Part 1 of this article gives a quick overview of the various JTAG debug methods for PowerPC, ARM and MIPS processors and how these compare to the JTAG implementation in the Intel Atom microprocessor.]
A Review of Various Types of OCD
Several processor vendors have extended JTAG software debug, often to make it faster, or to add hardware trace capabilities. The NEXUS consortium for example defines an auxiliary port containing a variable bit width MDO (message data out) bus. Examples of other technologies are explained in the different implementations below.
BDM (Motorola CPU16, CPU32, ColdFire, HC08, HC11, HC16)
As mentioned previously, Motorola coined the term BDM (Background Mode Debug) with its CPU32 family of microcontrollers. This was followed by the CPU16 family, and then ColdFire, and now encompasses the HC08, and HC11 families.
These BDMs are extremely similar. They build upon the concept of a ROM monitor and have a similar command set. The core of the hardware interface consists of a serial data in, serial data out, serial clock/breakpoint, and freeze status signal. The commands are shifted into the chip serially and are 17 bits in length. The command set for the CPU32 is as follows:
Table 1. CPU32 Command Set
These commands closely mirror those that have been used for years in ROM monitors. Single stepping is accomplished via hardware control of the BDM port or by placing a software breakpoint type of instruction in the code stream.
The processor is not aware of the BDM engine, it is not seen as an exception or interrupt. There is a "background" instruction, "BGND" which causes the processor to enter BDM when it is executed. BDM is left, and real-time code execution is resumed, upon the GO command being executed.
Embedded PowerPC BDM (Motorola MPC5xx, MPC8xx)
This BDM works quite differently from the CPU32 type of BDM. The hardware interface is similar with serial in, serial out, clock, reset, and status signals. The difference is that there is not a specific command set. Any serial stream entered into the chip is either 7 or 32 bits in length (not counting start, control, and length bits).
Thirty-two-bit data streams go into the instruction stuff register and come out of the debug data register. What actually happens is that the host debugger stuffs PowerPC opcodes into the processor and they are executed. This is actually a very powerful design allowing for all system resources to be accessible since this method gives the debug port the same power as executing system code. Seven-bit data streams are used to control on chip breakpoint functions. Debug control registers exist to enable single stepping and other special controls.
The processor is "aware" of this BDM in that it is a CPU exception. BDM may be entered upon one of any number of exception causing events (invalid opcode, address bus misalignment, non-maskable interrupt, etc.) To resume real-time execution, the debugger stuffs a "return from exception" instruction, "RFI" into the processor's instruction register.