Jtag question

Hello all,

I am new to Jtag debuger, after I read some documents and ARM jtag debuger specs, I wrote some codes to debug my CPU ARM926ej-s, I can break the CPU, also can read and write the core register(R0-R15). but when I read memory from 0xFFFF0000, I use the follwing steps to read.

  1. Scan 0xFFFF0000 to R0

  2. Scan a LDMIA R0, {R1-r13} with SYSSPEED low

  3. Scan a NOP with SYSSPEED high

  4. Scan a RESTART instruction

  5. Read back ICE status, value is 0x2CD,

  6. Scan a INTEST instruction

  7. Read core register R1-R13

  8. Read back ICE status, value is 0,

At step7 I can get the correct value,but after step 8, I try to read the next 13 memory location, I can not get the correct value. I guess the step 7 got error, so I step into the following function,

  1. Scan a SCAN_N instruction

  2. Scan a scan chain 1 data

  3. Scan a INTEST instruction

  4. Scan a STMIA R0, {R1-r13} with SYSSPEED low

  5. Scan a NOP with SYSSPEED low

  6. Scan a NOP with SYSSPEED low

  7. From I scan out all registers.

After step3 I try to read ICE status, the value is 0x2C5

After step4 I try to read ICE status, the value is 0x2C0, I don’t know what cause the ICE status changed, is this the root cause?

thanks