1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
|
== Debugger commands ==
CMD_DB_GETSTAT (D0h) - Get target status
Get current status of the target. Issue this command at regular
intervals to monitor for breakpoints or exceptions during program
execution.
Arguments:
None.
Response:
[u8] Status byte.
0 - Program stopped
1 - Breakpoint hit/trace complete
2 - Unhandled exception (see CMD_DB_GETREGS to
determine cause of exception via CAUSE)
3 - Running
CMD_DB_GETINFO (D1h) - Get debug monitor info string
Obtain information string of the debug monitor. Normally the
response would be 'PSnDBmk2'.
Arguments:
None.
Response:
[...] Zero terminated string. Transmission ends when a zero
character has been received.
CMD_DB_SETEXEC (D2h) - Execution control
Control program execution on the target.
Arguments:
[u8] Set execution.
0 - stop target
1 - step single instruction
2 - resume execution
Response:
[u8] New target status (see CMD_DB_GETSTAT).
CMD_DB_RUNTO (D3h) - Run to address
Resume execution up to the specified program counter address. If the
trace bit is set, and a non-sequential instruction was encountered
(ie. jump or branch instruction) before the target address is reached,
the monitor will break on the destination address of the non-sequential
instruction instead. Intended for run-to cursor and source level trace
operations- so the destination of a function call, conditional line or
a loop while tracing can be determined.
If a previously defined breakpoint or hard breakpoint (hard-coded break
instruction) was encountered before the target address is reached, the
monitor will break on the breakpoints instead.
This command automatically resumes execution if the target was in a
stopped state.
Arguments:
[u8] Flags.
bit 0 : Trace enable
bit 1-7 : Reserved
[u32] Target program counter address.
Response:
[u8] New execution status (see D0).
CMD_DB_SETBRK (D4h) - Set program breakpoint
Defines a program breakpoint on the specified address. Up to 32 program
breakpoints can be set at a time.
Breakpoints can only be set to writable memory regions as the
breakpoint mechanism works by patching break instructions into the
program text- a modification that is automatically undone and redone
between monitor interactions to appear invisible to the debugging host.
The patched instruction is also undone and immediately redone when
resuming from a breakpoint so program execution continues normally
between each break iteration.
FlushCache() is called to clear the instruction cache whenever
breakpoints get patched and unpatched.
Avoid placing a program breakpoint inside the delay slot of a
non-sequential instruction such as a jump or branch instruction,
otherwise the monitor will not be able to trace or resume execution
from the branch instruction.
Setting a breakpoint to an already existing breakpoint will update
the existing breakpoint with the specified flags and target count,
as well as clearing the breakpoint counter.
Arguments:
[u32] Breakpoint address.
[u16] Flags
Bits 0-1 : Breakpoint mode
0 - No break, but increment counter.
1 - Stop execution when encountered.
2 - Break when counter reaches target value.
3 - Reserved.
Bits 2-15 : Reserved
[u16] Target Count
Response:
[u8] Result byte
0 - Invalid address
1 - Breakpoint set
2 - Breakpoint updated
CMD_DB_CLRBRK (D5h) - Clear program breakpoints
Clears all previously defined program breakpoints.
Arguments:
none
Response:
[u8] Status byte (acknowledge)
CMD_DB_GETREGS (D6h) - Get registers
Obtain all 32 general purpose register values and some special
registers- such as the hi/lo registers, EPC (program counter), CAUSE,
BADVADDR, JUMPDEST and DCIC. Two op-codes from EPC are also retrieved
totalling about 42 32-bit register words.
The value of register k0 is superfluous for it is used immediately by
the jump routines of the exception vectors. Software is not meant to
use the k0/k1 registers as it is used by the kernel's jump vector.
Refer to the LSI L64360 datasheet for details on cop0 registers SR,
CAUSE, BADVADDR, JUMPDEST, and DCIC.
Arguments:
None.
Response:
[u32] 42 Processor register values in the following order:
r0,at,v0,v1,a0,a1,a2,a3,
t0,t1,t2,t3,t4,t5,t6,t7,
s0,s1,s2,s3,s4,s5,s6,s7,
t8,t9,k0,k1,gp,sp,fp,ra,
EPC,hi,lo,
SR,CAUSE,BADVADDR,JUMPDEST,DCIC
opcode(EPC+0),opcode(EPC+4)
CMD_DB_MEM (D7h) - Read/write n bytes from address
Reads or writes n bytes of memory to or from the specified address.
Arguments:
[u8] Operation
0 - read
1 - write
[u32] Read source address/write destination address
[u32] Number of bytes
[u8] Write data of n bytes (only when writing to memory)
Response (only when reading from memory):
[...] Bytes read of specified length.
CMD_DB_WORD (D8h) - Read/write word
Reads or writes a word from memory.
The specified memory address must be aligned to two or four bytes
when performing a 16-bit word or 32-bit memory operation respectively.
Failing to do so will cause an in-monitor exception and crash the
target.
Arguments:
[u8] Operation
0 - read
1 - write
[u8] Word size (0 - [u8], 1 - [u16], 2 - [u32]).
[u32] Memory address.
[u8/u16/u32] Word value to write (only when writing to memory)
Response (only when reading from memory):
[u32] Word value read (always 32-bit regardless of word size).
CMD_DB_GETBRK (D9h) - Get all breakpoints
Returns an array of currently set breakpoints with their flag settings
and counter values.
Arguments:
None.
Response:
[u32] Breakpoint address.
[u16] Breakpoint flag
[u16] Breakpoint counter target value.
[u16] Breakpoint counter.
...
The list is terminated with a breakpoint of address FFFFFFFFh.
CMD_DB_SETREG (DAh) - Set register
Sets any of the register values of the running target.
This command, coupled with CMD_DB_MEM, can be used to upload and
execute a PS-EXE without a loader as long as the monitor program
is installed and responsive. To do this, stop the target with
CMD_DB_SETEXEC, upload the program text to its target address
using CMD_DB_MEM, then use CMD_DB_SETREG to reset the stack pointer
(sp) to the initial stacktop (801FFFF0h) and PC to the program text's
entrypoint (pc0), clear bits 0-5 of the SR register then execute the
program by resuming with CMD_DB_SETEXEC.
Arguments:
[u8] Register number
0 - r0* 1 - at 2 - v0 3 - v1
4 - a0 5 - a1 6 - a2 7 - a3
8 - t0 9 - t1 10 - t2 11 - t3
12 - t4 13 - t5 14 - t6 15 - t7
16 - s0 17 - s1 18 - s2 19 - s3
20 - s4 21 - s5 22 - s6 23 - s7
24 - t8 25 - t9 26 - k0 27 - k1
28 - gp 29 - sp 30 - fp 31 - ra
32 - EPC 33 - hi 34 - lo 35 - SR
* Ignored
[u32] Register value
Response:
[u8] 0 - Response byte
CMD_DB_MEMBRK (DBh) - Set data access breakpoint registers
Set breakpoint registers for memory access operations. Only a single
breakpoint address or a range of addresses with the compare mask can
be set with this command.
The mask register is used to mask which bits between the address of
a memory access operation and the memory breakpoint address are
compared. For example, a mask value of FF000000h compares bits
31-24 of the addresses- the remaining bits are ignored.
To deactivate data access breakpoint, simply set the address, mask
and flags to zero.
Arguments:
[u32] Memory breakpoint address
[u32] Memory breakpoint compare mask
[u8] Breakpoint flags
Bit 0: Break on memory read
Bit 1: Break on memory write
Bit 2-7: Reserved
Response:
[u8] 0 - Response byte
CMD_REBOOT (A0h) - Reboot console
While not necessarily a debug command, it is a convenience command
that allows remote reboot of the target. Soft reboot is performed by
simply jumping to the base address of the BIOS ROM segment, which is
equivalent to pressing the reset button on the console.
Command numbers DC-DFh are not yet defined and are reserved.
== Multiple Program Breakpoints Implementation ==
Because the hardware only supports one software breakpoint at a time,
performing rapid breakpoint cycles on every non-sequential instruction
via the trace bit in DCIC would incur a massive performance penalty and
potentially introduce system instability. Multiple software breakpoints
are instead implemented by patching break instructions to specified
breakpoint locations and the patched instructions are undone when the
original instruction needs to be executed (ie. resume program from break
address). This limits breakpoints to code residing in RAM, but this
method does not incur a performance penalty that can break speed
sensitive code.
|
