ICE Emulator for MC68020/30

ICE Emulator for MC68020/30 TRACE32 Online Help TRACE32 Directory TRACE32 Index TRACE32 Documents... ICE In-Circuit Emulator... ICE Target Guides... ICE Emulator for MC68020/30... 1 Warning... 4 Quick Start... 4 Troubleshooting... 5 Hang-Up 5 Dualport Errors 6 FAQ... 7 Configuration... 12 Basics... 12 Emulation Modes 13 SYStem.Clock Clock generation 14 SYStem.Mode Select emulation modes 15 General SYStem Settings and Restrictions... 16 General Restrictions 16 SYStem.Line CPU signals 16 SYStem.Option TestClock Clock test 17 SYStem.Option TestPower Power test 17 Exception Control... 18 Reset 19 Halt 21 Berr 22 BR 22 Interrupt Control 23 Interrupt Stimulation 23 Mapping... 24 FPU... 25 SYStem.Option FPU Activate emulator based FPU 25 MMU... 27 ICE Emulator for MC68020/30 1

MMU.view Display MMU registers 27 MMU.Set Modify MMU registers 27 MMU.DUMP Dump MMU tables 28 MMU.SCAN Scan MMU tables 29 Cache... 30 SYStem.Option CACHE Enable cache 30 Wait Cycles... 31 Breakpoint System... 32 Monitor Extensions... 33 Memory Classes... 34 State Analyzer... 36 Keywords for the Trigger Unit 36 Keywords for the Display 38 Dequeueing 39 Compilers... 40 Debugger Support... 42 RTOS Support... 43 Emulation Frequency... 44 Emulation Modules... 45 Module Overview 45 Order Information 45 Physical Dimensions... 46 Physical Dimensions 68020/30 Module 46 ICE Emulator for MC68020/30 2

ICE Emulator for MC68020/30 Version 06-Nov-2017 SP:0017BE \\MCC\mcc\sieve+36... MIX EI E::w.d.l addr/line code label mnemonic comment 571 flags[ k ] = FALSE; SP:0017BE 4212 clr.b (a2) 572 k += prime; SP:0017C0 D5C4 adda.l d4,a2 ; prime,a2 SP:0017C2 D684 add.l d4,d3 ; prime,k SP:0017C4 7012 moveq #12,d0 ; #18,d0 SP:0017C6 B083 cmp.l d3,d0 ; k,d0 SP:0017C8 6CF4 bge $17BE E::w.v.chain %r %m ast ast.left E::w.v.ref 0x0 (0) (word = 0x0 NULL, flags = (1, 1, 1, 1, 1 count = 12346, k = 3 left = 0x5200 (word = 0x0, count = 12, prime = 3 right = 0x5600 (word = 0x0, count = 0, i = 0 field1 = 1, count = 0 field2 = 2), vint = 1 0x1 (1) (word = 0x0 NULL, count = 12, left = 0x5756 (word = 0x0, count = 34, right = 0x5680 (word = 0x0, count = 0, For general informations about the In-Circuit Debugger refer to the ICE User s Guide (ice_user.pdf). All general commands are described in IDE Reference Guide (ide_ref.pdf) and General Commands and Functions. ICE Emulator for MC68020/30 3

Warning NOTE: Do not connect or remove probe from target while target power is ON. Power up: Switch on emulator first, then target Power down: Switch off target first, then emulator Quick Start tbd. ICE Emulator for MC68020/30 4

Troubleshooting Hang-Up If you are not able to stop the emulation, there may be some typically reasons: Double Address Error No DTACK Signal Clock Error Interrupt Request Analyzer Function After a double address error the CPU is in halt state, use the SYStem.Up command to start again. Double address errors normally occur when the stack pointer is out of memory. If not TIMOUT is specified, the CPU cycle isn t completed if the DTACK signal fails. On memory display windows BERR signals are not accepted. You can verify this state by checking the CYCLE signal with the counter function. When low, the CPU is stopped in the middle of the cycle. When request mode is selected, a dualport error occurs and the emulator system changes to reset state. The clock lines between the target and the oscillator replacement are very short. Therefore normally no problems should occur when using an external crystal. Be sure that the capacitors on the target have a value of 20 pf minimum and are with short routes connected to the CPU socket. The device is specified for 8 to 16.7 or 20.0 MHz. If all IPL signals are active low at the same time (NMI request) you can t use an asynchronous break. This interrupt level in usually used for fatal errors in target systems only. If only program breakpoints are used, no restriction in using interrupt level 7 is known. If you switch off the analyzer and the CPU has stopped operation, an invalid display occurs. Make a SYStem.Up command to see the true trace information. ICE Emulator for MC68020/30 5

Dualport Errors To realize the dualport access (emulation memory) the BR-line of the CPU is used. Dualport accesses are allowed only while no external request to the bus occurs and the CPU cycle is completed. If the emulation CPU is in RESET state of the CPU the system controller may always access the emulation memory. Dualport errors may occur by the following conditions: 1. The length of the CPU cycle is extended by wait cycles, so that the request timeout signal is generated. 2. External DMA requests (single cycles) are too long. To solve problems with dualport error first increase the SYStem.TimeReq value. Be sure that the SYStem.TimeOut value is bigger than the access time limit. If it is not possible to solve the problem by changing the values, you must switch to DENIED mode. In this mode no access to memory is possible while running realtime emulation. The internal dualport access can increase the reaction time for external DMA requests. The performance reduction by the dualport access is typically 1% with some data windows (dualported) on the screen and may be at max. 5% when using dynamic emulation memory. ICE Emulator for MC68020/30 6

FAQ Debugging via VPN Ref: 0307 The debugger is accessed via Internet/VPN and the performance is very slow. What can be done to improve debug performance? The main cause for bad debug performance via Internet or VPN are low data throughput and high latency. The ways to improve performance by the debugger are limited: In PRACTICE scripts, use "SCREEN.OFF" at the beginning of the script and "SCREEN.ON" at the end. "SCREEN.OFF" will turn off screen updates. Please note that if your program stops (e.g. on error) without executing "SCREEN.OFF", some windows will not be updated. "SYStem.POLLING SLOW" will set a lower frequency for target state checks (e.g. power, reset, jtag state). It will take longer for the debugger to recognize that the core stopped on a breakpoint. "SETUP.URATE 1.s" will set the default update frequency of Data.List/Data.dump/Variable windows to 1 second (the slowest possible setting). prevent unneeded memory accesses using "MAP.UPDATEONCE [address-range]" for RAM and "MAP.CONST [address--range]" for ROM/FLASH. Address ranged with "MAP.UPDATEONCE" will read the specified address range only once after the core stopped at a breakpoint or manual break. "MAP.CONST" will read the specified address range only once per SYStem.Mode command (e.g. SYStem.Up). ICE Emulator for MC68020/30 7

Target Power Supply Switch Ref: 0103 Is there a simple way to control target power supply via the ICE to prevent problems after the ICE has been powered off? Follow the sequence below. If you own an output probe COUT8, connect it to the STROBE output connector. Type PULSE2. and press F1. You will get the pin out of the output probe COUT8. Pin 13 (OUT6) delivers +5 V after the emulator has finished its initialization and 0 V if the emulator is powered off. This can be used to drive a relay via a transistor to switch the target power on and off automatically if the Pulse Generator is not used for other purposes. The schematic of the switching unit can be found in the file TARGETC.CMM. Additionally Pin 13 (OUT6) can be controlled by ICE commands. Target power supply off. "PULSE2.P +" Target power supply on. "PULSE2.P -" The following Practice command file creates 3 buttons in the Toolbox for: Target power on Target power off Target power off and QUIT. Wrong Location after Break Ref: 0030 68020 Dataselectors on Misalligned Addresses Ref: 0180 Adding that file to T32.cmm loads the buttons automatically after startup. http://www.lauterbach.com/faq/targetc.cmm Why is the location after break wrong? Most emulators use some bytes of user stack for the break system. Therefore it is necessary to have valid stack, if single step or breakpoints are used. Why there is only one record in the trace listing, if the dataselector hits on a misaligned access? The dynamic dataselector of the ICE68020 detects any data pattern even if the CPU access is split into two buscycles. E.g. a LONG access to address 0x3 is split into a byte access to 0x3 and a tripple access to address 0x4. At the first buscycle (byte access) the data selector logic detects the first part of the data pattern. With the second buscycle (tripple access) the data selector detects the second part of the data pattern and becomes true. The first buscycle is not traced, because at this time the data selector does not "know" if the second part of the data access will hit the selector condition. ICE Emulator for MC68020/30 8

68020 Problems with Target Reset Detection Is there a PullUp at the emulator Reset Line Yes there is a PullUp of 2.7 kohm to 5 V. For weak target Reset signals (or at Target Power Down) it might be necessary to modify this pull-up resistors. Please contact the Lauterbach support team. Ref: 0183 68020 Single Stepping of FPU Instructions Ref: 0184 Is there a restriction in Single Stepping of FPU instructions? Yes, there is. ASM Single Stepping of FPU instructions will cause wrong FPU results. Workaround: Use the Go.Next command/button. This sets a temporary breakpoint to the next instruction and executes the FPU instruction in realtime. ICE Emulator for MC68020/30 9

68020 Target PowerUp Emulation Ref: 0182 Is it possible to run emulation out of Target Power Up? There are different ways to support this: PowerUp detection by a script file By default the ICE enters SYSTEM.DOWN state as soon as a Target Power Fail is detected. With a script file it is possible to run automatically an init sequence of commands as soon as Target Power Up is detected by the ICE. Add the following lines to your setup script: on powerup gosub ( system.mode emulext register.reset go ) stop Of course there is a timeslip between Target Power Up and running the first instruction. Faster version of solution 1 (timeslip about 35 ms) Setup: Normal setup of emulator and application Then power down target Enter command SYSTEM.Mode StandBy power up target PowerDown-Up during program execution With this method there is no timeslip between Target Power Up and the execution of the first instruction. The ICE bahaves as the real target CPU. Setup: Prepare a CPU socket with all VCC pins removed Plug this socket in between target and probe Add the command "SYStem.Option TESTCLOCK OFF" to your setup file Run your application and do a PowerDown-Up sequence Target PowerDown is no more detected, but program execution restarts by detecting the target RESET-UP. ICE Emulator for MC68020/30 10

68030 STERM Buscycles (68030 only) Problems with STERM bus cycles STERM bus cycles are not supported! Ref: 0181 ICE Emulator for MC68020/30 11

Configuration The configuration between 68020 and 68030 is done by changing the probe module. 68EC20 and 68EC30 processors need additional socket conversion adapters. The software is configured automatically. Basics The basic module supports 68020, 68030 and the EC versions of this CPU family. The EC versions may be adapted by a special socket to socket connector. MC68020 MC68EC020 MC68030 MC68EC030 33 MHz 33 MHz 33 MHz 33 MHz The emulation is in realtime up to 25 MHz and not realtime up to 33 MHz. The probe uses a special emulation concept to provide emulation of highspeed target systems together with the advanced emulation features of TRACE32. By generating internal waitstates together with a 'synthetic' target interface TRACE32 guarantees an 'error free' target adaption even in a high frequency target system. The advantages are as follows: Strobe timing is better than original CPU Address and data are stable to the bus one clock cycle earlier Slower emulation memory is possible DRAM emulation memory is possible to support large programs All the complex trigger features are possible at high target frequencies Their is no significant speed difference to realtime because target systems in most cases use waitstates and fast program loops are running from the cache. This leads to an average performance reduction of only about 10% using three waitstates. As many target systems don't run with zero waitstates, most systems may run with no internal waitstates at frequencies above 25 MHz. ICE Emulator for MC68020/30 12

The waitstates are internal and not seen by the target. One Internal Waitstate CLK AS- Internal AS- Target ECS- Target OCS- Target ADDR SIZE FC -------==========================-------------- DATA OUT -----------======================-------------- Emulation Modes E::w.sys system Mode Clock TimeReq Option Down RESet VCO 5.000ms CACHE Up Analyzer Low TimeOut FPU Monitor Mid 1.000ms RamWait RESet ResetDown High TraceWait ResetUp STERM reset NoProbe Access Line Wait RESetOut AloneInt Nodelay ECS 1. AloneExt Wait BusReq BrkVector cpu-type EmulInt Request STERM 0. M68030 EmulExt Denied 25 MHz The emulation head can stay in 6 modes. The modes are selected by the SYStem.Up or the SYStem.Mode command. ICE Emulator for MC68020/30 13

SYStem.Access Dualport access SYStem.Access <option> <option>: Request Denied Request Denied Dualport access is always possible. Dualport access is not possible while the emulation is running. SYStem.Clock Clock generation SYStem.Clock <option> <option>: VCO High Mid Low VCO Low, Mid, High Variable frequency 1 35 MHz. 2.5, 5.0 or 10.0 MHz. ICE Emulator for MC68020/30 14

SYStem.Mode Select emulation modes SYStem.Mode <mode> <mode>: ResetDown ResetUp AloneInt AloneExt EmulInt EmulExt Reset Down Reset Up Alone Internal Alone External Target is down, all drivers are in tristate mode. Target has power, drivers are logically in inactive state, but not tristate. Probe is running with internal clock, driver inactive. This mode is used for 'standalone' operation. Probe is running with external clock, driver inactive. Emulation Internal Emulation External Probe is running with internal clock, strobes to target are generated. Probe is running with external clock, strobes to target are activated. In active mode, the power of the target is sensed and by switching down the target the emulator changes to RESET mode. The probe is not supplied by the target. When running without target, the target voltage is simulated by an internal pull-up resistor. ICE Emulator for MC68020/30 15

General SYStem Settings and Restrictions General Restrictions MMU Cache Burst The MMU is fully supported, backtrace from physical to logical address is only possible when the translation is defined in the MMU table of the emulator. Breakpoints may be set to logical addresses. Cache operation is possible when running with target memory. Internal mapped memory is only possible together with cache, when no STERM cycles are requested by the target system. Break commands always disable the cache under hardware control. For effective software testing it is not recommended to enable the cache. Burst cycles are not supported. SYStem.Line CPU signals SYStem.Line <option> <option>: ECS [ON OFF] STERM [ON OFF] BusReq [ON OFF] If no real-time emulation occurs then the CPU's status lines and the strobe lines will have to contain certain values in order that no memory accesses will be executed. However, depending upon the target system used, certain exceptions to this rule may become necessary. ECS Enable ECS and OCS lines always. STERM Enables the STERM line of the target (68030). BusReq Under normal conditions DMA accesses will be permitted only if the emulator is executing a real-time program. If constant DMA is required then this function must be set to ON. ICE Emulator for MC68020/30 16

SYStem.Option TestClock Clock test SYStem.Option TestClock [ON OFF] Enables/disables clock fail detection. SYStem.Option TestPower Power test SYStem.Option TestPower [ON OFF] Enables/disables power fail detection. ICE Emulator for MC68020/30 17

Exception Control E::w.x exception Activate Enable Trigger Puls Puls OFF OFF OFF OFF OFF Single ON CpuReset ON ON CpuReset Width RESet PerReset RESet RESet PerReset 1.000us Halt Halt CpuReset Halt PERiod BusReq BusReq Halt BusReq 0.000 BusErr BusReq BusErr AVEC BusErr ReRun Vector Nmi Puls Int 00 (000.) Int Int1 Int2 Int3 Int4 Int5 Int6 exception.enable ON exception.enable OFF exception.activate OFF exception.enable OFF Enable ON Enable OFF Activate OFF Pulse OFF Enable all exception lines. Disable all exception lines. Disactivate all exception lines. Disable all pulse exceptions. ICE Emulator for MC68020/30 18

Reset The reset line (input and output) is controlled by a bridge with analog switches and diodes. VCC +1 > Trace VCC R1 R2 RESET- S2 RESET- Target <> <> Emulation CPU S3 S1 S4 GND GND R1 = R2 = 2.7 K S1 Reset Target X.Activate PerReset X.Puls PerReset S2 Reset Out SYStem.RESetOut Running S3 Reset In X.Enable Reset S4 Internal Reset Emulator Control X.Activate CpuReset X.Puls CpuReset ICE Emulator for MC68020/30 19

SYStem.RESetOut exception.enable RESet [ON OFF] exception.activate PerReset [ON OFF] exception.activate CpuReset [ON OFF] exception.pulse PerReset [ON OFF] exception.pulse CpuReset [ON OFF] exception.pulse ReRun [ON OFF] Enable RESet Activate PerReset Enables the Reset line. Activates the Target Reset line. Activate CpuReset Pulse PerReset Pulse CpuReset Pulse ReRun Activates the CPU Reset line. Force a pulse to the Target Reset line. Force a pulse to the CPU Reset line. Force a ReRun pulse sequence. ICE Emulator for MC68020/30 20

Halt VCC +1 > Trace/Trigger VCC R3 R4 HALT- S5 HALT- Target <> <> Emulation CPU S6 S7 GND R3 = R4 = 2.7 K S5 HALT Out Running S6 HALT In X.Enable HALT S7 Internal Halt Emulator Control X.Activate HALT X.Activate CpuReset X.Puls HALT X.Puls CpuReset exception.enable Halt [ON OFF] exception.activate Halt [ON OFF] exception.pulse Halt [ON OFF] Enable Halt Activate Halt Pulse Halt Enables HALT line. Activates the Halt line. Force a pulse to the CPU Halt line. ICE Emulator for MC68020/30 21

Berr VCC +1 >Trace/Trigger exception.enable BErr [ON OFF] exception.pulse BErr [ON OFF] Enable BErr Pulse BErr Enables BERR line. Force a pulse to the CPU BERR line. BR VCC +1 >Trace/Trigger 22k BERR- Target > >=1 > BERR- CPU X.Enable- 22k BR- Target > >=1 X.Enable- X.Puls- & > BR- CPU X.Activate- Dualport- exception.enable BusReq [ON OFF] exception.activate BusReq [ON OFF] exception.pulse BusReq [ON OFF] Enable BusReq Activate BusReq Pulse BusReq Enables BusRequest line. Activates the BusReq line. Force a pulse to the BusReq line. ICE Emulator for MC68020/30 22

Interrupt Control Interrupts may be enabled separately for every interrupt level Exception.Enable <option> <option>: Nmi [ON OFF] INT6 [ON OFF] INT5 [ON OFF] INT4 [ON OFF] INT3 [ON OFF] INT2 [ON OFF] INT1 [ON OFF] INT [ON OFF] exception.enable AVEC [ON OFF] exception.pulse Int [ON OFF] Enable INT Enables all Interrupt levels. Enable INT1 Enables Interrupt levels 0 to 1. Enable INT2 Enables Interrupt levels 0 to 2. Enable INT3 Enables Interrupt levels 0 to 3. Enable INT4 Enables Interrupt levels 0 to 4. Enable INT5 Enables Interrupt levels 0 to 5. Enable INT6 Enables Interrupt levels 0 to 6. Enable AVEC Pulse Int Enables AVEC line. Force an Interrupt pulse. Interrupt Stimulation The interrupt stimulation is always done with level 7 (MNI level). The pulse width must be at minimum 2 CPU cycles. ICE Emulator for MC68020/30 23

Mapping MAP.PRE [<range>] The basic mapper of TRACE32 uses an address area of 16 MByte. The CPU however supplies 32 address lines, which means an address range up to 4 GByte. TRACE32 solves this problem by a 2-stage mapping system. The first system, named premapper, allows to define 16 different 1 MByte areas named workbenches. Within this areas it is possible to set breakpoints on a byte by byte level. Outside this area breakpoints may only be set on ranges limited by 1 MByte. map.res map.pre 0--0fffff map.pre 400000--4fffff map.pre 80000000++1fffff map.pre 0ffe00000++1fffff w.map.pre E::w.map.pre Workbench Address 1 C:00000000--000FFFFF 2 C:00400000--004FFFFF 3-- 4 C:80000000--801FFFFF 5-- 6 C:FFE00000--FFFFFFFF ICE Emulator for MC68020/30 24

FPU SYStem.Option FPU Activate emulator based FPU SYStem.Option FPU [ON OFF] FPU If the emulation adapter has an FPU chip in the FPU socket then the internal FPU is activated. No additional FPU, however may be present in the target system. ++++++++++ ++++++++++ 1 + Jumper FPU 2 + + 1 10 MHz CLK + 2 CPU CLK + + ++++++++++ ++++++++++ FPU.ON FPU.OFF FPU.view FPU.Set <register> <value> ON/OFF view FPU.Set FPU display option is switched on or off Display window. The display is only updated, if the FPU is in idle state Changes FPU registers ICE Emulator for MC68020/30 25

E::w.fpu INEX1 _ INEX _ NAN _ FP0 1.0 3FFF.80000000000000 INEX2 _ DZ _ Inf _ FP1 2.0 4000.80000000000000 DZ _ UNFL _ Zr _ FP2 3.333e+3 400A.D0500000000000 UNFL _ OVFL _ Neg _ FP3 3.3999999999999 4000.D9999999999998 OVFL _ IOP _ RND N FP4 1.0 3FFF.80000000000000 OPERR _ Q +00 PREC X FP5 2.0e+1 4003.A0000000000000 SNAN _ FPCR 00000000 FP6 2.0e+3 4009.FA000000000000 BSUN _ FPSR 00000000 FP7 NAN 7FFF.FFFFFFFFFFFFFF FPIAR SP: 00000000 ICE Emulator for MC68020/30 26

MMU MMU.view Display MMU registers MMU.view Displays the current values of MMU registers. E::w.mmu N 0 CRPH 80000003 T T CRPL 100 M M SRPH 80000003 I I SRPL 100 W W TC 82C8C000 S S TT0 0FFFF0777 L L TT1 0FFFF0777 B B MMUSR 0EE40 MMU.Set Modify MMU registers MMU.Set <register> <value> Changes MMU registers. ICE Emulator for MC68020/30 27

MMU.DUMP Dump MMU tables MMU.DUMP [<addressrange>] [<root>] Displays the MMU translation and protection for the specified memory area. The root argument defines which table is used. The lower three bits of the root argument define the type of table to be used. mmu.dump 0x0--0x0fffff mmu.dump, asd:0x203 ; display the current MMU translation ; for the first megabyte ; display the whole translation table ; beginning at physical address 200 ; the table contains long descriptors E::w.mmu.dump logical physical status E::w.mmu.l SP:00000000--00000FFF SP:00180000--00180FFF FC09 S:0 CI:0 M:0 U:1 WP:0 SP:00001000--00001FFF logical SP:00181000--00181FFF physical FC09 S:0 CI:0 M:0 U:1 WP:0 SP:00002000--00002FFF C:00000000--000FFFFF SP:00182000--00182FFF A:80000000--800FFFFF FC09 S:0 CI:0 M:0 U:1 WP:0 SP:00003000--00003FFF C:00010000--0010FFFF invalid A:C0000000--C00FFFFF SP:00004000--00004FFF invalid SP:00005000--00005FFF invalid SP:00006000--00006FFF invalid SP:00007000--00007FFF invalid E::w.d c:0000000 E::w.d ad:80000000 address 0 1 2 3 0123 address 0 1 2 3 0123 E::w.mmu.dump SD:00000000 2020 2020 ASD:80000000 2020 2020 rpsd:00000004 fc 5465 tia7374 Test tib ASD:80000004 5465 tic7374 Test tid SRPSD:00000008 2020 00000100+0000*8 2020 00002000+0000*8 ASD:80000008 2020 2020 SRPSD:0000000C 2000 00000100+0000*8... 00002000+0001*8 ASD:8000000C 2000 0000... SRPSD:00000010 0000 00000100+0000*8... 00002000+0002*8 ASD:80000010 0000 0000... SRP 00000100+0000*8 00002000+0003*8 SRP 00000100+0000*8 00002000+0004*8 SRP 00000100+0000*8 00002000+0005*8 SRP 00000100+0000*8 00002000+0006*8 SRP 00000100+0000*8 00002000+0007*8 ICE Emulator for MC68020/30 28

MMU.SCAN Scan MMU tables MMU.SCAN [<addressrange>] [<root>] Scans MMU tables in the target into the internal MMU tables used by TRACE32. This allows to create the logical to physical address translation table automatically without using the MMU.Create command. The parameters are identical to the MMU.DUMP command. Transparent translation registers are not considered for by this command. They must be added to the translation list manually. mmu.res mmu.scan mmu.create 0x0ff000000--0x0ffffffff mmu.on ; clear all current translations ; get translations for whole ; address space ; define TT0 translation ; activate translation For more information refer to the MMU command in the main manual. ICE Emulator for MC68020/30 29

Cache SYStem.Option CACHE Enable cache SYStem.Option CACHE [ON OFF] This function activates the CDIS line of the CPU. NOTE: The data-cache of the 68030 will not work with internal emulation-memory! ICE Emulator for MC68020/30 30

Wait Cycles SYS.Option <option> [ON OFF] <option>: STERM Wait <cycles> TraceWait RamWait AddWait STERM Wait Must be selected, if the target uses the STERM bus cycle with no waitstates. Selects the number of hidden waitstates. The target will see idle cycles instead of the waitstates. Max. frequencies for different number of waitstates 68020/30 wait 0 wait 1 wait 2 wait 3 wait4 SRAM/Fast 70ns SRAM/Slow 70ns DRAM 60ns 20 MHz 17 MHz 17 MHz 25 MHz 20 MHz 20 MHz 33 MHz 25 MHz 25 MHz - 33 MHz 33 MHz 68030/STERM wait 0 wait 1 wait 2 wait 3 wait 4 SRAM/Fast 70ns SRAM/Slow 70ns DRAM 60ns 12.5 MHz 10 MHz 10 MHz 20 MHz 17 MHz 17 MHz 25 MHz 20 MHz 20 MHz 33 MHz 25 MHz 25 MHz - - - - 33 MHz 33 MHz TraceWait RamWait AddWait One additional wait state is inserted whenever two memory accesses take place back-to-back. This function is necessary in order to ensure that the analyzer works properly when the minimum time between two cycles is less than 150 us (68020 at 20 MHz). Loss in performance is minimal, only a few percent. Inserts one additional wait state in all cycles. If the target system uses at least one wait state too, the internal waitstates can be reduced. To enable correct trace function this option must be activated. sys.option wait 1. sys.option addwait ; Selects one emulator wait state ; Target system has one wait state ; each cycle has at least two waitstates ICE Emulator for MC68020/30 31

Breakpoint System SYS.Option BrkVector [0 2 4 7] Program breakpoints are installed by a BPT instruction. As some software monitor programs included in the target software need a breakpoint instruction too there should be no conflict. The 68020/30 probe allows the selection of 4 different breakpoint vectors. ICE Emulator for MC68020/30 32

Monitor Extensions A monitor extension is a piece of code extending the emulation control monitor. The emulation monitor is responsible for starting and stopping the target program and accessing memory and registers when the target program is stopped. This monitor is running in a hidden memory inside the ECU unit. Extensions must be made available in a binary program. This program must be loaded before activating the emulation by the following command: SYStem.MonFile <file> The program can contain the following extensions: Start Target Stop Target Read Memory Write Memory This part is executed before the target program is started. It can enable timers in the target or reset watchdogs. This part is executed after the emulation in the target has stopped. It can disable timers or external watchdogs. It can also contain code to get the current task ID for task selective symbols. User specific memory read. Allows access to special memories, e.g. serial connected EEPROMs. The access is made by the USR: memory class. User specific memory write. Allows write access to special memories, e.g. programming EEPROM or FLASH memories. The access is made by the USR: memory access class. For more details about the definition of the monitor extension and parameter passing see the example file './demo/m68k/etc/monext.asm'. ICE Emulator for MC68020/30 33

Memory Classes Memory Class Description FC0 Function-Code 0 FC1 UD, AUD FC2 UP, AUP USER-DATA USER-DATA USER-PROGRAM USER-PROGRAM FC3 Function-Code 3 FC4 Function-Code 4 FC5 SD, ASD FC6 SP, ASP SUPERVISOR-DATA SUPERVISOR-DATA SUPERVISOR-PROGRAM SUPERVISOR-PROGRAM FC7 Function-Code 7 CPU U S D P C A E EA CPU Function-Code User Supervisor Data Program Memory access by CPU Absolute (physical) memory access Emulation memory access Absolute (physical) emulation memory access ICE Emulator for MC68020/30 34

USR User defined memory access (monitor extension) ICE Emulator for MC68020/30 35

State Analyzer Keywords for the Trigger Unit Input Event Meaning Analyzer Hardware ECC8 HAC HA120 SA120 AutoVECtor Reading interrupt vector from table (FC7 and R and VMA) BYTE Byte transfer X X CDIS Cache disable X X CPU, FC7 Interrupt acknowledge X X X Data Data access (UD or SD) X X X DMACycle DMA cycle X X FC0 Function code 0 X X X FC1,UserData User data area X X X FC2, UserProgram User program area X X X FC3 Function code 3 X X X FC4 Function code 4 X X X FC5,Supervisor- Data Supervisor data area X X X FC6,Supervisor- Program Supervisor program area X X X FC7, CPU Interrupt acknowledge X X X IACK Interrupt acknowledge X X X (FC7 and Read) IPL0.. IPL2 Interrupt priority level lines X X IR Interrupt request (IPL0 or IPL1 or IPL2) X X IR1.. IR6 Interrupt request 1 to 6 X X IR7, NMI Interrupt request 7, or NMI X X LONG Double word transfer X X NMI, IR7 Interrupt request 7, or NMI X X Program Program access (UP or SP) X X X Read CPU read cycle X X X ReadData Data access read (Read and Data) X X X X X ICE Emulator for MC68020/30 36

Supervisor SupervisorData, FC5 SupervisorProgram, FC6 Supervisor program or data access (SP or SD) X X X Supervisor data area X X X Supervisor program area X X X TimeOut DTACK Timeout X TRIPLE 3-byte transfer X X User User program or data access (UP or UD) X X X UserData, FC1 User data area X X X UserProgram, FC1 User program area X X X VMA VMA cycle X X Wait0.. Wait6 Waitstates 0.. 6 X X WaitX Waitstates greater 6 X X WORD Word transfer X X Write CPU write cycle X X X WriteData Data access write (Write and Data) X X X For not CPU-specific keywords, see non-declarable input variables in ICE/FIRE Analyzer Trigger Unit Programming Guide (analyzer_prog.pdf). ICE Emulator for MC68020/30 37

Keywords for the Display AAddress Absolute (physical) address WR Write cycle DMA DMA cycle between this and last record VMA VMA cycle IR Interrupt request level IPL.0 Interrupt request line 0 IPL.1 dto. IPL.2 dto. BR Bus request BG Bus grant BGACK Bus grant acknowledge BERR Bus access error AVEC AVEC cycle HALT Halt cycle RES Reset cycle Wait Number of inserted wait cycles, for more than 6 a 'X' appears. SIZE bussize SIZE.0 bussize bit 0 SIZE.1 bussize bit 1 DSACK DSACK lines DSACK.0 DSACK0 line DSACK.1 DSACK1 line CDIS CDIS line OCS OCS line RMC RMC line IPEND IPEND line ICE Emulator for MC68020/30 38

Dequeueing The disassembled lines in the analyzer are displayed prior to the resulting data cycles. This dequeueing fails for commands which have not a constant number of data cycles. Problems with Prefetches: Recording start at address which is not multiple of 4. Indirect calls and jumps to such addresses Long data sequences without fetches (e.g. MOVEM, coprocessor access) Short forward conditional branches to addresses already prefetched PFLUSH PC relative addressing Problems with Dequeueing (unknown number of cycles): Memory-Pointer-Addressing BFINS, BFEXT, etc. CAS,CAS2 FMOVEM with dynamic register list RTE CALLM,RTM MMU-table walk cycles (68030) ICE Emulator for MC68020/30 39

Compilers Language Compiler Company Option Comment ADA ALSYS-ADA IEEE limited support (IEEE) ADA TELESOFT-ADA Telesoft IEEE limited support (IEEE) ASM RTOS IEP GmbH SYM/LOC Source level debugging ASM ASM68K Mentor Graphics Corporation IEEE Source level debugging ASM VERSADOS-ASM NXP Semiconductors VERSADOS symbols only ASM OS-9-ASSEMBLER Radisys Inc. ROF Source level debugging ASM AS68 TASKING IEEE C HP-64000-C HP no type/locals info C ORGANON CAD-UL BOUND ElectronicServices GmbH C C68K Cosmic Software COSMIC C GNU-C Free Software ELF/DWARF Foundation, Inc. C GNU-C Free Software COFF Foundation, Inc. C GNU-C Free Software Foundation, Inc. ELF/DWARF C GREEN-HILLS-C Greenhills Software Inc. COFF C ICC68K Introl Corporation ICOFF C MCC Mentor Graphics IEEE Corporation C HT-68K Microchip Technology HITECH Inc. C HICROSS-68K NXP Semiconductors HICROSS C CC68K NXP Semiconductors COFF C ULTRA-C Radisys Inc. ROF OS/9 compilers C OS/9-C Radisys Inc. ROF C CROSSCODE-C SDSI SDS C SCC68K Sierra COFF C SUN3-CC Oracle Corporation DBX C ICC68K TASKING COFF C ICC68K TASKING IEEE C TT-68K TASKING IEEE C TCC68K TASKING AOUT only source and syms C TEKTRONIX-C Tektronix COMFOR ICE Emulator for MC68020/30 40

Language Compiler Company Option Comment C D-CC Wind River Systems IEEE C D-CC Wind River Systems ELF/DWARF C++ ORGANON-C++ CAD-UL BOUND ElectronicServices GmbH C++ GNU-C++ Free Software DBX Foundation, Inc. C++ GNU-C++ Free Software ELF/DWARF Foundation, Inc. C++ CCC68K Mentor Graphics IEEE Corporation C++ HICROSS-68K NXP Semiconductors HICROSS C++ CODEWARRIOR NXP Semiconductors ELF/DWARF C++ CROSSCODE-C++ SDSI SDS C++ D-C++ Wind River Systems ELF/DWARF MODULA MOD68K Introl Corporation ICOFF MODULA MCS2 Multichannelsystems COFF GmbH MODULA MCDS NXP Semiconductors MCDS PASCAL MPC Mentor Graphics IEEE Corporation PEARL RTOS IEP GmbH SYM/LOC no type/locals info ICE Emulator for MC68020/30 41

Debugger Support CPU Tool Company Host WINDOWS CE PLATF. - Windows BUILDER CODE::BLOCKS - - C++TEST - Windows ADENEO - X-TOOLS / X32 blue river software GmbH Windows CODEWRIGHT Borland Software Windows Corporation CODE CONFIDENCE Code Confidence Ltd Windows TOOLS CODE CONFIDENCE Code Confidence Ltd Linux TOOLS EASYCODE EASYCODE GmbH Windows ECLIPSE Eclipse Foundation, Inc Windows CHRONVIEW Inchron GmbH Windows LDRA TOOL SUITE LDRA Technology, Inc. Windows UML DEBUGGER LieberLieber Software Windows GmbH SIMULINK The MathWorks Inc. Windows ATTOL TOOLS MicroMax Inc. Windows VISUAL BASIC Microsoft Corporation Windows INTERFACE LABVIEW NATIONAL Windows INSTRUMENTS Corporation RAPITIME Rapita Systems Ltd. Windows RHAPSODY IN MICROC IBM Corp. Windows RHAPSODY IN C++ IBM Corp. Windows DA-C RistanCASE Windows TRACEANALYZER Symtavision GmbH Windows TA INSPECTOR Timing Architects GmbH Windows UNDODB Undo Software Linux VECTORCAST UNIT Vector Software Windows TESTING VECTORCAST CODE Vector Software Windows COVERAGE 68K OS68 DEBUGGER Enea OSE Systems - 68K SDT CMICRO IBM Corp. Windows 68K DIAB RTA SUITE Wind River Systems Windows ICE Emulator for MC68020/30 42

RTOS Support Company Product Comment Atego Ldt. AdaWorld ARTK KadakProducts Ltd. AMX Oracle Corporation ChorusOS CMX Systems Inc. CMX-RTX Synopsys, Inc MQX 2.40 and 2.50, 3.6 MTOS-UX Mentor Graphics Nucleus PLUS Corporation Radisys Inc. OS-9 Enea OSE Systems OSE Classic (OS68) Enea OSE Systems OSE Delta 4.x and 5.x RealTime Craft (XEC68k) Quadros Systems Inc. RTXC 3.2 IBM Corp. SDT-Cmicro - uclinux Kernel Version 2.4 and 2.6, 3.x Mentor Graphics VRTX32 Corporation Mentor Graphics VRTXmc Corporation Mentor Graphics VRTXsa Corporation Wind River Systems VxWorks 5.x and 6.x ICE Emulator for MC68020/30 43

Emulation Frequency The emulation probe is designed for running with CPUs up to 33 MHz. The max. speed is limited by the memory speed and the waitstates used for memory access. Module CPU F-W0-15 F-W0-35 S-W0-15 S-W0-35 S-W1-15 S-W1-35 LA-6623 MC68020 33.0+ 25.9 23.0 18.7 33.0+ 28.0 16.0 LA-6624 MC68030 33.0+ 25.9 23.0 18.7 33.0+ 28.0 16.0 LA-6623 MC68EC020 33.0+ 25.9 23.0 18.7 33.0+ 28.0 16.0 LA-6624 MC68EC030 33.0+ 25.9 23.0 18.7 33.0+ 28.0 16.0 DRAM ICE Emulator for MC68020/30 44

Emulation Modules Module Overview LA-6620 LA-6623 LA-6628 MC68020 MC68EC020 PGA PGA LA-6624 MC68030 MC68EC030 PGA PGA Order Information Order No. Code Text LA-6620 ICE-68020 ICE-68020 Base Module LA-6621 M-MC68020-PGA Module MC68020 PGA LA-6622 M-MC68030-PGA Module MC68030 PGA LA-6623 M-MC68020-33-PGA Module MC68020-33 PGA LA-6624 M-MC68030-33-PGA Module MC68030-33 PGA LA-6625 M-MC68020-ROT MC68020/30 rotator 90 degrees (clockwise) LA-6617 M-MC68020-ROT-C MC68020/30 rotator 90 degrees (counterclock) LA-6629 M-MC68020-33-PGA-ROT Module MC68020-33 PGA 180 Degrees Rotation LA-6626 M-MC68020-PRO Probe Prolongation for 68020/30 LA-6628 A-MC68EC020 Adapter MC68EC020 ET-1040 ET-68020-S 68020 PGA to QFP132 Surface Mountable Adapter Additional Options LA-7510 MON-68K ROM Monitor for 68K on ESI LA-2812L SIMULATOR-68K-FL 1 User Float. Lic. TRACE32 68K Simulator LA-7410 TP Trigger Probe ICE Emulator for MC68020/30 45

Physical Dimensions Physical Dimensions 68020/30 Module Dimension LA-6621 M-MC68020-PGA cable (300) 82 24 8 112 SIDE VIEW PGA A1 71 19 5 TOP VIEW (all dimensions in mm) ICE Emulator for MC68020/30 46

Dimension LA-6622 M-MC68030-PGA cable (300) 82 24 8 112 SIDE VIEW PGA A1 71 19 5 TOP VIEW (all dimensions in mm) ICE Emulator for MC68020/30 47

925 1525 3050 Dimension LA-6623 LA-6624 M-MC68020-33-PGA M-MC68030-33-PGA SIDE VIEW CABLE ( 11800 ) 300 1650 TOP VIEW PIN 1 ET132 A1 1850 2125 3950 ALL DIMENSIONS IN 1/1000 INCH ICE Emulator for MC68020/30 48

Dimension LA-6625 M-MC68020-ROT 13 28 SIDE VIEW 3 4 A1 36 71 A1 36 3 37 70 71 TOP VIEW (all dimensions in mm) ICE Emulator for MC68020/30 49

Dimension LA-6626 M-MC68020-PRO 28 15 SIDE VIEW 7 49 8 2 35 327 330 SHORT VERSION ( 116 mm EXTENSION) AVAILABLE TOP VIEW (all dimensions in mm) LA-6627 TEST-MC68020 ICE Emulator for MC68020/30 50

Dimension LA-6628 A-MC68EC020 13 28 SIDE VIEW A1 A1 36 2 4 37 69 71 TOP VIEW (all dimensions in mm) ICE Emulator for MC68020/30 51

Dimension ET-1040 ET-68020-S 27 SIDE VIEW ::::::::::: :::...::: ::: ::: ::: ::: :::..:..::: ::::::::::: TOP VIEW (all dimensions in mm) ICE Emulator for MC68020/30 52