You copied the Doc URL to your clipboard.

2.3.1. MTB execution trace packet format

The execution trace packet consists of a pair of 32-bit words that the MTB generates when it detects the processor PC value changes non-sequentially. A non-sequential PC change can occur during branch instructions or during exception entry.

Note

The processor can cause a trace packet to be generated for any instruction.

Figure 2.3 shows the signal combination that detects a non-sequential PC change.

Figure 2.3. MTB non-sequential PC diagram

Figure 2.3. MTB non-sequential PC diagram

Figure 2.4 shows how the execution trace information is stored in memory as a sequence of packets.

Figure 2.4. MTB execution trace storage format

Figure 2.4. MTB execution trace storage format

The first, lower addressed, word contains the source of the branch, the address it branched from. The value stored only records bits[31:1] of the source address, because Thumb instructions are at least halfword aligned. The least significant bit of the value is the A-bit. The A-bit indicates the atomic state of the processor at the time of the branch, and can differentiate whether the branch originated from an instruction in a program, an exception, or a PC update in Debug state. When it is zero the branch originated from an instruction, when it is one the branch originated from an exception or PC update in Debug state. This word is always stored at an even word location.

The second, higher addressed word contains the destination of the branch, the address it branched to. The value stored only records bits[31:1] of the branch address. The least significant bit of the value is the S-bit. The S-bit indicates where the trace started. An S-bit value of 1 indicates where the first packet after the trace started and a value of 0 is used for other packets. Because it is possible to start and stop tracing multiple times in a trace session, the memory might contain several packets with the S-bit set to 1. This word is always stored in the next higher word in memory, an odd word address.

When the A-bit is set to 1, the source address field contains the architecturally-preferred return address for the exception. For example, if an exception was caused by an SVC instruction, then the source address field contains the address of the following instruction. This is different from the case where the A-bit is set to 0. In this case, the source address contains the address of the branch instruction. For an exception return operation, two packets are generated:

  • The first packet has the:

    • Source address field set to the address of the instruction that causes the exception return, BX or POP.

    • Destination address field set to bits[31:1] of the EXC_RETURN value. See the ARM v6-M Architecture Reference Manual.

    • The A-bit set to 0.

  • The second packet has the:

    • Source address field set to bits[31:1] of the EXC_RETURN value.

    • Destination address field set to the address of the instruction where execution commences.

    • A-bit set to 1.

Was this page helpful? Yes No