Home

70632 Emulator Terminal Interface

Contents

1. 000 2 6 Becoming Familiar with the System Prompts 2 7 Initializing the Emulator 2 2 2 0000 2 8 Other Types of Initialization 0 2 9 Using The Default Emulation Configuration 2 9 Loading Firmware Sample Programs 2 10 Mapping Memory 0 000 ee eee 2 10 Loading the Sample Program into Emulation Memory 2 14 Displaying Memory In Mnemonic Format 2 16 Contents 1 2 Contents Stepping Through the Program 0 2 17 Displaying Registers 2 0 00 00004 2 18 Combining Commands 2 18 Using Macros tsi 6 5 hs ao oe hae ke an 2a eS 2 19 Command Recall 0 2 0 0000 2 19 Repeating Commands 20000 2 19 Command Line Editing 0 2 21 Modifying Memory 0 0000 eee 2 21 Specifying the Access and Display Modes 2 21 Searching Memory for Data 2 22 Breaking into the Monitor 4 2 23 Using Software Breakpoints 0 04 2 23 Displaying and Modifying the Break Conditions 2 24 Defining a Software Breakpoint 2 24 Using the Analyzer 2 2 ee ee eee 2 26 Predefined Trace Labels 04 2 26 Predefined Status Equates 002 2 26 Specifying a Simple Trigger 4 2 27 Trigger Position 2 ee 2 29
2. Organization Chapter 1 Chapter 2 Chapter 3 Chapter 4 Chapter 5 Appendix A Appendix B Introduction This chapter lists the 70632 emulator features and describes how they can help you in developing new hardware and software Getting Started This chapter shows you how to use emulation commands by executing them on a sample program The chapter describes the sample program and how to load programs into the emulator map memory display and modify memory display registers step through programs run programs set software breakpoints search memory for data and use the analyzer Virtual Mode Emulation Topics This chapter shows you how to use emulator in virtual mode The chapter describes a sample program and how to load programs into the emulator display on chip MMU registers privilege registers and TCB set software breakpoints and use the analyzer in virtual mode Using the Emulator This chapter describes emulation topics that are not covered in the Getting Started and Virtual Mode Emulation Topics chapters for example coordinated measurements and storing memory In Circuit Emulation This chapter shows you how to plug the emulator into a target system and how to use the in circuit emulation features 70632 Emulator Specific Command Syntax This appendic describes the command syntax which is specific to the 70632 emulator Included are emulator configuration items address syntax display a
3. Message Task A Task A Stack Area Task A Instruction Task A Memory Space for Task A Destination Common Message Task Task B B Message Task Task A A Stack Area Task B Stack Area Task A Instruction Task B Instruction Task A Actual 2008c B80 2808b B80 2008 aBB2 280029080 20088 040 28007 B80 28026 B20 Memory Space Figure 3 4 Mapping of the Tasks 3 12 Virtual Mode Emulation Topics Sample Prog ram Figure 3 5 shows the flow of the sample program Flow 1 The initialization of the operating system is executed and the execution is switched to Task A 2 Task A reads the characters from address Message_A and writes to address Message_Dest 3 When the trap instruction of Task A is executed the execution of Task A is stopped and the task dispatcher of the operating system stores environment of Task A and loads the Task B s one 4 The execution of the operating system is exited then the execution is switched to Task B Task B reads the characters from address Message_B and writes to address Message_Dest 5 After the transfer the execution is returned to the operating system by the trap instruction of Task B 6 Task A is executed via the operating system again The next instruction which has made abort to the operating system restarts the execution from address Transfer_A T
4. gt r lt VIR_ADDR gt ev Function The lt ADDRESS gt parameter used in emulation commands may be specified as a virtual address or as a real address You can specify the address as real or virtual by adding a suffix r or v If neither suffix is specified the address is interpreted in the manner described in below lt REAL_ADDR gt This expression with r suffix is a real actual address in the 70632 address range 0 through OffffffffH The following emulation commands never accept real addresses completely ate pte The following emulation commands never accept real addresses when the emulator is in virtual mode r rx s lt VIR_ADDR gt This expression with v suffix is a virtual address in the 70632 address range 0 through OffffffffH When you specify the address in virtual address the emulator refers to corresponded address translation tables in order to translate virtual address to real actual address In multiple virtual space may be there are plural real addresses equivalent to specified virtual address The emulator uses one of the virtual space to determine a real address which corresponds to the specified virtual address By default the emulator uses the current address space which is specified by the contents of the area table register pairs of the 70632 Emulator Specific Command Syntax A 5 microprocessor to translate virtual address to real address The details
5. FI RK 4 1 0000a000 T FO KK 2 0000a001 H BKK 3 0000a002 1 KK 4 0000a003 S FO KK 5 0000a004 baton FI KK 6 0000a005 I kkk kkk kkk 7 Q000a006 S FI KK 8 0000a007 See ee a 9 0000a008 eae KKK KKK KKK LO 0000a009 A kkk kkk kkk 11 0000a00a S KK KK 12 0000a00b K kkk kkk kkk L3 OO000a00c KOK KK l4 0000a00d A kkk kkk kkk 15 0000a00e ee ed 16 0000a00f M kkk kkk kkk 17 0000a010 E Kk KK KKK 18 0000a011 S FO KK 19 0000a012 Power KOK KK 20 0000a013 A Se ee ee a 21 0000a014 G kkkkkk k 22 0000a015 E kkk kkk kkk 29 0000a016 FO KK 24 0000a017 ATA HK RK Ke The trace listing shows that the processor reads characters to transfer the message of Task A To view the continuation of the trace listing type U gt t1 Line addr H data A count R seq 25 0000a000 T BK 26 0000a001 H kkkkkkk 27 0000a002 alee KOK KK 28 0000a003 S FORK KK 29 0000a004 IE i kkk kkk kkk 30 0000a005 1 kkkkkkk 31 00004006 S kkk kkk kkk 32 0000a007 kkkkkkk 33 0000a008 T FO KK 34 0000a009 A FI KK 35 0000a00a _ S OK KK 36 O0000a00b K FO KK 37 O0000a00c KKK KK 38 0000a00d A kkk ee kkk 39 0000a00e KOK KK 40 0000a00f M BK 41 0000a010 E KKK RRR RK 42 0000a011 S FO IK 43 0000a012 IG ha KKK RRR KEK 44 0000a013 A FI KK 45 0000a014 eee KKK RR KK RK 46 0000a015 E ee kkk 47 0000a016 FI KK 48 0000a017 ae KKK KKK KEK 49 0000a000 T FI KK Virtual
6. Figure 5 1 Installing Emulation Probe Into PGA Socket 5 4 In Circuit Emulation Topics Installing the Target System Probe 1 Remove the 70632 microprocessor from the target system socket Note the location of pin on the processor and on the target system socket 2 Store the microprocessor in a protected environment such as antistatic foam 3 Install the target system probe into the target system microprocessor socket Remember to use the pin protector In Circuit The 70632 emulator provides configuration options for the followin P g p g Configuration in circuit emulation issues Refer to the CONFIG_ITEM section in Options the 70632 Emulator Specific Command Syntax appendix Selecting the Emulator Clock Source The default emulator configuration selects the internal 20 MHz clock as the emulator clock source You can configure the emulator to select an external target system clock source in the range of 8 20 MHz The configuration item is clk Driving Background Cycles to the Target System You can choose whether emulator bus cycles are driven to your target system bus when the emulator is in background cycle If your target system requires bus cycle activities constantly such as BCYST will need to drive the emulation bus cycles to your target system bus By default no bus cycles are driven to the target system in background operation The configuration item is dbc Selecting Memory Block during Background Cy
7. HP 64758 70632 Emulator Terminal Interface User s Guide L HEWLETT PACKARD HP Part No 64758 97004 Printed in U S A March 1993 Edition 2 Notice Hewlett Packard makes no warranty of any kind with regard to this material including but not limited to the implied warranties of merchantability and fitness for a particular purpose Hewlett Packard shall not be liable for errors contained herein or for incidental or consequential damages in connection with the furnishing performance or use of this material Hewlett Packard assumes no responsibility for the use or reliability of its software on equipment that is not furnished by Hewlett Packard Copyright 1990 1993 Hewlett Packard Company This document contains proprietary information which is protected by copyright All rights are reserved No part of this document may be photocopied reproduced or translated to another language without the prior written consent of Hewlett Packard Company The information contained in this document is subject to change without notice HP is a trademark of Hewlett Packard Comapny UNIX is a registered trademark of UNIX System Laboratories Inc in the U S A and other countries V70 is trademark of NEC Electronics Inc Hewlett Packard Company P O Box 2197 1900 Garden of the Gods Road Colorado Springs CO 80901 2197 U S A RESTRICTED RIGHTS LEGEND Use duplication or disclosure by the U S A Government is s
8. When tbf is set to dis the emulator ignores BFREZ signal input from target system Enable disable user INT This configuration item allows you to specify whether user INT is accepted or ignored by the emulator If en is selected the emulator accepts user INT If dis is selected the emulator ignores user INT When ti is set to dis the emulator ignores user INT input Enable disable user NMI This configuration item allows you to specify whether user NMI is accepted or ignored by the emulator If en is selected the emulator accepts user NMI if dis is selected ignores user NMI When ti is set to dis the emulator ignores user NMI input Allow analyzer to trace bus hold sequence This configuration item allows you to specify whether analyzer traces microprocessor generated bus hold sequence If you configure to trace bus hold cycles the analyzer capture a hold status state when bus hold request HLDRQ is acknowledged by the CPU If en is selected the analyzer traces bus hold cycles If dis is selected the analyzer traces no bus hold cycles If you wish to exclude bus hold cycles from trace listings you can set trh to dis and execute the t command Executed Instruction Address Trace Selection Bus states show actual processor bus activity Exe states indicate the address of the first byte of an executed opcode Only the address and processor status channels are valid during these states If en is selected both exe
9. r6 00000000 r11 00000000 r16 00000000 r21 00000000 r26 00000020 r31 00030134 CMP B psw 10000001 r1 00030004 r6 00000000 r11 00000000 r16 00000000 r21 00000000 r26 00000020 r31 00030134 sycw 00000070 r2 00000000 r7 00000000 r12 00000000 r17 00000000 r22 00000000 r27 00000000 ap 04420010 sycw 00000070 r2 00000000 r7 00000000 r12 00000000 r17 00000000 r22 00000000 r27 00000000 ap 04420010 sycw 00000070 r2 00000000 r7 00000000 r12 00000000 r17 00000000 r22 00000000 r27 00000000 ap 04420010 sycw 00000070 r2 00000000 r7 00000000 r12 00000000 r17 00000000 r22 00000000 r27 00000000 ap 04420010 RO 0H R2 20H R26 r3 00000000 r8 00000000 r13 00000000 r18 00000000 r23 00000000 r28 00000000 fp 00000000 0H RO r3 00000000 r8 00000000 r13 00000000 r18 00000000 r23 00000000 r28 00000000 fp 00000000 R2 r3 00000000 r8 00000000 r13 00000000 r18 00000000 r23 00000000 r28 00000000 fp 00000000 r3 00000000 r8 00000000 r13 00000000 r18 00000000 r23 00000000 r28 00000000 fp 00000000 r4 00000000 r9 00000000 r14 00000000 r19 00000000 r24 00000000 r29 04420010 sp 00030134 r4 00000000 r9 00000000 r14 00000000 r19 00000000 r24 00000000 r29 04420010 sp 00030134 r4 00000000 r9 00000000 r14 00000000 r19 00000000 r24 00000000 r29 04420010 sp 00030134 r4 00000000 r9 00000000 r14 00000000 r19 00000000 r24 00000000 r29 04420010 sp 00030134 Command Line T
10. triggering analyzer 4 4 INT signal during monitor cycles 5 9 from target system A 12 Intel hexadecimal files downloading 2 15 interface probe 5 14 interrupt during monitor cycles 5 9 INT 5 9 NMI 5 9 interrupt INT from target system A 12 interrupt NMI from target system A 12 interrupt handler foreground monitor B 3 B 4 inverse assembler selecting A 9 labels trace predefined 2 26 linking foreground monitor B 9 loa emulator configuration A 13 load load absolute file command 2 14 load address mode A 13 loading firmware sample program 2 10 Index 7 8 Index loading foreground monitor B 9 local bus masters target system accesses of emulation memory 2 11 locating the foreground monitor A 10 location of foreground monitor B 3 B 8 lower byte accesses 2 27 m memory display modification command 2 16 2 21 macros after initialization 2 8 using 2 19 map memory mapper command 2 12 mapping memory 2 10 memory displaying in mnemonic format 2 16 emulation mode 4 21 memory characterization 2 11 memory inverse assembler selecting A 9 memory map after initialization 2 8 memory emulation access by target system 2 11 memory mapping 2 10 mil emulator configuration A 9 MMU 1 4 4 18 mmu register displaying 3 18 mnemonic trace listing 4 5 mo mode command 2 17 2 22 modifying T O 5 10 stack pointer 4 2 modifying ROMed code 5 8 mon emulator configurat
11. 2 27 TRIGGER CMB signal 4 19 trigger condition instruction execution 4 4 trigger position 2 29 trom memory characterization 2 12 ts trace status command 2 27 tsto command 3 30 using the default emulation configuration 2 9 using the emulator 4 1 ver command 2 10 virtual address tracing 3 25 A 13 virtual address translation 4 23 virtual mode emulation 3 1 virtual space specifying 3 22 4 24 wait state target ready signal 5 7 waiting for ready 4 19 warm start initialization 2 8 x execute command 4 19 xmmu function 3 22 4 23 trace 3 28 xmmu registers 3 22 Index 13 Notes 14 Index
12. If your program performs in multiple virtual space you may want to specify a virtual address space for address translations in order to watch for the execution of a certain task This is accomplished by using the XMMU function The XMMU function allows you to fix a virtual address space for address translations The emulator has the optional XMMU class registers These registers consist of eight XMMU register pairs and one XMMU mode register The XMMU register pairs correspond to the actual 70632 area table register pairs You can specify a virtual address space by modifying the XMMU class registers The format of the XMMU class registers is the same as the 70632 actual area table register pairs The XMMU class registers also include the XMMU mode register mmumod which determines whether the caches or the contents of the XMM U register pairs are used for address translations By default the caches are selected If you activate the XMMU function the emulator uses the contents of the XMMU register pairs for address translations whether or not the emulator is restricted to real time runs The XMMU class registers consist of the following registers corresponded actual registers atbr0 atlro atbrl atlirl atbr2 atlr2 atbr3 atlr3 None To specify a virtual address space which is used for address translations modify the contents of the XMMU register pairs corresponded to the area table registers by using the reg register
13. bsp tee hve hos aha NW tee 8a haw Be ae ne a 4 21 Tracing States In Both Mode 4 21 Real time Emulation Memory Access 4 22 Virtual Address Translation 044 4 23 Using the Caches of Area Table Register Pairs 4 23 Contents 3 4 Contents Specifying Virtual Address Space 4 24 Restrictionas and Considerations 00 4 26 In Circuit Emulation Topics ntr duction e Jette Sipe AS Be ee Ba bet Shy 5 1 Prerequisites 23 930 en ee I ie a eee ae re sd 5 2 Installing the Emulator Probe into a Target System 5 2 Pin Protectors eio i hoe ee ae Goel ee ee A 5 3 Conductive PinGuard 20000 5 3 Installing the Target System Probe 5 5 In Circuit Configuration Options 5 5 Allowing the Target System to Insert Wait States 5 7 Target ROM Debug Topics 0 0004 5 7 Using Software Breakpoints with ROMed Code 5 8 Coverage Testing ROMed Code 5 8 Modifying ROMed Code 2 04 5 8 User Interrupts ssc gs oe uersa ee ek S 5 9 DMA Operation 2 2 2 0 ee ee ee ee 5 10 The Usage of I O Command 5 10 FRM Function 2 2 2 2 0 0 eee ee ee ee 5 11 Pin State on Emulation Probe 04 5 12 Target system Interface 2 0 2 2 00 4 5 14 70632 Emulator Specific Command Symtax ACCESS MODE is g se
14. egisters l view the contents of the registers M gt reg The resulting display will be similar to the following reg pc 00010007 psw 10000000 sycw 00000070 reg r0 000000ff r1 00000000 r2 00000000 r3 00000000 r4 00000000 reg r5 00000000 r6 00000000 r7 00000000 r8 00000000 r9 00000000 reg r10 00000000 r11 00000000 r12 00000000 r13 00000000 r14 00000000 reg r15 00000000 r16 00000000 r17 00000000 r18 00000000 r19 00000000 reg r20 00000000 r21 00000000 r22 00000000 r23 00000000 r24 00000000 reg r25 00004040 r26 00000000 r27 00000000 r28 00000000 r29 04420010 reg r30 00000000 r31 00030134 ap 04420010 fp 00000000 sp 00030134 Combining More than one command may be entered in a single command line if Commands the commands are separated by semicolons For example you could execute the next instruction s and display the registers by entering the following M gt s reg 000010007 r MOVEA W 00030000H RO PC 00001000e r reg pc 0001000e psw 10000000 sycw 00000070 reg 10 00030000 r1 00000000 r2 00000000 r3 00000000 r4 00000000 reg xr5 00000000 r6 00000000 xr7 00000000 r8 00000000 r9 00000000 reg xr10 00000000 r11 00000000 xr12 00000000 r13 00000000 xr14 00000000 reg xr15 00000000 r16 00000000 xr17 00000000 r18 00000000 xr19 00000000 reg x20 00000000 r21 00000000 xr22 00000000 r23 00000000 xr24 00000000 reg x25 00004040 r26 00000000 xr27 00000000 r28 00000000 r29 04420010 reg x30 00000000 r31 00030134 ap 04420010 fp 00000000 sp 00030134 2 18 Gettin
15. guarded memory The emulator generates an error message when accesses are made to guarded memory locations additionally you can configure the emulator so that writes to memory defined as ROM cause emulator execution to break out of target program execution You can select whether the memory accesses honor READY and BERR signals from target system for each emulation memory range Introduction 1 3 Analysis FPU MMU FRM Registers Single Step 1 4 Introduction The integrated emulation bus analyzer provides real time analysis of all bus cycle activity You can define break conditions based on address and data bus cycle activity In addition to hardware break software breakpoints can be used for execution breakpoints The 70632 microprocessor has on chip MMU which provides a 4 Giga byte virtual space for each task When you use the on chip MMU you will want to analyze either actual or virtual address space You can configure which address space should be recognized by the emulation analyzer Analysis functions include trigger storage count and context directives The analyzer can capture up to 1024 events including all address data and status lines The emulation bus analyzer can capture bus states accessing to a Floating Point Processor The emulator will support development when using the internal Memory Management Unit The emulator supports the master mode of the 70632 FRM function In the master mode you can
16. the READY signal is internally pulled up When you encounter the prompt w gt the emulator cannot break into monitor All you can do is to reset the processor If you are using the emulator in in circuit mode the reason is that the emulator intends to access to a memory location for which your target system does not generate ready signal If you are using the emulator in out of circuit mode the reason is that the emulator intends to access to a target memory location by your program To prevent this all of memory locations which are not used should be mapped as guarded memory When you direct the emulator to access a target memory location the emulator will return an error message The prompt h gt indicates that the emulator is halted or in machine fault In case of machine fault all you can do will be to reset the processor because the emulator cannot break into monitor One of the causes is the exception by a address translation failure In this case one of the solution is to use the analyzer The analyzer will capture states which causes the emulator to halt Refer to the Finding out the Cause of a Monitor Break description of the Analyzer Topics section in this chapter for the analyzer configuration 70108 70116 The 70632 microprocessor has the 70108 70116 emulation mode In this mode the 70632 executes instructions as 70108 70116 Emulation Mode microprocessor s ones The emulator provides the followin
17. the current default display mode is not changed Emulator Specific Command Syntax A 15 Long Float Memory is displayed in a long float format and when memory locations are modified long floats are changed When this display mode used the current default display mode is not changed Mnemonic Memory is displayed in mnemonic format that is the contents of memory locations are inverse assembled into mnemonics and operands When memory locations are modified the last non mnemonic display mode specification except for s and l is used You cannot specify this display mode in the ser search memory for data command Defaults The lt DISPLAY_MODE gt is b at power up initialization Display mode specifications are saved that is when a command changes the display mode the new display mode becomes the current default Related Commands mo specify access and display modes m memory display modify io I O display modify ser search memory for data A 16 Emulator Specific Command Syntax REGISTER CLASS and NAME Summary 70632 register designators All available register class names and register names are listed below lt REG_CLASS gt lt REG_NAME gt Description All basic registers pc psw sycw All basic registers rO rl 1213 r4 The ap and r29 fp and r30 sp and r31 have same r5 r6 r7 r8 r9 values because of only difference of their register r10 r11 r12r13 mnemonics r14 r15 r16 r17 r18 r19 r20 r21 r22
18. 01E0C00104C061 FAE4 00 Dummy_Text 2D3AF420000000 2D38F417000000 588AF30020004098 F30030004020 F8F4A0 D6F2E1FFFFFF 2D3AF420000000 2D38F413000000 588AF30020004098 F30030004020 F8F4A0 D6F2E1FFFFFF 5448495320495320 5441534B2041204D 4553534147452E Message_A Setup_Task_0O Sys_Trap_0O Transfer_A Transfer_B ldtask mov w mov mov mov mov add dbr SSES ldtask retis align mov w mov w mul w mov w sttask inc w cmp w jnz XOr w mov w mul w ldtask retis halt text mov Ww mov w movcfu trap jmp text mov w mov Ww movcfu trap jmp bss Lcomm bss Lcomm data str b b Ater FEL Ox1l0 r1 r2 0 r2 8 rl r2 L2 Pl l 22 r2 4 r1 0x18 r1 r0 Setup_Task_0 TCB_Entry 4 TCB_Entry 4 4 Current_Task r0 r0 r2 0x6 r2 TCB_Entry r1 4 r1 r2 ro r0 Num_Of_Task Sys_Trap_0 r0 r0 r0 Current_Task 0x6 r0 4 r1 r0 r1 r0 4 text_a RW gt 0x00006000 ror 126 Message_A_End Message_A r24 0x40002000 r24 0x40003000 Dest_Size Oxad Transfer_A text_b RW gt 0x00007000 hee SEZ 6 Message_B_End Message_B r24 0x40002000 r24 0x40003000 Dest_Size Oxa0 Transfer_B stack_a RW gt 0x00008000 Stack_A Stack_Size 4 stack_b RW gt 0x00009000 Stack_B Stack_Size 4 data_a RW gt 0x0000a000 THIS IS TASK A MESSAGE Figure 3 1 Sample Program Listing Cont d
19. 0x0xxxxxxxxxx1l000y equ data Oxxxxxxxxxxxx0011ly equ datard 0x1xxxxxxxxxx001lly equ datawr 0x0xxxxxxxxxx001lly equ exe 0XXXXXXXXXXXX0000y equ fault 0xxxxxxxxxxxx1100y equ fetch 0x1xxxxxxxxxx011lxy equ fetchbr 0x1xxxxxxxxxx01llly equ grd O0xxxxxxxxxx0x0xxxy equ halt O0xxxxxxxxxxxx1101ly equ hold 0xxxxxxxxxxxx0001ly equ int 0xxxxxxxxxxxx1110y equ 10 0xxxxxxxxxxxxl01lly equ iord 0x1xxxxxxxxxx1l0lly equ iowr O0x0xxxxxxxxxx1l0l1lly equ lock Oxxxxxxxx0XxXxXxXXXxXy equ mon OxxxxxxxXxXxXXXOXXXXYy equ retry 0XXXXXXXXXXXXXXXY equ short 0xxxxxxxxxxxx0010y equ shortrd 0x1xxxxxxxxxx0010y equ shortwr 0x0xxxxxxxxxx0010y equ trans 0xxxxxxxxxxxx010ly equ transrd 0x1xxxxxxxxxx010ly equ transwr 0x0xxxxxxxxxx010ly equ wrrom 0x0xxxxxxx0xx0xxxy These equates may be used to specify values for the stat trace label when qualifying trace conditions For the description of these equates refer to the Analyzer Topics section of the Using the Emulator chapter 2 26 Getting Started Specifying a Simple The tg analyzer command is a simple way to specify a condition on Trigger which to trigger the analyzer Suppose you wish to trace the states of the program after the read of a B 42H command from the command input byte Enter the following commands to set up the trace run the program issue the trace and display the trace status Note that the analyzer is to search for a lowest byte read of 42H because the address is a multiple of four M gt tg
20. 4ffH The program area text section which contains the opcodes and operands which make up the sample program occupies locations 10000H through 1006dH The data area data section which contains the ASCII values of the messages the program transfers occupies locations 20000H through 20031H The destination area bss section which contains the command input byte and the locations of the message destination occupies locations 30000H through 30117H Since the program writes to the destination locations the mapper block of destination area should not be characterized as ROM memory Enter the following commands to map memory for the sample program R gt map 0 4ff erom R gt map 10000 1006c erom R gt map 20000 20031 erom R gt map 30000 30117 eram By default unmapped area attribute is defined as target RAM However when emulation without plugging the emulator into your target system unmapped area should be defined as guarded to detect the illegal accesses to the area R gt map other grd To confirm the memory map you ve just done R gt map remaining number of terms 4 remaining emulation memory 7b000h bytes map 000000000 000000fff r eram term 1 map 000010000 000010fff r erom term 2 map 000020000 000020fff r erom term 3 map 000030000 000030fff r eram term 4 map other grd As you can see the mapper rounded up the second term to 4 Kbytes blocks since those are minimum size blocks supported
21. 70632 area table entry for the address which you specify The virtual address space which is used for displaying area table entry depend on the contents of register mmumod and whether the emulator is restricted real time runs When the values which are equivalent to the area table register pairs are invalid or the corresponded area table entry is invalid or out of bounds error messages will be displayed The values mentioned above are defined by the contents of either caches or XMMU class registers Refer to the Virtual Address Translation section of chapter 4 Parameters i The i option allows you to specify the area table entry by using section ID and area ID lt ADDRESS gt Specifies the virtual address which belongs to the area based on the area table entry You cannot specify the address with real address by adding suffix r If you specify the address with no suffix the address is interpreted as virtual The only bits 20 to 31 of the lt ADDRESS gt are effective Emulator Specific Command Syntax A 19 Refer to the lt ADDRESS gt syntax pages in this chapter lt SECT_ID gt Specifies the ID number of the section which includes the area pointed by the area table entry lt SECT_ID gt is a hexadecimal value from 0 to 3 lt AREA_ID gt Specifies the ID number of the area pointed by the area table entry lt AREA_ID gt is a hexadecimal value from 0 to 3ff Note As noted in the syntax an address IDs followed by two
22. Fora Complete Description 2 30 Copying Memory 0 0002 ee eee eee 2 31 Testing for Coverage 2 2 000000 02 eae 2 31 Resetting the Emulator 2 04 2 33 Virtual Mode Emulation Topics InttoductlOn n 2453 42 oe ee Se ta ee eed EY BR 3 1 Sample Program for Virtual Mode Emulation 3 1 Multiple Virtual Space of the Sample Program 3 9 Sample Program Flow 00 0 3 13 Setting Up the Emulator 0 0 3 15 Using The Emulator In Virtual Mode 3 15 Address Mode suffixes 0 00 000 3 15 Setting Breakpoints in Real Address 3 17 Running the Sample Program 3 17 Displaying the CPU Address Mode 3 17 Which Breakpoint Has Hit 0 3 17 Displaying MMU Registers 004 3 18 Displaying Address Translation Tables 3 18 Continuing the Execution 00 3 19 Enabling Breakpoints in Virtual Address 3 20 Setting Breakpoints in Virtual Address 2 0 3 20 Display Privilege registers 4 3 21 Displaying TOB iads spss Poke c Seer aS ea 3 21 Using the XMMU Function 4 3 22 Displaying the XMMU Class Registers 3 23 Modifying the XMMU Class Registers 3 23 Using the Analyzer 2 ee ee ee 3 25 Using The Emulator TntroduchOn oie SR
23. Memory is mapped with the map command To view the memory mapping options enter R gt help map Getting Started 2 11 map display or modify the processor memory map map display the current map structure map lt addr gt lt addr gt lt type gt lt attrib gt define address range as memory type map other lt type gt map d lt term gt map d define all other ranges as memory type delete specified map term delete all map terms VALID lt type gt OPTIONS eram emulation ram erom emulation rom tram target ram trom target rom grd guarded memory VALID lt attrib gt OPTIONS lt none gt do not see READY and BERR signal during emulation memory cycles lock see READY BERR and RT EP signal during emulation memory cycles Enter the map command with no options to view the default map structure R gt map remaining number of terms 8 remaining emulation memory 7f 000h bytes map other tram 2 12 Getting Started If your emulator s model number is HP64758B the size of remaining emulation memory will be displayed Off000h bytes instead of 7 000h bytes Mapping the Appropriate Memory Location The sample program consists of four sections the system base table area named sbt the program area named text the data area named data the destination area named bss The sbt area which contains 70632 System Base Table occupies locations 0 through
24. Message_B Ste THIS IS MESSAGE B 4D45535341474520 42 D 00020022 494656414C494420 Invalid_Input str INVALID COMMAND 434F4D4D414E44 D 00020031 Message_End Figure 2 1 Sample Program Listing Getting Started 2 3 00030000 00030000 00030004 00030034 w w w w 2 4 Getting Started bss RW gt 0x00030000 lcomm Command_Input 4 4 lcomm Message_Dest Dest_Size 4 lcomm Stack Stack_Size 4 Figure 2 1 Sample Program Listing Cont d System Base Table The sbt section defines 70632 System Base Table containing the vectors for 70632 interrupts and exceptions The sample program defines BRK instruction vector pointing to an address in the text section This is requirement for emulation software breakpoints feature Refer to Using Software Breakpoints section in this chapter for details Data Declarations The data section defines the messages used by the program to respond to various command inputs These messages are labeled Message_A Message_B and Message_I The Destination Area The bss section declares memory storage for the command input byte Command_Input the destination area Message_Dest and the stack area Initialization The program instructions from the Init label to the Clear label perform initialization The stack pointer is set up and the addresses labeled Command_Input and Message_Dest are loaded into registers RO and R1 Register R26 is set up to 20H for filling remaining lo
25. Mode Emulation Topics 3 29 Emulation trace started 40000000 40002000 40002001 40002002 40002003 40002004 40002005 40002006 40002007 40002008 40002009 4000200a 4000200b 4000200c 4000200d 4000200e 4000200f 40002010 40002011 40002012 40002013 40002014 40002015 40002016 40002017 data A You will find the transfer of the Task A message is done continuously Contrary specify the address in virtual address U gt cf tra vir To set the trigger point at 40000000H U gt tg addr 40000000 To store only the accesses to the address range 40002000H through 400020 1fH U gt tsto addr 40002000 4000201f Start the trace by typing U gt t You will see To view the trace listing enter U gt tl count R seq KKKKKKKKK KKKKKKKKK KKKKKKKKK AAA HK aR KREKARAEAS KKKKKKKKK KKKKKKKKK KKKKKKKKK KKKKKKKKK KAKA H KA AK KKKKKKKKK KKKKKKKKK KKKKKKKKK kkkxkxkxkxkxkxx k KKKKKKKKK KKKKKKKKK KAKA AAAKA SE KKKKKKKKK KKKKKKKKK kk ek a a KKKKKKKKK KKKKKKKKK kkkxkxkxkxkxkxx k KKKKKKKKK KKKKKKKKK 3 30 Virtual Mode Emulation Topics ODINHDUTIABWNHERO 0002000 0002001 0002002 0002003 0002004 0002005 0002006 0002007 0002008 0002009 000200a 000200b 000200c 000200d 000200e 000200 0002010 0002011 0002012 0002013 0002000 0002001 0002002 0002003 0002004 data A To view the continuation of the trace listing type U gt tl count R seq KKKKKKKKK KKKKKKKKK KAKAEARA HX KKK
26. The current default display mode is used when you don t specify display mode with this option To view the current default display command type R gt mo mo ab dm Stepping Thro ug h The emulator allows you to execute one instruction or a number of instructions with the s step command Enter the help s to view the the Prog ram options available with the step command R gt help s s step emulation processor S step one from current PC s lt count gt step lt count gt from current PC s lt count gt step lt count gt from current PC s lt count gt lt addr gt step lt count gt from lt addr gt s q lt count gt lt addr gt step lt count gt from lt addr gt quiet mode S W lt count gt lt addr gt step lt count gt from lt addr gt whisper mode NOTES STEPCOUNT MUST BE SPECIFIED IF ADDRESS IS SPECIFIED If lt addr gt is not specified default is to step from current PC A lt count gt of 0 implies step forever A step count of 0 will cause the stepping to continue forever until some break condition such as write to ROM is encountered or until you enter lt CTRL gt c The following command will step from the first address of the sample program R gt s 1 10000 000010000 r MOV W 00030134 SP PC 000010007 r Getting Started 2 17 Displaying The step command shown above executed a R ist MOV W 00030118 SP instruction Enter the following command to
27. by modifying the XMMU class registers These registers are not actual registers of the 70632 processor 3 22 Virtual Mode Emulation Topics XMMU class registers xatbr0O xatlr0o xatbrl xatlirl xatbr2 xatlr2 xatbr3 xatlr3 mmumod Displaying the XMMU reg reg reg reg reg Class Registers mmumod 00000000 xatbr0 00000000 xat1lr0 00000000 xatbr2 00000000 xatlr2 00000000 When you set the contents of the XMMU class registers and activate the XMMU function the XMMU class registers are used for the address translation of the virtual address you specify in a command instead of the actual area table register pairs of the 70632 microprocessor The XMMU class registers consist of the following registers corresponded actual registers atbr0 atlro atbrl atiri atbr2 atlr2 atbr3 atlr3 None If you set the value of the mmumod register in the above table to 1 the emulator translates the virtual address in a command line with the contents of the XMMU class registers instead of the actual area table register pairs Oppositely if you want to make the emulator to translate the virtual address in a command line with the actual table register pairs in other words the virtual address in the current address space reset the value of the mmumod register to 0 Assuming that you want to note to the current task Task B Display the XMMU class registers by typing M gt reg xmmu xatbr1 00000000 xatlr1
28. by the 70632 emulator When mapping memory for your target system programs you may wish to characterize emulation memory locations containing programs and constants locations which should not be written to as ROM This will prevent programs and constants from being written over accidentally and will cause breaks when instructions or commands attempt to do so if the rom break condition is enabled Note g Software breakpoints should be removed before altering the memory map If they are NOT BRK instructions will be left at unknown locations Getting Started 2 13 Loading the Sample Program into Emulation Memory 2 14 Getting Started This section assumes you are using the emulator in one of three configurations 1 Connected only to a terminal which is called the standalone configuration In the standalone configuration you must modify memory to load the sample program 2 Connected between a terminal and a host computer which is called the transparent configuration In the transparent configuration you can load the sample program by downloading from the other port 3 Connected to a host computer and accessed via a terminal emulation program for example the terminal window of the PC Interface Configurations in which the emulator is connected to and accessed from a host computer are called remote configurations In the remote configuration you can load the sample program by downloading from the same port Stan
29. copy memory command gives you the ability to copy the contents of one range of memory to another This is a handy feature to test things like the relocatability of programs etc To test if the sample program is relocatable within the same segment enter the following command to copy the program to an unused but mapped area of emulation memory After the program is copied run it from its new start address to verify that the program is indeed relocatable U gt cp 10800 10000 1006d U gt cp 20800 20000 20031 U gt r 10800 U gt The prompt shows that the emulator is executing user code so it looks as if the program is relocatable You may want to issue a simple trace to verify that the program works while running from its new location U gt tg any U gt t Emulation trace started U gt tl Testi ng for For each 4 bytes of emulation memory there is an additional bit of Covera ge emulation RAM used by the emulator to provide coverage testing When the emulator is executing the target program and an access is made to a byte in emulation memory the corresponding bit of coverage memory is set With the cov command you can see which bytes in a range of emulation memory have or have not been accessed For example suppose you want to determine how extensive some test input is in exercising a program in other words how much of the program is covered by using the test input You can run the program with the test input and then us
30. eee k ok 20 0000c 85 MOVCFU B 40002000H R24 40003000H Ok Ak ek k 0000600e 20H Zl 0000a000 ffffff54 54H data read Kk Kk kK ok oe 22 0000a001 ffff48ff 48 H data read KAK kK ok ae 23 0000c000 00000054 3 54H data write KOK Kk Kk oe 24 0000a002 ff49ffff 49 H data read Kk Kk AK ok oe The trace list shows the execution from the read address 00006000H To trace from the virtual address 40000000H which is the entry of both Task A and Task B enter U gt cf tra vir U gt tg addr 40000000 U gt t The trace list will be stored from whether the entry of Task A or Task B View the trace list by typing U gt tl 0 24 3 26 Virtual Mode Emulation Topics 40000000 4000001f 40000004 40000008 4000000c 40000000 40000010 40000014 40000007 40000018 4000001c 40000020 40000024 40000028 00002010 00002014 00003208 00002010 00002014 0000320c 4000000e 40002000 40002001 40003000 40002002 40000000 4000001f 40000004 40000008 4000000c 40000000 40000010 40000014 40000007 40000018 4000001c 40000020 40000024 40000028 00002008 0000200c 00003108 00002008 0000200c 0000310c 4000000e 40002000 40002001 40003000 40002002 data H 20f43a2d 2d000000 2a000000 0013f438 8a580000 8a580000 002000 3 00 39840 20400030 20400030 d6a0f4f8 ffffelf2 OO0000fE 5750875d 00003203 00000300 0000be85 00003203 00000300 0000c 85 0000c 85 ffffff54 ffff61ff 00000054 FEVSEE
31. gt tcb 1 7 000000 tkcw ATT 7 OTM 0 FIT 0 FZT 0 FVT 0 FUT 0 FPT 0 RDI 0 RD 0 l10sp 40001ff4 r24 00000013 r25 00000000 r26 00000020 r27 40003020 r28 40002013 r29 00000000 r30 00000000 atrpl ATB 000002010 Limit 000 Growth positive Valid To display the TCB which is not current specify the base address of the TCB Enter M gt tcb 1 7 000000 1038 tkcw ATT 7 OTM 0 FIT 0 FZT 0 FVT 0 FUT 0 FPT 0 RDI 0 RD 0 10sp 40001ff4 r24 00000017 r25 00000000 r26 00000020 r27 40003020 r28 40002017 r29 00000000 r30 00000000 atrpl ATB 000002008 Limit 000 Growth positive Valid Using the XMMU As described in the previous section the emulator uses the current A value of the 70632 address table register pairs by default when you Function specify an address in virtual address in a command Suppose that you would like to debug a certain task executed in multiple virtual space without stopping the execution You will be unable to specify the virtual address in desired virtual space because the address space is dynamically changed The XMMU function provides you to specify a desired virtual address space Regardless of the current virtual space you can specify the address space you want to note to The emulator has the optional XMM U class registers These registers consist of eight XMMU register pairs and one XMMU mode register The XMMU register pairs correspond to the actual 70632 area table register pairs You can specify a virtual address space
32. in this chapter you must have completed the following tasks 1 Completed hardware installation of the HP 64700 emulator in the configuration you intend to use for your work Standalone configuration Transparent configuration Remoto configuration Local Area Network configuration Reference HP 64700 Series Installation Service manual 2 If you are using the Remote configuration you must have completed installation and configuration of a terminal emulator program which will allow your host to act as a terminal xonnected to the emulator In addition you must start the termunal emulator program before you can work thr examples in this chapter 3 If you have properly completed step 1 above you should be able to hit lt RETURN gt or lt ENTER gt on some keyboards and get one of the following command prompts on your terminal screen U gt R gt M gt If you do not see one of these command prompts retrace your steps through the hardware installation procedure outlined in the manual referenced above verifying all connections and procedural steps In any case you must have a command prompt on your terminal screen before proceeding with the tutorial A Look at the Sam ple The sample program used in this chapter is listed in figure 2 1 The Program program emulates a primitive command interpreter 2 2 Getting Started cmd_rds s D 00000000 file emd tds s D 0000000
33. is 4 byte U gt m 30000 42 U gt cov a 10000 1006c 20000 20030 coverage list list of address ranges accessed 000010000 00001006c r 000020000 000020023 r percentage of memory accessed 91 7 The address range 10000H through 1006cH contains all instructions in the sample program Although you have never enter the invalid command C the report shows that all instructions including the instructions for the invalid command process have been accessed This 2 32 Getting Started reason is because the 70632 microprocessor prefetched the instructions for the invalid command Note this when you use the coverage tester for the purpose of measuring memory locations of instructions executed U gt m 30000 43 U gt cov a 10000 1006c 20000 20030 coverage list list of address ranges accessed 000010000 00001006c r 000020000 000020030 r percentage of memory accessed 100 0 Re setting the To reset the emulator enter the following command Emulator U gt rst R gt The emulator is held in a reset state suspended until a b break r run or s step command is entered A CMB execute signal will also cause the emulator to run if reset The m option to the rst command specifies that the emulator begin executing in the monitor after reset instead of remaining in the suspended state R gt rst m M gt Getting Started 2 33 Notes 2 34 Getting Started Virtual Mode Emulation Topics Intr
34. map When addresses are specified with no suffix in the above command the addresses are interpreted as real whether or not the current address mode is virtual or real r rx Ss When addresses are specified with no suffix in the above command the addresses are interpreted with the current address mode Emulator Specific Command Syntax A 7 CONFIG_ITEMS Summary 70632 emulator configuration items Syntax ea A 8 Emulator Specific Command Syntax Bi 3 is J int ext lt ADDRESS gt dbc bbk i Sem gt lt ADDRESS gt Function The lt CONFIG_ITEMS gt are the 70632 specific configuration items which can be displayed modified using the ef emulator configuration Parameters command If the Wow portion of the syntax is not used the current value of the configuration item is displayed clk rrt mil Clock Source This configuration item allows you to specify whether the emulator clock source is to be internal int provided by the emulator or external ext provided by the target system The internal clock speed is 20 MHz system clock The emulator will operate at external clock speed from 8 20 MHz entered clock or crystal frequency connected Restrict to Real Time Runs This configuration item allows you to specify whether program execution should take place in real time or whethe
35. may pose serious problems for complex applications that rely on the microprocessor for real time Using the Foreground Monitor B 1 Foreground Monitors Foreground Monitor Selection Using Built in Foreground monitor non intrusive support Also the background monitor code resides in emulator firmware and can t be modified to handle special conditions A foreground monitor may be required for more complex debugging and integration applications A foreground monitor is a block of code that runs in the same memory space as your program You link this monitor with your code so that when control is passed to your program the emulator can still service real time events such as interrupts or watchdog timers For most multitasking interrupt intensive applications you will need to use a foreground monitor You can tailor the foreground monitor to meet your needs such as servicing target system interrupts However the foreground monitor does use part of the processor s address space which may cause problems in some target systems You must also properly configure the emulator to use a foreground monitor The HP 64758 emulator provides two kinds of foreground monitor One is included in the emulator the other is provided with assembler source file The foreground monitor included in the emulator allows you to use the foreground monitor quickly When you use this built in foreground monitor you do not have to assemble li
36. microprocessor Always high impedance otherwise you direct the emulator to access target memory When accessing target memory by background monitor same as 70632 microprocessor Same as 70632 microprocessor except for emulation memory access When accessing emulation memory high impedance Always high impedance otherwise you direct the emulator to access target memory When accessing HLDAK R W Others Foreground Background Foreground Background cf dbc en Background cf dbc dis target memory by background monitor same as 70632 microprocessor Same as 70632 microprocessor Always high Same as 70632 microprocessor except for emulation memory write When accessing emulation memory high Same as 70632 microprocessor Same as 70632 microprocessor Always high impedance otherwise you direct the emulator to access target memory When accessing target memory by background monitor same as 70632 microprocessor In Circuit Emulation Topics 5 13 Target system Interface AO thru A7 5V 10kQ PO 74FCT373A A8 thru A31 1 kQ AB 3 1 DO thru D31 5V 1 kQ D 31 5 14 In Circuit Emulation Topics These signals are connected to 74FCT373A and 10 Kohm pull up resistor These signals are connected to both of 74FCT373A and 74FCT374A and 10 Kohm pull up resistor If you enable the emulator to drive the background cycles to target system cf dbc en the sig
37. of the address translation are shown in chapter 4 The following emulation commands never accept virtual addresses completely cim cov map The following emulation commands never accept virtual addresses when the emulator is in real mode r rx Ss lt ADDR gt This expression with no suffix is interpreted as either real or virtual by the emulator The address mode which is required to interpret the address expression with no suffix is determined as follows with a few exceptions 1 When the processor is reset the expression is evaluated as the real address 2 When the processor never runs in virtual mode after reset the expression is evaluated as the real address 3 Once the processor has run in virtual mode after reset the expression is evaluated as the virtual address Note Although the processor is running in real mode the address expression which has no suffix is recognized as the virtual address if the processor has ever run in virtual mode since the processor was reset For each address mode see the description of lt REAL_ADDR gt or lt VIR_ADDR gt mentioned above There are exceptions to this rule when the address expression with no suffix is specified in the following commands ate pte When addresses are specified with no suffix in the above command the addresses are interpreted as virtual whether or not the current address mode is virtual or real A 6 Emulator Specific Command Syntax cim cov
38. r23 r24 r25 r26 r27 r28 r29 r30 r31 ap fp sp priv Privilege registers isp l0sp l1sp 12sp I3sp sbr tr sycw tkew pir psw2 mmu MMU registers atbr0 atlr0 atbr1 Area Table Register Pairs atlr1 atbr2 atlr2 atbr3 atlr3 debg Debug registers trmod adtr0 adtr1 adtmr0 adtmr1 Emulator Specific Command Syntax A 17 all All of the 70632 registers all of the 70632 registers xmmu XMMU function registers mmumod xatbr0 xatlr0 xatbr1 xatlri xatbr2 xatlr2 xatbr3 xatlr3 XMMU function registers These registers are not actual 70632 registers Refer to the XMMU function section of the Using the Emulator chapter for the detail Function The lt REG_CLASS gt names may be used in the reg register command to display a class of 70632 registers The lt REG_NAME gt names may be used with the reg command to either display or modify the contents of an 70632 register Refer to your 70632 user s manual for complete details on the use of the 70632 registers Related Commands reg register display modify A 18 Emulator Specific Command Syntax ate Summary Display processor s area table entry for specified address in default virtual address space Syntax lt ADDRESS gt lt RETURN gt Uo PN lt ADDRESS gt J lt SECT_1D gt Pe AREA ID D As ae eee Function The ate command allows you to display a
39. start or stop multiple emulators start multiple trace measurements or to arm multiple analyzers As with the analyzer generated break breaks to the monitor on CMB or BNC trigger signals are interpreted as a request to break The emulator looks at the state of the CMB READY active high line to determine if it should break It does not interact with the EXECUTE active low or TRIGGER active low signals For information on how to make coordinated measurements refer to the HP 64700 Emulators Terminal Interface Coordinated Measurement Bus User s Guide manual When you are using the emulator one of the following prompts is displayed normally R gt The emulator is in reset state U gt The emulator is running user program M gt The emulator is running in monitor Using the Emulator 4 19 Waiting for Target Ready Halt or Machine Fault 4 20 Using the Emulator If your target system has a defect or you does not configure the emulator appropriately the following prompts may be displayed w gt waiting for target ready m h gt halt or machine fault The prompt w gt indicates that the emulator is waiting for target ready signal If you map the unused memory locations as target memory and your program accesses to these locations by a defect in case of in circuit also if a target memory is accessed by an emulation command the emulator is waiting for an impossible ready signal infinitely because
40. the value of the RO you have modified freg r0 For more informations refer to the freg syntax pages in this chapter Using the Emulator 4 3 Analyzer Topics Analyzer Status Qualifiers base 0XXXXXXXXXXXX0100 coprd 0x1xxxxxxxxxx1000 coproc OxXXXXXXXXXXXX1000 copwr OxOxxxxxxxxxx1000 data OxxxxxxXxxxxxx0011 datard Ox1lxxxxxxxxxx0011 datawr OxOxxxxxxxxxx0011 exe Oxxxxxxxxxxxx0000 fault OxxxxxXXXXXXXX1100 fetch Ox1lxxxxxxxxxx011x fetchbr Ox1lxxxxxxxxxx0111 grd OxXXXXXXXXXXOXOXXX halt OxxxxXXXXXXXXX1101 hold OxxxxxxxXxxxxx0001 int OxxxxXXXXXXXXX1110 io OxxxxxXXXXXXXxX1011 iord Ox1xxxxxxxxxx1011 iowr OxOxxxxxxxxxx1011 lock OxxxxxxxXxXOXXXXXXX mon OxxxxXXXXXXXXOXXXX retry OOxxXXXXXXXXXXXXXX short Oxxxxxxxxxxxx0010 shortrd Ox1lxxxxxxxxxx0010 shortwr OxOxxxxxxxxxx0010 trans OxxxxxXXxXxxxx0101 transrd Ox1lxxxxxxxxxx0101 transwd OxOxxxxxxxxxx0101 wrrom OxOxxxxxxx0xx0xxx The following are the analyzer status labels which may be used in the tg and tsto analyzer commands system base table access co processor access read co processor access read write co processor access write data access read write data access read data access write execution state machine fault acknowledge code fetch code fetch after branch guarded memory access halt acknowledge bus hold interrupt acknowledge i o access i o access i o access bus lock background retry data access data access data access translat
41. to display the states about the execution state of the address 10033H U gt tl1l 10 13 Line addr H data H uPD70632 Mnemonic H count R 10 00010023 44226a14 BE Z 0001001dH KOK IK I Kk oe 9 00010034 ffcdf223 fetch kkkkkkkk 8 00010025 ffcdf223 CMP B 41H R2 KAAK kk ae ET 00010029 44fdffff BE Z 00010033H KOK IK KK ae 6 00010033 44ffffff fetch aft br KK CK kK Ak 5 00010034 ffcdf223 fetch kkkkkkk 4 00010038 242da0000 fetch KOK KK Kk oe 3 0001003c 000011f4 fetch KOK IK I Kk oe 2 00010040 44206a00 fetch KOK IK Ke i 00010044 ffcef223 fetch KK 0 00010033 242d0000 MOVEA W 00020000H R3 Kk Kk Kk 1 00010048 242d0000 fetch KOK IK Ke 2 0001003a 000011f4 MOV W 00000011H R4 KOK KK KK Ke 3 0001004c 000011f4 fetch KOK IK KI 4 00010061 638a58ff fetch aft br KK OK Ak Ak 5 00010041 ffa3f284 BR 00010061H KOK IK Kk 6 00010064 ffa3f 284 fetch FI EK 7 00010068 6a300001 fetch KOK IK Kk 8 0001006c O000000ae fetch KKK kkk k k k 9 00010070 78ef4120 fetch kkk kkk kkk 10 00010074 ffff1028 fetch eK OK OK Ke 11 00010061 ffff1028 MOVCFU B R3 R4 00030004H 30H EEEE EEEE 12 00010078 015d0aaa fetch KK 13 00020000 ffffff54 54H data read KKK kK Ak The transition states to the process for the command A are displayed For a Com plete For a complete description of the HP 64700 Series analyzer refer to Description the HP 64700 Emulators Terminal Interface Analyzer User s Guide 2 30 Getting Started Co pyi ng Memory The cp
42. words of the interrupt stack pointed by ISP is modified by the emulator instead of level 0 stack Using the Emulator 4 15 Target Memory Access Commands Not Allowed when Real Time Mode is Enabled 4 16 Using the Emulator Software Breakpoint Manipulation In Virtual Mode When you enable disable or remove a software breakpoint which you have set by using virtual address you must issue its command in same virtual space when you have set The notices related to software breakpoint manipulation in virtual mode are described in chapter 3 When emulator execution is restricted to real time and the emulator is running in user code the system refuses all commands that require access to processor registers or target system memory or I O The following commands are not allowed when runs are restricted to real time m Register display modification except for XMMU class registers m Target system memory display modification Because the emulator contains dual port emulation memory commands which access emulation memory do not require breaks and are allowed while runs are restricted to real time m I O display modification m Step m Area Table Entry display which is in target system memory m Page Table Entry display when the PTE or the dependent ATE is are in target system memory m Any other commands with virtual address designation which cause target system memory accesses for address translation Breaking
43. 0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000034 00000038 000000C0 000000C4 00001000 00001004 00001008 0000100C 00001010 00001014 00001018 0000101C 00001020 00001024 00001028 0000102C 00001030 00001034 C1500000 88500000 00000000 02000000 38100000 0000007F 00000000 00000040 00200040 00000000 64100000 0000007F 00000000 00000040 00200040 00000000 file equ equ equ equ equ equ equ equ equ equ equ equ equ equ equ equ equ equ equ equ equ equ equ equ equ equ data Sys_SBT org word org word data Current_Task word Num_Of_Task word TCB_Entry word word word word word word word word word word word word mul_task s isp 0 10sp 1 lisp 2 12sp 3 13sp 4 sbr 5 E4 6 sycw 7 tkew 8 pir 9 psw2 15 atbr0 16 atlr0 17 atbr1 18 atlr1 19 atbr2 20 atin2 22 atbhr3 22 atlr3 23 txrmod 24 adtr0 25 adtr1 26 adtmr0 27 adtmr1 28 Stack_Size 0x1000 Dest_Size 0x20 sys_sbt RW gt 0x00000000 0x34 Dummy_Text OxcO Sys_Trap sys_tcb RW gt 0x00001000 0 2 TCB_A 0x7 000000 0x00000000 0x40000000 0x40002000 0 TCB_B 0x7 000000 0x00000000 0x40000000 0x40002000 0 Figure 3 1 Sample Program Listing 3 2 Virtual Mode Emulation Topics U
44. 0 equ Dest_Size 0x30 D 00000000 equ Stack_Size 0x100 D 00000000 data sbt RW gt 0x00000000 D 00000000 Org 0x34 D 00000034 6D000100 word Dummy_Text T 00010000 text RX gt 0x00010000 T 00010000 align 4 T 00010000 2D3FF434010300 Init mov w Stack Stack_Size sp T 00010007 4420F2F9FF0100 movea w Command_Input r0 T 0001000E 4421F2F6FF0100 movea w Message_Dest r1 T 00010015 093AF420 mov b P26 T 00010019 0980E060 Clear mov b 0x00 r0 T 0001001D 092260 Read_Input mov b r0 r2 T 00010020 B822E0 cmp b 0x00 r2 T 00010023 64FA je Read_Input T 00010025 B822F441 Process_Comm cmp b TA x2 T 00010029 640A je Command_A T 0001002B B822F442 cmp b CB b2 T 0001002F 6414 je Command_B T 00010031 6A22 JE Unrecognized T 00010033 4423F2CDFF0000 Command_A movea w Message_A r3 T 0001003A 2D24F411000000 mov w Message_B Message_A r4 T 00010041 6A20 j Output T 00010043 4423F2CEFF0000 Command_B movea w Message_B r3 T 0001004A 2D24F411000000 mov w Invalid_Input Message_B r4 T 00010051 6A10 J Output T 00010053 4423F2CFFF0000 Unrecognized movea w Invalid_Input r3 T 0001005A 2D24F40F000000 mov w Message_End Invalid_Input r4 T 00010061 588A6384F2A3FFO1 Output movcfu b r3 r4 Message_Dest Dest_Size 0030 T 0001006B 6AAE jr Clear T 0001006D 00 Dummy_Text halt D 00020000 data R gt 0x00020000 D 00020000 5448495320495320 Message_A ste THIS IS MESSAGE A 4D45535341474520 41 D 00020011 5448495320495320
45. 000000 r21 00000000 r26 00000020 r31 00030134 When a breakpoint is hit it becomes disabled You can use the e option to the bp command to re enable the software breakpoint M gt bp sycw 00000070 r2 00000041 r7 00000000 r12 00000000 r17 00000000 r22 00000000 r27 00030034 ap 04420010 BREAKPOINT FEATURE IS ENABLED bp 000010033 r disabled BREAKPOINT FEATURE IS ENABLED bp 000010033 r enabled ASYNC_STAT 615 Software breakpoint M gt bp M gt r U gt m db 30000 41 000010033 r BREAKPOINT FEATURE IS ENABLED bp 000010033 r disabled 00020000H R3 r3 00020000 r8 00000000 r13 00000000 r18 00000000 r23 00000000 r28 00020011 fp 00000000 M gt bp e 10033 M gt bp r4 00000011 r9 00000000 r14 00000000 r19 00000000 r24 00000000 r29 04420010 sp 00030134 Getting Started 2 25 Using the Analyzer Predefined Trace Three trace labels are predefined in the 70632 emulator You can view Labels _ these labels by entering the tlb trace label command with no options M gt tlb Emulation trace labels tib addr 32 63 tlb data 0 31 tlb stat 64 79 Predefined Status Common values for the 70632 status trace signals have been Eq uates predefined You can view these predefined equates by entering the equ command with no options M gt equ Equates equ base O0xxxxxxxxxxxx0100y equ coprd 0x1xxxxxxxxxx1000y equ coproc O0xxxxxxxxxxxx1l000y equ copwr
46. 001 atlr0 00000000 atbr1 00002009 atlr1i 00000000 reg atbr2 00000000 atlr2 00000000 atbr3 00000000 atlr3 00000000 You will verify the CPU is in Task A address space from the value of atbr1 displayed Displaying Address You can display the 70632 Area Table Entry ATE To display the Translation Tables ATE corresponding with address 40000000 enter M gt ate 40000000 1 000 at 000002008 Present PTB 000003100 Limit 003 Growth positive Execute level 0 Write level 0 Read level 0 You can also display the 70632 Page Table Entry PTE To display the PTE corresponding with address 40000000 enter M gt pte 40000000 1 000 000 at 000003100 Present Page base 000006000 Executable Writable Readable Not modified Accessed User 0 Not locked The display shows the page base address is 00006000H The addition of this base address and the offset of virtual address O00H is 00006000H The address is the real address corresponding with the virtual address 40000000H You could also use section area and page number with i option instead of address To display the ATE of Section 1 Area 0 enter M gt ate i 1 0 3 18 Virtual Mode Emulation Topics To display the PTE of Section 1 Area 0 Page 0 enter M gt pte i 1 0 0 Continuing the To continue the execution enter Execution M gt r ASYNC_STAT 615 Software breakpoint 040000000 v The breakpoint hits at the virtual address 40000000H again The real address should be 00007000H To show
47. 0x00000000 sys_ate RW gt 0x00002000 0x00003003 0x00000500 0x00003103 0x00000300 0x00003203 0x00000300 sys_pte RW gt 0x00003000 0x00000e05 0x00001e05 0x00002e05 0x00003e05 0x00004e05 0x00005e05 0x100 0x00006e05 0x00008e05 0x0000ae05 0x0000ce05 0x200 0x00007e05 0x00009e05 0x0000be05 0x0000ce05 sys_stk RW gt 0x00004000 Sys_Stack Stack_Size 4 sys_text RX gt 0x00005000 4 Sys_Stack Stack_Size sp Sys_SBT sbr 0x2001 atbr0 0x00000000 atlr0 0 atbr1 0 atbr2 0 atbr3 0x2171 sycw Num_Of_Task r0O TCB_Entry rl Figure 3 1 Sample Program Listing Cont d Virtual Mode Emulation Topics 3 3 T 00005051 T 00005056 T 0000505A T 0000505E T 00005063 T 00005068 T 0000506D T 00005074 T 00005078 T 00005084 T 00005086 T 00005088 T 0000508F T 00005092 T 00005095 T 0000509C T 000050A0 T 000050A2 T 000050A9 T 000050AB T 000050AE T 000050B5 T 000050B8 T 000050BF T 000050C1 T 000050C2 T 00006000 T 00006007 T 0000600E T 0000601C T 0000601F T 00006025 T 00007000 T 00007007 T 0000700E T 0000701C T 0000701F B 00008000 B 00008000 B 00009000 B 00009000 D 0000A000 D 00004000 0180010461 2D220110 2DA0E0A2 2DA00108A2 2DA0010CA2 2D42010004 8421F418000000 C6AODDFF 0180F294BFFFFFF2 9OBFFFFF FAE4 2D20F278BFFFFF Sys_Trap 2D4062 8522E6 2D21F408100000 FDC20104 DD60 BCOOF262BFFFFF 6505 B44060 2D00F252BFFFFF 8520E6
48. 1 register displaying mmu 3 18 displaying privilege 3 21 floating point 4 3 modification 4 2 register class mmu 3 18 priv 3 21 xmmu 3 22 register display modify 1 4 registers XMMU 4 23 REGISTERS syntax A 17 relocatable files 2 12 remote configuration 2 14 rep repeat command 2 19 reset commands which cause exit from 2 33 reset control 1 5 resetting the trace specifications 3 25 respond to target bus freeze BFREZ A 12 respond to target system interrupt A 12 restrict real time runs 4 16 restrict to real time runs 1 5 ROM debug of target 5 7 mapping emulation or target 2 11 writes to 2 11 rrt emulator configuration A 9 rst reset emulator command 2 33 RT EP from target system 5 7 s step command 2 17 sample program description 2 2 flow of the 3 13 loading the 2 14 multiple virtual space 3 9 virtual mode 3 1 selecting memory inverse assembler A 9 ser search memory command 2 22 signals background cycle A 10 simple trigger specifying 2 27 single step emulation mode 4 21 single step processor 1 4 software breakpoints 1 5 2 23 3 17 3 20 4 14 after initialization 2 8 defining 2 24 note on BRK instruction vector 2 23 using with ROMed code 5 8 software debugging 1 5 specifying virtual space 3 22 4 24 stack pointer modification 4 2 standalone configuration 2 14 stat emulation analyzer status trace label 2 26 state count 4 8 state on emulation probe 5 12 s
49. 3 4 Virtual Mode Emulation Topics whens WWD 00004017 00004017 0000B000 0000B013 0000C000 0000C000 Message_A_End 5461736B2042203A Message_B 2052756E6E696E67 2E2E2E Message_B_ End data data_b RW gt 0x0000b000 Str Task B Running bss dest RW gt 0x0000c000 lcomm Message_Dest Dest_Size 4 Figure 3 1 Sample Program Listing Cont d the Software trap 0 vector The break point instruction vector is required for the software breakpoint feature of the emulator The software trap 0 vector is used for aborting task and transfering execution to the operating system Task Context Block The sys_tcb part at address range 00001000H through 00001 fffH defines task context block The operating system manages tasks with this block The address labeled Current_Task contains a task number which is currently executed Tasks are numbered from 0 This address initialized to 0 when the program is started First the task numbered 0 will be executed The address labeled Num_Of_Task contains the number of tasks the operating system manages This program has two tasks which are alternately executed So this address contains the value 2 The address labeled TCB_Entry contains task control blocks for each task Each block consists of pointer and register list of TCB managed under the 70632 processor and the initial values of registers PSW PC and SP and a word of flags The address labeled TCB_A con
50. 4M L FMUL3M S FMUL3M L FMUL4M S FMUL4M L FRPUSH FRPOP FAFFECT Instructions with one operand Dummy operand is displayed when dis assembling instructions with only one operand As a sign is displayed just after Opcode mnemonics as follows FRREL 00000100H FRO The FRO is a dummy operand The following instructions relate this FIPV S FIPV L FRPINC FRREL The ate and pte commands allow you to display Area Table Entry and Page Table Entry for an address you specified in the commands These commands are useful to examine in which address space the program are executed and detect the address translation error of the program Examples of these command usages are described in Virtual Mode Emulation Topics chapter These command syntax are shown in 70632 Emulator Specific Command Syntax appendixa Making Coordinated Measurements Unfamiliar Prompts Coordinated measurements are measurements made between multiple HP 64700 Series emulators which communicate via the Coordinated Measurement Bus CMB Coordinated measurements can also include other instruments which communicate via the BNC connector A trigger signal from the CMB or BNC can break emulator execution into the monitor or it can arm the analyzer An analyzer can send a signal out on the CMB or BNC when it is triggered The emulator can send an EXECUTE signal out on the CMB when you enter the x execute command Coordinated measurements can be used to
51. 6 00 23 tue tte oh Oe Tees SS SBE SS A 3 ADDRESS api 4ie 80 aoe ai OR Ae Ee BR ar BAS BA A 5 CONFIG ITEMS sce eh p oe ne ee we a ED D a S A 8 DISPLAY MODE a rh Sty Oe AR Bates AE ae Y A 15 REGISTER CLASS and NAME A 17 ATE se la i ee th eee Se ae a E a ae Y A 19 Pee i ek oe EIA ayaa ne le Sate ae e Bgad S Bo aes A 21 AOS utah ae She ese io Pose we ps aS A 23 TED ge ett tM pede el hoe aa ete eh thee aye Gh A Mae A 25 CpMM ees Bee eS RE ES ee es BS A 27 Error and Status Message 004 A 28 Using the Foreground Monitor Comparison of Foreground and Background Monitors B 1 Background Monitors 2 0 00 05 0004 B 1 Foreground Monitors 000 B 2 Foreground Monitor Selection 00 B 2 Using Built in Foreground monitor B 3 Interrupt Exception Handler B 3 Using Custom Foreground monitor B 4 Interrupt Exception Handler 2 B 4 Loading Foreground Monitor B 5 Loading User Program 2 2 0 0 0004 B 6 Loading into Target Memory B 6 Loading into Emulation Memory B 6 Restrictions and Considerations B 7 An Example Configuration of the Foreground Monitor B 8 Modify Monitor Source Program 4 B 8 Defining System Base Table in Your Program B 8 Defining Address Translatio
52. FE 20f43a2d 2d000000 2d000000 0017 438 8a580000 8a580000 002000 3 00 39840 20400030 20400030 deadt4ts ffffelf2 o00000ff 777e5558 00003103 00000300 0000ae85 00003103 00000300 0000cf 85 0000cf85 ffffff54 ffff48ff 00000054 FEA9QEEEE You will see uPD70632 Mnemonic H fetch aft br No fetch cycle found fetch fetch fetch MOV W 00000020H R26 fetch fetch MOV W 00000013H R24 fetch fetch fetch fetch fetch 00003203H trans table read 00000300H trans table read 0000be85H trans table read 00003203H trans table read 00000300H trans table read 0000cf85H trans table read MOVCFU B 40002000H R24 40003000H 20H ET 54H data read 61 H data read PA 54H data write Aas H data read Or uPD70632 Mnemonic H fetch aft br No fetch cycle found fetch fetch fetch MOV W 00000020H R26 fetch fetch MOV W 00000017H R24 fetch fetch fetch fetch fetch 00003103H trans table read 00000300H trans table read 0000ae85H trans table read 00003103H trans table read 00000300H trans table read 0000cf85H trans table read MOVCFU B 40002000H R24 40003000H 20H betel aN 54H data read 48 H data read AE 54H data write 49 H data read Virtual Mode Emulation Topics 3 27 count R KKKKKKKKK KKKKKKKKK KKKKKKKKK KKKKKKKKK KKKKKKKKK KKKKKKKKK KKKKKKKKK KKKKKKKKK KKKKKKKKK KKKKKKKKK RAK A A HK KKKKKKKKK KKKKKKKKK a eh a KKKKKKKKK KKKKKKKKK KKKKKKKKK KKKKKKKKK KKKKKKKKK AR
53. K or 1020K bytes of emulation memory which you may use You can examine the emulation memory size of your emulator type 2 10 Getting Started R gt ver The resulting display includes the information of emulation memory size If your emulator s model number is m HP64758G you ll find Memory 508 KBytes Emulation Memory m HP64758H you ll find Memory 1020 KBytes Emulation Memory By default the emulation memory system does not introduce wait states The memory mapper allows you to characterize memory locations It allows you specify whether a certain range of memory is present in the target system or whether you will be using emulation memory for that address range You can also specify whether the target system memory is ROM or RAM and you can specify that emulation memory be treated as ROM or RAM If you are using the emulator in in circuit additionally you can choose whether the emulation accesses honor READY or BERR signals from the target system wait or retry cycles are inserted if requested system devices that take control of the bus for example coprocessors Note wc Target system access to emulation memory is not allowed Target or external DMA controllers cannot access emulation memory Blocks of memory can also be characterized as guarded memory Guarded memory accesses will generate break to monitor requests Writes to ROM will generate break to monitor requests if the rom break condition is enabled
54. KKKKKK KKKKKKKKK KKKKKKKKK KKKKKKKKK KKKKKKKKK AKA A HAH KKKKKKKKK KKKKKKKKK KKKKKKKKK KKKKKKKKK KKKKKKKKK KAKA AKASK KKKKKKKKK KKKKKKKKK EAA AR HH Ke Kee He eK KKKKKKKKK KAKA EAKAS KKKKKKKKK KKKKKKKKK KKK AARES KKKKKKKKK Because the locations of both Task A and Task B messages are the same address in virtual the message which is stored in the beginning of the trace listing may be of Task B Anyway you will find the messages of Task A and Task B are alternately read from the same address range 40002000H through 4000201fH Virtual Mode Emulation Topics 3 31 Notes 3 32 Virtual Mode Emulation Topics Using The Emulator Introduction Many of the important topics described in this chapter involve the commands or features which relate to using the emulator The Getting Started and Virtual Mode Emulation Topics chapters shows you how to use the basic features of the 70632 emulator This chapter describes more information or notices of the 70632 emulator This chapter contains the following topics m Register Manipulation Stack Pointer and Program Status Word Modification Floating Point Format Display or Modification m Analyzer Topics Analyzer Status Labels Analyzer Trigger Condition Trace Listing Disassembler Execution States Analyzer Data Bus Condition Analyzer Clock Speed Cause of Monitor Break Hardware Breakpoints Software Breakpoints Target Memor
55. M You can however copy target ROM into emulation memory see the Target ROM Debug Topics section of the In Circuit Emulation chapter BRK instruction vector must be set up You must define the 70632 break point instruction trap vector to point to an address which is allowed instruction fetch typically in the program code area When a software breakpoint occurred the emulator breaks into the monitor after the BRK instruction has been executed However the instruction which is pointed by the BRK instruction vector is never executed If you didn t set up the vector and a software break has occurred an access to the address pointed by the vector may drive the emulator into unpredictable state The 70632 break point instruction vector is defined in the 70632 system base table The vector is located at OXXXXXX34H where XXXXXX is determined by the contents of the privilege register SBR defaults is 000000 This table location depends on the content of 70632 SBR register More three words of the stack area must be prepared When the BRK instruction is executed the emulator stores the exception information to stack as the same as the 70632 microprocessor does So you should prepare more three words 12 bytes for stack in addition The stack which is used when the breakpoint occurs is normally the level 0 stack which is pointed by LOSP When the software breakpoint occurs if the program uses interrupt stack the three
56. MALS Ot oS eee Ae ed 4 1 Preregulsites y aiene ae nE OR Oe ante a OE Ae a g 4 2 Register Manipulation oaoa e 4 2 Stack Pointer Modification o oo a 4 2 Displaying Modifying Registers In Floating Format 4 3 Analyzer Topics ice ate a oleae a ee Bl te A WB 4 4 Analyzer Status Qualifiers 004 4 4 Specifying Trigger Condition at Desired Instruction Execution 2 00 000004 4 4 Disassembles In Trace Listing 4 5 Execution States Location in Trace Listing 4 6 Specifying Data For Trigger Condition or Store Condition 4 7 Analyzer Clock Speed 000 4 8 Finding Out the Cause of a Monitor Break 4 10 Hardware Breakpoints 50004 4 11 Example Configuration for Hardware Breakpoints Features 4 12 Software Breakpoints 02 20004 4 14 Target Memory Access 2 0 0 0000 4 16 Commands Not Allowed when Real Time Mode is Enabled 4 16 Breaking out of Real Time Execution 4 17 FPU Support g e s jones eet hal eS ee hel eee 4 17 MMU Support s ea oe ee a eee Pe eG 4 18 Making Coordinated Measurements 4 19 Unfamiliar Prompts 2 0 00000000 4 19 Waiting for TargetReady 0 0 4 20 Halt or Machine Fault 2 0 4 20 70108 70116 Emulation Mode 4 4 21 Displaying Memory In 70108 70116 Mnemonic Format 4 21 Single st ppi g
57. OOU0U90 E E SEA A T A UO UOO0U0 w 00001038 0000103C 0000105C 00001064 00001068 00001088 00001090 00002000 00002008 00002010 00002018 00003000 00003004 00003008 0000300C 00003010 00003014 00003018 00003100 00003104 00003108 0000310C 00003110 00003200 00003204 00003208 0000320C 00004000 00004000 00005000 00005000 00005000 00005007 0000500F 0000501B 00005023 0000502B 00005033 0000503B 00005043 0000504A 00 00000 09200000 00 00000 11200000 03300000 03310000 03320000 050E0000 051E0000 052E0000 053E0000 054E0000 055E0000 056E0000 058E0000 O5AE0000 O05CE0000 057E0000 059E0000 O5BE0000 O05CE0000 2D3FF400 L280F400 L280F40 10000000 L280E0F4 L280E0F4 L280E0F4 L280E0F4 L280F471 2D20F2C1 2D21F408 00000000 00000000 00050000 00030000 00030000 500000 000000E5 1200000F4 11000000 12000000 14000000 16000000 210000E7 BFFFFF 100000 TOBA TCB_B ATEO ATE1_A ATE1_B PTEO PTE1_A PTE1_B Sys_Init Setup_Task word space word word Space word data word word word data word word word word word word org word word word word org word word word word bss lcomm text align mov Ww pr pr pr pr pr o 9900 9 pr mov Ww mov Ww 0x0000e000 8x4 0x00002009 0x00000000 0x0000e000 8x4 0x00002011
58. RAS SH KK AK ek KKKKKKKKK KKKKKKKKK KKKKKKKKK KKKKKKKKK count R KKK KEK KKKKKKKKK KKKKKKKKK KKKKKKKKK KKKKKKKKK KKKKKKKKK KKKKAKAKKE KKKKKKKKK KKKKKKKKK KKKKKKKKK KKKKKKKKK KKKKKKKKK aKa KKK KKKKKKKKK KKKKKKKKK KKKKKKKKK KKKKKKKKK KKKKKKKKK KKKKKKKKK KKKKKKKKK KKKKKKKKK KKKKKKKKK KKKKKKKKK kaa KK KK KKKKKKKKK Note Hg Emulation trace started In a analyzer command you can not specify a address with a address mode suffix such as r or v Additionally the XMMU class registers do not effect You should configure which address mode the analyzer should capture and you will specify in with cf tra command before starting trace The sample program transfers the character string data Suppose that you would like to trace the character translation by Task A Change the data format of the trace display so that you will see the output message writes displayed in ASCII format U gt t addr h data A count R seq To specify the analyzer trace address mode to real U gt cf tra real To set the trigger point at the entry address of Task A 00006000H U gt tg addr 6000 To store only the accesses to the addresses which are stored message of Task A range 0000a000H through 0000a01fH U gt tsto addr 0a000 0a01f Start the trace by typing U gt t You will see To view the trace listing enter U gt tl 0 24 3 28 Virtual Mode Emulation Topics Line addr H data A count R seq Q 00006000
59. S gt is not specified the TCB contents of the current task which is specified by register TR contents are displayed Emulator Specific Command Syntax A 25 Examples tcb tcb 1 07f 0000 tcb 12345678 tcb 1 O7fffffff 12345678 A 26 Emulator Specific Command Syntax cpmmu Summary Copy the contents of the current area table register pairs to XMMU class registers commu gt lt RETURN gt lt SECT_ID gt q Syntax Function The cpmmu command allows you to copy the contents of the current area table register pairs to XMMU function registers You can specify the IDs of the sections which correspond to the area table register pairs After you set up the XMMU function registers activate the XMMU function by modifying the mmumod register to the value The XMM U function allows you to specify a virtual address space where the virtual address which you specify in a certain command is interpreted by the emulator The virtual address is defined by the contents of XMMU function registers if activated Refer to the Using the XMMU Function section of chapter 4 Parameters lt SECT_ID gt Specifies the ID number of the section which correspond to the area table register pair to be copied to XMMU function registers lt SECT_ID gt is a value from 0 to 3 Defaults If no lt SECT_ID gt is specified all of the area table register pairs are copied to the XMMU function registers Examp
60. Sample Program 3 14 Virtual Mode Emulation Topics Setting Up the Emulator Using The Emulator In Virtual Mode Address Mode suffixes To set up the emulator the demo command is provided for this example The demo command performs the following tasks m Limited initialization of the emulator Mapping memory for this example m Loading the sample program into the emulator Enter the following command R gt demo 2 This section shows a example usage of the emulator in virtual mode When you issue a command the emulator displays the result of the command According to circumstance the resulting display includes address information such as 00004000 r or 00008000 v The suffix r indicates that the address is displayed in real address space The suffix v indicates that the address is displayed in virtual address space When the emulator displays an address information the address space mode will be different as the case may be Specifying An Address Mode When you designate addresses you can select either real or virtual address by adding a suffix with a few exceptions such as map and cov commands These exceptions are shown in ADDRESS section in the 70632 Emulator Specific Command Syntax appendixa The following suffixes are allowed Virtual Mode Emulation Topics 3 15 a r real address a y virtual address You can also designate addresses with no suffix In this case the addres
61. TER SUBSTITUTION amp token amp pseudo parameter included in macro definition cannot contain any white space between amp pairs performs positional substitution when macro is invoked Example Macro definition mac getfile load hbs transfer t amp file amp Macro invocation getfile MYFILE o Expanded command load hbs transfer t MYFILE o Help information exists for each command Additionally there is help information for each of the emulator configuration items 2 6 Getting Started Becoming Familiar A number of prompts are used by the HP 64700 Series emulators with the System Each of them has a different meaning and contains information about Prompts the status of the emulator before and after the commands execute These prompts may seem cryptic at first but there are two ways you can find out what a certain prompt means if you are not familiar with it Using help proc to View Prompt Description The first way you can find information on the various system prompts is to look at the proc help text R gt help proc Address format 32 bit address for memory with optional function code An address is usually interpreted as real unless the function code contains a v specifying a virtual or real address Address format is either XXXXXXXX or XXXXXXXX fc where XXXXXXXX is a 32 bit address and fc is any of the following r real y virtual Address range format 32 bit address thru 32 bi
62. _ENTRY label is also defined to break the emulator into monitor when NMI signal is generated The following statements define two page tables for monitor program The real address location of label PTE_FGMON must be pointed by the Area Table Entry of Section 1 Area 0 because the monitor location is 40000000h virtual PTE_FGMON word 0x00001e05 for foreground monitor location word 0x00001e05 for accessing to target memory by monitor The PTE in the second line must be defined to access to target memory B 8 Using the Foreground Monitor by monitor program The monitor modifies the PTE to point to target memory location to be accessed Initially the PTE had better point to the foreground monitor location Note that the foreground monitor must be reside in the fixed virtual address even if virtual space is changed This allows the emulator to break into monitor in any virtual space Assem bling and To refer to these labels in this example NMI_ENTRY Linking the STEP_ENTRY and BRK_ENTRY the foreground monitor program Fore groun d Monitor and your program should be linked together Suppose that the generated absolute file name is usr_prog x You must prepare another absolute file which contains only foreground monitor program The absolute file will be used to load the monitor program into the emulator Suppose that the generated absolute file name is monitor x Setting Up the The following command should be issued to tel
63. a eee 414 14 4124 4 QBS fF FF Son ere Real Address Space 00004020 Actual Memory 28083228 System 202082 2228 2028 128228 gaoaega2 Task A Virtual Address Space Figure 3 2 Virtual Address Space for Sample Program 3 10 Virtual Mode Emulation Topics SBbf Exit of Task Switching Routine D System Program 5288 Entry of Task Switching Routine 58808 Program Entry 4000 D C j age Table ntry 3200 PTE for Sec 1 Area of Task B 310 PTE for Sec 1 Area of Task A 3000 PTE for Section Area B Area Table Entry 2810 lof ATE for Section ask 2008 ATE for Section 1 of Task 2009 ATE for Section Dw Task Control Block 18064 TCB of Task B 1838 TCB of Task A 1882 Sys tem Ba Ee Tab le Bco Software trap vector 0034 Breakpoint instruction trap vector Baga System Base Figure 3 3 Mapping of the Sample Operating System Virtual Mode Emulation Topics 3 11 40003000 40002088 4020 1000 40000000 Virtual 400030280 40002000 4004 1000 40000000 Virtual Destination Common Message Task B ask B Stack Area ask B Instruction Task B Memory Space for Task B Destination Common
64. a pin protector that prevents damage to the prove when inserting and removing the probe from the target system microprocessor socket Do not use the probe without a pin protector installed If the target system probe is installed on a densely populated circuit board there may not be enough room to accommodate the plastic shoulders of the probe socket If this occurs another pin protector may be stacked onto the existing pin protector HP emulators are shipped with a conductive plastic or conductive foam pin guard over the target system probe pins This guard is designed to prevent impact damage to the pins and should be left in place while you are not using the emulator However when you do use the emulator either for normal emulation tasks or to run performance verification on the emulator you must remove this conductive pin guard to avoid intermittent failures due to the target system probe lines being shorted together In Circuit Emulation Topics 5 3 Caution Always use the pin protectors and guards as described above Failure to use these devices may result in damage to the target system probe pins Replacing the target system probe is expensive the entire probe and cable assembly must be replaced because of the wiring technology employed PROBE CABLE MICROPROCESSOR CONNECTOR gt PIN 1 OF MICROPROCESSOR CONNECTOR TARGET SYSTEM MICROPROCESSOR SOCKET PIN 1 OF TARGET SYSTEM MICROPROCESSOR SOCKET
65. ad He ke ke ke de KEKE MOV W 00001004H RO He ke He ke de e ke ke ke MOV W 00001008H R1 KO KK kk Ie fetch ee ed The analyzer captures the data bus of the 70632 microprocessor When you specify a data in the analyzer trigger condition or store condition the ways of the analyzer data specifications differ according to the data size and the address Suppose that you wish to trigger the analyzer when the processor accesses to the byte data 41H in the address 1000H You should not specify the trigger condition like this tg addr 1000 and data 41 The data condition will be considered as 00000041H The bit 31 through bit 8 of data bus is unpredictable because of the byte data You will unable to trigger as you desire You should have entered as follows tg addr 1000 and data 0xxxxxx41 Where x s are don t care bits When the address that you want to trigger is not a multiple of 4 the data bus specification is different from the above If you trigger the analyzer at the address 1001H instead of the address 1000H the data 41H will be output to the bit 7 through bit 4 of the data bus You should enter tg addr 1001 and data 0xxxx41xx In case of halfword or word access to the data bus it will be more complex if two bus states are required to access the data because the data is across 4 byte boundary In this case you need to use the analyzer sequential trigger capabilities We do not describe the detail about the sequential trigger
66. addr 30000 and data 0xxxxxx42 M gt t Emulation trace started U gt zr U gt ts Emulation Trace Status NEW User trace running Arm ignored Trigger not in memory Arm to trigger States 0 Sequence term 1 Occurrence left 1 The trace status shows that the trigger condition has not been found You would not expect the trigger to be found because no commands have been entered Modify the command input byte to B 42H and display the trace status again U gt m db 30000 42 U gt ts Emulation Trace Status NEW User trace complete Arm ignored Trigger in memory Arm to trigger States 1024 1024 0 1023 Sequence term 2 Occurrence left 1 The trace status shows that the trigger has been found and that 1024 states have been stored in trace memory Enter the following command to display the first 20 states of the trace U gt tl 0 19 Getting Started 2 27 ODAIDOBPWNHRPOWODNANOBWNHEO 00030000 00010020 00010030 00010023 00010034 00010025 00010029 00010038 0001002b 0001003c 0001002 00010043 00010044 00010048 0001004c 00010050 00010054 00010043 00010058 0001004a 0001 00020011 00020012 00030004 00020013 00030005 00020014 00030006 00020015 00030007 00020016 2 28 Getting Started data H 242d0000 o0000ff4 o0000ff4 638a58ff fa3f284 fa3f284 HUTI OH O eO h uPD70632 Mnemonic H AEE 42H data read N
67. ain commands If you are not familiar with a new prompt and would like information about that prompt only enter the es emulation status command for more information about the status of the emulator U gt es Initializing the Emulator If you plan to follow this tutorial by entering commands on your emulator as shown in this chapter verify that no one else is using the emulator To initialize the emulator enter the following command R gt ainit Limited initialization completed 2 8 Getting Started The init command with no options causes a limited initialization also known as a warm start initialization Warm start initialization does not affect system configuration However the init command will reset emulator and analyzer configurations The init command m Resets the memory map m Resets the emulator configuration items m Resets the break conditions m Clears software breakpoints The init command does not m Clear any macros m Clear any emulation memory locations mapper terms are deleted but if you respecify the mapper terms you will find that the emulation memory contents are the same Other Types Of There are two options to the init command which specify other types of Initialization initializations The p option specifies a powerup initialization also known as a cold start initialization The cold start initialization sequence includes the emulator analyzer system controller and communications po
68. and Status Messages A 2 Emulator Specific Command Syntax ACCESS MODE Summary Specify cycles used by monitor when accessing target system memory or I O Syntax 7 Function The lt ACCESS_MODE gt specifies the type of microprocessor cycles that are used by the monitor program to access target memory When a command requests the monitor to read or write target system memory or I O the monitor program will look at the access mode setting to determine whether byte halfword or word instructions should be used Parameters b Byte Selecting the byte access mode specifies that the emulator will access target memory using byte cycles one byte at a time h Halfword Selecting the word access mode specifies that the emulator will access target memory using halfword cycles one word at a time w Word Selecting the word access mode specifies that the emulator will access target memory using word cycles one word at a time Example mo ab mo aw Defaults The lt ACCESS_MODE gt is b at power up initialization Access mode specifications are saved that is when a command changes the access mode the new access mode becomes the current default Emulator Specific Command Syntax A 3 Related Commands mo specify display and access modes m memory io I O A 4 Emulator Specific Command Syntax ADDRESS Summary Address specifications used in emulation commands Syntax lt ADDR gt lt REAL_ADDR gt
69. and or a break condition such as software breakpoint is satisfied the caches are updated If the emulator is not restricted to real time runs default the caches are updated by the contents of the area table register pairs every time the emulator breaks into monitor whether with or without your intention When you issue commands with virtual addresses the emulator breaks into the monitor to access the area table register if possible As the result the emulator will use the current virtual address space for address translations In the both cases when the emulator cannot break into monitor for example the processor is reset the emulator uses the caches for the address translation Using the Emulator 4 23 Specifying Virtual Address Space XMMU class registers xatbroO xatlr0 xatbrl xatirl xatbr2 xatlr2 xatbr3 xatlr3 mmumod 4 24 Using the Emulator When you specify virtual addresses in emulation commands the emulator translates the virtual address to corresponded real addresses The translated real addresses depends on a virtual address space The virtual address space can be defined by the values of area table base and length for each section In 70632 microprocessor these informations are stored in its area table register pairs In case that the caches mentioned above are used for the address translation it is difficult to specify an virtual address in your desirable virtual address space during running user program
70. at read Now specify the trigger condition and start the trace 2 If your target system clock rate is equal to 16 MHz or less than 16 MHz you can use the state counter or the time counter of the analyzer Change the mode of the analyzer clock speed to Slow by entering tek s S The Slow mode allows you to use the analyzer tag counter as either the state counter or the time counter The analyzer tag counter counts occurrences of the states which you specify or the amount of time between stored states The following is example of the usage of the analyzer tag counter as the time counter Assume that you would like to count time between states tcq time Now specify the trigger condition and start the trace Finding Out the If the emulator breaks into monitor unwillingly you can examine the Cause ofa Monitor cause of the break by using the analyzer When you issue the following Break commands you can capture the behavior of the program just before the monitor break Specify the trigger condition that the analyzer is never triggered tg never Specify the store condition that the analyzer captures any states tsto any Start the trace t After starting your program the unexpected break will occur To show the cause of the break stop the trace and display the trace listing Using the Emulator 4 9 4 10 Using the Emulator th tl 19 0 The trace listing displays will show the cause of the break If you cannot find the ca
71. ation Topics 70632 Emulator Specific Command Syntax The following pages contain descriptions of command syntax specific to the 70632 emulator The following syntax items are included several items are part of other command syntax m lt ACCESS_MODE gt May be specified in the mo display and access mode m memory display modify and io 1 O display modify commands The access mode is used when the m or io commands modify rarget memory or I O locations m lt ADDRESS gt May be specified in emulation commands which allow addresses to be entered m lt CONFIG_ITEMS gt May be specified in the ef emulator configuration and help cf commands a lt DISPLAY_MODE gt May be specified in the mo display and access mode m memory display modify io 1 O display modify and ser search memory for data commands The display mode is used when memory locations are displayed or modified m lt REGSTER_NAME gt and lt REGISTER_CLASS gt May be specified in the reg register display modify command m lt ate gt May be specified in the ate area table entry display command m lt pte gt May be specified in pte page table entry display command Emulator Specific Command Syntax A 1 m lt freg gt May be specified in the freg floating point format register display modify command m lt tcb gt May be specified in the teb TCB diaplay command m lt cpmmu gt May be specified in the cpmmu XMMU copy command m Error
72. can configure the emulator so that it honors target system wait and retry requests when accessing emulation memory Additionally the processor signals READY BERR BFREZ RT EP NMI INT and HLDRQ may be enabled or disabled independently of the 70632 processor Real time signifies continuous execution of your program at full rated processor speed without interference from the emulator Such interference occurs when the emulator needs to break to the monitor to perform an action you requested such as displaying target system memory Emulator features performed in real time include running and analyzer tracing Emulator features not performed in real time include display or modify of target system memory load dump of target memory and display or modification of registers and some virtual related functionality Introduction 1 5 Foreground or Background Emulation Monitor Out of Circuit or In Circuit Emulation 1 6 Introduction The emulation monitor is a program executed by the emulation processor It allows the emulation controller to access target system resources For example when you display target system memory the monitor program executes 70632 instructions to read the target memory locations and send their contents to the emulation controller The monitor program can execute in foreground the mode in which the emulator operates as would the target processor The foreground monitor occupies processor address space and
73. cations Moving target ROM contents into emulation memory is the key which allows you to perform the tasks described below For example if target ROM exists at locations 00020000H through 0002ffffH you can copy target ROM into emulation memory with the following commands R gt map 20000 2fffF erom lock R gt cim 20000 2ffff In Circuit Emulation Topics 5 7 The lock attribute mentioned in the Allowing the Target System to Insert Wait States section above is used so that the emulation ROM accesses honor ready signals from your target system Using Software You cannot define software breakpoints in target ROM memory Breakpoints with However you can copy target ROM into emulation memory which ROMed Code does allow you to use software breakpoints Once target ROM is copied into emulation memory software breakpoints may be used normally at addresses in these emulation memory locations R gt be e bp R gt bp 20000 Coverage Testing Coverage testing as described in the Getting Started chapter can ROMed Code only be performed on emulation memory However if you wish to perform coverage tests on code in target system ROM you can copy target ROM into emulation memory and perform the coverage tests on your ROMed code Once target ROM is copied into emulation memory coverage testing may be done normally at addresses in these emulation memory locations U gt cov a 20000 2ffff Even if your application is executed in virtual addr
74. cations after transferring a message to the destination area Message_Dest with blank Reading Input The instruction at the Clear label clears any random data or previous commands from the Cmd_Input byte The Read_Input loop continually reads the Cmd_Input byte to see if a command is entered a value other than OH Processing Commands When a command is entered the instructions from Process_Comm to Command_A determine whether the command was A B or an invalid command If the command input byte is A ASCII 41H execution is transferred to the instructions at Command_A If the command input byte is B ASCII 42H execution is transferred to the instructions at Command_B If the command input byte is neither A nor B an invalid command has been entered and execution is transferred to the instructions at Unrecognized The instructions at Command_A Command_B and Unrecognized each load register R3 with the starting location of the appropriate message and register R4 with the length of the message to be displayed Then execution transfers to Output which writes the appropriate message to the destination location Message_Dest At the same time the remaining locations are filled with blanks the content of register R26 Then the program jumps back to read the next command Getting Started 2 5 Using the help The HP 64700 Series emulator s Terminal Interface provides an Facil ity excellent help fac
75. cles You can select the value of the 70632 address bus which should be driven to your target system Pin A31 through A8 of the address bus is configurable This configuration is meaningful when the Driving In Circuit Emulation Topics 5 5 Background Cycles to Target System configuration mentioned above is activated The configuration item is bbk Allowing HLDRQ Signal from Target System You can specify whether the emulator accepts or ignores the HLDRQ signal from your target system By default the emulator accepts the HLDRQ signal from the target system The configuration item is th Allowing BFREZ Signal from Target System You can specify whether the emulator accepts or ignores the BFREZ signal from your target system By default the emulator accepts the BFREZ signal from the target system The configuration item is tbf Allowing INT Signal from Target System You can specify whether the emulator accepts or ignores the INT signal from your target system By default the emulator accepts the INT signal from the target system The configuration item is ti Allowing NMI Signal from Target System You can specify whether the emulator accepts or ignores the NMI signal from your target system By default the emulator accepts the NMI signal from the target system The configuration item is tn 5 6 In Circuit Emulation Topics Allowing the Target High speed emulation memory provides no wait state opera
76. command or the cpmmu copy current virtual address space to XMMU registers command See also the Using the XMMU function section of chapter 3 and the cpmmu command syntax of chapter 4 After you have modify the contents of the XMMU register pairs activate the XMMU function by changing the contents of XMMU mode register mmumod to the value 1 reg mmumod 1 To use the caches of the area table register pairs for address translations modify mmumod register to 0 default reg mmumod 0 Besides by using the reg command the mmumod register is reset when the emulator breaks into monitor in the following causes m Break by software breakpoint m Break by single stepping m Break by writing to ROM m Break by access to guarded memory In these case the mmumod register is reset to 0 As the result the address translation of the virtual address in a command uses the actual area table register pairs Using the Emulator 4 25 Restrictionas and Considerations 4 26 Using the Emulator When the microprocessor accesses data which are not aligned the microprocessor generates more than twice memory access cycles If the microprocessor accepts interrupt while microprocessor reads the data which are not aligned the microprocessor stop accessing the data and generates invalid memory write cycle But memory is not changed because bus enable signals BSO BS3 are inactive and stopped memory read cycles are reexecuted after interrupt ro
77. commands To continue stepping through the sample program you could repeatedly press lt CTRL gt r to recall and lt RETURN3 gt to execute the st macro Repeating Commands The rep command is also helpful when entering commands repetitively You can repeat the execution of macros as well commands For example you could enter the following command to cause the st macro to be executed four times M gt rep 4 st Getting Started 2 19 s reg 000010015 r PC 000010019 r reg pc 00010019 reg r0 00030000 reg r5 00000000 reg r10 00000000 reg r15 00000000 reg r20 00000000 reg r25 00004040 reg r30 00000000 s reg 000010019 r PC 00001001d r reg pc 0001001d reg r0 00030000 reg r5 00000000 reg rl0 00000000 reg r15 00000000 reg r20 00000000 reg r25 00004040 reg r30 00000000 s reg 00001001d r PC 000010020 r reg pc 00010020 reg r0 00030000 reg r5 00000000 reg r1l0 00000000 reg r15 00000000 reg r20 00000000 reg r25 00004040 reg r30 00000000 s reg 000010020 r PC 000010023 r reg pc 00010023 reg r0 00030000 reg r5 00000000 reg r10 00000000 reg r15 00000000 reg r20 00000000 reg r25 00004040 reg r30 00000000 2 20 Getting Started MOV B psw 10000000 r1 00030004 r6 00000000 r11 00000000 r16 00000000 r21 00000000 r26 00000020 r31 00030134 MOV B psw 10000000 r1 00030004 r6 00000000 r11 00000000 r16 00000000 r21 00000000 r26 00000020 r31 00030134 MOV B psw 10000000 r1 00030004
78. d Using the Emulator 4 5 Execution States Location in Trace 61 62 63 64 65 66 Listing 00003004 00001e05 00003004 00001e85 00001004 00000002 00005043 00000002 0000504a 00000002 00005060 2da20801 Specifying Data For Trigger Condition or Store Condition 4 6 Using the Emulator For complete disassembles specify the trigger point that ten states will be stored before the trigger point by typing the following command instead of tp s tp b 10 To display the trace listing from the triggered state enter tl 0 You will see complete disassembles in trace listing In this example the trigger position was specified to store the 10 states before the trigger According to your program more states may be required for complete disassembles The emulation analyzer stores execution states of the program in addition to actual bus cycles if configuration item cf tre is enabled When the processor executes an instruction the execution state of the instruction is generated before its bus state s by the execution of the instruction However it is possible that the execution states are inserted after or between the actual bus states of these activities since the clock rate of bus sampling is high speed The following trace listing shows the example that the execution state numbered 64 falls behind its bus activity 00001e05H trans table read kk ok kk kK 00001e85H trans table write Kok Kk kk KK 00000002H data re
79. dalone Configuration If you are operating the emulator in the standalone configuration the only way to get the sample program into emulation memory is by modifying emulation memory locations with the m memory display modification command You can enter the sample program into memory with the m command Transparent Configuration If your emulator is connected between a terminal and a host computer you can download programs into memory using the load command with the o from other port option The load command will accept absolute files in the following formats HP absolute m Intel hexadecimal m Tektronix hexadecimal Motorola S records The examples which follow will show you the methods used to download HP absolute files and the other types of absolute files HP Absolutes Downloading HP format absolute files requires the transfer protocol The example below assumes that the transfer utility has been installed on the host computer HP 64884 for HP 9000 Series 500 or HP 64885 for HP 9000 Series 300 with the lt ESCAPE gt g characters by default these are the characters which temporarily suspend the transparent mode to allow the emulator to receive data or commands Note ui Notice that the transfer command on the host computer is terminated R gt load hbo lt RETURN gt lt RETURN gt transfer rtb cmd_rds X lt ESCAPE gt g EHHH R gt Other Supported Absolute Files The example which follows shows how to dow
80. e mode with the command you Modes entering as with the command m db 30000 The mo display and access mode command is another way to change the default mode For example to display the current modes display 20000H in the current Getting Started 2 21 mode byte define the display mode as word and redisplay 20000H enter the following commands M gt mo mo ab db M gt m 20000 000020000 r 54 M gt mo dw M gt m 20000 000020000 r 53494854 To continue the rest of program M gt r U gt Display the Message_Dest memory locations destination of the message 30004H to verify that the program moved the correct ASCII bytes At this time we want to see correct byte value so db option display with byte is used U gt m db 30004 30023 000030004 r 54 48 49 53 20 49 53 20 4d 45 53 53 41 47 45 20 000030014 r 41 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Search ing The ser search memory for data command is another way to verify Memo ry for Data that the program did what it was supposed to do U gt ser 30000 3003f THIS IS MESSAGE A pattern match at address 000030004 r If any part of the data specified in the ser command is not found no match is displayed No message displayed 2 22 Getting Started Bre aking into the You can use the break b command to generate a break to the Monitor background monitor While the break will occur as soon as possible the actual stopping point may be man
81. e the cov command to display which locations in the program range were accessed Before coverage testing break the emulator into monitor by typing U gt b Getting Started 2 31 The examples which follow use the cov command to perform coverage testing on the sample program Before performing coverage tests reset all coverage bits to non accessed by entering the following command M gt cov r Run the program from the start address 10000H and use the cov command to display how much of the program instructions and data is accessed before any commands are entered M gt r 10000 U gt cov a 10000 1006c 20000 20030 coverage list list of address ranges accessed 000010000 000010033 r percentage of memory accessed 32 9 Now enter the sample program commands A B and an invalid command C will do display the coverage bits for the address range of the sample program after each command You can see that more of the sample program address range is covered after each command is entered U gt m 30000 41 U gt cov a 10000 1006c 20000 20030 coverage list list of address ranges accessed 000010000 00001004f r 000010060 00001006c r 000020000 000020013 r percentage of memory accessed 71 5 As you have entered command A the memory access for the command A process is added to the address ranges Each term of the address ranges displayed is rounded to 4 byte boundaries because the coverage resolution
82. eakpoint hit To display the MMU registers to examine the address space M gt reg mmu atbr1 00002011 atlr1 00000000 atbr0 00002001 atlr0 00000000 atbr3 00000000 atlr3 00000000 reg reg atbr2 00000000 atlr2 00000000 The address space is for Task B No break occurs at the address 40000000 v at Task A You should note this when dealing breakpoints with virtual address Display Privilege The 70632 microprocessor has several privilege registers which can be p P ge reg registers accessed only if the execution level is 0 The level is known as the privilege level You can display the privilege registers by typing M gt reg priv reg isp 00005000 10sp 40002000 11sp 00000000 12sp 00000000 13sp 00000000 tr 00001064 sycw 00002171 tkew 0000e000 pir 00007006 reg sbr 00000000 reg psw2 0000f002 The current values of the privilege registers are displayed Displaying TCB You can display the register SYCW and stack pointers of each level in current TCB Type M gt tcb tkew ATT 7 OTM 0 FIT 0 FZT 0 FVT 0 FUT 0 FPT 0 RDI 0 RD 0 lOsp 40001ff4 Virtual Mode Emulation Topics 3 21 You must designate the register list to display the complete TCB contents of current task with l option The register list specifies registers to be stored to or loaded from TCB when the task is switched The format of the register list is same as the 70632 processor s LDTASK or STTASK instruction operand Since the register list of current task is 7f000000H enter M
83. eakpoint when a 70632 exception is occurred There are two way to detect the 70632 exceptions as follows m Detect the states of the System Base Table Access at Events To specify the breakpoint when the system base table access occurs by an event exception or interrupt enter tg stat base m Detect the states of the Address Range of System Base Table To specify the breakpoint when the address range of the system base table access occurs except for Software Trap and Maskable Interrupt enter tg addr 0 0bf If the program to be tested uses the 70632 Software Trap or Maskable Interrupt or any other trap or exceptions on purpose use the method of Detect the System Base Table Access If the program to be tested accesses the 70632 system base tables which pointed at the SBR register on purpose use the method of Detect the Address Range of System Base Table Now start the trace by typing t Using the Emulator 4 13 Software Breakpoints 4 14 Using the Emulator Software breakpoints are realized by the 70632 BRK instruction When you define or enable a software breakpoint with the bp command the emulator will replace the opcode at the software breakpoint address with a breakpoint interrupt instruction BRK When the BRK instruction is executed the emulator breaks into monitor and compares the address that the break occurred If the address is defined as software breakpoint the emulator displays that the b
84. ecker mode of the emulator is permitted The 70632 emulator can accept the FMST FCHK signal However the emulator does not work as checker The emulator bus is frozen instead So the MSMAT signal will be not generated even if the master CPU should malfunction The emulator can not be changed the mode to master mode by changing external FMST FCHK signal You can not use the any analyzer features in addition to the commands which cause break into the emulation monitor The emulator prompt g gt shows that the emulator is in checker mode In Circuit Emulation Topics 5 11 Note wc The use of the b break command causes the emulator to break into the emulation monitor even though the Restriction to real time runs configuration is enabled cf rrt en If you should do the b command you would be unable to continue the execution of the program Pin State on The probe pins of the emulator are in the following state While the Emulation Probe emulator is running in background the pin states are different according to the configuration item cf dbc Address Bus Foreground Background cf dbc en Background cf dbc dis Data Bus Foreground Background 5 12 In Circuit Emulation Topics Same as 70632 microprocessor Upper 24 bits of the address bus depend on the configuration item cf bbk otherwise you direct the emulator to access target memory When accessing target memory by background monitor same as 70632
85. ector from damage due to impact intoaTa rg et Since the protector is non conductive you may run performance Sy stem verification with no adverse effects when the emulator is out of circuit Caution Protect against static discharge The emulation probe contains devices that are susceptible to damage by static discharge Therefore precautionary measures should be taken before handling the microprocessor connector attached to the end of the probe cable to avoid damaging the internal components of the probe by static electricity Caution g Make sure target system power is OFF Do not install the emulator probe into the target system microprocessor socket with power applied to the target system The emulator may be damaged if target system power is not removed before probe installation 5 2 In Circuit Emulation Topics Caution g Caution g Pin Protector Conductive Pin Guard Make sure pin 1 of probe connector is aligned with pin 1 of the socket When installing the emulation probe be sure that the probe is inserted into the processor socket so that pin 1 of the connector aligns with pin 1 of the socket Damage to the emulator probe will result if the probe is incorrectly installed Protect your target system CMOS components If you target system contains any CMOS components turn ON the target system first then turn ON the emulator Likewise turn OFF your emulator first then turn OFF the target system The target system probe has
86. ed automatically The dual port memory for the emulation memory allows emulation displays and modifications of emulation memory without breaking the processor into the monitor during emulation This is referred to as the Real time Emulation Memory Access capability If you issue emulation memory display modification command while the emulation program is running HP 64700 emulation controller not the emulation processor intends to access the dual port emulation memory with the cycle stealing method The emulation memory accesses without breaking the processor into the monitor are accomplished for this reason When cycle stealing to access to the emulation memory the emulation controller watches for idle cycles in the 70632 bus cycles When the idle cycles are found the emulation controller can access to the emulation memory at the interval of the 70632 bus cycles with cycle stealing However in case that the emulation controller cannot find any idle cycles the emulation controller holds the 70632 bus cycles not but breaking into the monitor in order to access to the emulation memory If your target system inserts some wait states to access to memory no idle cycle may be generated It is depended on WHAT instructions are executed when the emulation memory access command is issued or HOW much wait states are inserted When there is no idle cycle within 160 mS the hold request will be generated to the emulation processor excep
87. em A 10 emulation configuration modifying the default 2 9 emulation feature foreground or background monitor 1 6 out of circuit or in circuit emulation 1 6 emulation memory 1 3 access by target system 2 11 after initialization 2 8 real time access 4 22 size of 2 10 emulation mode 4 21 memory inverse assembler A 9 emulation monitor foreground or background 1 6 monitor 1 6 emulation RAM and ROM 2 11 emulator feature 1 3 purpose 1 1 usage 4 1 emulator configuration after initialization 2 8 drive background cycles to the target system A 10 emulator clock source A 9 enable execution cycles trace A 13 enable NMI input from target system A 12 enable responding to HLDRQ signal A 11 memory inverse assemble type A 9 memory location in background operation A 11 monitor type A 10 on line help for 2 6 real time mode A 9 respond to target bus freeze A 12 respond to target system interrupt A 12 selection of virtual or read address for loading absolute file A 13 trace hold tag A 12 trace virtual or read address A 13 emulator feature analyzer 1 4 breakpoints 1 5 clock speed 1 3 emulation memory 1 3 FPU 1 4 FRM 1 4 MMU 1 4 processor reset control 1 5 register display modify 1 4 restrict to real time runs 1 5 single step processor 1 4 software debugging 1 5 target interface 1 5 emulator probe installing 5 2 enabling NMI input from target system A 12 responding to HLDRQ signal A 11 traci
88. esponding to the execution level need to have the same value The monitor intends to keep the stack pointer SP and the current level stack pointer to have the same value When breaking into monitor the current level stack pointer is modified to the value of SP If you modify registers PSW LOSP LISP L2SP L3SP or SP in monitor note the following m When you modify the EL or IS flag of the PSW the SP is modified to the value of the stack pointer corresponding to the execution level which is determined by the EL or IS flag of the PSW you have modified m When you modify the stack pointer corresponding to the current execution level LOSP LISP L2SP L3SP ISP the stack pointer SP is modified to the same value m When you modify the stack pointer SP the stack pointer corresponding to the execution level LOSP L1SP L2SP L3SP or ISP the one selected depending on the contents of the PSW is modified with the same value Displaying Modifying You can display modify general purpose registers RO through R31 in Registers In floating point format with freg command The IEEE 754 standard data Floating Format Pe is supported To display all general purpose registers in short real format enter freg You can specify register s to be displayed freg r0 r1 To display two consecutive registers RO and R1 in long real format enter freg 1 r0 Modify register RO to the value 12345 678 by typing freg r0 12345 678 Verify
89. ess space a r suffix is not needed because the cov command accepts only real addresses Address expressions with no suffixes are recognized as real address always Modifying ROMed Suppose that while debugging your target system you begin to suspect Code _ a bug in some target ROM code You might want to fix or patch this code before programming new ROMs This can also be done by copying target system ROM into emulation memory with the cim copy target memory image command Once the contents of target ROM are copied into emulation memory you can modify emulation memory to patch your suspected code 5 8 In Circuit Emulation Topics User Interrupts Background Monitor If you use the background monitor interrupts may be suspended or ignored during background operation NMI and INT signal is not passed to the emulator during the background monitor even if the configuration items cf tn and or cf ti are enabled In case that NMI is generated by target system during background operation the NMI is accepted if the NMI signal status is kept asserting low until the transition from background monitor to user program execution In case that INT is generated by target system during background operation the INT is accepted if the INT signal status is kept asserting high until the transition from background monitor to user program execution When an interrupt is generated during single stepping next instruction w
90. executes as if it were part of the target program The monitor program also can execute in background the emulator mode in which foreground operation is suspended so the emulation processor can access target system resources The background monitor does not occupy processor address space The 70632 emulator can be used for both out of circuit emulation and in circuit emulation The emulation can be used in multiple emulation systems using other HP 64700 Series emulators analyzers Getting Started Introduction This chapter lead you through a basic step by step tutorial designed to familiarize you with the HP 64758G H emulator for the 70632 microprocessor in real mode This chapter m Describes the sample program used for this chapter s examples m Shows you how to use the help facility Shows you how to map memory m Shows you how to enter emulation commands to view execution of the sample program The commands described in this chapter include displaying and modifying memory stepping displaying registers defining breaking using software breakpoints tracing program execution copying memory and testing coverage This chapter does not m Describe any virtual mode debbugging informations The description for virtual mode emulation is shown in the Virtual Mode Emulation Topics chapter Getting Started 2 1 Before You beg in Before beginning the tutorial presented
91. feature Only how to trigger the analyzer at some example cases is described in this section To trigger the analyzer when the processor accesses the word data 12345678H at the address 1003H The data bus activity of this cycles will be as follows Sequencer level Address bus Data bus 1 00001003 78XXXXXX 2 00001004 xx123456 To specify the condition of sequencer level 1 enter tif 1 addr 1003 and data 78xxxxxx To specify the condition of sequencer level 2 enter tif 2 addr 1004 and data xx123456 To restart sequencer when any states except for exe state are generated between sequencer term 1 and 2 telif stat exe Start trace by typing t Analyzer Clock The emulation analyzer can capture both the exe states and bus states Speed Using the Emulator 4 7 4 8 Using the Emulator Bus states show actual processor s bus activity Exe states indicate the address of the first byte of an executed opcode Only the address and processor status fields are valid during these states The analyzer has a counter which allows to count either time or occurrence of bus states Tracing both bus cycles and exe states effectively doubles the clock rate to the analyzer If the system clock speed is 20 MHz the analyzer will be collecting states at a rate in maximum 20 MHz By default the analyzer time counter is turned off This is because the analyzer time counter cannot be used at clock speeds greater than 16 MHz The internal emu
92. fies the page table to point to the target memory to be accessed to The page must follows the foreground monitor page For this reason you must set up the address translation tables of two pages for the foreground monitor Monitor Must be Located at the Same Virtual Address Always The foreground monitor must be located at the same virtual address whenever virtual space is changed This allows the emulator to break into monitor in any virtual space Using the Foreground Monitor B 7 An Example Configuration of the Foreground Monitor Modify Monitor Source Program In the following example we will illustrate how to set up the emulator to use the custom foreground monitor in virtual mode For this example we will locate the monitor at 400000000h virtual and 1000h real To use the monitor you must modify the following statement near the top of the monitor program In this example the monitor will be located at 40000000h in virtual text FG_MON gt 0x40000000 Defining System Base Table in Your Program data sys_base word STEP_ENTRY word BRK_ENTRY Defining Address Translation Tables for Monitor Program To use the single step and software breakpoint feature of the emulator you must define the single step trap and breakpoint instruction trap vector into the system base table Assuming that the system table description in your program as follows 00 04 08 Oc S97 3 0 34 The NMI
93. g Started Using Macros Suppose you want to continue stepping through the program displaying registers after each step You could continue entering s commands followed by reg commands but you may find this tiresome It is easier to use a macro to perform a sequence of commands which will be entered again and again Macros allow you to combine and store commands For example to define a macro which will display registers after every step enter the following command M gt mac st s reg Once the st macro has been defined you can use it as you would any other command M gt st s reg 00001000e r MOVEA W 00030004H R1 PC 000010015 r reg pc 00010015 psw 10000000 sycw 00000070 reg r0 00030000 r1 00030004 r2 00000000 r3 00000000 r4 00000000 reg r5 00000000 r6 00000000 r7 00000000 r8 00000000 r9 00000000 reg rl0 00000000 r11 00000000 r12 00000000 r13 00000000 r14 00000000 reg ri5 00000000 r16 00000000 r17 00000000 r18 00000000 r19 00000000 reg r20 00000000 r21 00000000 r22 00000000 r23 00000000 r24 00000000 reg r25 00004040 r26 00000000 r27 00000000 r28 00000000 r29 04420010 reg r30 00000000 r31 00030134 ap 04420010 fp 00000000 sp 00030134 Command Recall The command recall feature is yet another easier way to enter commands again and again You can press lt CTRL gt r to recall the commands which have just been entered If you go past the command of interest you can press lt CTRL gt b to move forward through the list of saved
94. g functions for both 70108 70116 and 70632 Display memory contents in processor mnemonic format m Single stepping m Analyzer trace Displaying Memory The emulator can display contents of memory in mnemonic format for In 70108 70116 both 70108 70116 and 70632 The emulator provides both inverse Mnemonic Format assemblers for 70108 70116 and 70632 You can select one of the inverse assemblers to display memory contents by using configuration item cf mil To display memory contents in 70108 70116 mnemonic change the disassembler by typing cf mil v20_30 Issue the m memory command To display memory contents in 70632 mnemonic default enter cf mil v70 Issue the m memory command Single stepping You can also single step the instructions in the 70108 70116 emulation mode When you single step the instructions mnemonics of the executed instruction is displayed in corresponded processor s ones However when you modify the contents of PSW to change the mode with the reg command a mnemonic of next one instruction is displayed in wrong processor mnemonic Tracing States In You can also trace the bus states and exe states in the 70108 70116 Both Mode emulation mode When tracing the execution of the program Using the Emulator 4 21 Real time Emulation Memory Access 4 22 Using the Emulator mnemonics of the executed instructions are included in trace listing The corresponded processor mnemonics are display
95. he analyzer capture the virtual address enter U gt cf tra vir Or if you want to make the analyzer capture the real address enter U gt cf tra real Before setting a trace specifications initialize the any trace specifications you had changed U gt tinit To trace from the real address 00006000H which is the entry of Task A enter U gt cf tra real U gt tg addr 6000 U gt t Emulation trace started Virtual Mode Emulation Topics 3 25 To display the trace list type U gt t1l 0 24 Line addr H data H uPD70632 Mnemonic H count R 0 00006000 20f43a2d fetch aft br KR Kk AK Ok oe 0000601f 2da000000 No fetch cycle found Hk kkk Kk 2 00006004 2d000000 fetch KOK IK I Kk 3 00006008 0017 438 fetch KOK KK 4 0000600c 8a580000 fetch KOK I KK Ke 5 00006000 8a580000 MOV W 00000020H R26 kkk kkk kkk 6 00006010 002000f3 fetch KOK IK Ke 7 00006014 00 f39840 fetch KOK IK Ke 8 00006007 20400030 MOV W 00000017H R24 KOK Kk Kk 9 00006018 20400030 fetch KOK IK Ke LO 0000601c d 6a0f4f8 fetch KOK IK KK I 00006020 ffffelf2 fetch KOK KK I Kk 2 00006024 000000ff fetch KOK IK Kk 3 00006028 777e5558 fetch Kk Kk Kk 4 00002008 00003103 00003103H trans table read RAK ke 5 0000200c 00000300 00000300H trans table read AK ke 6 00003108 O0000ae85 Q000ae85H trans table read ee ke k k A 00002008 00003103 00003103H trans table read RO IK ke 8 0000200c 00000300 00000300H trans table read Rk AK ke 19 0000310c 0000cf85 0000cf85H trans table read
96. he terminal interface supports the use of HP UX ksh 1 like editing Editing of the command line The default is for the command line editing feature to be disabled to be compatible with earlier versions of the interface Use the cl command to enable command line editing M gt cl e Refer to Command Line Editing in the HP 64700 Series Emulators Terminal Interface Reference for information on using the command line editing feature Modifying Memory The preceding step and register commands show the sample program is executing Read_Input loop where it continually reads the command input byte to check if a command had been entered Use the m memory command to modify the command input byte M gt m db 30000 41 To verify that 41H has been written to 30000H enter the following command M gt m 30000 000030000 r 41 The display mode described in the above Display Memory In Mnemonic Format section also functions when modifying memory contents When memory was displayed in byte format earlier the current display mode was changed to byte The display and access modes from previous commands are saved and they become the defaults In mnemonic current display mode last display mode in b h w and d is used when modifying memory command with no display mode option Specifying the There are a couple of different ways to modify the display and access Access and Display modes One is to explicitly specify th
97. he transfer of the Task A message is executed again The procedures numbered from 2 to 6 are repeated infinitely As a result the address Message_Dest is written the messages of Task A and Task B alternately because the address Message_Dest is same actual memory Virtual Mode Emulation Topics 3 13 Operating System Execution Setup Priviledge Registers Switch to Virtual Setup Tasks Task A Loading the the the Storing Loading the the Storing Loading the the Storing Loading TCB for TCB for TCB for TCB for Task Swit TCB for TCB for Task Swit TCB for Task Swit Task Switching Task A Task B ching Task B Task A ching Task R Task B ching Mode 51717 583b 5843 5078 5084 5088 303c 3068 3 Bb Ft 3888 509c 58b8 58bf 5088 589c 32868 I Wb Ft System Initialization Execution of Task A Task Dispatch Execution of Task B Task Dispatch Execution of Task A Task Dispatch Execution of Task B Task Execution Entry 60288 600 Transfer Task A Message 68lc TRAP instruction 70288 700 Transfer Task B Message 7Olc TRAP instruction 6 1Ff Jump to Task A 6880 600 Transfer Task A Message 6Wlc TRAP instruction Olf Jump to Task B 70GB Entry 700 Transfer Task B Message Figure 3 5 The Execution Flows of the
98. hich will be stepped is the entry of the interrupt handler Foreground Monitor If you use the foreground monitor interrupts are accepted during foreground monitor cycles as same as user program execution However when the emulator breaks into foreground monitor some instructions for monitor are executed in background to transit from user program execution to foreground monitor Interrupts status should be held for these instruction execution The period of transition from user program to monitor is 60 uS When an interrupt is generated during single stepping the instruction will be executed after the execution of the interrupt handler In Circuit Emulation Topics 5 9 DMA Operation The Usage of I O Command Direct memory access to 70632 emulation memory is not permitted The emulator has io command you can manipulate an I O address by using the io command You can specify an I O address in either virtual or real address space as well as the m command There are two I O spaces according to methods for accessing to I O in the 70632 microprocessor The first I O space can be accessed by using an IN OUT instruction In this section this I O space is referred as Isolated I O space distinguish from Memory Mapped I O described below The second I O space can be accessed by simply reading from or writing to the memory The I O space can be mapped to the virtual address space and known as Memory Mapped I O H
99. i 00000000 xatbr3 00000000 xatlr3 00000000 Also display the MMU registers to refer the value of area table register pairs for the current task M gt reg mmu atbr0 00002001 atlr0 00000000 atbr1 00002011 atbr2 00000000 atlr2 00000000 atbr3 00000000 at1lr1 00000000 at1lr3 00000000 Modifying the XMMU Modify the XMMU class registers to the current area table register Class Registers pairs by typing Virtual Mode Emulation Topics 3 23 M gt reg xatbr0 2001 M gt reg xatbr1 2011 There is another way to modify the XMMU class registers as far as you want to modify the registers to the value of the current area table register pairs by using the epmmu command In the above case you didn t have to type the reg command two times because of modifying the registers for the current task You could type the only one command as follows M gt cpmmu To confirm the XMMU class registers modified enter M gt reg xmmu reg mmumod 00000000 reg xatbr0 00002001 xatlr0 00000000 xatbr1l 00002011 xatlr1 00000000 reg xatbr2 00000000 xatlr2 00000000 xatbr3 00000000 xat1lr3 00000000 To make the emulator use the configured address space when you enter a virtual address enter M gt reg mmumod 1 Restart the program from the current PC which is the address the emulator has been broken M gt r U gt Display the memory at the Message_B with the virtual address 40002000H U gt m db 40002000 4000201f You should see 040002000
100. ility to provide you with quick information on the various commands and their options From any system prompt you can enter help or as shown below R gt help help display help information help lt group gt print help for desired group help s lt group gt print short help for desired group help lt command gt print help for desired command help print this help screen VALID lt group gt NAMES gram system grammar proc processor specific grammar sys system commands emul emulation commands tre analyzer trace commands all command groups Commands are grouped into various classes To see the commands grouped into a particular class you can use the help command with that group Viewing the group help information in short form will cause the commands or the grammar to be listed without any description For example if you want to get some information for group gram enter help gram Following help information should be displayed R gt help gram SPECIAL CHARACTERS comment delimiter command separator Ctl C abort signal command grouping UN ascid string ascii string Ctl R command recall Ctl B recall backwards EXPRESSION EVALUATOR number bases t ten y binary q octal o octal h hex repetition and time counts default to decimal all else default to hex operators f amp 4 lt lt lt lt lt gt gt gt gt gt amp ER PARAME
101. ines program codes for the operating system The program instructions from the Sys_Init label to the Setup_Task perform initialization of the operating system The privilege registers are set up and the processor address mode is switched to virtual mode The instructions from the Setup_task to Start_Ini_Task perform initialization for the tasks The stack for each task is set up with initial PC and PSW 3 6 Virtual Mode Emulation Topics The instructions from Start_Ini_Task transfer the execution to initial task Task A The instructions from Sys_Trap perform switching task When a task aborts the execution the processor executes from the address labeled Sys_Trap The instructions store the task execution environment of the aborted task to corresponding TCB update the Current_Task to the another task number to be switched load the TCB and switch the execution Task A Program Code The text_a part defines program codes of Task A This part located at 00006000H through 00006fffH of actual memory address However when Task A is running this part is executed as it is located at 40000000H through 40000fffH by using the on chip MMU Task A transfers a message of character string data from the address labeled Message_A to the address labeled Message_Dest After the transfer the processor executes trap instruction The trap instruction causes the execution aborting into the operating system At this time the execution of Task A is
102. ion A 10 monitor background A 10 B 1 comparison of foreground background B 1 foreground A 10 monitor break cause 4 10 monitor program memory size of 2 10 Motorola S record files downloading 2 15 NMI signal during monitor cycles 5 9 from target system A 12 notes address evaluation without suffix in real mode A 6 break command on FRM system 5 12 default address evaluation in real mode 3 16 emulation memory access from target system 2 11 escape character for the transparent mode 2 15 monitoring bus activity A 11 remove software breakpoints before altering memory map 2 13 software breakpoints 2 23 trace address mode suffix xmmu function 3 28 object file address attribute A 13 on line help using the 2 6 page table entry displaying 3 18 pin state 5 12 predefined equates 2 26 predefined trace labels 2 26 prerequisites for getting started 2 2 privilege register displaying 3 21 prompts 2 7 halted 4 19 help information on 2 7 machine fault 4 19 using es command to describe 2 8 waiting for ready 4 19 pte command 3 18 syntax A 21 purpose of the emulator 1 1 qualifiers analyzer 4 4 RAM mapping emulation or target 2 11 Index 9 10 Index READY from target system 5 7 READY CMB signal 4 19 real address tracing A 13 real time access emulation memory 4 22 real time execution A 9 real time runs 1 5 4 16 recalling commands 2 19 reg register command 2 18 3 18 3 2
103. ion translation translation write to RO read write read write monitor cycle read write with short path read with short path write with short path table access read write table access read table access write M Specifying Trigger Condition at Desired Instruction Execution 4 4 Using the Emulator In the Using the Analyzer section of the Getting Started chapter you used the analyzer to trace the states of the program after that the instruction located at address 10033H was executed Then the following command was issued to specify trigger condition tg addr 10033 and stat exe As you know the 70632 processor has the prefetch unit PFU to prefetch the instruction string to be executed If you had issued the following command instead unexpected trigger would have occurred at the prefetch state of the address 10033H tg addr 10033 This discussion is significant when you specify the trigger condition at the execution of the instruction which follows a branch instruction like 000020012 r CMP B 00H R2 000020016 r BZ 00020000H 000020018 r MOV W 0000000fH RO Assume that the processor executes instructions at address range 20000H through 20016H normally and the instruction at address 20018H is executed at long intervals If you wish to trigger the analyzer at the execution of the address 20018H you should specify trigger condition as follows tg addr 20018 and stat exe If you would type the follo
104. itor still put the emulator into the background mode but the monitor program returns to foreground before performing any functions Specify the real memory location of foreground monitor at the first lt ADDRESS gt term which follows two periods When the foreground monitor is executed in virtual mode specify the virtual location at the second lt ADDRESS gt term The first lt ADDRESS gt term and the second lt ADDRESS gt term must be separated by comma Refer to the Using the foreground monitor appendix Bus Drives During Background Operation You can choose whether emulator bus cycles are driven to your target system bus when the emulator is in background cycle If your target system requires bus cycle activities constantly you will need to drive the emulation bus cycles to your target system bus If en is selected the emulator drives its bus cycles to target system bus whether or not the emulator executed in the background cycles If dis is selected the emulator does not drive any bus cycles to target system bus in background operation By default no bus cycles are driven to the target system in background operation If your target system have some circuitry which monitors bus activities you may need to enable this configuration related configuration bbk Memory Location In Background Operation This configuration item allows you to specify the location of the background monitor program The monitor may be l
105. l the use of foreground Monitor monitor and the location of the monitor to the emulator Configuration Item R gt cf mon fg 1000 40000000 Mapping Memory for Map memory for your program by using map command The monitor Your Program location is already mapped as emulation RAM eram Loading Fo reground Load the foreground monitor program Monitor R gt load fios cat monitor x The linked monitor program monitor x is separated from user program In this example the Intel hexadecimal format and transparent configuration are assumed Using the Foreground Monitor B 9 Loading User Load the target memory portion of your program To load the program Program into target memory the emulator must be running in monitor R gt b M gt load uios cat usr_prog x Next load the emulation portion of your program Since the portion includes the foreground monitor program which is linked to refer to the symbols in this example STEP_LENTRY BRK_ENTRY and NMI_ENTRY the monitor program should not be running Therefore reset the emulator M gt rst R gt load eios cat usr_prog x B 10 Using the Foreground Monitor Index A absolute files downloading 2 14 access emulation memory 4 22 target memory 4 16 access mode specifying 2 21 ACCESS_MODE syntax A 3 address bus background cycles A 11 address mode suffix 3 15 A 5 trace 3 28 ADDRESS syntax A 5 address translation 4 23 address translation tables disp
106. lator Specific Command Syntax A 13 If vir is selected the emulator interprets the location address information in the absolute files as virtual address The default virtual address are used to translate the location address to actual memory address Defaults The default values of the configuration items are listed below cf clk int cf rrt dis cf mil v70 cf mon bg cf dbc dis cf bbk 0 cf th en cf tbhf en cf ti en cf tn en cf trh en cf tre en cf tra real cf loa real Related Commands help You can get an on line help information for particular configuration items by typing R gt help cf lt CONFIG_ITEM gt A 14 Emulator Specific Command Syntax DISPLAY_MODE Summary Specify the memory display format or the size of memory locations to be modified Syntax i i Function The lt DISPLAY_MODE gt n specifies the format of the memory display or the size of the memory which gets changed when memory is modified Parameters b Byte Memory is displayed in a byte format and when memory locations are modified bytes are changed h Halfword Memory is displayed in a halfword format and when memory locations are modified halfwords are changed w Word Memory is displayed in a word format and when memory locations are modified words are changed s Short Float Memory is displayed in a short float format and when memory locations are modified short floats are changed When this display mode used
107. lator clock is 20 MHz when clocking both bus cycles and execution states In addition the analyzer state counter cannot be used at speeds greater than 20 MHz If it is desired to use the analyzer counter one of the following ways can be done m The clock speed can be effectively halved if execution states are NOT traced This is accomplished using the configuration item cf tre dis m The other method is to slow the bus clock using an external clock The internal clock is fixed and is NOT easily changed To trace both bus cycles and exe states the configuration item cf tre should be enabled Issue the following command cf tre en By default the analyzer time tagging or of states counter field in trace listing will be displayed as If you wish to trace both bus cycles and exe states and also wish to use the analyzer tag counter you have the following two alternatives according to the system clock speed 1 If you use the internal system clock or if your target system clock rate is greater than 16 MHz you can use the analyzer state counter Change the mode of the analyzer clock speed to First by entering tck s F The First mode allows you to use the analyzer tag counter as the state counter The analyzer state counter counts occurrences of the states which you specify Assume that you would like to count occurrences of the states which the processor read a data from the address 123456H tceq addr 123456 and st
108. laying 3 18 analyzer 1 4 cause of break 4 10 clock speed 4 8 data trigger 4 7 disassemble 4 5 emulation mode 4 21 execution state 4 4 4 6 hardware break 4 11 qualifiers 4 4 state count 4 8 status label 4 4 time tagging 4 8 tracing virtual address 3 25 analyzer status predefined equates 2 26 area table entry displaying 3 18 assembling and linking foreground monitor B 9 ate command 3 18 syntax A 19 Index 1 2 Index b break command 2 23 background 1 6 background cycle address bus A 11 signals to target system A 10 background monitor A 10 B 1 interrupts 5 9 pin state 5 12 bbk emulator configuration A 11 be break conditions command 2 24 BERR from target system 5 7 BFREZ signal responding A 12 BNC connector 4 19 bp breakpoints command 2 23 break monitor 4 10 target memory access 4 16 break conditions 2 24 after initialization 2 8 breaking into the monitor on trigger 4 11 breakpoints 1 5 2 8 3 17 3 20 hardware 4 11 software 4 14 BRK instruction 2 23 built in foreground monitor B 3 bus masters target system accesses of emulation memory 2 11 cautions installing the probe into socket 5 3 protect against static discharge 5 2 protect your target system CMOS components 5 3 target system power must be off when installing the probe 5 2 use the pin protectors 5 4 characterization of memory 2 11 checksum error count 2 15 cim copy target system mem
109. les cpmmu cpmmu 0 cpmmu 0 1 Emulator Specific Command Syntax A 27 Error and Status The following are error and status messages which are unique to the Message 70632 emulator The following are ERROR messages which are of the form ERROR XXX error message where XXX is the error number 140 146 147 148 149 150 151 152 153 154 155 156 157 Cannot access target memory Not in circuit Unable to load user supplied foreground monitor Area table register pair not valid atbr d Area out of bounds sect x area 03x 03x Area table entry not valid ate x x 08x 08x Page table not exist ate x x Page out of bounds ate x x page 02x 02x Page table entry not valid pte x x x 08x Page not exist s Address translation failed Page mapped as I O port s Page not mapped as I O port s Page locked s A 28 Emulator Specific Command Syntax The following are STATUS messages which are of the form STATUS XXX status message where XXX is the status number 152 Target system has been switched off 153 Target system has been switched on Emulator Specific Command Syntax A 29 Notes A 30 Emulator Specific Command Syntax Using the Foreground Monitor By using and modifying the optional Foreground Monitor you can provide an emulation environment which is customized to the needs of a particular target system Comparison of An emulation monitor is req
110. n part defines common destination of message from both Task A and Task B tasks This part is located at 0000c000H through 0000cfffH of actual memory address Both locations of the Task A and Task B virtual space are at the same address range 40003000H through 40003 fffH The sample program is a multi tasking program There are two tasks and each task has an independent virtual space Figure 3 2 shows the virtual spaces of each task Section 0 which contains the operating system resources is 1 1 mapping at the same address between real address and virtual address The mapping of 3 8 Virtual Mode Emulation Topics section 1 is different between each virtual space for Task A and Task B except for the destination area Figure 3 3 shows the detail of the operating system locations Figure 3 4 shows the detail of the virtual space of each task in Section 1 Virtual Mode Emulation Topics 3 9 Pres ke ee Da 40003Ff fF 428838088 Common 40802800 Task B 4028 1000 Private 40002028 oe ee awe ee E GERREG BagBc fFF QBAGS f FF QQ08c BBB BBBUS5 UBB QQBRbALB 20004 A228 Task B Private Z gZaggg 282803228 System 771717517717 21412172471717 Task A 200882828 BOBO 1088 Task B Private 028807000 7417414114141717 QQ006 2228 ees i 288852828 jaca coe Common B30804008 42002082 System 20003000 Task A 40001088 Private 00002088 4nv000u0 00001000 ea A ES a
111. n Tables for Monitor Program B 8 Assembling and Linking the Foreground Monitor B 9 Setting Up the Monitor ConfigurationItem B 9 Mapping Memory for Your Program B 9 Loading Foreground Monitor B 9 Loading User Program 004 B 10 Index Illustrations Figure 1 1 HP 64758 Emulator for the 70632 1 2 Figure 2 1 Sample Program Listing 2 3 Figure 3 1 Sample Program Listing 3 2 Figure 3 2 Virtual Address Space for Sample Program 3 10 Figure 3 3 Mapping of the Sample Operating System 3 11 Figure 3 4 Mapping of the Tasks 3 12 Figure 3 5 The Execution Flows of the Sample Program 3 14 Figure 5 1 Installing Emulation Probe Into PGA Socket 5 4 Contents 5 Notes 6 Contents Introduction to the 70632 Emulator Introduction The topics in the this chapter include Purpose of the emulator m Features of the emulator Pu rpose of the The 70632 emulator is designed to replace the NEC uPD70632 microprocessor in your target system to help you integrate target 70632 Emulator system software and hardware The 70632 emulator performs just like the NEC uPD70632 microprocessor but at the same time it gives you information about the operation of the processor The emulator gives you control over target system execution and allows you to view or modify the contents of pr
112. nals are driven by 74FCT374A while background cycles except that you direct the emulator to access target memory Otherwise driven by 74FCT373A 74FCT374A 74FCT373A These signals are connected to 74FCT244A and 10 Kohm pull up resistor 4FCT245A ST2 thru STO These signals are connected to 74FCT373A and 1 MRQ Kohm pull up resistor R W FAS B3E thru BOE DLO DL1 5V ST2 ST he en DLI DL MRO RN 74FCT373A B3E Bae BLOCK These signals are connected to 74FCT244A and 1 MSMAT Kohm pull up resistor BCYST BCYEND AOBCY 5V 1kQ BLOCK MSMAT BCYST BCYEND 74FCT244A TOBCY HLDAK This signal is connected PAL20R8 7 and 10 Kohm pull up resistor 5V 1BkQ HLDAK PAL2 R8 A RESET NMI These signals are connected to PAL20R8 7 through INT HLDRQ 47 ohm series resistor and 10 Kohm pull up resistor BFREZ FMST FCHK RESET NMI INT HLDRQ FMST FCHK BFREZ 97Q PAL2 R4 7 In Circuit Emulation Topics 5 15 CLK BERR These signals are connected to 74FCT244A READY RT EP mounted on probe directly CLK BERR READY 74FCT244A MOSZEN These signals are connected to 74FCT244A and 10 108 1016 Kohm pull up resistor 5V pee E 74FCT244A CPBUSY These signals are connected to both of 74FCT373A CPERR and 74FCT374A and 10 Kohm pull up resistor CPEND 5V 18 kQ CPBUSY CPERR 74FCT373A CPEND 74FCT374A 5 16 In Circuit Emul
113. nd access mode Using the Foreground Monitor This appendix describes the advantages and disadvantages of foreground and background monitors and how to use foreground monitors Contents Introduction to the 70632 Emulator Introduci n a sss sete ok Sa es Be eh ts ded Wa hee amp 1 1 Purpose of the 70632 Emulator 1 1 Features of the 70632 Emulator 1 3 Supported Microprocessor 004 1 3 Clock Speeds ies 4 8 ae ee Gee he a Soe Bad he Seer reed 1 3 Emulation Memory 2 000002 eee 1 3 ATIALYSIS es esd ft ol Ace he ee ee ER a hae Ge as 1 4 BRU 2 hin of to a se tala Go aha a ee ae Beale She ia 1 4 MMU oai sacs ee BSG ok a E A i ed a O 1 4 ERM 3 2 a heraa nin th ra eh ie E AE Ba Soe 1 4 Registers tte T ede hth ah ee Soe a Bee ahs 1 4 Single Step sags ead tees em ee ee ee E E N 1 4 Breakpomts ap eraa are ok Gea fo R R oe 1 5 Reset Support eec sese ee eva ee ee ee 1 5 Software Debugging 2 000 1 5 Configurable Target System Interface 1 5 Real Time Operation 00 00 000 1 5 Foreground or Background Emulation Monitor 1 6 Out of Circuit or In Circuit Emulation 1 6 Getting Started Introduction fag S45 SPOS SEES RRE EE aS aA DOA 2 1 Prerequisites x ste Goh th ook ee ol Ai eee Weed Be ah aks 2 2 A Look at the Sample Program 2 2 2 2 00000 2 2 Using the help Facility
114. ng execution cycles A 13 equates predefined for analyzer status 2 26 eram memory characterization 2 12 erom memory characterization 2 12 error messages A 28 es emulator status command 2 8 Index 5 6 Index escape character default for the transparent mode 2 15 exception handler foreground monitor B 3 B 4 EXECUTE CMB signal 4 19 execution cycles tracing A 13 execution state analyzer 4 4 trace 4 6 feature of the emulator 1 3 file formats absolute 2 14 floating point register 4 3 floating point format A 23 foreground 1 6 foreground monitor A 10 B 2 assembling and linking B 9 built in monitor B 3 configuration B 9 custom monitor B 4 interrupt exception handler B 3 B 4 interrupts 5 9 loading the B 9 location A 10 B 3 B 8 pin state 5 12 selecting B 2 FPU 1 4 disassemble 4 17 freg command syntax A 23 FRM 1 4 FRM function 5 11 getting started prerequisites 2 2 grd memory characterization 2 11 guarded memory accesses 2 11 halted 4 19 hardware breakpoints 4 11 help facility using the 2 6 help information on system prompts 2 7 HLDRQ signal responding A 11 hold tracing A 12 HP absolute files downloading 2 15 I O display modify 5 10 in circuit READY BERR RT EP 5 7 in circuit emulation 5 1 init emulator initialization command 2 8 initialization emulator 2 8 cold start 2 9 warm start 2 8 inserting wait state 5 7 instruction execution
115. nk and load the monitor program The foreground monitor provided with assembler source file allows you to customize the foreground monitor as you desire When you use this custom foreground monitor you need to assemble link and load the monitor program The 70632 emulator includes foreground monitor The built in foreground monitor saves your tasks for assembling linking and loading the monitor To use the built in foreground monitor all you have to do is to specify the location of the monitor The location is B 2 Using the Foreground Monitor Interrupt Exception Handler real address entry NMI_ENTRY INT_ENTRY EXC1_ENTRY EXC2_ENTRY STEP_ENTRY BRK_ENTRY specified by the configuration item cf mon fg Specify the monitor location real address as follows R gt cf mon fg lt real_address gt When your application is executed in virtual mode you should also specify the virtual memory location for the monitor The address translation tables for the monitor must be set up R gt cf mon fg lt real_address gt lt virtual_addres s gt After you issued the configuration command the built in foreground monitor is set up automatically The foreground monitor supports interrupt exception handler The interrupt exception handler allows you to break the emulator into monitor when a certain interrupt or exception is generated When you issue the cf mon fg command six equation label pairs are defined These equati
116. nload Intel hexadecimal files but the same method and a different load option can be used to load Tektronix hexadecimal and Motorola S record files as well R gt load io lt RETURN gt lt RETURN gt cat ihexfile lt ESCAPE gt g EEHEHE Data records 00003 Checksum error 00000 R gt Remote Configuration If the emulator is connected to a host computer and you are accessing the emulator from the host computer via a terminal emulation program you can also download files with the load command However in the remote configuration files are loaded from the same port that commands are entered from For example if you wish to download a Tektronix hexadecimal file from a Vectra personal computer you would enter the following commands R gt load t lt RETURN gt After you have entered the load command exit from the terminal emulation program to the MS DOS operating system Then copy your hexadecimal file to the port connected to the emulator for example Getting Started 2 15 Displaying Memory In Mnemonic Format 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 2 16 Getting Started L0000 r L0007 r L000e r 10015 r 10019 r LOO0ld r L0020 r L0023 r 10025 r L0029 r LOO2b r 1002f r 10031 r L0033 r L003a r 10041 r 10043 r L004a r 10051 r L0053 r L005a r 10061 r LO06b r C copy thexfile coml lt RETURN gt Now y
117. o fetch cycle found fetch No fetch cycle found fetch No fetch cycle found No fetch cycle found fetch No fetch cycle found fetch No fetch cycle found fetch aft br fetch fetch fetch fetch fetch MOVEA W 00020011H R3 fetch MOV W 00000011H R4 Line 0 in the trace list above shows the state which triggered the analyzer The trigger state is always on line 0 To list the next lines of the trace enter the following command U gt tl uPD70632 Mnemonic H fetch fetch aft br BR 00010061H fetch fetch fetch fetch fetch MOVCFU B R3 R4 00030004H 30H fetch 54 H data read 48 H data read TARI 54H data write EP H data read 48 H data write aaea 53H data read 49 H data write 20 H data read IISA Nein H data write 49 H data read KKKKKKKKK KKKKKKKKK KKKKKKKKK KKKKKKKKK ee Tee Kee ae KKKKKKKKK KKKKKKKKK KKKKKKKKK KKKKKKKKK KKKKKKKKK a he eK eK KKKKKKKKK KKKKKKKKK KKKKKKKKK KKKKKKKKK KKKKKKKKK KKKKKKKKK KKKKKKKKK KKKKKKKKK KKKKKKKKK KKKKKKKKK KKKKKKKKK KKKKKKKKK KKKKKKKKK KKKKKKKKK kaa KAKA KH KKKKKKKKK KKKKKKKKK KKKKKKKKK KKKKKKKKK KKKKKKKKK RAKE KKKKKKKKK KKKKKKKKK KKKKKKKKK KKKKKKKKK Te KK Te Se KKKKKKKKK KKKKKKKKK KKKKKKKKK Trigger Position You can specify where the trigger state will be positioned with in the emulation trace list The following three basical trigger positions are defined E S start E C center me end When s start trigge
118. ocated on any 4K byte boundary If the lt ADDRESS gt specified is not on a 4K boundary the 4K boundary below the address is used The location of background monitors may be important because background cycles of the 70632 emulator are always visible to the target system In default the monitor is located on 00000H through OOFFFH physical address The lt ADDRESS gt should be specified with no suffix This configuration does not make sense when the Bus Drives During Background Operation configuration is disabled cf dbc dis Note If your target system have some circuitry which monitors bus activities to detect illegal access to resources You may need to relocate monitor address th Allow Target Hold Request Signal This configuration item allows you to specify whether HLDRQ signal from target system is accepted or ignored by the emulator If en is selected the emulator accepts Hold Request from target system If dis is selected the emulator ignores Hold Request When th is set to dis the emulator ignores ALDRQ signal input from target system Emulator Specific Command Syntax A 11 tbf ti tn trh tre A 12 Emulator Specific Command Syntax Allow Target Bus Freeze Signal This configuration item allows you to specify whether BFREZ from target system is accepted or ignored by the emulator If en is selected the emulator accepts BFREZ signal from target system If dis is selected the emulator ignores BFREZ signal
119. ocessor registers and target system memory Introduction 1 1 Ro ese Re 4ee Connection Green Probe Cable Power Switch Target System gt typically contains memory CPU and IZO circuitry Emulator Figure 1 1 HP 64758 Emulator for the 70632 1 2 Introduction Status Right Probe Features of the 70632 Emulator Supported Microprocessor Clock Speeds Emulation Memory The emulator probe has a 132 pin PGA connector The HP 64758G H emulator supports the NEC uPD70632 microprocessor Measurements can be made using the emulator s internal 20 MHz clock or an external clock from 8 MHz to 20 MHz with no wait states added to target memory Depending on the emulator model number there are 512K 1M bytes of emulation memory Memory mapping configuration maps physical memory only If the MMU is enabled the user is responsible for knowing user physical memory usage Dual ported memory allows you to display or modify physical emulation memory without stopping the processor Flexible memory mapping lets you define address ranges over the entire 4 Gbyte address range of the 70632 You can define up to 8 memory ranges at 4 Kbyte boundaries and at least 4Kbytes in length The monitor occupies 4K bytes leaving 508K or 1020K bytes of emulation memory which you may use You can characterize memory ranges as emulation RAM emulation ROM target system RAM target system ROM or as
120. oduction The on chip Memory Management Unit MMU of the 70632 microprocessor translates virtual addresses to physical actual addresses that are placed on the processor address bus This chapter shows you how to use the emulator when the 70632 MMU is active This chapter m Describes the sample program used for this chapter s examples m Shows you how to enter emulation commands to view execution of the sample program The commands described in this chapter include using virtual address expression in command lines displaying on chip MMU registers and privilege registers displaying address translation tables displaying TCB using software breakpoint using XMMU function using the analyzer Sample Prog ram The sample program listed in figure 3 1 is a multi task system which consists of a simple operating system and two tasks Each of two tasks for Virtual Mode transfers its own message from an independent area to a common area Emulation System Base Table The sys_sbt part located at address range 00000000H through OOOOOfffH defines the 70632 Break point instruction trap vector and Virtual Mode Emulation Topics 3 1 mul_task s D K S A N AE KA EE KE EI A E SA E K EA AAN AE E KI KEA E AE Sat UO UO SA NI SASA KI N gJ SA A A A K Nt UOOU0 9 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 0000000
121. on label pairs contain the entry addresses of the handlers which are included in the foreground monitor One of each equation label pair contains real address of the entry the other which has V prefix contains virtual address of the entry The description of these equation label pairs are as follows virtual address entry description VNMI_ENTRY VINT_ENTRY VEXC1_ENTRY VEXC2_ENTRY VSTEP_ENTRY VBRK_ENTRY NMI handler entry INT handler entry 3 words stacking Exception handler entry 4 words stacking Exception handler entry Single Step Trap handler entry Breakpoint Instruction Trap handler entry Either of each equation label pair can be used so that vectors in system base table point to the corresponded handlers if desired The system base table must be defined in your program For using single step and software breakpoint features the single step trap and breakpoint instruction trap handler entries must be set up For example if you wish to use the emulator s single step feature you must define the single step trap handler entry in the corresponded vector table M gt m dd 30 STEP_ENTRY If you use the single step feature in virtual mode you should have entered the following command instead Using the Foreground Monitor B 3 M gt m dd 30 VSTEP_ENTRY According to the system base table location you may have to change the address in this case 30H to be modified Using Custom The custom foreground monitor all
122. or with your program these labels will be referred B 4 Using the Foreground Monitor by your program The system base table must be defined in your program To use the single stepping and or software breakpoints feature s you must define the single step trap vector and or the breakpoint instruction trap vector into the system base table When you use these features in virtual mode you must set up these vectors to point to their handler s entry in the foreground monitor in virtual address Even if you link the monitor with your program you should also prepare the absolute file separated from user program to load the monitor program Loading Fo reg round To load the monitor program enter the following command whether Monitor or not the monitor program is linked with your program R gt load fios cat lt foreground_monitor gt The f option was used to load the foreground monitor program According to file format and terminal configuration the rest options ios may be different You should specify the file name of the foreground monitor absolute separated from your program After loading the monitor map the memory for your program and load your program into the emulator Using the Foreground Monitor B 5 Loading User Program Loading into Target Memory Loading into Emulation Memory To load your program into target memory and emulation memory do the following To load the program into target memory ente
123. ore you can define software breakpoints you must enable software Modifying the Break breakpoints with the be break conditions command To view the Conditions default break conditions and change the software breakpoint condition enter the be command with no option This command displays current configuration of break conditions M gt be be d bp disable bc e rom enable be d bnct disable be d cmbt disable be d trigl disable be d trig2 disable To enable the software breakpoint feature enter M gt bc e bp To confirm modified break condition enter M gt be be e bp enable be e rom enable be d bnct disable be d cmbt disable be d trigl disable be d trig2 disable Defining a Software Now that the software breakpoint feature is enabled you can define Breakpoint software breakpoints Enter the following command to break on the address of the Command_A address 10033H label M gt bp 10033 M gt bp BREAKPOINT FEATURE IS ENABLED bp 000010033 r enabled Run the program and verify that execution broke at the appropriate address M gt r 10000 U gt m db 30000 41 ASYNC_STAT 615 Software breakpoint 000010033 r M gt st 2 24 Getting Started s reg 000010033 r PC 00001003a r reg pc 0001003a reg r0 00030000 reg r5 00000000 reg r1l0 00000000 reg r15 00000000 reg r20 00000000 reg r25 00004040 reg r30 00000000 MOVEA W psw 10000001 r1 00030004 r6 00000000 r11 00000000 r16 00
124. ory image command 5 7 clk emulator configuration A 9 clock source A 9 clock speed 1 3 CMB coordinated measurement bus 4 19 CMOS target system components protecting 5 3 cold start initialization 2 9 combining commands on a single command line 2 18 command groups viewing help for 2 6 command recall 2 19 commands combining on a single command line 2 18 Comparison of foreground background monitors B 1 CONFIG_ITEMS syntax A 8 configuration bbk A 11 clk A 9 dbc A 10 loa A 13 mil A 9 mon A 10 rrt A 9 tbf A 12 th A 11 ti A 12 tn A 12 tra A 13 tre A 13 trh A 12 configuration hardware remote 2 14 standalone 2 14 transparent 2 14 coordinated measurements 4 19 coprocessors target system access of emulation memory 2 11 cov reset display coverage command 2 32 coverage testing 2 31 on ROMed code 5 8 cp copy memory command 2 31 cpmmu command 3 24 syntax A 27 custom foreground monitor B 4 data bus trace 4 7 Index 3 4 Index dbc emulator configuration A 10 demo command 2 10 3 15 disassemble FPU 4 17 trace listing 4 5 disassembler selecting A 9 display mode 2 16 display mode specifying 2 21 DISPLAY_MODE syntax A 15 displaying address translation tables 3 18 T O 5 10 memory emulation mode 4 21 mmu register 3 18 privilege register 3 21 TCB 3 21 DMA 5 10 downloading absolute files 2 14 driving background cycles to the target syst
125. ou can return to the terminal emulation program and verify that the file was loaded For More Information For more information on downloading absolute files refer to the load command description in the HP 64700 Emulators Terminal Interface User s Reference manual Once you have loaded a program into the emulator you can verify that the program has indeed been loaded by displaying memory in mnemonic format R gt m dm 10000 1006c MOV W 00030134H SP MOVEA W 00030000H RO MOVEA W 00030004H R1 MOV B 20H R26 MOV B OH RO MOV B RO R2 CMP B OH R2 BE Z 0001001dH CMP B 41H R2 BE Z 00010033H CMP B 42H R2 BE Z 00010043H BR 00010053H MOVEA W 00020000H R3 MOV W 00000011H R4 BR 00010061H MOVEA W 00020011H R3 MOV W 00000011H R4 BR 00010061H MOVEA W 00020022H R3 MOV W 0000000fH R4 MOVCFU B R3 R4 00030004H 30H BR 00010019H To display in processor mnemonics the dm option was used You can specify one of display modes with the option like this d followed by one character It allows you to display contents of memory in various formats The following display modes are available in the memory display command byte half word 2 bytes word 4 bytes double word 8 bytes short float long float m processor mnemonic aag rT The display mode option which is used last except for s or P is registered as current default display mode
126. out of Real Time Execution FPU Support 0000fe86a r When you specifies virtual addresses in commands the emulator will refer to the address translation tables to translate the virtual addresses to the corresponded real addresses If the address translation tables which are required to translate the specified virtual addresses is in target system memory the address translation will be failed If the real time mode is enabled these resources can only be displayed or modified while running in the monitor The only commands which are allowed to break real time execution are rst reset r run b break The emulation analyzer can capture co processor cycles FPU register display and modification are not supported There are following considerations to display co processor mnemonics in trace or memory display FMOVCR instruction FMOVCR instruction will be displayed as follows FMOVCTW instead of FMOVCR OP1 FCTW FMOVPTW instead of FMOVCR OP1 FPTW FMOVSTW instead of FMOVCR OP1 FSTW Instructions with no operand Dummy operands are displayed when dis assembling instructions without any operand As a sign is displayed just after Opcode mnemonics as follows FRPUSH FRO FRO Using the Emulator 4 17 O0000fe87a r MMU Support 4 18 Using the Emulator Two FRO s are dummy operands The following instructions relate this FADD3M S FADD3M L FADD4M S FADD4M L FSUB3M S FSUB3M L FSUB4M S FSUB
127. ow to Access an Isolated I O space If you would like to manipulate an Isolated I O space which is accessed by using an IN OUT instruction of the microprocessor designate the I O address in real address How to Access a Memory Mapped I O space If you would like to manipulate a Memory Mapped I O space which is accessed by reading from or writing to a memory designate the I O address in virtual address The I O mapped bit of the page table entry which includes the I O address must be set to 1 in other word the address is mapped as I O 5 10 In Circuit Emulation Topics FRM Function When using the emulator for an FRM system there are some restrictions To use the emulator in master mode the checker CPU in your target system should be inactivated so that the checker CPU never generates the MSMAT signals The following are the reasons Some of input signals are not connected to the emulation CPU directly The signals are INT HLDRQ NMI and BFREZ Some bus signals in the monitor operation differ from the actual CPU As far as your FRM system never introduces the INT HLDRQ NMI and BFREZ you may activate the checker CPU In this case note the following m All the memory should be mapped as target ram m External system clock should be selected cf clk ext m Any operations which cause break is never allowed cf rrt en m All you can do is to use the analyzer Besides the transition from master mode to ch
128. ows you to customize the monitor Fore groun d for your target system To use the monitor you need to assemble link b and load the monitor program into emulator monitor The monitor program is provided with HP 64758 emulator You should modify the following statement of the monitor program to specify the monitor location text FG_MON gt 0x000000000 The default monitor location is defined at address 000000000 hex To tell the monitor location to the emulator you should specify the monitor location real address as follows cf mon fg lt real_address gt When your application is executed in virtual mode you should also specify the virtual memory location for the monitor The address translation tables for the monitor must be set up cf mon fg lt real_address gt lt virtual_addres s gt After you issued the configuration command you must load the monitor program into the emulator The memory for the foreground monitor is already mapped when configuring the monitor location Interrupt Exception The foreground monitor supports interrupt exception handler The Handler interrupt exception handler allows you to break the emulator into monitor when a certain interrupt or exception is generated In the foreground monitor program some entry labels of the handlers are defined See the monitor program for these entry labels Write these labels in your program s system base table description When you link the foreground monit
129. periods and another address IDs specifies a range of addresses IDs to display If you specify only the first address IDs of a range followed by two periods and omit the second address IDs of the range four are table entries of the range starting at the first address IDs specified are selected for display Defaults One address or one pair of IDs must be specified Examples ate 12345678 ate i 2 2de Related Commands pte A 20 Emulator Specific Command Syntax pte Summary Syntax Function Parameters Display processor s page table entry for specified address in default virtual address space C pte gt G lt ADDRESS gt lt RETURN gt Kea lt ADDRESS gt J j lt SECT_ID gt G lt RRER_ID gt HG PREL H C 4 Lots lt SECT_ID gt gt RRER_ID gt G lt PAGE_ID gt J The pte command allows you to display a 70632 page table entry for the address which you specify The virtual address space which is used for displaying page table entry depend on the contents of register mmumod and whether the emulator is restricted real time runs When the values which are equivalent to the area table register pairs are invalid or the corresponded area table entry or the corresponded page table entry is invalid or out of bounds error messages will be displayed The values mentioned above are defined by the content
130. r commands should be allowed to cause breaks to the monitor during program execution If en is selected the emulator is restricted execution to real time If dis is selected the emulator is allowed breaks to the monitor during program execution When runs are restricted to real time commands which access target system resources are not allowed For the commands which is refused when runs are restricted to real time refer to the Target Memory Access section of chapter 4 Select Memory Inverse Assembler This configuration item allows you to specify inverse assembler for either 70108 70116 or 70632 microprocessor The 70632 microprocessor has the 70108 70116 emulation mode In this mode the 70632 executes the instruction as 70108 70116 microprocessor s one Emulator Specific Command Syntax A 9 mon dbc A 10 Emulator Specific Command Syntax The emulator provides both inverse assemblers for 70108 70116 and 70632 If v70 is selected the 70632 inverse assembler is used when you display memory in mnemonic format If v20_30 is selected the 70108 70116 inverse assembler is used when you display memory in mnemonic format Monitor Options This configuration item is used to select the type of monitor to be used by the emulator If bg background monitor is selected all monitor functions are performed in background If fg foreground monitor is selected all monitor functions are performed in foreground Breaks to the mon
131. r position is selected the trigger is positioned at the start of the trace list You can trace the states after the trigger state When center trigger position is selected the trigger is positioned at the center of the trace list You can trace the states around the trigger state When e end trigger position is selected the trigger is positioned at the end of the trace list You can trace the states before the trigger In the above section you have traced the states of the program after a certain state because the default trigger position was s start If you want to trace the states of the program around a certain state you need to change the trigger position For example if you wish to trace the transition to the command A process change the trigger position to center and specify the trigger condition To specify the trigger position issue the tp command like this U gt tp c Specify the trigger condition by typing U gt tg addr 10033 and stat exe Issue the trace command to start the trace U gt t Emulation trace started Modify the command input byte to A and display the trace status again U gt m db 30000 41 U gt ts Emulation Trace Status NEW User trace complete Arm ignored Trigger in memory Getting Started 2 29 Arm to trigger States 1024 1024 512 511 Sequence term 2 Occurrence left 1 The trace status shows that the trigger has been found Enter the following command
132. r the following commands R gt b M gt load uios cat lt user_program gt The first command b cause the emulator to break into the monitor For loading into target memory the emulator must be running in monitor The u option specify to load only target memory portion of the program To load the program into emulation memory enter the following commands M gt rst R gt load eios cat lt user_program gt The first command rst causes the emulator to reset For loading into emulation memory which includes monitor program portion the emulator must be reset The e option specifies to load only emulation memory portion of the program B 6 Using the Foreground Monitor Restrictions and When using the foreground monitor there are some restrictions and Considerations considerations Cannot Single step the Instruction RETIS and RETIU The foreground monitor cannot step the RETIS and RETIU instruction If you step either the RETIS or RETIU instruction the emulator cannot break into monitor As a result the emulator runs your program without stepping Two Pages for the Monitor Program Must be Set Up When you use the foreground monitor in virtual mode the address translation tables for the foreground monitor must be set up The monitor occupies one page 4 Kbytes memory and further one more page is required for accessing to target memory In virtual mode when accessing to target memory the monitor modi
133. reakpoint hit The emulator disable the breakpoint and replace the BRK instruction with the original opcode If the BRK interrupt was generated by a BRK interrupt instruction in the target system execution still breaks to the monitor and an undefined breakpoint status message is displayed To continue with program execution you must run or step from the target program s breakpoint interrupt vector address There are some attentions when you use the software breakpoint features Software breakpoints should be set at only locations which contain instruction opcodes You must only set software breakpoints at memory locations which contain instruction opcodes not operands or data If a software breakpoint is set at a memory location which is not an instruction opcode the software breakpoint instruction will never be executed and the break will never occur Software breakpoints should be set when the emulator is running in monitor Software breakpoints should not be set enabled disabled or removed while the emulator is running user code If any of these commands are entered while the emulator is running user code and the emulator is executing code in the area where the breakpoint is being modified program execution may be unreliable Software breakpoints cannot be set in target ROM Because software breakpoints are implemented by replacing opcodes with the BRK instructions you cannot define software breakpoints in target RO
134. riods and Defaults One address or one pair of IDs must be specified Examples pte 12345678 pte i 2 2de Related Commands ate A 22 Emulator Specific Command Syntax freg Summary Display and modify the 70632 general purpose registers using floating point format Syntax lt RETURN gt Ereg lt GR_NAME gt A gt lt F_VALUE gt J Function The freg command allows you to display and modify the 70632 general purpose register contents The general purpose registers RO through R31 may be displayed or modified in short or long format combinations of display and modify or short and long formats are permitted on the same command line Parameters lt GR_NAME gt The lt GR_NAME gt parameter allows you to specify a specific register to display or modify The valid register names are the following registers rO r1 r2 r3 r4r5 r6r7 r8 r9 r10 r11 r12 r13 r14 r15 r16 r17 r18 r19 r20 r21 r22 r23 r24 r25 r26 r27 r28 r29 r30 r31 lt F_VALUE gt To modify a register s contents supply the new contents in the lt F_VALUE gt variable This is a floating point value S Specifies the display or modification format as short floating point format Emulator Specific Command Syntax A 23 Specifies the display or modification format as short floating point format If l option is specified you can not specify register r31 in the lt GR_NAME gt Defaults If no lt GR_NAME gt is
135. rt initialization additionally performance verification tests are run The c option also specifies a cold start initialization except that performance verification tests are not run Using The Default Emulation configuration is needed adapting to your specific development To view the items of emulation configuration enter Emulation a z Configuration R gt help cf You will see cf display or set emulation configuration cf display current settings for all config items cf lt item gt display current setting for specified lt item gt cf lt item gt lt value gt set new lt value gt for specified lt item gt cf lt item gt lt item gt lt value gt lt item gt set and display can be combined help cf lt item gt display long help for specified lt item gt VALID CONFIGURATION lt item gt NAMES clk select internal external clock source rrt enable disable restriction to real time runs mil selection of memory inverse assembler mon selection of a foreground or background monitor dbc en dis drive of background cycles to the target system bbk select memory block during background operation th en dis Target HLDRQ signal tbf en dis Target BFREZ signal Ea en dis Target INT signal tn en dis Target NMI signal trh en dis emulation analyzer tag of the bus hold handshake tre en dis emulation analyzer trace execution cycles tra select virtual real addres
136. s mode which is required to evaluate the addresses is determined as follows 1 When the processor is reset the addresses are evaluated as real address 2 When the processor never runs in virtual mode after reset the addresses are evaluated as real address 3 Once the processor has run in virtual mode after reset the addresses are evaluated as virtual address Note If the processor has ever run in virtual mode since the processor was reset the address expression without suffix is evaluated as virtual address even if the processor is running in real mode If you specify a virtual address in a command the emulator has to translate the virtual address which you have specified to the real address The method of the address translation is same as the actual 70632 microprocessor In this case the emulator use the current value of the 70632 address table register pairs ATBRO ATLRO ATBR1 to translate the address by default The details of the address translation are shown in chapter 4 3 16 Virtual Mode Emulation Topics Setting Breakpoints First set the software breakpoints at the entry of both tasks The real g p p y in Real Address address of Task A entry is 00006000H and Task B is 00007000H Enter the following commands R gt bc e bp R gt bp 6000 R gt bp 7000 The address expressions used in the above commands have no suffix The emulator recognized the address as real because the processor is reset You could al
137. s of either caches or XMMU class registers Refer to the Virtual Address Translation section of chapter 4 i The i option allows you to specify the page table entry by using section ID area ID and page ID lt ADDRESS gt Specifies the virtual address which belongs to the page based on the page table entry You cannot specify the address with real address by adding suffix r If you specify the address with no suffix the address is interpreted as virtual The only bits 20 to 31 of the lt ADDRESS gt are effective Emulator Specific Command Syntax A 21 Refer to the lt ADDRESS gt syntax pages in this chapter lt SECT_ID gt Specifies the ID number of the section which includes the page pointed by the page table entry lt SECT_ID gt is a hexadecimal value from 0 to 3 lt AREA_ID gt Specifies the ID number of the area which includes the page pointed by the page table entry lt AREA_ID gt is a hexadecimal value from 0 to 3ff lt PAGE_ID gt Specifies the ID number of the page pointed by the page table entry lt PAGE_ID gt is a hexadecimal value from 0 to Off another address IDs specifies a range of addresses IDs to display If you specify only the first address IDs of a range followed by two periods and omit the second address IDs of the range four are table entries of the range starting at the first address IDs specified are selected for display Note wc As noted in the syntax an address IDs followed by two pe
138. s trace loa select virtual real address for file loading To view the current emulation configuration enter R gt cf Getting Started 2 9 As you have initialized the emulator the emulation configuration items have the default value So you should see the default configuration values as follows cf clk int cf rrt dis cf mil v70 cf mon bg cf dbc dis cf bbk 0 cf th en cf tbhf en cf ti en cf tn en cf trh en cf tre en cf tra real cf loa real Since the default configuration is sufficient to execute the sample program you don t have to change any configuration items in this tutorial Loading Firmware For convenience of demonstration two sample programs are included ple prog in the emulator one for this chapter and the other for next chapter Sample Prog rams Usually you need to map memory and load program into the memory after configuring the emulator You don t have to enter the commands in the following two sections Mapping Memory and Loading the Sample Program into Emulation Memory sections Enter the following command instead R gt demo 1 The demo command performs the same as the commands will do However you should read through the sections to learn how to map memory and load program for debugging your development Mapping Memory Depending on the emulator model number emulation memory consists of 512K or 1M bytes mappable in 4K byte blocks The monitor occupies 4K bytes leaving 508
139. so enter the addresses using the r suffixes such as 6000 r and 7000 r To confirm the breakpoints set type R gt bp BREAKPOINT FEATURE IS ENABLED bp 000006000 r enabled bp 000007000 r enabled Running the Sam ple Start the program from address 00005000H by typing the following Program command R gt r 5000 ASYNC_STAT 615 Software breakpoint 040000000 v M gt You will see the execution has stopped at virtual address 40000000H which is one of the breakpoints you set Because the processor ran in virtual mode the address which caused breaking into monitor was displayed in virtual address Displaying the CPU You can confirm the CPU is in virtual mode type Address Mode M gt reg sycw reg sycw 00002171 You can find the bit 0 of SYCW register is set This bit indicates the CPU is in virtual mode Which Breakpoint You will be unable to find which breakpoint has been hit in this Has Hit information because the virtual address 40000000H corresponds to both real addresses 00006000H and 00007000H Virtual Mode Emulation Topics 3 17 To show the breakpoint status type M gt bp BREAKPOINT FEATURE IS ENABLED bp 000006000 r disabled bp 000007000 r enabled Now you can find the breakpoint is the real address 00006000H because it is disabled The address is the entry of the program Task A Displaying MMU To display the on chip MMU registers enter Registers M gt reg mmu reg atbr0 00002
140. specified all of the general purpose registers are displayed in short float format The s option is in effect if no option is specified If one of the options is specified you cannot omit the lt GR_NAME gt Examples freg freg freg freg freg freg Related Commands reg A 24 Emulator Specific Command Syntax s 1 s 1 rO ri r2 r30 r0 123 456 r0 1 23456e 10 r0 5678 123 s r3 987 543 tcb Summary Display processor s TCB of specified address in default virtual address space Syntax C tcb gt lt RETURN gt Ge ae eae Function The tcb command allows you to display the task control block Parameters l The l option allows you to specify the register list to display the complete TCB contents lt REG_LIST gt Specifies the register list to display the complete TCB contents with l option The register list specifies registers to be stored to or loaded from TCB when the task is switched The format of the register list is same as the 70632 processor s LDTASK or STTASK instruction operand lt REG_LIST gt is a value from 0 to O7fffffff hex lt ADDRESS gt Specifies the address which is the base address of the TCB to be displayed Refer to the lt ADDRESS gt syntax pages in this chapter Defaults If no option is specified only the contents of register SYCW and stack pointers for each level in the current TCB are displayed If lt ADDRES
141. splay the destination area once again Type M gt m db 40003000 4000301f 040003000 v 54 61 73 6b 20 42 20 3a 20 52 75 6e 6e 69 6e 67 040003010 v 2e 2e 2e 20 20 20 20 20 20 20 20 20 20 20 20 20 You will find the message of Task B is transferred Enabling Breakpoints You can enable or disable the software breakpoints which was set with in Virtual Address real addresses by using virtual addresses Enter the following command M gt bp e 40000000 To display the breakpoint enabled enter M gt bp BREAKPOINT FEATURE IS ENABLED bp 000006000 r disabled bp 000007000 r enabled As the virtual address 40000000H in the current virtual space corresponds to the real address 00007000H the 7000 r is enabled To enable or disable the breakpoint with real address add the suffix r Enter M gt bp e 6000 r M gt bp BREAKPOINT FEATURE IS ENABLED bp 000006000 r enabled bp 000007000 r enabled Setting Breakpoints Remove the all breakpoints enter in Virtual Address M gt bp r 3 20 Virtual Mode Emulation Topics Verify that the all breakpoints are removed by typing M gt bp BREAKPOINT FEATURE IS ENABLED Set the breakpoint at the address 40000000 v and verify it Enter M gt bp 40000000 M gt bp BREAKPOINT FEATURE IS ENABLED bp 040000000 v enabled Run the program from current PC enter M gt r 615 Software breakpoint 040000000 v ASYNC_STAT The emulator displays that the br
142. states and bus states are captured by the emulation analyzer You will see the disassembles of executed instructions in trace listing Lines with disassembles indicate exe states of the instructions If dis is selected only bus states are captured by the emulation analyzer When you display trace listing the emulator disassembles with fetch states and their disassembled processor mnemonics is displayed at the fetch states which are the first byte of the instructions In this mode the analyzer can trace with time tagging or of states counter Refer to the Using the Emulator chapter for more details of the analyzer features tra Selection of Virtual or Real Address Trace This configuration item allows you to specify whether analyzer should trace virtual address or real address If real is selected the analyzer captures real address bus which is the same that the actual microprocessor outputs to If vir is selected the analyzer captures virtual address loa Selection of Virtual or Real Address for Loading Absolute File This configuration item allows you to specify whether the emulator should load absolute files into virtual address or real address when you use the load command In other words you can specify that in which address space the address location information are recorded in the absolute files If real is selected the emulator interprets the location address information in the absolute files as real address Emu
143. stopped until next dispatch by the operating system Task B Program Code The text_b part defines program codes of Task B This part is at 00007000H through 00007fffH of actual memory address Under the Task B virtual space this part is executed as it is at 40000000H through 40000fffH as same as Task A Task B does same as Task A except for the message data which is located at address labeled Message_B Task A Data The data_a part defines the message transferred by Task A This part located at 0000a000H through O0000afffH of actual memory address Under the Task A virtual space location of this part is recognized as 40002000H through 40002fffH Virtual Mode Emulation Topics 3 7 Multiple Virtual Space of the Sample Program Task B Data The data_b part defines the message transferred by Task B This part located at 0000b000H through OOOObfffH of actual memory address Under the Task B virtual space location of this part is recognized as 40002000H through 40002fffH as same as Task A Task A Stack The stack_a part at 00008000H through OOOO8fffH of actual memory address defines stack of Task A The location of the Task A virtual space is at 40001000H through 40001 fffH Task B Stack The stack_b part at 00009000H through 00009fffH of actual memory address defines stack of Task B The location of the Task B virtual space is at 40001000H through 40001fffH as same as Task A Common Destination Area The commo
144. t address with optional function codes Address range format is any of the following XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX fec XXXXXXXX fc XXXXXXXX fc Emulation Status Characters R emulator in reset state c no target system clock U running user program r target system reset active M running monitor program h halt or machine fault W waiting for CMB to become ready w waiting for target ready T waiting for target reset b no bus cycles g frozen or held or in checker mode i invalid virtual cpu unknown state Equates for Analyzer Label stat base system base table coproc co processor cycle coprd co processor read copwr co processor write data data cycle datard data read datawr data write exe instruction execution fetch instruction fetch fetchbr fetch after branch fault machine fault grd guarded access halt halt acknowledge hold hold tag int interrupt acknowledge io io cycle iord io read iowr io write lock bus lock mon background cycle retry retry cycle short data short cycle shortrd data short read shortwr data short write trans translation table transrd trans table read transwr trans table write wrrom write to rom Getting Started 2 7 N70632 Running user program Using the Emulation Status Command es for Description of Current Prompt When using the emulator you will notice that the prompt changes after entering cert
145. t that the emulator is held bus frozen or reset Virtual Address When you specify virtual addresses in emulation commands the emulator intends to translate these virtual addresses to actual memory Translation addresses in order to manipulate contents of these memory locations For the address translation the 70632 microprocessor uses its area table register pairs which define a virtual address space Similarly the emulator requires values which corresponds to the 70632 area table register pairs Using the Caches of The emulator has the caches of the area table register pairs which Area Table Register allow the emulator to refer the corresponded area table for the address Pairs translations even if the emulator cannot to or is not allowed to break into the monitor Each time the emulator breaks into monitor the caches are updated by the contents of the 70632 area table register pairs By default the emulator uses the caches to translate the addresses which you specify in emulation commands The caches contain the base addresses and the lengths of the area tables as the same as the 70632 area table register pairs The emulator refers to the corresponded area table and page table by using the caches If the emulator is restricted to real time runs by the cf rrt en configuration command the caches will keep the values while you do not break the emulator into the monitor intentionally Only when you issue b s or rst comm
146. tains the TCB managed under the processor for one of the tasks This task will be called as Task A in this example The task number mentioned above is 0 The address labeled TCB_B contains the TCB for the other task which will be called as Task B The task number is 1 Virtual Mode Emulation Topics 3 5 Area Table Entry The ate part at address range 00002000H through 00002fffH defines the 70632 Area Table Entry The address labeled ATEO contains Area Table Entry ATE in Section O In this example Section 0 is a common part between Task A and Task B Section 0 has one area The address labeled ATE1_A and ATE1 _B contains ATE in Section 1 for each task Section 1 is independent between Task A and Task B ATEL1 A is for Task A and ATE1_B is for Task B Section 1 has one area each other Page Table Entry The pte part at address range 00003000H through 00003fffH defines the 70632 Page Table Entry The address labeled PTEO contains Page Table Entry PTE in Section 0 Area 0 This area has six pages The addresses labeled PTE1_A and PTE1_B contains PTE in Section 1 Area 0 for each task PTE1_A is for Task A and PTE1_B is for Task B Each area has four pages System Stack The sys_stk part at address range 00004000H through 00004fffH defines a stack for the operating system The stack is pointed by the register ISP System Program Code The sys_text part at address range 00005000H through 00005fffH def
147. tatic discharge protecting the emulator probe against 5 2 status label analyzer 4 4 status messages A 28 step emulation mode 4 21 suffix A 5 address mode 3 15 target interface 1 5 target memory access 4 16 Index 11 12 Index target system signals during background cycles A 10 target system interface 5 14 target system RAM and ROM 2 12 tbf emulator configuration A 12 TCB displaying 3 21 tcb command 3 21 syntax A 25 Tektronix hexadecimal files downloading 2 15 tg specify simple trigger command 2 27 th emulator configuration A 11 ti emulator configuration A 12 time tagging 4 8 tinit command 3 25 tl trace list command 2 27 tlb display modify trace labels command 2 26 tn emulator configuration A 12 tp specify trigger position command 2 29 tra emulator configuration A 13 trace cause of break 4 10 clock speed 4 8 data trigger 4 7 disassemble 4 5 emulation mode 4 21 even address 2 27 execution cycles A 13 execution state 4 6 hold tag A 12 resetting the trace specification 3 25 state count 4 8 time tagging 4 8 virtual address 3 25 virtual or real address A 13 trace labels predefined 2 26 tram memory characterization 2 12 transfer utility 2 15 translation table displaying 3 18 transparent configuration 2 14 transparent mode 2 15 tre emulator configuration A 13 trh emulator configuration A 12 trigger breaking into monitor on 4 11 specifying a simple
148. the breakpoint status type M gt bp You can find the breakpoint of the real address 00007000H is disabled The address is the entry of program Task B To display the on chip MMU registers the ATE and PTE corresponding with address 40000000H enter M gt reg mmu reg atbr0 00002001 atlr0 00000000 atbr1 00002011 atlri 00000000 reg atbr2 00000000 atlr2 00000000 atbr3 00000000 atlr3 00000000 M gt ate 40000000 1 000 at 000002010 Present PTB 000003200 Limit 003 Growth positive Execute level 0 Write level 0 Read level 0 M gt pte 40000000 1 000 000 at 000003200 Present Page base 000007000 Executable Writable Readable Not modified Accessed User 0 Not locked A few differences can be found from the results of the commands in Task A virtual space which you entered This is the another virtual space for Task B Let s look at the execution of Task B The Program Counter PC points to the entry of Task B Task B will transfer its message to the destination area To display the destination area enter M gt m db 40003000 4000301f 040003000 v 54 48 49 53 20 49 53 20 54 41 53 4b 20 41 20 4d 040003010 v 45 53 53 41 47 45 2e 20 20 20 20 20 20 20 20 20 The message of Task A remains here Virtual Mode Emulation Topics 3 19 Step the three instructions by typing M gt s 3 040000000 v MOV W 00000020H R26 O40000007 v MOV W 00000013H R24 04000000e v MOVCFU B 40002000H R24 40003000H PC 04000001cev To di
149. the trigger condition the trigger will never occur and will never break The break condition on trig1 that you have enabled should be disabled when you use the analyzer in order to only trace states of your program If you neglect and issue t trace command the execution of the program will break at the trigger you have specified unexpectedly Using the Emulator 4 11 Example Configuration for Hardware Breakpoints Features 4 12 Using the Emulator The following are example configurations for typical break conditions you will use Breaks on Executing an Instruction If you wish to break the execution when an instruction is executed To specify the breakpoint when the instruction at address 12345678H is executed tg addr 12345678 and stat exe Start the trace by typing t Breaks on Accessing an Address If you wish to break the execution when a certain data is written to a certain memory location To specify the breakpoint when the halfword data OabcdH is written to the address 87654321H tg addr 87654321 and data 0xxabcdxxH and stat write Start the trace by typing t The detail of analyzer data specification in the trigger condition is described in Specifying Data For Trigger Condition or Store Condition part of this section Breaks on 70632 Exceptions In case that you test a simple program which does not have exception handler you want to break the emulator on a 70632 exception It is useful to specify the br
150. tion System to Insert Wait However the emulator may optionally respond to the target system States READY BERR RT EP lines while emulation memory is being accessed You can specify whether the emulation memory accesses are honored by these target system signals or not in a memory mapping term When you map emulation memory with map command if you would like to cause the emulation memory to honor these target system signals add lock attribute after an emulation memory type For example to map the address range 00000000H through OOOOffffH as emulation rom which accepts these signals from your target system enter R gt map 0 0ffff erom lock When the ready relationship is locked to the target system by adding lock attribute in a map command the emulation memory accesses honor READY BERR RT EP signals from the target system wait states or retry cycles are inserted if requested If you do not specify the lock attribute in a map command the ready relationship is not locked to the target system and the emulation memory accesses ignore these signals from the target system no wait states are inserted Ta rg et ROM The descriptions in this section are of emulation tasks which involve Debu g T opi cs ee target ROM The tasks described below are made possible y the cim copy target system memory image command The cim command allows you to read the contents of target memory into the corresponding emulation memory lo
151. ubject to restrictions as set forth in subparagraph c 1 ii of the Rights in Technical Data and Computer Software Clause at DFARS 252 227 7013 Hewlett Packard Company 3000 Hanover Street Palo Alto CA 94304 U S A Rights for non DOD U S Government Departments and Agencies are as set forth in FAR 52 227 19 c 1 2 Printing History New editions are complete revisions of the manual The date on the title page changes only when a new edition is published A software code may be printed before the date this indicates the version level of the software product at the time the manual was issued Many product updates and fixes do not require manual changes and manual corrections may be done without accompanying product changes Therefore do not expect a one to one correspondence between product updates and manual revisions Edition 1 64758 97000 August 1990 Edition 2 64758 97004 April 1993 Using This manual This manual is designed to give you an introduction to the HP 64758G H 70632 Emulator This manual will also help define how these emulators differ from other HP 64700 Emulator This manual will m give you an introduction to using the emulator m explore various ways of applying the emulator to accomplish your tasks m show you emulator commands which are specific to the 70632 Emulator This manual will not m tell you how to use each and every emulator analyzer command refer to the User s Reference manual
152. uired to service certain requests for Fore groun d and information about the target system and the emulation processor For example when you request a register display the emulation processor Ba ckg round is forced into the monitor The monitor code has the processor dump Monitors its registers into certain emulation memory locations which can then be read by the emulator system controller without further interference Backg round Monitors A background monitor is an emulation monitor which overlays the processor s memory space with a separate memory region Usually a background monitor will be easier to work with in starting a new design The monitor is immediately available upon powerup and you don t have to worry about linking in the monitor code or allocating space for the monitor to use the emulator No assumptions are made about the target system environment therefore you can test and debug hardware before any target system code has been written All of the processor s address space is available for target system use since the monitor memory is overlaid on processor memory rather than subtracted from processor memory Processor resources such as interrupts are not taken by the background monitor However all background monitors sacrifice some level of support for the target system For example when the emulation processor enters the monitor code to display registers it will not respond to target system interrupt requests This
153. use of the break display the previous states If the trace listing does not include the fundamental problem you need to change the trigger condition to capture the problem and then restart the trace and the program This is also useful to detect the causes other than monitor breaks like a processor halt Hardware The analyzer may generate a break request to the emulation processor Breakpoints ae up a break condition upon an analyzer trigger follow the steps Specify the Signal Driven when Trigger is Found Use the tgout trigger output command to specify which signal is driven when the analyzer triggers Either the trig1 or the trig2 signal can be driven on the trigger tgout trigl Enable the Break Condition Enable the trig1 break condition be e trigl Additionally you can see the program states before the breakpoint in trace listing Specify the trigger position at the end of trace listing by typing tp e After you specify the trigger to drive trig1 and enable the trig1 break condition set up the trace issue the t trace command and run the program When the trigger condition is found emulator execution will break into the emulation monitor Then you can also see the trace listing mentioned above enter the following commands Stop the trace by typing th Display the twenty states at the end of the trace listing by typing tl 19 0 The trace listing will show the cause of the break Without
154. use the analyzer feature of the emulator If signal is asserted by your target system the emulator bus signals are held So the emulator does not work as checker You can display or modify the 70632 internal CPU register contents This includes the ability to modify the program counter PC value so you can control where the emulator starts a program run You can also display or modify the 70632 MMU register contents You can direct the emulation processor to execute a single instruction or a specified number of instructions Breakpoints Reset Support Software Debugging Configurable Target System Interface Real Time Operation You can set the emulator analyzer interaction so the emulator will break to the monitor program when the analyzer finds a specific state or states allowing you to perform post mortem analysis of the program execution You can also set software breakpoints in your program With the 70632 emulator setting a software breakpoint inserts a 70632 BRK instruction into your program at the desired location The emulator can be reset from the emulation system under your control or your target system can reset the emulation processor The HP 64758G H Real Time Emulator for 70632 microprocessors is a powerful tool for both software and hardware designers Using the HP 64758G H Emulator s emulation memory up to 512 Kilo 1 Mega bytes software debugging can be done without functional target system memory You
155. utine If you specify that be e rom and if microproccessor generates invalid memory write cycle described above in user s program the emulator break into the monitor In Circuit Emulation Topics Introduction Many of the topics described in this chapter involve the commands which relate to using the emulator in circuit that is connected to a target system This chapter will m Describe the issues concerning the installation of the emulator probe into target systems m Show you how to install the emulator probe m Describe how to set up the emulator to use a target system clock Describe how to use software breakpoints with ROMed code how to perform coverage testing on ROMed code and how to test patches to ROMed code These topics relate to the debugging of target system ROM m Describe target interrupts m Describe DMA operation m Describe how to access to target I O resource m Describe FRM function m Describe Target Interface In Circuit Emulation Topics 5 1 Pre requ isites Before performing the tasks described in this chapter you should be familiar with how the emulator operates in general Refer to the Concepts of Emulation and Analysis manual and the Getting Started chapter of this manual Installing the The emulator probe has a PGA connector The emulator probe is also provided with a conductive pin protector to protect the delicate Emu lator Probe gold plated pins of the probe conn
156. v 54 61 73 6b 20 42 20 3a 20 52 75 6e 6e 69 6e 67 040002010 v 2e 2e 2e 00 9f eb b5 5f 54 5c 60 41 55 55 15 5c Display the translation tables at the virtual address 40000000H by typing U gt ate 40000000 1 000 at 000002010 Present PTB 000003200 Limit 003 Growth positive Execute level 0 Write level 0 Read level 0 U gt pte 40000000 1 000 000 at 000003200 Present Page base 000007000 Executable Writable Readable Not modified Accessed User 0 Not locked The contents of the tables displayed should be the execution environment of Task B 3 24 Virtual Mode Emulation Topics The XMMU function also allows you to specify breakpoints with virtual addresses in a desired address space by using the XMMU function even though the processor is executed in the other virtual address space Besides by using the reg command the mmumod register is reset when the emulator breaks into monitor in the following causes m Break by software breakpoint m Break by single stepping m Break by writing to ROM m Break by access to guarded memory In these case the mmumod register is reset to 0 As the result the address translation of the virtual address in a command uses the actual area table register pairs Using the Analyzer Regardless of address mode addresses which the analyzer captures are real addresses by default You can select which address the analyzer should capture by changing the configuration item cf tra If you want to make t
157. wing the trigger will always occur at the prefetch of the address 20018H whether or not the branch condition at address 20016H is satisfied tg addr 20018 Disassembles In As you can see disassembles in analyzer trace listing the emulator has Trace Listing disassemble capability in trace listing When the emulator disassembles instructions in stored trace information the prefetch cycles of each instruction are required In the Using the Analyzer section of the Getting Started chapter you configured the analyzer to trace the states of the program after the read states of address 30000H and data 0xxxxxx42H by typing U gt tp s U gt tg addr 30000 and data 0xxxxxx42 U gt t When you displayed the results of analyzer trace some lines which include No fetch cycle found messages were displayed Each line was instruction execution cycle at the address in the left side of the line However the disassembles of these instructions were not displayed because the prefetch states for the instructions were not stored by the analyzer To display complete disassembles in trace listing you should modify location of trigger state in trace list referred to as the trigger position with tp command See the tp command syntax in the HP 64700 Emulators Terminal Interface Reference manual The trigger position was at the start of the trace listing because you wished to trace the states of the program after the triggered state tp s comman
158. y Access FPU Support MMU Support Coordinated Measurement Unfamiliar Prompts 70118 70116 Emulation Mode FRM Support Real time Emulation Memory Access Virtual Address Translation Restrictions and Considerations Using the Emulator 4 1 Prerequisites Register Manipulation Stack Pointer Modification 4 2 Using the Emulator Before performing the tasks described in this chapter you should be familiar with how the emulator operates in general Refer to the Concepts of Emulation and Analysis manual and the Getting Started and Virtual Mode Emulation Topics chapters of this manual In the 70632 microprocessor one of the five privileged registers LOSP LISP L2SP L3SP ISP is selected as stack pointer according to the EL and IS flags of the PSW and the stack pointer is cached by SP The contents of the stack pointer corresponding to the execution level are not always the same as the stack pointer SP The stack pointer corresponding to the execution level is updated only when the execution level is changed The emulation monitor is executed in execution level 0 When the emulator returns from emulation monitor to user program for example when you issue r run command the emulator changes execution level from 0 to user program s execution level which is determined by the IS flag and EL field in the program status word PSW For this reason in emulation monitor the stack pointer SP and the stack pointer corr
159. y cycles after the break request depend on the type of instruction being executed and whether the processor is in a hold state U gt b M gt Using Software Software breakpoints are realized by the 70632 BRK instruction Breakp oints When you define or enable a software breakpoint with the bp command the emulator will replace the opcode at the software breakpoint address with a breakpoint interrupt instruction BRK If the BRK interrupt was generated by a software breakpoint execution breaks to the monitor and the breakpoint interrupt instruction BRK is replaced by the original opcode A subsequent run or step command will execute from this address Note wc When using software breakpoints feature of the emulator you must define the BRK instruction vector to point to an address where instruction fetches is allowed typically in the program code area In this sample program the BRK instruction vector points to a HALT instruction When a software breakpoint occurs the emulator reads the BRK interrupt vector push the next PC PSW and a word of exception code to stack fetch one word of instruction pointed by the vector same as the actual CPU And then break occurs but the instruction HALT in this example will never be executed There are some notices to use the software breakpoints features Refer to the Software Breakpoints section of the Using the Emulator chapter Getting Started 2 23 Displaying and Bef

Download Pdf Manuals

Related Search

Related Contents

Case Department of Occupational and Environmental Safety  SUC - Bosch Industriekessel GmbH  World Machine 2 User`s Manual 1. An Introduction to World Machine 2  Emerson 92S Instruction Manual  Lowrance electronic X-28 User's Manual  ORCHID - Stefan Matyba  溶接形オリフィス  世界最小クラス気中遮断器  取扱説明書 (6.25 MB/PDF)  

Copyright © All rights reserved. Failed to retrieve file