x386 and x486 Monitor

x386 and x486 Monitor TRACE32 Online Help TRACE32 Directory TRACE32 Index TRACE32 Documents... ICD In-Circuit Debugger... Processor Architecture Manuals... x386 and x486... x386 and x486 Monitor... 1 Brief Overview of Documents for New Users... 4 Warning... 5 Quick Start 386 ESI-ROM Monitor... 6 Troubleshooting... 8 FAQ... 8 Basics... 10 Monitor Features 10 Monitor Files 10 Address Layout 11 Vector Table 12 General SYStem Commands... 13 SYStem.CPU CPU type 13 SYStem.CpuAccess Run-time memory access (intrusive) 13 SYStem.MemAccess Real-time memory access (non-intrusive) 14 SYStem.Mode Establish the communication with the CPU 14 SYStem.Option MMUSPACES Enable space IDs 15 CPU specific MMU Commands... 16 MMU.DUMP Page wise display of MMU translation table 16 MMU.List Compact display of MMU translation table 17 MMU.SCAN Load MMU table from CPU 18 General SYStem Settings and Restrictions... 20 General Restrictions 20 Memory Classes... 21 Support... 22 Available Tools 22 Compilers (Protected Mode) 22 x386 and x486 Monitor 1

Compilers (Real Mode) 23 Target Operating Systems 24 3rd Party Tool Integrations 25 Products... 26 Product Information 26 Order Information 26 x386 and x486 Monitor 2

x386 and x486 Monitor Version 06-Nov-2017 PP:00000164 \\SCO386I\func2+15... MIX AI E::w.d.l addr/line code label mnemonic comment 163 autovar = regvar = fstatic; PP:0000015B 8B1D6C0C4000 mov ebx,[400c6c] ; ebx,fstat PP:00000161 895DFC mov [ebp-4],ebx 164 autovar++; PP:00000164 FF45FC inc dword ptr [ebp-4] 166 func1( &autovar ); * to force autovar as stack-s PP:00000167 8D45FC lea eax,[ebp-4] E::w.r E::w.v.v %c %m ast Cy C EAX 1 EBX 0 SP >00000006 ast = ( P _ ECX 3 EDX 4-0C 00000007 word = 0x0, Ac _ DS 38 ESI 6-08 00000002 count = 12345, Zr _ ES 30 EDI 7-04 00000000 left = 0x401E14, S _ SS 34 ESP 3FBC FP >00003FFC right = 0x0, T _ EBP 3FCC +04 00000C8C field1 = 1, I _ CS 28 EIP 164 +08 00000006 field2 = 2) D _ FS 30 TR 40 +0C 00000007 O _ GS 30 LDTR 18 +10 00000002 PL 0 EF 1 +14 00000000 x386 and x486 Monitor 3

Brief Overview of Documents for New Users Architecture-independent information: Debugger Basics - Training (training_debugger.pdf): Get familiar with the basic features of a TRACE32 debugger. T32Start (app_t32start.pdf): T32Start assists you in starting TRACE32 PowerView instances for different configurations of the debugger. T32Start is only available for Windows. General Commands (general_ref_<x>.pdf): Alphabetic list of debug commands. Architecture-specific information: Processor Architecture Manuals : These manuals describe commands that are specific for the processor architecture supported by your debug cable. To access the manual for your processor architecture, proceed as follows: - Choose Help menu > Processor Architecture Manual. RTOS Debuggers (rtos_<x>.pdf): TRACE32 PowerView can be extended for operating systemaware debugging. The appropriate RTOS manual informs you how to enable the OS-aware debugging. x386 and x486 Monitor 4

Warning NOTE: Do not connect or remove probe from target while target power is ON. Power up: Switch on emulator first, then target Power down: Switch off target first, then emulator x386 and x486 Monitor 5

Quick Start 386 ESI-ROM Monitor Starting up the ROM Monitor is done as follows: 1. Select the device B: for the ROM Monitor. b: 2. Power the system down (optional). sys.d This instruction is necessary when the system is restarted. When the system is active while you try to reinitialize it, you get an error message. 3. Set the CPU type in the ROM Monitor program to load the CPU specific settings. sys.cpu I80486 4. Map the EPROM simulator. The mapping of the EPROM simulator is described in the section Mapping the EPROM Simulator. 5. Load the application program. d.load.coff sco386i.x The format of the Data.LOAD command depends on the file format generated by the compiler. The corresponding options for all available compilers are listed in the compiler list. A detailed description of the Data.LOAD command is given in the Emulator Reference Manual. NOTE: The application must have a gap for the monitor program (see Address Layout below). 6. Load the monitor program. Usually the monitor program runs at top of memory in the ROM area. The binary file contains the monitor, the startup sequence which brings CPU into Protected Mode and all necessary descriptor tables. Loading the whole file can be used to run the monitor without an application. d.load.b rom386b.bin a:0x0ffff0000 7. Set the polarity of the Reset and NMI signal according to your target. The NMI signal is optional, it can be use to interrupt the program. x.respol + x.nmipol + x.nmibreak on ; Reset and NMI signal should be connected ; from ESI to target. NMI is used for ; manual break. x386 and x486 Monitor 6

8. Start the ROM Monitor. If the RESET output of the ESI is not connected you must press the RESET button of your target after entering this command. sys.up The start up can be automated using the programming language PRACTICE. A typical start sequence is shown below: ; the EPROM is in the addressrange 0x0ffff0000++0x0ffff ; the RAM is in the addressrange 0x40000--0x7ffff b: sys.d winclear sys.cpu i80486 map.res map.rom a:0ffff0000--0ffffffff d.load.b rom386b.bin a:0ffff0000 x.respol + x.nmipol + x.nmibreak on sys.up d.load.coff sco386i.x /flat d.s ap:38 0ff 0ff 0 0 d.s ap:3c 0 9a 0cf 0 d.s ap:80 50 0 28 0 d.s ap:84 0 8e 0ff 0ff d.s ap:80 50 0 28 0 d.s ap:84 0 8e 0ff 0ff d.s ap:80 50 0 28 0 d.s ap:84 0 8e 0ff 0ff r.s gdtb 10 r.s gdtl 2ff r.s ds 38 r.s cs 28 r.s idtb 78 r.s idtl 0ffff ; select the Debugger device ; switch the system down ; clear all windows ; set the CPU type for the user ; interface ; map the EPROM simulator ; map the EPROM simulator ; load the monitor ; adapt the polarity of RES and NMI ; enables the connection of the NMI signal ; power the system up ; set code segment descriptor(s), if ; not included in application file ; set interrupt descriptor 1, if not ; incl. ; set interrupt descriptor 2, if not ; incl. ; set interrupt descriptor 3, if not ; incl. ; set GDT base register ; set GDT limit register ; set ds selector ; set cs selector ; set IDT base register ; set IDT limit register ; Important: All used register, tables and selectors must be initialized ; correctly. Although it is possible to reload all registers by ; application program, it is important to have valid selectors and ; descriptors at every time. Using r.s ds 38 for example directly loads ; the selector and descriptor into the segment register. A wrong ; descriptor will generate a trap into the monitor. x386 and x486 Monitor 7

Troubleshooting No information available. FAQ EPROM Simulator Error on Data Modification Ref: 0056 Step or Breakpoint Fails Ref: 0061 Stepping Fails when Executing MOV SP,xxx Ref: 0062 Why crashes ROM monitor after modification of EPROM? Check that there is enough space left on the stack. See also "Restrictions for Stack Requirements". Why does single step or breakpoint not work? Check that there is enough space left on the stack before and after the execution of the instruction. See "Restrictions for Stack Requirements". Make sure that the single step and INT3 vector (1 + 3) are valid and point to the correct monitor entry. Why does stepping fail, when executing a MOV SP,xxx instruction? Check that there is enough space left on the stack before and after the execution of the instruction. See "Restrictions for Stack Requirements". Check that the value for the CP is within limits for the CPU and that the register space ist not beeing overwritten by the stack. See "Restrictions for Stack Requirements". EPROM Simulator Error on Data Modification Ref: 0056 Step or Breakpoint Fails Ref: 0061 Why crashes ROM monitor after modification of EPROM? Check that there is enough space left on the stack. See also "Restrictions for Stack Requirements". Why does single step or breakpoint not work? Check that there is enough space left on the stack before and after the execution of the instruction. See "Restrictions for Stack Requirements". Make sure that the single step and INT3 vector (1 + 3) are valid and point to the correct monitor entry. x386 and x486 Monitor 8

Stepping Fails when Executing MOV SP,xxx Ref: 0062 80386 Manual Break Fails Ref: 0060 Why does stepping fail, when executing a MOV SP,xxx instruction? Check that there is enough space left on the stack before and after the execution of the instruction. See "Restrictions for Stack Requirements". Check that the value for the CP is within limits for the CPU and that the register space ist not beeing overwritten by the stack. See "Restrictions for Stack Requirements". Why does manual break fail? Check that there is enough space left on the stack before and after the execution of the instruction (see Restrictions for stack requirements). Check exception control (x.nmipol +, x.nmibreak on) and NMI connection from EPROM simulator to target. Make sure that the NMI vector (2) is valid and points to the correct Monitor entry. x386 and x486 Monitor 9

Basics Monitor Features The monitor requires no stack during startup and memory operations. A valid stack is always required. The NMI pin of the Eprom Simulator can be used to manually stop the target program. Monitor Files The 'rom386b', 'rom386w' and 'rom386l' monitors are for Eprom Simulator solutions (8bit, 16bit and 32 bit). The target program can be single stepped without stopping the target processors interrupts. The source file of the monitor is 'rom386.asm'. This source file should not be modified, it is only included for reference purposes. There are two possibilities to include the monitor in the application: loading the '.bin' by the Eprom Simulator or linking the '.src' file together with the application. The '.src' files contain only the monitor code, a corresponding configuration table must be included in the target program. x386 and x486 Monitor 10

Address Layout The Rom Monitor and the startup sequence to bring CPU into Protected Mode is normally located at top of memory (boot ROM). The communication area for the Eprom Simulator is located at the fixed address 1000 to 1FFF of the first EPROM. The CPU address depends on the bus width of the EPROMs. The following table shows the address ranges occupied by the communication port: bus width start address end address 8 bit 1000 1FFF 16 bit 2000 3FFF 32 bit 4000 7FFF The monitor program consists of three parts: Startup Code to bring CPU into Protected Mode All necessary Descriptor Tables Monitor Program Code The '.bin' and '.asm' files contain all parts of the monitor. The address layout of the default monitor is as follows: 0x00000--0x00FFF 0x01000--0x07FFF 0x08000--0x080CD 0x080CE--0x08145 0x0FFF0--0x0FFF7 Monitor Code Monitor Communication Area (depends on bus width) Global and Interrupt Descriptor Tables Setup Code to bring CPU into Protected Mode Jump after RESET x386 and x486 Monitor 11

Vector Table For the first tests of a software, the '.bin' files can be loaded with descriptor tables. When the descriptor tables becomes part of the application, it is not loaded with the monitor. Instead the tables are setup according to the application (the table may also reside in RAM). Some descriptors (interrupt descriptor 1, 2, 3) must be set up to point into the monitor program code. The entry points are located at the beginning of the monitor. vec offs ent usage 00 000 +40 Reset (optional, can also go to application) 01 008 +50 Single Step Break 02 010 +50 Manual Break by NMI (optional) 03 018 +50 Breakpoint Trap (used for breakpoints) 04 020 +60 Any unused trap maybe handled by monitor........ " 17 020 +60 " NOTE: The entry point is given relative to the start of the monitor. x386 and x486 Monitor 12

General SYStem Commands SYStem.CPU CPU type Format: SYStem.CPU <mode> <mode>: 8086 I80186 I80386 I80386EX I80486 Selects the processor type. The ROM debugger requires also a modification in the debug monitor for different processor types. SYStem.CpuAccess Run-time memory access (intrusive) Format: SYStem.CpuAccess Enable Denied Nonstop Default: Denied. Enable Denied Nonstop Allow intrusive run-time memory access. In order to perform a memory read or write while the CPU is executing the program, the debugger stops the program execution shortly. Each short stop takes 1 100 ms depending on the speed of the debug interface and on the number of the read/write accesses required. A red S in the state line of the TRACE32 main window indicates this intrusive behavior of the debugger. Lock intrusive run-time memory access. Lock all features of the debugger that affect the run-time behavior. Nonstop reduces the functionality of the debugger to: Run-time access to memory and variables Trace display The debugger inhibits the following: To stop the program execution All features of the debugger that are intrusive (e.g. action Spot for breakpoints, performance analysis via StopAndGo mode, conditional breakpoints, etc.) x386 and x486 Monitor 13

SYStem.MemAccess Real-time memory access (non-intrusive). Format: SYStem.MemAccess CPU Denied <cpu_specific> SYStem.ACCESS (deprecated) CPU Denied (default) Real-time memory access during program execution to target is enabled. Real-time memory access during program execution to target is disabled. SYStem.Mode Establish the communication with the CPU Format: SYStem.Mode <mode> <mode>: Down NoDebug Go Up Default: Down. Selects the target operating mode. tbd. Down NoDebug Go Up The CPU is in reset. Debug mode is not active. Default state and state after fatal errors. The CPU is running. Debug mode is not active. Debug port is tristate. In this mode the target should behave as if the debugger is not connected. The CPU is running. Debug mode is active. After this command the CPU can be stopped with the break command or if any break condition occurs. The CPU is not in reset but halted. Debug mode is active. In this mode the CPU can be started and stopped. This is the most typical way to activate debugging. If the mode Go is selected, this mode will be entered, but the control button in the SYStem window jumps to the mode UP. x386 and x486 Monitor 14

SYStem.Option MMUSPACES Enable space IDs Format: SYStem.Option MMUSPACES [ON OFF] SYStem.Option MMUspaces [ON OFF] (deprecated) SYStem.Option MMU [ON OFF] (deprecated) Default: OFF. Enables the use of space IDs for logical addresses to support multiple address spaces. A space ID is a 16- bit memory space identifier which extends a logical TRACE32 address. With space IDs, TRACE32 can handle multiple address spaces in the debugger address translation. Space IDs are defined within a loaded TRACE32 OS awareness extension. Often, space IDs are directly derived from the OS process ID. Be aware that this depends on the OS and the loaded awareness extension. NOTE: SYStem.Option MMUSPACES should not be used if only one translation table is used on the target. If a debug session requires space IDs, you must observe the following sequence of steps: 1. Activate SYStem.Option MMUSPACES. 2. Load the symbols with Data.LOAD. Otherwise, the internal symbol database of TRACE32 may become inconsistent. Examples: ;Dump logical address 0xC00208A belonging to memory space with ;space ID 0x012A: Data.dump D:0x012A:0xC00208A ;Dump logical address 0xC00208A belonging to memory space with ;space ID 0x0203: Data.dump D:0x0203:0xC00208A x386 and x486 Monitor 15

CPU specific MMU Commands MMU.DUMP Page wise display of MMU translation table Format: MMU.DUMP <table> [<range> <addr> <range> <root> <addr> <root>] MMU.<table>.dump (deprecated) <table>: PageTable KernelPageTable TaskPageTable <magic_number> <task_id> <task_name> <cpu_specific_tables> Displays the contents of the CPU specific MMU translation table. If called without parameters, the complete table will be displayed. If the command is called with either an address range or an explicit address, table entries will only be displayed, if their logical address matches with the given parameter. The optional <root> argument can be used to specify a page table base address deviating from the default page table base address. This allows to display a page table located anywhere in memory. PageTable KernelPageTable TaskPageTable <magic_number> <task_id> <task_name> Display the current MMU translation table entries of the CPU. This command reads all tables the CPU currently uses for MMU translation and displays the table entries. Display the MMU translation table of the kernel. If specified with the MMU.FORMAT command, this command reads the MMU translation table of the kernel and displays its table entries. Display the MMU translation table entries of the given process. In MMU based operating systems, each process uses its own MMU translation table. This command reads the table of the specified process, and displays its table entries. See also the appropriate OS awareness manuals: RTOS Debugger for <x>. For information about the parameters, see What to know about Magic Numbers, Task IDs and Task Names (general_ref_t.pdf). CPU specific tables: GDT Displays the contents of the Global Descriptor Table. x386 and x486 Monitor 16

IDT Displays the contents of the IDT table. LDT Displays the contents of the Local Descriptor Table. MMU.List Compact display of MMU translation table Format: MMU.List <table> [<range> <addr> <range> <root> <addr> <root>] MMU.<table>.List (deprecated) <table>: PageTable KernelPageTable TaskPageTable <magic_number> <task_id> <task_name> <space_id>:0x0 Lists the address translation of the CPU-specific MMU table. If called without address or range parameters, the complete table will be displayed. If called without a table specifier, this command shows the debugger-internal translation table. See TRANSlation.List. If the command is called with either an address range or an explicit address, table entries will only be displayed, if their logical address matches with the given parameter. <root> PageTable KernelPageTable TaskPageTable <magic_number> <task_id> <task_name> The optional <root> argument can be used to specify a page table base address deviating from the default page table base address. This allows to display a page table located anywhere in memory. List the current MMU translation of the CPU. This command reads all tables the CPU currently uses for MMU translation and lists the address translation. List the MMU translation table of the kernel. If specified with the MMU.FORMAT command, this command reads the MMU translation table of the kernel and lists its address translation. List the MMU translation of the given process. In MMU-based operating systems, each process uses its own MMU translation table. This command reads the table of the specified process, and lists its address translation. See also the appropriate OS awareness manuals: RTOS Debugger for <x>. For information about the parameters, see What to know about Magic Numbers, Task IDs and Task Names (general_ref_t.pdf). x386 and x486 Monitor 17

MMU.SCAN Load MMU table from CPU Format: MMU.SCAN <table> [<range> <address>] MMU.<table>.SCAN (deprecated) <table>: PageTable KernelPageTable TaskPageTable <magic_number> <task_id> <task_name> ALL <cpu_specific_tables> Loads the CPU-specific MMU translation table from the CPU to the debugger-internal translation table. If called without parameters, the complete page table will be loaded. The loaded address translation can be viewed with TRANSlation.List. If the command is called with either an address range or an explicit address, page table entries will only be loaded if their logical address matches with the given parameter. PageTable KernelPageTable TaskPageTable <magic_number> <task_id> <task_name> ALL Load the current MMU address translation of the CPU. This command reads all tables the CPU currently uses for MMU translation, and copies the address translation into the debugger-internal translation table. Load the MMU translation table of the kernel. If specified with the MMU.FORMAT command, this command reads the table of the kernel and copies its address translation into the debugger-internal translation table. Load the MMU address translation of the given process. In MMU-based operating systems, each process uses its own MMU translation table. This command reads the table of the specified process, and copies its address translation into the debugger-internal translation table. See also the appropriate OS awareness manual: RTOS Debugger for <x>. For information about the parameters, see What to know about Magic Numbers, Task IDs and Task Names (general_ref_t.pdf). Load all known MMU address translations. This command reads the OS kernel MMU table and the MMU tables of all processes and copies the complete address translation into the debuggerinternal translation table. See also the appropriate OS awareness manual: RTOS Debugger for <x>. x386 and x486 Monitor 18

CPU specific tables: GDT GDTLDT LDT Loads the Global Descriptor Table from the CPU to the debugger internal translation table. Loads the Global and Local Descriptor Table from the CPU to the debugger internal translation table. Loads the Local Descriptor Table from the CPU to the debugger internal translation table. x386 and x486 Monitor 19

General SYStem Settings and Restrictions General Restrictions Stack Memory The ROM debugger needs memory on the current stack. For only starting the Monitor and memory read or modify commands 8 bytes of stack are used. To start application, 40 bytes of stack are used. Modification of the EPROM while the monitor is running (Hot Patch) requires 64 bytes (at all) on the stack. x386 and x486 Monitor 20

Memory Classes Memory Class D P IO Description Data Program I/O C E A Memory access by CPU Emulation memory access Absolute (physical) memory access x386 and x486 Monitor 21

Support Available Tools CPU ICE FIRE ICD DEBUG ICD MONITOR ICD TRACE POWER INTEGRATOR INSTRUCTION SIMULATOR 486 YES Compilers (Protected Mode) Language Compiler Company Option Comment C SCO-UNIX-CC COFF C GNU-C Free Software DBX Foundation, Inc. C GNU-C Free Software Foundation, Inc. ELF/DWARF2 C GCC386 Greenhills Software Inc. COFF C IC386 Intel Corporation OMF-386 C IC286 Intel Corporation OMF-286 C MCC386 Mentor Graphics EOMF-386 Corporation C MSVC-1.5 Microsoft Corporation EOMF-386 Pharlap ETS C MSVC Microsoft Corporation EXE/CV C MSVC Microsoft Corporation OMF-386/CV SSI Link386 C MSVC/CSI Microsoft Corporation EOMF-386 C HC386 Synopsys, Inc OMF386/SPF C HIGHC Synopsys, Inc ELF/DWARF C++ BORLAND-C Borland Software Corporation EXE/BC5 x386 and x486 Monitor 22

Language Compiler Company Option Comment C++ ORGANON CAD-UL OMF386++ ElectronicServices GmbH C++ GNU-C++ Free Software DBX Foundation, Inc. C++ MSVC Microsoft Corporation EXE/CV4 C++ HC386 Synopsys, Inc OMF/SPF C++ HIGH-C++ Synopsys, Inc ELF/DWARF Compilers (Real Mode) Language Compiler Company Option Comment ASM AXLS HP Source level debugging C BORLANDC Borland Software Corporation EOMF-86 with Paradigm LOCATE C ORGANON CAD-UL EOMF-86 Banking support ElectronicServices GmbH C IC86 Intel Corporation OMF-86 C MCC86 Mentor Graphics EOMF-86 incl. Microtec ext. Corporation C MSC/MSVC-16BIT Microsoft Corporation EOMF-86 with Paradigm LOCATE C MSC/MSVC Microsoft Corporation EXE/TD with Paradigm LOCATE C ICC86 TASKING OMF-86 C ICC86 TASKING IEEE C++ BORLANDC Borland Software EXE/TD Corporation C++ MSVC-16BIT Microsoft Corporation EXE/CV MODULA LOGITECH-M2 Terra Datentechnik MAP/REF PASCAL TEK-PASCAL Tektronix TEK PLM PL/M86 Intel Corporation OMF-86 reads src or list file x386 and x486 Monitor 23

Target Operating Systems Company Product Comment Oracle Corporation ChorusOS - Linux Kernel Version 2.4 and 2.6, 3.x, 4.x Mentor Graphics Nucleus Corporation QNX Software Systems QNX 6.0 to 7.0 Quadros Systems Inc. RTXC 3.2 Wind River Systems VxWorks 5.x to 7.x Microsoft Corporation Windows CE 6.0 Microsoft Corporation Windows Embedded Compact EC7, EC2013 Microsoft Corporation Windows Standard XP, Vista, 7, 8, 10 x386 and x486 Monitor 24

3rd Party Tool Integrations CPU Tool Company Host WINDOWS CE PLATF. - Windows BUILDER CODE::BLOCKS - - C++TEST - Windows ADENEO - X-TOOLS / X32 blue river software GmbH Windows CODEWRIGHT Borland Software Windows Corporation CODE CONFIDENCE Code Confidence Ltd Windows TOOLS CODE CONFIDENCE Code Confidence Ltd Linux TOOLS EASYCODE EASYCODE GmbH Windows ECLIPSE Eclipse Foundation, Inc Windows CHRONVIEW Inchron GmbH Windows LDRA TOOL SUITE LDRA Technology, Inc. Windows UML DEBUGGER LieberLieber Software Windows GmbH SIMULINK The MathWorks Inc. Windows ATTOL TOOLS MicroMax Inc. Windows VISUAL BASIC Microsoft Corporation Windows INTERFACE LABVIEW NATIONAL Windows INSTRUMENTS Corporation RAPITIME Rapita Systems Ltd. Windows RHAPSODY IN MICROC IBM Corp. Windows RHAPSODY IN C++ IBM Corp. Windows DA-C RistanCASE Windows TRACEANALYZER Symtavision GmbH Windows TA INSPECTOR Timing Architects GmbH Windows UNDODB Undo Software Linux VECTORCAST UNIT Vector Software Windows TESTING VECTORCAST CODE COVERAGE Vector Software Windows x386 and x486 Monitor 25

Products Product Information OrderNo Code LA-7530 MON-386 Text ROM Monitor for 386/486 family on ESI supports 386/486 includes HLL debugger, operation system, includes software for Windows Order Information Order No. Code Text LA-7530 MON-386 ROM Monitor for 386/486 family on ESI x386 and x486 Monitor 26