README.TXT ----------------------------------------------------- FS2 System Analyzer for the Geode GX and LX Processors Copyright (C) 1998-2005 First Silicon Solutions, Inc. Copyright (C) 2006 MIPS Technologies, Inc. All rights reserved. Unpublished rights (if any) reserved under the copyright laws of the United States of America and other countries. The copyright notices provided herein apply to the files included in this directory and any and all subdirectories. The files included in this directory and any and all subdirectories contain information (the "Information") that is proprietary to MIPS Technologies, Inc. ("MIPS Technologies"). Any copying, reproducing, modifying or use of the Information (in whole or in part) that is not expressly permitted in writing by MIPS Technologies or an authorized third party is strictly prohibited. At a minimum, the Information is protected under unfair competition and copyright laws. Violations thereof may result in criminal penalties and fines. Any Information provided as a document in source format (i.e., in a modifiable form such as in FrameMaker or Microsoft Word format) is subject to use and distribution restrictions that are independent of and supplemental to any and all confidentiality restrictions. UNDER NO CIRCUMSTANCES MAY A DOCUMENT PROVIDED IN SOURCE FORMAT BE DISTRIBUTED TO A THIRD PARTY IN SOURCE FORMAT WITHOUT THE EXPRESS WRITTEN PERMISSION OF MIPS TECHNOLOGIES, INC. MIPS Technologies reserves the right to change the Information to improve function, design or otherwise. MIPS Technologies does not assume any liability arising out of the application or use of the Information, or of any error or omission in such information. Any warranties, whether express, statutory, implied or otherwise, including but not limited to the implied warranties of merchantability or fitness for a particular purpose, are excluded. Except as expressly provided in any written license agreement from MIPS Technologies or an authorized third party, the furnishing of the Information does not give recipient any license to any intellectual property rights, including any patent rights, that cover the Information. The Information shall not be exported, reexported, transferred, or released, directly or indirectly, in violation of the law of any country or international law, regulation, treaty, Executive Order, statute, amendments or supplements thereto. Should a conflict arise regarding the export, reexport, transfer, or release of the Information, the laws of the United States of America shall be the governing law. The Information constitutes one or more of the following: commercial computer software, commercial computer software documentation or other commercial items. If the user of the Information, or any related documentation of any kind, including related technical data or manuals, is an agency, department, or other entity of the United States government ("Government"), the use, duplication, reproduction, release, modification, disclosure, or transfer of the Information, or any related documentation of any kind, is restricted in accordance with Federal Acquisition Regulation 12.212 for civilian agencies and Defense Federal Acquisition Regulation Supplement 227.7202 for military agencies. The use of the Information by the Government is further restricted in accordance with the terms of the license agreement(s) and/or applicable contract terms and conditions covering this information from MIPS Technologies or an authorized third party. $Id: readme.txt,v 1.82 2006/11/17 15:23:31 mindy Exp $ ----------------------------------------------------- File contents: - Change history in reverse chronological order - User Notes - Known Issues =============== Getting Started =============== There is an icon for the Getting Started manual. It is in Abode PDF format. A sample "user.tcl" file is included in the /Samples sub-directory. Copy this file to the /Bin sub-directory and modify it to match the requirements of your target board. See the comments in the file for more information. ============== Change history ============== Changes in 2.1.3.3 ------------------ - Fixed divide by zero error in memory window when using the Goto Memory Address... option with address 0xFFFFFFF0. - Gdbstub 'k' packet no longer sends a reply to gdb. Sending that reply was messing up future conntections to gdb on some machines. - Changed gdbstub 'k' packet to be able to handle receiving another target remote connection. - Fixed a problem in the gdbstub for handling escape sequences on binary write packets(X). Changes in 2.1.3.2 ------------------ - Fix for firmware update problems (introduced in 2.1.3.0) - Fix for problem connecting through USB 1.1 on Linux (introduced in 2.1.3.0) - Fix for lack of exclusive single-process ownership of probe (introduced in 2.1.3.0) - Fix for problem with msr commands for addresses greater than 0x7fffffff Changes in 2.1.3.0 ------------------ - Changed MSR command to allow address ranges. - Usb performance changes. Changes in 2.1.2.4 ------------------ - Added commands for the mcpcc's use. Changes in 2.1.2.3 ------------------ - Check for reset first in each breakpoint polling cycle and ensure that reset has been negated for at least [config resetduration] ms prior to doing any JTAG activity. Changes in 2.1.2.2 ------------------ - Fix enabling problem with triggers 15..18. - Changes to ice-cle.tcl to properly handle new triggers. Changes in 2.1.2.1 ------------------ - Added triggers 15..18 (BXDR breakpoints) Changes in 2.1.1.1 ------------------ - Added config BkptPoll to control or disable the breakpoint polling loop. - Added links to command syntax pages in the HTML help file Table of Contents. Changes in 2.1.0.3 ------------------ - Corrected bug in reset that reported a spurious error and left the software running state out of sync. This occurred when the target was set to run after reset. Changes in 2.1.0.2 ------------------ - Upgraded to Tcl/tk version 8.4.11. - Included ice-cle.tcl fixes for bpo and bpio commands supplied by AMD. - The byte, word, and dword commands now use a matching bus cycle type (i.e. the byte command uses an 8-bit bus cycle, etc) for all memory and I/O. All other commands that reference memory continue to use the "size" variable to determine the bus cycle type. New commands byte_size, word_size, and dword_size use the "size" variable like the old byte/word/dword commands. - The Tcl/Tk GUI now restores windows that were open at the end of the previous session. - Added a "package" proc which is aware of the Console's renamed "load" command. The original Tcl load and package commands are available as _load and _package. - An existing Ethernet connection to a System Navigator probe can now be overridden. Use "getowner " to see an existing connection and "dropowner " to override an existing connection. Changes in 2.0.1.2 ------------------ - Support for Geode LX [Castle] processor is now available without NDA. - Text changes in product and documentation to conform to trademark rules. - Added hotplug command to facilitate connecting probe to powered-on system. Changes in 2.0.0.5 ------------------ - Added support for Red Hat Linux 9 (x86) hosts. Changes in 2.0.0.2 ------------------ - Support System Navigator probe via USB 2.0 and Ethernet. - Support GDB connection to drive debug probe. - Rearrange trace start sequence per AMD request Changes in 1.8.5.2 ------------------ - Fixed defect that prematurely exited a rep loop while stepping. Changes in 1.8.4.7 ------------------ - Changed code to "open the trace port" according to AMD recommendation. - The default trace mode is now on-chip. Use traceparams -offchip to direct trace through the Mictor cable to the probe. - The default jtagChain setting is now 24,X which matches most AMD eval boards and other boards that contain both the CS553x and GX2/GX3. - An example user.tcl startup file is now in the samples subdirectory. Changes in 1.8.4.6 ------------------ - Changed trace MSR settings per AMD request. Also changed FPGA's off-chip trace sampling window to conform with the new MSR settings. Changes in 1.8.4.5 ------------------ - Added -stall and -nostall (default) parameter choices to traceparams command. The -stall option will pause the CPU if the off-chip trace FIFO is almost full. Changes in 1.8.4.4 ------------------ - Increased limit of IR and DR command to 64K bytes per scan. Changes in 1.8.4.3 ------------------ - Fixed autodetection process for CS553X. - Fixed cs semantics in ice-cle commands a, g, p, and bpio. - Fixed bug in triggers 11 through 14 in which they would stop execution only when there was another hardware breakpoint also set. Changes in 1.8.4.1 ------------------ - Corrected CS553X access problem when using USB. Changes in 1.8.4.0 ------------------ - Incorporated new ice-cle.tcl code from AMD for bpo. - Software now recognizes CS5536 companion chip IDCODE. Changes in 1.8.3.0 ------------------ - Added Getting Started link to Console Help menu. - Fixed disassembler handling of "sysexit" instruction. - If reset to debug mode occurs during execution, trace is now restarted when restarting execution. - Software now recognizes Castle 2.0 JTAG IDCODE. Changes in 1.8.2.2 ------------------ - Added support for new exception type trace record. - fs2.ini file is now set to world writable, allowing limited users to use the product. - Non-administrators can install updates. Changes in 1.8.2.1 ------------------ - Added closeport command. - Added usblist command. This lists the available probes on USB ports. - USB performance improvements. Changes in 1.8.2.0 ------------------ - Added FPGA version for Castle that conforms to the trace port timing. The proper FPGA image is automatically loaded depending on the chip type the probe is connected to. - Fixed invalidate operation to invalidate the L0 instruction cache which was not present on GX2. - Reinstated config traceflusheip function for Castle. Despite earlier hopes, the Castle chip does not flush out all trace records when stopping at breakpoints. To insure trace command output covers all the way to the end of execution, "config traceflusheip 0xfffffff3" is recommended. This setting is now the default for Castle. - Changed default config showftw to off for Castle. - Three changes to ice-cle.tcl: (1) Bug 377: trigger 0 is hit but does not report the correct breakpoint info. (2) The set_trigger proc now defaults to debug register breakpoints rather than software breakpoints. (3) Bug 409: An extra parameter was being sent to the FS2 trigger command when a trigger is set twice. - Fixed boundary problem with flash ranges ending at 0xffffffff. Changes in 1.8.1.4 ------------------ - Printtrace raw changes to display data LS dword first in all modes and changes to not discard valid frames from on-chip trace. Changes in 1.8.1.3 ------------------ - Corrected trace collection to on-chip memory in certain configurations. Changes in 1.8.1.2 ------------------ - Changes to trigger window GUI. Changes in 1.8.1.1 ------------------ - Documentation errata fixed. - Improved local buffering for off-chip trace to improve performance. - USB communication bug introduced in 1.8.0.3 fixed. Changes in 1.8.0.3 ------------------ - Fixed issue in ice-cle.tcl: 'Run Hawk, halt, try to set breakpoint and get the following error: "can't read "g_bpid": no such variable"'. - Fixed issue that could sometimes cause memory window to get into an infinite loop. - Added ISA-Geode.pdf datasheet to installation. Changes in 1.8.0.2 ------------------ - Added config ShowFtw to control access to the FTW register. In some situations, accessing FTW corrupts the FPU. Normally this item should be left at its default (off) which is the safest setting. Changes in 1.8.0.1 ------------------ - Added driver for Microsoft eXDI protocol as a product option. With this option, debugger hardware now accessible from Microsoft's eXDI-capable debuggers (Windows CE Platform Builder, WinDbg). - Changed two commands in ice-cle.tcl: idt no longer stops when it encounters an unknown descriptor type, and bpo now supports an automatic mode where it computes the prefix mask byte based on the bytes provided in the opcode argument. - Changed asm/dasm to support mov reg,trx where x is 0-2. There are also other assembler changes related to optimization (e.g. how the jmp offsets are determined). The address-size rather than operand-size prefix is now used for jecxz (fixing a previous bug). - Enhanced go and halt commands to synchronize the execution status in the Console window when a go or halt command is given just after hot plugging. - Changed FPU register access to honor the FPU_BUSY flag. If the FPU is busy, the FPU stack registers and fcw, ftw, fsw cannot be accessed. In this case, the value returned from the register command, e.g. [fcw], is "busy". The Tcl variable, e.g. $fcw, and regs command show the last known value of the register. - The byte, word, and dword commands now override the size variable when accessing I/O space, and the access type matches the operand size. Accesses to memory space still use the size variable to determine the width of the memory access. Changes in 1.7.5.1 ------------------ - Changed wording of Memory/trace inconsistency message to suggest pagingoff mode per National request. - Fixed problem with disconnecting, then reconnecting a unit when there are multiple units connected through USB. The reconnected unit was not being recognized by Windows and so was inaccessible until power-cycled a second time. - When decoding trace, trace now automatically switches to "pagingoff" mode when between an SMM entry and SMM exit message, unless the user explicitly specified a particular paging mode in the printtrace command. Restrictions: 1. The SMM Entry/Exit must be in the range of trace being requested in order to be automatically detected. To decode a range of trace wholly within SMM, the user still needs to explicitly specify the "pagingoff" option. 2. This works only with off-chip trace. On-chip trace does not record SMM Entry/Exit special messages. - Added option to trace flush process (see issue #1 in Issues section below). The user may now select to not attempt to alter cs:eip and instead immediately step at the TraceFlushEip address. This corrects an issue with an unterminated memory cycle that occurs when a write to a read-only region is attempted. Summary: config TraceFlushEip "none" --> Do not flush trace config TraceFlushEip 0xfffffff3 --> (Default) Step at 0xfffffff3 to flush config TraceFlushEip 0xfffffff3,tryeip --> Attempt to write NOP at cs:eip. If successful, step at eip, else step at 0xfffffff3 to flush. Note that the default behavior has changed to not attempt writing cs:eip prior to stepping at the TraceFlushEip address. Changes in 1.7.4.1 ------------------ Corrected input timing on trace bus to compensate for RC delay of input protection resistors. Corrected calculation of clock divider to use for trace clock output. In some cases, the trace clock was above the rated maximum of the probe. Changes in 1.7.3.2 ------------------ Added support for ECP mode on IEEE-1284 parallel port. Some PC's, mostly notebooks support ECP but not EPP. Updated parallel port driver to parport2k. This change will affect installation process for third-party applications that use the ABI. Incremental trace decoder enhancements to better recover from inconsistencies and track execution through INT instructions. Documentation changes in Jtag Chain discussion to match Hawk Rev 3 board. Changes in 1.7.2.1 ------------------ Increased maximum resetDuration from 1 second to 10 seconds. Changes in 1.7.1.2 ------------------ Added config UserDR. When on, the probe will not alter any debug registers (DR0-7). config UserDR on may be used in combination with config ReserveDR off to allow a target application full use of the debug registers. Note, however, that if the debugger user sets any other debug breakpoints (single-step, software breakpoints, task breakpoints) that the debug interrupt will be configured to cause a breakpoint and will not be serviced by the target application. Session config parameters are now stored in the [geode] section of fs2.ini. When installing this version, you should generally rename the [fs2] section to [geode]. Bug fix in ice-cle.tcl supplied by National. Changes in 1.7.0.3 ------------------ Registers in register window now highlighted when changed. Added register save/restore to CPU window. Added bitfield display/edit for EFLAGS, CR0, CR3, and CR4. Fixed reporting of FPU registers FCS, FDS, FOP, FEA, and FIP. The Soft-Ice command script has been renamed "ice_cle.tcl" and now supports the bpint command. Changed to measure Vail clock only after reset or if trace clock lock fails. The REGA register remains unchanged through go and halt. Changed default resetDuration to 300ms. This duration is required by most Geode systems. Changes in 1.6.3.1 ------------------ Fixed stepover command. Command now does not time out since a subroutine call could take an arbitrarily long time. You can press ESC to stop execution. Hex loader now loads both cs and csbase when there is a cs:ip record. Added 3 keywords to printtrace (pt), savetrace (st), and showtrace commands to control how linear addresses in the trace are translated to physical addresses for access. "pagingbkpt" is the default and uses the paging configuration in effect at the last breakpoint. "pagingoff" assumes there is no difference between linear and physical. "pagingstart" uses the paging configuration in effect when trace was started. When the trace record includes a mode transition or task switch, these keywords can be used to successfully decode the portion of trace prior to the transition. Miscellaneous minor GUI bug fixes. Corrected problem with corruption of eax when executing in ROM with config RestoreAllRegs off and config TraceFlushEip at its default of 0xfffffff3. Changes in 1.6.2.1 ------------------ Per request, added warning message indicating when the CPU is reset while running. In this case, the debugger automatically reloads breakpoints and restarts execution from reset. Fixed failure to reset in Capistrano. Added missing "gpf" keyword to "help bkptcond" command. Changes in 1.6.1.2 ------------------ Capistrano improvements. Certain query cycles were corrupting chip state, sometimes causing a power-off or other undesired side effects. Changes in 1.6.0.1 ------------------ Added xstep command. This is similar to step except that it uses the DMI_TF method. Unlike step, xstep will step into interrupts and exceptions that occur during an instruction. Warning message added if the CPU resets to run mode (configurable with bootstrap jumpers) and there are breakpoints set. In this case, execution will occur without the breakpoints having been loaded. Added "bkptcond [set|clear] gpf" command. When set, the CPU will enter debug stall whenever a general protection fault occurs. If a GPF occurs, cs:$eip will point to the instruction causing the fault and the brktype will be 3 (software breakpoint). Added "config RestoreAllRegs" option. When off (default), the debugger will restore only those registers that have changed since they were last extracted (such as when the user explicity changes one or more of the register values). When on, the debugger will always restore all registers, whether or not they have been explicitly changed. Note that in a few cases, the debugger itself will change certain registers, such as setting the EFLAGS.TF bit when single stepping. Added automatic trace clock configuration that works over a range of Vail clocks from 50MHz to 566MHz. If outside this range, the hardware will still attempt to lock and print an error if unsuccessful. Change EPP timeout error recovery to be compatible with more types of parallel port hardware. Changes in 1.5.9.1 ------------------ Geode rev 2 support complete. See Known Issues section below. A Soft-ICE compatible command set is now included with the debugger. To enable these commands place the line "source s-ice.tcl" in the user.tcl file located in the debugger's startup directory (typically C:\Program Files\fs2\geode\bin). A windowed user-interface is now included with the debugger. The installer creates start menu items for both the Command Line (CLI) and Windowed (GUI) user interfaces. The GUI includes an embedded Console. Added support for on-chip trace collection. This allows collecting trace when no trace clock is present or when the Mictor trace cable is not connected. Use the traceparams command to configure this item. Changes in 1.5.8.1 ------------------ Added support for Geode rev 2. - Defaults for config regHack and config eipHack are now "off". - The debugger now restarts execution after a reset that occurs during emulation. To disable this behavior, use bkptcond reset. Changes in 1.5.6.3 ------------------ Timing bug fixed in selftest when connected via USB. Inability to connect when using USB with config eipHack off fixed. Changes in 1.5.6.2 ------------------ Restored IR/DR command capacity to 1024 bytes (8K bits). Changes in 1.5.6.1 ------------------ Increased performance of register load/unload by about 4x. Single- stepping and go/halt are much faster. USB communication option is now available. EPP is generally faster, but if no EPP port is available, USB is a viable alternative. For maximum memory access performance (e.g. code download), use size 8. Added check for "user.tcl". If this file exists, it is sourced after the console initializes. Added mbaddr to bus error and unterminated memory cycle error messages. The ISA-Geode system now supports both Geode and Capistrano chips. Use config ChipType to specify which chip, or use config ChipType auto to auto-detect the chip type using the JTAG idcode. Fixed problem in trace decoder with recovery after mismatched data. Changes in 1.5.5.1 ------------------ Fixed XDR triggers (4..7) to allow address ranges in execution mode. Fixed startup problem if communication is not established. If there is no hardware connected, then the version command prints the error message as the hardware version rather than returning an error itself. Changed behavior of the debugger reset command and initialization sequence to maintain the running state selected by the jumpers on the target. If boot to debug stall is not selected, then after reset or initialization, the CPU will be running. Note: - If boot to debug stall is not selected, hardware breakpoints and trace will all be disabled after reset. To maintain trace and breakpoint settings through reset, the target jumpers must select debug stall after reset. - When initializing, FS2 software no longer initializes the CPU. Use the reset command to initialize the CPU. Corrected a problem with targets strapped to boot to run mode. A time delay is required after reset is released before JTAG transactions can begin. The delay in milliseconds is the [config resetDuration] value. In the Arcturus board, a value of 200 seems to work consistently while 100 is sporadic. Changes in 1.5.4.1 ------------------ Added hardware version to version command output. The "bus error" and "unterminated memory cycle" errors now provide more information including the 66-bit return data buffer from Geode, and the original access address, address space, and access size. Fixed bug in memory write function that caused incorrect data to be written when size was set to a value less than 8. Changed byte/word/dword and register-name commands to output values in hexadecimal rather than decimal. Execution trace has been significantly improved. Due to chip problems, there are still occasional instances of missing or incorrect execution data, but the trace display software is designed to identify these conditions and continue decoding at the next synchronization point. See "BTM Anomalies" item below. Changes in 1.5.3.2 ------------------ Added loadgmem and dumpgmem commands supplied by NSC. Changes in 1.5.3.1 ------------------ Added additional syntax option for address entry. You can now use a selector register name. When translating, this type of virtual address uses the corresponding base register rather than a descriptor fetched from memory. The "invalidate" command is now supported for instruction cache. Added "config EipHack" command to select mechanism used to work around the missing EIP register in revision 1.0 silicon. rega: (default) Use MCP, diag bus, and REGA to capture EIP. EIP cannot be changed. bkpt: Use address of last breakpoint. EIP will be wrong after step and halt. EIP cannot be changed. off: Do not attempt any special processing of EIP. EIP is read and written using MSR 0x2c001360. Incorporated changes to conform to trace message output format and order. Changes in 1.5.2.2 ------------------ Integrated with hardware. Execution commands (go, halt, step, breakpoints) now tested. Spurious error message bug in regs command fixed. MSR table search turned off temporarily because it is overflowing the available buffer. This is the equivalent of typing "_test msrtable off" in version 1.5.2.1. The default is now msrtable off (i.e. all msr addresses are hardcoded within the debugger). You can enable mapping using the command "_test msrtable init" to initialize the MSR mapping, though the automatic algorithm does not work. However, you can then use the msrentry command to fill in the msr mapping table manually. Changes in 1.5.2.1 ------------------ Added config coherent [on|off|auto] to control memory cycle type. Default is auto. Auto indicates that noncoherent should be used if CR0.CD and CR0.NW are both 1, else coherent should be used. Added ?c|nc? option to byte, word, dword, long, and dump commands. If specified, the coherency attribute of the bus cycle is as specified. If not specified, then the coherency is determined by config coherent. Added msrentry command to display and change MSR routing table. Type "help msrentry" for syntax. Note that msr addresses entered using the msr command are always used directly with no translation. Only internal msr accesses use the msr table. Added functionality to the config command. If config is given with no parameters, all config items and their current settings are returned. If config is given with a key whose value has not yet been set, the default value of the key is returned. Added procstat command as a shortcut to access the procstat register. Changes in 1.4.3.1 ------------------ Added stepover and tapreset commands. New 2.5V I/O hardware version supported. The debugger now does the necessary CPU operations to set up the trace port. Extended debug registers are now supported in the trigger command and the bkpt command. Internal MSR addresses are now computed dynamically. Added config DisableTrace command to bypass the external clock lock process. This allow using ISA-Geode without the external trace cable attached. Changes in 1.4.1.1 ------------------ Updated to Tcl 8.3.2 distribution libraries. Fixes missing checkbox in Edit | Find dialog. Changes in 1.3.1.5 ------------------ Now supports Geode hardware. See issues section below. Changes in 1.2.3.1 ------------------ Initial version. Only the simulator is supported. ============== User Notes ============== 1. The debugger does not recognize SMM or DMM mode. The main implication of this is that Debug register breakpoints set in SMM/DMM space will never be matched when using Geode silicon 1.x. Software breakpoints will operate correctly in SMM mode and hardware breakpoints work with Geode 2.x. 2. A number of internal registers are reflected in the Console's register list. A GUI intended for end users will not show these registers. 3. If the user activates software breakpoints, debug register breakpoints, or uses the debugger's single-step command, the debugger will set DMI_AS_STALL and one or more of the other DMM control register fields. This will direct all DMI activity to the debugger. As long as the user does not use any of the above-listed features, the debugger can coexist with a standard DMI handler. 4. When using off-chip trace collection, the debugger requires a trace clock between 25MHz and 133MHz because it uses a Delay Locked Loop (DLL) to receive the trace data. To disable trace and bypass the locking check, use the command "config disabletrace on". Or, use "traceparams -onchip" to use on-chip memory instead. Once the clock is established, you can use "config disabletrace off" or "traceparams -offchip" to resume tracing using off-chip memory. After reset, the Geode device drives a clock that is too slow to lock to. Therefore, the following sequence is recommended to initialize the debugger: reset traceparams -onchip go # wait here a second or two for clock to start halt traceparams -offchip go 5. The debugger uses memory writes to insert the software breakpoint opcode into memory. Neither the processor nor the debugger sets the dirty flag in the page table entry representing the breakpoint address. This could result in the breakpoint being lost if the page is replaced without being written back. Even if the debugger did set the dirty flag, the O/S need not honor the dirty flag if it knows that a page contains only code. In this situation, use of hardware breakpoints is recommended. 6. After reset, the EIP register is fixed at 0xFFF0 and cannot be set. You must single-step at least once before the debugger is able to set EIP. ============== Known Issues, Geode GX 1.x ============== 1. BTM Anomalies. - If execution stops just after a branch executes, the final BT message is not output. The result is that the end of the last execution range is incorrect. - Message: "Interrupt or BTM failure. End of previous range unknown." This indicates that a full-address record was encountered but was not expected. This condition is known to occur at interrupts and may also occur in other cases. - Message: "Memory and trace branch types don't agree. BTM decoding may be incorrect." This indicates that the branch types fetched from memory at the execution address do not correspond to those in the trace. This can be due to incorrect use16/use32 mode in the printtrace command, or may be caused by various chip problems relating to BTM trace such as reordering of branches and incorrect branch destination addresses. 2. The EIP register is not accessible from the debugger in silicon revision 1.0. The config EipHack workaround is provided as a partial solution. 3. ESP, EIP, and some bits of CR0 cannot be changed from the debugger. ============== Known Issues, Geode GX 2.x ============== 1. After a breakpoint, the last 1 to 13 branches encountered may not be written out to the trace port and recorded. The debugger implements a workaround that involves writing a NOP temporarily at cs:eip, single- stepping it, then restoring the original opcode. This single step pushes out the missing BTM information. When executing in ROM, cs:eip is not writable. The debugger detects this and instead steps one instruction at a location defined by the [config TraceFlushEip] value. By default, TraceFlushEip is 0xFFFFFFF3, which generally points to an add al,dh instruction. You can change TraceFlushEip to point to any physical address that contains an instruction that does not change any register other than eax and does not write to memory. 2. If the CPU stops at a HLT instruction, you cannot restart the CPU unless interrupts are enabled and occurring because an interrupt is the only way to un-halt the CPU. This issue also causes a problem when trace is enabled and the CPU stops at a HLT instruction. The single-step performed to flush the queued trace data fails. You must "config disabletrace on" or "config TraceFlushEip none" in order to stop reliably at a HLT instruction.