     EPI Development Toolkit for ARM Architecture (EDTA)
     Read Me File for MAJIC XScale Support     Sept 2, 2004
========================================================================
(c) Copyright 2002 Embedded Performance Inc.  All rights reserved.




CONTENTS
=======================================

  Introduction
  Target Connection Problems
  XScale CPU switches
  Command Files
  Exception Vectors
  Memory Controller Initialization
  Memory Map Dump Utility
  Virtual to Physical Translation Utility
  WinCE
  Instruction Tracing
  User Defined Register Names
  MAJIC Support For XScale with ARM ADS
  Regression Test
  Feedback




INTRODUCTION
=======================================

This file documents how to use the command files and other related information 
needed for use with the Intel XScale processor.



Intel XScale Processors supported by edta21c SP1:
--------------------------------------------------

    80200
    80321
    80331
    80332
    PXA210
    PXA250
    PXA255
    PXA261
    PXA262
    PXA263
    PXA270
    IXP420
    IXP421
    IXP422
    IXP425
    IXC1100
    IXP2400
    IXP2800
    IXP2850




TARGET CONNECTION PROBLEMS
=======================================

Common reasons why MAJIC will not connect to a XScale target:

  *  JTAG SRST does not assert the XScale nRESET pin.
  *  JTAG TRST does not assert the XScale nTRST pin.
  *  JTAG SRST asserts the XScale nTRST pin.
  *  JTAG connector layed out incorrectly.
  *  Excessive delays in assertion or deassertion of SRST or TRST.
  *  XScale nRESET pin was asserted by watchdog timer, PCI device, or 
     any device other than MAJIC.

Any of the above problems will give the following message(s) upon 
detection of target power:
     "check break failed in save context"
and/or
     "JTAG Write to RX register Timed Out"

These message's occur when MAJIC cannot communicate to the Debug Handler. If 
the connection to your target is working properly and while debugging you get 
this message, you will not be able to continue debugging. To recover you must 
power cycle your target, in some cases you must power cycle both your target 
and the MAJIC to recover.

If you get any of the following ERRORS, you will need to power cycle both your 
target and the MAJIC to recover.

    ERROR: Abort or Retry? (A/R)

    ERROR: Unexpected packet received from target, type x

    ERROR: (x): Unexpected response type (x) from target, expected x

    ERROR: Communications failure (remote not responding)
    ERROR: remote is not responding.  Is power on?
           Enter 'y' to retry or 'n' to quit
    Retry (Y/N) ?



When power cycling the MAJIC, you should (in the following order):

    1.  Exit your debugger.
    2.  Power off your target.
    3.  Power off the MAJIC.
    4.  Wait 2 seconds.
    5.  Power on the MAJIC.
    6.  Power on your target.
    7.  Restart your debugger.

NOTE: You may connect both the MAJIC and your target power supply to a power 
      strip and power both on and off simultaneously.


A common cause of problems while debugging are caused by MAJIC exception 
vector configuration problems, see: EXCEPTION VECTORS for more information.




XSCALE CPU SWITCHES
=======================================

The current version of the MAJIC Setup Wizard supports the following XScale 
processors.

    CPU       -v SWITCH      EPIcpuid
   80200       -v80200       "80200"
   80321       -v80321       "80321"
   80331       -v80331       "80331"
   80332       -v80332       "80332"
   PXA210      -vPXA210      "PXA210"
   PXA250      -vPXA250      "PXA250"
   PXA255      -vPXA255      "PXA255"
   PXA261      -vPXA261      "PXA261"
   PXA262      -vPXA262      "PXA262"
   PXA263      -vPXA263      "PXA263"
   PXA270      -vPXA270      "PXA270"
   IXP420      -vIXP420      "IXP420"
   IXP421      -vIXP421      "IXP421"
   IXP422      -vIXP422      "IXP422"
   IXP425      -vIXP425      "IXP425"
   IXC1100     -vIXC1100     "IXC1100"
   IXP2400     -vIXP2400     "IXP2400"
   IXP2800     -vIXP2800     "IXP2800"
   IXP2850     -vIXP2850     "IXP2850"


EDBICE Shortcut Examples:
..\EPITools\edta11a\bin\edbice.exe -d 192.168.123.1:e -v80200
..\EPITools\edta11a\bin\edbice.exe -d 192.168.123.1:e -vPXA250
..\EPITools\edta11a\bin\edbice.exe -d 192.168.123.1:e -vIXP425


RDIMAJIC.CFG Examples:
      EPIcpuid              "80200"
      EPIcpuid              "80321"
      EPIcpuid              "PXA210"




COMMAND FILES
=======================================

Description of commands files included for XScale.

  XDMP.CMD        Displays a Memory Map Dump of target.
  XLAT.CMD        Displays a Virtual to Physical Translation of target.
  XVT.CMD         Displays Debug handler download settings.

Each of these command files is self documented, users may view and/or make 
changes to these files using a text editor. 

NOTE: Windows NT/2000/XP users, Windows uses the .CMD extension for Windows NT 
      Command Scripts. Double clicking on a EPI command file from Windows 
      Explorer will invoke Windows to execute this file as a Windows NT 
      Command Script. 


A more detailed description of the following commands, can be found in 
sections of this text file as indicated.

  XDMP.CMD        Memory Map Dump
  XLAT.CMD        Virtual to Physical Translation
  
  XVT.CMD         Exception Vectors




EXCEPTION VECTORS
=======================================

Exception Vectors on your XScale target may be a source of problems when using 
a JTAG debugger such as MAJIC. To overcome these problems, MAJIC has built in 
support which allows the user to configure how MAJIC is to handle Exception 
Vectors on your target.

Why users must configure MAJIC to handle Exception Vectors:

This is required because of several XScale debug architecture design features.

  1) The reset vector is overloaded to be the debug exception vector. 
  2) The debug handler is loaded into a special mini-instruction
     cache with a cache line length of 32 bytes.
  3) Because of 1) and 2), ALL of the targets exception vectors will now be
     executed from the special mini-instruction cache.
  4) The mini i-cache is write protected from code running on the target,
     and may only be modified via a JTAG emulator.
  5) Code executing on the target with a virtual address that hits the mini 
     i-cache will execute from the mini i-cache. Code which does a memory 
     access from a virtual address that hits the mini i-cache will do a memory 
     access from the data cache or external memory, not from the mini i-cache.

This means that when the debug handler debug exception vector opcode is 
written to the special mini-instruction cache, we must fill an entire cache 
line, which will hide all exception vectors from execution, but will not from 
a memory dump. 

MAJIC defaults to loading the exception vectors found at physical address 
0x4-0x1C into the special mini i-cache. This only works if the exception 
vectors always remain the same, and does not work if the exception vectors at 
virtual address 0x4-0x1C are not the same as the vectors at physical address 
0x4-0x1C. To overcome this problem, the user must specify what exception 
vectors opcodes MAJIC is to download to mini i-cache. This is done in the 
USER_VECTORS_LO and/or USER_VECTORS_HI sections. User must also select 
eo vector_load_low = user in the USER_OPTIONS section. 

NOTE: This normally works fine, but only if the exception vectors at Physical 
Address 0x4-0x1C don't get executed prior to enabling the MMU and using the 
vector table at Virtual Address 0x4-0x1C. To solve this problem, use the 
method described below "Changing vectors on the fly". 



Changing vectors on the fly:
----------------------------
User code should not modify the XScale exception vectors on the fly, what 
should be done instead, is change the value in memory which is loaded into the 
PC for that exception. 

 Example:
   00000004:      e59ff3d8    LDR    pc, 0x03E4        //NEVER MODIFY
   [Repeat for each Exception]

   //Original Undefined Instruction vector jump entry
   000003E4:      80001000                             //MODIFY OK

   //New Improved Undefined Instruction vector jump entry
   000003E4:      80008000                             //MODIFY OK


If the target OS or kernel MUST modify the exception vectors, and the above 
method can NOT be done, use one of the two following workarounds.


Support for Exception vectors which must change:

WORKAROUND #1: 
Put a breakpoint after the section of code that modifies the exception 
vectors, the vector_load_low or vector_load_high EO option(s) must be set = 
target. Doing a target GO or STEP will reload the exception vectors in the 
mini I-cache with those found in target memory at virtual address 0x0-0x1C 
and/or 0xFFFF0000-0xFFFF001C.


WORKAROUND #2: 
With MAJIC firmware version 3.2.7.20 and later, functionality was added to
support exception vectors which must change. This may be done by doing the 
following:

  //Enter the following cmd in you board init .cmd file.
 eo vector_load_low = target    //If low vector table code changes.
 eo vector_load_high = target   //If high vector table code changes.

 Embed a "BKPT 0X1234" instruction in your code so that it is executed after
 the code at the exception vectors has changed, but prior to a exception
 occurring with the changed vectors.

The "BKPT 0X1234" instruction will behave as a NOP if MAJIC is not connected,
when MAJIC is connected, it will act like a software breakpoint was hit,
except that is ignored and execution will automatically resume. If
vector_load_low or vector_load_high = target, MAJIC will then load the debug
mini I-cache with the values found in memory at that time.



Connect MAJIC non-intrusively:
------------------------------
To connect MAJIC to a XScale based target non-intrusively, you must link 
the Intel Hot-Debug code into the target's reset handler routine. This code 
can be found in the "Hot-Debug for Intel XScale core document" (27353902.pdf). 
Set XYN_LOAD_VECTORS = NO, in the USER_OPTIONS Section. 

NOTE: Support for Hot-Debug requires MAJIC firmware version 3.2.3 or greater.




MEMORY CONTROLLER INITIALIZATION
=======================================

Memory controller initialization is required to run the EPI supplied sample 
executable (EPI flash and native memory test utilities). 

Initializing the memory controller on your target is done via target init 
command files found in the ...epitools\edta21c\targets directory. For XScale, 
those directories which do not end in _mv, _vx, _wince, _vx, _linux, ... will 
initialize the memory controller for the reference target indicated by the 
directory name. If your target memory system is not identical to a reference 
target in one of the supplied reference directories, you will need to make 
modifications to the
 "//  Memory Controller Initialization"
section in the .cmd file of the same name as the directory.

NOTE: If you must modify any command files in the .\targets directory, we 
strongly recommend that you make a copy of the directory and rename it to be 
unique. This will prevent any user modified files from being overwritten by 
any future updates/service packs.

Initializing the memory controller on your target may also be done by running 
the firmware present in flash. To do this, do a GO from the reset vector, then 
do a STOP after a second or two, for some targets it may require more than 
a minute.




MEMORY MAP DUMP UTILITY
=======================================

A MMU Translation Table memory map dump of your target may be displayed in 
your EDB or MON session window using the MMU_DUMP alias (which executes the
XDMP.CMD command file).

The XDMP command file will dump a target memory map regardless of wether the 
MMU is enabled or not, and shows how the MMU would map Virtual memory to 
Physical memory assuming the MMU were enabled. If the MMU is not enabled at 
the time of the dump then read or writes to Virtual addresses would map 
one-to-one with Physical.


Usage: fr c xdmp          (dumps mixed table)
       fr c xdmp 0        (dumps mixed table)
       fr c xdmp 1        (dumps mixed and mapped tables)
       fr c xdmp 2        (dumps mixed and not mapped tables)
       fr c xdmp 3        (dumps mixed, mapped and not mapped tables)
       fr c xdmp x x      (any second arg displays MMU Table Help Information)



Sample output from MMU dump with MMU Table Information:
-------------------------------------------------------

MON> mmu_dump 3 x
 or
MON> fr c xdmp 3 x

                              XScale Memory Map

      Virtual              Physical        MAP  L1-D   L2-D  DMF  DM  AP  CB  X
00000000 - bfffffff    ------  -  ------    N   INV    INV    0   1   0   0   0
c0000000 - c0ffffff   a0000000 - a0ffffff   Y   SECT   ----   1   3   1   3   1
c1000000 - c17fffff    ------  -  ------    N   INV    INV    0   1   0   0   0
c1800000 - c1800fff   a0ff0000 - a0ff0fff   Y   CRSE   XSML   1   3   1   3   1
c1801000 - c1801fff   a0fef000 - a0feffff   Y   CRSE   XSML   1   3   1   3   1
c1802000 - c1802fff   a0fee000 - a0feefff   Y   CRSE   XSML   1   3   1   3   1
c1803000 - c1803fff   a0fed000 - a0fedfff   Y   CRSE   XSML   1   3   1   3   1
c1804000 - c1804fff   a0fec000 - a0fecfff   Y   CRSE   XSML   1   3   1   3   1
c1805000 - c1805fff   a0feb000 - a0febfff   Y   CRSE   XSML   1   3   1   3   1
c1806000 - c1806fff   a0fea000 - a0feafff   Y   CRSE   XSML   1   3   1   3   1
c1807000 - c1807fff   a0fe9000 - a0fe9fff   Y   CRSE   XSML   1   3   1   3   1
c1808000 - c1808fff   a0fe8000 - a0fe8fff   Y   CRSE   XSML   1   3   1   3   1
c1809000 - c1809fff   a0fe7000 - a0fe7fff   Y   CRSE   XSML   1   3   1   3   1
c180a000 - c180afff   a0fe6000 - a0fe6fff   Y   CRSE   XSML   1   3   1   3   1
c180b000 - c180bfff   a0fe5000 - a0fe5fff   Y   CRSE   XSML   1   3   1   3   1
c180c000 - c180cfff    ------  -  ------    N   CRSE   INV    1   3   0   0   0
c180d000 - c18a3fff   a0e00000 - a0e96fff   Y   CRSE   XSML   1   3   1   0   0
c18a4000 - c18fffff    ------  -  ------    N   CRSE   INV    1   3   0   0   0
c1900000 - efffffff    ------  -  ------    N   INV    INV    0   1   0   0   0
f0000000 - f00fffff   08000000 - 080fffff   Y   SECT   ----   2   1   3   0   0
f0100000 - f0ffffff    ------  -  ------    N   INV    INV    0   1   0   0   0
f1000000 - f10fffff   10000000 - 100fffff   Y   SECT   ----   2   1   3   0   0
f1100000 - f11fffff   12000000 - 120fffff   Y   SECT   ----   2   1   3   0   0
f1200000 - f1ffffff    ------  -  ------    N   INV    INV    0   1   0   0   0
f2000000 - f2ffffff   14000000 - 14ffffff   Y   SECT   ----   2   1   3   0   0
f3000000 - f3ffffff    ------  -  ------    N   INV    INV    0   1   0   0   0
f4000000 - f41fffff   00000000 - 001fffff   Y   SECT   ----   2   1   3   0   0
f4200000 - f5ffffff    ------  -  ------    N   INV    INV    0   1   0   0   0
f6000000 - f6ffffff   20000000 - 20ffffff   Y   SECT   ----   2   1   3   0   0
f7000000 - f7ffffff   30000000 - 30ffffff   Y   SECT   ----   2   1   3   0   0
f8000000 - fbffffff    ------  -  ------    N   INV    INV    0   1   0   0   0
fc000000 - fdffffff   40000000 - 41ffffff   Y   SECT   ----   2   1   1   0   0
fe000000 - feffffff   44000000 - 44ffffff   Y   SECT   ----   2   1   1   0   0
ff000000 - ffefffff   48000000 - 48efffff   Y   SECT   ----   2   1   1   0   0
fff00000 - fffeffff    ------  -  ------    N   CRSE   INV    0   1   0   0   0
ffff0000 - ffff0fff   a0001000 - a0001fff   Y   CRSE   XSML   0   1   0   2   1
ffff1000 - ffffffff    ------  -  ------    N   CRSE   INV    0   1   0   0   0


                              XScale Memory Map  (MAPPED)

      Virtual              Physical        MAP  L1-D   L2-D  DMF  DM  AP  CB  X
c0000000 - c0ffffff   a0000000 - a0ffffff   Y   SECT   ----   1   3   1   3   1
c1800000 - c1800fff   a0ff0000 - a0ff0fff   Y   CRSE   XSML   1   3   1   3   1
c1801000 - c1801fff   a0fef000 - a0feffff   Y   CRSE   XSML   1   3   1   3   1
c1802000 - c1802fff   a0fee000 - a0feefff   Y   CRSE   XSML   1   3   1   3   1
c1803000 - c1803fff   a0fed000 - a0fedfff   Y   CRSE   XSML   1   3   1   3   1
c1804000 - c1804fff   a0fec000 - a0fecfff   Y   CRSE   XSML   1   3   1   3   1
c1805000 - c1805fff   a0feb000 - a0febfff   Y   CRSE   XSML   1   3   1   3   1
c1806000 - c1806fff   a0fea000 - a0feafff   Y   CRSE   XSML   1   3   1   3   1
c1807000 - c1807fff   a0fe9000 - a0fe9fff   Y   CRSE   XSML   1   3   1   3   1
c1808000 - c1808fff   a0fe8000 - a0fe8fff   Y   CRSE   XSML   1   3   1   3   1
c1809000 - c1809fff   a0fe7000 - a0fe7fff   Y   CRSE   XSML   1   3   1   3   1
c180a000 - c180afff   a0fe6000 - a0fe6fff   Y   CRSE   XSML   1   3   1   3   1
c180b000 - c180bfff   a0fe5000 - a0fe5fff   Y   CRSE   XSML   1   3   1   3   1
c180d000 - c18a3fff   a0e00000 - a0e96fff   Y   CRSE   XSML   1   3   1   0   0
f0000000 - f00fffff   08000000 - 080fffff   Y   SECT   ----   2   1   3   0   0
f1000000 - f10fffff   10000000 - 100fffff   Y   SECT   ----   2   1   3   0   0
f1100000 - f11fffff   12000000 - 120fffff   Y   SECT   ----   2   1   3   0   0
f2000000 - f2ffffff   14000000 - 14ffffff   Y   SECT   ----   2   1   3   0   0
f4000000 - f41fffff   00000000 - 001fffff   Y   SECT   ----   2   1   3   0   0
f6000000 - f6ffffff   20000000 - 20ffffff   Y   SECT   ----   2   1   3   0   0
f7000000 - f7ffffff   30000000 - 30ffffff   Y   SECT   ----   2   1   3   0   0
fc000000 - fdffffff   40000000 - 41ffffff   Y   SECT   ----   2   1   1   0   0
fe000000 - feffffff   44000000 - 44ffffff   Y   SECT   ----   2   1   1   0   0
ff000000 - ffefffff   48000000 - 48efffff   Y   SECT   ----   2   1   1   0   0
ffff0000 - ffff0fff   a0001000 - a0001fff   Y   CRSE   XSML   0   1   0   2   1


                              XScale Memory Map  (NOT MAPPED)

      Virtual              Physical        MAP  L1-D   L2-D  DMF  DM  AP  CB  X
00000000 - bfffffff    ------  -  ------    N   INV    INV    0   1   0   0   0
c1000000 - c17fffff    ------  -  ------    N   INV    INV    0   1   0   0   0
c180c000 - c180cfff    ------  -  ------    N   CRSE   INV    1   3   0   0   0
c18a4000 - c18fffff    ------  -  ------    N   CRSE   INV    1   3   0   0   0
c1900000 - efffffff    ------  -  ------    N   INV    INV    0   1   0   0   0
f0100000 - f0ffffff    ------  -  ------    N   INV    INV    0   1   0   0   0
f1200000 - f1ffffff    ------  -  ------    N   INV    INV    0   1   0   0   0
f3000000 - f3ffffff    ------  -  ------    N   INV    INV    0   1   0   0   0
f4200000 - f5ffffff    ------  -  ------    N   INV    INV    0   1   0   0   0
f8000000 - fbffffff    ------  -  ------    N   INV    INV    0   1   0   0   0
fff00000 - fffeffff    ------  -  ------    N   CRSE   INV    0   1   0   0   0
ffff1000 - ffffffff    ------  -  ------    N   CRSE   INV    0   1   0   0   0


                              XScale Memory Map  (MAPPED)
                             (Sorted by Physical Address)

      Virtual              Physical        MAP  L1-D   L2-D  DMF  DM  AP  CB  X
f4000000 - f41fffff   00000000 - 001fffff   Y   SECT   ----   2   1   3   0   0
f0000000 - f00fffff   08000000 - 080fffff   Y   SECT   ----   2   1   3   0   0
f1000000 - f10fffff   10000000 - 100fffff   Y   SECT   ----   2   1   3   0   0
f1100000 - f11fffff   12000000 - 120fffff   Y   SECT   ----   2   1   3   0   0
f2000000 - f2ffffff   14000000 - 14ffffff   Y   SECT   ----   2   1   3   0   0
f6000000 - f6ffffff   20000000 - 20ffffff   Y   SECT   ----   2   1   3   0   0
f7000000 - f7ffffff   30000000 - 30ffffff   Y   SECT   ----   2   1   3   0   0
fc000000 - fdffffff   40000000 - 41ffffff   Y   SECT   ----   2   1   1   0   0
fe000000 - feffffff   44000000 - 44ffffff   Y   SECT   ----   2   1   1   0   0
ff000000 - ffefffff   48000000 - 48efffff   Y   SECT   ----   2   1   1   0   0
c0000000 - c0ffffff   a0000000 - a0ffffff   Y   SECT   ----   1   3   1   3   1
ffff0000 - ffff0fff   a0001000 - a0001fff   Y   CRSE   XSML   0   1   0   2   1
c180d000 - c18a3fff   a0e00000 - a0e96fff   Y   CRSE   XSML   1   3   1   0   0
c180b000 - c180bfff   a0fe5000 - a0fe5fff   Y   CRSE   XSML   1   3   1   3   1
c180a000 - c180afff   a0fe6000 - a0fe6fff   Y   CRSE   XSML   1   3   1   3   1
c1809000 - c1809fff   a0fe7000 - a0fe7fff   Y   CRSE   XSML   1   3   1   3   1
c1808000 - c1808fff   a0fe8000 - a0fe8fff   Y   CRSE   XSML   1   3   1   3   1
c1807000 - c1807fff   a0fe9000 - a0fe9fff   Y   CRSE   XSML   1   3   1   3   1
c1806000 - c1806fff   a0fea000 - a0feafff   Y   CRSE   XSML   1   3   1   3   1
c1805000 - c1805fff   a0feb000 - a0febfff   Y   CRSE   XSML   1   3   1   3   1
c1804000 - c1804fff   a0fec000 - a0fecfff   Y   CRSE   XSML   1   3   1   3   1
c1803000 - c1803fff   a0fed000 - a0fedfff   Y   CRSE   XSML   1   3   1   3   1
c1802000 - c1802fff   a0fee000 - a0feefff   Y   CRSE   XSML   1   3   1   3   1
c1801000 - c1801fff   a0fef000 - a0feffff   Y   CRSE   XSML   1   3   1   3   1
c1800000 - c1800fff   a0ff0000 - a0ff0fff   Y   CRSE   XSML   1   3   1   3   1

ROM Protection         : 0
System Protection      : 1
Control Register       : 0000397f
PID Register           : 00000000
Translation Base Addr  : a0004000
Domain Access Register : 0000001d
Entries - Mapped       : 25
Entries - Not Mapped   : 12
Entries - Both         : 37

  MAJIC XScale MMU Page Table Dump

    L1-D  = Level 1 Descriptor Type
    L2-D  = Level 2 Descriptor Type
    DMF   = Domain Field
    DM    = Domain Access bits (from Domain Access Control Register)
    AP    = Access Permission bits
    CB    = Cache and Bufferability bits
    X     = X-bit, Includes TEX bits (XScale only)
    MAP   = Y, MMU Translation Passed,
            Virtual Addresses map to Physical Addresses
    MAP   = N, MMU Translation Failed,
            Virtual Addresses do NOT map to Physical Addresses

  Level 1 Descriptor Types
    INV   = Invalid descriptor
    CRSE  = Coarse page table descriptor
    SECT  = Section descriptor
    FINE  = Fine page table descriptor

  Level 2 Descriptor Types
    INV   = Invalid descriptor
    LRGE  = Large page table descriptor
    SMAL  = Small page table descriptor
    XSML  = Extended Small page table descriptor (XScale only)
    TINY  = Tiny page table descriptor
    ----  = No Level 2 descriptor for section descriptor

  Domain Access bits
    0  =  No access
    1  =  Client
    2  =  Reserved
    3  =  Manager

  Access Permission bits
          Privileged            User
          Permissions        Permissions
    0  =  Permission dependent on S and R bits
    1  =  Read/Write          No Access
    2  =  Read/Write          Read Only
    3  =  Read/Write          Read/Write






VIRTUAL TO PHYSICAL TRANSLATION UTILITY
=======================================

A Single Virtual to Physical Address Translation dump of your target may be 
displayed in your EDB or MON session window using the MMU_XLATE alias (which 
executes the XLAT.CMD command file).

The XLAT command file can display either a simple or detailed translation 
of a single virtual address. The detailed translation will show a break down 
of the page table descriptors used in the translation. The detailed break 
down uses the same names and terminology as those found in the ARM Technical 
reference manual.

The MMU must be enabled for XLAT to work, if it is not you will get:
  MMU is Not Enabled - Translation Aborted


Usage: fr c xlat 1000      (Display a simple Translation)
       fr c xlat 1000 X    (Display a detailed Translation)



Sample output for simple Translation: 
-------------------------------------

MON> mmu_xlate 9004C7C0
 or
MON> fr c xlat 9004C7C0

  Virtual Address       :  9004C7C0
  Physical Address      :  0004C7C0




Sample output for Detailed Translation: 
---------------------------------------

MON> mmu_xlate 9004C7C0 x

  Virtual  Address      :  9004C7C0
  Physical Address      :  0004C7C0
  Translation Base Addr :  A0100000
  1st Level Dscrptr Addr:  A0102400
  2nd Level Dscrptr Addr:   ------ 
  1st Level Descriptor  :  0000040E  SECTION
  2nd Level Descriptor  :   ------   ----

1st Level Descriptor Address Break Down
  1st Level Dscrptr Addr:  A0102400
  Translation Base Addr :  A0100000
  Translation Base Mask :  FFFFC000
     Table Index [13:0] :      2400
  VA Table Index [31:20]:  90000000
  VA Table Idx Bit Mask :  FFF00000
  VA Table Idx Shift Val:  18

Physical Address Break Down
   Physical Address     :  0004C7C0
   Base Address         :  00000000
   Base Address Mask    :  FFF00000
   Section Index        :     4C7C0
   Section Index Mask   :  000FFFFF

  TEX Bits (X-Bit)      :  0
  CB Bits               :  3
  Subpage               :  NA
  Domain Field          :  0
  Domain Access         :  1
  Domain Access Register:  00000001
  Access Permission     :  1
  PID Register          :  00000000




WinCE
=======================================

Support for WinCE using Microsoft's Platform Builder is provided by the EPI 
eXDI Driver. See the MAJIC eXDI User's Guide (majic_exdi.pdf) for more 
detailed information.



Hardware Breakpoints:
---------------------
Of the two hardware breakpoints in XScale, one is used for stepping, leaving 
only one free for the user.



Stepping - User Application Code:
---------------------------------
Stepping User Application code in the source code window requires that the 
Modules and Symbols window be active, stepping Kernel source does not. The 
"Auto Refresh on Step" option must also be selected.

If you get the Error Message "No hardware breakpoints are available" (from the 
EPI MAJIC eXDI Monitor) you must remove one or more of your hardware 
breakpoints. NOTE: Of the two hardware breakpoints available in XScale, one is 
used for stepping, leaving only one free for the user.



Setting Breakpoints in User Application Code:
---------------------------------------------
Setting a breakpoint in your WinCE User Application code prior to loading may 
only be done with a Hardware breakpoint that has the breakpoint address hard 
coded with the PID OR'd in. This Hardware breakpoint should be the first 
breakpoint in your code, other software breakpoints may be set 



Tracing: 
--------
User Application trace Addresses includes the PID. Example: If your 
Application is at address 0x00011000 and the PID is 0x08000000 the address 
displayed in the Trace window will be 0x08011000.



Known Issues:
-------------

Issue #1:
There is a known problem with stepping and tracing code which the WinCE kernel 
has invalidated the page table entry for. This occurs when the ITLB is 
still valid for the invalidated page table entry, and there is no
corresponding DTLB. The result is, you can execute code which can not be 
traced, read, written, dumped or stepped. NOTE: Stepping or tracing kernel 
code does not have this problem.

Currently the only work around for this problem is to do a GO.

To see all page table entries: do a "mmu_dump" from the eXDI MON> command line 
prompt.



Issue #2:
There is a known problem with setting a software breakpoint in THUMB code 
when using MAJIC with PB. The current workaround is to use a hardware 
breakpoint or recompile your code to be ARM.




INSTRUCTION TRACING
=======================================

On-chip trace support requires a MAJIC-MX or MAJIC-PLUS, EPI's low cost MAJIC 
JTAG emulator does not have on-chip trace support.



Controlling XScale Trace Acquisition:
-------------------------------------
Trace Acquisition for XScale's on-chip trace has virtually no Trace Control 
hardware, see XScale specific Tracing limitations. Tracing starts immediately 
upon RUN and stops when a breakpoint is hit, user stops execution, or when 
the trace buffer is full (which is the only trace control feature). 

XScale's on-chip trace buffer may be set up to wrap around or break when full.
This is done with the  eo trace_trigger_action  option:
    eo trace_trigger_action = stop     (wrap around mode)
    eo trace_trigger_action = start    (break when full mode)

NOTE: You may abbreviate all eo options with the first letter of each word,
      example:  eo tta = stop



Tracing THUMB code:
-------------------
Because XScale provides NO Trace information to indicate that the code traced 
is ARM or THUMB. The trace_inst16 eo option has been added to allow the user 
to specify that the trace data should be decoded and displayed as ARM or THUMB 
code. For best results only ARM or THUMB code should be traced. A mix of ARM 
and THUMB code can NOT be correctly decoded and displayed, but may still 
display some useful trace information. This option may be changed between ON 
and OFF to display the trace data as ARM or THUMB, and may be changed at 
anytime before or after the collection or display of the trace data.

    eo trace_inst16 = on     (Display Trace as THUMB code)
    eo trace_inst16 = off    (Display Trace as ARM code)



XScale specific Tracing limitations:
-----------------------------------

    NO Trace Control Hardware for Trace Acquisition.

    Trace Points are not supported.

    Trace Trigger is not supported.

    Conditional Tracing is not supported.

    Tracing of Data is not supported.

    Time Stamp information is not available.

    On-chip trace buffer is fixed at 256 bytes.

    Processor must be stopped to retrieve on-chip trace data.

    Processor must be stopped to start tracing.

    Modified Virtual Address (MVA) is not broadcast for code that uses PID.

    NO Trace information to indicate that the code traced is ARM or THUMB.



NOTE: The above limitations are a function of the Intel XScale processor and 
      is not a limitation of the MAJIC.



Tracing limitations:
--------------------

    Code that is paged or swapped out of memory can NOT be Traced.
    
    Self modifying code can NOT be Traced.

    Can NOT correctly decode trace if the process (PID) changes.

    Only ARM or THUMB code is supported for trace. Because the XScale 
    processor does not provide trace information to indicate that the code 
    traced is ARM or THUMB. A mixture of ARM and THUMB code can NOT currently 
    be displayed correctly.



NOTE:
The current version of the MAJIC firmware does not support the displaying of 
RAW trace information for XScale in EPI's EDB or MONICE, you may select to 
view RAW trace, but the values displayed are not correct. If RAW trace 
information is critical please contact support.



Known Issues:
-------------
NONE: 


Please see Chapter 6 of the MAJIC user's manual for more information on 
tracing.




USER DEFINED REGISTER NAMES
=======================================

User defined register names and register display windows.

The registers window supports displaying of the general purpose and 
Coprocessor registers. NOTE: See "Known Problems:" and "EDB (Source Level 
Debugger) NOTES:" in the readme.txt file.

See the latest EDB User Manual in ./manuals/edb.pdf "Custom Registers and 
Register Windows" for full details. 


Loading register names files:
-----------------------------
Register names files are automatically loaded when monice or edbice is 
executed, the -vcpu switch must match the filename (less .rd). For XScale and 
other ARM processors, these register names files must be located in the 
.\xxx\bin\arm directory.


The following .RD files are automatically loaded:

               -vcpu switch
  80200.RD       -v80200
  80321.RD       -v80321
  80331.RD       -v80331
  80332.RD       -v80332

  IXP420.RD      -vIXP420
  IXP421.RD      -vIXP421
  IXP422.RD      -vIXP422
  IXP425.RD      -vIXP425
  IXC1100.RD     -vIXC1100
  IXP2400.RD     -vIXP2400
  IXP2800.RD     -vIXP2800
  IXP2850.RD     -vIXP2850

  PXA210.RD      -vpxa210
  PXA250.RD      -vpxa250
  PXA255.RD      -vPXA255
  PXA261.RD      -vPXA261
  PXA262.RD      -vPXA262
  PXA263.RD      -vPXA263
  PXA270.RD      -vPXA270
  

  XSCALE.RD      This RD file is loaded from a INCLUDE "XSCALE.RD" command 
                 embedded within each of the automatically loaded RD files.

  80312.RD       Loaded using  "fr rd 80312.rd" from a command file or command 
                 line prompt.


The above .RD files may be edited, modified or used as a guide for adding 
your own register names and display windows.




MAJIC SUPPORT FOR XSCALE WITH ARM ADS
=======================================

MAJIC for ARM ADS support is provided thru RDIMAJIC.DLL and RDIMAJIC.CFG,
these files are located in the .\rdi directory and must be copied to your ARM 
ADS bin directory (done automatically with MAJICSetupWizard). Use the
MAJICSetupWizard to configure the RDIMAJIC.CFG file to support your 
MAJIC IP address, target cpu and endian type.

Setup of RDIMAJIC is covered in the RDIMAJIC User Manual.

Support for XScale and your MAJIC must be added to the following sections
within RDIMAJIC.CFG.
//  Device Definition Section
//  RDI Device Definition Section
//  Controller Definition Section


Example:

//  Device Definition Section
//  This may be copied as is for little endian.
Define Device XSCALELittle
        Family              "CPU"
        Class               "ARM"
        ISA                 "ARM9"
        Part                "80200"
        Vendor              "Intel"
        Endian              Little
        EPIcpuid            "80200"


//  RDI Device Definition Section
//  Edit MAJICX and COM1 per your setup
Define RDIDeviceList
    DevName         "MAJIC XScale Little Endian via MAJICX"
        Device      XScaleLittle
        Controller  MAJICX

    DevName         "MAJIC XScale Little Endian via COM1"
        Device      XScaleLittle
        Controller  MAJIC_COM1


//  Controller Definition Section
//  Edit MAJICX, IP address, and COM1 per your setup
Define Controller MAJICX
       Port         "192.168.123.1:e"
       Speed        3
       CommandFile  "startice.cmd"

Define Controller MAJIC_COM1
       Port         "com1"
       Speed        7
       CommandFile  "startice.cmd"




REGRESSION TEST
=======================================

To run Regression Test:
   Goto your ...\EPITools\edta11a\ice\majic.318.10\reg_test directory.
   Execute monice:
   Example:     monice -d  192.168.123.1:e -v80200 -L
                (NOTE: Use the monice.exe in the reg_test directory)

   Syntax:      fr c reg_test  #
               (where # is the number of times (base 16) to run
                the test, with blank for once, 0 for forever)
   At MON>  prompt:
   Example:     fr c reg_test
   Example:     fr c reg_test  5
   Example:     fr c reg_test  0


   The regression test known good files are located in:
      ...ice\majic.318.10\reg_test\ref\xscale
      ...ice\majic.318.10\reg_test\ref\lubbock
      ...ice\majic.318.10\reg_test\ref\xs_adi
   NOTE: reg_test.out will indicate which directory the
         known good file(s) can be found in.

   The regression test output files are located in:
      ...ice\majic.318.10\reg_test\output\

   The compared results of the reg_test are in:
      ...ice\majic.318.10\reg_test\reg_test.out


XScale Targets Supported:
     ADI 80200EVB
     Intel IQ80310  (redboot.bin Ver 1.24 (09-13-2001) required)
     Intel IQ80321
     Intel Lubbock  (POST Version 1.01.002 to 1.01.006 required)
     Accelent Systems PXA250


Regression Test consists of the following files.

find.cmd:
Tests the emulator's find function.

memacc.cmd:
Test of the emulator's ability to access different memory regions
by each of the memory access methods.  Note that word accesses are
tested as a side effect of PWD mode.

mv_byte.cmd:
Test of the emulator's ability to move BYTES between:  memory and register,
memory and memory, register and register, with numerous permutations of
overlapped, non-overlapped, destructive, and non-destructive.

mv_hword.cmd:
Test of the emulator's ability to move HALF WORDS between: memory and register,
memory and memory, register and register, with numerous permutations of
overlapped, non-overlapped, destructive, and non-destructive.

mv_word.cmd:
Test of the emulator's ability to move WORDS between: memory and register,
memory and memory, register and register, with numerous permutations of
overlapped, non-overlapped, destructive, and non-destructive.

register.cmd:
Test of the emulator's ability to access different register spaces.

revision.cmd:
Verifies that the MON and F/W revisions match those used to create the
reference files, and also displays the emulator's self test status.

step.cmd:
Test of the emulator's ability to step ARM code, non-exhaustive with
s - step command.

stepover.cmd:
Test of the emulator's ability to step ARM code, non-exhaustive with
s - step, so - step over, sf - step forward commands.

step_arm.cmd:
Test of the emulator's ability to step ARM code, exhaustive with 
sfv - step forward verbose command.

step_thm.cmd:
Test of the emulator's ability to step THUMB code, exhaustive with
sfv - step forward verbose command.

swbp.cmd:
Tests the emulator's management of software breakpoints.

xtrace.cmd:
Test of the emulator's ability to Trace ARM code (XScale ONLY), exhaustive.



Sample output of reg_test.out with NO errors:
---------------------------------------------


Test Suite: MAJIC/MAJIC+, little endian, lubbock, loop 1 time(s)


<<<Checking test results from pass #1>>>

Comparing files OUTPUT\revision.out and REF\XSCALE\REVISION.GUD
FC: no differences encountered

Comparing files OUTPUT\reg_lub1.out and REF\LUBBOCK\REG_LUB1.GUD
FC: no differences encountered

Comparing files OUTPUT\memacc.out and REF\XSCALE\MEMACC.GUD
FC: no differences encountered

Comparing files OUTPUT\swbp_lub1.out and REF\LUBBOCK\SWBP_LUB1.GUD
FC: no differences encountered

Comparing files OUTPUT\step.out and REF\LUBBOCK\STEP.GUD
FC: no differences encountered

Comparing files OUTPUT\stepover.out and REF\LUBBOCK\STEPOVER.GUD
FC: no differences encountered

Comparing files OUTPUT\find.out and REF\XSCALE\FIND.GUD
FC: no differences encountered

Comparing files OUTPUT\mv_byte.out and REF\XSCALE\MV_BYTE.GUD
FC: no differences encountered

Comparing files OUTPUT\mv_hword.out and REF\XSCALE\MV_HWORD.GUD
FC: no differences encountered

Comparing files OUTPUT\mv_word.out and REF\XSCALE\MV_WORD.GUD
FC: no differences encountered

Comparing files OUTPUT\step_arm.out and REF\LUBBOCK\STEP_ARM.GUD
FC: no differences encountered

Comparing files OUTPUT\step_thm.out and REF\LUBBOCK\STEP_THM.GUD
FC: no differences encountered

Comparing files OUTPUT\xtrace.out and REF\LUBBOCK\XTRACE.GUD
FC: no differences encountered





FEEDBACK
=======================================

If you have feedback on the Software Development Toolkit, please contact
either EPI or your distributor (if outside USA).  You can send feedback via:

    email: support@epitools.com
    web:   <http://www.epitools.com>, click on the Support link
    Voice: 408 957-0350
    Fax:   408 957-0307

In order to help us respond quickly to your support needs, please provide
the following details with your question(s):

  - an explanation of what you expected to happen, and what actually
    happened.

  - details of your host computer, EPI toolkit release number, and the
    particular product's release number (see sign on banner or about box).  

  - log file or sample code that demonstrates the problem

  - output generated by running the command file ./bin/support.cmd file,
    so that we can see *everything* about your MAJIC configuration.
