Intel x86/x64 Debugger

Transcription

1 Intel x86/x64 Debugger TRACE32 Online Help TRACE32 Directory TRACE32 Index TRACE32 Documents... ICD In-Circuit Debugger... Processor Architecture Manuals... x86... Intel x86/x64 Debugger... 1 Brief Overview of Documents for New Users... 4 Warning... 5 Quick Start... 6 Troubleshooting... 8 FAQ... 8 x86 Specific Implementations... 9 Tool Identification 9 Onchip Breakpoints 9 Breakpoints after Reset/Power Cycle 10 Access Classes 11 Overview 11 Memory Model 20 General SYStem Settings SYStem.CPU Select the used CPU 22 SYStem.CpuAccess Run-time memory access (intrusive) 22 SYStem.JtagClock Define JTAG clock 23 SYStem.LOCK Tristate the JTAG port 23 SYStem.MemAccess Real-time memory access (non-intrusive) 24 SYStem.Mode Establish the communication with the target 24 CPU specific SYStem Settings SYStem.CONFIG Configure debugger according to target topology 26 STM Settings 26 Multicore Settings (daisy chain) 27 SYStem.CORESTATES Core states overview 31 SYStem.Option Address32 Use 32 bit addresses only 32 SYStem.Option AddTAP Add TAP to JTAG chain 32 SYStem.Option BranchSTEP Enables branch stepping 32 Intel x86/x64 Debugger 1

2 SYStem.Option BreakDELAY Set max. break delay 33 SYStem.Option C0Hold Hold CPU in C0 state 33 SYStem.Option CLTAPOnly Only have CLTAP in JTAG chain by default 33 SYStem.Option IGnoreDEbugReDirections Ignore debug redirections 34 SYStem.Option IGnoreSOC Ignore SoC TAP chain structure 34 SYStem.Option IMASKASM Disable interrupts while single stepping 34 SYStem.Option IMASKHLL Disable interrupts while HLL single stepping 35 SYStem.Option InstrSUBmitFOrcePHYSicalPRDY Use physical PRDY 35 SYStem.Option InstrSUBmitTimeout Timeout for instruction submission 35 SYStem.Option IntelSOC Core is part of Intel SoC 35 SYStem.Option JTAGDirectCPU JTAG directly to CPU TAPs 37 SYStem.Option JTAGOnly Use only JTAG signals 37 SYStem.Option MEMoryMODEL Define memory model 37 SYStem.Option MMUSPACES Enable multiple address spaces support 40 SYStem.Option NoDualcoreModule Disable dualcore module support 40 SYStem.Option NoHyperThread Disable HyperThreading support 41 SYStem.Option NoReBoot Disable chipset reboot 41 SYStem.Option PassWord Unlock JTAG functionality 41 SYStem.Option PreserveDRX Preserve DRx resources 42 SYStem.Option PreserveLBR Preserve LBR resources 42 SYStem.Option ProbeModeNOSaveRestore In probe mode, no save/restore 42 SYStem.Option BIGREALmode Enable Big Real mode handling 43 SYStem.Option ReArmBreakPoints Rearm breakpoints on reset 44 SYStem.Option ResetDELAY Set reset delay 44 SYStem.Option SecondTAP Move TAP to secondary JTAG chain 44 SYStem.Option SMMBIGREALmode Big Real mode handling for SMM 45 SYStem.Option SOFTLONG Use 32-bit access to set SW breakpoint 46 SYStem.Option STandBYAttach In standby mode, only attach to target 46 SYStem.Option STepINTEXC Step into exception handler 46 SYStem.POWER Control target power 47 SYStem.StuffInstruction Submit instruction to CPU in probe mode 47 SYStem.StuffInstructionRead Submit instruction and read 47 Command Groups for Special Registers CPU specific MMU Commands MMU Display all segment and descriptor registers 49 MMU.DUMP Page wise display of MMU translation table 49 MMU.FORMAT Set MMU format 50 MMU.GDT Display GDT descriptor table 51 MMU.IDT Display IDT descriptor table 51 MMU.LDT Display LDT descriptor table 51 MMU.List Compact display of MMU translation table 51 MMU.SCAN Load MMU table from CPU 52 MMU.Set Set MMU register 53 Intel x86/x64 Debugger 2

3 Onchip Triggers TrOnchip.CONVert Adjust range breakpoint in onchip registers 54 TrOnchip.RESet Reset settings to defaults 54 TrOnchip.Set Break on event 55 TrOnchip.Set BootStall Enter bootstall 55 TrOnchip.Set ColdRESet Break on cold reset 56 TrOnchip.Set CpuBootStall Enter CPU bootstall 57 TrOnchip.Set GeneralDetect Break on general detect 57 TrOnchip.Set INIT Break on init 57 TrOnchip.Set MachineCheck Break on machine check 58 TrOnchip.Set RESet Break on CPU reset 58 TrOnchip.Set ShutDown Break on shutdown 58 TrOnchip.Set SMMENtry Break on SMM entry 58 TrOnchip.Set SMMEXit Break on SMM exit 59 TrOnchip.Set SMMINto Step into SMM when single stepping 59 TrOnchip.Set VMENtry Break on VM entry 59 TrOnchip.Set VMEXit Break on VM exit 60 TrOnchip.state Display onchip trigger window 62 CPU specific Events for the ON and GLOBALON Command CPU specific BenchmarkCounter Commands BMC.<counter> Select BMC event to count 64 BMC.<counter>.COUNT Select count mode for BMC 64 CPU Specific Onchip Trace Commands Onchip.Buffer Configure onchip trace source 65 CPU Specific Functions Connectors JTAG Connector 68 MIPI34 Connector 69 MIPI60-C Connector 70 MIPI60-Cv2 Connector 72 MIPI60-Q Connector 73 Support Available Tools 75 Compilers 78 Operating Systems (32-bit) 79 Operating Systems (64-bit) 79 3rd Party Tool Integrations 80 Products Product Information 81 Order Information 83 Intel x86/x64 Debugger 3

4 Intel x86/x64 Debugger Version 24-May Jan-16 Added command description for Onchip.Buffer.TOPA. 07-Jan-16 New access class Q, see Q:, QD:, QP:. Removed accesss class B. 20-Nov Nov Oct Jun Oct-14 Pinout of QuadProbe connector added. Added command descriptions for SYStem.Option BIGREAL and SYStem.Option SMMBIGREAL. Added command description for SYStem.Option.MEMoryMODEL and the new chapter Memory Model. Pinout of CombiProbe connectors added. Added chapter CPU Specific Functions. Brief Overview of Documents for New Users Architecture-independent information: Debugger Basics - Training (training_debugger.pdf): Get familiar with the basic features of a TRACE32 debugger. T32Start (app_t32start.pdf): T32Start assists you in starting TRACE32 PowerView instances for different configurations of the debugger. T32Start is only available for Windows. General Commands (general_ref_<x>.pdf): Alphabetic list of debug commands. Architecture-specific information: Processor Architecture Manuals : These manuals describe commands that are specific for the processor architecture supported by your debug cable. To access the manual for your processor architecture, proceed as follows: - Choose Help menu > Processor Architecture Manual. RTOS Debugger (rtos_<x>.pdf): TRACE32 PowerView can be extended for operating systemaware debugging. The appropriate RTOS manual informs you how to enable the OS-aware debugging. Intel x86/x64 Debugger 4 Brief Overview of Documents for New Users

5 Warning NOTE: To prevent debugger and target from damage it is recommended to connect or disconnect the debug cable only while the target power is OFF. Recommendation for the software start: 1. Disconnect the debug cable from the target while the target power is off. 2. Connect the host system, the TRACE32 hardware and the debug cable. 3. Power ON the TRACE32 hardware. 4. Start the TRACE32 software to load the debugger firmware. 5. Connect the debug cable to the target. 6. Switch the target power ON. 7. Configure your debugger e.g. via a start-up script. Power down: 1. Switch off the target power. 2. Disconnect the debug cable from the target. 3. Close the TRACE32 software. 4. Power OFF the TRACE32 hardware. Intel x86/x64 Debugger 5 Warning

6 Quick Start Starting up the debugger is done as follows: 1. Select the device prompt for the ICD Debugger and reset the TRACE32 development tool. B:: RESet The device prompt B:: is normally already selected in the command line. If this is not the case enter B:: to set the correct device prompt. The RESet command is only necessary if you do not start directly after booting the TRACE32 development tool. 2. Specify the CPU specific settings. SYStem.CPU <cputype> After choosing the CPU, the default values of all other options are automatically set to the most useful values for the chosen CPU. This means that in most cases it should now be possible to do basic debugging without any further initial configuration of the TRACE32 tool. 3. Attach to the target and enter debug mode. SYStem.Mode.Attach Break The first command attaches the debugger to the running target. The second command stops the target and enters debug mode. After these commands are executed it is possible to access memory and registers. A typical start sequence is shown below. This sequence can be written to an ASCII file (script file) and executed with the command DO <filename>. B:: RESet WinClear SYStem.CPU ATOMZ5XX SYStem.Mode.Attach Break ; Select the ICD device prompt ; Reset the TRACE32 software ; Clear all windows ; Select specific CPU ; Attach to the running target ; Stop the target and enter debug mode Register /SpotLight ; Open register and stack window *) Data.List ; Open source code window *) Intel x86/x64 Debugger 6 Quick Start

7 *) These commands open windows on the screen. The window position can be specified with the WinPOS command. Intel x86/x64 Debugger 7 Quick Start

8 Troubleshooting No information available FAQ What is the difference between the executables t32mx86[.exe] and t32m64[.exe]? t32mx86 is for debugging 32 bit target code, t32mx64 is for debugging 64 bit target code. If the CPU does not support Intel 64 technology, you have to use t32mx86. If the CPU is executing 64 bit code you have to use t32mx64. In other cases you can choose what is most convenient. We recommend to use t32mx86 when debugging only 32 bit target code (even if the CPU is 64 bit capable) and to use t32mx64 when debugging 64 bit or mixed 32/64 bit target code. NOTE: The question of t32mx86 or t32mx64 is only related to the target you are debugging. It is not related to the host operating system you are working on (Linux (32/64bit), Windows (32/64bit), Solaris or any other)! Intel x86/x64 Debugger 8 Troubleshooting

9 x86 Specific Implementations Tool Identification The following TRACE32 functions allow you to check which Intel x86/x64 specific TRACE32 tool component is used to connect to the target. ID.CABLE() ID.WHISKER(0) ID.WHISKER(0) ID.WHISKER(1) Returns 0x3836 if Intel x86/x64 XDP60 Debug Cable is connected. Returns 0x05 if a Whisker for CombiProbe Intel x86/x64 MIPI34 is connected. Return both 0x10 if a Whisker Cable MIPI60-C for CombiProbe is connected. IF (ID.WHISKER(0)==0x10)&&(ID.WHISKER(1)==0x10) PRINT "Whisker Cable MIPI60-C for CombiProbe connected" Onchip Breakpoints The list below gives an overview of the availability and the usage of the onchip breakpoints. The following notations are used: Onchip breakpoints: Total amount of available onchip breakpoints. Instruction breakpoints: Number of onchip breakpoints that can be used to set Program breakpoints into NOR FLASH. Read/Write breakpoints: Number of onchip breakpoints that stop the program when a write or read/write to a certain address happens. Data value breakpoint: Number of onchip data breakpoints that stop the program when a specific data value is written to an address or when a specific data value is read from an address. Intel x86/x64 Debugger 9 x86 Specific Implementations

10 Family Onchip Breakpoints Instruction Breakpoints Read/Write Breakpoint Data Value Breakpoints Intel x86/x single address 4 Write or Read/Write single address or ranges up to 8 bytes (aligned) A detailed introduction into the breakpoint handling can be found in Basic Debugging Intel x86/x64 (training_debugger_x86.pdf). Breakpoints after Reset/Power Cycle TRACE32 PowerView displays valid in the note column of the Break.List window, as long a the breakpoint setting is valid on the target. TRACE32 PowerView displays Unknown State in the note column of the Break.List window, if TRACE32 detects that the target is reset/re-powered and the cores immediately start the program execution. In this case it is likely that the breakpoint settings are cleared. Intel x86/x64 Debugger 10 x86 Specific Implementations

11 Access Classes Overview Access Class C D P Description Generic Data Program A AD AP Absolute Absolute Data Absolute Program I ID IP Intermediate Intermediate Data Intermediate Program L LD LP Linear Linear Data Linear Program R RD RP ARD ARP LRD LRP Real Mode Real Mode Data Real Mode Program Absolute Real Mode Data Absolute Real Mode Program Linear Real Mode Data Linear Real Mode Program N ND NP AND Protected Mode (32 bit) Protected Mode Data (32 bit) Protected Mode Program (32 bit) Absolute Protected Mode Data (32 bit) Intel x86/x64 Debugger 11 x86 Specific Implementations

12 Access Class ANP LND LRP Description Absolute Protected Mode Program (32 bit) Linear Protected Mode Data (32 bit) Linear Protected Mode Program (32 bit) X XD XP AXD AXP LXD LXP 64 bit Mode 64 bit Mode Data 64 bit Mode Program Absolute 64 bit Mode Data Absolute 64 bit Mode Program Linear 64 bit Mode Data Linear 64 bit Mode Program O OD OP AOD AOP LOD LOP Protected Mode (16 bit) Protected Mode Data (16 bit) Protected Mode Program (16 bit) Absolute Protected Mode Data (16 bit) Absolute Protected Mode Program (16 bit) Linear Protected Mode Data (16 bit) Linear Protected Mode Program (16 bit) IO MSR CID VMCS IOSF IO Ports MSR Registers CPUID Instruction VMCS Registers IOSF Sideband Q QD QP AQD AQP Real Big Mode (Real Mode supporting 32 bit addresses) Real Big Mode Data Real Big Mode Program Absolute Real Big Mode Data Absolute Real Big Mode Program Intel x86/x64 Debugger 12 x86 Specific Implementations

13 Access Class LQD LQP Description Linear Real Big Mode Data Linear Real Big Mode Program E Dual Port Access S SD SP SR SRD SRP SN SND SNP SX SXD SXP SO SOD SOP SQ SQD SQP System Management Mode (SMM) SMM Data SMM Program SMM Real Mode SMM Real Mode Data SMM Real Mode Program SMM Protected Mode (32 bit) SMM Protected Mode Data (32 bit) SMM Protected Mode Program (32 bit) SMM 64 bit Mode SMM 64 bit Mode Data SMM 64 bit Mode Program SMM Protected Mode (16 bit) SMM Protected Mode Data (16 bit) SMM Protected Mode Program (16 bit) SMM Real Big Mode (Real Mode supporting 32 bit addresses) SMM Real Big Mode Data SMM Real Big Mode Program AS ASD ASP ASQD ASQP LS LSD Absolute SMM Absolute SMM Data Absolute SMM Program SMM Absolute Real Big Mode Data SMM Absolute Real Big Mode Program Linear SMM Linear SMM Data Intel x86/x64 Debugger 13 x86 Specific Implementations

14 Access Class LSP SLQD SLQP Description Linear SMM Program SMM Linear Real Big Mode Data SMM Linear Real Big Mode Program CS DS SS ES FS GS Current value of CS Current value of DS Current value of SS Current value of ES Current value of FS Current value of GS D:, P: The D: prefix refers to the DS segment register and the P: prefix to the CS segment register. Both D: and P: memory classes access the same memory. It is not possible to split program and data memory. Real Mode or Protected Mode (16, 32 or 64 bit) addressing is chosen dependent on the current processor mode. Data.Set P:0x0--0x0ffff 0x0 ; fill program memory with zero Data.Set 0x0--0x0ffff 0x0 ; fill data memory with zero Data.Set 0x100 0x0 ; set location DS:0x100 to 0 Data.Assemble 0x100 nop Data.Assemble 0x0--0x0fff nop ; assemble to location CS:0x100 ; fill program memory with nop ; instruction A:, AD:, AP: Absolute addressing. The address parameter specifies the absolute address thus disregarding segmentation and paging. It is possible to use A as a prefix to most other memory classes. Data.Set A:0x x33 Data.dump AD:0x12000 ; write to absolute address 0x12000 in ; program/data memory ; displays absolute address 0x12000 ; from data memory Intel x86/x64 Debugger 14 x86 Specific Implementations

15 I:, ID:, IP: Intermediate addressing. This memory class is used in connection with virtualization. It corresponds to the guest physical address, i.e., disregards segmentation and paging of the guest, but does not disregard possible second level paging done by the host (use A: for that). Data.Set I:0x x33 Data.dump ID:0x12000 ; write to guest absolute address ; 0x12000 in program/data memory ; displays guest absolute address ; 0x12000 from data memory L:, LD:, LP: Linear addressing. The address parameter specifies the linear address thus disregarding segmentation but not paging. It is possible to use L as a prefix to most other memory classes. Data.Set L:0x x33 Data.dump LD:0x12000 ; write to linear address 0x12000 in ; program/data memory ; displays absolute address 0x12000 ; from data memory R:, RD:, RP: Real Mode addressing. Data.Set R:0x1234:0x5678 Data.Set R:0x100 ; write to Real Mode address 0x1234:0x5678 ; write to Real Mode address DS:0x100 N:, ND:, NP: Protected Mode (32 bit) addressing. ( N is for Normal.) Data.Set N:0x0f0:0x5678 Data.dump ND:0x Data.List NP:0x0C ; write to Protected Mode address 0x5678 of ; selector 0x0f0 ; display memory at Protected Mode address ; DS:0x ; disassemble memory in 32 bit mode at ; Protected Mode address CS:0x0C Intel x86/x64 Debugger 15 x86 Specific Implementations

16 X:, XD:, XP: 64 bit Mode addressing. ( X is for extended.) Data.dump XD:0x ABC ;display memory at 64 bit Mode ;linear address 0x ABC O:, OD:, OP: Protected Mode (16 bit) addressing. ( O is for Old.) Data.List OP:0x4321 ; disassemble memory in 16 bit mode at ; Protected Mode address CS:0x4321 Q:, QD:, QP: Big Real Mode addressing. Real Mode (16 bit opcodes), supporting 32 bit addresses. See SYStem.Option.BIGREALmode ON for details. Data.Set Q:0x1234:0x5678ABCD Data.Set Q:0x ; write to 32 bit Big Real Mode address 0x1234:0x5678ABCD ; write to 32 bit Big Real Mode address DS:0x IO: Access IO ports. Data.Out IO:0xCF8 %long 0xF ; output 32 bit value 0xF at IO port ; 0xCF8 MSR: Accesses MSR registers. The address format is as follows: Bits Meaning 23-0 MSR[23-0] MSR[31-28] Ignored Intel x86/x64 Debugger 16 x86 Specific Implementations

17 Data.dump msr:0x0 Data.dump msr:0x0c ; display MSR registers starting with ; MSR register 0 ; display MSR registers starting with ; MSR register 0xC CID: Return CPUID values. The address format is as follows: Bits Meaning 1-0 Return Register (0=EAX, 1=EBX, 2=ECX, 3=EDX) 3-2 Ignored 14-4 EAX[10-0] 15 EAX[31] ECX[13-0] Ignored Data.dump cid:0x0 ; display CPUID values starting with ; initial EAX value 0x0 Data.dump cid:0x8020 ; display CPUID values starting with ; initial EAX value 0x Data.In cid:0x20041 ; return EBX CPUID value with initial ; EAX value 0x4 and initial ECX value ; 0x2 VMCS: Access virtual-machine control data structures (VMCSs). The address to be used with this memory class is the corresponding field encoding of an VMCS component. Data.In VMCS:0x6C00 ; display the host CR0 VMCS component IOSF: Access IOSF sideband. The address format uses a <segment>:<offset> syntax, where the segment is 16 bits, and the offset 64 bits: Intel x86/x64 Debugger 17 x86 Specific Implementations

18 IOSF:<8 bit Opcode><8 bit PortID>:<8 bit FID><4 bit BAR><4 bit Reserved><48 bit Address> Segment part: Bits Meaning 7-0 Port ID 15-8 Opcode Offset part: Bits Meaning 47-0 Address Reserved BAR FID Data.In IOSF:0x0608:3C /long ; Read IOSF sideband with opcode 0x06, ; port ID 0x08 and address 0x3C. ; (FID and BAR are both 0) Data.Set IOSF:0x0608:3C %long 0xdeadbeef Data.In IOSF:0x0608:0xFF A B /long ; Write IOSF sideband with opcode 0x06, ; port ID 0x08 and address 0x3C. ; (FID and BAR are both 0) ; Read IOSF sideband with opcode 0x06, ; port ID 0x08, FID 0xFF, BAR 0x7 and ; address 0x AB E: Dual Port access. This access class must be used for run-time memory access (intrusive or non-intrusive). E can additionally be used as a prefix to every other access class documented here. Data.dump END:0x ; display memory at Protected Mode ; address DS:0x during run-time Intel x86/x64 Debugger 18 x86 Specific Implementations

19 S:, SD:, SP:, SR:, SRD:, SRP:, SN:, SND:, SNP:, SX:, SXD:, SXP:, SO:, SOD:, SOP:, SQ:, SQD:, SQP: The S prefix refers to System Management Mode. All these access classes behave like the corresponding ones without the S only that they refer to SMM memory instead of normal memory. Data.dump ASD:0x3f ; display SMM memory at absolute ; address 0x3f CS:, DS:, SS:, ES: / ESR:, FS:, GS: Current value of the corresponding segment register. These are not real access classes but rather simply placeholders for the segment register values.. Data.Set FS:0x x33 ; write to address FS:0x12000 Data.dump SS:0x12000 ; displays memory at SS:0x12000 NOTE: Address prefix ES: is interpreted as access class for an unspecific (nonprogram and non-data) dual-port System Management Mode memory accesses. To specify the ES: segment for a memory access please use ESR: instead. Intel x86/x64 Debugger 19 x86 Specific Implementations

20 Memory Model The Intel x86 memory model describes the way the debugger considers the six segments CS (code segment), DS (data segment), SS (stack segment), ES, FS and GS and the usage of the LDT (local descriptor table) for the current debug session. A further introduction into the concept of x86 memory models can be found in the Intel software developer s manual (please refer to the chapter describing segments in protected mode memory management). TRACE32 supports a number of memory models when working with addresses and segments: LARGE, FLAT, ProtectedFLAT, LDT and SingleLDT. Activating the space IDs with SYStem.Option.MMUSPACES ON will override any other selected memory model. TRACE32 now behaves as if the memory model FLAT is selected and additionally uses space IDs in the address to identify process-specific address spaces (see SYStem.Option.MMUSPACES for more details). Effect of the Memory Model on the Debugger Operation In protected mode, the address translation of x86 processors support segment translation and paging (if enabled). Segment translation cannot be disabled in hardware. If the TRACE32 address translation is enabled (TRANSlation.ON, TRANSlation.TableWalk ON), the same translation steps are executed when the debugger performs a memory access to protected mode addresses. The values loaded into base, limit and attribute of the segment registers CS, DS, ES, FS, GS and SS depend on the code being executed and how it makes use of the segments. Setup of the segment registers is an essential step in loading executable code into memory. Choosing the appropriate TRACE32 memory model adjusts the segment register handling on the debugger side to the segment register handling on the software side. For this purpose, TRACE32 offers six memory models. The memory model affects: The TRACE32 address format Whether or not segment information is used when the debugger accesses memory Whether a LDT descriptor is used to dynamically fetch code and data segments from the local descriptor table LDT when the debugger accesses memory The way how the segment base and limit values are evaluated when an address is translated from a protected mode address into a linear and/or physical address The way the segment attribute information such as code or data width (16/32/64 bit) is evaluated when code or data memory is accessed For a more detailed description of the memory models supported by TRACE32, see SYStem.Option.MEMoryMODEL. Intel x86/x64 Debugger 20 x86 Specific Implementations

21 Selecting the Memory Model After reset, the TRACE32 memory model LARGE is enabled by default. Use one of the following commands to select a different TRACE32 memory model for the current debug session: 1. SYStem.Option.MEMoryMODEL 2. SYStem.Option.MMUSPACES 3. Data.LOAD - When loading an executable file, specify one of these command options FLAT, ProtectedFLAT, SingleLDT, LDT, or LARGE to select the TRACE32 memory model you want to apply to the executable. The PRACTICE function SYStem.Option.MEMoryMODEL() returns the name of the currently enabled memory model. PRINT SYStem.Option.MEMoryMODEL() ;print the name of the memory model ;to the TRACE32 message line Intel x86/x64 Debugger 21 x86 Specific Implementations

22 General SYStem Settings SYStem.CPU Select the used CPU SYStem.CPU <cpu> Selects the target CPU/SoC. After choosing the CPU/SoC, the default values of all other options are automatically set to the most useful values for the chosen CPU/SoC. This means that in most cases it should now be possible to do basic debugging without any further initial configuration of the TRACE32 tool. In a few special cases it might be necessary to do additional configuration of the JTAG TAP chain (please refer to the section on Multicore Settings later in this document). SYStem.CpuAccess Run-time memory access (intrusive) SYStem.CpuAccess Enable Denied Nonstop Default: Denied. Enable Denied Nonstop Allow intrusive run-time memory access. In order to perform a memory read or write while the CPU is executing a program the debugger stops the program execution shortly. Each short stop takes ms depending on the speed of the debug interface and on the number of the read/write accesses required. A red S in the state line of the TRACE32 screen indicates this intrusive behavior of the debugger. Do not allow intrusive run-time memory access. Lock all features of the debugger, that affect the run-time behavior. Nonstop reduces the functionality of the debugger to: run-time access to memory and variables trace display The debugger inhibits the following: to stop the program execution all features of the debugger that are intrusive (e.g. action Spot for breakpoints, performance analysis via StopAndGo mode, conditional breakpoints etc.) Intel x86/x64 Debugger 22 General SYStem Settings

23 SYStem.JtagClock Define JTAG clock SYStem.JtagClock <freq> SYStem.BdmClock <freq> (deprecated) Default: 5.0 MHz. Selects the clock frequency of the JTAG debug interface communication. Use the command SYStem.DETECT.JtagClock to experimentally detect the maximum possible JTAG clock frequency for a particular setup. SYStem.LOCK Tristate the JTAG port SYStem.LOCK [ON OFF] Default: OFF. If the system is locked no access to the JTAG port will be performed by the debugger. While locked, the JTAG connector of the debugger is tristated. The intention of the lock command is for example to give JTAG access to another tool. The process can also be automated, see SYStem.CONFIG TriState. It must be ensured that the state of the JTAG state machine remains unchanged while the system is locked. To ensure correct hand over the options SYStem.CONFIG TAPState and SYStem.CONFIG TCKLevel must be set properly. They define the TAP state and TCK level which is selected when the debugger switches to tristate mode. Intel x86/x64 Debugger 23 General SYStem Settings

24 SYStem.MemAccess Real-time memory access (non-intrusive). SYStem.MemAccess CPU Denied Default: Denied. CPU Denied Real-time memory access during program execution to target is enabled. Real-time memory access during program execution to target is disabled. NOTE: None of the currently supported CPUs support non-intrusive real-time memory access. SYStem.Mode Establish the communication with the target SYStem.Mode <mode> <mode>: Down NoDebug Prepare Go Attach StandBy Up Down NoDebug Prepare Go Attach Down mode. Disconnects the debugger from the target. If the CPU is stopped in debug mode it is forced to leave and start running before the debugger is tristated. Equivalent to Down. Resets JTAG. This must be used before doing raw JTAG shifting. Not used for normal debugging Connects the debugger and resets the target. Connects the debugger to the running target. The state of the CPU remains unchanged. Intel x86/x64 Debugger 24 General SYStem Settings

25 StandBy Up Standby mode. The debugger must be in this mode to handle scenarios where the target looses power and where the debugger must react when the power returns. The default behavior is to stop at the reset vector, rearm onchip breakpoints and set the CPU running again. The default behavior can be overwritten by using SYStem.Option.STandBYAttach, TrOnchip.Set.ColdRESet or TrOnchip.Set.BootStall. Connects the debugger, resets the target, enters debug mode and stops the CPU at the reset vector. NOTE: Some CPUs are not resettable via the JTAG interface, i.e., Go and/or Up might not work for all targets. NOTE: Standby is not available for all CPUs. Intel x86/x64 Debugger 25 General SYStem Settings

26 CPU specific SYStem Settings SYStem.CONFIG Configure debugger according to target topology SYStem.CONFIG <parameter> SYStem.MultiCore <parameter> (deprecated) <parameter>: STM Type Generic (single STM) STM1 Type Generic (two STMs) STM2 Type Generic (two STMs) STM Mode STP STP64 SPTv2 (single STM) STM1 Mode STP STP64 SPTv2 (two STMs) STM2 Mode STP STP64 SPTv2 (two STMs) STM RESET (single STM) STM1 RESET (two STMs) STM2 RESET (two STMs) state IRPRE <bits> IRPOST<bits> DRPRE <bits> DRPOST <bits> TriState [ON OFF] Slave [ON OFF] TAPState <state> TCKLevel <level> STM Settings STM Type STM Mode (default: Generic) STM module is generic. Inform TRACE32 that the chip contains a System Trace Module. The TRACE32 command group STM is enabled. The following STP protocols can be specified: STP (MIPI STPv1, D32 packets) STP64 (MIPI STPv1, D64 packets) STPv2 (MIPI STPv2) If the chip contains more the one STM, the individual STM can be addressed by adding a number to the keyword STM. STM RESET Reset SYStem.CONFIG STM settings. Intel x86/x64 Debugger 26 CPU specific SYStem Settings

27 SYStem.CONFIG STM Mode STP64 STM.state ; chip contains a STM that uses ; MIPI STPv1 (D64) protocol ; open STM configuration window SYStem.CONFIG STM1 Mode STPv2 STM1.state SYStem.CONFIG STM2 Mode STPv2 STM2.state ; chip contains a STM that uses ; MIPI STPv2 protocol ; open STM1 configuration window ; chip contains a second STM that ; uses MIPI STPv2 protocol ; open STM2 configuration window Multicore Settings (daisy chain) The four parameters IRPRE, IRPOST, DRPRE, DRPOST are used to inform the debugger of the TAP controller position in the JTAG chain if there is more than one core in the JTAG chain. This information is required for some CPUs before the debugger can be activated, e.g., by SYStem.Mode.Attach. NOTE: It is possible to use the command SYStem.DETECT.DaisyChain to probe the JTAG chain for the presence and positions of TAP controllers. TriState has to be used if several debuggers are connected to a common JTAG port at the same time. TAPState and TCKLevel define the TAP state and TCK level which is selected when the debugger switches to tristate mode. Please note: ntrst must have a pull-up resistor on the target, TCK can have a pull-up or pull-down resistor, other trigger inputs needs to be kept in inactive state. state DRPRE DRPOST Show multicore settings. (default: 0) <number> of TAPs in the JTAG chain between the core of interest and the TDO signal of the debugger. If each core in the system contributes only one TAP to the JTAG chain, DRPRE is the number of cores between the core of interest and the TDO signal of the debugger. (default: 0) <number> of TAPs in the JTAG chain between the TDI signal of the debugger and the core of interest. If each core in the system contributes only one TAP to the JTAG chain, DRPOST is the number of cores between the TDI signal of the debugger and the core of interest. Intel x86/x64 Debugger 27 CPU specific SYStem Settings

28 IRPRE IRPOST TriState [ON OFF] Slave [ON OFF] TAPState TCKLevel [0 1] (default: 0) <number> of instruction register bits in the JTAG chain between the core of interest and the TDO signal of the debugger. This is the sum of the instruction register length of all TAPs between the core of interest and the TDO signal of the debugger. (default: 0) <number> of instruction register bits in the JTAG chain between the TDI signal and the core of interest. This is the sum of the instruction register lengths of all TAPs between the TDI signal of the debugger and the core of interest. See also Daisy-Chain Example. (default: OFF) If several debuggers share the same debug port, this option is required. The debugger switches to tristate mode after each debug port access. Then other debuggers can access the port. (default: OFF) If several debuggers share the same debug port, all except one must have this option active. (default: 7 = Select-DR-Scan) This is the state of the TAP controller when the debugger switches to tristate mode. All states of the JTAG TAP controller are selectable. (default: 0) Level of TCK signal when all debuggers are tristated. Intel x86/x64 Debugger 28 CPU specific SYStem Settings

29 Daisy-Chain Example IRPOST IRPRE TAP1 TAP2 TAP3 TAP4 TDI IR DR 4 1 IR DR 3 1 IR DR 5 1 Core IR DR 6 1 TDO DRPOST DRPRE IR: Instruction register length DR: Data register length Core: The core you want to debug Daisy chains can be configured using a PRACTICE script (*.cmm) or the SYStem.CONFIG.state window. The PRACTICE code example below explains how to obtain the individual IR and DR values for the above daisy chain. PRACTICE code example: SYStem.CONFIG.state /Jtag ; optional: open the window SYStem.CONFIG IRPRE 6. ; IRPRE: There is only one TAP. ; So type just the IR bits of TAP4, i.e. 6 SYStem.CONFIG IRPOST 12. ; IRPOST: Add up the IR bits of TAP1, TAP2 ; and TAP3, i.e = 12 SYStem.CONFIG DRPRE 1. ; DRPRE: There is only one TAP which is ; in BYPASS mode. ; So type just the DR of TAP4, i.e. 1 SYStem.CONFIG DRPOST 3. ; DRPOST: Add up one DR bit per TAP which ; is in BYPASS mode, i.e = 3 ; This completes the configuration. NOTE: In many cases, the number of TAPs equals the number of cores. But in many other cases, additional TAPs have to be taken into account; for example, the TAP of an FPGA or the TAP for boundary scan. Intel x86/x64 Debugger 29 CPU specific SYStem Settings

30 TapStates 0 Exit2-DR 1 Exit1-DR 2 Shift-DR 3 Pause-DR 4 Select-IR-Scan 5 Update-DR 6 Capture-DR 7 Select-DR-Scan 8 Exit2-IR 9 Exit1-IR 10 Shift-IR 11 Pause-IR 12 Run-Test/Idle 13 Update-IR 14 Capture-IR 15 Test-Logic-Reset Intel x86/x64 Debugger 30 CPU specific SYStem Settings

31 SYStem.CORESTATES Core states overview SYStem.CORESTATES This command opens an overview window showing mode, state and more for each core/hyperthread of the CPU. This information is updated every time the CPU is stopped. Curr. Core Phys. Hyper. APIC Mode Prior State SMM VMX Currently selected core Core index as numbered by the debugger Index of physical core Index of hyperthread of physical core APIC ID of core Current mode of core (e.g., Real or Protected) Indicates any special state the core is in (e.g., HLT or MWAIT) Shows if a core is in SMM mode Shows if a core is in VMX mode, and if Host or Guest NOTE: By double-clicking a line, the current core can be selected. Intel x86/x64 Debugger 31 CPU specific SYStem Settings

32 SYStem.Option Address32 Use 32 bit addresses only SYStem.Option Address32 [ON OFF] Default: OFF. This option only has an effect when in 64 bit mode. When the option is ON, all addresses are truncated to 32 bit. The high 32 bits of a 64 bit address are not shown when the address is displayed, and when an address is entered the high 32 bits are ignored (thereby effectively being set to zero). NOTE: The actual memory access mode is NOT affected by this option. SYStem.Option AddTAP Add TAP to JTAG chain SYStem.Option AddTAP <tap> Adds a TAP to the JTAG chain. This is a special-purpose option and only available for a few CPUs. The available <tap> names are also CPU specific. It is required to use this option before attaching to the target, that is, before using the SYStem.Mode.Attach or SYStem.Mode.Up commands. SYStem.Option BranchSTEP Enables branch stepping SYStem.Option BranchStep [ON OFF] Default: OFF. If enabled, the debugger changes the behavior of normal single stepping to single stepping on branches : Only taken branches are visited when stepping. Intel x86/x64 Debugger 32 CPU specific SYStem Settings

33 SYStem.Option BreakDELAY Set max. break delay SYStem.Option BreakDELAY <ms> Default: 500 ms. Sets the max. break delay during which the debugger attempts to stop the CPU cores. Increasing the break delay might help stop the CPU cores, e.g., in certain power down scenarios. SYStem.Option C0Hold Hold CPU in C0 state SYStem.Option C0Hold [ON OFF] Default: OFF. If enabled, the CPU is being held in the C0 state. In C0 the CPU is fully powered all the time. The CPU does not enter any power-saving modes and no peripherals are powered down. SYStem.Option CLTAPOnly Only have CLTAP in JTAG chain by default SYStem.Option CLTAPOnly [ON OFF] Default: OFF. This option is only available for newer Intel Atom SoCs. When enabled, only the CLTAP is kept in the JTAG chain by default. Every time an access to other TAPs (in particular, the CPU TAP) is needed, the TAP in question is added to the chain. After the access, the added TAP is removed again. This functionality is used for multicore debugging and concurrent access through the C API, such that the state of the JTAG chain is always known and invariant. Intel x86/x64 Debugger 33 CPU specific SYStem Settings

34 SYStem.Option IGnoreDEbugReDirections Ignore debug redirections SYStem.Option IGnoreDEbugReDirections [ON OFF] Default: OFF. When enabled, debug redirections are ignored by the debugger. This means that onchip breakpoints and most onchip triggers will not be functional. This option is available for special handling if the target program needs to react to the debug redirections itself. Note: SW breakpoints in the debugger are still functional even if this option is enabled. SYStem.Option IGnoreSOC Ignore SoC TAP chain structure SYStem.Option.IGnoreSOC [ON OFF] Default: OFF. When enabled, debugger ignores all other TAPs in the SoC and considers a plain IA core, typically used in early design phase to verify the IA core in FPGA. Note: To debug a specific IA core, select an SoC that contains this type of core and enable this option in down mode. SYStem.Option IMASKASM Disable interrupts while single stepping SYStem.Option IMASKASM [ON OFF] Default: OFF. If enabled, the interrupt enable flag of the EFLAGS register will be cleared during assembler single-step operations. After the single step the interrupt enable flag is restored to the value it had before the step. Intel x86/x64 Debugger 34 CPU specific SYStem Settings

35 SYStem.Option IMASKHLL Disable interrupts while HLL single stepping SYStem.Option IMASKHLL [ON OFF] Default: OFF. If enabled, the interrupt enable flag of the EFLAGS register will be cleared during HLL single-step operations. After the single step the interrupt enable flag is restored to the value it had before the step. SYStem.Option InstrSUBmitFOrcePHYSicalPRDY Use physical PRDY SYStem.Option InstrSUBmitFOrcePHYSicalPRDY [ON OFF] Default: OFF. If enabled, the debugger forces usage of the physical PRDY pin for checking completion of instruction submissions in Probe Mode even if SYStem.Option.JTAGOnly ON. SYStem.Option InstrSUBmitTimeout Timeout for instruction submission SYStem.Option InstrSUBmitTimeout <us> Default: 2000 us. Sets the timeout for instruction submission completion checking. SYStem.Option IntelSOC Core is part of Intel SoC SYStem.Option IntelSOC [ON OFF] Default: OFF. Only used for AMP multicore debugging to inform the slave debugger that the core is part of an Intel SoC. When enabled, all IR and DR pre/post settings are handled automatically, no manuel configuration is necessary. Intel x86/x64 Debugger 35 CPU specific SYStem Settings

36 Requires that the debugger is slave in a multicore setup with an x86 master debugger and that SYStem.Option.CLTAPOnly is enabled in the x86 master debugger. Intel x86/x64 Debugger 36 CPU specific SYStem Settings

37 SYStem.Option JTAGDirectCPU JTAG directly to CPU TAPs SYStem.Option JTAGDirectCPU [ON OFF] Default: CPU dependent. NOTE: This option is only relevant when SYStem.Option JTAGOnly ON If enabled, the debugger talks directly to the CPU TAPs. If disabled, the debugger uses other JTAG-only methods to control the CPU (virtual PREQ/PRDY or RCM). It is recommended to use the default setting unless special cases require otherwise. Not all targets support SYStem.Option JTAGDirectCPU OFF SYStem.Option JTAGOnly Use only JTAG signals SYStem.Option JTAGOnly [ON OFF] Default: CPU dependent. If enabled, the debugger uses only the five JTAG signals (TCK,TMS,TDI,TDO,TRST) for controlling the target. If disabled, the debugger also uses extra non-jtag signals (PREQ,PRDY,...). It is recommended to use the default setting unless special cases require otherwise. Not all targets support SYStem.Option JTAGOnly OFF SYStem.Option MEMoryMODEL Define memory model SYStem.OptionMEMoryMODEL <model> <model>: LARGE FLAT LDT SingleLDT ProtectedFLAT Default: LARGE (Multi-Segment Model). Intel x86/x64 Debugger 37 CPU specific SYStem Settings

38 Selects the memory model TRACE32 uses for code and data accesses. The memory model describes how the CS (code segment), DS (data segment), SS (stack segment), ES, FS and GS segment registers are currently used by the processor. The command SYStem.Option.MMUSPACES ON will override the setting of SYStem.Option.MEMoryMODEL with the memory model MMUSPACES. The selection of the memory model affects the following areas: The way TRACE32 augments program or data addresses with information from the segment descriptors. Information augmented is the segment selector, offset, limit and access width. The TRACE32 address format The way TRACE32 handles segments when the debugger address translation is enabled (TRANSlation.ON). LARGE This is the default memory model. It is enabled after reset. This memory model is used if the application makes use of the six segment registers (CS, DS, ES, FS, GS, SS) and the global descriptor table (GDT) and/or the local descriptor table (LDT). TRACE32 supports GDT and LDT descriptor table walks in this memory model. if a TRACE32 address contains a segment descriptor and the specified segment descriptor is not present in any of the six segments CS, DS, ES, FS, GS or SS, TRACE32 will perform a descriptor table walk through the GDT or the LDT to extract the descriptor information and apply it to the address. Access classes of program and data addresses will be augmented with information from the CS and DS segments. Segment translation is used in TRACE32 address translation. TRACE32 addresses display the segment selector to the left of the address offset. The segment selector indicates the GDT or LDT segment descriptor which is used for the address. Example address: NP:0x0018:0x0003F000 Intel x86/x64 Debugger 38 CPU specific SYStem Settings

39 LDT This memory model should be selected if a LDT is present and the debugger uses multiple entries from it. TRACE32 addresses contain a LDTR segment selector specifying the LDT entry which applies to an address. Access classes of program and data addresses will be augmented with the information specified by the LDTR segment selector. Segment translation is used in TRACE32 address translation. TRACE32 addresses display three numeric elements: The 16-bit LDTR segment selector used pointing to the LDT for the address The 16-bit CS (for program addresses) or DS (for data addresses) segment selector, extracted from the LDT The 16-bit address offset Example address: NP:0x0004:0x0018:0x8000 SingleLDT This memory model should be selected if a LDT is present but the debugger works with only one single LDT entry. The LDT is not used to differentiate addresses. Access classes of program and data addresses will be augmented with information from the CS (for program addresses) or DS (for data addresses) segment. Segment translation is used in TRACE32 address translation. TRACE32 addresses display the segment selector to the left of the address offset. Example address: NP:0x001C:0x0003F000 ProtectedFLAT This memory model is used if the segment translation and limit checks of the CS and the DS registers are required, but the segment register contents are kept constant. Consequently, TRACE32 addresses contain no segment descriptor because no descriptor table walk is used to reload the segment registers. Access classes of addresses are not augmented with segment information. TRACE32 addresses display only the access class and the address offset. Example address: NP:0xC0003F000 Segment translation is used in TRACE32 address translation for limit checking. Accesses to program addresses use the CS segment, accesses to data addresses use the DS segment. FLAT This memory model is used if segmentation plays no role for an application and memory management makes use of paging only. Segments are ignored, no segment translation is performed. Accesses to program and data addresses are treated the same. Example address: NP:0xC0003F000 Intel x86/x64 Debugger 39 CPU specific SYStem Settings

40 (MMUSPACES) This memory model can only be enabled with the command SYStem.Option.MMUSPACES ON. Memory model MMUSPACES is used if TRACE32 works with a kernel awareness and memory space identifiers (spaceids) are used in addresses to identify process specific address spaces. Segments are ignored, no segment translation is performed. TRACE32 addresses display a 16-bit memory space identifier to the left of the address offset. Example address: NP:0x29A:0xC0003F000 SYStem.Option MMUSPACES Enable multiple address spaces support SYStem.Option MMUSPACES [ON OFF] SYStem.Option MMU [ON OFF] (deprecated) Default: OFF. Enables the usage of the MMU to support multiple address spaces. The command should not be used if only one translation table is used. Enabling the option will extend the address scheme of the debugger by a 16 bit memory space identifier. You should activate the option first, and then load the symbols. SYStem.Option NoDualcoreModule Disable dualcore module support SYStem.Option NoDualcoreModule [ON OFF] Default: OFF if the CPU supports dual core modules. ON if the CPU does not support dual core modules. If Dual Core Module support is disabled in the CPU, this option must be enabled. It is required to use this option before attaching to the target, that is, before using the SYStem.Mode.Attach or SYStem.Mode.Up commands. Intel x86/x64 Debugger 40 CPU specific SYStem Settings

41 SYStem.Option NoHyperThread Disable HyperThreading support SYStem.Option NoHyperThread [ON OFF] Default: OFF if the CPU supports hyper threading. ON if the CPU does not support hyper threading If HyperThreading is disabled in the CPU, this option must be enabled. It is required to use this option before attaching to the target, that is, before using the SYStem.Mode.Attach or SYStem.Mode.Up commands. SYStem.Option NoReBoot Disable chipset reboot SYStem.Option NoReBoot [ON OFF] Default: ON. On some targets a watchdog timer in the chipset causes a cold reboot (full power cycle) if not disabled soon after reset. This is normally done in FW/BIOS. To avoid such a reboot after doing SYStem.Mode.Up in TRACE32, if this option is enabled, the debugger will write the relevant peripheral registers to disable the watchdog timer. If the target does not have such a watchdog timer, this option has no effect. SYStem.Option PassWord Unlock JTAG functionality SYStem.Option PassWord <password> [<level>] Default <level>: 0. Provides passwords to unlock JTAG functionality. This is a special-purpose option and only available for a few CPUs. A <password> is a 32 bit unsigned integer that can be associated with a level (0,1,2,...). Each level can have a different password for unlocking different levels of security on the chip. It is required to use this option before attaching to the target, that is, before using the SYStem.Mode.Attach or SYStem.Mode.Up commands. Intel x86/x64 Debugger 41 CPU specific SYStem Settings

42 SYStem.Option PreserveDRX Preserve DRx resources SYStem.Option PreserveDRX [ON OFF] Default: OFF. If enabled, prevents other software from touching debug resources, including flags, debug registers (DRx), pending debug exceptions. SYStem.Option PreserveLBR Preserve LBR resources SYStem.Option PreserveLBR [ON OFF] Default: OFF. If enabled, prevents other software from touching LBR resources. SYStem.Option ProbeModeNOSaveRestore In probe mode, no save/restore SYStem.Option ProbeModeNOSaveRestore [ON OFF] Default: OFF. When enabled, the debugger does not carry out the state save/restore flow when entering/existing Probe Mode. This option is only to be used for initial testing on slow emulation/simulation setups. Intel x86/x64 Debugger 42 CPU specific SYStem Settings

43 SYStem.Option BIGREALmode Enable Big Real mode handling SYStem.Option BIGREALmode [ON OFF] Default: OFF. NOTE: The command takes effect only if the processor is in real mode. ON OFF SYStem.Option BIGREALmode ON switches from the real mode to the Big Real mode. TRACE32 now works with 32-bit addresses (instead of 16 bit real-mode addresses). Opcodes are decoded as 16-bit real mode opcodes. The processor itself continues to be in real mode. If the processor is in real mode and SYStem.Option BIGREALmode is OFF, TRACE32 works only with real-mode addresses and 16-bit offsets. The Big Real mode makes use of the fact that the hardware address registers in the core and the MMU of x386 and newer CPUs can hold 32 bit addresses, even if the CPU is in real mode. If SYStem.Option.BIGREALmode is enabled and the processor is in real mode, TRACE32 uses 32-bit addresses and 16-bit real-mode opcodes. The current PC is reported with the Big Real mode access class QP: instead of the real mode access class RP: In Big Real mode, as in protected mode, the address extension (the first number in addresses like P:0x00A0:0x8000) specifies a descriptor and not a segment offset. This descriptor must be one of the 6 existing segment descriptors shown in the MMU.view window for CS, DS, ES, FS, GS or SS. Specifying a segment descriptor other than CS, DS, ES, FS, GS or SS will fail because in real mode there is no descriptor table walk. In Big Real mode, the TRACE32 debugger address translation will add the code segment base CSB (for program addresses) or data segment base DSB (for data addresses) to the address offset. In contrast, if SYStem.Option BIGREAL is disabled, CSB or DSB will be ignored during the debugger address translation and the segment offset will be multiplied by 16 and added to the address offset instead. See also: SYStem.Option SMMBIGREALmode Intel x86/x64 Debugger 43 CPU specific SYStem Settings

44 SYStem.Option ReArmBreakPoints Rearm breakpoints on reset SYStem.Option ReArmBreakPoints [ON OFF] Default: OFF. When enabled, if a (warm) reset happens, the debugger attempts to stop at the reset vector, rearm onchip breakpoints and set the CPU running again. SYStem.Option ResetDELAY Set reset delay SYStem.Option ResetDELAY <ms> Default: 500 ms. Sets the reset delay during which the debugger attempts to stop the CPU cores at the reset vector. Increasing the break delay might help stop the CPU cores at the reset vector for certain platforms. SYStem.Option SecondTAP Move TAP to secondary JTAG chain SYStem.Option SecondTAP <tap> Moves a TAP to the secondary JTAG chain. The <tap> must have been added with SYStem.Option.AddTAP <tap> before. This is a special-purpose option and only available for a few CPUs. The available <tap> names are also CPU specific. It is required to use this option before attaching to the target, that is, before using the SYStem.Mode.Attach or SYStem.Mode.Up commands. Intel x86/x64 Debugger 44 CPU specific SYStem Settings

45 SYStem.Option SMMBIGREALmode Big Real mode handling for SMM SYStem.Option SMMBIGREALmode [ON OFF] Default: ON. If SYStem.Option SMMBIGREALmode is set to ON and the target is in System Management Mode (SMM), TRACE32 will work with SMM big real mode addresses (SQ:, SQP:, SQD:) instead of real mode addresses. SMM allows to use up to 32-bit wide program or data addresses, although the core is in real mode. 16 bit real-mode opcodes are used. See also: SYStem.Option.BIGREALmode for further details. Intel x86/x64 Debugger 45 CPU specific SYStem Settings

46 SYStem.Option SOFTLONG Use 32-bit access to set SW breakpoint SYStem.Option SOFTLONG [ON OFF] Default: OFF. When enabled, this option forces the debugger to use only 32-bit memory access when patching code with the software breakpoint instruction. NOTE: MAP.BUS8 / BUS16 / BUS32 (used for restricting general memory access to the given width) does NOT influence the access width used for patching code with the software breakpoint instruction. So if MAP.BUS32 is used for a code memory range, this option must be enabled for SW breakpoints to work as well. SYStem.Option STandBYAttach In standby mode, only attach to target SYStem.Option STandBYAttach [ON OFF] Default: OFF. When enabled, this option changes the behavior of the Standby mode (see SYStem.Mode): The debugger does not attempt to stop at the reset vector, but instead just attaches to the running CPU. SYStem.Option STepINTEXC Step into exception handler SYStem.Option STepINTEXC [ON OFF] Default: OFF. When enabled, this option allows the debugger to step into interrupt and exception handlers. This is not supported older CPUs. Intel x86/x64 Debugger 46 CPU specific SYStem Settings

47 SYStem.POWER Control target power SYStem.POWER [ON OFF CYCLE] If supported by the target, this command turns the target power ON (if off), OFF (if on), or does a power CYCLE (if on). SYStem.StuffInstruction Submit instruction to CPU in probe mode SYStem.StuffInstruction <address> <mnemonic> This command can be used to submit an assembler instruction (<mnemonic>) to the CPU in Probe Mode. The <address> is a "dummy" address used only to decide the instruction size. This means that just either "o:0", "n:0" or "x:0" can be used as <address> to determine if 16, 32 or 64 bit instruction size, respectively. SYStem.StuffInstructionRead Submit instruction and read SYStem.StuffInstructionRead <address> <mnemonic> This command is like SYStem.StuffInstruction but where PDRL and PDRH are read after issuing the instruction. The PDR values can be retrieved afterwards using the functions SYStem.ReadPDRL() and SYStem.ReadPDRH(). Intel x86/x64 Debugger 47 CPU specific SYStem Settings

48 Command Groups for Special Registers The command groups for special registers are documented in the general_ref_<x>.pdf manuals. For more information, click the blue hyperlinks. AVX AVX512 MMX SSE Command group for the AVX registers (Advanced Vector Extension) Command group for the AVX512 registers (Advanced Vector Extension) Command group for the MMX registers (MultiMedia extension) Command group for the SSE registers (Streaming SIMD Extension) Intel x86/x64 Debugger 48 Command Groups for Special Registers

49 CPU specific MMU Commands MMU Display all segment and descriptor registers MMU Displays all segment and descriptor registers, including the hidden (shadow) parts. MMU.DUMP Page wise display of MMU translation table MMU.DUMP <table> [<range> <addr> <range> <root> <addr> <root>] MMU.<table>.dump (deprecated) <table>: PageTable KernelPageTable TaskPageTable <task> and CPU specific tables Displays the contents of the CPU specific MMU translation table. If called without parameters, the complete table will be displayed. If the command is called with either an address range or an explicit address, table entries will only be displayed, if their logical address matches with the given parameter. The optional <root> argument can be used to specify a page table base address deviating from the default page table base address. This allows to display a page table located anywhere in memory. PageTable Display the current MMU translation table entries of the CPU. This command reads all tables the CPU currently used for MMU translation and displays the table entries. Intel x86/x64 Debugger 49 CPU specific MMU Commands

50 KernelPageTable TaskPageTable Display the MMU translation table of the kernel. If specified with the MMU.FORMAT command, this command reads the MMU translation table of the kernel and displays its table entries. Display the MMU translation table entries of the given process. In MMU based operating systems, each process uses its own MMU translation table. This command reads the table of the specified process, and displays its table entries. See also the appropriate OS awareness manuals: RTOS Debugger for <x>. CPU specific tables: GDT IDT LDT Displays the contents of the Global Descriptor Table. Displays the contents of the Interrupt Descriptor Table. Displays the contents of the Local Descriptor Table. MMU.FORMAT Set MMU format MMU.FORMAT STD P32 PAE PAE64 LINUX64 Default: STD. Informs the debugger of the MMU format currently used by the CPU: STD P32 PAE PAE64 Automatically chooses the MMU paging format based on the current CPU state. Use the standard 32 bit Protected Mode MMU paging format. Use the PAE MMU paging format. Use the 64 bit PAE MMU paging format. LINUX64 Use the Linux specific 64 bit MMU paging format. This page table format covers only the address ranges 0x0--0x00007FFFFFFFFFF and 0xFFFF xFFFFFFFFFFFFFFFF Intel x86/x64 Debugger 50 CPU specific MMU Commands

51 MMU.GDT Display GDT descriptor table MMU.GDT (deprecated) Use MMU.DUMP GDT instead. Displays the contents of the Global Descriptor Table. MMU.IDT Display IDT descriptor table MMU.IDT (deprecated) Use MMU.DUMP IDT instead. Displays the contents of the Interrupt Descriptor Table. MMU.LDT Display LDT descriptor table MMU.LDT (deprecated) Use MMU.DUMP LDT instead. Displays the contents of the Local Descriptor Table. MMU.List Compact display of MMU translation table MMU.List <table> [<range> <address>] MMU.<table>.List (deprecated) <table>: PageTable KernelPageTable TaskPageTable <task> Lists the address translation of the CPU specific MMU table. If called without address or range parameters, the complete table will be displayed. Intel x86/x64 Debugger 51 CPU specific MMU Commands

52 If called without a table specifier, this command shows the debugger internal translation table. See TRANSlation.List. If the command is called with either an address range or an explicit address, table entries will only be displayed, if their logical address matches with the given parameter. PageTable KernelPageTable TaskPageTable List the current MMU translation of the CPU. This command reads all tables the CPU currently used for MMU translation and lists the address translation. List the MMU translation table of the kernel. If specified with the MMU.FORMAT command, this command reads the MMU translation table of the kernel and lists its address translation. List the MMU translation of the given process. In MMU based operating systems, each process uses its own MMU translation table. This command reads the table of the specified process, and lists its address translation. See also the appropriate OS awareness manuals: RTOS Debugger for <x>. MMU.SCAN Load MMU table from CPU MMU.SCAN <table> [<range> <address>] MMU.<table>.SCAN (deprecated) <table>: PageTable KernelPageTable TaskPageTable <task> ALL and CPU specific tables Loads the CPU specific MMU translation table from the CPU to the debugger internal translation table. If called without parameters the complete page table will be loaded. The loaded address translation can be viewed with TRANSlation.List. If the command is called with either an address range or an explicit address, page table entries will only be loaded if their logical address matches with the given parameter. Intel x86/x64 Debugger 52 CPU specific MMU Commands

53 PageTable KernelPageTable TaskPageTable ALL Load the current MMU address translation of the CPU. This command reads all tables the CPU currently used for MMU translation, and copies the address translation into the debugger internal translation table. Load the MMU translation table of the kernel. If specified with the MMU.FORMAT command, this command reads the table of the kernel and copies its address translation into the debugger internal translation table. Load the MMU address translation of the given process. In MMU based operating systems, each process uses its own MMU translation table. This command reads the table of the specified process, and copies its address translation into the debugger internal translation table. See also the appropriate OS awareness manuals: RTOS Debugger for <x>. Load all known MMU address translations. This command reads the OS kernel MMU table and the MMU tables of all processes and copies the complete address translation into the debugger internal translation table. See also the appropriate OS awareness manuals: RTOS Debugger for <x>. CPU specific tables: GDT GDTLDT LDT Loads the Global Descriptor Table from the CPU to the debugger internal translation table. Loads the Global and Local Descriptor Table from the CPU to the debugger internal translation table. Loads the Local Descriptor Table from the CPU to the debugger internal translation table. MMU.Set Set MMU register MMU.Set <reg> <value> Assigns <value> to MMU register <reg>. Intel x86/x64 Debugger 53 CPU specific MMU Commands

54 Onchip Triggers TrOnchip.CONVert Adjust range breakpoint in onchip registers TrOnchip.CONVert [ON OFF] Default: ON. ON OFF Onchip breakpoints can only be set to 1, 2, 4 or 8 bytes. Breakpoints specified for a different range size are extended to the next possible number of bytes to fit the breakpoint resources. Breakpoints specified for a range size other than 1, 2, 4 or 8 bytes are rejected with an error message. TrOnchip.RESet Reset settings to defaults TrOnchip.RESet Resets the TrOnchip settings to their default values. Intel x86/x64 Debugger 54 Onchip Triggers

55 TrOnchip.Set Break on event NOTE: TRACE32 cannot activate the selected settings while the program execution is running. TrOnchip.Set BootStall Enter bootstall TrOnchip.Set BootStall [ON OFF] Default: OFF. If enabled, this trigger changes the default behavior of the Standby mode (see SYStem.Mode) as follows: When power returns, the debugger enters SoC/PCH bootstall, if this is supported by the SoC/PCH. SYStem.Mode StandBy TrOnchip.Set BootStall ON ; Prepare TRACE32 to enter bootstall ; mode on the next power on ; un-power SoC/PCH ; power SoC/PCH Intel x86/x64 Debugger 55 Onchip Triggers

56 TRACE32 indicates bootstall as follows: bootstall is displayed in the Debug field of the TRACE32 state line. The current mode of the debugger is Prepare (StandBy). After your finished your bootstall operations, you can switch to normal debugging by one of the following commands: SYStem.Up, SYStem.Attach or SYStem.Mode Go. TrOnchip.Set ColdRESet Break on cold reset TrOnchip.Set ColdRESet [ON OFF] Default: OFF. Intel x86/x64 Debugger 56 Onchip Triggers

57 If enabled, this trigger changes the default behavior of the Standby mode (see SYStem.Mode) as follows: The core(s) are stopped at the reset vector after a cold reset, if this is supported by the SoC/PCH. SYStem.Mode StandBy TrOnchip.Set ColdRESet ON ; Prepare TRACE32 to stop the core(s) ; at the reset vector on a cold reset ; (power on) TrOnchip.Set CpuBootStall Enter CPU bootstall TrOnchip.Set CpuBootStall [ON OFF] Default: OFF. If enabled, this trigger changes the default behavior of the Standby mode (see SYStem.Mode) as follows: When power returns, the debugger enters SoC/PCH CPU bootstall, if this is supported by the SoC/PCH. An example on how to use this feature is given at the description of the command TrOnchip.Set BootStall. TrOnchip.Set GeneralDetect Break on general detect TrOnchip.Set GeneralDetect [ON OFF] Default: OFF. If enabled, the program execution is stopped when a General Detect exception happens. TrOnchip.Set INIT Break on init TrOnchip.Set INIT [ON OFF] Default: OFF. If enabled, the program execution is stopped when a processor INIT happens. Intel x86/x64 Debugger 57 Onchip Triggers

58 TrOnchip.Set MachineCheck Break on machine check TrOnchip.Set MachineCheck [ON OFF] Default: OFF. If enabled, the program execution is stopped when a Machine Check exception happens. TrOnchip.Set RESet Break on CPU reset TrOnchip.Set RESet [ON OFF] Default: OFF. If enabled, the program execution is stopped at the reset vector when a processor RESET happens. TrOnchip.Set ShutDown Break on shutdown TrOnchip.Set ShutDown [ON OFF] Default: OFF. If enabled, the program execution is stopped when a Shutdown occurs. TrOnchip.Set SMMENtry Break on SMM entry TrOnchip.Set SMMENtry [ON OFF] Default: OFF. If enabled, the program execution is stopped each time SMM is entered. Intel x86/x64 Debugger 58 Onchip Triggers

59 TrOnchip.Set SMMEXit Break on SMM exit TrOnchip.Set SMMEXit [ON OFF] Default: OFF. If enabled, the program execution is stopped each time SMM is exited. TrOnchip.Set SMMINto Step into SMM when single stepping TrOnchip.Set SMMINto [ON OFF] Default: OFF. If enabled, if during an assembler single step an SMM interrupt happens, the debugger steps into the SMM handler. If disabled, the debugger steps over the SMM handler. TrOnchip.Set VMENtry Break on VM entry TrOnchip.Set VMENtry [ON OFF] Default: OFF. If enabled, the program execution is stopped each time a virtual machine VM entry happens. Intel x86/x64 Debugger 59 Onchip Triggers

60 TrOnchip.Set VMEXit Break on VM exit TrOnchip.Set VMEXit [ON OFF All None <value> <controlbits>] <value>: <hexadecimal> <integer> <binary> <controlbits>: {<controlbit>} <controlbit>: SWINT_EXCEPTION_NMI EXTERNAL_INTERRUPT TRIPLE_FAULT INIT SIPI IO_SMI OTHER_SMI PND_VIRT_INTERRUPT PND_VIRT_NMI TASK_SWITCH CPUID GETSEC HLT INVD INVLPG RDPMC RDTSC RSM VMCALL VMCLEAR VMLAUNCH VMPTRLD VMPTRST VMREAD VMRESUME VMWRITE VMXOFF VMXON CR_ACCESS DR_ACCESS IOEXIT RDMSR WRMSR ENTRY_BADGUEST ENTRY_BADMSR EXITFAULT MWAIT MONITOR_TRAP_FLAG CORRUPTED_VMCS MONITOR PAUSE ENTRY_MCA CSTATE_SMI TPR_BELOW_THRESHOLD APIC_ACCESS LEVEL_TRIG_EOI GDTR_IDTR_ACCESS LDTR_TR_ACCESS EPT_VIOLATION EPT_MISCONFIG INVL_EPT RDTSCP VMXTIMER INVLD_VPID WBINVD Default: OFF with all control bits disabled. If enabled, the program execution is stopped each time a virtual machine VM exit event happens for the enabled control bits. Intel x86/x64 Debugger 60 Onchip Triggers

61 The TrOnchip control window is extended by the control bits: when VMEXit is set to ON. when controlbits are set via the command line. VMEXit check box: ON OFF The VM exit event is enabled and the program execution is stopped on a VM exit. If previously no control bit was enabled then all control bits are enabled. The VM exit event is disabled. The control bit remain unchanged. All/None button: All None The VM exit event is enabled and all control bits are enabled. The VM exit event is disabled and all control bits are disabled. Command line examples: ; Trigger VM exit event on signals TRIPLE_FAULT, VMWRITE and INIT TrOnchip.Set.VMEXit TRIPLE_FAULT VMWRITE INIT ; TrOnchip.Set.VMEXit 0x200000C ; TrOnchip.Set.VMEXit 0y ; Enable VM exit event on all control bit signals TrOnchip.Set.VMEXit All ;TrOnchip.Set.VMEXit 0x7FFFFFFFFFFFFF ; Disable VM exit event and clear all control bits TrOnchip.Set.VMEXit None Intel x86/x64 Debugger 61 Onchip Triggers

62 TrOnchip.state Display onchip trigger window TrOnchip.state Displays the TrOnchip control window. If enabled, the program execution is stopped at the specified event If enabled, the default behavior of the command SYStem.Mode StandBy is changed Intel x86/x64 Debugger 62 Onchip Triggers

63 CPU specific Events for the ON and GLOBALON Command TRACE32 can be programmed to detect CPU specific <events> and execute a user-defined <action> in response to the detected event. The user-defined action is a PRACTICE script (*.cmm). The following commands and CPU specific events are available: GLOBALON <event> [<action>] ON <event> [<action>] Global event-controlled PRACTICE script execution. The event is detectable during an entire TRACE32 session. Event-controlled PRACTICE script execution. The event is detectable only by a particular PRACTICE script. CPU specific Events BOOTSTALL CPUBOOTSTALL PBREAKRESET PBREAKVMENTRY PBREAKVMEXIT PBREAKSMMENTRY PBREAKSMMEXIT PBREAKGENERALDETECT PBREAKINIT PBREAKMACHINECHECK PBREAKSHUTDOWN Descriptions The target entered Bootstall The target entered CPU Bootstall The CPU stopped at the reset vector. The CPU stopped due to a VM Entry event. The CPU stopped due to a VM Exit event. The CPU stopped due to an SMM Entry event. The CPU stopped due to an SMM Exit event. The CPU stopped due to a General Detect event. The CPU stopped due to an Init event. The CPU stopped due to a Machine Check event. The CPU stopped due to a Shutdown event. Intel x86/x64 Debugger 63 CPU specific Events for the ON and GLOBA-

64 CPU specific BenchmarkCounter Commands The BMC (BenchMark Counter) commands provide control and usage of the x86 performance monitoring capabilities. The benchmark counters can only be read while the target application is halted. Currently only the pre-defined architectural performance events are supported. For information about architecture-independent BMC commands, refer to BMC (general_ref_b.pdf). For information about architecture-specific BMC commands, see command descriptions below. BMC.<counter> Select BMC event to count BMC.PMC0 <event> BMC.PMC1 <event> <event>: OFF UCC URC IR LLCR LLCM BIR BMR Currently only the two generic benchmark counters PMC0 and PMC1 are supported. Each of these two counters can count one of the seven pre-defined architectural performance events. Please see the chapter on Performance Monitoring in the Intel 64 and IA-32 Architectures Software Developer s Manual, Volume 3B for details. BMC.<counter>.COUNT Select count mode for BMC BMC.<counter>.COUNT <mode> <mode>: DUR EDGE Default: DUR. Selects the count mode for <counter>. In DURation mode, all cycles, where the selected event is enabled, are counted. In EDGE mode, only rising edges of the selected event are counted. Intel x86/x64 Debugger 64 CPU specific BenchmarkCounter Commands

65 CPU Specific Onchip Trace Commands Onchip.Buffer Configure onchip trace source Onchip.Buffer <item> <item>: LBR BTS IPT BASE <base> SIZE <size> TOPA [ON OFF] Provides control of the architectural x86 execution trace capabilities: LBR (Last Branch Records) BTS (Branch Trace Store) IPT (Intel Processor Trace) LBR BTS IPT BASE <base> SIZE <size> Chooses LBR as the trace source. LBR uses onchip registers to store the last 4, 8, or 16 (CPU dependent) taken branches/interrupts for each HW thread/core. The LBR feature is always available. Chooses BTS as the trace source. BTS stores BTMs (Branch Trace Messages) in a user-defined area in target RAM for all HW threads/cores. BTS/BTM is not always available. As a rule of thumb, BTS is normally available on icore CPUs, whereas it is not functional on Atom CPUs. Chooses IPT as the trace source. Sets the base of the trace buffer to the linear address <base>. Sets the size of the trace buffer to <size> bytes. Note that the buffer must be big enough to hold BTMs for all HW threads/cores. TOPA Enables/Disables Table Of Physical Addresses: OFF: Trace data will be written to default memory location or address defined by Onchip.Buffer.Base. ON: Onchip.Buffer.Base points to a structure which defines the memory output area. Please consult Intel Processor Trace documentation for more information. Only applicable if Onchip.Buffer.IPT is selected! Intel x86/x64 Debugger 65 CPU Specific Onchip Trace Commands

66 NOTE: BTMs may not be observable on Intel Atom processor family processors that do not provide an externally visible system bus. NOTE: BTMs visibility is implementation specific and limited to systems with a front side bus (FSB). BTMs may not be visible to newer system link interfaces or a system bus that deviates from a traditional FSB. Please see the chapter on Debugging, Profiling Branches and Timstamp Counter in the public Intel 64 and IA-32 Architectures Software Developer s Manual, Volume 3 for more details on LBR, BTM and BTS. Intel x86/x64 Debugger 66 CPU Specific Onchip Trace Commands

67 CPU Specific Functions SYStem.CoreStates.APIC(<core>) SYStem.CoreStates.HYPER(<core>) SYStem.CoreStates.MODE(<core>) SYStem.CoreStates.PHYS(<core>) SYStem.CoreStates.PRIOR(<core>) SYStem.CoreStates.SMM(<core>) SYStem.CoreStates.VMX(<core>) SYStem.Option.MEMoryMODEL() SYStem.ReadPDRH() SYStem.ReadPDRL() VMX() VMX.Guest() Returns the APIC ID given the virtual core index <core>. This corresponds to the APIC column in the SYStem.CORESTATES window. Returns the hyper thread index given the virtual core index <core>. This corresponds to the Hyper. column in the SYStem.CORESTATES window. Returns the core mode as a string given the virtual core index <core>. This corresponds to the Mode column in the SYStem.CORESTATES window. Returns the physical core index given the virtual core index <core>. This corresponds to the Phys. column in the SYStem.CORESTATES window. Returns the prior state as a string given the virtual core index <core>. This corresponds to the Prior State column in the SYStem.CORESTATES window. Returns the SMM state as a string given the virtual core index <core>. This corresponds to the SMM column in the SYStem.CORESTATES window. Returns the VMX mode as a string given the virtual core index <core>. This corresponds to the VMX column in the SYStem.CORESTATES window. Returns the name of the currently enabled memory model as a string. Returns the PDRH value previously read with the command SYStem.StuffInstructionRead. Returns the PDRL value previously read with the command SYStem.StuffInstructionRead. Returns TRUE if in VMX mode, FALSE otherwise. [build DVD 02/2013] Returns TRUE if in VMX guest mode, FALSE otherwise. This function is only applicable if VMX() returns TRUE. [build DVD 02/2013] Intel x86/x64 Debugger 67 CPU Specific Functions

68 Connectors JTAG Connector This JTAG connector is a 60-pin XDP connector. Signal Pin Pin Signal GND 1 2 GND PREQ- 3 4 N/C PRDY- 5 6 N/C GND 7 8 GND N/C 9 10 N/C N/C N/C GND GND N/C N/C N/C N/C GND GND N/C N/C N/C N/C GND GND N/C N/C N/C N/C GND GND N/C N/C N/C N/C GND GND PWRGOOD N/C N/C N/C VTREF N/C N/C RESET- N/C DBR- GND GND N/C TDO N/C TRST- N/C TDI TCK TMS GND GND Intel x86/x64 Debugger 68 Connectors

69 MIPI34 Connector Signal Pin Pin Signal VTREF DEBUG 1 2 TMS GND 3 4 TCK GND 5 6 TDO N/C (KEY) - 8 TDI GND 9 10 N/C GND N/C GND N/C GND TRST- GND PREQ- GND PRDY- GND PTI 0 CLK GND PTI 0 DATA[0] GND PTI 0 DATA[1] GND PTI 0 DATA[2] GND PTI 0 DATA[3] GND N/C GND VTREF TRACE Intel x86/x64 Debugger 69 Connectors

70 MIPI60-C Connector MIPI60 target pinout specified by Intel. Signal Pin Pin Signal VREF_DEBUG 1 2 TMS TCK0 3 4 TDO TDI 5 6 No Connect HOOK[6]=Reset In kohm to GND TRST_N 9 10 PREQ_N PRDY_N VTREF_TRACE PTI_0_CLK PTI_1_CLK POD_PRESENT1_N GND POD_PRESENT2_N PTI_1_DATA[0] PTI_0_DATA[0] PTI_1_DATA[1] PTI_0_DATA[1] PTI_1_DATA[2] PTI_0_DATA[2] PTI_1_DATA[3] PTI_0_DATA[3] PTI_1_DATA[4]/PTI_2_DATA[0] PTI_0_DATA[4] PTI_1_DATA[5]/PTI_2_DATA[1] PTI_0_DATA[5] PTI_1_DATA[6]/PTI_2_DATA[2] PTI_0_DATA[6] PTI_1_DATA[7]/PTI_2_DATA[3] PTI_0_DATA[7] HOOK[7]=Reset Out PTI_0_DATA[8]/PTI_3_DATA[0] HOOK[3]=Boot Stall PTI_0_DATA[9]/PTI_3_DATA[1] HOOK[2]=CPU Boot Stall PTI_0_DATA[10]/ HOOK[1]=Power Button PTI_3_DATA[2] PTI_0_DATA[11]/ HOOK[0]=PWRGOOD PTI_3_DATA[3] PTI_0_DATA[12]/ HOOK[5] PTI_3_DATA[4] PTI_0_DATA[13]/ HOOK[4] PTI_3_DATA[5] PTI_0_DATA[14]/ I2C_SCL PTI_3_DATA[6] PTI_0_DATA[15]/ I2C_SDA PTI_3_DATA[7] TCK GND TRIG_INOUT DBG_UART_TX TRIG_IN DBG_UART_RX GND GND PTI_3_CLK PTI_2_CLK Intel x86/x64 Debugger 70 Connectors

71 Not all pins of the Intel MIPI60 connector are connected to the CombiProbe Intel x86/x64 MIPI60-C. The connected pins are displayed with their name on a gray background in the picture below. Signal Pin Pin Signal VREF_DEBUG 1 2 TMS TCK0 3 4 TDO TDI 5 6 Open Drain Reset Out Reset In 7 8 No Connect TRST_N 9 10 PREQ_N PRDY_N VREF_TRACE PTI_0_CLK PTI_1_CLK GND GND No Connect PTI_1_DATA[0] PTI_0_DATA[0] PTI_1_DATA[1] PTI_0_DATA[1] PTI_1_DATA[2] PTI_0_DATA[2] PTI_1_DATA[3] PTI_0_DATA[3] No Connect PTI_0_DATA[4] No Connect PTI_0_DATA[5] No Connect PTI_0_DATA[6] No Connect PTI_0_DATA[7] Reset Out No Connect Boot Stall No Connect CPU Boot Stall No Connect Power Button No Connect PWRGOOD No Connect No Connect No Connect No Connect No Connect I2C_SCL No Connect I2C_SDA No Connect No Connect No Connect DBG_UART_TX No Connect DBG_UART_RX GND GND No Connect No Connect Intel x86/x64 Debugger 71 Connectors

72 MIPI60-Cv2 Connector Under construction. Intel x86/x64 Debugger 72 Connectors

73 MIPI60-Q Connector Converged MIPI60 target pinout specified by Intel. Signal Pin Pin Signal VREF_DEBUG 1 2 TMS TCK0 3 4 TDO TDI 5 6 HOOK[7]=Reset Out HOOK[6]=PMODE/Reset In kohm to GND TRST_N 9 10 PREQ_N PRDY_N VTREF_TRACE PTI_0_CLK PTI_1_CLK POD_PRESENT1_N GND POD_PRESENT2_N PTI_1_DATA[0] PTI_0_DATA[0] PTI_1_DATA[1] PTI_0_DATA[1] PTI_1_DATA[2] PTI_0_DATA[2] PTI_1_DATA[3] PTI_0_DATA[3] PTI_1_DATA[4]/PTI_2_DATA[0] PTI_0_DATA[4] PTI_1_DATA[5]/PTI_2_DATA[1] PTI_0_DATA[5] PTI_1_DATA[6]/PTI_2_DATA[2] PTI_0_DATA[6] PTI_1_DATA[7]/PTI_2_DATA[3] PTI_0_DATA[7] No Connect PTI_0_DATA[8]/PTI_3_DATA[0] HOOK[3]=Boot Stall PTI_0_DATA[9]/PTI_3_DATA[1] HOOK[2]=CPU Boot Stall PTI_0_DATA[10]/ HOOK[1]=Power Button PTI_3_DATA[2] PTI_0_DATA[11]/ HOOK[0]=PWRGOOD PTI_3_DATA[3] PTI_0_DATA[12]/ No Connect PTI_3_DATA[4] PTI_0_DATA[13]/ No Connect PTI_3_DATA[5] PTI_0_DATA[14]/ I2C_SCL PTI_3_DATA[6] PTI_0_DATA[15]/ I2C_SDA PTI_3_DATA[7] TCK No Connect HOOK[9] DBG_UART_TX HOOK[8] DBG_UART_RX GND GND PTI_3_CLK PTI_2_CLK Intel x86/x64 Debugger 73 Connectors

74 Not all pins of the Converged Intel MIPI60 connector are connected to the Whisker MIPI60-Q for Quad- Probe x86/x64. The connected pins are displayed with their name on a gray background in the picture below. Signal Pin Pin Signal VREF_DEBUG 1 2 TMS TCK0 3 4 TDO TDI 5 6 Reset Out PMODE/Reset In 7 8 No Connect TRST_N 9 10 PREQ_N PRDY_N VREF_TRACE No Connect No Connect GND GND GND No Connect No Connect No Connect No Connect No Connect No Connect No Connect No Connect No Connect No Connect No Connect No Connect No Connect No Connect No Connect No Connect No Connect No Connect Boot Stall No Connect CPU Boot Stall No Connect Power Button No Connect PWRGOOD No Connect No Connect No Connect No Connect No Connect I2C_SCL No Connect I2C_SDA TCK reserved by TRACE32 HOOK[9] DBG_UART_TX HOOK[8] DBG_UART_RX GND GND No Connect No Connect Intel x86/x64 Debugger 74 Connectors

75 Support Available Tools CPU ICE FIRE ICD DEBUG ICD MONITOR ICD TRACE POWER INTEGRATOR INSTRUCTION SIMULATOR 230 YES YES 330 YES YES C27XX YES YES CE2600 YES YES CE4200 YES YES CE5300 YES YES COREI3 YES YES COREI3-2NDGEN YES YES COREI3-3RDGEN YES YES COREI3-4THGEN YES YES COREI5 YES YES COREI5-2NDGEN YES YES COREI5-3RDGEN YES YES COREI5-4THGEN YES YES COREI7 YES YES COREI7-2NDGEN YES YES COREI7-3RDGEN YES YES COREI7-4THGEN YES YES D2500 YES YES D2550 YES YES D2700 YES YES D410 YES YES D425 YES YES D510 YES YES D525 YES YES E382X YES YES E620 YES YES E620T YES YES E640 YES YES E640T YES YES E645C YES YES E645CT YES YES E660 YES YES E660T YES YES Intel x86/x64 Debugger 75 Support

76 CPU E665C YES YES E665CT YES YES E680 YES YES E680T YES YES N2600 YES YES N270 YES YES N280 YES YES N2800 YES YES N450 YES YES N455 YES YES N470 YES YES N475 YES YES N550 YES YES N570 YES YES QUARKX1000 YES YES Z2420 YES YES Z2460 YES YES Z2480 YES YES Z2520 YES YES Z2560 YES YES Z2580 YES YES Z2720 YES YES Z2760 YES YES Z2780 YES YES Z37XX YES YES Z500 YES YES Z510 YES YES Z510P YES YES Z510PT YES YES Z515 YES YES Z520 YES YES Z520PT YES YES Z530 YES YES Z530P YES YES Z540 YES YES Z550 YES YES Z560 YES YES ICE FIRE ICD DEBUG ICD MONITOR ICD TRACE POWER INTEGRATOR INSTRUCTION SIMULATOR Intel x86/x64 Debugger 76 Support

77 CPU Z600 YES YES Z615 YES YES Z625 YES YES Z650 YES YES Z670 YES YES ICE FIRE ICD DEBUG ICD MONITOR ICD TRACE POWER INTEGRATOR INSTRUCTION SIMULATOR Intel x86/x64 Debugger 77 Support

78 Compilers Language Compiler Company Option Comment C GNU-C Free Software DBX Foundation, Inc. C GNU-C Free Software ELF/DWARF2 Foundation, Inc. C GCC386 Greenhills Software Inc. COFF C IC386 Intel Corporation OMF-386 C IC286 Intel Corporation OMF-286 C MCC386 Mentor Graphics EOMF-386 Corporation C MSVC-1.5 Microsoft Corporation EOMF-386 Pharlap ETS C MSVC Microsoft Corporation EXE/CV C MSVC Microsoft Corporation OMF-386/CV SSI Link386 C MSVC/CSI Microsoft Corporation EOMF-386 C SCO-UNIX-CC SCO COFF C HC386 Synopsys, Inc OMF386/SPF C HIGHC Synopsys, Inc ELF/DWARF C++ BORLAND-C Borland Software EXE/BC5 Corporation C++ ORGANON CAD-UL OMF386++ ElectronicServices GmbH C++ GNU-C++ Free Software DBX Foundation, Inc. C++ MSVC Microsoft Corporation EXE/CV4 C++ HC386 Synopsys, Inc OMF/SPF C++ HIGH-C++ Synopsys, Inc ELF/DWARF Intel x86/x64 Debugger 78 Support

79 Operating Systems (32-bit) Name Company Comment ChorusOS Oracle Corporation Linux - Kernel Version 2.4 and 2.6, 3.x, 4.x Nucleus Mentor Graphics Corporation RTXC 3.2 Quadros Systems Inc. VxWorks Wind River Systems 5.x to 7.x Windows CE Microsoft Corporation 6.0 Windows Embedded Microsoft Corporation EC7, EC2013 Compact Windows Standard Microsoft Corporation XP, Vista, 7, 8, 10 Operating Systems (64-bit) Name Company Comment Linux - Kernel Version 2.4 and 2.6, 3.x, 4.x VxWorks Wind River Systems 5.x to 7.x Windows Standard Microsoft Corporation XP, Vista, 7, 8, 10 Intel x86/x64 Debugger 79 Support

80 3rd Party Tool Integrations CPU Tool Company Host ALL ADENEO Adeneo Embedded ALL X-TOOLS / X32 blue river software GmbH Windows ALL CODEWRIGHT Borland Software Windows Corporation ALL CODE CONFIDENCE Code Confidence Ltd Windows TOOLS ALL CODE CONFIDENCE Code Confidence Ltd Linux TOOLS ALL EASYCODE EASYCODE GmbH Windows ALL ECLIPSE Eclipse Foundation, Inc Windows ALL RHAPSODY IN MICROC IBM Corp. Windows ALL RHAPSODY IN C++ IBM Corp. Windows ALL CHRONVIEW Inchron GmbH Windows ALL LDRA TOOL SUITE LDRA Technology, Inc. Windows ALL UML DEBUGGER LieberLieber Software Windows GmbH ALL ATTOL TOOLS MicroMax Inc. Windows ALL VISUAL BASIC Microsoft Corporation Windows INTERFACE ALL LABVIEW NATIONAL Windows INSTRUMENTS Corporation ALL CODE::BLOCKS Open Source - ALL C++TEST Parasoft Windows ALL RAPITIME Rapita Systems Ltd. Windows ALL DA-C RistanCASE Windows ALL TRACEANALYZER Symtavision GmbH Windows ALL SIMULINK The MathWorks Inc. Windows ALL TA INSPECTOR Timing Architects GmbH Windows ALL UNDODB Undo Software Linux ALL VECTORCAST UNIT Vector Software Windows TESTING ALL VECTORCAST CODE Vector Software Windows COVERAGE ALL WINDOWS CE PLATF. BUILDER Windows Windows Intel x86/x64 Debugger 80 Support

81 Products Product Information OrderNo Code LA-3776 DEBUG-INTEL-X86 LA-3776A DEBUG-INTEL-X86-A LA-3825 CON-XDP60-HIR31 LA-3826 CON-XDP60-ZIF24 LA-3827 CON-XDP60-ZIF26 LA-3791 CON-MULTIPLE-XDP60 LA-3828 CON-XDP60-MIPI34 LA-3877 CON-XDP60-MIPI34-G Text JTAG Debugger for Intel x86/x64 (ICD) Supports Intel Atom cores, and Intel Core i3,i5,i7 (32-bit and 64-bit) Multicore debugging included includes software for Windows, Linux and MacOSX requires Power Debug Interface USB 2.0/USB 3.0, Power Debug Ethernet, PowerTrace, Power Debug II or Power Debug PRO debug cable with 60-pin XDP connector JTAG Debugger for Intel x86/x64 Add. Supports Intel Atom cores, Intel Core i3,i5,i7 and Core2 Duo (32-bit and 64-bit) Multicore debugging included please add the serial number of the base debug cable or CombiProbe to your order Only suitable for debug cables newer than 08/2008 Conv. Intel x86/x64 Debugger to Hirose31 Converter from 60 pin XDP (Samtec) connector on JTAG Debugger for Intel x86/x64 (LA-3776) to 31 pin XDP-SSA (Hirose) connector (not recommended because of poor signal quality) Conv. Intel x86/x64 Debugger to ZIF24 pin Converter from 60 pin XDP (Samtec) connector on JTAG Debugger for Intel x86/x64 (LA-3776) to 24 pin XDP-SFF (ZIF) connector (not recommended because of poor signal quality) Conv. Intel x86/x64 Debugger to ZIF26 pin Converter from 60 pin XDP (Samtec) connector on JTAG Debugger for Intel x86/x64 (LA-3776) to 26 pin XDP-SFF (ZIF) connector (not recommended because of poor signal quality) Conv. Intel x86/x64 Multiple Con. to XDP60 Converter from MIPI34 connector on CombiProbe for Intel x86/x64 + from XPD60 connector on JTAG probe for Intel x86/x64 + from Mictor for STP to 60 pin XDP (Samtec) connector Conv. Intel x86/x64 Debug. to Intel MIPI34 Converter from 60pin XDP (Samtec) connector on JTAG Debugger for Intel x86/x64 (LA-3776) to Intel MIPI34 connector Conv. Intel x86/x64 Debuger to MIPI34 Galil Converter from 60pin XDP (Samtec) connector on JTAG Debugger for Intel x86/x64 (LA-3776) to 34pin MIPI connector Galileo/Quark Intel x86/x64 Debugger 81 Products

82 OrderNo Code LA-3869 CONV-XDP60-MIPI60 LA-3824 CON-XDP60-TEST LA-3823 CON-XDP/MIPI34-TEST LA-3895 CONV-MINNOWB-MIPI60 LA-3970X TRACE-LIC-INTEL-PT Text Conv. XDP60 to MIPI60 (Intel) Converter from XDP 60 pin to MIPI 60 pin on target for ITP 60 pin to MIPI 60 pin (Intel) Conv. XDP60-3x20pol-XDP60 Testadapter from 60 pin XDP to 3 x 20pin 2,54mm post-header to 60 pin XDP for Intel x86/x64 (LA-3776) Conv. XDP60-1x20pol-MIPI34 Testadapter from 34pin MIPI to 1 x 20pin 2,54mm post-header to 60 pin XDP Intel x86/x64 (LA-3776) Debug Converter for MinnowBoard Converter to connect LA-3776 JTAG Debugger for Intel x86/x64 (Intel XDP60) or LA-4512/LA-4516 CombiProbe Intel x86/x64 MIPI60-C to the MinnowBoard MAX LA-3894 Trace Lic. for Intel Processor Trace Cable Allows to decode Intel Processor Trace recorded to SDRAM, TRACE32 CombiProbe or recorded by TRACE32 PowerTrace II+AutoFocus II preprocessor configuration that does not include LA-3907 please add the serial number of the base debug cable or CombiProbe to your order Intel x86/x64 Debugger 82 Products

83 Order Information Order No. Code Text LA-3776 DEBUG-INTEL-X86 JTAG Debugger for Intel x86/x64 (ICD) LA-3776A DEBUG-INTEL-X86-A JTAG Debugger for Intel x86/x64 Add. LA-3825 CON-XDP60-HIR31 Conv. Intel x86/x64 Debugger to Hirose31 LA-3826 CON-XDP60-ZIF24 Conv. Intel x86/x64 Debugger to ZIF24 pin LA-3827 CON-XDP60-ZIF26 Conv. Intel x86/x64 Debugger to ZIF26 pin LA-3791 CON-MULTIPLE-XDP60 Conv. Intel x86/x64 Multiple Con. to XDP60 LA-3828 CON-XDP60-MIPI34 Conv. Intel x86/x64 Debug. to Intel MIPI34 LA-3877 CON-XDP60-MIPI34-G Conv. Intel x86/x64 Debuger to MIPI34 Galil LA-3869 CONV-XDP60-MIPI60 Conv. XDP60 to MIPI60 (Intel) LA-3824 CON-XDP60-TEST Conv. XDP60-3x20pol-XDP60 LA-3823 CON-XDP/MIPI34-TEST Conv. XDP60-1x20pol-MIPI34 LA-3895 CONV-MINNOWB-MIPI60 Debug Converter for MinnowBoard LA-3970X TRACE-LIC-INTEL-PT Trace Lic. for Intel Processor Trace Cable Additional Options LA-1229 FLEXEXT-SAM-BTH-BSH Flex Ext. for SAMTEC 60 pin BTH-BSH series LA-3778A JTAG-APS-A JTAG Debugger License for APS Add. LA-3750A JTAG-ARC-A JTAG Debugger License for ARC Add. LA-7843A JTAG-CORTEX-A/R-A JTAG Debugger Lic. Cortex-A/-R (32-bit) Add. LA-7848A JTAG-M8051EW-A JTAG Debugger for M8051EW Add. LA-3844A JTAG-TEAKLITE-4-A JTAG Debugger for TeakLite-4 Add. (ICD) LA-3774A JTAG-TEAKLITE-III-A JTAG Debugger for TeakLite III Add. (ICD) LA-3760A JTAG-XTENSA-A JTAG Debugger License for Xtensa Add. Intel x86/x64 Debugger 83 Products