MC9S12XD series
Posted: 28 Apr 2022, 17:16
This thread is for the often used NXP (now Freescale) microcontrollers. They are based on the MC9S12D series (without the "X") but with an "XGATE" CO-Processor extention. It uses an HCS12X processor and many on-chip periphal controllers like CAN, PWM, LCD, Steppers, SPI, LIN, etc.
You find it in many Ford modules (BCM, KVM, PAM, ...).
The HCS12 CPU is 16 Bit, big-endian, so it can only address 64KB of memory. All periphals are memory-mapped, means that there are no special CPU commands for them (even not RAM, EEPROM, Flash) but their control is via memory locations. Some control registers can't be moved, other could.
Understanding addressing of memory locations
The most important part to understand is memory mapping and adressing. So carefully read this doc: "The internal memory available to the CPU has been increased to a maximum of 8M bytes. The sixteen CPU address lines result in a maximum address space of 64K bytes. Therefore, two new access schemes are available, each of which extends the memory map. These schemes are called global addressing and logical addressing."
This tells us that CPU can only address 64K because of only 16 address lines (locigal addressing). The memory-controller (MMC) extends them by additonal 7 address lines, the "page" address-bits up to the full maximum of 23 address lines (global addressing): So the global addresses ranges from 0x00_0000 to 0x7F_FFFF, which is 8MByte in total: The available address space is dedicated to special resources (colored blocks). Note that this shows the maximum with the biggest version of the MC9S12XD. Smaller ones uses only parts of it, from highest address downwards.
One method for a program to access a specific address within the global map is to use the GPAGE register at 0x0010. After reset it is 0x00 and so logical address = global address. If the program set the GPAGE to 0x01, the next 64KB page of global memory is used by the following commands. If a command stores data e.g. at 0x1F50, it will be stored in global map at 0x01_1F50. This way a program can work like if the CPU was able to access the whole memory map, i only needs to respect the GPAGE resgister to be set accordingly.
Another method of addressing is paging the resources. In the logical address space there are areas where a small portion of RAM, FLASH, EEPROM is directly accessible by the CPU, called a "page". By setting the global page-registers EPAGE for EEPROM, PPAGE for Flash or RPAGE for RAM, the program can map a different area into the logical scope of the CPU.
This graphics show the relation of logical memory map to paged portions out of global map: Accessing the EEPROM
In the global memory map, the 4K byte EEPROM is accessible in the linear address range from $13_F000 to $13_FFFF. An unpaged portion of this EEPROM, 0x13_FC00 to 0x13_FFFF area is mapped into logical address space from 0x0C00 to 0x0FFF.
The EEPROM page window is located from 0x0800 to 0x0BFF in logical address space. There are four pages of EEPROM available, each page storing 1K bytes.
At reset, the EPAGE register is set to 0xFE. It can take values from 0xFC to 0xFF, depending on how much EEPROM is provided by the chip.
The EPAGE value 0xFF equals the unpaged EEPROM portion in logical address map.
Accessing the RAM
In the global mapping scheme, the RAM is located as a linear 32KB block from 0x0F_8000 to 0x0F_FFFF.
The logical address range for each 4K byte page of RAM locations is from 0x1000 to 0x1FFF.
At reset, the RPAGE register is set to 0xFD. It can take values from 0xF8 to 0xFF, depending on how much RAM is provided by the chip.
The RPAGE value 0xFE equals the unpaged 4KB RAM portion in logical address map at 0x2000, 0xFF the one starting at 0x3000.
Accessing the Flash
At maximum there is a total of 512KB available within the PPAGE values of 0xE0 to 0xFF.
Each 16KB page is at the logical address of 0x8000 to 0xBFFF. The reset value for PPAGE is 0xFE.
When PPAGE = 0xFD, the 16KB page at 0x4000 to 0x7FFF is mapped to the locations 0x8000 to 0xBFFF.
When PPAGE = 0xFF, the range 0xC000 to 0xFFFF is mapped to 0x8000 to 0xBFFF.
You find it in many Ford modules (BCM, KVM, PAM, ...).
The HCS12 CPU is 16 Bit, big-endian, so it can only address 64KB of memory. All periphals are memory-mapped, means that there are no special CPU commands for them (even not RAM, EEPROM, Flash) but their control is via memory locations. Some control registers can't be moved, other could.
Understanding addressing of memory locations
The most important part to understand is memory mapping and adressing. So carefully read this doc: "The internal memory available to the CPU has been increased to a maximum of 8M bytes. The sixteen CPU address lines result in a maximum address space of 64K bytes. Therefore, two new access schemes are available, each of which extends the memory map. These schemes are called global addressing and logical addressing."
This tells us that CPU can only address 64K because of only 16 address lines (locigal addressing). The memory-controller (MMC) extends them by additonal 7 address lines, the "page" address-bits up to the full maximum of 23 address lines (global addressing): So the global addresses ranges from 0x00_0000 to 0x7F_FFFF, which is 8MByte in total: The available address space is dedicated to special resources (colored blocks). Note that this shows the maximum with the biggest version of the MC9S12XD. Smaller ones uses only parts of it, from highest address downwards.
One method for a program to access a specific address within the global map is to use the GPAGE register at 0x0010. After reset it is 0x00 and so logical address = global address. If the program set the GPAGE to 0x01, the next 64KB page of global memory is used by the following commands. If a command stores data e.g. at 0x1F50, it will be stored in global map at 0x01_1F50. This way a program can work like if the CPU was able to access the whole memory map, i only needs to respect the GPAGE resgister to be set accordingly.
Another method of addressing is paging the resources. In the logical address space there are areas where a small portion of RAM, FLASH, EEPROM is directly accessible by the CPU, called a "page". By setting the global page-registers EPAGE for EEPROM, PPAGE for Flash or RPAGE for RAM, the program can map a different area into the logical scope of the CPU.
This graphics show the relation of logical memory map to paged portions out of global map: Accessing the EEPROM
In the global memory map, the 4K byte EEPROM is accessible in the linear address range from $13_F000 to $13_FFFF. An unpaged portion of this EEPROM, 0x13_FC00 to 0x13_FFFF area is mapped into logical address space from 0x0C00 to 0x0FFF.
The EEPROM page window is located from 0x0800 to 0x0BFF in logical address space. There are four pages of EEPROM available, each page storing 1K bytes.
At reset, the EPAGE register is set to 0xFE. It can take values from 0xFC to 0xFF, depending on how much EEPROM is provided by the chip.
The EPAGE value 0xFF equals the unpaged EEPROM portion in logical address map.
Accessing the RAM
In the global mapping scheme, the RAM is located as a linear 32KB block from 0x0F_8000 to 0x0F_FFFF.
The logical address range for each 4K byte page of RAM locations is from 0x1000 to 0x1FFF.
At reset, the RPAGE register is set to 0xFD. It can take values from 0xF8 to 0xFF, depending on how much RAM is provided by the chip.
The RPAGE value 0xFE equals the unpaged 4KB RAM portion in logical address map at 0x2000, 0xFF the one starting at 0x3000.
Accessing the Flash
At maximum there is a total of 512KB available within the PPAGE values of 0xE0 to 0xFF.
Each 16KB page is at the logical address of 0x8000 to 0xBFFF. The reset value for PPAGE is 0xFE.
When PPAGE = 0xFD, the 16KB page at 0x4000 to 0x7FFF is mapped to the locations 0x8000 to 0xBFFF.
When PPAGE = 0xFF, the range 0xC000 to 0xFFFF is mapped to 0x8000 to 0xBFFF.