MANUAL
Release 09.2021
PQIII Debugger
Page 1: ...MANUAL Release 09 2021 PQIII Debugger ...
Page 2: ...Errors 9 FAQ 10 Configuration 11 System Overview 11 PowerPC MPC85XX QorIQ specific Implementations 12 Breakpoints 12 Software Breakpoints 12 On chip Breakpoints 12 Breakpoints on Program Addresses 13 Breakpoints on Data Addresses 13 Breakpoints on Data Access at Program Address 14 Breakpoints on Data Value 14 Access Classes 16 Access Classes to Memory and Memory Mapped Resources 16 Access Classes ...
Page 3: ...oad flush in debug mode 33 SYStem Option DCREAD Read from data cache 34 SYStem Option DUALPORT Implicitly use run time memory access 34 SYStem Option FREEZE Freeze system timers on debug events 35 SYStem Option HOOK Compare PC to hook address 35 SYStem Option ICFLUSH Invalidate instruction cache before go and step 35 SYStem Option ICREAD Read from instruction cache 36 SYStem Option IMASKASM Disabl...
Page 4: ...esource 50 TrOnchip DISable Disable NEXUS trace register control 50 TrOnchip ENable Enable NEXUS trace register control 51 TrOnchip RESet Reset on chip trigger settings 51 TrOnchip Set Enable special on chip breakpoints 52 TrOnchip VarCONVert Adjust HLL breakpoint in on chip resource 53 TrOnchip state View on chip trigger setup window 54 MPC85XX QorIQ Specific On chip Trace Settings 55 Onchip Mode...
Page 5: ...or for specific families the name s of the family ies is added in brackets Brief Overview of Documents for New Users Architecture independent information Debugger Basics Training training_debugger pdf Get familiar with the basic features of a TRACE32 debugger T32Start app_t32start pdf T32Start assists you in starting TRACE32 PowerView instances for different configurations of the debugger T32Start...
Page 6: ...o connect or disconnect the Debug Cable only while the target power is OFF Recommendation for the software start 1 Disconnect the Debug Cable from the target while the target power is off 2 Connect the host system the TRACE32 hardware and the Debug Cable 3 Power ON the TRACE32 hardware 4 Start the TRACE32 software to load the debugger firmware 5 Connect the Debug Cable to the target 6 Switch the t...
Page 7: ...mance Ensure that JTAG HRESET is connected directly to the HRESET of the processor This will provide the ability for the debugger to drive and sense the status of HRESET The target design should only drive HRESET with open collector open drain For optimal operation the debugger should be able to reset the target board completely processor external peripherals e g memory controllers with HRESET In ...
Page 8: ...the CPU for the access to all memories either run the initialization code on your target or configure the CPU by using the Data Set command For complete example scripts see demo powerpc hardware 10 Load the program The option of the Data LOAD command depends on the file format generated by the compiler A detailed description of the Data LOAD command is given in the General Commands Reference SYSte...
Page 9: ... not supported by the used software Please check if the processor is supported by the debugger Processors that appeared later than the debugger software version are usually not supported Please download and install the latest software from our homepage or contact technical support to get a newer software Please also check if the processor or the software update is covered by your current licence A...
Page 10: ...error This can e g be the case when the PLL configuration is wrong there is an alternative method to access the bootstrap configuration information For instructions please contact bdmppcpq3 support lauterbach com SYStem Up will also fail if the processor is configured to boot from NAND but the NAND flash contains invalid data The processor enables NAND error checking upon reset If the ECC in the s...
Page 11: ...ach GmbH Configuration System Overview PODBUS Cable PODPC PODPAR Debug EPROM PODETH Interface Simulator optional Debug Cable CPU CLK RESET INT Target Connector 600 EPROM only Target TS4 400 only Basic configuration for the BDM Interface ...
Page 12: ...reakpoints Total amount of available on chip breakpoints Instruction address breakpoints Number of on chip breakpoints that can be used to set Program breakpoints into ROM FLASH EEPROM Data address breakpoints Number of on chip breakpoints that can be used as Read or Write breakpoints Data value breakpoint Number of on chip data value breakpoints that can be used to stop the program when a specifi...
Page 13: ...address or address range is read or written by the core A data address breakpoint to a single address has a granularity of 1 byte Equal to program address breakpoints data address breakpoints can be configured to stop if the break event occurred a given number of times Data address breakpoint limitations Map BOnchip 0xFFFC0000 0xFFFFFFFF use on chip breakpoints in FLASH Break Set 0xFFFFF064 debugg...
Page 14: ...em by software emulation When a data value breakpoint is set the debugger will use one of the data address breakpoint s When the core hits that breakpoint the target application will stop and the debugger will evaluate if the data value matches If the value matches the debugger will stop execution if it does not match the debugger will restart the application Using software emulated data value bre...
Page 15: ...o the 16 bit word at 0x40000200 Break Set 0x40000200 Write Data Word 0x1233 Break when a value not equal 0x98 is written to the 8 bit variable xval Break Set xval Write Data Byte 0x98 Break when decimal 32 bit value 4000 is written to variable count within function foo Break Set sYmbol RANGE foo MemoryWrite count Data Long 4000 ...
Page 16: ...les Command Effect Data List P 0x1000 Opens a List window displaying program memory Data dump D 0xFF800000 LONG Opens a DUMP window at data address 0xFF800000 SPR 415 Long 0x00003300 Write value 0x00003300 to the SPR IVOR15 PRINT Data Long ANC 0xFFF00100 Print data value at physical address 0xFFF00100 Access Class Description P Program memory as seen by core s instruction fetch F Program disassemb...
Page 17: ...epending on the selected memory class Access Class Attributes Description E Use real time memory access A Given address is physical bypass MMU U TS translation space 1 user memory S TS translation space 0 supervisor memory Access Class Description SPR Special Purpose Register SPR access PMR Performance Monitor Register PMR access Memory Class D Cache I Cache L2 Cache Memory uncached DC updated not...
Page 18: ...ed updated updated updated Memory Class D Cache I Cache L2 Cache Memory uncached Depending on the debugger configuration the coherency of the instruction cache will not be achieved by updating the instruction cache but by invalidating the instruction cache See SYStem Option ICFLUSH for details ...
Page 19: ...ommand The meaning of the data fields in the CACHE DUMP window os explained in the following table MESI state Flag M modified V alid D irty E exclusive V alid NOT D irty S shared V alid S hared I invalid NOT V alid Cache Command L1 instruction cache CACHE DUMP IC L1 data dache CACHE DUMP DC L2 unified cache CACHE DUMP L2 Data field Meaning address Physical address of the cache line The address is ...
Page 20: ...y RFCI to the debug interrupt vector These two instructions are needed for SYStem Option FREEZE Multicore Debugging e500 cores SMP Debugging For the dual core processors MPC8572 and the dual core variants of P10xx and P20xx SMP debugging is selected by default No further configuration is needed As soon as the debugger is connected SYStem Up SYStem Mode Attach etc it is possible to switch to any co...
Page 21: ...ebugging P10xx 20xx dual core processors on AMP mode in demo powerpc hardware qoriq_p1_p2 amp_debugging in the TRACE32 installation directory Synchronous stop of both e500 cores MPC8572 P10xx P20xx processors do not implement a break switch on silicon If SYNCH is configured to synchronous break in AMP mode or always if SMP mode is selected the core that did not hit a breakpoint will be stopped by ...
Page 22: ... Processors of the MPC85XX series have a built in trace buffer with 256 entries It can be used to trace transactions that occur on the internal memory bus according to the selected major interface local bus DDR SDRAM and PCI The trace buffer holds information about transaction address transaction type source target ID and the byte count The interface can be selected with the command Onchip Mode IF...
Page 23: ... at once the program trace can not be reconstructed using this on chip trace Also data trace is limited to uncached accesses The data value of the load store access is not contained in the trace data For more information about general trace commands see Trace in General Commands Reference Guide T and Onchip Trace Commands in General Commands Reference Guide O initialize trace buffer Onchip Init st...
Page 24: ...ies in order to accomplish the debugger s operations Alternatively you can modify the target configuration settings via the TRACE32 command line with the SYStem CONFIG commands Note that the command line provides additional SYStem CONFIG commands for settings that are not included in the SYStem CONFIG state window Format SYStem BdmClock rate rate 5kHz 50MHz NOTE MPC85XX QorIQ The recommended maxim...
Page 25: ...ected when the debugger switches to tristate mode Jtag Informs the debugger about the position of the Test Access Ports TAP in the JTAG chain which the debugger needs to talk to in order to access the debug and trace facilities on the chip Format SYStem CONFIG parameter number_or_address SYStem MultiCore parameter number_or_address deprecated parameter JTAG DRPRE DRPOST IRPRE IRPOST CHIPDRLENGTH b...
Page 26: ... the instruction register lengths of all TAPs between the TDI signal of the debugger and the core of interest CHIPDRLENGTH bits Number of Data Register DR bits which needs to get a certain BYPASS pattern CHIPDRPATTERN Standard Alter nate pattern Data Register DR pattern which shall be used for BYPASS instead of the standard 1 1 pattern CHIPIRLENGTH bits Number of Instruction Register IR bits which...
Page 27: ...one TAP So type just the IR bits of TAP4 i e 6 SYStem CONFIG IRPOST 12 IRPOST Add up the IR bits of TAP1 TAP2 and TAP3 i e 4 3 5 12 SYStem CONFIG DRPRE 1 DRPRE There is only one TAP which is in BYPASS mode So type just the DR of TAP4 i e 1 SYStem CONFIG DRPOST 3 DRPOST Add up one DR bit per TAP which is in BYPASS mode i e 1 1 1 3 This completes the configuration Chip IRPOST IRPRE 4 1 TAP1 IR DR 3 ...
Page 28: ...Controls the level of pin 8 CHKSTP_IN or PRESENT of the debug connector 0 Exit2 DR 1 Exit1 DR 2 Shift DR 3 Pause DR 4 Select IR Scan 5 Update DR 6 Capture DR 7 Select DR Scan 8 Exit2 IR 9 Exit1 IR 10 Shift IR 11 Pause IR 12 Run Test Idle 13 Update IR 14 Capture IR 15 Test Logic Reset Format SYStem CONFIG CHKSTPIN LOW HIIGH ...
Page 29: ...15040204231 and higher SYStem CONFIG QACK Control QACK pin Controls the level and function of pin 2 QACK of the debug connector Default TRISTATE Format SYStem CONFIG DriverStrength signal LOW MID HIGH signal TCK Format SYStem CONFIG QACK TRISTATE QREQ LOW HIGH TRISTATE Pin is disabled tristate QREQ Pin is driven to level of QREQ pin 5 LOW Pin is driven to GND permanently HIGH Pin is driven to JTAG...
Page 30: ...release the processor is most likely not supported Please check the Lauterbach download center www lauterbach com for updates If the debugger software version from the download center also does not support the processor please contact technical support and request a software update If you are unsure about the processor try SYStem DETECT CPU for automatic detection SYStem LOCK Lock and tristate the...
Page 31: ...ar View E var1 It is also possible to activate this non intrusive memory access for all memory ranges displayed on the TRACE32 screen by setting SYStem Option DUALPORT ON Format SYStem MemAccess mode mode Denied Enable Denied Memory access is disabled while the CPU is executing code Enable CPU deprecated The debugger performs memory accesses via a dedicated CPU interface This memory access will sn...
Page 32: ...e keeps in the state of NoDebug Go Resets the target with debug mode enabled and prepares the CPU for debug mode entry Now the processor can be stopped with the break command or any break condition Attach Connect to the processor without resetting target processor Use this command to connect to the processor without changing it s current state StandBy Debugging Tracing through power cycles The deb...
Page 33: ...re enable MSR_DE in the critical interrupt handlers After MSR_DE has been restored it is safe to use breakpoints SYStem Option CoreStandBy On the fly breakpoint setup On multi core processors only one of the cores starts to execute code right after reset The other cores remain in reset or disabled state In this state it is not possible to set breakpoints or configure the core for tracing This opti...
Page 34: ...a cache Default ON If enabled Data dump windows for access class D data and variable windows display the memory values from the d cache or L2 cache if valid If data is not available in cache physical memory will be read SYStem Option DUALPORT Implicitly use run time memory access Forces all list dump and view windows to use the access class E e g Data dump E 0x100 or to use the format option E e g...
Page 35: ...g the target program Step or Go If this option is disabled the debugger will update Memory and instruction cache for program memory downloads modifications and breakpoints Disabling this option might cause performance decrease on memory accesses Format SYStem Option FREEZE ON OFF NOTE MPC85XX with PVR 0x8020XXXX For the MPC85XX CPU family the debugger needs to execute a RFCI instruction out of mem...
Page 36: ...le step the interrupt mask bits are restored to the value before the step SYStem Option IMASKHLL Disable interrupts while HLL single stepping Default OFF If enabled the interrupt mask bits of the cpu will be set during HLL single step operations The interrupt routine is not executed during single step operations After single step the interrupt mask bits are restored to the value before the step Fo...
Page 37: ...em Option MMUspaces ON OFF deprecated SYStem Option MMU ON OFF deprecated NOTE SYStem Option MMUSPACES should not be set to ON if only one translation table is used on the target If a debug session requires space IDs you must observe the following sequence of steps 1 Activate SYStem Option MMUSPACES 2 Load the symbols with Data LOAD Otherwise the internal symbol database of TRACE32 may become inco...
Page 38: ...tion Defines which instruction is used as software breakpoint instruction Format SYStem Option NOTRAP type type OFF FPU ILL ON deprecated same as FPU OFF Use TRAP instructions as software breakpoint default setting Software breakpoint will overwrite SRR0 1 registers FPU Use an FPU instruction as software breakpoint Gives the ability to use the program interrupt in the application without halting f...
Page 39: ...a 16 bit virtual overlay ID Addresses therefore have the format overlay_id address This enables the debugger to handle overlaid program memory OFF Disables support for code overlays WithOVS Like option ON but also enables support for software breakpoints This means that TRACE32 writes software breakpoint opcodes to both the execution area for active overlays and the storage area This way it is pos...
Page 40: ...SET can be determined via JTAG_RESET If this system option is enabled the debugger will not read JTAG_RESET but instead waits up to 4 s and then assumes that the boards RESET is released SYStem Option STEPSOFT Use alternative method for ASM single step This method uses software breakpoints to perform an assembler single step instead of the processor s built in single step feature Works only for so...
Page 41: ...Us servicing watchdog If the debugger is servicing the watchdog conditions might occur where the watchdog times out before the debugger is able to service it Unintended resets or interrupts can occur Further SWT window mode is not supported by the debugger ...
Page 42: ...eTable task_magic task_id task_name space_id 0x0 cpu_specific_tables root The root argument can be used to specify a page table base address deviating from the default page table base address This allows to display a page table located anywhere in memory range address Limit the address range displayed to either an address range or to addresses larger or equal to address For most table types the ar...
Page 43: ...k_name space_id 0x0 Displays the MMU translation table entries of the given process Specify one of the TaskPageTable arguments to choose the process you want In MMU based operating systems each process uses its own MMU translation table This command reads the table of the specified process and displays its table entries For information about the first three parameters see What to know about the Ta...
Page 44: ...t MMU List table range address range root address root MMU table List deprecated table PageTable KernelPageTable TaskPageTable task_magic task_id task_name space_id 0x0 root The root argument can be used to specify a page table base address deviating from the default page table base address This allows to display a page table located anywhere in memory range address Limit the address range display...
Page 45: ..._id task_name space_id 0x0 Lists the MMU translation of the given process Specify one of the TaskPageTable arguments to choose the process you want In MMU based operating systems each process uses its own MMU translation table This command reads the table of the specified process and lists its address translation For information about the first three parameters see What to know about the Task Para...
Page 46: ...nto the debugger internal static translation table if range or address have a space ID loads the translation table of the specified process else this command loads the table the CPU currently uses for MMU translation KernelPageTable Loads the MMU translation table of the kernel If specified with the MMU FORMAT command this command reads the table of the kernel and copies its address translation in...
Page 47: ...om the CPU to the debugger internal translation table Formats MMU Set TLB0 index mas1 mas2 mas3 mas7 MMU Set TLB1 index mas1 mas2 mas3 mas7 MMU table SET deprecated index TLB entry index From 0 to number of TLB entries 1 of the specified TLB table mas1 mas2 mas3 mas7 Values corresponding to the values that would be written to the MAS registers in order to set a TLB entry See the processor s refere...
Page 48: ...reeze counters while core halted Enable this setting to prevent that actions of the debugger have influence on the performance counter As this feature software controlled no on chip feature some events especially clock cycle measurements may be counted inaccurate even if this setting is set ON BMC counter FREEZE Freeze counter in certain core states Halts the selected performance counter if one or...
Page 49: ...ch GmbH BMC counter SIZE No function Since only one counter size is possible this command is only available for compatibility reasons MASKSET Counter frozen if MSR PMM 1 MASKCLEAR Counter frozen if MSR PMM 0 Format BMC counter SIZE size ...
Page 50: ...use command TrOnchip ENable Per default NEXUS register control is enabled Format TrOnchip CONVert ON OFF ON default After a data address breakpoint is set to an address range all on chip breakpoints are spent As soon as a new data address breakpoint is set the data address breakpoint to the address range is converted to a single data address breakpoint Please be aware that the breakpoint is still ...
Page 51: ...egister control by the debugger By default NEXUS register control is enabled This command is only needed after disabling NEXUS register control using TrOnchip DISable TrOnchip RESet Reset on chip trigger settings Resets the on chip trigger system to the default state Format TrOnchip ENable Format TrOnchip RESet ...
Page 52: ...terrupt Break on machine check interrupt Break on data storage interrupt Break on instruction storage interrupt Break on external input interrupt Break on alignment interrupt Break on program interrupt Break on fpu unavailable interrupt Break on system call Break on auxiliary processor unavailable interrupt Break on decrementer interrupt Break on fixed interval timer interrupt Break on watchdog in...
Page 53: ...kpoint to the HLL variable is converted to a single data address breakpoint Please be aware that the breakpoint is still listed as a range breakpoint in the Break List window Use the Data View command to verify the set data address breakpoints OFF An error message is displayed when the user wants to set a new data address breakpoint after all on chip breakpoints are spent by a data address breakpo...
Page 54: ...PQIII Debugger 54 1989 2021Lauterbach GmbH TrOnchip state View on chip trigger setup window Display the trigger setup dialog window Format TrOnchip state ...
Page 55: ... for both comparison buffer control and buffer data capture The availability of certain interface options depends on the target processor Please check the processor user s manual for which interfaces are available Format Onchip Mode IFSel interface interface ECM processor core interface SDRAM SDRAM interface PCI PCI2 PCI controller interface RI0 RapidI0 interface PCIEX PCIEX2 PCIEX3 PCI Express in...
Page 56: ...o rows of eight pins connector pin to pin spacing 0 100 in Signals in brackets are not strong necessary for basic debugging but its recommended to take in consideration for future designs Signal Pin Pin Signal TDO 1 2 N C TDI 3 4 TRST RUNSTOP 5 6 JTAG VREF TCK 7 8 CHKSTPIN TMS 9 10 N C SRESET 11 12 GND HRESET 13 14 N C KEY PIN CKSTOPOUT 15 16 GND ...
