Debugger Mips

MIPS Debugger and Trace
TRACE32 Online Help

TRACE32 Directory
TRACE32 Index
TRACE32 Documents ......................................................................................................................
ICD In-Circuit Debugger ................................................................................................................
Processor Architecture Manuals ..............................................................................................
MIPS ..........................................................................................................................................
MIPS Debugger and Trace ...................................................................................................
Brief Overview of Documents for New Users .................................................................
WARNING ...........................................................................................................................
Quick Start of the EJTAG Debugger ................................................................................
Troubleshooting ................................................................................................................
SYStem.Up Errors
FAQ .....................................................................................................................................
CPU specific Implementations .........................................................................................
Breakpoints
Instruction Breakpoints (Software Breakpoints)
Instruction Breakpoints in ROM (On-chip Breakpoints)
Breakpoints on Read/Write Access to Data(On-chip Breakpoints)
Example for Standard Breakpoints
10
Trigger
11
Runtime Measurement
11
Register
11
Memory Classes
12
SPR Memory Overlay
13
MIPS specific SYStem Commands ..................................................................................

SYStem.CONFIG
Configure debugger according to target topology
15
Define JTAG frequency
25
SYStem.BdmClock
SYStem.CPU
SYStem.CpuAccess
Select the used CPU
26
Run-time memory access (intrusive)
27
Define JTAG clock
29
Tristate the JTAG port
30
SYStem.JtagClock
SYStem.LOCK
SYStem.MemAccess
SYStem.Mode
Run-time memory access
30
Establish the communication with the target
31
Use 32-bit addresses
32
SYStem.Option Address32
1989-2016 Lauterbach GmbH
15
SYStem.Option DCFREEZE
Freeze data cache
32
SYStem.Option DCREAD
Use DCACHE for data read
33
SYStem.Option DisMode
Define disassembler mode
34
Define endianess of target memory
35
Control target system reset
35
SYStem.Option Endianess
SYStem.Option EnReset
SYStem.Option EnTRST
Control TAP reset
35
SYStem.Option HoldReset
Set system reset hold time
36
SYStem.Option FlowTrace
Define operating mode of RISC TRACE
36
Freeze system timer in stop mode
36
SYStem.Option FREEZE
SYStem.Option ICFLUSH
Flush of instruction cache during step and go
37
Use ICACHE for program read
37
SYStem.Option IMASKASM
Disable interrupts while ASM single stepping
37
SYStem.Option IMASKHLL
Disable interrupts while HLL single stepping
38
SYStem.Option KEYCODE
Define key code to unsecure processor
38
Select break synchronization method
38
Enable multiple address spaces support
39
Base address for monitor download routine
40
SYStem.Option ICREAD
SYStem.Option MCBreaksynch
SYStem.Option MMUSPACES
SYStem.Option MonBase
SYStem.Option PROTECTION
Sends an unsecure sequence to the core
40
Halt the core after reset
40
Use onchip breakpoints for ASM stepping
41
Use software breakpoints for ASM stepping
41
SYStem.Option ResBreak
SYStem.Option STEPONCHIP
SYStem.Option STEPSOFT
SYStem.Option TURBO
Enable fast download
42
SYStem.Option UnProtect
Unprotect memory addresses
42
SYStem.Option WaitReset
Set system reset wait time
42
On-chip Breakpoints .........................................................................................................
43
TrOnchip.AddressMask
TrOnchip.ASID
TrOnchip.CONVert
TrOnchip.CORERESET
Define an address mask
43
Extend on-cip breakpoint/trace filter by ASID
43
Adjust range breakpoint in on-chip resource
44
Halt at reset vector after core reset
44
Set on-chip trigger to default state
44
TrOnchip.RESet
TrOnchip.StepVector
Halt on exception vector during step
45
TrOnchip.TCompress
Trace data compression
45
Use watchpoints
45
Adjust complex breakpoint in on-chip resource
45
Display on-chip trigger window
46
TrOnchip.UseWatch
TrOnchip.VarCONVert
TrOnchip.view
Trigger Commands ...........................................................................................................
47
Trigger.Set
External trigger input enable
47
Trigger.Out
External trigger output enable
47
CPU specific MMU Commands ........................................................................................
48
MMU.DUMP
Page wise display of MMU translation table
MMU.FORMAT
MMU.List
Define MMU table structure
49
Compact display of MMU translation table
52
48
MMU.SCAN
Load MMU table from CPU
53
MMU.Set
Set MMU registers
54
MMU.TLB.Set
Set MMU registers
54
MMU.TLBSET
Set MMU registers
54
TCB .....................................................................................................................................
55
TCB Control
55
Configuring your FPGA ....................................................................................................

Using JTAG for FPGA configuration
57
57
JTAG.LOADBIT
Configure FPGA with BIT file
57
EJTAG Connector .............................................................................................................
58
Mechanical Description of the 14-pin EJTAG Connector
58
Electrical Description of the 14-pin EJTAG Connector
59
60
61
Recommended JTAG Circuit on Target
62
Technical Data Debugger .................................................................................................
63
Operation Voltage
63
Mechanical Dimensions
63
Trace ...................................................................................................................................
65
Technical Data Trace ........................................................................................................
66
Operation Voltage
66
Operation Frequency
66
68
Support ...............................................................................................................................
70
Available Tools
70
Compilers
75
Realtime Operation Systems
75
3rd Party Tool Integrations
76
Products .............................................................................................................................
77
Product Information
77
Order Information
79

Version 24-May-2016
Brief Overview of Documents for New Users

Architecture-independent information:
Debugger Basics - Training (training_debugger.pdf): Get familiar with the basic features of a
TRACE32 debugger.
T32Start (app_t32start.pdf): T32Start assists you in starting TRACE32 PowerView instances

for different configurations of the debugger. T32Start is only available for Windows.
General Commands (general_ref_<x>.pdf): Alphabetic list of debug commands.
Architecture-specific information:
Processor Architecture Manuals: These manuals describe commands that are specific for the
processor architecture supported by your debug cable. To access the manual for your processor
architecture, proceed as follows:
-
Choose Help menu > Processor Architecture Manual.
RTOS Debugger (rtos_<x>.pdf): TRACE32 PowerView can be extended for operating systemaware debugging. The appropriate RTOS manual informs you how to enable the OS-aware
debugging.
Brief Overview of Documents for New Users
WARNING
NOTE:
To prevent debugger and target from damage it is recommended to connect or

disconnect the debug cable only while the target power is OFF.
Recommendation for the software start:
1.
Disconnect the debug cable from the target while the target power is
off.
2.
Connect the host system, the TRACE32 hardware and the debug
cable.
3.
Power ON the TRACE32 hardware.
4.
Start the TRACE32 software to load the debugger firmware.
5.
Connect the debug cable to the target.
6.
Switch the target power ON.
7.
Configure your debugger e.g. via a start-up script.
Power down:
1.
Switch off the target power.
2.
Disconnect the debug cable from the target.
3.
Close the TRACE32 software.
4.
Power OFF the TRACE32 hardware.
WARNING
Quick Start of the EJTAG Debugger

All default settings should be fine. Therefore the only required command should be SYStem.Up. This
command resets the processor, establish connection via EJTAG, and requests the processor to enter debug
mode. After this command is executed it is possible to access memory and registers.
A typical start sequence is shown below. This sequence can be written to an ASCII file (script file) and
executed with the command do <filename>.
Reset
; Only required if you do not start

; immediately after booting
WinCLEAR
; Clear all windows
MAP.BOnchip 0x100000++0xfffff
; Specify where ROM/Flash is; on-chip

; breakpoints will be automatically
used
; there
SYStem.Up
; Reset the target and enter debug mode
Data.LOAD.Ieee demo.abs
; Load the application program
PER.view
; Show clearly arranged peripherals

; in window *)
Data.List
; Open source code window *)
Register /SpotLight
; Open register window *)
Frame.view /Locals /Caller
; Open the stack frame with

; local variables *)
Var.Watch flags ast
; Open watch window for variables *)
Break.Set 0x1000 /Program
; Set software breakpoint to address

; 1000 (address 1000 outside of BOnchip
; range)
; Set on-chip breakpoint to address

; 101000 (address 101000 is within
; BOnchip range)
*) These commands open windows on the screen. The window position can be specified with the WinPOS
command.
Quick Start of the EJTAG Debugger
Troubleshooting
SYStem.Up Errors
The SYStem.Up command is the first command of a debug session where communication with the target is
required. If you receive error messages while executing this command this can have many reasons.
A first test, the JTAG Chain Diagnostics, determines if there is a basic electrical problem with the JTAG
interface. For this test, a area window has to be opened and the SYStem.Mode must be down. The
following command sequence starts the diagnostics:
diag 10000 1
diag 16001
In this example, no reasonable values for JTAG

chain properties could be detected. There seems to
be a general electrical problem with the JTAG port.
The diagnostics has detected some reasonable
values for the JTAG chain. There seems to be a
more advanced problem.
General electrical problems with the JTAG interface:
The target has no power.
The target is in reset.
The processor has no clock.
The EJTAG connection is not done properly (see EJTAG connector).
On the board can be switched between JTAG and EJTAG and JTAG is active. E.g. a jumper is
wrongly set or a resistor must be removed.
Selected JTAG frequency is too high.
The targets JTAG circuit is incompatible with LAUTERBACH JTAG adapter. See recommended
JTAG schematics for more information.
Advanced problems:
The wrong processor type is selected in the SYStem.CPU list.
The target is a multicore device. See SYStem.Config for more information.
The JTAG frequency is too high or no RTCK is available.
The target is in an unrecoverable state. Re-power the target and try again.
Troubleshooting
FAQ
No information available
FAQ
CPU specific Implementations
Breakpoints
Onchip instruction and data breakpoints and software breakpoints are supported.
NOTE:
For all MIPS cores with VPEs it is only possible to set onchip breakpoints on active
VPEs. Setting an onchip breakpoint during SMP debugging with inactive VPEs a
warning will be displayed. To guarantee that all TCs on all VPEs will halt at the
onchip breakpoint the user should set an instruction breakpoint after creation of all
TCs on all VPEs.
Instruction Breakpoints (Software Breakpoints)

The program code will be patched to force the processor entering debug mode when reaching this
instruction. Therefore unlimited number of software breakpoints are available. But there is the need to modify
the program memory (RAM).
It is not allowed to place a software breakpoint on an instruction in a delay slot of a branch or jump
instruction.
Instruction Breakpoints in ROM (On-chip Breakpoints)

With the command 'MAP.BOnchip <range>' it is possible to tell the debugger where you have ROM (FLASH,
EPROM) on the target. If a breakpoint is set into a location mapped as BOnchip on-chip breakpoints will be
used. Depending on the used processor type 0 to 15 on-chip breakpoints are available.
Breakpoints on Read/Write Access to Data(On-chip Breakpoints)

Breakpoints on data can be set with the options /Write or /Read of the Break.Set command. Depending on
the used processor type 0 to 15 data breakpoints are available.
Example for Standard Breakpoints

Assume you have a target with FLASH from 0 to fffff and RAM from 100000 to 11ffff. The command to
configure TRACE32 correctly for this configuration is:
Map.BOnchip 0x0--0xfffff
The following standard breakpoint combinations are possible.
1.
2.
3.
4.
5.
Instruction breakpoints in RAM and one breakpoint in ROM

; software breakpoint 1
Break.Set addr /Program
; software breakpoint 3 to x
; on-chip breakpoint
Instruction breakpoints in RAM and one data breakpoint

Break.Set addr /Program
; software breakpoint 3 to x
Break.Set 0x108000 /Write
; write data breakpoint
Two instruction breakpoints in ROM

; on-chip breakpoint 1
; on-chip breakpoint 2
Two data breakpoints

Break.Set 0x108000 /Write
; write data breakpoint
Break.Set 0x108010 /Read
; read data breakpoint
One breakpoint in ROM and one data breakpoint

; Hardware Breakpoint
Break.Set 0x108010 /Read
; Read Watchpoint
10
Trigger
A bidirectional trigger system allows the following two events:
trigger an external system (e.g. logic analyzer) if the MIPS breaks (Trigger.Out)
break emulation if an external trigger is asserted (Trigger.Set)
The location of the bidirectional trigger connector which is on the host interface (PODPC, PODPAR,
PODETH) is shown in the ICD Debugger Users Guide.
The trigger system has the following specific restriction:
If a terminal window is open the response time of the trigger system is undefined. It is
recommended not to use the trigger system and terminal window at the same time.
Runtime Measurement
The function RunTime allows run time measurement. The measurement is done by software control.
Therefore the result is not an exact value.
Register
In the register window the 32 general-purpose registers of the core are named R0 - R31. You can change
the default names to ZERO, AT, V0, V1, with the command SETUP.DIS ,,,,,,,,, SPECIAL
(9 commas to skip dont care parameters).
If implemented, GPR shadow register sets can be displayed with the command Register.view /REGSET.
Register.view /REGSET Current
;
;
;
;
shows the GPR registers R0-R31 of

the current context.
it is equivalent to the command
Register.view
Register.view /REGSET Previous
;
;
;
;
in case of a register set change

e.g caused by an exception, it
shows the register set of the
previous context.
Register.view /REGSET 15.
; shows GPR register set 15.
11
Memory Classes
The following MIPS specific memory classes are available.
Memory Class
Description
AP
Program Memory physically addressed
EAP
Run-time Program Memory (access also during running CPU), physically

addressed
EP
Run-time Program Memory (access also during running CPU), virtually

addressed
Program Memory virtually addressed
AD
Data Cache / Memory physically addressed.
Data Memory virtually addressed
EAD
Data Memory via DMA (access also during running CPU), physically
addressed
ED
Data Memory via DMA (access also during running CPU), virtually
addressed
CBU
CBUS Register (only for MDED)
CC0
Coprocessor 0 Control Register (only for Lexra cores)
CP0
Coprocessor 0 Register
CP1
Coprocessor 1 Register (if implemented)
CP2
CP3
DBG
Debug Memory Class (gives additional information)
Emulation Memory, Pseudo Dualport Access to Memory

(see SYStem.MemAccess and SYStem.CpuAccess)
ECBU
CBUS Register (only for MDED) (access also during running CPU)
VM
Virtual Memory (memory on the debug system)
IC
Virtually addressed Instruction Cache
AIC
Physically addressed Instruction Cache

12
DC
Virtually addressed Data Cache
ADC
Physically addressed Data Cache
NC
Uncached memory access.
ANC
Physically addressed Data Memory without Cache
To access a memory class write the class in front of the address.

Examples:
Data.dump CP0:0--3 displays the register 0 (Index), 1 (Random), 2 (EntryLo0), 3 (EntryLo1) of the System
Control Coprocessor (=CP0).
The register number can have values between 0 and 31. The value of select must be multiplied by 32 and
added to the register number. Data.dump CP0:0x30--0x30 displays the Config1 register (register number:
0x10; select: 0x01). Select is 0 for the registers mentioned above.
Virtual Memory could be helpful, if the memory of the target should not be used e.g. to load and examine a
program.
ICD-MIPS64: For the memory classes CPx and DBG are only 64-bit (QUAD) write accesses possible.
SPR Memory Overlay

In case Target Scratch Pad RAM is available and enabled all TRACE32 accesses for the defined SPR
address range are automatically redirected to the referring physical memory.
Power View does not support a SPR memory class which forces SPR memory access!
If SPR is implemented, the current SPR settings could be seen and changed within Cache Control
peripheral window. It could be found within MIPS drop down list in the tool bar.
13
Instruction SPR accesses are handled only for virtual addresses within KSEG0 and KSEG1 and for physical
addresses!
Following examples refer to the ISPR and DSPR settings in the CACHE window above and a 1:1 virtual to
physical address mapping for KUSEG.
Data.Set D:0x80008000 0x11
; Write 0x11 to the first address

; of the data SPR via KSEG0 access.
Data.Set P:0xA0008000 0x22
; Write 0x22 to the first address

; of the instruction SPR via KSEG1
; access.
Data.In AM:0x8000
; Read first address of instruction

; SPR via physical access.
Data.In M:0x8000
;
;
;
;
Data.In D:0x8000
; Read from first data SPR address.
Read from virtual SDRAM address

0x8000 via USEG access, because
ISPR accesses are only handled
for KSEG0 and KSEG1.
14
MIPS specific SYStem Commands
SYStem.CONFIG
Configure debugger according to target topology
Format:
SYStem.CONFIG <sub_cmd> <parameter> ... <parameter>

SYStem.MultiCore (deprecated)
<sub-cmd>:
CORE <core> <chip>

CORENUMBER <number>
BCN <number>
BCO DESCENDING | ASCENDING
CMT ON | OFF
IRPRE <bits> ... <bits>
IRPOST <bits> ... <bits>
DRPRE <bits> ... <bits>
DRPOST <bits> ... <bits>
TAPState <state>
TCKLevel 0 | 1
TriState ON | OFF
Slave ON | OFF
CHIPIRPRE <bits>
CHIPIRPOST<bits>
CHIPDRPRE <bits>
CHIPDRPOST <bits>
BYPASS <pattern>
DMAIRPRE <bits> ... <bits>
DMAIRPOST <bits> ... <bits>
DMADRPRE <bits> ... <bits>
DMADRPOST <bits> ... <bits>
state
GBA <address>
The four parameter IRPRE, IRPOST, DRPRE, DRPOST are required to inform the debugger about the
MIPS TAP controller position in the JTAG chain, if there is more than one core in the JTAG chain (e.g. MIPS
+ DSP). The information is required before the debugger can be activated e.g. by a SYStem.Up.
Debugging an SMP system, there are more than one core for which the Jtag chain must be defined within
one Power View instance. So the pre- and post bits will be defined for all cores within one command e.g. an
SMP system with 3 cores must be configured as follows:
15
SYStem.CONFIG IRPRE 0. 5. 10. means core 0 has 0, core 1 has 5 and core 2 has 10 IRPRE bits.
SYStem.CONFIG IRPOST 10. 5. 0. means core 0 has 10, core 1 has 5 and core 2 has 0 IRPRE bits.
SYStem.CONFIGDRPRE 0. 1. 2. means core 0 has 0, core 1 has 1 and core 2 has 2 IRPRE bits.
SYStem.CONFIGDROST 2. 1. 0. means core 0 has 2, core 1 has 1 and core 2 has 0 IRPRE bits
If the cpu is defined in the cpu selection list, the coniguration of the pre- and post-coordinates is predefined
in the TRACE32 software, so theres nothing to be done by the user.
Some chip vendors implement an extra Chip TAP for controlling, among other things, the JTAG chain
establishing. The position of the Chip TAP is determined by CHIPIRPRE, CHIPIRPOST, CHIPDRPRE and
CHIPDRPOST. The Chip TAP position must be defined for the fully established JTAG chain which is not
necessarily the case after reset!
To keep the JTAG chain with all TAPS alive a special bypass command has to be shifted in the IR register of
the chip TAP with each JTAG transaction. This bypass command is defined with the BYPASS parameter.
The position of an optional EJTAG DMA TAP could be defined with the parameters DMAIRPRE,
DMAIRPOST, DMADRPRE and DMADRPOST.
TriState has to be used if more than one debugger are connected to the common JTAG port at the same
time. TAPState and TCKLevel define the TAP state and TCK level which is selected when the debugger
switches to tristate mode.
NOTE:
nTRST must have a pull-up resistor on the target, EDBGRQ must have a pull-down
resistor.
CORE
For multicore debugging one TRACE32 GUI has to be started per core. To
bundle several cores in one processor as required by the system this command
has to be used to define core and processor coordinates within the system
topology.
CoreNumber
Set number of cores per SMP system.
BaseCoreNumber
Set number of base cores. For cores, consisting of a cluster of base cores, the
base core number has to be set for correct hardware resource assignment
within the debug driver.
BaseCoreOrder
Set ordering rule for base cores. Ascending order means that base core 0 is
next to TDI, descending order means core 0 is next to TDO.
Ascending : TDI --> BaseCore 0 --> ... --> BaseCore n --> TDO
Descending : TDI --> BaseCore n --> ... --> BaseCore 0 --> TDO
Currently not used.
CoherenceManagerTap
Set if this core has an additional coherence manager tap. If necessary this
option is set implicitly by the CPU selection. So that command is only needed
for bringing up new MIPS cores and therefore is not mentioned in following
configuration examples!
16
IRPRE
(default: 0) <number> of instruction register bits in the JTAG chain between the
core of interest and the TDO signal of the debugger. This is the sum of the
instruction register length of all TAPs between the core of interest and the TDO
signal of the debugger.
IRPOST
(default: 0) <number> of instruction register bits in the JTAG chain between the
TDI signal and the core of interest. This is the sum of the instruction register
lengths of all TAPs between the TDI signal of the debugger and the core of
interest.
DRPRE
(default: 0) <number> of TAPs in the JTAG chain between the core of interest
and the TDO signal of the debugger. If each core in the system contributes only
one TAP to the JTAG chain, DRPRE is the number of cores between the core of
interest and the TDO signal of the debugger.
DRPOST
(default: 0) <number> of TAPs in the JTAG chain between the TDI signal of the
debugger and the core of interest. If each core in the system contributes only
one TAP to the JTAG chain, DRPOST is the number of cores between the TDI
signal of the debugger and the core of interest.
TAPState
This is the state of the TAP controller when the debugger switches to tristate
mode. All states of the JTAG TAP controller are selectable.(default: 7 = SelectDR-Scan)
TCKLevel
Level of TCK signal when all debuggers are tristated. (default: 0)
TriState
The debugger switches to tristate mode after each JTAG access. Then other
debuggers can access the port. This option is required if more than one
debugger hardware is used share the same JTAG port. (default: OFF)
Slave
Only one debugger (master) is allowed to control the signals nTRST and nRST.
If more than one debugger hardware is used to share the same JTAG port, all
except the master must have this option active. (default: OFF)
CHIPIRPRE
CHIPIRPOST
CHIPDRPRE
CHIPDRPOST
CHIPIRLENGTH
CHIPIRPATTERN
CHIPDRLENGTH
CHIPDRPATTERN
Definition of a TAP in a scan chain that needs a different IR and DR pattern than
the default BYPASS (1...1) pattern.
BYPASS
Special Chip TAP bypass pattern. (default: 0)
17
DMAIRPRE
DMAIRPOST
DMADRPRE
DMADRPOST
Definition of a DMA TAP in a scan chain.
state
Show state.
GcrBaseAddress
Set non default global control register base address. This command is only
available if the core has a coherence manager block. The default Gcr Base
Address is 0xBFBF8000.
Example for configuration of a chip with 3 cores
SYStem.CONFIG.CORE 1. 1.
Example for configuration of a Jtag daisy chain

TDI ---> ChipTAP ---> Mips1 ---> Mips2 ---> DMATAP ---> TDO
Instruction register length of
ChipTap: 3 bit
Mips1: 5 bit
Mips2: 5 bit
DMATap: 6 bit
Below the necessary commands for setup the Mips 1 Core could be seen.
SYStem.CONFIG.IRPRE
11.
IR Mips2 Core + DMA TAP
SYStem.CONFIG.IRPOST
3.
IR Chip TAP
SYStem.CONFIG.DRPRE
2.
DR Mips2 Core + DMA TAP
SYStem.CONFIG.DRPOST
1.
DR Chip TAP
SYStem.Up
18
Below the necessary commands for setup the Mips 2 Core in a second power view instance could be seen.
SYStem.CONFIG.IRPRE
6.
IR DMA TAP
8.
IR Chip TAP + Mips1 Core
SYStem.CONFIG.DRPRE
1.
DR DMA TAP
2.
DR Chip TAP + Mips1 Core
Assign Mips2 core to chip1 core2
SYStem.Up
Note:
While defining the Mips2 core in a second Power View instance (AMP System) it will get the core and chip
coordinates 1, 2. But if the target is one chip with two cores inside we have to reassign the coordinates of the
Mips2 core to core2 chip1 which is done by SYStem.CONFIG.Core 2. 1.
If the chip has an additional Chip Tap and the device is not yet supported by our debugger following settings
have to be done before SYStem.Up.
SYStem.CONFIG.CHIPIRPRE 16.
IR Mips1 Core + Mips2 Core

+ DMA TAP
SYStem.CONFIG.CHIPIRPOST 0.
SYStem.CONFIG.BYPASS 3.
Set special Chip TAP Bypass

pattern.
If a chip provides EJTAG DMA access on an extra TAP these TAP could be defined with following
commands.
SYStem.CONFIG.DMAIRPRE
0.
SYStem.CONFIG.DMAIRPOST 13.
SYStem.CONFIG.DMADRPRE
0.
SYStem.CONFIG.DMADRPOST
3.
IR Chip TAP + Mips1 Core

+ Mips2 Core
DR Chip TAP + Mips1 Core

+ Mips2 Core
SYStem.MEMACCESS DMA
Enable DMA Access in Debugger.
19
Configuration of Mips34K
Mips34k may be used as a single or a dual core. Each core/vpe has an own TAP. The Jtag scan chain for a
single MIPS34K core with two VPEs is
TDI ---> VPE0 ---> VPE1 ---> TDO
The Mips34k VPE0 and VPE1 TAP access is completely controlled within the T32 Mips debug driver.
Therefore a single core/vpe Mips34k is debugged as all other single core chips and no multi core settings
have to be set at all.
Depending on the number of opened PowerView instances and their Core-Chip assignment AMP
debugging is automatically determined and supported by the debugger.
Setup an SMP system
Start one TRACE32 instance
Select MIPS34K in CPU selection list
Set TAP coordinates to VPE0 of referring Mips34K core.
Set total number of implemented cores (threads)
Define number of cores (threads) which participate the SMP system.
See below the configuration for a Mips34K single SMP system.

SYStem.CPU MIPS34K
SYStem.CONFIG.IRPRE
SYStem.CONFIG.DRPRE
; select Mips34k core

0.
0.
0.
0.
; set TAP coordinates to VPE0 of

; Mips34K core (default values).
SYStem.CONFIG.CoreNumber 9.
; set total number of cores

(threads).
Core.Number 9.
: assign all available cores

(threads) to one SMP system
SYStem.Up
; bring up debugger
PowerView shows always the context of the current core. A manual switching between the TCs (Thread
Context) could be done with the CORE command or with help of the core drop down list.
20
Setup a Multi TAP system
The Mips34k may be used together with additional TAPs in the Jtag chain.
TDI ---> Chip TAP --> VPE0 ---> VPE1 ---> DMA Tap --> TDO
See below the configuration for a Mips34K system with additional Chip- (IR width=7 bit) and DMA TAP(IR
width=6 bit) in the Jtag chain.
SYStem.CPU MIPS34K
SYStem.CONFIG.IRPRE
SYStem.CONFIG.DRPRE

6.
7.
1.
1.
; set TAP coordinates to VPE0 of

; Mips34K core (default values).
SYStem.Up
; bring up debugger
Configuration of Mips1004K / 1004KMT / InterAptiv
The Mips1004k core is a cluster of up to 4 Mips 1004K base cores which are derived from the MIPS34K
core. Therefore the configuration is mainly the same and only the differences will be described here. The
Jtag scan chain for a MIPS1004K core with 4 base cores and two VPEs each is
Base Core 3 (BC3)
.....
Base Core 0 (BC0)
TDI ---> VPE0 ---> VPE1 ---> .....---> VPE0 ---> VPE1 ---> TDO
Since PRID Revision 0x2f the Mips 1004K core has additional multithreading capability an extra Coherence
Manager TAP and an opposite numbering of the Base Cores. In that Case CPU selection has to be
MIPS1004KMT instead. Below the Jtag Scan Chain for Mips1004KMT with same properties as above could
be seen.
Base Core 3 (BC0)
.....
Base Core 0 (BC3 ) Coherence Manager
TDI ---> VPE0 ---> VPE1 ---> .....---> VPE0 ---> VPE1 ---> CM ---> TDO
From debug configuration point of view the MIPSInterAptiv is equivalent to Mips1004KMT. So the following
description is also valid for this core.
21
Setup a single core system:
Select MIPS1004K /MIPS1004KMT in CPU selection list
Set number of Base cores.
Set total number of implemented cores
Set number of cores which participate the system to 1.

SYStem.CPU MIPS1004K / MIPS1004KMT
SYStem.CONFIG.IRPRE
SYStem.CONFIG.DRPRE
; set TAP base coordinates of

; Mips1004K core (default
; values).
0.
0.
0.
0.
SYStem.CONFIG.BCN 4.
; set number of Base Cores within

; MIPS 1004k core (default)
Core.Number 1.
; assign one core to system

; (default)
SYStem.Up
; bring up debugger
Setup an SMP system:
Select MIPS1004K / 1004KMT in CPU selection list
Set number of Base cores.
Set total number of implemented cores
Define number of cores which participate the SMP system.
22

SYStem.CPU MIPS1004K / MIPS1004KMT
SYStem.CONFIG.IRPRE 0.
SYStem.CONFIG.IRPOST 0.
SYStem.CONFIG.DRPRE 0.
SYStem.CONFIG.DRPOST 0.
; set TAP base coordinates of

; Mips1004K core (default
; values).
SYStem.CONFIG.BCN 4.
; set number of Base Cores within

; MIPS 1004k core (default)
Core.Number 8.
; assign all available cores to

; SMP system
SYStem.Up
; bring up debugger
Setup of an AMP system:

Start two or more PowerView instances.
Select cpu MIPS1004K / MIPS1004KMT in all PowerView instances.
Set TAP coordinates to referring Mips1004K core in all PowerView instances.
Assign all other cores to the first Mips1004K core.
Set number of Base Cores.
Bring up the power view instances.
See below command sequence to bring up MIPS1004K with 4 Base Cores and 2 VPEs each as AMP
system:
PV1 for BC0 VPE0
PV2 for BC0 VPE1
PV8 for BC3 VPE1
SYStem.CPU MIPS1004K
SYStem.CONFIG.Slave On
SYStem.MODE NODEBUG
...
...
...
23
SYStem.CONFIG.Slave On
SYStem.MODE NODEBUG
SYStem.Up
GO (start booting of
all VPEs within
Base Cores BC0 to
BC3)
SYStem.MODE ATTACH
...
...
...
SYStem.MODE ATTACH
24
TapStates
Exit2-DR
Exit1-DR
Shift-DR
Pause-DR
Select-IR-Scan
Update-DR
Capture-DR
Select-DR-Scan
Exit2-IR
Exit1-IR
10
Shift-IR
11
Pause-IR
12
Run-Test/Idle
13
Update-IR
14
Capture-IR
15
Test-Logic-Reset
SYStem.LOCK
Displays the Instruction TLB or Data TLB MMU entries.
SYStem.BdmClock
Define JTAG frequency
Obsolete command syntax. It has the same effect as SYStem.JtagClock. Use SYStem.JtagClock instead.
25
SYStem.CPU
Select the used CPU
Format:
SYStem.CPU <cpu>
<cpu>:
ICD-MIPS32:
MIPS4K, MIPS4KC, MIPS4KEC,
MIPSM14K, MIPSM14KC,
MIPS24K, MIPS24KE,
MIPS34K,
MIPS74K,
MIPS1004K,
ADM5120, ADM8686,
AU1000, AU1100, AU1200, AU1500, AU1550
BCM1101, BCM1103, BCM1113, BCM3349, BCM3380, BCM35230,
BCM3549, BCM3556, BCM4704, BCM471x, BCM4748, BCM5331x,
BCM5350, BCM5354, BCM5358, BCM5365, BCM56xxx, BCM5836,
C7108,
COACH12,
F731940,
FALCON,
HIDTV_PRO_QX,
IKF6833, IKF6834, IKF6836 IKF6850, IKF6860,
LX4X80, LX4189, LX5180, LX5280,
MDEB, MDED,
MP32,
MSP20xx,MSP71xx,
PIC32MX,
PNX8330, PNX8331, PNX8332, PNX8335, PNX8541, PNX8542, PNX8543,
PNX8932, PNX8935, PNX85500_MIPS4K, PNX85500_MIPS24K,
PSB21553, PSB21653,
RT3052, RT3662,
RC32334, RC32355,
VGCA, VGCB, VCTH, VCTV,
WP3
(For ICD-MIPS64, see next page.)
26
<cpu>:
ICD-MIPS64:
MIPS5K
BCM7038,
CN30XX, CN31XX, CN38XX, CN50XX, CN54XX, CN55XX, CN56XX,
CN57XX, CN58XX, CN63XX,
MSP8510,
PXB4261,
RM9000,
TX4938,
WIN1XX, WIN7XX
Selects the processor type.

Default selection:
MIPS4K if the JTAG Debugger for MIPS4K is used.
MIPS5K if the JTAG Debugger for MIPS5K is used.
SYStem.CpuAccess
Run-time memory access (intrusive)
Format:
SYStem.CpuAccess <mode>
<mode>:
Enable
Denied
Nonstop
Default: Denied
Enable
Allow intrusive run-time memory access.
Denied
Lock intrusive run-time memory access.
Nonstop
Lock all features of the debugger that affect the run-time behavior.
(Not implemented yet).
Default: Denied.
This option gets relevant if SYStem.MemAccess is set to denied and a run-time memory access is
requested. If CpuAccess is set to Enable, the access will be done by stopping the core, accessing the data
and restarting the core (Stop and Go method). Each stop takes 0.1 100 ms depending on the speed of
the JTAG port and the operations that should be performed. A red S in the state line of the TRACE32 screen
warns you, that the program is no longer running in real-time.
27
If CpuAccess is set to Denied, intrusive memory access is blocked. Nonstop behaves like Denied but
even commands which would halt the core (e.g. break) are not accepted anymore.
28
SYStem.JtagClock
Define JTAG clock
Format:
SYStem.JtagClock [<frequency | RTCK>]

SYStem.BdmClock (deprecated)
<frequency>
5 kHz 25 MHz.
Default frequency: 2 MHz.

Selects the EJTAG port frequency (TCK). This influences e.g. the download speed and scrolling speed in
dump windows.
It could be required to reduce the EJTAG frequency if there are buffers, additional loads or high capacities on
the EJTAG lines or if the target voltage (VIO) is very low. A very high frequency will not work on all systems
and will result in an erroneous data transfer. Therefore we recommend to use the default setting if possible.
<frequency>:
The debugger can not select all frequencies accurately. It chooses the next
possible frequency and displays the real value in the System Settings window.
If you want to enter a decimal value, please do not forget the dot . at the end of
the number. Otherwise it is taken hexadecimal. Besides a decimal number like
100000. also short forms like 10kHz or 15MHz can be used. The short
forms implies a decimal value, although no . is used.
RTCK:
The JTAG clock is controlled by the RTCK signal (Returned TCK). This signal isnt
a standard pin of the Mips Jtag connector.
Example:
SYStem.JtagClock RTCK
The clock mode RTCK can not be used if a common debug cable with 14-pin
flat cable (LA-7760) is used. A special dongle must be ordered. And it is
required that the target provides a RTCK signal.
29
SYStem.LOCK
Format:
Tristate the JTAG port
SYStem.LOCK [ON | OFF]
Default: OFF.
If the system is locked no access to the EJTAG port will be performed by the debugger. While locked the
EJTAG connector of the debugger is tristated. The intention of the lock command is to give EJTAG access to
a debugger for another core if the EJTAG port of both cores are multiplexed.
It must be ensured that the state of the MIPS core EJTAG state machine remains unchanged while the
system is locked. To ensure correct hand over between two debuggers a pull-up or pull-down resistor on
TCK and a pull-up resistor on /TRST is required. In case you use a pull-up at TCK, you have to inform the
debugger about that -> SYStem.CONFIG TCKLevel 1. VIO and GND should be kept connected or be reconnected first.
There is an additional plug on the debug cable on the debugger side. This signal can be used to detect if the
EJTAG connector is tristated. If tristated also this signal is tristated, it is pulled low otherwise.
SYStem.MemAccess
Run-time memory access
Format:
SYStem.MemAccess <mode>
<mode>:
CPU
Denied
DMA
This option declares how memory access can take place while the CPU is executing code (run-time memory
access). The run-time memory access has to be activated for each window by using the memory class E:
(e.g. Data.Dump ED:0x800000) or by using the format option %E (e.g. Var.View %E var1).
CPU
not possible.
Denied
Dualport access is blocked.
DMA
Direct memory access/dual port access allowed.
Data.dump ED:0x80000100
Data.dump EAD:0x100
Var.View %E flags
30
SYStem.Mode
Establish the communication with the target
Format:
SYStem.Mode <mode>
<mode>:
Down
NoDebug
Go
Attach
Up
StandBy
Down
(Disables the debugger and keeps the CPU in reset. (default)
NoDebug
Disables the debugger. The state of the CPU remains unchanged. The EJTAG
port is tristated.
Go
Resets the target and enables the debugger. The CPU is running. Program
execution can be stopped by the break command or external trigger. This
command is only allowed if SYStem.Option FlowTrace is OFF.
Attach
No reset is performed. The CPU keeps running. Program execution can be

stopped by the break command or external trigger. This command is only
allowed when CPU is in NoDebug mode and when SYStem.Option FlowTrace
is OFF.
Up
Resets the target and sets the CPU to debug mode. After the execution of this
command the CPU is stopped and all registers are set to the default level.
StandBy
Not implemented.
31
SYStem.Option Address32
Format:
Use 32-bit addresses
SYStem.Option Address32 [ON | OFF]
Default: OFF.
This option is functionable for 64bit architectures only, not for 32bit architectures.
Enable Address32 if you want to work with 32bit addresses on a 64bit MIPS CPU. If enabled, TRACE32
accepts and displays only 32bit addresses. Internally, they are sign-extended to 64bit addresses before they
are used on the CPU. This results in a mapping as follows:
address used in TRACE32
mapped to address on 64bit CPU
0x0000 0000 - 0x7FFF FFFF
0x0000 0000 0000 0000 - 0x0000 0000 7FFF FFFF
0x8000 0000 - 0xFFFF FFFF
0xFFFF FFFF 8000 0000 - 0xFFFF FFFF FFFF FFFF
As a result, with Address32 ON, only the 32bit Compatibility Address Spaces 0x0000 0000 0000 0000 0x0000 0000 7FFF FFFF and 0xFFFF FFFF 8000 0000 - 0xFFFF FFFF FFFF FFFF can be accessed.
This option is helpful if you debug a 32bit Linux kernel on a 64bit MIPS CPU.
Careful: if 64bit addresses are used in TRACE32 with Address32 ON, bits 32-63 will truncated. Turn this
option off if you need to access real 64bit addresses.
SYStem.Option DCFREEZE
Format:
Freeze data cache
SYStem.Option DCFREEZE [ON | OFF]
Default: OFF.
This option has no function for the MIPS architecture.
If DCFREEZE is set on, the debugger leaves the data cache as far as possible unchanged. I.e. if data is
written by the debugger, it will be written into the data cache if the corresponding line is loaded and valid in
the data cache. If no cache line contains the address or the line isnt valid, the data will be written into main
memory. This option has only effect for virtual addressing. If physical addresses are used, they will always
be handled as if dcfreeze is set.
32
SYStem.Option DCREAD
Use DCACHE for data read
Format:
SYStem.Option DCREAD [ON | OFF]
ON (Default)
If data memory is displayed (memory class AD:) the memory contents from the
D-cache is read via dedicated cache opcodes. If D-cache is not valid the
physical memory is read.
OFF
If data memory is displayed (memory class AD:) the memory contents from the
D-cache is read via mapping to KSEG0 for addresses < 0x2000000 respectively via
cached TLB entry for larger addresses. If D-cache is not valid the physical
memory is read.
33
SYStem.Option DisMode
Define disassembler mode
Format:
SYStem.Option DisMode <mode>
<mode>:
AUTO
ACCESS
MIPS32
MIPS16
MICROMIPS
Default: AUTO.
This command specifies the selected disassembler.
AUTO
Automatic selection of disassembler mode. The information provided by the

compiler output format is used for the disassembler selection. If no information
is available it has the same behavior as ACCESS. (default)
ACCESS
Disassembler mode will be selected by entered access class.
MIPS32
The MIPS32 disassembler is used.
MIPS16
The MIPS16 disassembler is used.
MICROMIPS
The microMIPS disassembler is used.
34
SYStem.Option Endianess
Format:
Define endianess of target memory
SYStem.Option Endianess [AUTO | Little | Big]
Default: AUTO.
This option selects the byte ordering mechanism. If it is set to AUTO, the kernel mode endianess will be
detected and selected.
SYStem.Option EnReset
Format:
Control target system reset
SYStem.Option EnReset [ON | OFF]
Default: ON.
During SYStem.Up the target is reset by the debugger. If the target reset is to be inhibited for some reason in
general, this can be done with the command SYStem.Option.EnReset OFF. Note that it is recommended to
leave the option ON because it ensures a more robust startup of the debug session. Consider using
SYStem.Mode.Attach instead of SYStem.Up if you dont want to issue a target reset during the startup of the
debug session.
Note that for multicore debug sessions only the master session issues a system reset.
SYStem.Option EnTRST
Format:
Control TAP reset
SYStem.Option EnTRST [ON | OFF]
Default: ON.
To set the debug interface in a defined state the TAP is reset by driving the TRST pin low and additionally
holding TMS low for five 5 TCKs. By setting the EnTRST option to OFF only the TMS method is used. The
reason for introducing this command was that in some target systems several chips were connected to the
TRST line, which must not be reset together with the debug TAP.
35
SYStem.Option HoldReset
Format:
Set system reset hold time
SYStem.Option HoldReset [<time>]
Default: 300ms
With this option the default reset hold time could be set to a user-defined value.
hold time
wait time
reset
running
nRST
CPU State
SYStem.Option FlowTrace
Format:
debug
Define operating mode of RISC TRACE
SYStem.Option FlowTrace [ON | RealTime | OFF]
Default: OFF.
Flow Trace must be switched to ON or RealTime, if a Trace module is used.Using no trace FlowTrace must
be switched off, otherwise a correct working of the debugger cant be guaranteed.
On RealTime the processor is not stalled if the trace port can not output all data in realtime, trace data get
lost. On ON the processor will be stalled until all trace data have been transferred.
SYStem.Option FREEZE
Format:
Freeze system timer in stop mode
SYStem.Option FREEZE [ON | OFF]
Enabling this option will lead the debugger to stop the target CPU system timer since entering stop mode.
36
SYStem.Option ICFLUSH
Format:
Flush of instruction cache during step and go
SYStem.Option ICFLUSH [ON | OFF]
Default: OFF.
If this option is ON the instruction cache will be invalidated automatically before debug mode will be left (in
case of a step or a go).
SYStem.Option ICREAD
Use ICACHE for program read
Format:
SYStem.Option ICREAD [ON | OFF]
ON
If program memory is displayed (memory class AP:) the memory contents from
the I-cache is shown if the I-cache is valid. If I-cache is not valid the physical
memory will be read. Typical command for program memory display are:
Data.List, Data.dump.
OFF (Default)
If program memory is displayed (memory class AP:) the memory contents from
the physical memory is displayed.
SYStem.Option IMASKASM
Format:
Disable interrupts while ASM single stepping
SYStem.Option IMASKASM [ON | OFF]
Default: OFF.
If enabled, the interrupt mask bits of the CPU will be set during assembler single-step operations. The
interrupt routine is not executed during single-step operations. After single step the interrupt mask bits are
restored to the value before the step.
37
SYStem.Option IMASKHLL
Format:
Disable interrupts while HLL single stepping
SYStem.Option IMASKHLL [ON | OFF]
Default: OFF.
If enabled, the interrupt mask bits of the cpu will be set during HLL single-step operations. The interrupt
routine is not executed during single-step operations. After single step the interrupt mask bits are restored to
the value before the step.
SYStem.Option KEYCODE
Format:
Define key code to unsecure processor
SYStem.Option KEYCODE <key>
Default: 0, means no key required.

Some processors have a security feature and require a key to unsecure the processor in order to allow
debugging. The processor will use the specified key on the next debugger start-up (e.g. SYStem.Up) and
forgets it immediately. For the next start-up the keycode must be specified again.
SYStem.Option MCBreaksynch
Format:
Select break synchronization method
SYStem.Option MCBreaksynch [MCBU | SOFT]
Default: MCBU for CPUs with hardware MultiCore Breakpoint Unit support, SOFT otherwise.
In SMP mode all cores in an SMP system are required to stop synchronously when a breakpoint is hit. In
CPUs with a MultiCore Breakpoint Unit (MCBU) the other cores can be stopped through a dedicated
hardware interrupt once a core hits a breakpoint. In CPUs without MCBU a TRACE32 software loop is used
to stop all SMP cores upon entry of debug mode. Since the hardware synchronization is much faster than
the software solution it is used by default on CPUs that support it. However, if more than one SMP system is
running on one CPU but the MCBU features only one synchronization channel, it might be necessary to set
the MultiCore Break Synchronization of all but the first SMP system to SOFT. Thus, the breaking behaviour
of the SMP systems can be decoupled.
This option is not available for all CPUs.
38
SYStem.Option MMUSPACES
Format:
Enable multiple address spaces support
SYStem.Option MMUSPACES [ON | OFF]

SYStem.Option MMU [ON | OFF] (deprecated)
Default: OFF.
Enables the usage of the MMU to support multiple address spaces. The command should not be used if
only one translation table is used. Enabling the option will extend the address scheme of the debugger by a
16 bit memory space identifier. You should activate the option first, and then load the symbols.
39
SYStem.Option MonBase
Format:
Base address for monitor download routine
SYStem.Option MonBase <address>
Default: 0.
This option selects an available memory area, where the debugger can load and execute a small program
(48 bytes) to realize a fast download. See SYStem.Option TURBO.
SYStem.Option PROTECTION
Format:
Sends an unsecure sequence to the core
SYStem.Option PROTECTION <filename>
This option was made for unsecure protected debug interfaces. It sends the key pattern in the file in a certain
way to the core in order to gain the right to debug the core.
SYStem.Option ResBreak
Format:
Halt the core after reset
SYStem.Option ResBreak [ON | OFF]
Default: ON.
The common system up procedure is, that the debugger resets the target and forces the core into debug
mode before any program will run. A prerequisite is that the TAP controller may be enabled during an
asserted nRST line. Some cores have unwanted correlations between nRST and nTRST, so it isnt possible
for the debugger to communicate with the core during reset. For those cores/boards (BCMxxxx and LX4x80/
MDEB) nRST must be deasserted before the TAP may be reset. Thus will be done by the debugger, if
ResBreak is switched off. For resetting all register values and allow debugging from the ResetVector an
additional Reset pulse is asserted.
40
System.Option ResBreak OFF:
hold time
wait time
hold time
running
reset
wait time
nRST
reset
CPU State
SYStem.Option STEPONCHIP
Format:
running
debug
Use onchip breakpoints for ASM stepping
SYStem.Option STEPONCHIP [ON | OFF]
Default: OFF.
If this option is ON, onchip breakpoints are used for single stepping on assembler level instead of using the
hardware single step feature of the CPU.
Use of STEPONCHIP ON:
On some CPUs the MIPS hardware single step feature does not function correctly in certain address
ranges, e.g. due to hardware issues. The STEPONCHIP ON option allows to workaround such problems.
Please note that STEPONCHIP ON has no effect if option STEPSOFT ON is used.
SYStem.Option STEPSOFT
Format:
Use software breakpoints for ASM stepping
SYStem.Option STEPSOFT [ON | OFF]
Default: OFF.
If this option is ON, software breakpoints are used for single stepping on assembler level.
Use of STEPSOFT ON for HLL debugging:
In several cases, the debugger executes an assembler single step by itself (e.g. continue on a breakpoint). If
this single step results in a jump to an exception, the exception release come back to the breakpoint and the
core stops at there again. STEPSOFT ON avoids this.
41
SYStem.Option TURBO
Format:
Enable fast download
SYStem.Option TURBO [ON | OFF]
Default: OFF.
If TURBO is on, a fast download is possible. It will be assumed that the memory is uncached and can be
accessed without errors. A program running on the target will be used to realize this fast download. A small
program will be loaded at the location specified by SYStem.Option MonBase. This mode should be switched
off after the download command is used, since it includes no error checks.
See SYStem.Option MonBase.
SYStem.Option UnProtect
Format:
Unprotect memory addresses
SYStem.Option UnProtect [ON | OFF]
Default: OFF.
If UnProtect is on, access to all addresses with entries in the TLB are possible. I.e. a write access is
possible, although the access is set to read only in the target TLB. This option is often necessary for
application debugging on Linux. If Linux marks pages as read-only, setting a SW-breakpoint on those
addresses will fail. To enable SW-breakpoint UnProtect must be switched on.
SYStem.Option WaitReset
Format:
Set system reset wait time
SYStem.Option WaitReset [<time>]
Default: 300ms
With this option the default reset wait time could be set to a user-defined value. That could be become
necesssary if the nRST hold time becomes extended by an onboard reset controller.
hold time
wait time
reset
running
nRST
CPU State
debug
42
On-chip Breakpoints
TrOnchip.AddressMask
Format:
TrOnchip.AddressMask <value> | <bitmask>
TrOnchip.ASID
Format:
Define an address mask
Extend on-cip breakpoint/trace filter by ASID
TrOnchip.ASID [ON | OFF]
OFF (default)
Stop the program execution at on-chip breakpoint if the address

matches.
Trace filters and triggers become active if the address matches.
ON
Stop the program execution at on-chip breakpoint if the address and

the ASID matches.
Trace filters and triggers become active if the address and the ASID
matches.
43
On-chip Breakpoints
TrOnchip.CONVert
Format:
Adjust range breakpoint in on-chip resource
TrOnchip.CONVert [ON | OFF]
The on-chip breakpoints can only cover specific ranges. If a range cannot be programmed into the
breakpoint it will automatically be converted into a single address breakpoint when this option is active. This
is the default. Otherwise an error message is generated.
TrOnchip.CONVert ON
Break.Set 0x1000--0x17ff /Write
; sets breakpoint at range

; 1000--17ff sets single breakpoint
; at address 1001
TrOnchip.CONVert OFF
; sets breakpoint at range

; 1000--17ff
; gives an error message
TrOnchip.CORERESET
Format:
Halt at reset vector after core reset
TrOnchip.CORERESET [ON | OFF]
OFF (default)
Dont stop the program execution at reset vector after any core
reset.
ON
Stop the program execution at reset vector after any core reset
TrOnchip.RESet
Format:
Set on-chip trigger to default state
TrOnchip.RESet
Sets the TrOnchip settings and trigger module to the default settings.
44
On-chip Breakpoints
TrOnchip.StepVector
Format:
Halt on exception vector during step
TrOnchip.StepVector [ON | OFF]
Default: OFF
Stepvector ON/OFF determines the behaviour of a single step, when an exception or an interrupt occurs. If
StepVector is ON, the core halts on the exception/interrupt routine, otherwise the core halts on the next
instruction (after the instruction where the single step is performed).
TrOnchip.TCompress
Format:
Trace data compression
TrOnchip.TCompress [ON | OFF]
Not implemented.
TrOnchip.UseWatch
Format:
Use watchpoints
TrOnchip.UseWatch [ON | OFF]
Watchpoints instead of onchip breakpoints are used.

Default: OFF.
TrOnchip.VarCONVert
Format:
Adjust complex breakpoint in on-chip resource
TrOnchip.VarCONVert [ON | OFF]
The on-chip breakpoints can only cover specific ranges. If you want to set a marker or breakpoint to a
complex variable, the on-chip break resources of the CPU may be not powerful enough to cover the whole
structure. If the option TrOnchip.VarCONVert is ON the breakpoint will automatically be converted into a
single address breakpoint. This is the default setting. Otherwise an error message is generated.
45
On-chip Breakpoints
TrOnchip.view
Format:
Display on-chip trigger window
TrOnchip.view
Open TrOnchip window.
46
On-chip Breakpoints
Trigger Commands
Trigger.Set
Format:
External trigger input enable
Trigger.Set BUSA [ON | OFF]
Enables the external trigger input. The program execution halts on a rising edge on the external trigger input.
Trigger.Out
Format:
External trigger output enable
Trigger.Out BUSA [ON | OFF]
When enabled a high pulse of 200 ns is asserted on the external trigger line when the user program
execution halts.
47
Trigger Commands
CPU specific MMU Commands
MMU.DUMP
Page wise display of MMU translation table
Format:
MMU.DUMP <table> [<range> | <addr> | <range> <root> | <addr> <root>]

MMU.<table>.dump (deprecated)
<table>:
PageTable
KernelPageTable
TaskPageTable <task>
and CPU specific tables
Displays the contents of the CPU specific MMU translation table.
If called without parameters, the complete table will be displayed.
If the command is called with either an address range or an explicit address, table entries will
only be displayed, if their logical address matches with the given parameter.
The optional <root> argument can be used to specify a page table base address deviating from the default
page table base address. This allows to display a page table located anywhere in memory.
PageTable
Display the current MMU translation table entries of the CPU.

This command reads all tables the CPU currently used for MMU translation
and displays the table entries.
KernelPageTable
Display the MMU translation table of the kernel.

If specified with the MMU.FORMAT command, this command reads the
MMU translation table of the kernel and displays its table entries.
TaskPageTable
Display the MMU translation table entries of the given process.

In MMU based operating systems, each process uses its own MMU
translation table. This command reads the table of the specified process,
and displays its table entries.
See also the appropriate OS awareness manuals: RTOS Debugger for
<x>.
CPU specific tables:

TLB
Displays the contents of the Translation Lookaside Buffer.
Displays the actual target TLB. Lines which are invalid will be displayed as empty lines. On the right side of
table the contents of the belonging CP0 registers (pagemask, entryhi, entrylo0 and entrylo1) are displayed.
48
MMU.FORMAT
Define MMU table structure
Format 1:
MMU.FORMAT <format> [<base_address> [<logical_kernel_address_range>

<physical_kernel_address>]]
Format 2:
MMU.FORMAT <format> [<base_address> [<base_address_highrange>

[<logical_kernel_address_range> <physical_kernel_address>]]]
MIPS64 only
Defines the information needed for the page table walks, which are performed by TRACE32 for debugger
address translation, page table dumps, or page table scans.
Format 1 is the normal, CPU-architecture independent command syntax. This format does not require the
additional input parameter <base_address_highrange> of format 2.
Format 2: For MIPS64, there are four MMU.FORMAT <format> keywords which require the additional input
parameter <base_address_highrange>. These keywords are LINUX64, LINUX64RIXI, LINUX64HTLB, and
LINUX64HTLBP16.
<format>
<format> is to be replaced with a CPU architecture specific keyword which defines the structure of the MMU
page tables used by the kernel. The MMU format STD is used when MMU.FORMAT is not specified at all.
The table below indicates if a <format> requires the additional parameter <base_address_highrange>.
<format>
Description
STD
Standard format defined by the CPU
LINUX32
Linux 32bit, pagesize 4kB
LINUX32RIXI
Linux 32bit with RI/XI bits
LINUX32R4K
Linux 32bit, pagesize 4kB, like LINUX32 but different pageflags
LINUX32P16
Linux 32bit, pagesize 16kB
LINUX32P16R41
Linux 32bit, pagesize 16kB, used on MIPS32 R2 or R6
LINUX64
Linux 64bit with 64bit PTEs, pagesize 4kB. Separate page table for high
address range can be specified with optional extra parameter
<base_address_highrange>.
LINUX64P64
Linux 64bit with 64bit PTEs, pagesize 64kB. Depth 3 levels.
LINUX64P64LT
Linux 64bit with 64bit PTEs, pagesize 64kB. Depth 2 levels with large level
1 table (used for BROADCOM(R) XLP SDK 3.7.10 and alike)
LINUX64RIXI
Linux 64bit with 64bit PTEs with RI/XI bits, pagesize 4kB. Separate page
table for high address range can be specified with optional extra
parameter <base_address_highrange>.
49
<format>
Description
LINUX64HTLB
Linux 64bit with 64bit PTEs, pagesize 4kB for huge TLB. Uses separate
sub table for addresses > 0xFFFFFFFFC0000000.
LINUX64HTLBP16
Linux 64bit like LINUX64HTLB but pagesize 16kB.
LINUXBIG
Linux 32bit with 64bit PTEs on MIPS32
LINUXBIG64
Linux 32bit with 64bit PTEs on MIPS64
WINCE6
Format used by Windows CE6
EXTENSION
Tablewalk performed by TRACE32 extension
<base_address>
<base_address> defines the default page table which is usually the kernel page table containing translations
for mapped address ranges owned by the kernel.
The debugger address translation uses the default page table if no process specific page table (task
page table) is available to translate an address.
<base_address> can be left empty by typing a comma or set to zero if there is no default page table
available in the system.
<base_address_highrange>
Using <base_address_highrange>, you can specify a second page table responsible for the translation of
addresses >= 0xFFFFFFFF00000000. Then, two page tables are in use:
Addresses in range 0x0--0xFFFFFFFEFFFFFFFF will be translated with the page table defined
by the argument <base_address>.
Addresses in range 0xFFFFFFFF00000000--0xFFFFFFFFFFFFFFFF will be translated with the

page table defined by the argument <base_address_highrange>.
<logical_kernel_address_range> and <physical_kernel_address>

The arguments <logical_kernel_address_range> and <physical_kernel_address> define a linear logical-tophysical address translation for the kernel addresses, called kernel translation or default translation. This
translation should cover all statically mapped logical address ranges of kernel code or kernel data.
For the <physical_kernel_address> you just need to specify the start address.
NOTE:
If no kernel translation is specified for a given memory access, TRACE32 tries to

use static address translations defined by the command TRANSlation.Create. The
kernel translation is shown in the TRANSlation.List window.
50
Examples
NOTE:
A backslash \ is used as a line continuation character in PRACTICE script files

(*.cmm). No white space permitted after the backslash.
Examples of Format 1:
;
<format>
MMU.FORMAT LINUX
<base_address>
swapper_pg_dir
<logical_range>
<phys_range>
MMU.FORMAT LINUX
swapper_pg_dir \
0xC000000000000000--0xc00000007FFFFFFF 0x20000000
Examples of Format 2 with <base_address_highrange>:

;
<format>
MMU.FORMAT LINUX64
<base_address>
swapper_pg_dir
MMU.FORMAT LINUX64
swapper_pg_dir
module_pg_dir \
0xC000000000000000--0xc00000007FFFFFFF 0x20000000
<logical_range>
<phys_range>
module_pg_dir
Examples of Format 2 without <base_address_highrange>:

In this example, not only the <base_address_highrange> is omitted but also all remaining parameters.
;
<format>
MMU.FORMAT LINUX64
<base_address>
swapper_pg_dir
If you need all parameters of Format 2 except for <base_address_highrange>, then use two commas to
specify an empty input parameter.
;
<format>
MMU.FORMAT LINUX64
<base_address>
swapper_pg_dir
MMU.FORMAT LINUX64
swapper_pg_dir
,, \
0xC000000000000000--0xC00000007FFFFFFF 0x20000000
<logical_range>
<phys_range>
51
MMU.List
Compact display of MMU translation table
Format:
MMU.List <table> [<range> | <address>]

MMU.<table>.List (deprecated)
<table>:
PageTable
KernelPageTable
Lists the address translation of the CPU specific MMU table. If called without address or range parameters,
the complete table will be displayed.
If called without a table specifier, this command shows the debugger internal translation table.
See TRANSlation.List.
If the command is called with either an address range or an explicit address, table entries will only be
displayed, if their logical address matches with the given parameter.
PageTable
List the current MMU translation of the CPU.

This command reads all tables the CPU currently used for MMU
translation and lists the address translation.
KernelPageTable
List the MMU translation table of the kernel.

MMU translation table of the kernel and lists its address translation.
TaskPageTable
List the MMU translation of the given process.

and lists its address translation.
<x>.
52
MMU.SCAN
Load MMU table from CPU
Format:
MMU.SCAN <table> [<range> <address>]

MMU.<table>.SCAN (deprecated)
<table>:
PageTable
KernelPageTable
ALL
and CPU specific tables
Loads the CPU specific MMU translation table from the CPU to the debugger internal translation table. If
called without parameters the complete page table will be loaded. The loaded address translation can be
viewed with TRANSlation.List.
If the command is called with either an address range or an explicit address, page table entries will only be
loaded if their logical address matches with the given parameter.
PageTable
Load the current MMU address translation of the CPU.

This command reads all tables the CPU currently used for MMU translation,
and copies the address translation into the debugger internal translation
table.
KernelPageTable
Load the MMU translation table of the kernel.

table of the kernel and copies its address translation into the debugger
internal translation table.
TaskPageTable
Load the MMU address translation of the given process.

and copies its address translation into the debugger internal translation
table.
<x>.
ALL
Load all known MMU address translations.

This command reads the OS kernel MMU table and the MMU tables of all
processes and copies the complete address translation into the
debugger internal translation table.
<x>.
53
CPU specific tables:
TLB
Loads the translation table from the CPU to the debugger internal translation
table.
MMU.Set
Format:
Set MMU registers
MMU.Set TLB <index> <pagemask> <entryhi> <entrylo0> <entrylo1>
Sets the specified MMU TLB table entry in the CPU.

TLB
Writes data to the processors TLB. (Translation Lookaside Buffer)
<index>
Index of entry in target TLB.
<pagemask>
Content of pagemask register.
<entryhi>
Content of entryhi register.
<entrylo0>
Content of entrylo0 register.
<entrylo1>
Content of entrylo1 register.
MMU.TLB.Set
Set MMU registers
Same command with same parameters as MMU.Set TLB. See command description above.
MMU.TLBSET
Set MMU registers
Command obsolete. Use MMU.Set TLB instead. Sets the specified MMU TLB table entry in the CPU.
54
TCB
The abbreviation TCB stands for Trace Control Block, and is the HW control interface to the MIPS hardware
trace block. For details please refer to the MIPS Trace specifications. In the following TCB specific controlling
and the referring commands are described.
TCB Control
The TCB triggering and filtering can be done in two ways:
GUI based by the settings in the TCB.state combined with the breakpoint windows.
Command line based by the TCB and break.set commands.
The triggering of the trace is controlled by the TraceOn and TraceOFF option of the break.set command. The
trace trigger is non intrusive and therefore each break action use one onchip breakpoint resource. The
number of available onchip breakpoints is implementation dependent and could be found in the instruction
and data breakpoint status register.
Break.Set 0x4dd84 /Program /TraceON
;
;
;
;
;
start broadcasting the

instruction flow after
the instruction at the
address 0x4dd84 was executed
by the hardware thread 3
Break.Set 0x4ffa8 /Program /TraceOFF
;
;
;
;
;
stop broadcasting the

instruction flow after
the instruction at the
address 0x4dd84 was executed
by the hardware thread 3
Onchip trace filtering by data, cpu operation mode and, in case of multi thread or core devices, by cpu and tc
number could be done with the TCB commands. In the example below the TCB broadcasts only trace
informations for hardware thread 1 in user mode.
TCB.TRACETC TC1
; broadcast trace information

; only if TC1 execute
; instructions.
TCB.TRACEKE OFF
; switch off broadcasting in

; kernel mode.
TCB.TRACESV OFF

; supervisor mode.
TCB.TRACEEX OFF

; exception mode.
55
TCB
In case of combined trace trigger and CPU operation mode filtering, the operation mode filtering has no
effect!
A full description of all TCB commands can be found in General Commands Reference Guide T
(general_ref_t.pdf).
56
TCB
Configuring your FPGA

Before you can start debugging, your FPGA has to contain a valid design. The design has to include a Mips
core, for which JTAG debugging is enabled.
You can use the debugger to configure your FPGA, if you provide a suitable BIT file.
Be sure to have correct multicore settings before configuring the FPGA (The
settings are identical when connecting to the Mips core), otherwise the
configuration will fail.
Also ensure that the debugger is in SYStem.down mode, before configuring
your FPGA. Configuring the FPGA will break the communication link between
the debugger and the Mips core, if your debugger is in SYStem.up mode.
It is recommended to configure the target with the config option JTAG
dedicated i.e. not using a mode where JTAG overrides other configurations like
MSI, SPI etc. In the latter case configuration via TRACE32 may fail silently (no
error message), though configuration via Xilinx Impact works.
Using JTAG for FPGA configuration

Dependant on the above mentioned conditions FPGA configuration is possible with a TRACE32 command.
JTAG.LOADBIT
Format:
Configure FPGA with BIT file
JTAG.LOADBIT <file>
This command downloads a bitstream (a .BIT file) to the FPGA configure it. Before invoking the command,
the debugger must be in state SYStem.Down..
SYStem.Down
JTAG.LOADBIT system.bit
NOTE:
It is necessary to configure the multicore settings for accessing the IR of the FPGA
fabric before using the command. These settings are identical to the settings used
for debugging Mips cores.
57
Configuring your FPGA
EJTAG Connector

This connector is defined by MIPS in the EJTAG specification revision 2.5 and we recommend this
connector for all future designs. Our debugger is supplied with this connector:
This connector does not provide trace signals, since the new EJTAG specification revision 2.5 does not yet
include a trace definition. The trace feature will currently be redefined by MIPS. We expect that an additional
connector will be specified for the trace signals.
Signal
TRSTTDI
TDO
TMS
TCK
RSTDINT
Pin
1
3
5
7
9
11
13
Pin
2
4
6
8
10
14
Signal
GND
GND
GND
GND
GND
Key
VIO (Reference Voltage)
This is a standard 14 pin double row connector (pin to pin spacing: 0.100 in.).
On target side a common pin strip with or without housing, for example SAMTEC: TSW-107-23-L-D can be
used. Pin12 should be removed to provide mechanical keying.
58
EJTAG Connector
The input and output signals are connected to a supply translating transceiver (74ALVC164245).
Therefore the ICD can work in an voltage range of (1.5 V) 1.8 3.3 V (3.6 V). Please note that a
5 V supply environment is not supported! This would cause damage on the ICD. Please contact
us for alternate solutions if you need to work with 5V.
VIO is used as a sense line for the target voltage. It is also used as supply voltage for the supply
translating transceiver of the ICD interface to make an adaptation to the target voltage
(1.5 V) 1.8 3.3 V (3.6 V).
nTRST, TDI, TMS, TCK are driven by the supply translating transceiver. In normal operation
mode this driver is enabled, but it can be disabled to give another tool access to the EJTAG port.
In environments where multiple tools can access the EJTAG port, it is absolutely required that
there is a pull down resistor at TCK. This is to ensure that TCK is low during a hand over between
different tools.
TDO is an ICD input. It is connected to the supply translating transceiver.
nRST is used by the debugger to reset the target CPU or to detect a reset on the target. It is
driven by an open collector buffer. A 47 k pull-up resistor is included in the ICD connector. The
debugger will only assert a pulse on nRST when the SYStem.UP, the SYStem.Mode Go or the
SYStem.RESetOUT command is executed. If it is ensured that the MIPS is able to enter debug
mode every time (no hang-up condition), the nRST line is optional.
DINT is driven by the supply translating transceiver. This line is optional. It allows to halt the
program execution by an external trigger signal.
key pin is blocked to avoid wrong connection
There is an additional plug in the connector on the debug cable to the debug interface. This signal is tristated
if the EJTAG connector is tristated by the debugger and it is pulled low otherwise. This signal is normally not
required, but can be used to detect the tristate state if more than one debug tools are connected to the same
EJTAG port.
59
EJTAG Connector

This connector is used on IDT boards. It provides the debugger signals plus the signals required for the
trace. This debug interface is based on an older MIPS EJTAG specification revision 1.5.3.. This interface is
not available for ICD-MIPS64.
Signal
TRSTTDI/DINT
TDO/TPC
TMS
TCK
RSTPCST[0]
PCST[1]
PCST[2]
DCLK
DEBUGBOOT
VIO (Reference Voltage)
Pin
1
3
5
7
9
11
13
15
17
19
21
23
Pin
2
4
6
8
10
12
14
16
18
20
22
24
Signal
GND
GND
GND
GND
GND
GND
GND
GND
GND
GND
GND
GND
An adapter is available if only the debugger should be connected. If debugger and trace is used, the
debugger can be plugged on the trace probe. The trace probe uses this connector type.
The connector on the tool side is the 1,27 mm pitch sockets from
SAMTEC: SFMC-112-T1-S-D
As an appropriate connector on the target side can for example be used
SAMTEC: FTSH-112- (LIF) or FW-112- (LIF) or DIS5-112-
60
EJTAG Connector
The input and output signals are connected to a supply translating transceiver (74ALVC164245).
Therefore the ICD can work in an voltage range of (1.5 V) 1.8 3.3 V (3.6 V). Please note that a
5 V supply environment is not supported! This would cause damage on the ICD. Please contact
us for alternate solutions if you need to work with 5 V.
VIO is used as a sense line for the target voltage. It is also used as supply voltage for the supply
translating transceiver of the ICD interface to make an adaptation to the target voltage
(1.5 V) 1.8 3.3 V (3.6 V).
nTRST, TDI/DINT, TMS, TCK are driven by the supply translating transceiver. In normal
operation mode this driver is enabled, but it can be disabled to give another tool access to the
EJTAG port. In environments where multiple tools can access the EJTAG port, it is absolutely
required that there is a pull down resistor at TCK. This is to ensure that TCK is low during a hand
over between different tools.
TDO/TPC is an ICD input. It is connected to the supply translating transceiver.
nRST is used by the debugger to reset the target CPU or to detect a reset on the target. It is
driven by an open collector buffer. A 47 k pull-up resistor is included in the ICD connector. The
debugger will only assert a pulse on nRST when the SYStem.UP, the SYStem.Mode Go or the
SYStem.RESetOUT command is executed. If it is ensured that the MIPS is able to enter debug
mode every time (no hang-up condition), the nRST line is optional.
Debugboot is driven by the supply translating transceiver. This line is optional. This line is
currently not used, but will probably be used in the future for additional features.
The signals DCLK, PCST0, PCST1, PCST2 are only connected to the trace tool if a trace tool is
used. Otherwise they are not required. TDO/TPC is used by the trace and the debugger (see
above).
There is an additional plug in the connector on the debug cable to the debug interface. This signal is tristated
if the EJTAG connector is tristated by the debugger and it is pulled low otherwise. This signal is normally not
required, but can be used to detect the tristate state if more than one debug tools are connected to the same
EJTAG port.
61
EJTAG Connector
Recommended JTAG Circuit on Target

MIPS recommends to configure the electrical JTAG connection as shown in the schematic below.
LAUTERBACHs JTAG adapters are conform to this proposal.
Referring to MIPS specification, the recommended pull-up/pull-down resistor is 1 k, the recommended

serial resistor is 33 .
On some evaluation boards, there is a pull-up resistor on VIO. Since the

LAUTERBACH JTAG adapter is supplied by targets VIO, a pull-up resistor is not
allowed. In such a case, this resistor has to be bridged.
62
EJTAG Connector
Technical Data Debugger
Operation Voltage
Adapter
OrderNo
Voltage Range
JTAG Debugger for MIPS32 (ICD)

EJTAG Debugger License for MIPS32 Add.
LA-7760
LA-7760A
LA-7761
LA-7761A
1.8 .. 3.6 V
1.8 .. 3.6 V
1.8 .. 3.6 V
1.8 .. 3.6 V
Dimension
LA-7760
EJTAG-MIPS32
1288
925
1113
TOP VIEW
CABLE
2288
433
275
SIDE VIEW
ALL DIMENSIONS IN 1/1000 INCH
63
Dimension
LA-7761
EJTAG-MIPS64
1288
925
1113
TOP VIEW
CABLE
2288
64
Trace
tbd.
65
Trace
Technical Data Trace
Operation Voltage
Adapter
OrderNo
Voltage Range
Preproc. for MIPS32 AUTOFOCUS 600 MIPI

Preprocessor for MIPS flex cable
LA-3906
LA-7894
1.8 .. 3.3 V
0.9 .. 3.3 V
Operation Frequency
Module
CPU
TRACE
LA-3906
LA-3906
LA-3906
LA-3906
LA-3906
LA-3906
LA-3906
LA-3906
LA-3906
LA-3906
LA-3906
LA-3906
LA-3906
LA-3906
LA-3906
LA-3906
LA-3906
LA-3906
LA-3906
LA-3906
LA-3906
LA-3906
LA-3906
LA-3906
LA-3906
LA-3906
LA-3906
AR2315
AR7242
AR9344
LX4189
LX4X80
LX5180
LX5280
MDEB
MDED
MIPS1004K
MIPS1004KMT
MIPS1074K
MIPS24K
MIPS24KE
MIPS34K
MIPS4KC
MIPS4KEC
MIPS4KM
MIPS4KP
MIPS4KSD
MIPS74K
MIPSINTERAPTIV
MSP2015
MSP2020
MSP7120
MSP7140
RC32332
180.0 MHz
180.0 MHz
180.0 MHz
180.0 MHz
180.0 MHz (CPU 720.0 MHz)
180.0 MHz (CPU 720.0 MHz)
180.0 MHz
180.0 MHz
180.0 MHz
180.0 MHz
180.0 MHz
66
Module
CPU
TRACE
LA-3906
LA-3906
LA-3906
LA-3906
LA-3906
LA-3906
LA-3906
LA-3906
LA-3906
RC32333
RC32334
RC32336
RC32351
RC32355
RC32364
RC32365
RTL8650
TX4938
180.0 MHz
180.0 MHz
180.0 MHz
180.0 MHz
180.0 MHz
180.0 MHz
180.0 MHz
180.0 MHz
67
Dimension
LA-3906
PP-MIPS32-AF-2
TOP VIEW
CABLE
LAUTERBACH
2475
1525
PIN1
400
1400
5700
1200
475
SIDE VIEW
LA-7894
PP-MIPS
TOP VIEW
CABLE
2475
1525
PIN 1
400
5700
SIDE VIEW
675
475
1400
275
68
Support
20KC
5KC
5KF
ALUMINIUM
AR2315
AR7
AR7242
AR9344
AU1000
AU1000LP
AU1000N
AU1100
AU1200
AU1500
AU1550
BCM1101
BCM1103
BCM1113
BCM1125
BCM1190
BCM1250
BCM1255
BCM1280
BCM1455
BCM1480
BCM3349
BCM3380
BCM35230
BCM3549
BCM3556
BCM4704
BCM47186
BCM471x
BCM4748
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
INSTRUCTION
SIMULATOR
POWER
INTEGRATOR
ICD
TRACE
ICD
MONITOR
ICD
DEBUG
FIRE
ICE
CPU
Available Tools
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
69
Support
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
INSTRUCTION
SIMULATOR
POWER
INTEGRATOR
ICD
TRACE
ICD
MONITOR
ICD
DEBUG
FIRE
ICE
CPU
BCM5331x
BCM5350
BCM5354
BCM5358
BCM5365
BCM56xxx
BCM5836
BCM63168
BCM63268
BCM6328
BCM6338
BCM6345
BCM6348
BCM6358
BCM6362
BCM6368
BCM6369
BCM6550
BCM6816
BCM6818
BCM6828
BCM7038
BCM7111
BCM7231
BCM7312
BCM7317
BCM7318
BCM7325
BCM7335
BCM7346
BCM7356
BCM7358
BCM7400
BCM7401
BCM7402
BCM7405
BCM7407
BCM7413
BCM7418
BCM7420
BCM7425
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
70
Support
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
INSTRUCTION
SIMULATOR
POWER
INTEGRATOR
ICD
TRACE
ICD
MONITOR
ICD
DEBUG
FIRE
ICE
CPU
BCM7435
BL25580
C7108
COACH12
EMMA3xxx
FALCON
HIDTV_PRO-QX
IKF6833
IKF6834
IKF6836
IKF6850
IKF6860
IKF7185
LX4189
LX4X80
LX5180
LX5280
MDEB
MDED
MIPS1004K
MIPS1004KMT
MIPS1074K
MIPS24K
MIPS24KE
MIPS34K
MIPS4KC
MIPS4KEC
MIPS4KM
MIPS4KP
MIPS4KSD
MIPS74K
MIPSINTERAPTIV
MIPSM14K
MIPSM14KC
MIPSM4K
MP32
MSP2015
MSP2020
MSP7120
MSP7140
MSP8510
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
71
Support
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
INSTRUCTION
SIMULATOR
POWER
INTEGRATOR
ICD
TRACE
ICD
MONITOR
ICD
DEBUG
FIRE
ICE
CPU
OCTEON_CN30XX
OCTEON_CN31XX
OCTEON_CN38XX
OCTEON_CN50XX
OCTEON_CN52XX
OCTEON_CN54XX
OCTEON_CN55XX
OCTEON_CN56XX
OCTEON_CN57XX
OCTEON_CN58XX
OCTEON_II_CN60XX
OCTEON_II_CN61XX
OCTEON_II_CN62XX
OCTEON_II_CN63XX
OCTEON_II_CN66XX
OCTEON_II_CN67XX
OCTEON_II_CN68XX
OCTEON_III_CN70XX
OCTEON_III_CN71XX
OCTEON_III_CNF71XX
P210
PIC32MX
PIC32MZ
PNX8330
PNX8331
PNX8332
PNX8335
PNX8535
PNX8541
PNX8542
PNX8543
PNX8932
PNX8935
PR3950
PR7530
PSB21553_INCA-IP
PXB9101
PXB9102
PXB9201
PXB9202
RC32332
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
72
Support
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
INSTRUCTION
SIMULATOR
POWER
INTEGRATOR
ICD
TRACE
ICD
MONITOR
ICD
DEBUG
FIRE
ICE
CPU
RC32333
RC32334
RC32336
RC32351
RC32355
RC32364
RC32365
RC32438
RM7935
RM9000
RM9220
RM9224
RT3052
RT3352
RT3662
RTL8650
SMP8634
SMP8654
TNETC4320
TX4938
VCT9xxxP
VDSL5100I
VGCA
VGCB
WIN1xx
WIN7xx
WINPATH2
WINPATH3
WP3SL
XLP1XX
XLP2XX
XLP3XX
XLP4XX
XLP8XX
XLR
XLS
xRX100
xRX200
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
73
Support
Compilers
Language
Compiler
Company
Option
C
C++
C++
TCC
SDE
GCC
IEEE
ELF/STABS
ELF/DWARF
C++
GREEN-HILLSC++
TASKING
Algorithmics
Free Software
Foundation, Inc.
Greenhills Software Inc.
Comment
ELF/DWARF
Realtime Operation Systems

Name
Company
Comment
ECOS
FreeRTOS
Linux
Linux
Nucleus
OSE Delta
OSEK
ProOSEK
RX4000
T-Kernel
ThreadX
uC/OS-II
uITRON
VxWorks
Windows CE
Windows Mobile
eCosCentric Limited
Freeware I
MontaVista Software, LLC
Mentor Graphics Corporation
Enea OSE Systems
Elektrobit Automotive GmbH
Renesas Technology, Corp.
eSOL Co., Ltd.
Express Logic Inc.
Micrium Inc.
Wind River Systems
Microsoft Corporation
1.3, 2.0 and 3.0

v7
Kernel Version 2.4 and 2.6, 3.x, 4.x
3.0, 3.1, 4.0, 5.0
4.x and 5.x
via ORTI
via ORTI
3.0, 4.0, 5.0

2.0 to 2.92
HI7000, RX4000, NORTi,PrKernel
5.x and 6.x
4.0 to 6.0
4.0 to 6.0
74
Support
3rd Party Tool Integrations

CPU
Tool
Company
ALL
ALL
ALL
ADENEO
X-TOOLS / X32
CODEWRIGHT
ALL
CODE CONFIDENCE
TOOLS
CODE CONFIDENCE
TOOLS
EASYCODE
ECLIPSE
RHAPSODY IN MICROC
RHAPSODY IN C++
CHRONVIEW
LDRA TOOL SUITE
UML DEBUGGER
Adeneo Embedded
blue river software GmbH
Borland Software
Corporation
Code Confidence Ltd
ALL
ALL
ALL
ALL
ALL
ALL
ALL
ALL
ALL
ALL
ALL
ALL
ALL
ALL
ALL
ALL
ALL
ALL
ALL
ALL
ALL
ALL
ATTOL TOOLS
VISUAL BASIC
INTERFACE
LABVIEW
CODE::BLOCKS
C++TEST
RAPITIME
DA-C
TRACEANALYZER
SIMULINK
TA INSPECTOR
UNDODB
VECTORCAST UNIT
TESTING
VECTORCAST CODE
COVERAGE
WINDOWS CE PLATF.
BUILDER
Host
Windows
Windows
Windows
Code Confidence Ltd
Linux
EASYCODE GmbH
Eclipse Foundation, Inc
IBM Corp.
IBM Corp.
Inchron GmbH
LDRA Technology, Inc.
LieberLieber Software
GmbH
MicroMax Inc.
Windows
Windows
Windows
Windows
Windows
Windows
Windows
Windows
Windows
NATIONAL
INSTRUMENTS
Corporation
Open Source
Parasoft
Rapita Systems Ltd.
RistanCASE
Symtavision GmbH
The MathWorks Inc.
Timing Architects GmbH
Undo Software
Vector Software
Windows
Windows
Windows
Windows
Windows
Windows
Windows
Linux
Windows
Vector Software
Windows
Windows
Windows
75
Support
Products
Product Information
OrderNo Code
Text
LA-7760
EJTAG-MIPS32
supports MIPS32 4Kp, 4Km, 4Kc derivatives

and LEXRA LX4280
includes software for Windows, Linux and MacOSX
requires Power Debug Module
debug cable with 14 pin connector
LA-7760A
EJTAG-MIPS32-A
supports MIPS32 4Kp, 4Km, 4Kc derivatives

and LEXRA LX4280
please add the base serial number of your debug
cable to your order
LA-7761
EJTAG-MIPS64
supports MIPS64 5Kc, 20Kc derivatives

includes software for Windows, Linux and MacOSX
requires Power Debug Module
debug cable with 14 pin connector
LA-7761A
EJTAG-MIPS64-A
supports MIPS64 5Kc, 20Kc derivatives

cable to your order
LA-7971X
Trace License for the MIPS32
TRACE-LICENSE-MIPS32
1.) Support for EJTAG onchip trace on MIPS32

cable to your order
2.) Supports 4-Bit IFlow program trace by using
LA-4504 CombiProbe MIPS32-Debugger and 4-Bit IFLOW
76
Products
OrderNo Code
Text
LA-7777
EJTAG MIPS Converter 14/12
EJTAG-MIPS-14/12
Converter for MIPS-EJTAG 14 pins to 12 pins

to support Micronas MDE processor
LA-7798
EJTAG MIPS32 Converter 14/24
EJTAG-MIPS32-14/24
Converter for MIPS-EJTAG 14 pins to 24 pins

to support IDT processors
IMPORTANT:
This adpater can also be used for 20 pin
target connections, but a separate wire for
VCC is required. Please ask your local
distributor.
LA-7901
EJTAG MIPS32 Converter Mictor38 to Samtec24
EJTAG-MIPS32-38/24
Converter for Preprocessor for MIPS

Mictor38 to Samtec 24
to support IDT processor
Target connectors:
FTSH-112-04-L-DV (SMD, small height)
FTSH-112-04-L-D (through-hole, small height)
FW-12-05-L-D-XXX-150
(SMD, "XXX" selectable height)
FW-12-02-L-D-XXX-150
(through-hole, "XXX" selectable height)
LA-7903
EJTAG-MIPS32-38/52B

Mictor38 to Samtec52
to support Micronas MDEB (Lexra LX4280) processor
Target connector:
FW-26-05-L-D-XXX-150
FW-26-02-L-D-XXX-150
(through-hole, selectable height)
LA-3845
Conv. Samtec60 to MICTOR38 for MIPS
CON-SAM60-MIC38-MIPS
Converter from SAMTEC60 + JTAG14 to MICTOR38 for

MIPS
77
Products
OrderNo Code
Text
LA-3906
PP-MIPS32-AF-2
Preprocessor for Real-Time Trace of MIPS32

EJTAG 2.6 derivatives or higher
600 MBaud (300MHz clock speed, DDR)
Variable threshold level and termination voltage,
AUTOFOCUS self calibration technology,
Supports 1.2 to 3.3V - otherwise contact support
Requires PowerTrace
(PowerTrace Ethernet Version 6 or higher)
LA-7908
EJTAG-MIPS32-38/52D

to support Micronas MDED (Lexra LX4280) processor
Target connector:
FW-26-05-L-D-XXX-150
FW-26-02-L-D-XXX-150
(through-hole, selectable height)
LA-7909
Converter Mictor38 to Samtec40 for PP-MIPS
CON-MIPS64-38/40
Converter for Preprocessor for MIPS64

to support TOSHIBA RBTX49xx EVBs
LA-3893
MIPS Converter MIPS-14 to MIPI-10/20/34
CONV-MIPS14/MIPI34
Converter to connect a Debug Cable to 10/20/34 pin

connectors specified by MIPI.
Order Information
Order No.
Code
Text
LA-7760
LA-7760A
LA-7761
LA-7761A
LA-7971X
LA-7777
LA-7798
LA-7901
LA-7903
LA-3845
EJTAG-MIPS32
EJTAG-MIPS32-A
EJTAG-MIPS64
EJTAG-MIPS64-A
TRACE-LICENSE-MIPS32
EJTAG-MIPS-14/12
EJTAG-MIPS32-14/24
EJTAG-MIPS32-38/24
EJTAG-MIPS32-38/52B
CON-SAM60-MIC38-MIPS

Trace License for the MIPS32
EJTAG MIPS Converter 14/12
EJTAG MIPS32 Converter 14/24
Conv. Samtec60 to MICTOR38 for MIPS
Additional Options
78
Products
Order No.
Code
Text
LA-3893
LA-3750A
LA-7765A
LA-7746A
LA-7742A
LA-3743A
LA-7843A
LA-7844A
LA-7848A
LA-7774A
LA-3844A
LA-3774A
LA-1370
LA-7960X
CONV-MIPS14/MIPI34
JTAG-ARC-A
JTAG-ARM11-A
JTAG-ARM7-A
JTAG-ARM9-A
JTAG-ARMV8-A-A
JTAG-CORTEX-A/R-A
JTAG-CORTEX_M-A
JTAG-M8051EW-A
JTAG-TEAK-JAM-20-A
JTAG-TEAKLITE-4-A
JTAG-TEAKLITE-III-A
MICTOR-FLEXEXT
MULTICORE-LICENSE

JTAG Debugger License for ARC Add.
JTAG Debugger License for ARM11 Add.
JTAG Debugger Lic. Cortex-A (64-bit) Add.
JTAG Debugger Lic. Cortex-A/-R (32-bit) Add.
JTAG Debugger License for Cortex-M Add.
JTAG Debugger for M8051EW Add.
JTAG Debug. for Teak/TeakLite JAM 20 Add.
JTAG Debugger for TeakLite-4 Add. (ICD)
JTAG Debugger for TeakLite III Add. (ICD)
Mictor Flex Extension
License for Multicore Debugging
Order No.
Code
Text
LA-3906
LA-7908
LA-7909
LA-3893
PP-MIPS32-AF-2
EJTAG-MIPS32-38/52D
CON-MIPS64-38/40
CONV-MIPS14/MIPI34

Converter Mictor38 to Samtec40 for PP-MIPS
Additional Options
LA-7903
EJTAG-MIPS32-38/52B
79
Products

Debugger Mips

Uploaded by

Copyright:

Available Formats

Debugger Mips

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Debugger Mips

Uploaded by

Copyright:

Available Formats

What are some of the different types of breakpoints discussed in the document?

What are some of the different types of breakpoints discussed in the document?

What are some of the options that can be configured using SYStem commands?

What are some of the options that can be configured using SYStem commands?

MIPS Debugger and Trace

TRACE32 Online Help

ICD In-Circuit Debugger ................................................................................................................

Processor Architecture Manuals ..............................................................................................

MIPS Debugger and Trace ...................................................................................................

Brief Overview of Documents for New Users .................................................................

Quick Start of the EJTAG Debugger ................................................................................

CPU specific Implementations .........................................................................................

Instruction Breakpoints (Software Breakpoints)

Instruction Breakpoints in ROM (On-chip Breakpoints)

Breakpoints on Read/Write Access to Data(On-chip Breakpoints)

Example for Standard Breakpoints

SPR Memory Overlay

MIPS specific SYStem Commands ..................................................................................

Configure debugger according to target topology

Define JTAG frequency

Select the used CPU

Run-time memory access (intrusive)

Define JTAG clock

Tristate the JTAG port

Run-time memory access

Establish the communication with the target

Use 32-bit addresses

MIPS Debugger and Trace

Freeze data cache

Use DCACHE for data read

Define disassembler mode

Define endianess of target memory

Control target system reset

Control TAP reset

Set system reset hold time

Define operating mode of RISC TRACE

Freeze system timer in stop mode

Flush of instruction cache during step and go

Use ICACHE for program read

Disable interrupts while ASM single stepping

Disable interrupts while HLL single stepping

Define key code to unsecure processor

Select break synchronization method

Enable multiple address spaces support

Base address for monitor download routine

Sends an unsecure sequence to the core

Halt the core after reset

Use onchip breakpoints for ASM stepping

Use software breakpoints for ASM stepping

Enable fast download

Unprotect memory addresses

Set system reset wait time

On-chip Breakpoints .........................................................................................................

Define an address mask

Extend on-cip breakpoint/trace filter by ASID

Adjust range breakpoint in on-chip resource

Halt at reset vector after core reset

Set on-chip trigger to default state

Halt on exception vector during step

Trace data compression