ICE Emulator for 386/486

Transcription

1 ICE Emulator for 386/486 TRACE32 Online Help TRACE32 Directory TRACE32 Index TRACE32 Documents... ICE In-Circuit Emulator... ICE Target Guides... ICE Emulator for 386/ WARNING... 6 Quick Start... 7 Troubleshooting Hang-Up 12 Dualport Errors 13 FAQ Configuration DIP-Switch Setting of 386SX/CX 17 DIP-Switch Setting of Cableset 19 Basics Emulation Modes 20 SYStem.Clock Clock generation 22 Dualport Access 22 General SYStem Settings and Restrictions General Restrictions 23 SYStem.Option BreakWin Break window 23 SYStem.Option FAST High speed mode 24 SYStem.Option FASTA High speed mode A 24 SYStem.Option ONCE On-circuit emulation 24 SYStem.Option PreMap Address lines 25 SYStem.Option SYNCH Synchronization mode 26 SYStem.Option TestClock Clock fail detection 26 SYStem.Option V V power fail detection 27 Continue with CPU specific Special Settings and Restrictions 27 Special Settings 386EX (no SMMC) and Restrictions Restrictions 386EX (no SMMC) 28 SYStem.Option BreakNMI Break with 2nd NMI 30 ICE Emulator for 386/486 1

2 SYStem.Option Protected Real mode/protected mode 31 SYStem.Option Prot16 Protected mode: 16 bit/32 bit code 32 SYStem.Option IDT Interrupt descriptor table base 33 Special Settings 386EX (SMMC) and Restrictions Restrictions 386EX (SMMC) 34 SYStem.Option BOOT Real mode boot segment 35 SYStem.Option Protected Real mode/protected mode 36 SYStem.Option Prot16 Protected mode: 16 bit/32 bit code 38 SYStem.Option IDT Interrupt descriptor table base 39 Special Settings 386SX, 386CX, 386DX and 486 (no SMMC) and Restrictions Restrictions 386SX, 386CX, 386DX and 486 (no SMMC) 40 SYStem.Option Protected Real mode/protected mode 42 SYStem.Option Prot16 Protected mode: 16 bit/32 bit code 43 SYStem.Option IDT Interrupt descriptor table base 44 SYStem.Option Wait Wait cycles 44 Special Settings 486 (SMMC) and Restrictions Restrictions 486 (SMMC) 46 SYStem.Option BOOT Real mode boot segment 47 SYStem.Option Protected Real mode/protected mode 47 SYStem.Option Prot16 Protected mode: 16 bit/32 bit code 49 SYStem.Option IDT Interrupt descriptor table base 50 SYStem.Option CACHE Disable cache 50 SYStem.Option BURST Disable burst 51 SYStem.Option Wait Wait cycles 51 Specific System Settings Exception Control Schematics 55 Reset Input 55 SMI (386CX, 386EX, 486) 55 NMI 56 HOLD 56 DMA Modes 57 SYStem.Line HOLD Enable HOLD line (emulation stopped) 57 exception.activate Force exception 58 exception.enable Enable exception 59 exception.trigger Trigger on exception 61 exception.pulse Stimulate exception 62 Interrupt Stimulation 62 Mapping MAP.PRE Premapper 63 MAP.BUS Buswidth mapping 64 ICE Emulator for 386/486 2

3 MAP.NoCache] No cache mapping 64 FPU MMU MMU.DUMP Dump descriptor tables 66 MMU.SCAN Scan descriptor tables 67 MMU.PDUMP Dump page tables 67 MMU.PSCAN Scan page tables 67 Special Functions Memory Classes Overview 69 Real Mode Addressing 71 Protected Mode Addressing 71 State Analyzer Keywords for the Trigger Unit 72 General 386/486 Keywords for the Trigger Unit EX Keywords for the Trigger Unit Keywords for the Trigger Unit 73 Keywords for the Display 74 General 386/486 Keywords SX, 386DX Keywords CX Keywords EX Keywords Keywords 75 Dequeueing 75 Port Analyzer Keywords for the Portanalyzer (386EX) 76 Input Connector for free Channels (386EX) 77 Compiler Compiler Support Real Mode 78 Compiler Support Protected Mode 79 3rd Party Tool Integration Realtime Operation Systems Emulation Frequency Emulation Modules Module Overview 83 Order Information 84 Operating Voltage Physical Dimensions Adapter ICE Emulator for 386/486 3

4 ICE Emulator for 386/486 4

5 ICE Emulator for 386/486 Version 06-Nov-2017 PP: \\SCO386I\func MIX AI E::w.d.l addr/line code label mnemonic comment 163 autovar = regvar = fstatic; PP: B 8B1D6C0C4000 mov ebx,[400c6c] ; ebx,fstat PP: DFC mov [ebp-4],ebx 164 autovar++; PP: FF45FC inc dword ptr [ebp-4] 166 func1( &autovar ); * to force autovar as stack-s PP: D45FC lea eax,[ebp-4] E::w.r E::w.v.v %c %m ast Cy C EAX 1 EBX 0 SP > ast = ( P _ ECX 3 EDX 4-0C word = 0x0, Ac _ DS 38 ESI count = 12345, Zr _ ES 30 EDI left = 0x401E14, S _ SS 34 ESP 3FBC FP >00003FFC right = 0x0, T _ EBP 3FCC C8C field1 = 1, I _ CS 28 EIP field2 = 2) D _ FS 30 TR 40 +0C O _ GS 30 LDTR PL 0 EF For general informations about the In-Circuit Debugger refer to the ICE User s Guide (ice_user.pdf). All general commands are described in IDE Reference Guide (ide_ref.pdf) and General Commands and Functions. ICE Emulator for 386/486 5

6 WARNING NOTE: Do not connect or remove probe from target while target power is ON. Power up: Switch on emulator first, then target Power down: Switch off target first, then emulator ICE Emulator for 386/486 6

7 Quick Start Before debugging can be started, the emulator must be configured by hardware and software: 1. Check DIP-switch setting (chapter Configuration) 2. Create setup file (next) Ready to run setup files for most standard compilers can be found on the software CD in the directory../demo/i386/compiler. All setup files are designed to run the emulator stand alone without target hardware. The following description should make the initial setup (to run the emulator together with the target hardware) easier. It describes a typical setup with frequently used settings. It is recommended to use the programming language PRACTICE to create a batch file, which includes all necessary setup commands. PRACTICE files (*.cmm) can be created with the PRACTICE editor pedit (Command: PEDIT <file name>) or with any other text editor. A basic setup file includes the following parts: 1. Set system options 2. Select dualport mode (optional) 3. Set mapper (optional) 4. Select frequency (optional) 5. Activate the emulator 6. Load application file (optional) 7. Initialize registers and chipselect units (optional) 8. Set breakpoints (optional) 9. Start application 10. Stop application (optional) ICE Emulator for 386/486 7

8 Now a typical example, how to setup the system: 1. Set system options The system window controls the CPU specific setup. Please check this window very carefully and set? the appropriate options. Use the button in the main tool bar and click to the option check box (Command: HELP.PICK) to get online help in a pop up window. system.down system.reset system.option once on system.option v33 on system.option premap on system.option protected on system.option idt 1000 ; switch the system down ; all system settings to default ; on: if clip over adapter is used ; important: ext. pull-up FLT# > 6.8K ; on: if 3.3 V module is used ; on: all CPU s, except 386SX (off) ; on: if break is in Protected Mode ; or Virtual 8086 Mode ; off: if break is in Real Mode ; address: value of IDT base register ; at the moment of break. ; Interrupt descriptor 1, 2 ; and 3 must be valid 2. Select dualport mode (optional) Dualport allows access to emulation RAM, while emulation is running. This is necessary to display variables, set breakpoints or display the flag listings while the emulation is running. System.access selects how dualport access is done. system.access request ; request: HOLD/HLDA line is used ; for dualport ; 386EX: HOLD/HLDA line must not ; be used as port lines ; denied: dualport is disabled 3. Set mapper (optional) The mapper controls the memory access of the CPU. This means the use of internal or external memory, the number of wait states, the buswidth etc. Address ranges must be defined by using memory classes. map.reset map.mode fast map.pre c:0x x00fffff map.pre c:0x3f x3ffffff map.ram ap:0x x00fffff map.ram ap:0x3f x3ffffff map.intern ap:0x x00fffff ; reset mapper (all external) ; use fast mode ; premapper: use low 1MB ; use top 1MB ; emulation RAM: use low 1MB ; emulation RAM: use top 1MB ; memory: use low 1MB internal ; use top 1MB external ; use top 1MB dualport Select frequency (optional) ICE Emulator for 386/486 8

9 The CPU can be clocked by internal (emulator) or external (target). If the internal clock is used, the clock is provides by the VCO of the emulator. The setting of the internal clock is done by the VCO command. The current CPU frequency can be displayed in the counter window (Command: Count). vco.clock 25. ; frequency: set to 25 MHz ; (necessary if internal clock used) 4. Activate the emulator When the emulator is activated a monitor program is loaded into hidden emulator memory. After the load and the falling edge of RESET the monitor program is started. This program allows access to user memory (data.dump, data.list) and register and gives control to start and stop the emulation. system.mode emulext ; system up: emulation external ; (target, ext. clock) ; or: system.mode aloneint ; (stand alone, int. clock) 5. Load application file (optional) Application can be loaded by various file formats. OMF386 file is often used to load code and symbol information. Important is the use of the correct memory model option (/flat, /pflat, /large). For information about the load command for your compiler see Compiler. data.load.omf file.abs /nocode /large ; load application file (symbols only, ; large memory model) emulator mmu is ; set automatically 6. Initialize registers and chipselect units (optional) For correct data.list and data.dump after RESET it necessary to initialize chipselect units. Stackpointer should be initialized by hand if debugging is started at RESET until it is initialized by the program. Stack is used for the emulator break system. register.set esp data.set io:0f data.set io:0f020 1 data.set io:0f021 0 data.set io:0f021 0 data.set io:0f data.set io:0f021 0ff data.set io:0f0a0 11 data.set io:0f0a1 0 data.set io:0f0a1 0 data.set io:0f0a1 11 data.set io:0f0a1 0ff ; initialize stackpointer to allow ; debugging from begin of program ; 386EX: initialize interrupt ; controller ICE Emulator for 386/486 9

10 7. Set breakpoints (optional) There are several ways to set breakpoints (Command: Break.Set). Breakpoints can be displayed using the Break.List command. Information regarding HLL lines (for HLL breakpoints) is loaded automatically when a HLL file is loaded. breakpoint.set main /program breakpoint.set counter /write ; set program break on function ; main ; set write break on variable ; counter 8. Start application Application can be started with giving a break address. For example go main starts the application and stops at symbol main. NOTE: Module versions, which do not use SMMC mode must be started via target RESET (see SYStem.Option Synch). All 386 modules should be synchronized via target RESET. go ; run application ICE Emulator for 386/486 10

11 9. Stop application (optional) Application can be breaked manually by using the Break command. If application executed a halt instruction the command Break.HALT should be used to terminate the application. break ; break application by hand It is recommended to check the following chapters for all questions regarding the correct setup: Configuration General SYStem Settings and Restrictions Special Settings 386EX (no SMMC) and Restrictions Special Settings 386EX (SMMC) and Restrictions Special Settings 386SX, 386CX, 386DX and 486 (no SMMC) and Restrictions Special Settings 486 (SMMC) and Restrictions Troubleshooting ICE Emulator for 386/486 11

12 Troubleshooting Hang-Up If you are not able to stop the emulation, there could be some typical reasons: Halt No READY Signal Clock Error NMI (no SMMC) SMI (SMMC) RESET and HOLD Analyzer Malfunction The program runs to HALT state. No cycles are generated by the CPU and the trigger system can not work. Use Break.HALT to generate a NMI/SMI interrupt and stop then the emulation. Typical reasons for HALT state are missing or invalid descriptors in Protected Mode or Virtual 8086 Mode or not correct IDT entries. If TIMOUT is not specified, the CPU cycle will not be completed, when the READY signal is missing. You can verify this state by checking the CYCLE signal with the counter function. If inactive, the CPU is stopped in the middle of the cycle. Normally no problems should occur when using an external oscillator. Be sure that the oscillator is connected with short routes to the CPU socket. If the clock input signal is only used by the CPU, the clock may be generated by the emulator system using the SYStem.Mode EmulInt. Break system will not work if NMI input is active at the same time a breakpoint or a triggerpoint is reached. Be sure that NMI is not used by the target system. Otherwise switch off the NMI line by exeption.enable NMI OFF. Break system will not work if SMI input is active at the same time a breakpoint or a triggerpoint is reached. Be sure that SMI is not used by the target system. Otherwise switch off the SMI line by exeption.enable SMI OFF. Reset and Hold signals from the target system stop emulation immediately. If these signals are constantly active, memory dump will be possible, but no emulation. If you switch off the analyzer and the CPU has stopped operation within a cycle, an invalid display will occur. Make a SYStem.Up command to see the correct trace information. ICE Emulator for 386/486 12

13 Dualport Errors Dualport errors may occur by the following conditions: 1. The length of the CPU cycle is extended by wait cycles, so that the request timeout signal is generated. 2. External DMA requests (single cycles) are too long EX P1.6/HOLD and P1.7/HLDA must be programmed as HOLD and HLDA in request mode. After Reset these pins are initialized as ports! To solve problems with dualport error first increase the SYStem.TimeReq value. Be sure of that the SYStem.TimeOut value is larger than the access time limit. If it is not possible to solve the problem by changing the values, you must switch to SYStem.Access Denied mode. In this mode no access to memory is possible while running realtime emulation. The internal dualport access can increase the reaction time for external DMA requests. The performance reduction by the dualport access is typically 1% with some data windows (dualported) on the screen and may be at max. 5% when using dynamic emulation memory. ICE Emulator for 386/486 13

14 FAQ Debugging via VPN Ref: 0307 The debugger is accessed via Internet/VPN and the performance is very slow. What can be done to improve debug performance? The main cause for bad debug performance via Internet or VPN are low data throughput and high latency. The ways to improve performance by the debugger are limited: In PRACTICE scripts, use "SCREEN.OFF" at the beginning of the script and "SCREEN.ON" at the end. "SCREEN.OFF" will turn off screen updates. Please note that if your program stops (e.g. on error) without executing "SCREEN.OFF", some windows will not be updated. "SYStem.POLLING SLOW" will set a lower frequency for target state checks (e.g. power, reset, jtag state). It will take longer for the debugger to recognize that the core stopped on a breakpoint. "SETUP.URATE 1.s" will set the default update frequency of Data.List/Data.dump/Variable windows to 1 second (the slowest possible setting). prevent unneeded memory accesses using "MAP.UPDATEONCE [address-range]" for RAM and "MAP.CONST [address--range]" for ROM/FLASH. Address ranged with "MAP.UPDATEONCE" will read the specified address range only once after the core stopped at a breakpoint or manual break. "MAP.CONST" will read the specified address range only once per SYStem.Mode command (e.g. SYStem.Up). ICE Emulator for 386/486 14

15 Target Power Supply Switch Ref: 0103 Is there a simple way to control target power supply via the ICE to prevent problems after the ICE has been powered off? Follow the sequence below. If you own an output probe COUT8, connect it to the STROBE output connector. Type PULSE2. and press F1. You will get the pin out of the output probe COUT8. Pin 13 (OUT6) delivers +5 V after the emulator has finished its initialization and 0 V if the emulator is powered off. This can be used to drive a relay via a transistor to switch the target power on and off automatically if the Pulse Generator is not used for other purposes. The schematic of the switching unit can be found in the file TARGETC.CMM. Additionally Pin 13 (OUT6) can be controlled by ICE commands. Target power supply off. "PULSE2.P +" Target power supply on. "PULSE2.P -" The following Practice command file creates 3 buttons in the Toolbox for: Target power on Target power off Target power off and QUIT. Wrong Location after Break Ref: 0030 Break Error Ref: 0028 Adding that file to T32.cmm loads the buttons automatically after startup. Why is the location after break wrong? Most emulators use some bytes of user stack for the break system. Therefore it is necessary to have valid stack, if single step or breakpoints are used. What could be the reasons for malfunction of breakpoints, single step and break by hand? User stack must be valid "SYStem.Option Protected" and "SYStem.Option IDT" must be configured correctly. Interrupt descriptors 1, 2 and 3 must be valid. NMI on no SMMC modules must not be active (x.enable nmi off) 386EX (no SMMC): Internal refresh controller must be stopped on emulation stop and started on emulation go. See "SYStem.Option BreakNMI". ICE Emulator for 386/486 15

16 Clip-Over Adaption 386/486 Ref: 0031 OFF ON 386EX 386EX Dualport Error Ref: 0048 Why does clip-over adaption work uncorrectly? Set System.option ONCE on. Check target connection of FLT# pin. External pull-ups should not be lower than 6.8 K. Why crashes the emulator after a break with system.access request? Emulator Dualport is implemented using HOLD/HLDA pin of the CPU. A fundamental condition for correct working with HOLD/HLDA line is the correct programming of port 1.6 and 1.7 as HOLD/HLDA function of 386EX. If this condition is fulfilled, and a dualport error occurs after a break the following topic should be checked: Because of a chip bug, under specific circumstances, the CPU generates faulty bus cycles, which crashes the emulator monitor program. The chip bug is described in the Intel document "Intel 386EX Embedded Processor Specification Update" (order number: ) under errata #38. Please follow the recommendations to solve the problem by using one of three workarounds described in this document. There is no bug fix planned. ICE Emulator for 386/486 16

17 Configuration The configuration of the different target CPU's and sockets is done by changing the probe or the sockets. The port analyzer is an optional unit, which is plugged on the ICE386 board. The software is configured automatically. The CPU type on the probes must be jumpered. Otherwise the message Configuration Error may appear. DIP-Switch Setting of 386SX/CX. Module SX CPU type SX ON OFF ON OFF ON OFF OFF OFF 386CX OFF ON OFF ON OFF ON ON ON 8-1 top view To select another CPU type, it is necessary to exchange the CPU on the module! ICE Emulator for 386/486 17

18 DIP-Switch Setting of 486 Module PGA SW SX ON ON ON OFF OFF OFF OFF OFF SX SLE ON OFF ON OFF ON ON ON OFF DX ON ON OFF OFF OFF OFF OFF OFF 486DX SLE ON OFF OFF OFF ON ON ON OFF 486DX2 OFF ON ON OFF OFF OFF OFF OFF 486DX4/DX5 OFF ON OFF OFF ON ON ON OFF SW1 SW bottom view (top board) SW SX OFF OFF OFF OFF ON OFF ON OFF 486SX SLE OFF OFF OFF OFF ON OFF ON OFF 486DX OFF OFF OFF ON OFF ON OFF ON 486DX SLE OFF OFF OFF ON OFF ON OFF ON 486DX2 ON OFF OFF ON OFF ON OFF ON 486DX4 OFF ON OFF ON OFF ON OFF ON 486DX5 ON OFF OFF ON OFF ON OFF ON To select another CPU type, it is necessary to exchange the CPU on the module! NOTE: 486DX4/DX5 can be used with pcb revision EKDD_5 only.ekdd_4 does not support 486DX4/DX5. If 486DX4/DX5 (3.3V) module shall be used as 486DX2 (5V) module, Jumper 706 must be removed. Jumper 706 is the only 0R resistor on the top pcb, top view, located between the blue connectors. For 486DX4/DX5 jumper 706 must be closed.ice 386 board must support SMMC mode for 486DX4/DX5. ICE Emulator for 386/486 18

19 Cableset ICE386 is connected with the modules via three or four cables depending on the type of module. If you change from a 386EX module to another please be sure that you are using the correct three ones. Module 386EX: Module 386SX, CX, DX, 486-PGA, 486-PQFP: NOTE: Cable 3 (port analyzer) is not used with this modules! ICE Emulator for 386/486 19

20 Basics Emulation Modes E::w.sys system Mode Clock TimeReq Option Down RESet VCO 1.000ms BreakWin Up Analyser Low TimeOut ONCE Monitor Mid us TestClock RESet ResetDown High Protected ResetUp Line FAST reset NoProbe Access HOLD SYNCH RESetOut AloneInt Nodelay PreMap AloneExt REFresh BreakNMI cpu-type EmulInt Request CACHE I80386EX EmulExt Denied BURST IDT Wait 0. The emulation head can stay in 6 modes. The modes are selected by the SYStem.Up or the SYStem.Mode command. SYStem.Mode <mode> <mode>: ResetDown ResetUp AloneInt AloneExt EmulInt EmulExt ICE Emulator for 386/486 20

21 Reset Down Reset Up Alone Internal Alone External Emulation Internal Emulation External Target is down, all drivers are in tristate mode. Target has power, drivers are logically in inactive state, but not tristate. Probe is running with internal clock, driver inactive. This mode is used for 'standalone' operation. Probe is running with external clock, driver inactive. Probe is running with internal clock, strobes to target are generated. Probe is running with external clock, strobes to target are activated. In active mode, the power of the target is sensed and by switching down the target the emulator changes to RESET mode. The probe is not supplied by the target. When running without target, the target voltage is simulated by an internal pull-up resistor. ICE Emulator for 386/486 21

22 SYStem.Clock Clock generation SYStem.Clock <option> <option>: VCO High Mid Low VCO Low, Mid, High Variable frequency 1 35 MHz. 2.5, 5.0 or 10.0 MHz. Dualport Access SYStem.Access <option> <option>: Request Denied Request Denied To realize the dualport access (emulation memory) at high frequencies the HOLD-line of the CPU is used. Dualport accesses are only allowed while no external request to the bus occurs and the CPU cycle is completed. If the emulation CPU is in RESET state of the CPU the system controller will always access the emulation memory. 386EX P1.6/HOLD and P1.7/HLDA will be programmed automatically as HOLD and HLDA in request mode. Dualport access is not possible while the emulation is running. Dualport allows access to emulation RAM, while emulation is running. This is necessary to display variables, set breakpoints or display flag listings while the emulation is running. Dualport access is only possible for emulator internal RAM. ICE Emulator for 386/486 22

23 General SYStem Settings and Restrictions General Restrictions Memory Setup All 386/486 type in-circuit emulators need memory in the stack area (SS:ESP) to break correctly. If you get an invalid EIP and CS value after the program has stopped, the stack area may be outside the memory area. The break system needs additionally 12 bytes on the top of the stack. To set breakpoints on I/O cycles, there must be free emulation memory for this area. Therefore reserve 64K of memory for the I/O area if possible. Register Setup The TF (Trap Flag) register trace flag must not be set to 1. Interrupt Vector/Descriptor Table For the emulator break system it is necessary to set the interrupt vector/descriptor table to a multiple of 4 address (386), or a multiple of 16 address (486). User program should not read at vector/descriptor 1, 2 and 3 address location. SYStem.Option BreakWin Break window SYStem.Option BreakWin [ON OFF] All program breakpoints are hardware based. The operation is done by replacing the opcode with an INT3 instruction. For not breaking on every INT3 code in the target program break sequencing is only possible during some cycles after the breakpoint cycle. In some cases it may be an advantage to switch off this feature (for example when using INT3 as software breakpoints in relocating programs). Especially when using block copy assembler instructions and setting a breakpoint at this location it could be necessary to switch off this option. Warning If the Break Window is OFF, accesses to vector table may stop the emulation. ICE Emulator for 386/486 23

24 SYStem.Option FAST High speed mode SYStem.Option FAST [ON OFF] The maximum emulation frequency of the emulator depends on the used CPU and memory type. The values printed in chapter Emulation Frequency are valid for internal memory. To emulate targets with faster (external) memory at higher frequencies it may be necessary to disable the emulator break system and mapper. With the FAST option set, only single step, asynchronous break and fast break is available. SYStem.Option FAST includes automatically SYStem.Option FASTA. Warning Internal (emulation) memory is disabled in this mode! SYStem.Option FASTA High speed mode A SYStem.Option FASTA [ON OFF] The maximum emulation frequency of the emulator depends on the used CPU and memory type. To improve emulator timining on frequencies above 20 MHz some mapper signals can be disabled with this option. The following mapper functions are disabled, when option is set to ON: MAP.NoCache, MAP.Ack, MAP.BUS8, MAP.BUS16, MAP.Wait. SYStem.Option ONCE On-circuit emulation SYStem.Option ONCE [ON OFF] This option selects the ONCE mode. The CPU soldered on the target system is floated on target reset by activating CPU FLT# line (put to GND). There is a 1k protection resistor on the ICE386 board. External pullups must have a value of at least 6.8KOhm to pull the line to a valid low level. To use this option a special clip-over adapter is needed. ICE Emulator for 386/486 24

25 SYStem.Option PreMap Address lines SYStem.Option PreMap [ON OFF] The emulator can run in 24-, 26- and 32-Bit mode. If the upper address lines are not used by the target system, the pre-mapper should be switched off. Bus Width SYStem.Option PreMap CPU 24 OFF 386SX 26 ON 386CX, 386EX 32 ON 386DX, 486 For additional information refer to the MAP.PRE command. NOTE: This option is selectable in active mode only. ICE Emulator for 386/486 25

26 SYStem.Option SYNCH Synchronization mode SYStem.Option SYNCH [ON OFF] All 386 and some 486 CPU s must be supplied with a double clock signal. This CLK2 signal is divided by two internally to generate the internal processor clock. The internal clock is subdivided in phase one and phase two, whereby each phase corresponds with one CLK2 period. The phase of the internal processor clock can be synchronized to a known phase by the falling edge of the RESET signal. Normally the target's logic generates a divided CLK2 signal to separate both phases. Divided CLK2 signal of Emulator's logic must be synchronized via RESET with the logic's CLK signal. There are two possibilities to do this: If program runs on the emulator, activate the target's RESET, and both CLK signals will be synchronized automatically. or If no program runs on the emulator, set System.Option SYNCH to ON and activate the target's RESET. In this mode CPU's RESET line is connected with the external RESET line logical ANDed with X.Enable RESET. See also Exception Control. Command SYStem.RESetOut generates a RESET pulse on the 2-pole module connector. This signal may be used to RESET target and emulator automatically. NOTE If BUSY# line is active while the falling edge of RESET the CPU performs a selftest, which takes about 2 exp 19 clocks. Depending on the CPU frequency and the Time Request value a dualport error may occur. SYStem.Option TestClock Clock fail detection SYStem.Option TestClock [ON OFF] Missing clock signals force emulator system to generate a Target Clock Fail error and to set emulation system to RESET. To use the Power-Down modes of the CPU the clock test logic must be blocked. ICE Emulator for 386/486 26

27 SYStem.Option V V power fail detection SYStem.Option V33 [ON OFF] The emulator has a detection logic to detect a power fail. This logic has to be adjusted for 3.3 V CPUs. Continue with CPU specific Special Settings and Restrictions The following Special Settings and Restrictions are subdivided by CPU type and the use or not use of SMMC from emulator break logic. All new delivered emulators for 386EX and 486 CPUs are using SMM mode for the break system. Older 386EX and 486 modules and 386SX, 386CX and 386DX modules use NMI for break system (no SMMC mode). NOTE: To find out, if your emulator uses SMMC mode or not please check SYStem window. Under CPU-type (in the second line) SMMC should be displayed. If there is no entry, no SMM is used for the break system. Special Settings 386EX (no SMMC) and Restrictions Special Settings 386EX (SMMC) and Restrictions Special Settings 386SX, 386CX, 386DX and 486 (no SMMC) and Restrictions Special Settings 486 (SMMC) and Restrictions ICE Emulator for 386/486 27

28 Special Settings 386EX (no SMMC) and Restrictions Restrictions 386EX (no SMMC) Interrupt Restrictions Interrupt Descriptor Setup Pending Interrupts Pending Interrupts during Single Step Real/Protected/Virtual 8086 Mode/Paging The NMI signal is used to stop emulation. The 'INT 3' instruction and the TrapFlag are used for single stepping and program breaks. Therefore the interrupt vectors 1, 2 and 3 may not be used by the target program when breakpoints are set or single stepping is done. However the vector entries should be defined, as the first locations of the code, addressed by these vectors, are fetched but not executed. If the vectors are not defined, this fetch can cause unpredictable results by reading memory or trigger by accessing wrong data areas. Interrupt descriptor 1, 2 and 3 must be valid.the start address of the vector/descriptor table must be a multiple of 4 using 386 processors and a multiple of 16 using 486 processors. Offset of interrupt gate 2 (NMI) must not be higher than 0f When internal interrupts are pending and the emulation is started at a program breakpoint, the interrupt routine will be executed once and the program will stop at the same breakpoint again. A solution to this problem can be to execute one step to skip over the breakpoint location (see also SETUP.STEPBREAK). Another solution is to disable or reset the timer while the emulation is stopped. This can be done by an extra nmi user routine (see also SYStem.Option BreakNMI). When executing an assembler step and internal interrupts are pending, the emulator will step into the interrupt program. This can be changed either by preventing the interrupt, e.g. stop the timer while the emulation is stopped (see 'Pending Interrupts') or by disabling the interrupt bit in the CPU (command SETUP.IMASKASM). For HLL steps the problem can be solved in the same way (command SETUP.IMASKHLL) or by temporarily removing the HLL breakpoint of the current line during the step (SETUP.StepInt). 386EX (no SMMC) emulator supports the Real Mode and the Protected Mode. In Protected Mode only privilege level 0 is supported. Virtual 8086 Mode and Paging is not supported. 386EX (SMMC) support all modes. ICE Emulator for 386/486 28

29 System Management Mode Memory access Ready generation Refresh Control Start after Reset The System Management handler disables NMI. But NMI is used by the emulator break system. Therefore it is necessary that the user enables NMI in the SMM handler. This can be done, by activating the INTR signal or by using a software interrupt INT xx. After interrupt service routine is processed, NMI is enabled. System.Option IDT must be zero, System.Option Protected must be OFF. Emulation DRAM cannot be used with 386EX module. External DRAM is accessible. The hidden wait system is not working with 386EX (see also SYStem.Option Wait). 386EX CPU can either use external Ready signal (via Ready pin) or internal Ready (via chipselect unit) or a mix mode. In mix mode, some waitstates are forced from chipselect unit, then external Ready signal is used. Mix mode is not supported. 386EX internal refresh controller must be stopped on emulator break and started on emulator go. Please refer to SYStem.Option BreakNMI, how to implement this. To continue refresh, while emulator is stopped use emulator refresh controller. Please refer to REFresh. After Reset 386/486 CPUs starts program at top of memory (386EX at AP:3fffff0). The emulator starts at AP:0ffff0 after Reset. The reason for this behavior is that CS-register is 0f000 and EIP is 0fff0. This address is calculated to physical address AP:0ffff0. The special address calculation after Reset is not used by the emulator. To solve this problem in standalone mode use the following command sequence in your setup file: x.activate resin on go x.activate resin off. These sequence activates RESET signal before emulation starts.to solve this problem with connected target:patch program code at AP:0ffff0 jmp 0fff0 (loop). After program has started with this loop, press the external RESET button to Reset CPU. Program will start at top of memory after Reset. To do this automatically use the RESOUT pin on the emulator pod to give a Reset signal to the target hardware (SYStem.RESetOut). Handling of Single Step and Breakpoints:Single Step cannot be used from RESET to the first far jump (cs reloaded). Breakpoints can be used within this memory area, but program cannot be continued after break. After first far jump this restrictions disappear. ICE Emulator for 386/486 29

30 SYStem.Option BreakNMI Break with 2nd NMI SYStem.Option BreakNMI [ON OFF] This option can be edited only with 386EX and if emulator is down. If option is set to ON, emulator breaks on second INT2 trap after application NMI trap handler is executed. To break correctly with 386EX it is necessary to stop internal peripheral. After a new "go" command peripherals must be activated. To realize these features it is necessary to use SYS.Option BreakNMI ON. Normally the emulator breaks after an emulator generated NMI signal. With BreakNMI ON the emulator activates NMI and program continues at NMI interrupt routine. In this subroutine the user has the possibility to reprogram the peripherals and after processing an user INT 2 command the emulator breaks. After the "go" command cpu continues after the INT 2 command. The user can start the peripherals and after processing an IRET command program continues the main program. Example: 1. sys.mode rd 2. sys.option BreakNMI on 3. Supply NMI vector/descriptor 4. Write NMI subroutine push ax push dx mov ax,80h xchg al,ah out 23h,al xchg al,ah out 22h,al out 22h,ax mov ax,0 mov dx,0f4a4h out dx,ax pop dx pop ax int 2 push ax push dx mov ax,8000h mov dx,0f4a4h out dx,ax pop dx pop ax iret ;save ax ;save dx ;enable expanded i/o space ;stop refresh control unit ;load dx ;load ax ;break ;save ax ;save dx ;start refresh control unit ;load dx ;load ax ;jump back to main programm (before break) 5. Program emulator refresh controller: ref.a 0--3fff (for example) ref.sb. Please refer to REFresh. ICE Emulator for 386/486 30

31 SYStem.Option Protected Real mode/protected mode SYStem.Option Protected [ON OFF] This option influences the emulator break system and the disassembler. Switch this option to ON, if program should be breaked in Protected Mode. Switch this option to OFF, if program should be breaked in Real Mode. While setting this option it is necessary that emulator is up and no real-time emulation is running. Break system The emulator uses interrupt number 1 3 to break the user program. Therefore the break system must know the location of these interrupt vectors. The interrupt vector/descriptor table starts at the address located in the IDT-Base Register of the CPU. This value must be edited in the SYStem.Option IDT field. NOTE: Start address of vector/descriptor table must be a multiple of 4 using 386 processors and a multiple of 16 using 486 processors. In Real Mode each vector entry is 4 bytes, in Protected Mode 8 bytes long. In Protected Mode it is necessary to supply the emulator with a valid interrupt descriptor for interrupt number 1, 2 and 3. Offset of interrupt gate 2 (NMI) must not be higher than 0f Disassembler In Real Mode the address- and operand size is always 16 bit. The default address- and operand size in Protected Mode is 32 bit. Depending on the SYStem.Option Protected and SYStem.Option Prot16 the disassembler interprets code as 16 bit- or 32 bit-code, when the memory access class A: (absolute addresses) is used. When using logical access classes this option does not influence the disassembler. The following table shows disassembler control: Access Class SYStem.Option Protected SYStem.Option Prot16 Disassembler Mode A: OFF OFF 16 bit Real Mode A: ON OFF 32 bit Protected Mode A: OFF ON 16 bit - A: ON ON 16 bit Protected Mode not A: - - depends on d.load (mmu information) depends on d.load (mmu information) sys.o p on sys.o idt 0x100 ;program runs in Protected Mode ;descriptor table is located at address a:100 ;set valid interrupt descriptors at address a:108, ;a:110 and a:118! ICE Emulator for 386/486 31

32 SYStem.Option Prot16 Protected mode: 16 bit/32 bit code SYStem.Option Prot16 [ON OFF] This option influences the disassembler when using access class A:. Switch this option to ON, if disassembler shall display 16 bit code in Protected Mode. Switch this option to OFF, if disassembler shall display 32 bit segments in Protected Mode. In Real Mode the address- and operand size is always 16 bit. The default address- and operand size in Protected Mode is 32 bit. Depending on the SYStem.Option Protected and SYStem.Option Prot16 the disassembler interprets code as 16 bit- or 32 bit-code, when the memory access class A: (absolute addresses) is used. When using logical access classes this option does not influence the disassembler. The following table shows disassembler control: Access Class SYStem.Option Protected SYStem.Option Prot16 Disassembler Mode A: OFF OFF 16 bit Real Mode A: ON OFF 32 bit Protected Mode A: OFF ON 16 bit - A: ON ON 16 bit Protected Mode not A: - - depends on d.load (mmu information) depends on d.load (mmu information) ICE Emulator for 386/486 32

33 SYStem.Option IDT Interrupt descriptor table base SYStem.Option IDT <address> This option influences the emulator break system. As address value use physical address of IDT at the moment of break. This is normally the value of IDT-base register. While setting this option it is necessary that emulator is up and no realtime emulation is running. The emulator uses interrupt number 1 3 to break the user program. Therefore the break system must know the location of these interrupt vectors. The interrupt vector/descriptor table starts at the address located in the IDT-Base Register of the CPU. This value must be edited in the System.Option IDT field. NOTE: Start address of vector/descriptor table must be a multiple of 4 using 386 processors and a multiple of 16 using 486 processors. In Real Mode each vector entry is 4 bytes, in Protected Mode 8 bytes long. In Protected Mode it is necessary to supply the emulator with a valid interrupt descriptor for interrupt number 1, 2 and 3. Offset of interrupt gate 2 (NMI) must not be higher than 0f See also SYStem.Option Protected. sys.o p on sys.o idt 0x100 ; program runs in Protected Mode ; descriptor table is located at address a:100 ; set valid interrupt descriptors at address a:108, ; a:110 and a:118! ICE Emulator for 386/486 33

34 Special Settings 386EX (SMMC) and Restrictions Restrictions 386EX (SMMC) Interrupt Restrictions The SMI signal is used to stop the emulation. The 'INT 3' instruction and the TrapFlag are used for single stepping and program breaks. Therefore the interrupt vectors 1 and 3 may not be used by the target program when breakpoints are set or single stepping is done. However the vector entries should be defined, as the first locations of the code, addressed by these vectors, are fetched but not executed. If the vectors are not defined, this fetch can cause unpredictable results by reading memory or trigger by accessing wrong data areas. Interrupt Descriptor Setup Pending Interrupts Pending Interrupts during Single Step Real/Protected/Virtual 8086 Mode/Paging System Management Mode Memory access Interrupt descriptor 1 and 3 must be valid.the start address of the vector/descriptor table must be a multiple of 4 using 386 processors and a multiple of 16 using 486 processors. When internal interrupts are pending and the emulation is started at a program breakpoint, the interrupt routine will be executed once and the program will stop at the same breakpoint again. A solution to this problem can be to execute one step to skip over the breakpoint location (see also SETUP.STEPBREAK). When executing an assembler step and internal interrupts are pending, the emulator will step into the interrupt program. This can be changed either by preventing the interrupt, e.g. stop the timer while the emulation is stopped (see 'Pending Interrupts') or by disabling the interrupt bit in the CPU (command SETUP.IMASKASM). For HLL steps the problem can be solved in the same way (command SETUP.IMASKHLL) or by temporarily removing the HLL breakpoint of the current line during the step (SETUP.STEPINT). 386EX (SMMC) emulator supports the Real Mode, Protected Mode and Virtual 8086 Mode including Paging. In Protected Mode all privilege levels are supported. This is different to non SMMC mode. Debugging of the System Management handler is not supported. Emulation DRAM cannot be used with 386EX module. External DRAM is accessible. The hidden wait system is not working with 386EX (see also SYStem.Option Wait). ICE Emulator for 386/486 34

35 Ready generation Chipselect configuration Refresh Control Start after Reset Background Mode 386EX CPU can either use external Ready signal (via Ready pin) or internal Ready (via chipselect unit) or a mix mode. In mix mode, some waitstates are forced from chipselect unit, then external Ready signal is used. Mix mode is not supported. CSxMSKL and UCSMSKL register include a bit CMSMM (SMM Mask Bit). CMSMM is set automatically by the emulator monitor program. This is necessary to display target memory correctly, when emulation is stopped. Do not reset this bits, while emulation is stopped. 386EX internal refresh controller is automatically stopped on emulator break and started on emulator go. To continue refresh, while emulator is stopped use emulator refresh controller. Please refer to REFresh. After Reset 386/486 CPUs starts program at top of memory (386EX at AP:3fffff0). The emulator starts at this address after Reset. The Data.List windows shows correct code after SYStem.Up (at AP:3fffff0). This is different from non SMMC mode. Go.Back is disabled. SYStem.Option BOOT Real mode boot segment SYStem.Option BOOT [ON OFF] This option influences emulator go after a break in Real Mode boot segment (3ff ffffff) and setting of CS register. After Reset a special address translation is working to start program at top of memory. After a break, information about running in boot segment is lost. To continue program in boot segment SYStem.Option BOOT must be set to ON. After the first far jump this option must be set to OFF. To set CS register to a value in boot segment (via register.set), switch this option to ON. If CS is set to a non boot segment, switch this option to OFF. NOTE: This feature is available on SMMC modules only. ICE Emulator for 386/486 35

36 SYStem.Option Protected Real mode/protected mode SYStem.Option Protected [ON OFF] This option influences the emulator break system and the disassembler. Switch this option to ON, if program should be breaked in Protected Mode or Virtual 8086 Mode. Switch this option to OFF, if program should be breaked in Real Mode. While setting this option it is necessary that emulator is up and no realtime emulation is running. Break System The emulator uses interrupt number 1and 3 to break the user program. Therefore the break system must know the location of these interrupt vectors. The interrupt vector/descriptor table starts at the address located in the IDT-Base Register of the CPU. This value must be edited in the SYStem.Option IDT field. NOTE: Start address of vector/descriptor table must be a multiple of 4 using 386 processors and a multiple of 16 using 486 processors. In Real Mode each vector entry is 4 bytes, in Protected Mode and Virtual 8086 Mode 8 bytes long. In Protected Mode it is necessary to supply the emulator with a valid interrupt descriptor for interrupt number 1 and 3. ICE Emulator for 386/486 36

37 Disassembler In Real Mode the address- and operand size is always 16 bit. The default address- and operand size in Protected Mode is 32 bit, in Virtual 8086 Mode 16 bit. Depending on the SYStem.Option Protected and SYStem.Option Prot16 the disassembler interprets code as 16 bit- or 32 bit-code, when the memory access class A: (absolute addresses) is used. When using logical access classes this option does not influence the disassembler. The following table shows disassembler control: Access Class SYStem.Option Protected SYStem.Option Prot16 Disassembler Mode A: OFF OFF 16 bit Real Mode A: ON OFF 32 bit Protected Mode A: OFF ON 16 bit - A: ON ON 16 bit Protected Mode, Virtual 8086 not A: - - depends on d.load (mmu information) depends on d.load (mmu information) sys.o p on sys.o idt 0x100 ; program runs in Protected Mode ; descriptor table is located at address a:100 ; set valid interrupt descriptors at address a:108, ; a:110 and a:118! ICE Emulator for 386/486 37

38 SYStem.Option Prot16 Protected mode: 16 bit/32 bit code SYStem.Option Prot16 [ON OFF] This option influences the disassembler when using access class A:. Switch this option to ON, if disassembler shall display 16 bit code in Protected Mode or Virtual 8086 Mode. Switch this option to OFF, if disassembler shall display 32 bit segments in Protected Mode. In Real Mode the address- and operand size is always 16 bit. The default address- and operand size in Protected Mode is 32 bit, in Virtual 8086 Mode 16 bit. Depending on the SYStem.Option Protected and SYStem.Option Prot16 the disassembler interprets code as 16 bit- or 32 bit-code, when the memory access class A: (absolute addresses) is used. When using logical access classes this option does not influence the disassembler. The following table shows disassembler control: Access Class SYStem.Option Protected SYStem.Option Prot16 Disassembler Mode A: OFF OFF 16 bit Real Mode A: ON OFF 32 bit Protected Mode A: OFF ON 16 bit - A: ON ON 16 bit Protected Mode, Virtual 8086 not A: - - depends on d.load (mmu information) depends on d.load (mmu information) ICE Emulator for 386/486 38

39 SYStem.Option IDT Interrupt descriptor table base SYStem.Option IDT <address> This option influences the emulator break system. As address value use physical address of IDT at the moment of break. This is normally the value of IDT-base register. While setting this option it is necessary that emulator is up and no realtime emulation is running. The emulator uses interrupt number 1 and 3 to break the user program. Therefore the break system must know the location of these interrupt vectors. The interrupt vector/descriptor table starts at the address located in the IDT-Base Register of the CPU. This value must be edited in the System.Option IDT field. NOTE: Start address of vector/descriptor table must be a multiple of 4 using 386 processors and a multiple of 16 using 486 processors. In Real Mode each vector entry is 4 bytes, in Protected Mode 8 bytes long. In Protected Mode it is necessary to supply the emulator with a valid interrupt descriptor for interrupt number 1 and 3. See also SYStem.Option Protected. sys.o p on sys.o idt 0x100 ; program runs in Protected Mode ; descriptor table is located at address a:100 ; set valid interrupt descriptors at address a:108, ; a:110 and a:118! ICE Emulator for 386/486 39

40 Special Settings 386SX, 386CX, 386DX and 486 (no SMMC) and Restrictions Restrictions 386SX, 386CX, 386DX and 486 (no SMMC) Interrupt Restrictions Interrupt Descriptor Setup Pending Interrupts during Single Step Real/Protected/Virtual 8086 Mode/Paging The NMI signal is used to stop emulation. The 'INT 3' instruction and the TrapFlag are used for single stepping and program breaks. Therefore the interrupt vectors 1, 2 and 3 may not be used by the target program when breakpoints are set or single stepping is done. However the vector entries should be defined, as the first locations of the code, addressed by these vectors, are fetched but not executed. If the vectors are not defined, this fetch can cause unpredictable results by reading memory or trigger by accessing wrong data areas. Interrupt descriptor 1, 2 and 3 must be valid.the start address of the vector/descriptor table must be a multiple of 4 using 386 processors and a multiple of 16 using 486 processors. Offset of interrupt gate 2 (NMI) must not be higher than 0f When executing an assembler step and interrupts are pending, the emulator will step into the interrupt program. This can be changed either by preventing the interrupt, e.g. stop the timer while the emulation is stopped or by disabling the interrupt bit in the CPU (command SETUP.IMASKASM). For HLL steps the problem can be solved in the same way (command SETUP.IMASKHLL) or by temporarily removing the HLL breakpoint of the current line during the step (SETUP.STEPINT). 386SX, 386CX, 386DX and 486 (no SMMC) emulator supports the Real Mode and the Protected Mode. In Protected Mode only privilege level 0 is supported. Virtual 8086 Mode and Paging is not supported. ICE Emulator for 386/486 40