You are on page 1of 72

PPC400/PPC440 Debugger and Trace

TRACE32 Online Help


TRACE32 Directory
TRACE32 Index
TRACE32 Documents ......................................................................................................................

ICD In-Circuit Debugger ................................................................................................................

Processor Architecture Manuals ..............................................................................................

PPC400/PPC440 .......................................................................................................................

PPC400/PPC440 Debugger and Trace ................................................................................

Brief Overview of Documents for New Users .................................................................

Warning ..............................................................................................................................

Target Design Requirement/Recommendations ............................................................

General

Quick Start JTAG ...............................................................................................................

Troubleshooting ................................................................................................................

10

SYStem.Up Errors

10

FAQ .....................................................................................................................................

11

PPC400

11

PPC440

15

RISC Trace

22

Configuration .....................................................................................................................
System Overview

23
23

ICD Trace Extension for PPC400 (ICT) ............................................................................

24

General Fact for PPC403 RiscTrace Use

24

Debugging and Trace Mode

24

What does the PPC403 Trace Mode provide?

24

Used Options for RiscTrace

25

CPU specific Implementations .........................................................................................

26

General Restrictions

26

Breakpoints

26

Software Breakpoints

26

On-chip Breakpoints

27

Breakpoint Restrictions

27

Breakpoint in ROM

27

Example for Breakpoints

28
1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

Memory Classes

29

Memory Coherency

29

General SYStem Commands ............................................................................................


SYStem.BdmClock

30

Select the used CPU

30

Run-time memory access (intrusive)

30

SYStem.CPU
SYStem.CpuAccess
SYStem.LOCK

Lock and tristate the debug port

31

Real-time memory access (non-intrusive)

31

Select operation mode

32

Configure debugger according to target topology

33

SYStem.MemAccess
SYStem.Mode
SYStem.CONFIG

30

Set JTAG clock frequency

Daisy-chain Example

35

TapStates

36

SYStem.CONFIG.CORE

Assign core to TRACE32 instance

37

CPU specific SYStem Commands ...................................................................................

38

SYStem.Option CLOCKX2

Selects the clock for the real-time trace

SYStem.Option DCFREEZE

38

Freeze contents of cache while debugging

38

SYStem.Option DCREAD

Read from data cache

39

SYStem.Option DMALOW

Switch DMA to low priority

39

Stop timer in user mode

39

SYStem.Option FREEZERUN
SYStem.Option FREEZEBDM

Stop timer in debug mode

39

SYStem.Option FLOWTRACE

Prepare CPU for real-time trace

40

Execute more instructions per cycle

40

Compare PC to hook address

40

SYStem.Option FOLDING
SYStem.Option HOOK
SYStem.Option ICFLUSH

Invalidate instruction cache

42

SYStem.Option ICREAD

Read from instruction cache

42

Enable multiple address spaces support

42

Disable HALT line

42

SYStem.Option MMUSPACES
SYStem.Option NoJtagHalt

Use alternative instruction to enter debug mode

43

SYStem.Option OVERLAY

SYStem.Option NOTRAP

Enable overlay support

44

SYStem.Option ResetMode

Selects the reset mode

44

Skip additional checks/waits

45

BenchMarkCounter ...........................................................................................................

46

CPU specific TrOnchip Commands .................................................................................

47

SYStem.Option TURBO

TrOnchip.view

Setup window

47

Adjust range breakpoint in on-chip resource

48

TrOnchip.DISable

Disable NEXUS trace register control

48

TrOnchip.ENable

Use CPU internal trigger logic

48

Set on-chip trigger to default state

49

Trigger sources

49

Set filter for the trace

49

TrOnchip.TOFF

Switch the sampling to the trace to OFF

49

TrOnchip.TON

Switch the sampling to the trace to ON

50

TrOnchip.CONVert

TrOnchip.RESet
TrOnchip.Set
TrOnchip.TEnable

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

TrOnchip.TTrigger

Set a trigger for the trace

TrOnchip.VarCONVert

50

Adjust complex breakpoint in on-chip resource

50

Switches mode for data breakpoints

50

CPU specific MMU Commands ........................................................................................

52

TrOnchip.SYNCHRONOUS

MMU.DUMP

Page wise display of MMU translation table

52

Compact display of MMU translation table

53

MMU.SCAN

Load MMU table from CPU

54

MMU.FORMAT

Define MMU table structure

55

Create a TLB entry on the TARGET

56

Debug Connector ..............................................................................................................

60

MMU.List

MMU.Set.TLB

Mechanical Description

60

JTAG Connector PPC401/403/405 and IOP480

60

Mictor Connector PPC440

60

Trace Connectors ..............................................................................................................

61

Mictor Connector 38 pin (Version B) for PPC440

61

Mictor Connector 38 pin (Version B) for PPC405

62

Connector 20 pin (Version A) for PPC405 (obsolete)

62

Mictor Connector 38 pin (Version B) for PPC403

63

Connector 20 pin (Version A) for PPC403

63

Support ...............................................................................................................................
Available Tools

64
64

Compilers

66

Realtime Operation Systems

67

3rd Party Tool Integrations

68

Products .............................................................................................................................

69

Product Information

69

Order Information

71

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

PPC400/PPC440 Debugger and Trace


Version 24-May-2016

B::Data.List
addr/line
code
P:FFF021C0 39400000
P:FFF021C4 915F0018
567
P:FFF021C8
P:FFF021CC
P:FFF021D0
P:FFF021D4

39200000
2C890012
40850008
4800001C

B::Register
R0
0
R1
0FFFFFFD8
R2
0
R3
0
R4
0
R5
0
R6
0
R7
0
SPRG0
0
SPRG1
0
SPRG2
0

label

mnemonic
li
stw

comment
r10,0
r10,18(r31)

for ( i = 0 ; i <= SIZE ; flags[ i++ ] = TRUE ) ;


li
r9,0
; i,0
cmpwi
cr1,r9,12
; cr1,i,18
ble
cr1,0FFF021D8
b
0FFF021F0

R8
R9
R10
R11
R12
R13
R14
R15
SRR0
SRR1
SRR2

0
0
0
0
0
0
0
0
0
0
0

B::PER
EXISR 80000000 CIS pending
D0IS wait
E0IS wait

S
D
E

Input
Output Configuration
IOCR 00000000 E0T level E1T level E2T le
E0L negative E1L negative
RDM disabled TCS sysclk
S
Bank 0
BR0
FF183FFE BAS 0FF00000

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

SRIS wait
D1IS wait
E1IS wait

BS 1MB

BU rea

Brief Overview of Documents for New Users


Architecture-independent information:

Debugger Basics - Training (training_debugger.pdf): Get familiar with the basic features of a
TRACE32 debugger.

T32Start (app_t32start.pdf): T32Start assists you in starting TRACE32 PowerView instances


for different configurations of the debugger. T32Start is only available for Windows.

General Commands (general_ref_<x>.pdf): Alphabetic list of debug commands.

Architecture-specific information:

Processor Architecture Manuals: These manuals describe commands that are specific for the
processor architecture supported by your debug cable. To access the manual for your processor
architecture, proceed as follows:
-

Choose Help menu > Processor Architecture Manual.

RTOS Debugger (rtos_<x>.pdf): TRACE32 PowerView can be extended for operating systemaware debugging. The appropriate RTOS manual informs you how to enable the OS-aware
debugging.

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

Brief Overview of Documents for New Users

Warning
ESD Protection

NOTE:

To prevent debugger and target from damage it is recommended to connect or


disconnect the debug cable only while the target power is OFF.
Recommendation for the software start:
1.

Disconnect the debug cable from the target while the target power is
off.

2.

Connect the host system, the TRACE32 hardware and the debug
cable.

3.

Power ON the TRACE32 hardware.

4.

Start the TRACE32 software to load the debugger firmware.

5.

Connect the debug cable to the target.

6.

Switch the target power ON.

7.

Configure your debugger e.g. via a start-up script.

Power down:
1.

Switch off the target power.

2.

Disconnect the debug cable from the target.

3.

Close the TRACE32 software.

4.

Power OFF the TRACE32 hardware.

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

Warning

Target Design Requirement/Recommendations

General
Locate the JTAG connector as close as possible to the processor to minimize the capacitive influence of
the trace length and cross coupling of noise onto the BDM signals.

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

Target Design Requirement/Recommendations

Quick Start JTAG


Starting up the Debugger is done as follows:
1.

Select the device prompt B: for the ICD Debugger, if the device prompt is not active after starting
the TRACE32 software.
b:

2.

Select the CPU type to load the CPU specific settings.


SYStem.CPU PPC403gcx

3.

Map the EPROM simulator (optional).


MAP.ROM 0x0--0x1FFFF

4.

Tell the debugger wheres FLASH/ROM on the target.


MAP.BOnchip 0x100000++0x0fffff

This command is necessary for the use of on-chip breakpoints.


5.

Enter debug mode


SYStem.Up

This command resets the CPU and enters debug mode. After this command is executed it is possible
to access memory and registers.
6.

Set the chip selects to get access to the target memory.


Data.Set

7.

Load the program.


Data.LOAD.Elf GNU603

; ELF specifies the format, GNU603 is


; the file name)

The option of the Data.LOAD command depends on the file format generated by the compiler. For
information on the compiler options refer to the section Compiler. A detailed description of the
Data.LOAD command is given in the General Commands Reference.

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

Quick Start JTAG

The start up can be automated using the programming language PRACTICE. A typical start sequence is
shown below:
b::

; Select the ICD device prompt

WinCLEAR

; Delete all windows

MAP.BOnchip 0x100000++0x0fffff

; Specify wheres FLASH/ROM

SYStem.CPU 403gcx

; Select the processor type

SYStem.Up

; Reset the target and enter debug


; mode

Data.LOAD.Elf GNU403

; Load the application

Register.Set PC main

; Set the PC to function main

Data.List

; Open disassembly window *]

Register /SpotLight

; Open register window *)

Frame.view /Locals /Caller

; Open the stack frame with


; local variables *)

Var.Watch %Spotlight flags ast

; Open watch window for variables *)

PER.view

; Open window with peripheral register


; *)

Break.Set sieve

; Set breakpoint to function sieve

Break.Set 0x1000 /Program

; Set software breakpoint to address


; 1000 (address 1000 is in RAM)

Break.Set 0x101000 /Program

;
;
;
;

Set on-chip breakpoint to address


101000 (address 101000 is in ROM)
For the PPC603e refer to the
restrictions in On-chip Breakpoints.

*) These commands open windows on the screen. The window position can be specified with the WinPOS
command.

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

Quick Start JTAG

Troubleshooting

SYStem.Up Errors
The SYStem.Up command is the first command of a debug session where communication with the target is
required. If you receive error messages while executing this command this may have the following reasons.
All

The target has no power.

All

The pull-up resistor between the JTAG/COP[VCCS] pin and the target VCC
is too large.

All

The target is in reset:


The debugger controls the processor reset and use the RESET line to reset
the CPU on every SYStem.Up.

All

There is logic added to the JTAG/COP state machine:


The debugger supports only one processor on one JTAG chain. Only the
debugged processor has to be between TDI and TDO in the scan chain. No
further devices or processors are allowed.

All

There are additional loads or capacities on the JTAG lines.

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

10

Troubleshooting

FAQ

PPC400
Debugging via
VPN

The debugger is accessed via Internet/VPN and the performance is very


slow. What can be done to improve debug performance?
The main cause for bad debug performance via Internet or VPN are low data
throughput and high latency. The ways to improve performance by the debugger
are limited:
in practice scripts, use "SCREEN.OFF" at the beginning of the script and
"SCREEN.ON" at the end. "SCREEN.OFF" will turn off screen updates.
Please note that if your program stops (e.g. on error) without executing
"SCREEN.OFF", some windows will not be updated.
"SYStem.POLLING SLOW" will set a lower frequency for target state
checks (e.g. power, reset, jtag state). It will take longer for the debugger to
recognize that the core stopped on a breakpoint.
"SETUP.URATE 1.s" will set the default update frequency of Data.List/
Data.dump/Variable windows to 1 second (the slowest possible setting).
prevent unneeded memory accesses using "MAP.UPDATEONCE
[address-range]" for RAM and "MAP.CONST [address--range]" for ROM/
FLASH. Address ranged with "MAP.UPDATEONCE" will read the specified
address range only once after the core stopped at a breakpoint or manual
break. "MAP.CONST" will read the specified address range only once per
SYStem.Mode command (e.g. SYStem.Up).

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

11

FAQ

Setting a
Software
Breakpoint fails

What can be the reasons why setting a software breakpoint fails?


Setting a software breakpoint can fail when the target HW is not able to
implement the wanted breakpoint.
Possible reasons:
The wanted breakpoint needs special features that are only possible to
realize by the trigger unit inside the controller.
Example: Read, write and access (Read/Write) breakpoints ("type" in Break.Set
window). Breakpoints with checking in real-time for data-values ("Data").
Breakpoints with special features ("action") like TriggerTrace, TraceEnable,
TraceOn/TraceOFF.
TRACE32 can not change the memory.
Example: ROM and Flash when no preparation with FLASH.Create,
FLASH.TARGET and FLASH.AUTO was made. All type of memory if the
memory device is missing the necessary control signals like WriteEnable or
settings of registers and SpecialFunctionRegisters (SFR).
Contrary settings in TRACE32.
Like: MAP.BOnchip for this memory range. Break.SELect.<breakpoint-type>
Onchip (HARD is only available for ICE and FIRE).
RTOS and MMU:
If the memory can be changed by Data.Set but the breakpoint doesn't work it
might be a problem of using an MMU on target when setting the breakpoint to a
symbolic address that is different than the writable and intended memory
location.

IOP480
Wrong Reset
Address

Why does the reset vector of the IOP480 not point to the reset vector of the
401 core?
In the default setting for the PPC400 family the option
SYStem.Option.ResetMode.SYSTEM is chosen. After SYStem.Up the PC
points to the address of the last session or to any other address. Use the
SYStem.Option.ResetMode.CHIP or SYStem.Option.ResetMode.CORE,
because the system reset is not implemented on the IOP480.

PPC400

Why does the connection to the target fails?

Connection to
Target Fails

When connecting to XILINX targets be sure to use a recent version of the debug
cable (see picture).
With the old version of the debug cable target connection will fail or be
unreliable.

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

12

FAQ

PPC4XX
Emulation
Debug Port
Problem

On system.up I got emulation debug port problem.


The JTAG protocol is not running on a good physical connection.
There are two possiblities can cause this. The VCCS pin is not connected
directly at CPU VCC.
The T32 debugger has an internal 1kOhm pull-down for a safe detection of
target power on/off.
As result of this voltage divider (the internal 1kOhm pull-down and the target
pull-up) the ICD detects a wrong target voltage and disables the output drivers if
the detected voltage is lower than the voltage for a HIGH detection.
Replace the pull-up by a 10 Ohm resistor.
The JTAG signals are not terminated or have some overtalk.
Put a 1 kOhm pull-down at TCK, TMS and TDI.

PPC4XX
Software
Breakpoints
Problem

Error message: software breakpoints not possible with current system


setting
One reason for this error message is that the option sys.o.icflush is OFF. Without
being able to flush the ICache the debugger cannot write software breakpoints.
Use the following command to allow the debugger to flush the ICache after
writing a SW breakpoint:
sys.o.icflush ON

PPC4xx
Stepping over
TLBWE
instruction
Virtex-PPC400
Flow Errors

Virtex-PPC400
Flow Errors
while Tracing
works

Stepping over TLBWE instruction result in another program flow as in run


mode.
There is a difference between stepping and running over a

Why does the debugger show only flow errors?


In contrast to most PPC405 cores, the PPC405 in Xilinx Virtex devices uses the
falling edge for clocking out trace data. Add an inverter for the trace clock to your
design as illustrated in the application note app_xilinx_ppc400.pdf.
Why do flow errors exist while ML310 tracing works?
In some samples of ML310 the GND plane in the middle of the mictor is not
connected to the GND signal of the board. The floating GND connection will
cause flow errors, especially at higher frequencies.
To fix the problem establish a proper GND connection on the board. To work
around the problem temporarily, it may help to vary the detected threshold (e.g.
from 1.3 V to 1.1 V).
Also be sure that your design contains an inverter for the trace clock (see
above).

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

13

FAQ

VIRTEXPPC405
ISOCM Access
in Xilinx
VirtexFX Chips

How can I enable access to ISOCM memory in Xilinx VirtexFX chips?


For accessing the ISOCM memory (instruction side OCM) attached to the
PPC405 in Xilinx VirtexFX chips, a special access mechanism via DCR is
required. This mechanism is only available from Virtex4 onwards. It is not
supported in Virtex2Pro.
For enabling the ISOCM access in Trace32 use the option
sys.o.isocm BASEADDR
where BASEADDR is the beginning of the ISOCM memory. The default value is
0xFFFF.FFFF (disabled).
The feature requires Trace32 SW from 2006-10-20 or later.

Virtex-PPC4XX
Debugging and
Tracing
Embedded
PPC Cores in
Xilinx FPGAs

How should I connect TRACE32-ICD JTAG connector to a Xilinx target?


What are the correct IRPRE/IRPOST and DRPRE/DRPOST settings?
This document describes for Xilinx Virtex chips how to:
Calculate the multicore pre/post settings
Debug the embedded PPC405/PPC440 cores
Trace the program flow of PPC405/PPC440 cores
NOTE: In some cases the application advises to use the CPU setting
"VirtexPPC". You will need a SW from May 2006 or later for this. If your SW does
not offer this setting, you need to get an update. Any attempt to use PPC405F or
PPC405D instead will fail and is a waste of time. To debug PPC440 cores in a
Virtex5 (e.g. SYStem.CPU Virtex5PPC, PPC440G, ...) will need SW newer than
March 2008.

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

14

FAQ

PPC440
Debugging via
VPN

The debugger is accessed via Internet/VPN and the performance is very


slow. What can be done to improve debug performance?
The main cause for bad debug performance via Internet or VPN are low data
throughput and high latency. The ways to improve performance by the debugger
are limited:
in practice scripts, use "SCREEN.OFF" at the beginning of the script and
"SCREEN.ON" at the end. "SCREEN.OFF" will turn off screen updates.
Please note that if your program stops (e.g. on error) without executing
"SCREEN.OFF", some windows will not be updated.
"SYStem.POLLING SLOW" will set a lower frequency for target state
checks (e.g. power, reset, jtag state). It will take longer for the debugger to
recognize that the core stopped on a breakpoint.
"SETUP.URATE 1.s" will set the default update frequency of Data.List/
Data.dump/Variable windows to 1 second (the slowest possible setting).
prevent unneeded memory accesses using "MAP.UPDATEONCE
[address-range]" for RAM and "MAP.CONST [address--range]" for ROM/
FLASH. Address ranged with "MAP.UPDATEONCE" will read the specified
address range only once after the core stopped at a breakpoint or manual
break. "MAP.CONST" will read the specified address range only once per
SYStem.Mode command (e.g. SYStem.Up).

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

15

FAQ

Setting a
Software
Breakpoint fails

What can be the reasons why setting a software breakpoint fails?


Setting a software breakpoint can fail when the target HW is not able to
implement the wanted breakpoint.
Possible reasons:
The wanted breakpoint needs special features that are only possible to
realize by the trigger unit inside the controller.
Example: Read, write and access (Read/Write) breakpoints ("type" in Break.Set
window). Breakpoints with checking in real-time for data-values ("Data").
Breakpoints with special features ("action") like TriggerTrace, TraceEnable,
TraceOn/TraceOFF.
TRACE32 can not change the memory.
Example: ROM and Flash when no preparation with FLASH.Create,
FLASH.TARGET and FLASH.AUTO was made. All type of memory if the
memory device is missing the necessary control signals like WriteEnable or
settings of registers and SpecialFunctionRegisters (SFR).
Contrary settings in TRACE32.
Like: MAP.BOnchip for this memory range. Break.SELect.<breakpoint-type>
Onchip (HARD is only available for ICE and FIRE).
RTOS and MMU:
If the memory can be changed by Data.Set but the breakpoint doesn't work it
might be a problem of using an MMU on target when setting the breakpoint to a
symbolic address that is different than the writable and intended memory
location.

APM86190
APM86x90
verus
APM86x90B
APM86190
Protected
Access Error

APM86190
SYS.Detect.CP
U
ApmPacketPro
Single/Dual

What is the difference between APM86x90 and APM86x90B?


Use CPU selection APM86x90 for -> Rev A (primary silicon)
Use CPU selection APM86x90B for -> Rev B,C,D,E (all newer one)

What does an "Protected Access Error" mean?


Section Memory Controller initialization of User Guide: After Reset the
Memory Queue, Memory Controller and DDR PHY are hold in Reset and clocks
are disabled. Any request on the PLB Bus designating DRAM or one of the
above Peripherals (ERPN 0x0 to 0x3) will cause an infinite stall of the CPU
(=>RESET). Furthermore the L2 Cache can not be enables (L2COBE) before
the above mentioned Peripherals are out of Reset and working. A such situation
is guarded by an "Protected Access Error". The Memory views addressing
ERPN 0x0 to 0x3 (PLB5) are unlocked as soon as the clock gating is enabled
and the reset is deasserted.
Why does SYStem.Detect.CPU detect an ApmPacketProSingle/Dual and
not the correct CPU derivative.
Many devices of the APM86xxx family share common JtagIDs which do not
allow to distinguish between the single derivatives. As a solution a general
ApmPacketProSingle/Dual device is detected to allow general debugging.
1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

16

FAQ

APM86190
SYStem.Up/
InTargetReset
with APM86xxx

APM86190B
APM86x90
verus
APM86x90B
APM86290
APM86x90
verus
APM86x90B
APM86290
Protected
Access Error

APM86290

The SYStem.Up/InTargetReset doesn't work with an APM86xxx device!


The contents of the memory views are wrong.
Some Revisions of the APM86xxx family need a special handling for Reset. As a
rule of thumb the Revison A e.g. of an APM86x90 requires an
SYStem.Option.ResetMode CHIP while the later revisions require an
SYStem.Option.ResetMode SYSTEM.
What is the difference between APM86x90 and APM86x90B?
Use CPU selection APM86x90 for -> Rev A (primary silicon)
Use CPU selection APM86x90B for -> Rev B,C,D,E (all newer one)

What is the difference between APM86x90 and APM86x90B?


Use CPU selection APM86x90 for -> Rev A (primary silicon)
Use CPU selection APM86x90B for -> Rev B,C,D,E (all newer one)

What does an "Protected Access Error" mean?


Section Memory Controller initialization of User Guide: After Reset the
Memory Queue, Memory Controller and DDR PHY are hold in Reset and clocks
are disabled. Any request on the PLB Bus designating DRAM or one of the
above Peripherals (ERPN 0x0 to 0x3) will cause an infinite stall of the CPU
(=>RESET). Furthermore the L2 Cache can not be enables (L2COBE) before
the above mentioned Peripherals are out of Reset and working. A such situation
is guarded by an "Protected Access Error". The Memory views addressing
ERPN 0x0 to 0x3 (PLB5) are unlocked as soon as the clock gating is enabled
and the reset is deasserted.
Why does SYStem.Detect.CPU detect an ApmPacketProSingle/Dual and
not the correct CPU derivative.

SYS.Detect.CP
U
ApmPacketPro
Single/Dual

Many devices of the APM86xxx family share common JtagIDs which do not
allow to distinguish between the single derivatives. As a solution a general
ApmPacketProSingle/Dual device is detected to allow general debugging.

APM86290

The SYStem.Up/InTargetReset doesn't work with an APM86xxx device!

SYStem.Up/
InTargetReset
with APM86xxx

The contents of the memory views are wrong.


Some Revisions of the APM86xxx family need a special handling for Reset. As a
rule of thumb the Revison A e.g. of an APM86x90 requires an
SYStem.Option.ResetMode CHIP while the later revisions require an
SYStem.Option.ResetMode SYSTEM.

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

17

FAQ

APM86290B
APM86x90
verus
APM86x90B
APM86491
Protected
Access Error

APM86491

What is the difference between APM86x90 and APM86x90B?


Use CPU selection APM86x90 for -> Rev A (primary silicon)
Use CPU selection APM86x90B for -> Rev B,C,D,E (all newer one)

What does an "Protected Access Error" mean?


Section Memory Controller initialization of User Guide: After Reset the
Memory Queue, Memory Controller and DDR PHY are hold in Reset and clocks
are disabled. Any request on the PLB Bus designating DRAM or one of the
above Peripherals (ERPN 0x0 to 0x3) will cause an infinite stall of the CPU
(=>RESET). Furthermore the L2 Cache can not be enables (L2COBE) before
the above mentioned Peripherals are out of Reset and working. A such situation
is guarded by an "Protected Access Error". The Memory views addressing
ERPN 0x0 to 0x3 (PLB5) are unlocked as soon as the clock gating is enabled
and the reset is deasserted.
Why does SYStem.Detect.CPU detect an ApmPacketProSingle/Dual and
not the correct CPU derivative.

SYS.Detect.CP
U
ApmPacketPro
Single/Dual

Many devices of the APM86xxx family share common JtagIDs which do not
allow to distinguish between the single derivatives. As a solution a general
ApmPacketProSingle/Dual device is detected to allow general debugging.

APM86491

The SYStem.Up/InTargetReset doesn't work with an APM86xxx device!

SYStem.Up/
InTargetReset
with APM86xxx

APM86692
Protected
Access Error

APM86692
SYS.Detect.CP
U
ApmPacketPro
Single/Dual

The contents of the memory views are wrong.


Some Revisions of the APM86xxx family need a special handling for Reset. As a
rule of thumb the Revison A e.g. of an APM86x90 requires an
SYStem.Option.ResetMode CHIP while the later revisions require an
SYStem.Option.ResetMode SYSTEM.
What does an "Protected Access Error" mean?
Section Memory Controller initialization of User Guide: After Reset the
Memory Queue, Memory Controller and DDR PHY are hold in Reset and clocks
are disabled. Any request on the PLB Bus designating DRAM or one of the
above Peripherals (ERPN 0x0 to 0x3) will cause an infinite stall of the CPU
(=>RESET). Furthermore the L2 Cache can not be enables (L2COBE) before
the above mentioned Peripherals are out of Reset and working. A such situation
is guarded by an "Protected Access Error". The Memory views addressing
ERPN 0x0 to 0x3 (PLB5) are unlocked as soon as the clock gating is enabled
and the reset is deasserted.
Why does SYStem.Detect.CPU detect an ApmPacketProSingle/Dual and
not the correct CPU derivative.
Many devices of the APM86xxx family share common JtagIDs which do not
allow to distinguish between the single derivatives. As a solution a general
ApmPacketProSingle/Dual device is detected to allow general debugging.

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

18

FAQ

APM86692
SYStem.Up/
InTargetReset
with APM86xxx

APM86791
Protected
Access Error

APM86791

The SYStem.Up/InTargetReset doesn't work with an APM86xxx device!


The contents of the memory views are wrong.
Some Revisions of the APM86xxx family need a special handling for Reset. As a
rule of thumb the Revison A e.g. of an APM86x90 requires an
SYStem.Option.ResetMode CHIP while the later revisions require an
SYStem.Option.ResetMode SYSTEM.
What does an "Protected Access Error" mean?
Section Memory Controller initialization of User Guide: After Reset the
Memory Queue, Memory Controller and DDR PHY are hold in Reset and clocks
are disabled. Any request on the PLB Bus designating DRAM or one of the
above Peripherals (ERPN 0x0 to 0x3) will cause an infinite stall of the CPU
(=>RESET). Furthermore the L2 Cache can not be enables (L2COBE) before
the above mentioned Peripherals are out of Reset and working. A such situation
is guarded by an "Protected Access Error". The Memory views addressing
ERPN 0x0 to 0x3 (PLB5) are unlocked as soon as the clock gating is enabled
and the reset is deasserted.
Why does SYStem.Detect.CPU detect an ApmPacketProSingle/Dual and
not the correct CPU derivative.

SYS.Detect.CP
U
ApmPacketPro
Single/Dual

Many devices of the APM86xxx family share common JtagIDs which do not
allow to distinguish between the single derivatives. As a solution a general
ApmPacketProSingle/Dual device is detected to allow general debugging.

APM86791

The SYStem.Up/InTargetReset doesn't work with an APM86xxx device!

SYStem.Up/
InTargetReset
with APM86xxx

MICROBLAZE
No Source
Code shown
on Xilinx
Targets
PPC440
Connection to
Target Fails

The contents of the memory views are wrong.


Some Revisions of the APM86xxx family need a special handling for Reset. As a
rule of thumb the Revison A e.g. of an APM86x90 requires an
SYStem.Option.ResetMode CHIP while the later revisions require an
SYStem.Option.ResetMode SYSTEM.
Virtex: after loading an ELF file (PPC or Microblaze) to the target, no
source code is displayed. Why?
The Xilinx compilers from the EDK operate inside a Cygwin environment and
therefore create debug information with non-standard path names. Use the
option /cygdrive when loading these ELF files: data.load.elf eventgen_ppc/
executable.elf /CYGDRIVE
Why does the connection to the target fails?
When connecting to XILINX targets be sure to use a recent version of the debug
cable (see picture).
With the old version of the debug cable target connection will fail or be
unreliable.

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

19

FAQ

PPC440
No Source
Code shown
on Xilinx
Targets
PPC440GX
Enable/
configure
mixed TRACE
Interface

Virtex: after loading an ELF file (PPC or Microblaze) to the target, no


source code is displayed. Why?
The Xilinx compilers from the EDK operate inside a Cygwin environment and
therefore create debug information with non-standard path names. Use the
option /cygdrive when loading these ELF files: data.load.elf eventgen_ppc/
executable.elf /CYGDRIVE
How to enable/configure muxed trace interface for TRACE
1. Enable Trace Broadcast:
CCR0[DTB]=0
(Register can be found in the tree "Instruction and Data Cache"-"Core
Configuration Registers") 2. Select the pin group for the trace signals: (!
[CTEMS] register bit description in "PPC440GX_UM2001_v1_04.pdf" is upside
down!)
SDR0_PFC1[CTEMS]=0 == GROUP A
TrcTS1:6 muxed with GPIO
(muxes the CPU trace functionality on the trace interface signals TrcTs1,
TrcTS2, TrcTS3, TrcTS4 and TrcTS5. With this selection ethernet groups 4,
5 and GPIO's GPIO27, GPIO28, GPIO29, GPIO30 and GPIO31 cannot be
used.)
Configure GPIO pins:
SDR0_PFC0[G18E-G22E]=1 (Select TrcESx as GPIOx)
SDR0_PFC1[CTEMS]=1 == GROUP B
TrcTS1:6 muxed with EBC/EBMI
(muxes the CPU trace functionality on the external master interface signals
BusReq, ExtAck, ExtReq, HoldAck, HoldReq and PerErr. With this selection the external master interface cannot be used.)
Disable the Lauterbach analyzer TERMINATION of the Trace Preprocessor
during initialization:
a.TERMINATION OFF
if termination is enabled, the signals will be terminated to the THRESHOLD
voltage. (e.g 1.5 V). This will disturb/lock the "HoldReq" signal and stop the
CPU at all.
after the EBC bus interface is disabled for trace (SDR0_PFC0[TRE]=1 +
SDR0_PFC1[CTEMS]=1), the termination can be enabled afterwards.
3. Enable Trace output:
SDR0_PFC0[TRE]=1

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

20

FAQ

PPC4XX
Software
Breakpoints
Problem

Error message: software breakpoints not possible with current system


setting
One reason for this error message is that the option sys.o.icflush is OFF. Without
being able to flush the ICache the debugger cannot write software breakpoints.
Use the following command to allow the debugger to flush the ICache after
writing a SW breakpoint:
sys.o.icflush ON

PPC4xx
Stepping over
TLBWE
instruction
VIRTEXPPC440
ISOCM Access
in Xilinx
VirtexFX Chips

Stepping over TLBWE instruction result in another program flow as in run


mode.
There is a difference between stepping and running over a

How can I enable access to ISOCM memory in Xilinx VirtexFX chips?


For accessing the ISOCM memory (instruction side OCM) attached to the
PPC405 in Xilinx VirtexFX chips, a special access mechanism via DCR is
required. This mechanism is only available from Virtex4 onwards. It is not
supported in Virtex2Pro.
For enabling the ISOCM access in Trace32 use the option
sys.o.isocm BASEADDR
where BASEADDR is the beginning of the ISOCM memory. The default value is
0xFFFF.FFFF (disabled).
The feature requires Trace32 SW from 2006-10-20 or later.

Virtex-PPC4XX
Debugging and
Tracing
Embedded
PPC Cores in
Xilinx FPGAs

How should I connect TRACE32-ICD JTAG connector to a Xilinx target?


What are the correct IRPRE/IRPOST and DRPRE/DRPOST settings?
This document describes for Xilinx Virtex chips how to:
Calculate the multicore pre/post settings
Debug the embedded PPC405/PPC440 cores
Trace the program flow of PPC405/PPC440 cores
NOTE: In some cases the application advises to use the CPU setting
"VirtexPPC". You will need a SW from May 2006 or later for this. If your SW does
not offer this setting, you need to get an update. Any attempt to use PPC405F or
PPC405D instead will fail and is a waste of time. To debug PPC440 cores in a
Virtex5 (e.g. SYStem.CPU Virtex5PPC, PPC440G, ...) will need SW newer than
March 2008.

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

21

FAQ

RISC Trace
No information available.

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

22

FAQ

Configuration

System Overview

PODBUS Cable
PODPC
PODPAR
PODETH

Debug
Interface

EPROM
Simulator
(optional)

...

Debug Cable

CPU CLK

Target Connector
EPROM

TS4 (400 only)

Target

RESET
INT
(600
only)

Basic configuration for the BDM Interface

NOTE:

Together with the debug interface you get a small black wire to connect the CPU
clock to the plug on the debug module. This way you can use the divided CPU
clock as clock for the debug interface.

NOTE:

If you use the PPC400 family you get a second wire to connect the TS4 signal.
This is only necessary if you want to use the TrBus.Out command.

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

23

Configuration

ICD Trace Extension for PPC400 (ICT)

General Fact for PPC403 RiscTrace Use


The PPC403 supports BDM debug features and FlowTrace features. Both uses the 403 debug logic on the
chip. During normal BDM debugging any debug event will stop the processor. When using the Trace mode
any debug event will start tracing. Therefore there are some restrictions to use both at the same time.

Debugging and Trace Mode


In the FlowTrace mode the SW-breakpoints normally cannot be used. This means also HLL-steps, step over
or functions like go <addr/label> are not working. The user is responsible that all breakpoints are cleared
(see BREAK.LIST). If the trap exception handler can be used and modified be the Trace Extension, then
SW-Breakpoint will be available and also Debugging and Trace Mode at the same time will be possible with
some restrictions (See Trace Extension for the PPC403).

What does the PPC403 Trace Mode provide?


The Trace Extension supports all features that are offered from the PPC403 Real-Time Trace functionality.
With the Trace Extension you are able to trace from the current instruction on, till the analyzer stack is full
(Stack Mode) or the break button is pushed (Fifo Mode). The trace feature allows to follow the source code.
There are five cases where the Trace Extension needs additional information from the trace signals to follow
the source code:
8.

Exceptions

9.

Branch to Link Instruction

10.

Branch to Count Instruction

11.

Return from Interrupt Instruction

12.

Return from Critical Interrupt Instruction

To allow tracing the processor will broadcast the following:

Count Register contents after Move to Count has occurred

Instruction address after an exception has occurred

Instruction address after a return from interrupt or return from critical interrupt(RFI,RFCI)

Link Register contents after Move to Link has occurred

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

24

ICD Trace Extension for PPC400 (ICT)

If a Trace Start events has occurred (depend on DBCR Register configuration) then the first RiscTrace
program flow synchronization take place after one of the five cases explained before are executed. This
means that the program should be traced, must consist one of the five special cases. Source code parts
which do not consist of one of the five cases, which start the FlowTrace broadcast, cannot be traced in the
fifo mode.

Used Options for RiscTrace

SYSTEM.OPTION FLOWTRACE ON /OFF

SYSTEM.OPTION CLOCKX2 ON /OFF

SYSTEM.OPTION HOOK <addr>

IOCR Register [RMD,2CX] (Peripheral Window)

DBCR Register (Peripheral Window)

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

25

ICD Trace Extension for PPC400 (ICT)

CPU specific Implementations

General Restrictions
PPC400

Make sure, that you don't increase the debug clock without decreasing the
internal waitstates, when the TURBO option is enabled. If external waitstates
are used it is recommended to switch TURBO mode off. The BDM driver may
not work with older PPC403GA-JA25 samples.

Breakpoints
There are two types of breakpoints available: Software breakpoints (SW-BP) and on-chip breakpoints (HWBP).

Software Breakpoints
Software breakpoints are the default breakpoints. They can only be used in RAM areas.There is no
restriction in the number of software breakpoints. Please consider that increasing the number of software
breakpoints will reduce the debug speed.

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

26

CPU specific Implementations

On-chip Breakpoints
The following list gives an overview of the usage of the on-chip breakpoints by
TRACE32-ICD:

CPU family

On-chip breakpoints: Total amount of available on-chip breakpoints.

Instruction breakpoints: Number of on-chip breakpoints that can be used for program and spot
breakpoints

Read/Write breakpoints: Number of on-chip breakpoints that can be used as read or write
breakpoints.

Data breakpoints: Number of on-chip data breakpoints that can be used to stop the program
when a specific data value is written to an address or when a specific data value is read from an
address.
CPU Family

On-chip
Breakpoints

Instruction
Breakpoints

Read/Write
Breakpoints

Data
Breakpoints

PPC401/403

2 Instruction
2 Read/Write

PPC405

4 Instruction
2 Read/Write

Breakpoint Restrictions

You can check your currently set breakpoints with the command Break.List

Breakpoint in ROM
With the command MAP.BOnchip <range> it is possible to inform the debugger where you have ROM
(FLASH,EPROM) on the target. If a breakpoint is set within the specified address range the debugger uses
automatically the available on-chip breakpoints.

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

27

CPU specific Implementations

Example for Breakpoints


Assume you have a target with FLASH from 0 to 0xFFFFF and RAM from 0x100000 to 0x11FFFF. The
command to configure TRACE32 correctly for this configuration is:
Map.BOnchip 0x0--0x0FFFFF

The following breakpoint combinations are possible.


1.

2.

Software breakpoints:

Break.Set 0x100000 /Program

; Software Breakpoint 1

Break.Set 0x101000 /Program

; Software Breakpoint 2

Break.Set 0xx /Program

; Software Breakpoint 3

On-chip breakpoints:
Break.Set 0x100 /Program

; On-chip Breakpoint 1

Break.Set 0x0ff00 /Program

; On-chip Breakpoint 2

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

28

CPU specific Implementations

Memory Classes
The following memory classes are available:
Memory Class

Description

Program

Data

SPR

Special Purpose Register

DCR

Device Control Register (PPC40x only)

IC

Instruction Cache

DC

Data Cache

NC

No Cache (only physically memory)

If caching is disabled via the appropriate hardware registers (DCCR/ICCR for PPC400 series, HID0 for
PPC603 series), memory accesses to the memory classes IC or DC are realized by TRACE32-ICD as
reads and writes to physical memory.

Memory Coherency
Memory coherency on access to the following memory classes. If data will be set to DC, IC, NC, D or P the
D-Cache, I-Cache or physical memory will be updated.
D-Cache

I-Cache

Physical Memory

DC:

Yes

No

Yes

IC:

No

Yes

Yes

NC:

No

No

Yes

D:

Yes

Yes

Yes

P:

Yes

Yes

Yes

See also SYStem.Option

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

29

CPU specific Implementations

General SYStem Commands

SYStem.BdmClock

Set JTAG clock frequency

Format:

SYStem.BdmClock <rate>

<rate>:

2. | 4.

<fixed>:

1000. 5000000. | 10 000 000. (Default 1 MHz)

Selects the frequency for the debug interface.

SYStem.CPU

Select the used CPU

Format:

SYStem.CPU <cpu>

<cpu>:

403GA | 403GB | 403GC | 403GCX | 405CR | 405GP | 440GP

SYStem.CpuAccess

Format:

Run-time memory access (intrusive)

SYStem.CpuAccess Enable | Denied | Nonstop

Default: Denied.
Enable

Allow intrusive run-time memory access.


In order to perform a memory read or write while the CPU is executing the
program the debugger stops the program execution shortly. Each short stop
takes 1 100 ms depending on the speed of the debug interface and on the
number of the read/write accesses required.
A red S in the state line of the TRACE32 screen indicates this intrusive behavior
of the debugger.

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

30

General SYStem Commands

Denied

Lock intrusive run-time memory access.

Nonstop

Lock all features of the debugger, that affect the run-time behavior.
Nonstop reduces the functionality of the debugger to:

run-time access to memory and variables

trace display
The debugger inhibits the following:

to stop the program execution

all features of the debugger that are intrusive (e.g. action Spot for breakpoints, performance analysis via StopAndGo mode, conditional breakpoints etc.)

SYStem.LOCK

Format:

Lock and tristate the debug port

SYStem.LOCK [ON | OFF]

Default: OFF.
If the system is locked, no access to the debug port will be performed by the debugger. While locked, the
debug connector of the debugger is tristated. The main intention of the lock command is to give debug
access to another tool.

SYStem.MemAccess

Real-time memory access (non-intrusive)

Format:

SYStem.MemAccess Denied<cpu_specific>
SYStem.ACCESS (deprecated)

Denied

Real-time memory access during program execution to target is disabled.

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

31

General SYStem Commands

SYStem.Mode

Select operation mode

Format:

SYStem.Mode <mode>

<mode>:

Down
NoDebug
Go
Attach
Up

Select target reset mode.


Down

Disables the Debugger. The state of the CPU remains unchanged.

NoDebug

Resets the target with debug mode disabled (for the PPC400 family the same
as Go). In this mode no debugging is possible. The CPU state keeps in the
state of NoDebug.

Go

Resets the target with debug mode enabled and prepares the CPU for debug
mode entry. After this command the CPU is in the system.up mode and running.
Now, the processor can be stopped with the break command or until any break
condition occurs.

Up

Resets the target and sets the CPU to debug mode. After execution of this
command the CPU is stopped and prepared for debugging. All register are set
to the default value.

Attach

This command works similar to Up command. The difference is, that the target
CPU is not reset. The BDM/JTAG/COP interface will be synchronized and the
CPU state will be read out. After this command the CPU is in the SYStem.Up
mode and can be stopped for debugging.

StandBy

Not available PPC400/PPC440

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

32

General SYStem Commands

SYStem.CONFIG

Configure debugger according to target topology

Format:

SYStem.CONFIG <parameter> <number_or_address>


SYStem.MultiCore <parameter> <number_or_address> (deprecated)

<parameter>
(General):

state
CORE

(JTAG):

DRPRE <bits>
DRPOST <bits>
IRPRE
<bits>
IRPOST <bits>
TAPState <state>
TCKLevel <level>
TriState [ON | OFF]
Slave
[ON | OFF]

<core>

The four parameters IRPRE, IRPOST, DRPRE, DRPOST are required to inform the debugger about the
TAP controller position in the JTAG chain, if there is more than one core in the JTAG chain (e.g. ARM +
DSP). The information is required before the debugger can be activated e.g. by a SYStem.Up. See Daisychain Example.
For some CPU selections (SYStem.CPU) the above setting might be automatically included, since the
required system configuration of these CPUs is known.
TriState has to be used if several debuggers (via separate cables) are connected to a common JTAG port
at the same time in order to ensure that always only one debugger drives the signal lines. TAPState and
TCKLevel define the TAP state and TCK level which is selected when the debugger switches to tristate
mode. Please note: nTRST must have a pull-up resistor on the target, TCK can have a pull-up or pull-down
resistor, other trigger inputs needs to be kept in inactive state.
Multicore debugging is not supported for the DEBUG INTERFACE (LA-7701).

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

33

General SYStem Commands

state

Show multicore settings.

CORE

For multicore debugging one TRACE32 GUI has to be started per core.
To bundle several cores in one processor as required by the system this
command has to be used to define core and processor coordinates within
the system topology.
Further information can be found in SYStem.CONFIG.CORE.

DRPRE

(default: 0) <number> of TAPs in the JTAG chain between the core of


interest and the TDO signal of the debugger. If each core in the system
contributes only one TAP to the JTAG chain, DRPRE is the number of
cores between the core of interest and the TDO signal of the debugger.

DRPOST

(default: 0) <number> of TAPs in the JTAG chain between the TDI signal
of the debugger and the core of interest. If each core in the system
contributes only one TAP to the JTAG chain, DRPOST is the number of
cores between the TDI signal of the debugger and the core of interest.

IRPRE

(default: 0) <number> of instruction register bits in the JTAG chain


between the core of interest and the TDO signal of the debugger. This is
the sum of the instruction register length of all TAPs between the core of
interest and the TDO signal of the debugger.

IRPOST

(default: 0) <number> of instruction register bits in the JTAG chain


between the TDI signal and the core of interest. This is the sum of the
instruction register lengths of all TAPs between the TDI signal of the
debugger and the core of interest.

TAPState

(default: 7 = Select-DR-Scan) This is the state of the TAP controller when


the debugger switches to tristate mode. All states of the JTAG TAP
controller are selectable.

TCKLevel

(default: 0) Level of TCK signal when all debuggers are tristated.

TriState

(default: OFF) If several debuggers share the same debug port, this
option is required. The debugger switches to tristate mode after each
debug port access. Then other debuggers can access the port. JTAG:
This option must be used, if the JTAG line of multiple debug boxes are
connected by a JTAG joiner adapter to access a single JTAG chain.

Slave

(default: OFF) If more than one debugger share the same debug port, all
except one must have this option active.
JTAG: Only one debugger - the master - is allowed to control the signals
nTRST and nSRST (nRESET).

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

34

General SYStem Commands

Daisy-chain Example

TDI

Core A

Core B

Core C

Chip 0

Core D

TDO

Chip 1

Below, configuration for core C.


Instruction register length of

Core A: 3 bit

Core B: 5 bit

Core D: 6 bit
SYStem.CONFIG.IRPRE 6

; IR Core D

SYStem.CONFIG.IRPOST 8

; IR Core A + B

SYStem.CONFIG.DRPRE 1

; DR Core D

SYStem.CONFIG.DRPOST 2

; DR Core A + B

SYStem.CONFIG.CORE 0. 1.

; Target Core C is Core 0 in Chip 1

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

35

General SYStem Commands

TapStates
0

Exit2-DR

Exit1-DR

Shift-DR

Pause-DR

Select-IR-Scan

Update-DR

Capture-DR

Select-DR-Scan

Exit2-IR

Exit1-IR

10

Shift-IR

11

Pause-IR

12

Run-Test/Idle

13

Update-IR

14

Capture-IR

15

Test-Logic-Reset

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

36

General SYStem Commands

SYStem.CONFIG.CORE

Assign core to TRACE32 instance

Format:

SYStem.CONFIG.CORE <coreindex> <chipindex>


SYStem.MultiCore.CORE <coreindex> <chipindex> (deprecated)

<chipindex>:

1i

<coreindex>:

1k

Default coreindex: depends on the CPU, usually 1. for generic chips


Default chipindex: derived from CORE= parameter of the configuration file (config.t32). The CORE
parameter is defined according to the start order of the GUI in T32Start with ascending values.
To provide proper interaction between different parts of the debugger the systems topology must be mapped
to the debuggers topology model. The debugger model abstracts chips and sub-cores of these chips. Every
GUI must be connect to one unused core entry in the debugger topology model. Once the SYStem.CPU is
selected a generic chip or none generic chip is created at the default chipindex.
None Generic Chips
None generic chips have a fixed amount of sub-cores with a fixed CPU type.
First all cores have successive chip numbers at their GUIs. Therefore you have to assign the coreindex and
the chipindex for every core. Usually the debugger does not need further information to access cores in
none generic chips, once the setup is correct.
Generic Chips
Generic chips can accommodate an arbitrary amount of sub-cores. The debugger still needs information
how to connect to the individual cores e.g. by setting the JTAG chain coordinates.
Start-up Process
The debug system must not have an invalid state where a GUI is connected to a wrong core type of a none
generic chip, two GUI are connected to the same coordinate or a GUI is not connected to a core. The initial
state of the system is value since every new GUI uses a new chipindex according to its CORE= parameter
of the configuration file (config.t32). If the system contains fewer chips than initially assumed, the chips must
be merged by calling SYStem.CONFIG.CORE.

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

37

General SYStem Commands

CPU specific SYStem Commands

SYStem.Option CLOCKX2

Selects the clock for the real-time trace

Available on: MPC403

Format:

SYStem.Option CLOCKX2 [ON | OFF]

This option select the clock for the Real-Time Trace. (Required for the TRACE32-ICD Risc Trace Modul).If
the 403GCX works with internal double clock (IOCR [2XC]), this option must be on before starting to record
with the trace.
If the source code being traced change the IOCR[2XC] register by its own
during the trace, the RiscTrace doesnt works properly.

SYStem.Option DCFREEZE

Format:

Freeze contents of cache while debugging

SYStem.Option.DCFREEZE [ON | OFF]

If this feature is enabled the status of the data caches is preserved while debugging. This feature should be
used in combination with SYStem.Option.DCREAD in order to read data as seen by the core. Otherwise all
memory accesses are as for access class NC.
If disabled, the debugger might modify the caches contents with each data access e.g. a Data.dump
window.
For caches that use hardware coherency (e.g. MESI protocol), the DCFREEZE feature is not supported.
This respects multicore architectures that use non-shared caches.

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

38

CPU specific SYStem Commands

SYStem.Option DCREAD

Format:

Read from data cache

SYStem.Option DCREAD [ON | OFF]

Data.dump windows for memory class D: displays the memory value from the d-cache if valid. If d-cache is
not valid the physical memory will be read.
If caching is disabled via the appropriate hardware registers (DCCR/ICCR for
PPC400 Series) or cache is invalid, read and writes from/to memory will directly
reflect to contents of physical memory even if a cache memory class is
selected.

SYStem.Option DMALOW

Format:

Switch DMA to low priority

SYStem.Option DMALOW [ON | OFF]

All DMA transfers continue in debug mode. If DMALOW is enabled all DMA activities are switched to low
priority.

SYStem.Option FREEZERUN

Format:

Stop timer in user mode

SYStem.Option FREEZERUN [ON | OFF]

Controls the internal CPU timer. If FREEZERUN is enabled, the timer will be stopped whenever the CPU
enters the user mode.

SYStem.Option FREEZEBDM

Format:

Stop timer in debug mode

SYStem.Option FREEZEBDM [ON | OFF]

Controls the internal CPU timer. If FREEZEBDM is enabled, the timer will be stopped whenever the CPU
enters the debug mode.

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

39

CPU specific SYStem Commands

SYStem.Option FLOWTRACE

Prepare CPU for real-time trace

Available on: MPC403

Format:

SYStem.Option FLOWTRACE [ON | OFF]

Prepare the CPU for real-time trace. (Required for the TRACE32-ICD RISC Trace Module). If switched on,
on every step or go the DBCR[EDM,IDM] bits are switched off and the IOCR[RDM] bits are switched to
Trace Mode automatically.

SYStem.Option FOLDING

Format:

Execute more instructions per cycle

SYStem.Option FOLDING [ON | OFF]

The PPC400 CPUs can execute more than one instruction per cycle. If FOLDING is disabled, exactly one
instruction is executed per cycle.

SYStem.Option HOOK

Format:

Compare PC to hook address

SYStem.Option HOOK <address>

The command defines the hook address. After program break the hook address is compared against the
program counter value.
If the values are equal, it is supposed that a hook function was executed. This information is used to
determine the right break address by the debugger.
This option make it possible to use breakpoints in the Real-Time Trace Mode. (Required for the TRACE32ICD RISC Trace Module) This assume that the trap exception handler can be modified for the RiscTrace.
After any synchronize break (using breakpoints) the IP will be compared with the Hook value. If true than the
last exception of will be canceled.
For example. Do use breakpoints, the trap exception handler must be prepared with some instructions.
P:FFF00700 lis r3,0

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

40

CPU specific SYStem Commands

If the CPU runs the instruction P:FFF0070C mtxxx, it stops. The IP will be compared to the Hook value. If the
Hook value is also 0xFFF0070C the exception will be canceled and the CPU register reconstructed to the
last breakpoint.
If you start again after a break with a breakpoint the IP is on the breakpoint.
This means that in the HLL mode a step are executed before the processor put
into run mode.

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

41

CPU specific SYStem Commands

SYStem.Option ICFLUSH

Format:

Invalidate instruction cache

SYStem.Option CFLUSH [ON | OFF]

Invalidates the instruction cache and flush the data cache before starting the target program (Step or Go).
This is required when the ICACHEs are enabled and software breakpoints are set to a cached location.

SYStem.Option ICREAD

Format:

Read from instruction cache

SYStem.Option ICREAD [ON | OFF]

Data.List window and Data.dump window for memory class P: displays the memory value from the I-cache if
valid. If I-cache is not valid the physical memory will be read.

SYStem.Option MMUSPACES

Format:

Enable multiple address spaces support

SYStem.Option MMUSPACES [ON | OFF]


SYStem.Option MMU [ON | OFF] (deprecated)

Default: OFF.
Enables the usage of the MMU to support multiple address spaces. The command should not be used if
only one translation table is used. Enabling the option will extend the address scheme of the debugger by a
16 bit memory space identifier. You should activate the option first, and then load the symbols.

SYStem.Option NoJtagHalt

Format:

Disable HALT line

SYStem.Option NoJtagHalt [ON | OFF]

Default: OFF.
The JTAG connection for an PowerPC 4xx type CPU features an HALT- signal which will stop the CPU. The
HALT- line enables to stop an core independently from the BDM/JTAG clock. As the HALT- line is a shared
signal for all cores & chips in a JTAG chain all cores & chips stop if the HALT- line is asserted.
1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

42

CPU specific SYStem Commands

By disabling the HALT- line it is possible to debug only specific cores in the chain without interference with
other PowerPC 4xx cores/chips (AMP). A side effect of this option is that the SYStem.Up behavior will
change as the core will then not be prevented from executing code after an reset. Thus if this option is
enabled the CPU will have executed some code after SYStem.Up and the system might be no longer in
reset status.

SYStem.Option NOTRAP

Format:

Use alternative instruction to enter debug mode

SYStem.Option NOTRAP [ON | OFF]

If the user software uses the TRAP command, the CPU performs a BREAK in debug mode and does not
jump to the interrupt handler of the TRAP command.
Normally, the T32Fire uses the trap command as patch for the synchronous software breakpoints. With this
option, a illegal instruction is used instead. (MPC5xx/8xx) or no software breakpoints are possible
(MPC4xx).

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

43

CPU specific SYStem Commands

SYStem.Option OVERLAY

Format:

Enable overlay support

SYStem.Option OVERLAY [ON | OFF | WithOVS]

Default: OFF.
ON

Activates the overlay extension and extends the address scheme of the
debugger with a 16 bit virtual overlay ID. Addresses therefore have the
format <overlay_id>:<address>. This enables the debugger to
handle overlaid program memory.

OFF

Disables support for code overlays.

WithOVS

Like option ON, but also enables support for software breakpoints. This
means that TRACE32 writes software breakpoint opcodes both to the
execution area (for active overlays) and to the storage area. In this way, it is
possible to set breakpoints into inactive overlays. Upon activation of the
overlay, the target's runtime mechanisms copies the breakpoint opcodes to
execution area. For using this option, the storage area must be readable and
writable for the debugger.

SYStem.Option OVERLAY ON
Data.List 0x2:0x11c4

; Data.List <overlay_id>:<address>

SYStem.Option ResetMode

Format:

Selects the reset mode

SYStem.Option ResetMode [SYSTEM | CHIP | CORE]

Use this option to select the type of reset at SYStem.Up. There are three types of resets:

SYSTEM will reset the peripherals and the core.

CHIP

CORE will only reset the core.

Note that a reset of the core does not reset the register tbd.

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

44

CPU specific SYStem Commands

SYStem.Option TURBO

Format:

Skip additional checks/waits

SYStem.Option TURBO [ON | OFF]

If there are buffers, additional loads or high capacities on the JTAG/COP lines,
reduce the debug speed.

Enables Turbo debugging. If Turbo is disabled, the CPU checks after each memory access in debug mode if
the CPU is ready. This check will decrease debug speed (30-40%).
If Turbo is enabled, the CPU will make no checks. The internal waitstates for a memory access must be
decremented before increasing the debug frequency. With the default debug frequency of 1 MHz Turbo can
always be enabled.

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

45

CPU specific SYStem Commands

BenchMarkCounter
For information about the architecture-independent BMC commands, refer to BMC (general_ref_b.pdf).

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

46

BenchMarkCounter

CPU specific TrOnchip Commands

The features supported by the TrOnchip command for TRACE32-ICD vary for
the different PowerPC families.

TrOnchip.view

Setup window

Format:

TrOnchip.view

Control panel to configure the on-chip breakpoint registers (here MPC860).


B::w.to
tronchip
RESet
CONVert
BRKNOMSK
Set
CHSTPE
MCEE
DSEE
ISEE
EXTIE
ALEE
PREE
FPUVEE
DECEE
SYSEE
FPASEE
SEEE

A.Data
OFF
G
H
GORH
GANDH

A.CYcle
Read
Write
Access

A.Lbus
OFF
A
B
C

A.Ibus
OFF
A
B
C

B.Data
OFF
G
H
GORH
GANDH

B.CYcle
Read
Write
Access

A.Count
1.

B.Count
1.

B.Lbus
OFF
A
B
C
B.Ibus
OFF
A
B
C

G.Value
00000000
G.Size
Byte
Word
Long

G.Match
OFF
EQ
NE
LE
GE
LT
GT
SIGNED

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

47

CPU specific TrOnchip Commands

TrOnchip.CONVert

Format:

Adjust range breakpoint in on-chip resource

TrOnchip.CONVert [ON | OFF]

The on-chip breakpoints can only cover specific ranges. If a range cannot be programmed into the
breakpoint it will automatically be converted into a single address breakpoint when this option is active. This
is the default. Otherwise an error message is generated.
TrOnchip.CONVert ON
Break.Set 0x1000--0x17ff /Write
Break.Set 0x1001--0x17ff /Write

; sets breakpoint at range


; 1000--17ff sets single breakpoint
; at address 1001

TrOnchip.CONVert OFF
Break.Set 0x1000--0x17ff /Write
Break.Set 0x1001--0x17ff /Write

; sets breakpoint at range


; 1000--17ff
; gives an error message

TrOnchip.DISable

Format:

Disable NEXUS trace register control

TrOnchip.DISable

Disables NEXUS register control by the debugger. By executing this command, the debugger will not write or
modify any registers of the NEXUS block. This option can be used to manually set up the NEXUS trace
registers. The NEXUS memory access is not affected by this command. To re-enable NEXUS register
control, use command TrOnchip.ENable. Per default, NEXUS register control is enabled.
tbd.

TrOnchip.ENable

Format:

Use CPU internal trigger logic

TrOnchip.ENable <item> [ON | OFF]

If TrOnchip.Enable is ON (by default) the CPU internal trigger/trace/debug feature like IACx (Instruction
Address Compare Register) and DACx (Data Address Compare Register) will be used by the debugger. If
TrOnchip.Enable is OFF, the registers can be manually programmed by user or application.

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

48

CPU specific TrOnchip Commands

TrOnchip.RESet

Format:

Set on-chip trigger to default state

TrOnchip.RESet

Sets the TrOnchip settings and trigger module to the default settings.

TrOnchip.Set

Trigger sources

Format:

TrOnchip.Set <item> [ON | OFF]

<item>:

BRANCH
eXception

Enables various trigger events. Detailed description of the trigger events can be found in the processor
manuals.
eXeption

Debug mode is entered if an exception occurs.

BRANCH

Debug mode is entered if a branch is taken.

TrOnchip.TEnable

Format:

Set filter for the trace

TrOnchip.TEnable <par>

Obsolete command. Refer to the Break.Set command to set trace filters.

TrOnchip.TOFF

Format:

Switch the sampling to the trace to OFF

TrOnchip.TOFF

Obsolete command. Refer to the Break.Set command to set trace filters.

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

49

CPU specific TrOnchip Commands

TrOnchip.TON

Format:

Switch the sampling to the trace to ON

TrOnchip.TON EXT | Break

Obsolete command. Refer to the Break.Set command to set trace filters.

TrOnchip.TTrigger

Format:

Set a trigger for the trace

TrOnchip.TTrigger <par>

Obsolete command. Refer to the Break.Set command to set a trigger for the trace.

TrOnchip.VarCONVert

Format:

Adjust complex breakpoint in on-chip resource

TrOnchip.VarCONVert [ON | OFF]

The on-chip breakpoints can only cover specific ranges. If you want to set a marker or breakpoint to a
complex variable, the on-chip break resources of the CPU may be not powerful enough to cover the whole
structure. If the option TrOnchip.VarCONVert is on the breakpoint will automatically be converted into a
single address breakpoint. This is the default setting. Otherwise an error message is generated.

TrOnchip.SYNCHRONOUS

Format:

Switches mode for data breakpoints

TrOnchip.SYNCHRONOUS [ON | OFF]

Default: OFF.
Switches the mode of the DAC (Data Address Compare Register) for debug events on PPC44x/PPC46x
cores. This mode setting is only effective if read/write breakpoints are used.
If the DAC works in synchronous mode the processor enters the stop state when reaching load/store
instructions and ceases the processing of instructions. This means the CPU will stop on a load/store
instruction without executing the read/write cycle. The disadvantage is that the core performance for load/
store instructions will be reduced in synchronous mode. Switch the synchronous mode OFF in order to
maintain normal processor performance .

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

50

CPU specific TrOnchip Commands

In asynchronous DAC mode the processor enters stop state on load/store instructions either before or after
the completion of the instruction. This means the CPU will execute the read/write cycle and stop some
instructions later for the most cases.

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

51

CPU specific TrOnchip Commands

CPU specific MMU Commands

MMU.DUMP

Page wise display of MMU translation table

Format:

MMU.DUMP <table> [<range> | <addr> | <range> <root> | <addr> <root>]


MMU.<table>.dump (deprecated)

<table>:

PageTable
KernelPageTable
TaskPageTable <task>
and CPU specific tables

Displays the contents of the CPU specific MMU translation table.

If called without parameters, the complete table will be displayed.

If the command is called with either an address range or an explicit address, table entries will
only be displayed, if their logical address matches with the given parameter.

The optional <root> argument can be used to specify a page table base address deviating from the default
page table base address. This allows to display a page table located anywhere in memory.
PageTable

Display the current MMU translation table entries of the CPU.


This command reads all tables the CPU currently used for MMU translation
and displays the table entries.

KernelPageTable

Display the MMU translation table of the kernel.


If specified with the MMU.FORMAT command, this command reads the
MMU translation table of the kernel and displays its table entries.

TaskPageTable

Display the MMU translation table entries of the given process.


In MMU based operating systems, each process uses its own MMU
translation table. This command reads the table of the specified process,
and displays its table entries.
See also the appropriate OS awareness manuals: RTOS Debugger for
<x>.

CPU specific tables:

TLB

Displays the contents of the Translation Lookaside Buffer.

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

52

CPU specific MMU Commands

MMU.List

Compact display of MMU translation table

Format:

MMU.List <table> [<range> | <address>]


MMU.<table>.List (deprecated)

<table>:

PageTable
KernelPageTable
TaskPageTable <task>

Lists the address translation of the CPU specific MMU table. If called without address or range parameters,
the complete table will be displayed.
If called without a table specifier, this command shows the debugger internal translation table.
See TRANSlation.List.
If the command is called with either an address range or an explicit address, table entries will only be
displayed, if their logical address matches with the given parameter.
PageTable

List the current MMU translation of the CPU.


This command reads all tables the CPU currently used for MMU
translation and lists the address translation.

KernelPageTable

List the MMU translation table of the kernel.


If specified with the MMU.FORMAT command, this command reads the
MMU translation table of the kernel and lists its address translation.

TaskPageTable

List the MMU translation of the given process.


In MMU based operating systems, each process uses its own MMU
translation table. This command reads the table of the specified process,
and lists its address translation.
See also the appropriate OS awareness manuals: RTOS Debugger for
<x>.

CPU specific tables:

TLB

Displays the contents of the Translation Lookaside Buffer.

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

53

CPU specific MMU Commands

MMU.SCAN

Load MMU table from CPU

Format:

MMU.SCAN <table> [<range> <address>]


MMU.<table>.SCAN (deprecated)

<table>:

PageTable
KernelPageTable
TaskPageTable <task>
ALL
and CPU specific tables

Loads the CPU specific MMU translation table from the CPU to the debugger internal translation table. If
called without parameters the complete page table will be loaded. The loaded address translation can be
viewed with TRANSlation.List.
If the command is called with either an address range or an explicit address, page table entries will only be
loaded if their logical address matches with the given parameter.

PageTable

Load the current MMU address translation of the CPU.


This command reads all tables the CPU currently used for MMU translation,
and copies the address translation into the debugger internal translation
table.

KernelPageTable

Load the MMU translation table of the kernel.


If specified with the MMU.FORMAT command, this command reads the
table of the kernel and copies its address translation into the debugger
internal translation table.

TaskPageTable

Load the MMU address translation of the given process.


In MMU based operating systems, each process uses its own MMU
translation table. This command reads the table of the specified process,
and copies its address translation into the debugger internal translation
table.
See also the appropriate OS awareness manuals: RTOS Debugger for
<x>.

ALL

Load all known MMU address translations.


This command reads the OS kernel MMU table and the MMU tables of all
processes and copies the complete address translation into the
debugger internal translation table.
See also the appropriate OS awareness manuals: RTOS Debugger for
<x>.

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

54

CPU specific MMU Commands

CPU specific tables:

ITLB

Loads the instruction translation table from the CPU to the debugger internal
translation table.

DTLB

Loads the data translation table from the CPU to the debugger internal
translation table.

TLB

Loads the translation table from the CPU to the debugger internal translation
table.

TLB0

Loads the translation table 0 from the CPU to the debugger internal
translation table.

TLB1

Loads the translation table 1from the CPU to the debugger internal
translation table.

TLB2

Loads the translation table 2 from the CPU to the debugger internal
translation table.

MMU.FORMAT

Define MMU table structure

Format:

MMU.FORMAT <format> [<effective_range> <real_base>]

<format>:

LINUX
LINUX26
LINUXEXT
LINUXE5
LYNXOS
LYNXOSPHYS
QNX
QNXBIG
DEOS
DEOS64

Defines the structure of the MMU table and optionally the base for the kernel space table.
LINUX

Standard Page-Table format for PPC405 running Linux

LINUXEXT

Standard Page-Table format for PPC44x/46x running Linux

If you require support for a particular operating system, please contact support@lauterbach.com.
See also MMU.FORMAT in general_ref_m.pdf.
1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

55

CPU specific MMU Commands

MMU.Set.TLB

Format 1:
PPC 40x

Format 2:
PPC 44x/46x

Format 3:
PPC 47x

Create a TLB entry on the TARGET

MMU.Set.TLB <index> <hi> <lo>


MMU.TLBSET (deprecated)
MMU.Set.TLB <index> <ws0> <ws1> <ws2>
MMU.TLBSET (deprecated)
MMU.Set.TLB <index> <way> <ws0> <ws1> <ws2> [/Bolted <index>]
MMU.TLBSET (deprecated)

Creates/modifies an TLB entry addressed by index (optional: way) in the target CPU. The provided settings
match the format of the tlbwe instruction of the target CPU and is thus CPU/Architecture specific. For the
exact meaning of the Bits provided below please refer to the CPUs/Architecture User-Guide.
Common arguments:
<index>

The line/index of the corresponding TLB entry

<way>

The way of the corresponding TLB entry

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

56

CPU specific MMU Commands

PowerPC 405 specific arguments:


<lo>

EPN

SIZ

U0

TID

Bit

[0:21]

[22:24]

[25]

[26]

[27]

[28:35]

<hi>

RPN

SXW

ZSEL

WIMG

Bit

[0:21]

[22:23]

[24:27]

[28:31]

Examples:
; Create TLB Entry, A:0x08800000++0x3FFFFF <-> SD:0x08800000++0x3FFFFF
; TID: 0x0, Permissions: eXecute, Write
MMU.TLBSET 0. 0x0880034000 0x08800300
; Create TLB Entry, A:0x90000000++0xFFF <-> SD:0x0++0xFFF
; TID: 0x0, Permissions: Write,
Cache: Inhibit, Guarded
MMU.TLBSET 1. 0x000000C000 0x90000105

PowerPC 44x/46x specific arguments:


<ws0>

EPN

TS

SIZE

TID

Bit

[0:21]

[22]

[23]

[24:27]

[28:31]

[32:39]

<ws1>

RPN

ERPN

Bit

[0:21]

[20:21]

[22:31]

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

57

CPU specific MMU Commands

<ws2>
Bit

[0:9]

FAR,WL1

IL1ID2ID

WIMGE

UXWRSXWR

[10:11]

[12:15]

[16:19]

[20:24]

[26:31]

Examples:
; Create TLB Entry, A:0xE:0x0xFFFF8000++0x3FFF <-> SD:0xE0000000++0x3FFF
; TID: 0x0, Permissions: User XWR, Supervisor XWR, Cache: Inhibit (L1&L2)
MMU.TLBSET 0. 0xE000022000 0xFFFF800E 0x000F043F
; Create TLB Entry, A:0x0:0x0++0x0FFFFFFF <-> SD:0xC0000000++0x0FFFFFFF
; TID: 0x0, Permissions: User ---, Supervisor XWR, Bolted: 0x1,
; Coherency: Enabled => WL1=1
MMU.TLBSET 1. 0xC000029000 0x00000000 0x00100207

PowerPC 47x specific arguments:


<ws0>

EPN

TS

DSIZ

TID

Bit

[0:19]

[20]

[21]

[22:27]

[28:31]

[32:39]

<ws1>

RPN

ERPN

Bit

[0:19]

[20:21]

[22:31]

<ws2>

IL1ID

WIMGE

UXWRSXWR

Bit

[0:12]

[14:15]

[16:19]

[20:24]

[25]

[26:31]

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

58

CPU specific MMU Commands

Examples:
; Create TLB Entry, A:0x2F:0x2000++0xFFF <-> SD:0x80801000++0xFFF
; TID: 0x0, Permissions: User ---, Supervisor XWR, Cache: Inhibit
; EA=0x80801000, DSIZ=0x0 => Index=0x1
MMU.TLBSET 0x1 0x0 0x8080180000 0x0000202F 0x00004007
; Create TLB Entry, A:0x0:0x0++0x3FFFFFFF <-> SD:0x0++0x3FFFFFFF
; TID: 0x0, Permissions: User ---, Supervisor XWR, Bolted: 0x1,
; Coherency: Enabled
; EA=0x00000000, DSIZ=0x3F => Index=0xC0, Bolted => Way=0x0
MMU.TLBSET 0x0 0x0 0xC0000BF000 0x00000000 0x00002007 /Bolted 1.

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

59

CPU specific MMU Commands

Debug Connector

Mechanical Description
JTAG Connector PPC401/403/405 and IOP480
It is recommended to connect all N/C Pins to GND (if you work with LAUTERBACH tools only).
Signal
TDO
TDI
N/C
TCK
TMS
HALTN/C
N/C

Pin
1
3
5
7
9
11
13
15

Pin
2
4
6
8
10
12
16

Signal
N/C
TRST- (*)
VCCS
N/C
N/C
N/C
KEY
GND

This is a standard 16 pin double row (two rows of eight pins) connector (pin to pin spacing: 0.100 in.).

Mictor Connector PPC440


The mictor connector can also be used for debugging. For a description of the pinout please refer to Trace
Connectors.

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

60

Debug Connector

Trace Connectors

Mictor Connector 38 pin (Version B) for PPC440


Signal
N/C
N/C
N/C
HALTN/C
TDO
N/C
TCK
TMS
TDI
TRSTN/C
BS0
BS1
BS2
ES0
ES1
ES2
ES3

Pin
1
3
5
7
9
11
13
15
17
19
21
23
25
27
29
31
33
35
37

Pin
2
4
6
8
10
12
14
16
18
20
22
24
26
28
30
32
34
36
38

Signal
N/C
N/C
TRACECLK
N/C
N/C
VTREF
N/C
N/C
N/C
N/C
N/C
ES4
TS0
TS1
TS2
TS3
TS4
TS5
TS6

Connect Pin 39,40,41,42 and 43 to GND.

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

61

Trace Connectors

Mictor Connector 38 pin (Version B) for PPC405


Signal
N/C
N/C
N/C
HALT
N/C
TDO
N/C
TCK
TMS
TDI
!TRST
N/C
GND
GND
GND
GND
GND
GND
GND

Pin
1
3
5
7
9
11
13
15
17
19
21
23
25
27
29
31
33
35
37

Pin
2
4
6
8
10
12
14
16
18
20
22
24
26
28
30
32
34
36
38

Signal
N/C
N/C
TRACECLK
N/C
N/C
VTREF
N/C
N/C
N/C
N/C
N/C
TS1O
TS2O
TS1E
TS2E
TS3
TS4
TS5
TS6

Connect Pin 39,40,41,42 and 43 to GND.

Connector 20 pin (Version A) for PPC405 (obsolete)


Signal
N/C
CLK
N/C
N/C
N/C
N/C
TS2O
TS2E
TS4
TS6

Pin
1
3
5
7
9
11
13
15
17
19

Pin
2
4
6
8
10
12
14
16
18
20

Signal
N/C
N/C
N/C
N/C
N/C
TS1O
TS1E
TS3
TS5
GND

This is a standard 20 pin double row (two rows of eight pins) connector (pin to pin spacing: 0.100 in.).

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

62

Trace Connectors

Mictor Connector 38 pin (Version B) for PPC403


Signal
N/C
N/C
N/C
HALT
N/C
TDO
N/C
TCK
TMS
TDI
N/C
N/C
GND
GND
GND
GND
GND
GND
GND

Pin
1
3
5
7
9
11
13
15
17
19
21
23
25
27
29
31
33
35
37

Pin
2
4
6
8
10
12
14
16
18
20
22
24
26
28
30
32
34
36
38

Signal
N/C
N/C
TRACECLK
N/C
N/C
VTREF
N/C
N/C
N/C
N/C
N/C
GND
TS0
TS1
TS2
TS3
TS4
TS5
TS6

Connect Pin 39,40,41,42 and 43 to GND.

Connector 20 pin (Version A) for PPC403


Signal
N/C
CLK
N/C
N/C
N/C
N/C
TS0
TS2
TS4
TS6

Pin
1
3
5
7
9
11
13
15
17
19

Pin
2
4
6
8
10
12
14
16
18
20

Signal
N/C
N/C
N/C
N/C
N/C
N/C
TS1
TS3
TS5
GND

This is a standard 20 pin double row (two rows of eight pins) connector (pin to pin spacing: 0.100 in.).

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

63

Trace Connectors

Support

IOP480
NPE405H
NPE405L
PPC401
PPC403GA
PPC403GB
PPC403GC
PPC403GCX
PPC405
PPC405Axx
PPC405Bxx
PPC405CR
PPC405Cxx
PPC405Dxx
PPC405EP
PPC405EX
PPC405Exx
PPC405Fxx
PPC405GP
PPC405GPR
PPC405LP
PPC405PM

YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES

YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES

INSTRUCTION
SIMULATOR

POWER
INTEGRATOR

ICD
TRACE

ICD
MONITOR

ICD
DEBUG

FIRE

ICE

CPU

Available Tools

YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

64

Support

YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES

YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES

INSTRUCTION
SIMULATOR

POWER
INTEGRATOR

ICD
TRACE

ICD
MONITOR

ICD
DEBUG

FIRE

ICE

CPU
ACP3448
APM86190
APM86190B
APM86290
APM86290B
APM86491
APM86692
PPC440
PPC440Axx
PPC440EP
PPC440EPX
PPC440GP
PPC440GR
PPC440GRX
PPC440GX
PPC440Gxx
PPC440SP
PPC440SPE
PPC460EX
PPC460GT
PPC460SX
PPC476FPE

YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

65

Support

Compilers
Language

Compiler

Company

Option

ADA

GNAT

ELF/DWARF

C
C

CXPPC
XCC-V

C
C

GREEN-HILLS-C
MCCPPC

C
C
C
C
C
C
C
C++

CC
ULTRA-C
HIGH-C
DCPPC
D-CC
D-CC
D-CC
GCC

C++
C++

GREEN-HILLSC++
CCCPPC

Free Software
Foundation, Inc.
Cosmic Software
GAIO Technology Co.,
Ltd.
Greenhills Software Inc.
Mentor Graphics
Corporation
NXP Semiconductors
Radisys Inc.
Synopsys, Inc
TASKING
Wind River Systems
Wind River Systems
Wind River Systems
Free Software
Foundation, Inc.
Greenhills Software Inc.

C++
C++
C++
C++
C/C++

MSVC
HIGH-C++
D-C++
GCCPPC
GCC

C/C++
GCC

CODEWARRIOR
GCC

JAVA

FASTJ

Mentor Graphics
Corporation
Microsoft Corporation
Synopsys, Inc
Wind River Systems
Wind River Systems
HighTec EDV-Systeme
GmbH
NXP Semiconductors
Free Software
Foundation, Inc.
Wind River Systems

Comment

ELF/DWARF
SAUF
ELF/DWARF
ELF/DWARF
XCOFF
ROF
ELF/DWARF
ELF/DWARF
IEEE
COFF
ELF/DWARF
ELF/DWARF
ELF/DWARF
ELF/DWARF
EXE/CV5
ELF/DWARF
ELF/DWARF
ELF/STABS
ELF/DWARF

WindowsCE

ELF/DWARF
ELF/DWARF
ELF/DWARF

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

66

Support

Realtime Operation Systems


Name

Company

Comment

AMX
ChorusOS
CMX-RTX
DEOS
ECOS
Elektrobit tresos
ERCOSEK
Erika
FreeRTOS
Linux
Linux
LynxOS
MQX
MQX
NetBSD
NORTi
Nucleus PLUS
OS-9
OSE Delta
OSEK
OSEKturbo
PikeOS
ProOSEK
pSOS+
QNX
RTEMS
RTXC 3.2
RTXC Quadros
Sciopta
SMX
ThreadX
uC/OS-II
uITRON
VRTXsa
VxWorks

KadakProducts Ltd.
Oracle Corporation
CMX Systems Inc.
DDC-I, Inc.
eCosCentric Limited
Elektrobit Automotive GmbH
ETAS GmbH
Evidence
Freeware I
MontaVista Software, LLC
LynuxWorks Inc.
NXP Semiconductors
Synopsys, Inc
MISPO Co. Ltd.
Mentor Graphics Corporation
Radisys Inc.
Enea OSE Systems
NXP Semiconductors
Sysgo AG
Elektrobit Automotive GmbH
Wind River Systems
QNX Software Systems
RTEMS
Quadros Systems Inc.
Quadros Systems Inc.
Sciopta
Micro Digital Inc.
Express Logic Inc.
Micrium Inc.
Mentor Graphics Corporation
Wind River Systems

implemented by DDC-I
1.3, 2.0 and 3.0
via ORTI
via ORTI
via ORTI
v7
Kernel Version 2.4 and 2.6, 3.x, 4.x
3.0, 3.1, 4.0, 5.0
3.1.0, 3.1.0a, 4.0
3.x and 4.x
2.40 and 2.50

4.x and 5.x


via ORTI
via ORTI/former MetrowerksOSEK
via ORTI
2.1 to 2.5, 3.0, with TRACE32
6.0 to 6.5.0
4.10

3.4 to 4.0
3.0, 4.0, 5.0
2.0 to 2.92
HI7000, RX4000, NORTi,PrKernel
5.x to 7.x

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

67

Support

3rd Party Tool Integrations


CPU

Tool

Company

ALL
ALL
ALL

ADENEO
X-TOOLS / X32
CODEWRIGHT

ALL

CODE CONFIDENCE
TOOLS
CODE CONFIDENCE
TOOLS
EASYCODE
ECLIPSE
RHAPSODY IN MICROC
RHAPSODY IN C++
CHRONVIEW
LDRA TOOL SUITE
UML DEBUGGER

Adeneo Embedded
blue river software GmbH
Borland Software
Corporation
Code Confidence Ltd

ALL
ALL
ALL
ALL
ALL
ALL
ALL
ALL
ALL
ALL
ALL

ALL
ALL
ALL
ALL
ALL
ALL
ALL
ALL
ALL
ALL
ALL
POWERPC
POWERPC
POWERPC

ATTOL TOOLS
VISUAL BASIC
INTERFACE
LABVIEW

CODE::BLOCKS
C++TEST
RAPITIME
DA-C
TRACEANALYZER
SIMULINK
TA INSPECTOR
UNDODB
VECTORCAST UNIT
TESTING
VECTORCAST CODE
COVERAGE
WINDOWS CE PLATF.
BUILDER
GR228X ICTESTSYSTEME
OSE ILLUMINATOR
DIAB RTA SUITE

Host
Windows
Windows
Windows

Code Confidence Ltd

Linux

EASYCODE GmbH
Eclipse Foundation, Inc
IBM Corp.
IBM Corp.
Inchron GmbH
LDRA Technology, Inc.
LieberLieber Software
GmbH
MicroMax Inc.
Microsoft Corporation

Windows
Windows
Windows
Windows
Windows
Windows
Windows
Windows
Windows

NATIONAL
INSTRUMENTS
Corporation
Open Source
Parasoft
Rapita Systems Ltd.
RistanCASE
Symtavision GmbH
The MathWorks Inc.
Timing Architects GmbH
Undo Software
Vector Software

Windows

Windows
Windows
Windows
Windows
Windows
Windows
Linux
Windows

Vector Software

Windows

Windows

Windows

Battefeld GmbH

Windows

Enea OSE Systems


Wind River Systems

Windows
Windows

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

68

Support

Products

Product Information
OrderNo Code

Text

LA-7723

JTAG Debugger for PPC400 (ICD)

DEBUG-PPC400

supports (1.8V - 5.0V) PPC40x


includes software for Windows, Linux and MacOSX
requires Power Debug Module
debug cable with 16 pin connector
requires LA-7984 if the target has a
Mictor38 connector

LA-7723A

JTAG Debugger License for PPC400 Add.

DEBUG-PPC400-A

supports PPC40x
please add the serial number of the base debug
cable to your order

LA-7723X

JTAG Debugger Extension for PPC400 (ICD)

DEBUG-PPC400-X

supports PPC40x
requires a valid software guaranty or a valid
software license key
please add the serial number of the base debug
cable to your order

LA-3731

JTAG Converter to Xilinx Target Adapter 14

JTAG-PPC-CON-XILINX

Converter from PPC400 16 pins to Xilinx


PPC400/Microblaze 14 pins target adapter

LA-7986

Mictor-Mictor-JTAG 16pin Converter for PPC4xx

JTAG-PPC4XX-2X38

Converter MICTOR 38 on target to


16 pin male connector JTAG Debugger PPC4XX
and MICTOR 38 of
LA-7929 Preprocessor for PPC4xx family fast flex or
LA-3900 Preproc. for PPC4XX AUTOFOCUS II Flex
required if no separate JTAG connector is provided
on the target

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

69

Products

OrderNo Code

Text

LA-7752

JTAG Debugger for PPC44x (ICD)

DEBUG-PPC44X

supports (1.8V - 5.0V) PPC440


includes software for Windows, Linux and MacOSX
requires Power Debug Module
debug cable with 16 pin connector
requires LA-7986 if the target has a
Mictor38 connector

LA-7752A

JTAG Debugger License for PPC44x Add.

DEBUG-PPC44X-A

supports PPC440
please add the serial number of the base debug
cable to your order

LA-7752X

JTAG Debugger Extension for PPC44x (ICD)

DEBUG-PPC44X-X

supports PPC440
requires a valid software guaranty or a valid
software maintenance key
please add the serial number of the base debug
cable to your order

LA-3731

JTAG Converter to Xilinx Target Adapter 14

JTAG-PPC-CON-XILINX

Converter from PPC400 16 pins to Xilinx


PPC400/Microblaze 14 pins target adapter

LA-7986

Mictor-Mictor-JTAG 16pin Converter for PPC4xx

JTAG-PPC4XX-2X38

Converter MICTOR 38 on target to


16 pin male connector JTAG Debugger PPC4XX
and MICTOR 38 of
LA-7929 Preprocessor for PPC4xx family fast flex or
LA-3900 Preproc. for PPC4XX AUTOFOCUS II Flex
required if no separate JTAG connector is provided
on the target

OrderNo Code

Text

LA-3900

Preproc. for PPC4XX AUTOFOCUS II Flex

PP-PPC4XX-AF-2

Program flow trace for PPC4xx


1.2 GHz clock speed
Variable threshold level and termination voltage,
AUTOFOCUS self calibration technology,
Supports 1.2 to 3.3V - else contact support
Requires PowerTrace
(PowerTrace Ethernet Version 6 or higher)

LA-3900A

Trace License for PPC4XX AUTOFOCUS II

PP-PPC4XX-AF-2-ADD

Supports off-chip trace port for PPC4XX if


applied to an AUTOFOCUS II preprocessor
please add the serial number of the preprocessor to
your order
AUTOFOCUS II Preprocessors with serial number
C0806xxxxxx and lower have to be send to Lauterbach
Germany for an hardware upgrade

LA-7929

Preprocessor for PPC4xx family fast flex

PP-PPC4XX-F

Program flow trace for PPC4xx


720 MHz clock speed, (180 MHz trace clock)
0.9-3.3V, connector cable and software
requires LA-7983 if the target has a
20 pin male connector

LA-7983

Conv. 38 Pin Mictor to 20 for Preproc. PPC4xx

PRE-PPC4XX-CON-20-38

Converter for preprocessor for PPC4xx MICTOR 38


(LA-7929) to 20 pin male connector (target)

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

70

Products

Order Information
Order No.

Code

Text

LA-7723
LA-7723A
LA-7723X
LA-3731
LA-7986

DEBUG-PPC400
DEBUG-PPC400-A
DEBUG-PPC400-X
JTAG-PPC-CON-XILINX
JTAG-PPC4XX-2X38

JTAG Debugger for PPC400 (ICD)


JTAG Debugger License for PPC400 Add.
JTAG Debugger Extension for PPC400 (ICD)
JTAG Converter to Xilinx Target Adapter 14
Mictor-Mictor-JTAG 16pin Converter for PPC4xx

Additional Options
LA-7752X DEBUG-PPC44X-X
LA-3730A JTAG-MICROBLAZE-A
LA-7984
JTAG-PPC4XX-CON-38
LA-7960X MULTICORE-LICENSE

JTAG Debugger Extension for PPC44x (ICD)


JTAG Debug. License for MicroBlaze Additonal
JTAG Converter to Mictor 38 for PPC4xx
License for Multicore Debugging

Order No.

Code

Text

LA-7752
LA-7752A
LA-7752X
LA-3731
LA-7986

DEBUG-PPC44X
DEBUG-PPC44X-A
DEBUG-PPC44X-X
JTAG-PPC-CON-XILINX
JTAG-PPC4XX-2X38

JTAG Debugger for PPC44x (ICD)


JTAG Debugger License for PPC44x Add.
JTAG Debugger Extension for PPC44x (ICD)
JTAG Converter to Xilinx Target Adapter 14
Mictor-Mictor-JTAG 16pin Converter for PPC4xx

Additional Options
LA-7723X DEBUG-PPC400-X
LA-3730A JTAG-MICROBLAZE-A
LA-7960X MULTICORE-LICENSE

JTAG Debugger Extension for PPC400 (ICD)


JTAG Debug. License for MicroBlaze Additonal
License for Multicore Debugging

Order No.

Code

Text

LA-3900
LA-3900A
LA-7929
LA-7983

PP-PPC4XX-AF-2
PP-PPC4XX-AF-2-ADD
PP-PPC4XX-F
PRE-PPC4XX-CON-20-38

Preproc. for PPC4XX AUTOFOCUS II Flex


Trace License for PPC4XX AUTOFOCUS II
Preprocessor for PPC4xx family fast flex
Conv. 38 Pin Mictor to 20 for Preproc. PPC4xx

Additional Options
LA-7986
JTAG-PPC4XX-2X38
LA-7992A PP-ARM-ETM-AF-2-ADD
LA-7995A PP-C55X-AF-2-ADD
LA-3903A PP-C64XP-AF-2-ADD

Mictor-Mictor-JTAG 16pin Converter for PPC4xx


Trace License for ARM-ETM
Trace License for TMS320C55x AUTOFOCUS II
Trace License for TMS320C64x+ in AUTOFOCUS II

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

71

Products

Order No.

Code

Text

LA-7996A
LA-3901A
LA-3902A
LA-7999A
LA-3904A

PP-CEVA-AF-2-ADD
PP-MICROBLA-AF-2-ADD
PP-SHX-AF-2-ADD
PP-STARCORE-AF-2-ADD
PP-TEAKLITE3-AF-2-AD

Trace License for Ceva-X AUTOFOCUS II


Trace License for MicroBlaze AUTOFOCUS II
Trace License for SH2A, SH4, SH4A in AF II
Trace License for StarCore AUTOFOCUS II
Trace License for TEAKLITE-III AUTOFOCUS II

1989-2016 Lauterbach GmbH

PPC400/PPC440 Debugger and Trace

72

Products