[_CD4_]<dragon7.0>SmallCache>Oracle>SmallCacheInner-Debug.oracle!4

SmallCacheInner-Debug.oracle

Pradeep Sindhu May 16, 1988 3:04:17 am PDT

Don Curry May 17, 1988 2:47:26 pm PDT

Warning: The PmCode Test routine PC encodings are built in below.

TestReadRamPC = 4A Hex

TestReadRCamPC = 4B Hex

TestReadVCamPC = 4C Hex

TestResetVictimPC = 4D Hex

TestShiftVictimPC = 4E Hex

Oracle File modified to work at top level (SmallCacheInner). Test completed April 23, 1988 12:38:17 pm PDT. This test now runs with the following settings:

Array OutputSection

TLevel TLevel

TLevel Behav

Behav TLevel

Behav Behav

NB: Each line corresponds to one cycle of the DynaBus clock

The state of the cache following Reset is: all x's except for signals set otherwise by the hardware

← Logic.SetOracleFileName["SmallCacheInnerTest", "SmallCacheInner-PAll"]

Perform the reset sequence:

Assert Reset till x's get flushed out (the last signal appears to be RamForP, which settles 3 cycles after BCtlRamForBCWS6, which settles in cycle 6):

D D D n n D D B B G G I P P P P | D H B B B R S P P P P P

S A E D D S S C D L r S m C B D | B d D O S e S R F F D R

h d x F R e e y a e a S o m y a | u r a w h q t e a a a e

i d e r e r l c t n n t d d t t | s C t n a u o j u u t s

f r c e s i e l a g t o e I e a | O y a e r e p e l l a c

t e u e e a c e I t p I n S | u c O r e s O c t t h

C s t z t l t 0 n h I n e | t l u O d t u t C e

k s e e I n l | e t u O t o d

n I | O t u d u

n | u t e l

| t e

|

( 0 0 0 1 0 0 ) 0 0 0000 0 0 0 0 0 0 00 | x x xxxx x x x x x x x xx x --A

( 0 0 0 1 0 0 ) 0 0 0000 0 0 0 0 0 0 00 | x x xxxx x x x x x x x xx x

( 0 0 0 1 0 0 ) 0 0 0000 0 0 0 0 0 0 00 | x x xxxx x x x x x x x xx x --B

( 0 0 0 1 0 0 ) 0 0 0000 0 0 0 0 0 0 00 | x x xxxx x x x x x x x xx x

( 0 0 0 1 0 0 ) 0 0 0000 0 0 0 0 0 0 00 | x x xxxx x x x x x 0 x xx x --A

( 0 0 0 1 0 0 ) 0 0 0000 0 0 0 0 0 0 00 | x x xxxx x x x x x 0 x xx x

( 0 0 0 1 0 0 ) 0 0 0000 0 0 0 0 0 0 00 | x x xxxx x x x x x 0 x xx x --B

( 0 0 0 1 0 0 ) 0 0 0000 0 0 0 0 0 0 00 | x x xxxx x x x x x 0 x xx x

( 0 0 0 1 0 0 ) 0 0 0000 0 0 0 0 0 0 00 | x x xxxx x x x x x 0 x xx x --A

( 0 0 0 1 0 0 ) 0 0 0000 0 0 0 0 0 0 00 | x x xxxx x x x x x 0 x xx x

( 0 0 0 1 0 0 ) 0 0 0000 0 0 0 0 0 0 00 | x x xxxx x x x x x 0 x xx x --B

( 0 0 0 1 0 0 ) 0 0 0000 0 0 0 0 0 0 00 | x x xxxx x x x x x 0 x xx x

( 0 0 0 1 0 0 ) 0 0 0000 0 0 0 0 0 0 00 | x x xxxx x x x x x 0 x xx x --A

( 0 0 0 1 0 0 ) 0 0 0000 0 0 0 0 0 0 00 | x x xxxx x x x x x 0 x xx x

( 0 0 0 1 0 0 ) 0 0 0000 0 0 0 0 0 0 00 | x x xxxx x x x x x 0 x xx x --B

( 0 0 0 1 0 0 ) 0 0 0000 0 0 0 0 0 0 00 | x x xxxx x x x x 0 0 x xx x

( 0 0 0 1 0 0 ) 0 0 0000 0 0 0 0 0 0 00 | x x xxxx x x x x 0 0 x xx x --A

( 0 0 0 1 0 0 ) 0 0 0000 0 0 0 0 0 0 00 | x x xxxx x x x x 0 0 x xx x

( 0 0 0 1 0 0 ) 0 0 0000 0 0 0 0 0 0 00 | x x xxxx x x x x 0 0 x xx x --B

( 0 0 0 1 0 0 ) 0 0 0000 0 0 0 0 0 0 00 | x x xxxx x x x x 0 0 x xx x

( 0 0 0 1 0 0 ) 0 0 0000 0 0 0 0 0 0 00 | x x xxxx x x x x 0 0 x xx x --A

( 0 0 0 1 0 0 ) 0 0 0000 0 0 0 0 0 0 00 | x x xxxx x x x x 0 0 x xx x

( 0 0 0 1 0 0 ) 0 0 0000 0 0 0 0 0 0 00 | x x xxxx x x x x 0 0 x xx x --B

( 0 0 0 1 0 0 ) 0 0 0000 0 0 0 0 0 0 00 | x x xxxx x x x x 0 0 x xx x

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

Check that chip Id can be read out (scan path 0):

D D D n n D D B B G G I P P P P | D H B B B R S P P P P P

S A E D D S S C D L r S m C B D | B d D O S e S R F F D R

h d x F R e e y a e a S o m y a | u r a w h q t e a a a e

i d e r e r l c t n n t d d t t | s C t n a u o j u u t s

f r c e s i e l a g t o e I e a | O y a e r e p e l l a c

t e u e e a c e I t p I n S | u c O r e s O c t t h

C s t z t l t 0 n h I n e | t l u O d t u t C e

k s e e I n l | e t u O t o d

n I | O t u d u

n | u t e l

| t e

|

( 0 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

Shift In MyId (scan path 1) (Recall that MyId is only one bit so only one bit needs to be shifted in):

D D D n n D D B B G G I P P P P | D H B B B R S P P P P P

S A E D D S S C D L r S m C B D | B d D O S e S R F F D R

h d x F R e e y a e a S o m y a | u r a w h q t e a a a e

i d e r e r l c t n n t d d t t | s C t n a u o j u u t s

f r c e s i e l a g t o e I e a | O y a e r e p e l l a c

t e u e e a c e I t p I n S | u c O r e s O c t t h

C s t z t l t 0 n h I n e | t l u O d t u t C e

k s e e I n l | e t u O t o d

n I | O t u d u

n | u t e l

| t e

|

( 0 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x --A

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x --B

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x

Write AID and read it:

Write AID [09], Kernel Mode:

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 D F 09 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 D F 09 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 D F 33 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 33 | x 0 xxxx 0 0 0 0 0 0 x xx x

Read it back to check it [09]:

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 C 0 09 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 C 0 09 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 C 0 xx | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 0 0 x 33 x

Read In Two Blocks (this stuff is the same as the first two reads of SmallCacheInner-Pall):

Now do PReads to fill lines 7 and 6:

D D D n n D D B B G G I P P P P | D H B B B R S P P P P P

S A E D D S S C D L r S m C B D | B d D O S e S R F F D R

h d x F R e e y a e a S o m y a | u r a w h q t e a a a e

i d e r e r l c t n n t d d t t | s C t n a u o j u u t s

f r c e s i e l a g t o e I e a | O y a e r e p e l l a c

t e u e e a c e I t p I n S | u c O r e s O c t t h

C s t z t l t 0 n h I n e | t l u O d t u t C e

k s e e I n l | e t u O t o d

n I | O t u d u

n | u t e l

| t e

|

PReadMiss-MapMiss-NoVictim[50]:

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 8 0 50 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 8 0 50 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 8 0 xx | x 0 xxxx 0 0 0 0 1 0 x xx x --B

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 1 0 x xx x

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 1 0 x xx x --B

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 1 0 x xx x

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 1 0 x xx x --B

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 1 0 x xx x

Let the grant come here, so we send our MapRqst

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x x xxxx 0 0 2 0 0 0 x xx x --A

( 0 0 0 1 1 0 ) 0 0 0000 0 1 0 0 0 0 xx | x x xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 0 0 0000 0 1 0 0 0 0 xx | x 1 E150 0 0 0 0 1 0 x xx x --B

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 3333 0 0 0 0 1 0 x xx x

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 1 0 x xx x --B

( 0 0 0 1 1 0 ) 0 1 E150 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 1 0 x xx x

Here's our map request on our input wires, followed immediately by the MapRply

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 0 0 0 1 1 0 ) 0 1 E9DE 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 1 0 x xx x --B

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 1 0 x xx x

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 1 0 x xx x --B

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 1 0 x xx x

D D D n n D D B B G G I P P P P | D H B B B R S P P P P P

S A E D D S S C D L r S m C B D | B d D O S e S R F F D R

h d x F R e e y a e a S o m y a | u r a w h q t e a a a e

i d e r e r l c t n n t d d t t | s C t n a u o j u u t s

f r c e s i e l a g t o e I e a | O y a e r e p e l l a c

t e u e e a c e I t p I n S | u c O r e s O c t t h

C s t z t l t 0 n h I n e | t l u O d t u t C e

k s e e I n l | e t u O t o d

n I | O t u d u

n | u t e l

| t e

|

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 1 0 x xx x --B

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 1 0 x xx x

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 2 0 0 0 x xx x --A

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 1 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 1 xxxx 0 0 0 0 1 0 x xx x --B

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 1 xxxx 0 0 0 0 1 0 x xx x

Give the grant for the RBRqst

( 0 0 0 1 1 0 ) 0 0 0000 0 1 0 0 0 0 xx | x 1 xxxx 0 0 0 0 0 0 x xx x --A

( 0 0 0 1 1 0 ) 0 0 0000 0 1 0 0 0 0 xx | x 1 01D0 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 1 0 x xx x --B

( 0 0 0 1 1 0 ) 0 1 01D0 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 1 0 x xx x

Here's our RBRqst on our input wires

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 1 0 x xx x --B

( 0 0 0 1 1 0 ) 0 1 09D0 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 1 0 x xx x

And shortly thereafter the RBRply

( 0 0 0 1 1 0 ) 0 0 ABC1 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 0 0 0 1 1 0 ) 0 0 BAC2 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 0 0 CAB3 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 1 0 x AB x --B

( 0 0 0 1 1 0 ) 0 0 CBA4 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 1 0 x AB x

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 0 0 x AB x --A

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 0 0 x AB x

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 1 0 x AB x --B

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 1 0 x AB x

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 0 0 x AB x --A

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 0 0 x AB x

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 0 0 x AB x --B

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 0 0 x AB x

PReadMiss-MapHit-NoVictim[59]:

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 8 0 59 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 8 0 59 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 8 0 xx | x 0 xxxx 0 0 0 0 1 0 x xx x --B

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 1 0 x xx x

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 1 0 x xx x --B

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 1 0 x xx x

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 1 0 x xx x --B

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 1 0 x xx x

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 1 0 x xx x --B

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 1 0 x xx x

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 2 0 0 0 x xx x

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 1 xxxx 0 0 0 0 1 0 x xx x --B

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 1 xxxx 0 0 0 0 1 0 x xx x

Give the grant for the RBRqst

( 0 0 0 1 1 0 ) 0 0 0000 0 1 0 0 0 0 xx | x 1 xxxx 0 0 0 0 0 0 x xx x --A

( 0 0 0 1 1 0 ) 0 0 0000 0 1 0 0 0 0 xx | x 1 01D9 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 1 0 x xx x --B

( 0 0 0 1 1 0 ) 0 1 01D9 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 1 0 x xx x

Here's our RBRqst on our input wires

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 1 0 x xx x --B

( 0 0 0 1 1 0 ) 0 1 09D9 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 1 0 x xx x

And shortly thereafter the RBRply

( 0 0 0 1 1 0 ) 0 0 AABB 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 0 0 0 1 1 0 ) 0 0 CCDD 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 0 0 EEFF 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 1 0 x BB x --B

( 0 0 0 1 1 0 ) 0 0 8899 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 1 0 x BB x

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 0 0 x BB x --A

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 0 0 x BB x

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 1 0 x BB x --B

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 1 0 x BB x

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 0 0 x BB x --A

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 0 0 x BB x

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 0 0 x BB x --B

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 xx | x 0 xxxx 0 0 0 0 0 0 x BB x

Now Let SStopIn come in to freeze the cache

( 0 1 0 1 1 0 ) 0 0 0000 0 0 1 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 1 0 1 1 0 ) 0 0 0000 0 0 1 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 1 0 1 1 1 ) 0 0 0000 0 0 1 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 1 0 1 1 1 ) 0 0 0000 0 0 1 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

D D D n n D D B B G G I P P P P | D H B B B R S P P P P P

S A E D D S S C D L r S m C B D | B d D O S e S R F F D R

h d x F R e e y a e a S o m y a | u r a w h q t e a a a e

i d e r e r l c t n n t d d t t | s C t n a u o j u u t s

f r c e s i e l a g t o e I e a | O y a e r e p e l l a c

t e u e e a c e I t p I n S | u c O r e s O c t t h

C s t z t l t 0 n h I n e | t l u O d t u t C e

k s e e I n l | e t u O t o d

n I | O t u d u

n | u t e l

| t e

|

Reset Victim Pointer

Address Scan path 3 - mCode PC and WdAdrs

mCode PC is 7 bits and WdAdrs is 3bits

( 0 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

Shift in mCode PC TestResetVictimPC = 4D Hex; WdAdrs=0

( 0 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

Execute TestResetVictimPC by holding DExecute high for a cycle (mCode requires 2 cycles)

( 0 0 1 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

D D D n n D D B B G G I P P P P | D H B B B R S P P P P P

S A E D D S S C D L r S m C B D | B d D O S e S R F F D R

h d x F R e e y a e a S o m y a | u r a w h q t e a a a e

i d e r e r l c t n n t d d t t | s C t n a u o j u u t s

f r c e s i e l a g t o e I e a | O y a e r e p e l l a c

t e u e e a c e I t p I n S | u c O r e s O c t t h

C s t z t l t 0 n h I n e | t l u O d t u t C e

k s e e I n l | e t u O t o d

n I | O t u d u

n | u t e l

| t e

|

Read Ram - 0

Address Scan path 3 - mCode PC and WdAdrs - not rqrd just after ResetVictim since Scan path 3 still enabled

( 0 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

Shift in mCode PC TestReadRamPC = 4A Hex; WdAdrs=0

( 0 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

Execute TestReadRamPC by holding DExecute high for a cycle (mCode requires 4 cycles)

This moves Ram[victim] to RequestBufHi

( 0 0 1 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

Address Scan path 2 - RequestBufHi

( 0 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

Two shift (4 cycle) delay

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

Shift Out 10101011

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x --B

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x

Read Ram - 7

Address Scan path 3 - mCode PC and WdAdrs - not rqrd just after ResetVictim since Scan path 3 still enabled

( 0 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

Shift in mCode PC TestReadRamPC = 4A Hex; WdAdrs=7

( 0 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

Execute TestReadRamPC by holding DExecute high for a cycle (mCode requires 4 cycles)

This moves Ram[victim] to RequestBufHi

( 0 0 1 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

Address Scan path 2 - RequestBufHi

( 0 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

Two shift (4 cycle) delay

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

Shift Out 10100100

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x --B

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x

D D D n n D D B B G G I P P P P | D H B B B R S P P P P P

S A E D D S S C D L r S m C B D | B d D O S e S R F F D R

h d x F R e e y a e a S o m y a | u r a w h q t e a a a e

i d e r e r l c t n n t d d t t | s C t n a u o j u u t s

f r c e s i e l a g t o e I e a | O y a e r e p e l l a c

t e u e e a c e I t p I n S | u c O r e s O c t t h

C s t z t l t 0 n h I n e | t l u O d t u t C e

k s e e I n l | e t u O t o d

n I | O t u d u

n | u t e l

| t e

|

Read RCam

Address Scan path 3 - mCode PC and WdAdrs - not necessary after ResetVictim since Scan path 3 still enabled

( 0 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

Shift in mCode PC TestReadRCamPC = 4B Hex; WdAdrs=0

( 0 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

Execute TestReadRCamPC by holding DExecute high for a cycle (mCode requires 7 cycles)

This moves RCam[victim] to RequestBufHi

( 0 0 1 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

Address Scan path 2 - RequestBufHi

( 0 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

Two shift (4 cycle) delay

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

Shift Out 11010001

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x --B

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x

D D D n n D D B B G G I P P P P | D H B B B R S P P P P P

S A E D D S S C D L r S m C B D | B d D O S e S R F F D R

h d x F R e e y a e a S o m y a | u r a w h q t e a a a e

i d e r e r l c t n n t d d t t | s C t n a u o j u u t s

f r c e s i e l a g t o e I e a | O y a e r e p e l l a c

t e u e e a c e I t p I n S | u c O r e s O c t t h

C s t z t l t 0 n h I n e | t l u O d t u t C e

k s e e I n l | e t u O t o d

n I | O t u d u

n | u t e l

| t e

|

Read VCam

Address Scan path 3 - mCode PC and WdAdrs - not necessary after ResetVictim since Scan path 3 still enabled

( 0 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

Shift in mCode PC TestReadVCamPC = 4C Hex; WdAdrs=0

( 0 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

Execute TestReadVCamPC by holding DExecute high for a cycle (mCode requires 7 cycles)

This moves VCam[victim] to RequestBufHi

( 0 0 1 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

Address Scan path 2 - RequestBufHi

( 0 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

Two shift (4 cycle) delay

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

Shift Out 01010001

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x --B

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x

D D D n n D D B B G G I P P P P | D H B B B R S P P P P P

S A E D D S S C D L r S m C B D | B d D O S e S R F F D R

h d x F R e e y a e a S o m y a | u r a w h q t e a a a e

i d e r e r l c t n n t d d t t | s C t n a u o j u u t s

f r c e s i e l a g t o e I e a | O y a e r e p e l l a c

t e u e e a c e I t p I n S | u c O r e s O c t t h

C s t z t l t 0 n h I n e | t l u O d t u t C e

k s e e I n l | e t u O t o d

n I | O t u d u

n | u t e l

| t e

|

Shift Victim Pointer

Address Scan path 3 - mCode PC and WdAdrs

mCode PC is 7 bits and WdAdrs is 3bits

( 0 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

Shift in mCode PC TestShiftVictimPC = 4E Hex; WdAdrs=0

( 0 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

Execute TestShiftVictimPC by holding DExecute high for a cycle (mCode requires 4 cycles)

( 0 0 1 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

D D D n n D D B B G G I P P P P | D H B B B R S P P P P P

S A E D D S S C D L r S m C B D | B d D O S e S R F F D R

h d x F R e e y a e a S o m y a | u r a w h q t e a a a e

i d e r e r l c t n n t d d t t | s C t n a u o j u u t s

f r c e s i e l a g t o e I e a | O y a e r e p e l l a c

t e u e e a c e I t p I n S | u c O r e s O c t t h

C s t z t l t 0 n h I n e | t l u O d t u t C e

k s e e I n l | e t u O t o d

n I | O t u d u

n | u t e l

| t e

|

Read Ram - 5

Address Scan path 3 - mCode PC and WdAdrs - not rqrd just after ResetVictim since Scan path 3 still enabled

( 0 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

Shift in mCode PC TestReadRamPC = 4A Hex; WdAdrs=0

( 0 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

Execute TestReadRamPC by holding DExecute high for a cycle (mCode requires 4 cycles)

This moves Ram[victim] to RequestBufHi

( 0 0 1 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

Address Scan path 2 - RequestBufHi

( 0 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

Two shift (4 cycle) delay

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

Shift Out 11111111

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x --B

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x

Read RCam

Address Scan path 3 - mCode PC and WdAdrs - not necessary after ResetVictim since Scan path 3 still enabled

( 0 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

Shift in mCode PC TestReadRCamPC = 4B Hex; WdAdrs=0

( 0 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

Execute TestReadRCamPC by holding DExecute high for a cycle (mCode requires 7 cycles)

This moves RCam[victim] to RequestBufHi

( 0 0 1 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

Address Scan path 2 - RequestBufHi

( 0 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

Two shift (4 cycle) delay

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

Shift Out 11011001

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x --B

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x

D D D n n D D B B G G I P P P P | D H B B B R S P P P P P

S A E D D S S C D L r S m C B D | B d D O S e S R F F D R

h d x F R e e y a e a S o m y a | u r a w h q t e a a a e

i d e r e r l c t n n t d d t t | s C t n a u o j u u t s

f r c e s i e l a g t o e I e a | O y a e r e p e l l a c

t e u e e a c e I t p I n S | u c O r e s O c t t h

C s t z t l t 0 n h I n e | t l u O d t u t C e

k s e e I n l | e t u O t o d

n I | O t u d u

n | u t e l

| t e

|

Read VCam

Address Scan path 3 - mCode PC and WdAdrs - not necessary after ResetVictim since Scan path 3 still enabled

( 0 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

Shift in mCode PC TestReadVCamPC = 4C Hex; WdAdrs=0

( 0 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 1 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

Execute TestReadVCamPC by holding DExecute high for a cycle (mCode requires 7 cycles)

This moves VCam[victim] to RequestBufHi

( 0 0 1 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 0 0 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

Address Scan path 2 - RequestBufHi

( 0 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 1 0 1 1 1 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 1 0 1 1 0 ) 0 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

Two shift (4 cycle) delay

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | x 0 xxxx 0 0 0 0 0 0 x xx x

Shift Out 01011001

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x --B

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x --A

( 1 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 1 0 xxxx 0 0 0 0 0 0 x xx x

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x --B

( 0 0 0 1 1 0 ) 1 0 0000 0 0 0 0 0 0 00 | 0 0 xxxx 0 0 0 0 0 0 x xx x

.