MANUAL
Release 02.2022
PPC600 Family Debugger
Page 1: ...MANUAL Release 02 2022 PPC600 Family Debugger ...
Page 2: ...ations 8 General 8 Quick Start 9 Troubleshooting 11 Problems with Memory Access 12 FAQ 12 Configuration 13 System Overview 13 PowerPC 600 Family Specific Implementations 14 Breakpoints 14 Software Breakpoints 14 Software Breakpoint Handling 15 On chip Breakpoints 17 Software Breakpoints in Interrupt Handlers 18 Breakpoints in FLASH ROM 18 Breakpoints on Physical or Virtual Addresses 18 Examples fo...
Page 3: ...configuration 36 SYStem Option DCREAD Read from data cache 37 SYStem Option DUALPORT Implicitly use run time memory access 37 SYStem Option FREEZE Freeze timebase when core halted 38 SYStem Option HoldReset Set reset hold time 39 SYStem Option HOOK Compare PC to hook address 39 SYStem Option HRCWOVerRide Override HRCW on SYStem Up 40 SYStem Option ICFLUSH Invalidate instruction cache before go ste...
Page 4: ...MMU table from CPU 57 MMU Set Write MMU TLB entries to CPU 58 CPU specific BenchMarkCounter Commands 59 BMC counter FREEZE Freeze counter in certain core states 59 BMC FREEZE Freeze counters while core halted 60 CPU specific TrOnchip Commands 61 TrOnchip DISable Disable debug register control 61 TrOnchip ENable Enable debug register control 61 TrOnchip CONVert Adjust range breakpoint in on chip re...
Page 5: ...PPC600 Family Debugger 5 1989 2022 Lauterbach PPC600 Family Debugger Version 09 Mar 2022 ...
Page 6: ...e family ies is added in brackets Brief Overview of Documents for New Users Architecture independent information Training Debugger Basics training_debugger pdf Get familiar with the basic features of a TRACE32 debugger T32Start app_t32start pdf T32Start assists you in starting TRACE32 PowerView instances for different configurations of the debugger T32Start is only available for Windows General Co...
Page 7: ...prevent debugger and target from damage it is recommended to connect or disconnect the Debug Cable only while the target power is OFF Recommendation for the software start 1 Disconnect the Debug Cable from the target while the target power is off 2 Connect the host system the TRACE32 hardware and the Debug Cable 3 Power ON the TRACE32 hardware 4 Start the TRACE32 software to load the debugger firm...
Page 8: ...memory controllers with HRESET In order to start debugging right from reset the debugger must be able to control CPU HRESET and CPU TRST independently There are board design recommendations to tie CPU TRST to CPU HRESET but this recommendation is not suitable for JTAG debuggers If the processor does not have QACK QREQ pins leave the corresponding pins on the debug connector N C If the processor ha...
Page 9: ...his command resets the CPU HRESET and enters debug mode After this command is executed it is possible to access the registers 5 Show registers of on chip peripherals 6 Set the chip selects to get access to the target memory 7 Load the program and debug symbols 8 If the program was compiled on a different computer environment the source file path might have to be adopted B SYStem CPU MPC8323 MAP BO...
Page 10: ...ommand is given in the General Commands Reference 9 Set a breakpoint to the function to be debugged 10 Start application The core will halt when the breakpoint is reached 11 Open windows to show source code core registers and local variables The window position can be specified with the WinPOS command Break Set main Go Data List Register view SpotLight Frame view Locals Caller ...
Page 11: ...asons for this error The CPU you are using is not supported by the used software or a communication error pre vented a correct determination Check the AREA window for more information target processor in reset The reset line is was asserted by the target while the debugger per formed a power on reset Try SYStem Option SLOWRESET and check signal level of the JTAG HRESET pin emulation debug port fai...
Page 12: ...effects of accessing unimplemented memory are temporarily flickering memory windows up to permanently hanging memory buses which can only be recovered by a reset The debugger can rarely detect if a memory bus is hanging or not Typical values displayed in dump list windows are 0x00000000 0xDEADBEE0 0xDEADBEE1 or bus error Hints for safe memory accesses directly after reset set R1 to zero before ope...
Page 13: ... System Overview POWER DEBUG PRO POWER DEBUG PRO SWITCH PC or Workstation 1 GBit Ethernet Ethernet Cable Target Debug Connector Debug Cable POWER DEBUG USB INTERFACE USB 3 POWER DEBUG INTERFACE USB 3 PC or Workstation USB Cable Target Debug Connector Debug Cable ...
Page 14: ...ne by setting MSR_IP Please note that the target application can modify this value any time Force on chip breakpoints to a different address until target initialization is finished E g set the on chip breakpoint to the address where the code at the interrupt addresses is not executed anymore If this point is reached clear the on chip breakpoint and continue debugging If the used CPU has more than ...
Page 15: ...ies MSR IP then a manual correction is necessary to use the correct exception handler Following some logic structure examples to explain this special situations Source code structure for all modes AUTO Mode Manual Mode 0 1 0x00 0x04 0x08 0x0C 0x10 0x14 0x18 0x1C 0x20 code code 1 SW BP code code code change MSR IP bit to 0 code 2 SW BP code Command Sequence CPU Status MSR IP Exception Pos Comment C...
Page 16: ...e right exception handler NOTE If the target application uses page tables software breakpoints can only be set to page tables which are already available If it is necessary to set breakpoints in pages not yet mapped only on chip breakpoints can be used Software breakpoints can be overwritten by the target application e g if a breakpoint is set in an area which will be loaded by a boot loader Use o...
Page 17: ...address NOTE On chip breakpoints can be cleared by the target application or by a target reset If an on chip breakpoint is not hit first check with the peripheral view if the on chip breakpoint is set or not CPU Family Instruction Breakpoints Read Write Breakpoints Data Value Breakpoints Notes PPC603 RHPPC MPC8240 MPC8245 MPC8255 MPC8260 MPC8265 MPC8266 1 single address Instruction breakpoint is n...
Page 18: ... will set an on chip breakpoint With the command MAP BOnchip range it is possible to inform the debugger where you have ROM FLASH EPROM on the target If a breakpoint is set within the specified address range the debugger uses automatically the available on chip breakpoints Use this command if write accesses to a read only memory space are forbidden e g because it could cause a reset etc Example Br...
Page 19: ...s breakpoints of all PPC603e based cores will operate on 8 byte boundaries Break Set 0x101000 single address Break Set FooBar function name Break Set 0xFFF00244 onchip program single address Break Set 0xFFF00244 onchip single address Break Set MyFlashFunction onchip function name Break Set 0x2000 0x2fff onchip address range Break Set 0xFFF00244 read single address read Break Set 0xFFF00244 write s...
Page 20: ...lasses there are access class attributes Examples Command Effect Data List P 0x1000 Opens a List window displaying program memory Data dump D 0xFF800000 LONG Opens a DUMP window at data address 0xFF800000 Data Set SPR 415 Long 0x00003300 Write value 0x00003300 to the SPR IVOR15 PRINT Data Long ANC 0xFFF00100 Print data value at physical address 0xFFF00100 Access Class Description P Program memory ...
Page 21: ... number after the access class Cache Memory Coherency The following table describes which memory will be updated depending on the selected access class Access Class Attributes Description E Use real time memory access A Given address is physical bypass MMU U TS translation space 1 user memory S TS translation space 0 supervisor memory Access Class Description SPR Special Purpose Register SPR acces...
Page 22: ... Invalidate instruction cache before go step debugger_ppc600 pdf for details MESI States The cache logic of e300 e600 e700 and PPC603e based cores is described as MESI states This MESI state are represented in the CPU as the flags Valid and Dirty The debugger will display both MESI state and the status flag representation State translation table MESI state Flag M modified Valid Dirty E exclusive V...
Page 23: ...ian mode enable SYStem Option LittleEnd For modified PowerPC little endian mode enable SYStem Option PPCLE The following table lists processors which support one or both little endian modes Processor true little endian modified little endian Notes MPC603 MPC745 MPC750 FSL MPC755 PPC750xx IBM Yes MPC5121 MPC5123 MPC5125 Yes e300 core only supports true little endian MGT5100 MPC5200 Yes Yes HID2 TLE...
Page 24: ...u will find the information in the VERSION window check if the debugger software is up to date Please check the VERSION window to see which version is installed CPUs that appeared later than the software release are usually not supported Please check www lauterbach com for updates If the needed CPU appeared after the release date of the debugger software please contact technical support and reques...
Page 25: ...var1 It is also possible to activate this non intrusive memory access for all memory ranges displayed on the TRACE32 screen by setting SYStem Option DUALPORT ON NOTE SYStem MemAccess Enable is only available for the MPC86XX Format SYStem LOCK ON OFF Format SYStem MemAccess Enable StopAndGo Denied cpu_specific SYStem ACCESS deprecated Enable CPU deprecated Real time memory access during program exe...
Page 26: ...o Resets the target with debug mode enabled and prepares the CPU for debug mode entry After this command the CPU is in the system up mode and running Now the processor can be stopped with the break command or until any break condition occurs Attach Connect to the processor without asserting reset The state of the target application does not change After this command the CPU is in the system up mod...
Page 27: ...ngs via the TRACE32 command line with the SYStem CONFIG commands Note that the command line provides additional SYStem CONFIG commands for settings that are not included in the SYStem CONFIG state window Format SYStem CONFIG state tab tab DebugPort Jtag tab Opens the SYStem CONFIG state window on the specified tab For tab descriptions see below DebugPort Lets you configure the electrical propertie...
Page 28: ...at the same time in order to ensure that always only one debugger drives the signal lines TAPState and TCKLevel define the TAP state and TCK level which is selected when the debugger switches to tristate mode Please note nTRST must have a pull up resistor on the target TCK can have a pull up or pull down resistor other trigger inputs need to be kept in inactive state Format SYStem CONFIG parameter...
Page 29: ... in the JTAG chain between the core of interest and the TDO signal of the debugger This is the sum of the instruction register length of all TAPs between the core of interest and the TDO signal of the debugger IRPRE bits default 0 number of instruction register bits in the JTAG chain between the TDI signal and the core of interest This is the sum of the instruction register lengths of all TAPs bet...
Page 30: ...port access Then other debuggers can access the port JTAG This option must be used if the JTAG line of multiple debug boxes are connected by a JTAG joiner adapter to access a single JTAG chain Slave default OFF If more than one debugger share the same debug port all except one must have this option active JTAG Only one debugger the master is allowed to control the signals nTRST and nSRST nRESET ...
Page 31: ...uction register length of Core A 3 bit Core B 5 bit Core D 6 bit SYStem CONFIG IRPRE 6 IR Core D SYStem CONFIG IRPOST 8 IR Core A B SYStem CONFIG DRPRE 1 DR Core D SYStem CONFIG DRPOST 2 DR Core A B SYStem CONFIG CORE 0 1 Target Core C is Core 0 in Chip 1 Core A Core B Core C Core D TDO TDI Chip 0 Chip 1 ...
Page 32: ...H Controls the level of pin 8 CHKSTP_IN or PRESENT of the debug connector 0 Exit2 DR 1 Exit1 DR 2 Shift DR 3 Pause DR 4 Select IR Scan 5 Update DR 6 Capture DR 7 Select DR Scan 8 Exit2 IR 9 Exit1 IR 10 Shift IR 11 Pause IR 12 Run Test Idle 13 Update IR 14 Capture IR 15 Test Logic Reset Format SYStem CONFIG CHKSTPIN LOW HIIGH ...
Page 33: ...Is are configured with different chip_index values Therefore you have to assign the core_index and the chip_index for every core Usually the debugger does not need further information to access cores in non generic chips once the setup is correct Generic Chips Generic chips can accommodate an arbitrary amount of sub cores The debugger still needs information how to connect to the individual cores ...
Page 34: ... C15040204231 and higher SYStem CONFIG QACK Control QACK pin Controls the level and function of pin 2 QACK of the debug connector Default TRISTATE Format SYStem CONFIG DriverStrength signal LOW MID HIGH signal TCK Format SYStem CONFIG QACK TRISTATE QREQ LOW HIGH TRISTATE Pin is disabled tristate QREQ Pin is driven to level of QREQ pin 5 LOW Pin is driven to GND permanently HIGH Pin is driven to JT...
Page 35: ...ed to set the base address of the memory mapped registers of an external memory peripheral controller MPC10X TSI1xx MV6xxxx etc Format SYStem Option Base AUTO value AUTO The debugger reads the RCW from FLASH to detect the base address of the internal memory map address Only works during SYStem Up AUTO does not work if the default reset configuration is used or if the RCW is only visible during res...
Page 36: ...ocessors SYStem Option CONFIG Select RCW configuration For MPC82XX only When SYStem Option BASE is set to AUTO this setting defines if the RCW is read from the location designated to the configuration master or from one of the seven locations designated to the configuration slaves By default setting the debugger will read from the configuration master location Format SYStem Option BUS32 ON OFF For...
Page 37: ...is setting has no effect if SYStem Option MemAccess is disabled or real time memory access not available for used CPU Please note that while the CPU is running MMU address translation can not be accesses by the debugger Only physical addresses accesses are possible Use the access class modifier A to declare the access physical addressed or declare the address translation in the debugger based MMU ...
Page 38: ...89 2022 Lauterbach SYStem Option FREEZE Freeze timebase when core halted When enabled the core s timebase is stopped when the core is halted in debug mode It is recommended to set this option ON Format SYStem Option FREEZE ON OFF ...
Page 39: ... delay else 100us See also SYStem Option WaitReset and SYStem Option SLOWRESET SYStem Option HOOK Compare PC to hook address The command defines the hook address After program break the hook address is compared against the program counter value If the values are equal it is supposed that a hook function was executed This information is used to determine the right break address by the debugger Form...
Page 40: ...in the order 0xHHHHHHHHLLLLLLLL NOTE The CPU will remember and use the overridden HRCW until the next power cycle or power on reset If JTAG_HRESET is connected to CPU_PORESET SYStem Option HRCWOVerRide will only work in conjunction with SYStem Option ResetMode JTAG_HRST SYStem CPU MPC8360 SYStem Option HRCWOVerRide 0x8060000004040006 SYStem Up SYStem Option HRCWOVerRide select CPU desired HRCW res...
Page 41: ...s After single step the interrupt mask bits are restored to the value before the step SYStem Option IMASKHLL Disable interrupts while HLL single stepping Default OFF If enabled the interrupt mask bits of the cpu will be set during HLL single step operations The interrupt routine is not executed during single step operations After single step the interrupt mask bits are restored to the value before...
Page 42: ...nable memory access safeguard PowerQuicc II MPC824X MPC826X MPC827X MPC8280 only This option can help to prevent a hanging memory bus caused by debugger accesses to unimplemented memory USe together with SYStem Option BASE AUTO Format SYStem Option IP 0 1 AUTO BOTH AUTO Depend on the current last state of the MSR IP bit the debugger uses the lower or the higher exception handler 0 Independent of t...
Page 43: ...ingle step Now the debugger will use the new IMMR address for peripheral view and servicing the watchdog SYStem Option MemSpeed Configure memory access timing This option can be used to configure the access speed for memory accesses by the debugger Only use this option when advised by Lauterbach SYStem Option MMUSPACES Separate address spaces by space IDs Default OFF Enables the use of space IDs f...
Page 44: ...n if the CPU should not stop for JTAG on debug events in order to allow a target application to use debug events Typical usages for this option are run mode debugging e g with gdbserver or setting up the system for a branch trace via LOGGER trace data in target RAM or INTEGRATOR NOTE SYStem Option MMUSPACES should not be set to ON if only one translation table is used on the target If a debug sess...
Page 45: ...registers FPU Use an FPU instruction as software breakpoint Gives the ability to use the program interrupt in the application without halting for JTAG This setting only works if the application does not use floating point instructions neither hardware nor software emulated MSR FP must be set to 0 at all times Software breakpoint will overwrite SRR0 1 registers ILL Use an illegal instruction as sof...
Page 46: ...bles the debugger to handle overlaid program memory OFF Disables support for code overlays WithOVS Like option ON but also enables support for software breakpoints This means that TRACE32 writes software breakpoint opcodes to both the execution area for active overlays and the storage area This way it is possible to set breakpoints into inactive overlays Upon activation of the overlay the target s...
Page 47: ...Please note that this feature has an impact on the real time behavior because the CPU will stop for a short time every time a program interrupt occurs SYStem Option PPCLittleEnd PPC little endian mode Enable this system option if the PowerPC core is operated in modified PowerPC little endian mode If the CPU is configured for true little endian mode use the command SYStem Option LittleEnd To find o...
Page 48: ...al memory access fail can result Related to this make sure to disable this option before SYStem Up or target reset SYStem Option RESetBehavior Set behavior when target reset detected Defines the debugger s action when a reset is detected Default setting is Disabled The reset can only be detected and actions taken if it is visible to the debugger s reset pin Format SYStem Option PTE ON OFF Format S...
Page 49: ... If this system option is enabled the debugger will not read JTAG_HRESET but instead waits four seconds and then assumes that the boards HRESET is released Format SYStem Option ResetMode mode mode PIN JTAG_PORST JTAG_HRST JTAG_SRST mode Effect at SYStem Up PIN The reset pin debug connector pin 13 is asserted to reset the processor JTAG_HRST A hard reset issue is issued via JTAG The debug connector...
Page 50: ...ssors is used and if the effect of this errata has been observed If the code to be debugged is located in RAM SYStem Option STEPSOFT can be used without further configuration If the code to be debugged is located in read only memory the alternative method can be used if RAM is available and free for debugger use In this case declare the read only memory using MAP BOnchip and the RAM used by the de...
Page 51: ...erence is set to RESET or RSTOUT the wait time starts when the debugger detects that reset is released on the corresponding pin Use this command when SYStem Up fails and the message AREA shows the message Target reset detected during system up sequence A wait time of several ms should be sufficient If a wait time 10ms is required the target might require a stronger RESET pull up resistor Format SY...
Page 52: ...sables the watchdog at SYStem Up Software Watchdog Timer SWT The SWT asserts a reset or non maskable interrupt as selected by the system protection control register if the software fails to service the SWT for a designated period of time e g because the software is trapped in a loop or lost After a system reset this function is enabled with a maximum time out period and asserts a system reset if t...
Page 53: ...ageTable task_magic task_id task_name space_id 0x0 cpu_specific_tables root The root argument can be used to specify a page table base address deviating from the default page table base address This allows to display a page table located anywhere in memory range address Limit the address range displayed to either an address range or to addresses larger or equal to address For most table types the ...
Page 54: ...ask_name space_id 0x0 Displays the MMU translation table entries of the given process Specify one of the TaskPageTable arguments to choose the process you want In MMU based operating systems each process uses its own MMU translation table This command reads the table of the specified process and displays its table entries For information about the first three parameters see What to know about the ...
Page 55: ...ys the contents of the BAT table PTE Displays the contents of the PTE table Format MMU List table range address range root address root MMU table List deprecated table PageTable KernelPageTable TaskPageTable task_magic task_id task_name space_id 0x0 root The root argument can be used to specify a page table base address deviating from the default page table base address This allows to display a pa...
Page 56: ...sk_id task_name space_id 0x0 Lists the MMU translation of the given process Specify one of the TaskPageTable arguments to choose the process you want In MMU based operating systems each process uses its own MMU translation table This command reads the table of the specified process and lists its address translation For information about the first three parameters see What to know about the Task Pa...
Page 57: ... into the debugger internal static translation table if range or address have a space ID loads the translation table of the specified process else this command loads the table the CPU currently uses for MMU translation KernelPageTable Loads the MMU translation table of the kernel If specified with the MMU FORMAT command this command reads the table of the kernel and copies its address translation ...
Page 58: ...B Loads the data translation table from the CPU to the debugger internal translation table BAT Loads the Block Address Translation table from the CPU to the debugger internal translation table PTE Loads the PTE table from the CPU to the debugger internal translation table Format MMU Set table index way tlbhi tlblo tlbext table ITLB DTLB index Index entry set number in TLB table tlbhi tlblo tlbext ...
Page 59: ... core If contradicting states are enabled e g SUPERVISOR and USER the counter will be permanently frozen The table below explains the meaning of the individual states NOTE For information about architecture independent BMC commands refer to BMC general_ref_b pdf For information about architecture specific BMC commands see command descriptions below Events can be assigned to the BMC commands BMC co...
Page 60: ...ted Enable this setting to prevent that actions of the debugger have influence on the performance counter As this feature software controlled no on chip feature some events especially clock cycle measurements may be counted inaccurate even if this setting is set ON Format BMC FREEZE ON OFF ...
Page 61: ...l automatically be converted into a single address breakpoint when this option is active This is the default Otherwise an error message is generated The features supported by the TrOnchip command for TRACE32 ICD vary for the different PowerPC families Format TrOnchip DISable Format TrOnchip ENable Format TrOnchip CONVert ON OFF deprecated Use Break CONFIG InexactAddress instead TrOnchip CONVert ON...
Page 62: ...the breakpoint will automatically be converted into a single address breakpoint This is the default setting Otherwise an error message is generated TrOnchip RESet Reset on chip trigger settings Resets the trigger system to the default state TrOnchip state Display on chip trigger window Opens the TrOnchip state window TrOnchip TEnable Set filter for the trace Refer to the Break Set command to set t...
Page 63: ... trace filters TrOnchip TON Switch the sampling to the trace to ON Refer to the Break Set command to set trace filters TrOnchip TTrigger Set a trigger for the trace Refer to the Break Set command to set a trigger for the trace Format TrOnchip TOFF deprecated Format TrOnchip TON EXT Break deprecated Format TrOnchip TTrigger par deprecated ...
Page 64: ...d 16 pin double row two rows of eight pins connector pin to pin spacing 0 100 in Pin 6 connected to VCCS should have a resistance less than 5kOhm for 3 0 5 0V less than 2kOhm for 1 8 3 0V Pin 8 is permanently driven high level of VCCS by the debug cable Signal in brackets are not needed by the debugger and can be left uncon nected If CPUs have an QACK input and this input is unused QACK should be ...
Page 65: ...PPC600 Family Debugger 65 1989 2022 Lauterbach Technical Data ...
