9000 and wait for the next instruction code supplied from the debug tool 2.

  (vii) The data written in the FrontMON_DATA register 38 is transferred to the MON_DATA register 34 by the functions of the JTAG control unit 15 and the monitor code supply function 16, and the MNDTVLD bit of the MON_ACCESS register 36 is set to “1” (ST26). ).

  (viii) The debug tool 2 reads the MON_ACCESS register 36 through the JTAG interface terminal 11, checks the MNDTVLD bit, and when it becomes “1”, reads the data in the MON_DATA register 34 through the JTAG interface terminal 11 (ST27). .

(6) Status ready waiting program execution (status ready waiting program execution means)
(i) The instruction code for branching to the status ready waiting program is set from the debug tool 2 to the MON_CODE register 33 via the JTAG interface terminal 11 (ST28).

  (ii) The instruction code set in the MON_CODE register 33 is transferred to the instruction code buffer 37 by the functions of the JTAG control unit 15 and the monitor code supply function 16 (ST29).

  (iii) “1” is set from the debug tool 2 to the MNSTART bit of the MON_ACCESS register 36 via the JTAG interface terminal 11 (ST28).

  (iv) The CPU 3 executes the instruction code branching to the status ready waiting program transferred to the instruction code buffer 37, and branches to the status ready waiting program saved in the built-in SRAM 6 (ST29).

  (v) The CPU 3 executes the status ready waiting program and performs the following processing (ST29).

  When the flash ready status register 51 shown in FIG. 7 is read and the FSTAT bit becomes “1”, H′00000000 is written to the FrontMON_DATA register 38 (address H′FFFF8000), and the FSTAT bit is set to “1” for a predetermined fixed period. If not, “H′80000000” is written to the FrontMON_DATA register 38 (address H′FFFF8000).

  (vi) The data written in the FrontMON_DATA register 38 is transferred to the MON_DATA register 34 by the functions of the JTAG control unit 15 and the monitor code supply function 16, and the MNDTVLD bit of the MON_ACCESS register 36 is set to “1” (ST29). ).

  (vii) The debug tool 2 reads the MON_ACCESS register 36 through the JTAG interface terminal 11, checks the MNDTVLD bit, and reads the data in the MON_DATA register 34 through the JTAG interface terminal 11 when it becomes “1”. If the bit0 value of the read data is “0”, the process proceeds to the next execution of (viii). If the bit0 value is “1”, error processing (ST31) is performed (ST30).

  (viii) The process from ST25 to ST30 is repeated by the debug tool 2 for the number of blocks to be erased (ST32).

(7) Execution of E / W mode end program (E / W mode end program execution means)
(i) The instruction code for branching to the E / W mode end program is set in the MON_CODE register 33 from the debug tool 2 through the JTAG interface terminal 11 (ST33).

  (ii) The instruction code set in the MON_CODE register 33 is transferred to the instruction code buffer 37 by the functions of the JTAG control unit 15 and the monitor code supply function 16 (ST34).

  (iii) “1” is set from the debug tool 2 to the MNSTART bit of the MON_ACCESS register 36 via the JTAG interface terminal 11 (ST33).

  (iv) The CPU 3 executes the instruction code branching to the E / W mode end program transferred to the instruction code buffer 37, and branches to the E / W mode end program saved in the built-in SRAM 6 (ST34).

  (v) The CPU 3 executes the E / W mode end program and performs the following processing (ST34).

  Write “0” to the FENTRY bit 62 of the flash memory control register 61 shown in FIG. 8 to shift the built-in flash memory 5 to the normal mode.

  Write H'00000000 to the FrontMON_DATA register 38 (address H'FFFF8000).

  (vi) The data written in the FrontMON_DATA register 38 is transferred to the MON_DATA register 34 by the functions of the JTAG control unit 15 and the monitor code supply function 16, and the MNDTVLD bit of the MON_ACCESS register 36 is set to “1” (ST34). ).

  (vii) The debug tool 2 reads the MON_ACCESS register 36 via the JTAG interface terminal 11, checks the MNDTVLD bit, and when it becomes “1”, reads the data in the MON_DATA register 34 via the JTAG interface terminal 11 (ST35). ).

  FIG. 16 is a flowchart showing the write operation of the built-in flash memory. Next, the write operation of the built-in flash memory 5 will be described with reference to the flowchart of FIG. The flowchart shown in FIG. 16 performs the erase and write operations of the built-in flash memory 5 in the flash E / W enable mode transition (ST13), flash rewrite (ST14), and normal mode return (ST15) shown in FIG. This corresponds to the details of the case.

(4) Execution of E / W mode transition program (E / W mode transition program execution means)
This operation is the same as (ST21) to (ST24) in the erase operation of the built-in flash memory 5 shown in FIG.

(5) Execution of block erase program (erase program execution means)
This operation is the same as (ST25) to (ST27) in the erase operation of the built-in flash memory 5 shown in FIG.

(6) Transfer of write data to built-in flash memory Normally, after (ST27), it should be verified by executing a status ready wait program to determine whether or not the erase has been completed. Using this, write data to the built-in flash memory 5 is transferred to a flash write buffer on the built-in SRAM 6. The operation will be described below.

  (i) The instruction code of the write data transfer program is set from the debug tool 2 to the MON_CODE register 33 via the JTAG interface terminal 11 (ST51).

  (ii) The instruction code set in the MON_CODE register 33 is transferred to the instruction code buffer 37 by the functions of the JTAG control unit 15 and the monitor code supply function 16 (ST52).

  The processes (i) and (ii) are performed four times to set the write data transfer program in the instruction code buffer 37. The write data transfer program is a program for transferring data to be written to the built-in flash memory from the debug tool 2 to the flash write buffer on the built-in SRAM 6 (see the execution method of the page write program having the configuration).

  (iii) Write data for 32 bits is set from the debug tool 2 to the MON_PARAM register 35 via the JTAG interface terminal 11 (ST51).

  (iv) The write data set in the MON_PARAM register 35 is transferred to the FrontMON_PARAM register 39 by the functions of the JTAG control unit 15 and the monitor code supply function 16 (ST52).

  (v) “1” is set from the debug tool 2 to the MNSTART bit of the MON_ACCESS register 36 via the JTAG interface terminal 11 (ST51).

  (vi) The CPU 3 executes the write data transfer program set in the instruction code buffer 37 and performs the following processing (ST52).

  Read the FrontMON_PARAM register 39 (address H'FFFF8004).

  Write the read write data to the flash write buffer on the built-in SRAM 6.

• Add +4 to the write destination address.
Branch to address H'FFFF9000 and wait for a new instruction code to be supplied.

  By repeating the processes (iii) to (vi), write data for one page (= 256 bytes) is transferred to the flash write buffer on the built-in SRAM 6. In the final loop (vi), the program branches to the status ready program.

(7) Status ready waiting program execution (status ready waiting program execution means)
This operation is the same as (ST28) to (ST31) in the erase operation of the built-in flash memory 5 shown in FIG.

(8) Execution of page writing program (writing program execution means)
(i) A write destination address is set from the debug tool 2 to the MON_PARAM register 35 via the JTAG interface terminal 11 (ST53).

  (ii) The address set in the MON_PARAM register 35 is transferred to the FrontMON_PARAM register 39 by the functions of the JTAG control unit 15 and the monitor code supply function 16 (ST54).

  (iii) The instruction code for branching to the page writing program is set from the debug tool 2 to the MON_CODE register 33 via the JTAG interface terminal 11 (ST53).

  (iv) “1” is set from the debug tool 2 to the MNSTART bit of the MON_ACCESS register 36 via the JTAG interface terminal 11 (ST53).

  (v) The CPU 3 executes the instruction code branching to the page writing program transferred to the instruction code buffer 37, and branches to the page writing program saved on the built-in SRAM 6 (ST54).

  (vi) The CPU 3 executes the page writing program and performs the following processing (ST54).

  Read the FrontMON_PARAM register 39 (address H'FFFF8004).

Issue a page write command to the built-in flash memory 5.
FIG. 17 is a flowchart showing details of the write operation of the built-in flash memory. The operation according to the page write command will be described with reference to this flowchart.

  First, page program command data (H′4141) is written to an arbitrary address in the built-in flash memory 5 (ST81). Data for the first 16 bits of the flash write buffer is read, and writing is performed using the value read from the FrontMON_PARAM register 39 as a write destination address (ST82). While increasing the read destination address from the flash write buffer and the write destination address to the flash by +2 sequentially (ST83), writing for one page (= 256 bytes) is performed (ST82 to ST84). When the writing for one page is completed, the flash internal control circuit 5c shown in FIG. 1 starts writing data for one page to the built-in flash memory 5 (ST85).

  Write H'00000000 to the FrontMON_DATA register 38 (address H'FFFF8000).

  Branch to address H'FFFF9000 and wait for the next instruction code supplied from the debug tool 2.

  (vii) The data written in the FrontMON_DATA register 38 is transferred to the MON_DATA register 34 by the functions of the JTAG control unit 15 and the monitor code supply function 16, and the MNDTVLD bit of the MON_ACCESS register 36 is set to “1” (ST54). ).

  (viii) The debug tool 2 reads the MON_ACCESS register 36 via the JTAG interface terminal 11, checks the MNDTVLD bit, and when it becomes “1”, reads the value of the MON_DATA register 34 via the JTAG interface terminal 11 (ST55). ).

(9) Transfer of write data to built-in flash memory This operation is the same as (6) Transfer of write data to built-in flash memory (ST56).

(10) Executing status ready waiting program (status ready waiting program execution means)
This operation is the same as (7) execution of the status ready waiting program (ST56) to (ST59).

  Then, the processing of ST53 to ST58 is repeated for the required number of pages (ST60), and the processing of ST25 to ST60 is repeated for the required number of blocks (ST32).

(11) Execution of E / W mode end program (E / W mode end program execution means)
This operation is the same as (ST33) to (ST35) in the erase operation of the built-in flash memory 5 shown in FIG.

  In the first embodiment, as shown in FIG. 9, the tool ROM area 24 and the rewrite program are provided in the boot ROM area 42 in the built-in flash memory 5, and the security code storage area 25 and the built-in flash information storage area. 26 was provided in an arbitrary space. However, these areas may be placed in any area accessible from the CPU 3. However, if these areas are provided in the built-in flash memory 5, information can be written after the manufacture of the microcomputer 1 chip. There is an advantage that it can be rewritten.

  As for the rewrite program, the storage location may be stored not in the built-in flash memory 5 but in the mask ROM. In this case, when the built-in flash memory 5 is rewritten, it is not necessary to save it in the built-in SRAM 6, and the processing is performed. There is an effect that it becomes easy.

  In the first embodiment, the information in the tool ROM area 24, the information in the security code storage area 25, and the information in the built-in flash information storage area 26 are distinguished from each other. It may be information.

  As described above, according to the first embodiment, the rewrite control of the built-in flash memory 5 can be performed directly from the debug tool 2, and there is an effect that a microcomputer that can increase the work efficiency of debugging is obtained. is there.

  1 Microcomputer, 2 Debug Tool, 3 CPU, 4 Debug Module, 5 Built-in Flash Memory, 5a FP Terminal, 5b OR Circuit (Rewrite Permission Unit), 5c Flash Internal Control Circuit (Rewrite Permission Unit), 6 Built-in SRAM, 7 Built-in Peripheral I / O, 8 bus control circuit, 9 internal bus, 9a address bus, 9b data bus, 11 JTAG interface terminal (interface, serial interface), 12 terminal, 13a debug trap instruction execution function, 13b program counter, 13c program counter Save register, 13d PSW register, 13e PSW save register, 13f General-purpose register, 14 Post-execution PC break function, 15 JTAG control unit, 16 Monitor code supply function, 17 Access Break function, 18 PC break function before execution, 19 Debug interrupt request, 21 Internal I / O area for debug module, 22 Control register area for debug module, 23 Monitor code supply area, 24 Tool ROM area, 26 Internal flash information storage area , 31 TAP controller, 32 instruction register, 33 MON_CODE register (first register), 34 MON_DATA register (second register), 35 MON_PARAM register (third register), 36 MON_ACCESS register, 37 instruction code buffer, 38 FrontMON_DATA Register, 39 FrontMON_PARAM register, 41 User area, 42 Boot ROM area, 51 Flash ready status register, 52 FSTAT bit, 61 Flash memory control register, 62 FENTRY bit.

Claims (5)

A central processing unit, a nonvolatile memory, and a debug interface to which a debug tool is connected to the outside are provided on a semiconductor substrate,
The central processing unit fetches an instruction from the nonvolatile memory and executes the instruction, and is controlled in accordance with an instruction from the debug tool.
The nonvolatile memory is configured to be able to write or erase data in response to an instruction from the debug tool, and stores information on whether or not data writing or erasure has been normally completed in the first register,
A semiconductor processing apparatus configured to be able to refer to the first register from the debug tool. The semiconductor processing apparatus further includes a volatile memory on the semiconductor substrate,
A program for writing or erasing data in the nonvolatile memory is stored in a predetermined address space of the nonvolatile memory,
Prior to writing or erasing the data, the program is transferred to the volatile memory,
The semiconductor processing apparatus according to claim 1, wherein control is performed to branch to a start address of the storage area of the program in accordance with an instruction from the debug tool. A second register that can be referred to by the debug tool;
The debug tool sets data to be written to the nonvolatile memory in the second register and stores the data in the volatile memory,
The semiconductor processing apparatus according to claim 2, wherein the program for writing data to the nonvolatile memory reads write data from the volatile memory and writes the data to the nonvolatile memory. A central processing unit, a nonvolatile memory, and a debug interface to which a debug tool is connected to the outside are provided on a semiconductor substrate,
The central processing unit fetches an instruction from the nonvolatile memory and executes the instruction, and is controlled in accordance with an instruction from the debug tool.
The nonvolatile memory is configured to be able to write, erase, or read data in response to an instruction from the debug tool, and stores access restriction information in a predetermined area,
When the access restriction information is stored in the nonvolatile memory and the authentication information input from the debug tool does not match the access restriction information, the nonvolatile memory according to an instruction from the debug tool Processing apparatus in which writing and reading of data to and from the memory are restricted. When the access restriction information stored in the nonvolatile memory and the authentication information input from the debug tool do not match, the data stored in the nonvolatile memory is erased in response to an instruction from the debug tool. Is possible,
The semiconductor processing apparatus according to claim 4, wherein restrictions on writing and reading of data to and from the nonvolatile memory are released according to an instruction from the debug tool after completion of erasure of data stored in the nonvolatile memory.

Images