Rochester Institute of Technology
RIT Scholar Works
Theses
Thesis/Dissertation Collections
8-14-1986
A Multiprocessor Distributed Debugger
David Blackman
Follow this and additional works at:
http://scholarworks.rit.edu/theses
This Thesis is brought to you for free and open access by the Thesis/Dissertation Collections at RIT Scholar Works. It has been accepted for inclusion in Theses by an authorized administrator of RIT Scholar Works. For more information, please [email protected].
Recommended Citation
Rochester Institute Of Technology
School Of Computer Science and Technology
A Multiprocessor Distributed Debugger
David Blackman
A thesis, submitted to The Faculty of the School of Computer
Science and Technology, in partial fulfillment of the requirements
for the degree of Master of Science in Computer Science.
Approved by:
Professor Roy Czernikowski
professor John Ellis
professor Margaret Reek
Abstract
This thesis presents the design and implementation of a distributed
debugger
The
debugger wasdesigned
to support thedebugging
of a systemcontaining
multiple processors from a singledebug
console.The
debugger
implementation consists of host software which runs on aVAX
minicomputer and target software which runs onIntel SDK-86
single board computers.The
host and targets communicateusing
an RS-232 channel.The debugger
supportsbreakpoints,
disassembly
of target code, symbolic reference of program procedures and variables, and download ofIntel Object Module
Formatbinary
files.Table of
Contents
1.
Introduction
andBackground
1
1.1
Problem
Statement
11.2
Previous
Work
2
1.2.1
PROM
Monitor
2
12.2
PROM
Monitor/Communications
Channel
2
1
2.3
Expandible
Target Systems
2
12.4
In Circuit
Emulation
3
12.5
Logic State
Analyzers3
12.6
Simulation
412.7
Distributed
Debuggers 51.3
Theoretical
and ConceptualDevelopment
62.
Debugger
Specification
8
2.1
Functional Specification
82.2
System Specification
92.2.1
The Debugger
Host 142.2.2
Loader/Debugger
Protocol
14 2.2.3RS-232
TransportProtocol
152.2.4
RS-232 Data Link Protocol
182.2.5
Target System Hardware Support
183.
Debugger Host Software Implementation
20
3
.1
Overview20
3.2
Procedures
andData Structures
24
3.2.1
Buffer Manager
243.2.2
Datalink Layer
263.2.3
Transport Layer
28
3.2.4
Terminal
Handler31
3.2.5
LDP Support Routines
32
3.2.6
Buffer Dispatcher
34
3.2.7
Command Parser
35
3.2.8
Disassembler Command
Execution
37
3.2.9
Download Command
Execution
38
3.2.10
Target Read Command
Execution
39
3.2.11
Target Write Command
Execution
403.2.12
Control Command Execution
413.2.13
Breakpoint
CommandExecution
42
3.2.14
Miscellaneous Command
Handlers
44
3.2.15
The
Response Handler
45
3.2.16
Intel
8086 ProcessorPersonality
46
4. Debugger
Target
SoftwareImplementation
54
4.1
Overview
544.2
Procedures
and DataStructures
574.2.1
Buffer
Manager
5742.2
Interrupt Handler
594.2.3
Runtime
Library
6142.4
Datalink
Layer
644.2.5
Transport
Layer
674.2.6
Exception
Handler
694.2.7
LDP Server
Process
71
4.2.8
LDP
Protocol
Handler72
4.2.9
LDP Data Transfer Handler
73
4.2.10
LDP
Control
Handler 754.2.11
LDP
ManagementHandler
775.
Testing
andValidation
805. 1
Debugger
Expansion
HardwareTests
80
5.2 Datalink/Transport Layer Tests 815.3 Host/Target Module Tests 81
5.4 Runtime
Library
Tests 825.5
System Tests
82
6.
User Manual
84
6.
1
Getting
Started
84
6.2
Debugger Commands
85
6.2.1
Disassemble
Memory
876.2.2
Display
Memory
876.2.3
Modify/Fill
Memory
88
6.2.4
Dowload File Into Target
Memory
88
6.2.5Display
TargetRegisters
896.2.6
Modify
Target
Registers
896.2.7
Read I/O Port
90
6.2.8
Write I/O Port
90
6.2.9
Breakpoint
Maintenance91
6.2.10
Processor
Control91
6.2.11
Miscellaneous Functions
92
6.3
Target Runtime
Exceptions 937.
Conclusions
and FutureWork
94References
Appendix
A.
Hardware
schematicsAppendix
B.
How
to
build
db.exe
Appendix C.
How to build the LDP Server
Appendix D.
How to
build
the
RuntimeLibrary
Appendix E.
Using
the 8086 development tools
Appendix F.
VMS
System
Services
Appendix
G.
LDP
summary
Appendix H.
Adding
a newdebugger target
Appendix
I.
The debugger's
directory
structureFigures
2.1
Ethernet
host-target
communication10
2.2
Ethernet/Serial
host-target communication11
2.3
Ethernet/Cheapernet host-target
communication 122.4
Serial
host-target communication 132.5
Datalink
andTransport frame
formats 173.1
Debugger data
flow23
3.2
Symbol table organization53
4.1 Loader/Debugger Server control flow 56
1. Introduction and Background 1. 1
Problem
Statement
The
continually
dropping
costs andincreasing
performance of integrated circuitshas
madethe
embedded microprocessor system an effective solutionfor
many
engineering
problems. A boardcontaining
a16
bit
microprocessor,
RAM, ROM,
andI/O
canbe
builtfor
less
than
$500.
These
low
prices coupled with thegrowing
number of applications whichhave
high
computationaldemands,
tight
real-timeconstraints,
extensiveI/O processing
requirements, or arefault-tolerant
make multi-microprocessor systemsvery
attractive[l].
Two
problems arise whendeveloping
software for this type ofsystem
[2].
The
first is that these computersdo
not include sufficienthardware
todirectly
develop
anddebug
software that runs on the system.The
reason is that the additional hardwarefor
support of afull
software development environment would make the resulting system too expensive.The
second problem is that currentdebuggers
are designedto
debug
single processor target systems;debugging
of a multiprocessortarget
system is usually done in an ad hoc manner.The
goal of this thesis is todesign
and implement a debugger whichis
effectivefor
debugging
multiprocessor embedded systemsThe
debugger
should minimize the use of the target system'slimited
resources andbe
inexpensive to implement. Although it isbeing
developed
for
the
Intel
SDK-86
singleboard
computer, it shouldbe easily
adaptable to work with other processors.A
debugger
which can support a target system consisting of a hetereogenous set of processors offers the advantage ofproviding
asingle uniform user interface
to
thedebugger,
ratherthan
a different terminal and commandlanguage
as an interface to each processor'sdebugger
inthe
target system.It
also offersthe
possibility
ofproviding
features not possible with the singledebugger
per processor approach such asbeing
ableto globally
start1.2 Previous Work
This section surveys seven methods
described
in the literature
or encountered in
experience
used todebug
software for embedded computer systems.1.2.1
PROM Monitor
Some
systemsinclude
aPROM
residentdebugger
on the microprocessor system which allows a userto
enter programs anddebug
commandsthrough
akeypad/LED
display
orterminal
I/O.
This
method is practicalfor
small programs which canbe
hand
assembled or assembled on another machine and typed in each timethey
areto
be
debugged.
These
debuggers
generallyhave
cryptic command sequences and no onlinehelp,
due
to thelimited
amount of program anddata
space availablefor the
debugger.1.2.2 PROM
Monitor/Communications
Channel
An enhancement to the
PROM
residentdebugger
is to include a communications channel onthe
target
system used todownload
object codefrom
ahost
computer.Programs
can thenbe
edited and cross assembled or compiled onthe
host
computer anddownloaded
to
the
target system. An example of this idea is implemented on the Intel SDK-86 singleboard
computer[3].
The
disadvantages
of this solution arethe
inability
of thePROM
debugger
to use symbol tableinformation
generatedby
compilers or assemblers(either
because thedebuggers
are not sophisticated enough orbecause
there
is
insufficient
memory
in the target systemto
hold
the
symboltable)
andlengthy
download
timesresulting
from
the
limited
bandwidth
ofthe
communications channel.For example,
ittakes
over two minutes todownload
a 64KByte
program encodedin
Intel
Hex
Format
using
a9600
bps
asynchronous serial channel.1.2.3
Expandable
Target
Systemshas the
disadvantage
that
once the extrahardware
is removed, only theremaining hardware
and softwaremay be
used todebug
the systemresulting
in
the problemsdescribed
insections 1.2.1 and 1.2.2.
1.2.4
In
Circuit
Emulation
In
circuitemulation
(ICE)
is probably the most powerful method ofdebugging
embedded systems.In
an in circuitemulation
debug
environment,
the
microprocessor of the target system is replaced with a probethat
performs realtime
emulation ofthe
replacedprocessor,
i.e.behaves
identically
to
the microprocessor.In
additionto
emulation,
the
ICE
systemhas
the
capabilities ofstarting
andstopping
processorexecution,
downloading
code intothe
target
memory,
reading
andwriting
processor memory, registers, andI/O
ports,
andbreakpointing
in
hardware.
Asin
circuit emulationdoes
not rely ontarget
resident code or data for correctoperation,
it is impervious to the problem of errant softwarewriting
over thedebugger,
rendering
systems undebuggable after a crash.ICE
systemshave
three
principle disadvantages.Microprocessor
development
systems/lCE systems are priced greater than$10K.
This high
unit cost coupled with thefact
that mostICE
systems canonly
be
used with one target system at a time results inhigh
costs whendebugging
a multiprocessor system.The
timing
delays
which areintroduced
by
the
additional electronics andcabling
often requirethat
theICE to
run with more wait states thanthe
emulated processor.This may
mask orintroduce
timing
related software problems.Finally,
ICE
systems aregenerally
available months after a microprocessor is introduced to the market. This means that another method ofdebugging
mustbe
used untilthe
ICE becomes
available.1.2.5
Logic State Analyzers
A
logic
state analyzeris
adevice consisting
of ahigh
speedtrace
memory,
trigger
hardware,
and probes which canbe
clipped onto a microprocessorin
a system underdebug.
When
debugging
microprocessorsoftware,
the
analyzer records processorinstruction
fetches,
memory
reads andwrites,
andI/O
reads and writesin its
trace
memory.The trigger
hardware is programmedby
the
userto
select a sequence ofbus
cycles which must occurbefore
the analyzer starts to collectbus
cycles andis
programmed to select whichbus
cyclesto
capture afterthe trigger
sequenceis
recognized[4].
Many
logic
state analyzers cantimestamp
each capturedexecution) that preceded the write of an incorrect value to a program variable.
Or,
it could be programmedto
trace executionof an
interrupt
serviceroutine;
linked
with thetimestamp
information,this
data
could be used to measure interruptservice time.
As with in circuit
emulators,
the use oflogic
state analyzers whendebugging
amultiprocessor
system wouldbe
quite expensive. Since
logic
state analyzers are passivedevices, they
do
not allow a userto
arbitrarily
examine atarget's memory
orI/O
ports afterthe
trigger sequence occurs.Furthermore,
they
cannotdirectly
monitor events withinthe
processor,
e.g. reads and writes ofprocessor registers.
Logic
state analyzers cannotdownload
target systems;therefore
one ofthe
othertechniques
outlinedhere
is used in conjunction with alogic
state analyzer.Usually,
logic
stateanalyzers
do
not usethe
symbol tableinformation
generatedby
assemblers or compilers which
forces the
userto deal
with collected bus cycles atthe
machine level.1.2.6
Simulation
Using
the
technique
of simulation, target system software is executed or emulated on a host computeroffering
a rich programdevelopment
anddebug
environment.If
the
target systemsoftware is written in a
high level language
supported on thehost,
itmay be
compiled withthe host's
native compiler anddebugged
on the
host.
If
a native compiler is not available or if the software is writtenin
assemblylanguage,
the software istranslated
to target machine codeusing
a cross compiler or assembler and runusing
atarget
simulator/debugger onthe host
[2].
In both
cases, software mustbe
written tohandle
input and output instructions containedin
the
target code andto
simulateinterrupts
from
external hardware.Simulation
offers the advantage ofallowing
a programmer touse
the
host's
debugger
or ahost-resident
target simulator/debugger.This
environmentis
more powerful and easierto
usethan
atarget
residentdebugger
asthe host
machine offers aricher execution environment than the target
hardware
(i.e.
morememoryi
higher
performanceCPU,
disk storage) for
adebugger.
It
also allows codeto
be
developedbefore
orin
parallel withthe
development
of a system's hardware.Simulation has the
principaldisadvantage
of notrunning in
real time which resultsin
lengthy
simulation runs orthe
masking
of timedependent
errors which often occurin
realtime
microprocessor code.This
problem wouldbe
exacerbatedby
the
simulation of a multi-processortarget
system.Due
to the
inability
of simulation toflush
outhardware,
debug
phaseusing
the targethardware
and one of the other debuggingtechniques
outlined here.1.2.7
Distributed
Debuggers
In a remote
debugger developed
for
the Alto workstation[5],
asmall
debugger
nub(server)
runs onthe
targetsystem,
while a debuggerhost
runs on another Alto.The
server and hostcommunicate
using
the
Ethernet.
The
debugger
server,
which is only 400bytes
ofcode,
implements Ethernet communication primitives and routines to service requestsfrom the
host,
such as:write/read
memory,
start/stop
processor, proceedfrom
breakpoint,
and obtain processor status.The
remotedebugger
has theinteresting
property
that
the machinebeing
debugged and the debugger canbe
physically
separatedby
largedistances,
limited
onlyby
the
extent ofthe
network.The
Alto
remote debugger does not support simultaneousdebugging
of multiple processors from a singledebug
console and is notdesigned to
work with other types of processors.Joff
[6]
is a distributed debugger developed at Bell Labs fordebug
of programs which run on theBlit
terminal.It
consists of a debugger process that runs on the target system(the
Blitterminal)
which
is 1000
lines
ofC
code and adebugger host
which runs on aVAX
which is 6000 lines of C code.Here,
the debugger server and host communicate using anRS-232
channel. Thedebugger
host has accessto
the symbol table information generated when the Blit programs are compiled; thereforefull
symbolicdebug
at the sourcelevel is
supported.DAD
(Do
AllDebugger)
[7]
is
a distributeddebugger
designed to work in the National SoftwareWorks
(NSW)
network environment.It
is usedto
debug
applications programsconsisting
of processes which arerunning
on a hetergeneous set of machines in anetwork. Its goals include source level
debug
and to provide a uniform user interface regardless of thelanguages
the application is writtenin
and the machinesthe
processes arerunning
on.It
is alsodesigned to be
extensible so newlanguages
and machines canbe
supported.DELTA
[8]
is
a multilingual debuggerfor
the
Honeywell
CP-6
operating
systemdesigned to
debug
programsrunning
locally
on aHoneywell DPS 8
mainframe and programsrunning remotely
on alayer, which also executes on the
host,
contains machinedependent
functions
such asformatting
of data structures whichdiffer among
machines
(e.g.
pointers),
disassembly
ofcode, and
display
ofhardware
faults.
Layer
three
executes on the target hardware andcommunicates
with
layer
two either with direct procedure calls(for
local
debugging)
or via an exchange of messages over acommunications
link
(for
remote
debugging).
This
layercontains routines
to
fetch/store
memory,
setbreakpoints,
traceprogram execution and
start/stop
execution of a user's program.The
Distributed
Incremental
Compiling
Environment
orDICE
[9] [10]
is
adistributed
programming
environmentdesigned
to
explorethe
use ofincremental
compilationfor
programdevelopment.
It
consists of an editor,incremental
compiler,debugger,
anddata base
which run on a host computerthe DEC20 computer and adebug
server which runs on atarget
systemthe PDP-11.The
DecNet
is used as the communicationslink
between the host and target system.The
host to target communications primitives used inDICE include halt
and resumetarget
execution, store/fetch target memory, store/fetch target registers andblock
move, the target to host messages are
breakpoint/runtime
error and requeststo
perform simulatedterminal input/output.
InDICE,
Pascal statementsmay be
entered into thedebugger, incrementally
compiled on
the
host,
downloaded
to thetarget,
and executed remotely.DICE
is an unusual example of an important conceptresulting
from
the use of adistributed
architecture.Large
and sophisticatedtools
canbe
used on alarge host
machine todevelop
programs
for
a modest target.In
DICE,
thedevelopment
environment wasimplemented
with20,000
lines
ofInterlisp
running
on thehost
system and a serverrunning
onthe
target tohandle
a small set of primitives. As anotherexample,
if thedebugger host
wasrunning
onUNIX,
tools
such asmake, sees, sed,
etc. couldbe
used whiledeveloping
target code[ll].
Furthermore,
debugger
userinterfaces
and commandlanguages
couldbe quickly
prototyped and evaluatedusing
yacc and lex.Due
to the size of the programs generatedby
yacc andlex,
this approach is notfeasible
for debuggers
resident on the target system.1.3
Theoretical
andConceptual
DevelopmentA distributed
debugger
should useapproximately
the same amount of target's resources(i.e.
ROM
andRAM)
as a conventionaldebugger. At the expense of
adding
code to a conventional debuggerto handle server-host
communications,
the userinterface,
symboltable
management,
anddisk
I/O
routines canbe
offloaded to thehost.
The
debugger
host,
running
on a mainframe computer, hasaccess to a
large
amount ofmemory
anddisk
storage allowing it to implementfeatures
such as symbolicdebug,
afriendly
userinterface,
onlinehelp,
logs
ofdebug
sessions, a commandhistory
mechanism, etc.
To
supportdebug
of aheteregenous
set of processors, a genericprotocol will be used
for
host-server communications. The protocolshould be able to support different machine address spaces
(eg
code,
data,
microcode,
I/O),
word widths, data and instructionformats,
register complements, andbreakpointing
capabilities Although thegenerality
of the protocol willincrease the
size of theservers in each target system, it eliminates the necessity of
modifying
large
parts of the host software whensupporting
a newtarget.
Furthermore,
any enhancementsin the debugger host
willimmediately
be useful for all targets.RFC-909
[12]
specifies aLoader/Debugger protocol which satistifes these requirements and will be used
for
this debugger.To
simplify the future
support of other processors, the debugger host will be partitioned into machine dependent and machineindependent modules.
Each
supported processor will require a set ofmachine
dependent
modules which perform target dependentfunctions
such as mapping the processor's register names, runtimeerror
types,
addressformats,
etc.into
parameters usedby
the2. Debugser
Specification
2.1 Functional
Specification
2.1.1
Functions
Performed
The
debugger's
functions
canbe
divided intothree
catagories:data
transfer,
processorcontrol,
and miscellaneousfunctions.
The
data
transfer
commandsdisplay
target
data,
and movedata
between
the
host
andthe
locations
in
the
targets'address
space.
The
supportedtarget
address spacesinclude
memory,
I/O
and processor registers.The debugger
will supportfive
generic data types whichmay be
displayed or written to the
target's
address space.The
types arebyte,
character,
long,
pointer,
and worddata
which are assignedinterpretations
by
the processordependent
modules.The
conversionof data received from the target to printable strings or from VAX
long
words to target format willbe
performed in the processordependent
personality
modules of the debugger.The
data transfer functionsinclude
commands tointeractively
read or write processor memory,
I/O
ports,
orregisters,
to fill targetmemory
with a pattern, todownload
targetmemory
froma
VMS
file,
andto disassemble
target memory.The
processor controlfunctions
include commands to start,single step, or
stop
the currently selected processor, and commandsto set and clear breakpoints.
In
addition, thedebugger
will provide commands to start or stop all processors in a target system.The
miscellaneous functions includesetting
the radixfor
display
or input of
data
(e.g.
hex,
octal,decimal),
and a command toselect the current target.
2.1.2
Limitations
andRestrictions
The
debugger
shouldbe
able to use symboltable
informationgenerated
by
assemblers and compilers to allow symbolic reference of global variables and program locations.However,
itdoes
not support symbolic reference of local(stack
resident) variables inblock-structured languages
such asPascal
or PL/M.The
debugger
willdownload files In
machinedependent format
from
the host
to
the
target system.For
Intel 8086
targets,
this
format
willbe
theIntel
Object
ModuleFormat
[13].
The
low
transfer
ratebetween the
host and targetmay
result inlengthy
download
times.The
user code must not disable interruptsfor longer
than
one2.2 System
Specification
The
distributed
structure of thedebugger
entails the need
for
a communications channel between thedebugger
host and server
(s).
Thehardware
for
support of the channel is the main expense associated withthe
distributed
debugger.Figures
2.1 through2.4
illustrate possibledistributed
architectures. A network such as Ethernet orCheapernet
couldbe
usedallowing
anarbitrary
number of
target
systemsto
be
debugged
from one mainframe.Unfortunately,
Ethernet
hardware
is not present on theIntel
SDK-86 andthe
cost ofadding
anEthernet
interface
to each target is greaterthan
$400
(mostly
in transceiver costs).Cheapernet
has a muchlower
connection cost($100)
as it eliminates the transceiver and uses aless
expensive network medium but has the disadvantagethat
notmany
mainframes support it.To
workaround
this
problem,
abridge
could be used which transfers packetsbetween
anEthernet
and a Cheapernet.Such
a bridge is currently unavailable.Due to these
considerations,
thedebugger
will use point to pointserial connections between the mainframe and the
targets;
serialports are readily available on the host system to be used for this thesis and the cost of adding a serial port to the SDK-86 is less than
$50.
Unfortunately,
the
use of a serial connection will limit transfer ratesbetween the host
and server to 9600bps,
prolonging
the
timeto
read or writelarge
blocks
of target memoryFigure
2.4
illustrates
thelayering
ofthe
host
and target software.The
host software consists of thedebugger
host,
theloader/debugger
protocollayer,
transport
anddata link
layers,
and a multiport serialI/O
driver. The hostoperating
system,VMS,
provides the implementation of the serialI/O
driver.The target
software consists of a serverfor the loader/debugger
RS232
Driver
RS232 Port
Host
System
VAX,
PDP-11
DebuggerHost
Loader/Debugger TCP/IPorRDP/IP
Ethernet Driver
Ethernet
Hardware
Transceiver
Debug
ConsoleTarqet 1
SDK-86
Tarqet 2
SDK-86
Loader/Debugger
Server
TCP/IPor RDP/IP
Ethernet Driver Ethernet Hardware
Loader/Debugger Server
TCP/IPor RDP/IP Ethernet Driver Ethernet Hardware
Transceiver Transc Ethernet
RS232
Driver
RS232
Hardware
Host
System
VAX,
PDP-1
1Debugger Host
Loader
/Debugger
TCP/IPor RDP/IP
Ethernet Driver
Ethernet Hardware
Transceiver
Ethernet
-RS232 Bridge
Bridge Software
TCP/IPor RDP/IP
Ethernet Driver
Ethernet Hardware
Sena) Transport Protocol
Serial DataLink Protocol
Serial 1/0 Driver
Serial 1/0 Hardware
Transceiver
Ethernet
Debug
ConsoleTarget 1
SDK-86
Target 2
SDK-86
Loader/Debugger Server
Loader/Debugger
Server
Serial Transport
Protocol
Serial Transport Protocol
SerialDataLink Protocol
Serial DataLink Protocol
Serial Driver Serial Driver
Serial 1/0 Hardware Serial I/O Hardware
Figure
2 2
Ethernet/Serial host-target communicationRS232 Driver
RS232 Hardware
Host
System
VAX.
PDP-11
Debugger Host
Loader/Debugger
TCP/IPor RDP/IP
Ethernet Driver
Ethernet Hardware
Transceiver
Ethernet
-Cheapernet Bridge
Bridge Software
TCP/IPor RDP/IP
Ethernet Driver
Ethernet Hardware
Cheapernet
TransportProtocol
Cheapernet Data Link Protocol
Cheapernet Driver
Cheapernet Hardware
Transceiver
Ethernet Cheapernet
Debug
ConsoleTarget 1
SDK-86
Target 2
SDK-86
Loader/Debugger Server
Loader/Debugger Server
Cheapernet
Transport Protocol
Cheapernet
Transport Protocol
CheapernetData Link Protocol
Cheapernet Data Link Protocol
Cheapernet Driver Cheapernet Driver
Cheapernet Hardware
Cheapernet Hardware
Host
System
VAX,
PDP-11
Debugger Host Target 1
SDK-86
Target 2
SDK-86
i
Loader/Debugger Loader/Debugger Server
Loader/Debugger Server
RS232 Transport RS232Transport RS232 Transport
RS232 DataLink RS232Data Link RS232 DataLink
RS232Driver RS232Driver RS232 Driver
RS232 Port
RS232
Port
RS232 Port
RS232Port RS232Port
Debut Consale
Figure 2.4
Serial host-target communication.13-2.2,1 The Debugger Host
The debugger
host
software can bebroken
into three functional blocks: a userinterface/command
parser,
command execution, and processorpersonality
modules.The
debugger
host
will run on the VAX/VMSoperating
system and will beimplemented
using the Clanguage.
VMS
was chosenfor
two
reasons.There
are a largenumber of
development
tools
for
the
80x86
microprocessor are available
for this
operating
system.These
tools include
C, Fortran,
and
Pascal
compilers and an assemblerfor the
8086.This
supportis
not availablefor
UNIX.
VMS
also provides theoperating
system routinesnecessary
to
implement
the
communications portion of thedebugger
such asinterprocess
communication,timeouts,
andcritical section protection.
The
userinterface/command
parser is atarget
independentmodule which will accept command strings
from the
debug
console,check them
for
syntacticvalidity,
and parse them into tokens for interpretationby
the command execution modules.The
target
independent command execution modules areresponsible
for
translating
parsed commands intoloader/debugger
protocol
primitives,
submitting them for
executionthrough
callsto
the transportlayer,
anddisplaying
the results. To convertprocessor
dependent
entities(e.g.
data
and addresses) into loader/debugger parameters, the command execution module willmake calls into the processor
personality
module for the currently selected processor.For
each supported processor,there
willbe
a processorpersonality
module which exports adata
structurecontaining
conversion procedures, an optionaldisassembler
procedure, adownload
procedure, and processor parameters.The
conversionprocedures perform the
mapping
between
processordependent
strings
(e.g.
memory
addresses,I/O
portlocations,
and registernames)
andloader/debugger
protocol parameters.A
conversion routine is alsonecessary
to
map
target runtime error codes receivedfrom the
loader/debuggerinto
stringsfor
display
onthe
debugger
console.Through
the use of a singledata
structure tohold these
procedures and parameters, thedebugger
will be able toselect a new processor simply
by
setting a pointer to theappropriate
personality
data structure.2.2.2
Loader/Debugger Protocol
RFC-909
[12]
specifies a loader/debugger protocol(LDP)
designed
to
work with avariety
of machine architecturesto
providethe
functions
of remotedebugging
anddownloading
target
systems.It
are:
loader/dumper,
basicdebugger,
andfull
debuggerThe
loader/dumper
level
provides protocol management commands suchas establishing a connection and
reporting
protocol errors. It also includes thefunctions
of reading,writing,
moving,
andfilling
targetmemory,
starting
thetarget,
and a runtime exception reporting mechanism.The
nextlevel,
the
basic
debugger,
includes
all the loader/dumpercommands
plus commands to singlestep
thetarget,
set
breakpoints,
continuefrom
breakpoints,
and report status.The
last
level,
the
full
debugger,
includes
a mechanism forsetting
complex conditionalbreakpoints using
anFSM
(finite
state machine) model.The
FSM
is constructedusing
loader/debugger messages whichspecify
the
number of machine states and a set of condition/action pairsfor
each state. The conditions that can be programmedinclude
tests
of processorregisters,
memory, and debugger maintained counters.The
actionsinclude
commands to halt execution, continue execution, switchthe
state of the finitestate
machine,
and to clear and incrementthe
counters. When a breakpoint ishit,
thedebugger
server evaluates each condition for the current state until one is satisfiedby
the machine state. It then executes the action associated with the true condition. This debugger server and host for this thesis will implement the basic debugger level.The
protocol uses a single address format to refer to target data in avariety
of address spaces. TheLDP
allows addresses to be specifiedin
one oftwo
formslong
or short format.The
long
address
format
consists of a7
bit modefield,
a32
bitID field
and a32
bit offset.The
modefield
specifies which address space theID
and offset fields refer to
(i.e.
systemRAM,
register, I/O space,etc.). A possible interpretation of the
ID,
offset pair could be aprocess number and virtual address
for
machinessupporting
multiple address spaces.The
short address format consists of a 7bit
modefield
and a32 bit
offset.The
debugger will use the short format which will decrease the size ofthe
server and makebetter
use of the
limited
bandwidthbetween
thehost
and target.The
16bit
segment and16
bit
offset comprising an80x86
address willbe
packed
into
the32 bit
offset field. AppendixG
contains a summary ofthe LDP
requests and responses.2.2.3
RS-232
Transport ProtocolDue
to the low channel bandwidth and the desire to minimizethe
size ofthe
target software, several standard transport anddata
link
protocols were evaluated and rejectedbecause
oflarge
and complex encapsulation overheads.
For
example,TCP/IP has
aheader
consisting
of at least40
bytes.Approximately
15%
of thechannel
bandwidth
would beconsumed just
by
the TCP/IP headerswith a 256
byte
data
field
at9600
bps.
For
this reason, newtransport and
datalink
protocols weredesigned
for
the debugger Thetransport
layer
will provide an error free transmissionfacility between
the host
and serverloader/debugger
layers. It willuse a one
byte
highly
encodedcontrol
byte
similar to the control field in SDLC[14J
.There
are
three frame formats
supportedby
this schemethe
information,
supervisory,
and unnumbered formats.Figure
2.5
illustrates
the
variouscommunications
frame
formats,
which are
described
below.
Information
frames
are usedfor
transmission
of clientdata;
these
frames
also allowpiggybacking
of acknowledgements.The
information frame
controlbyte
contains a threebit
ns sequencenumber, a
three
bit
nr sequence number, and one bit used to specify theframe
format.The
Poll/Finalbit
of theSDLC
protocol will notbe
used.The
ns sequence number isincremented
for eachframe
successfully
transmitted;
the nr sequence number is used toacknowledge all
frames
up to the value of nr minus one(modulo
eight).
Supervisory
frames
are usedfor
acknowledgements and flowcontrol.
A supervisory frame
controlbyte
contains athree bit
nrsequence
number,
twobits
tospecify
the
supervisory
frameformat,
andtwo bits to specify
thesupervisory
frame
type.The
RR
(receiver
ready)
supervisory
frame
type is used foracknowledging
messages; the RNR(receiver
not ready)frame
type is used to acknowledge a message and close the receive windowwhen receiver
buffers
aretemporarily
unavailable. ARR
formatframe
willbe
sent when the receiver window is reopened afterreceiver
buffers have become
available.Unnumbered
frames
are used forestablishing
thetransport
connection.
Their
controlbyte
contains afive bit field to
specify
the
unnumberedframe
type and twobits
to select theunnumbered
frame
format.A
RIM
(Request
Initialization
Mode)
format frame
willbe
sentby
thedebugger
host to a target to openthe
connection;the
target will respond with aUA
(Unnumbered
Ack)
format
frame.To simplify the
implementation of thedebugger
server and todecrease
the amount ofmemory
neededfor
buffering
STX Tranportand LDP Data CRC CRC r-y
Datalink frame format
STX Control LDP Data CRC CRC ETX
I
i
Information format transport frame
nr ns 0
Information framecontrol byte
STX Control CRC CRC ETX
Supervisory
format transportframenr 0 0 0 0
Supervisory
RR Control Byte:-:::: nr
-
visa-0 0 0 1
Supervisory
RNR Control ByteSTX
1
Control CRC CRC ETXUnnumbered formattransport frame
1 0 0 0 0 1 1
Unnumbered RIMControl Byte
OOO >::?. O 0 1 1
Unnumbered UA Control Byte
Figure 2.5.
Datalink and Transportframe formats.
2.2.4 RS-232 Data Link Protocol
Generally,
the
function
of adata link
protocol is to provide an errorfree,
flowcontrolled,
frame-basedtransmission
facility
[15]
However,
forthis
application,
the data link
protocol does not needto provide
flow
control,
retransmissions,
or duplicate suppression. Flow controlis
not required since multiple processes are notcompeting
for
the
use of alimited
pool of receivebuffers.
Retransmissions
andduplicate
suppression are not required as thesefunctions
willbe
suppliedby
the
transport layer.
Therefore,
thedata
link
protocol will provide aframe-based
datagram
(connectionless)
service.Transmission
errors willbe detected
with the 16 bitCCITT CRC.
Although
the8251A
USART
does
not include hardware to generate or check theCRC,
atable driven
algorithm can be used which minimizesCPU bandwidth
at the expense of a512 byte
table[16]
.The data
link
level
requires that the physicallink
be
able to transmit eightbit
characters.This
eliminatesthe
needfor
packing bytes and wordsinto
odd sized units(e.g.
seven bit characters)and improves performance as less channel
bandwidth
is used fortransmitting
start andstop
bits.As in the
BISYNC
protocol,framing
will be accomplished throughthe use of two reserved
byte
codes: a start offrame
byte(STX),
and an end of frame
byte
(ETX).
An escape sequence is used toachieve
transparency
when data contains a reserved byte code[17].
The
ETX
character willbe
a carriage return sincemany
terminal drivers
terminate inputlines
withthis
character.The data link
format usesfour bytes
of overhead: one start offrame
byte,
two
CRC
bytes,
and one end offrame
byte.
The
transportlayer
has
a one byte overhead. At9600
bps,
theseoverhead
bytes
requireapproximately five
milliseconds totransmit
and result in a datalink/transport overhead
less
than3%
whenusing
a256 byte
data field.
2.2.5
Target System Hardware Support
Approximately
ten integrated circuits willbe
addedto
theSDK-86 to
supportthe RS-232
communications channel tothe host.
The
circuit willbe
wire wrapped on a prototypeboard
and pluggedinto the SDK-86 bus
expansion interface withtwo
50
wire ribboncables
allowing
itto be easily detached
whenthe SDK-86 is to be
used
in
other projects.The
additionalcircuitry
consists offour
functional
blocks:chip
selectlogic,
an interruptcontroller,
the
serial
I/O
interface,
and additional ROM/RAM sockets.Appendix
Acontains schematics
for the
hardware support.code has control of the processor, the
debugger
server would be unable to poll the communications hardware for host requests Because theSDK-86
does
not include aninterrupt controller, an
Intel 18259A will
be
included on the prototypeboard
Thecommunications
interface logicincludes a
USART,
theRS-232 electrical
interface,
and baud rategeneration
logic
Although the
SDK-86
already
has
aUSART,
a secondIntel
18251A USART willbe
addedfor two
reasons.The first
is so thedebugger
does not interfere withtarget
codeusing
theSDK-86
USART
The second reason isthat
theSDK-86
USART
is not wired to support interruptdriven
operation.Rather
thancutting traces
and adding wires to supportinterrupts,
a second USART will be used.A single
Maxim
MAX232
integrated
circuit will support the RS-232 electrical interface.This
chip willdrive
the RS-232 TransmitData
and Request toSend
signalsfrom
the8251
A TTLoutputs and will convert the
host RS-232 Receive
Data
and ClearTo
Send signals to8251
A input voltage levels.The
MAX232
has the advantage ofrequiring
a single five volt powersupply
andfour
external capacitors to generate 10 volt
RS-232
voltage swings; the SDK-86implements
the equivalent functionusing
two power supplies(+5
and -12 volts) and a host ofdiscrete
components. An Intel 18254 will be used to derive the serial I/O baud rate clock which canbe
programmedfrom
110 to 19,200 bps.To minimize the parts count, an Intel i8256
MUART
wasconsidered
for
implementation
of the serialI/O,
baud rate generation and interrupt controller.Unfortunately,
the 18256requires multiplexed address/data
bus;
theSDK-86
only offers ademultiplexed
expansion bus.To
re-multiplex the address/data buswould require extra
logic
and buffersdefeating
the purpose of using the i8256.Four
ROM/RAM
sockets willbe
on the prototypeboard
toincrease the amount of program and
data
space(8K PROM,
2KRAM
expandible onboard to 4K
RAM)
available for the debugger and applications code.The
sockets will support either an additional32K
3. Debugger
Host Software
Implementation
3
. l OverviewThe
debugger host
software consists of ten subsystems:The Buffer
Manager
Communications
softwareTerminal
Handler
LDP
support routinesBuffer
Dispatcher
Command
Parser
Procedures
to
executethe debugger
commandsResponse
Handler
8086
personality
implementation
Symbol Table
supportThe software uses several
VMS
system services to performI/O,
timeouts,
andinterprocess
communication.Appendix
F
contains asummary of the these system
services;
detailed documentation
for these services is contained in[18]
.The
Buffer
Manager serves as an allocater of free storageorganized as
Buffer data
structures.These
structures are usedby
thedebugger
commandhandlers,
communicationssoftware,
andTerminal Handler.
The Buffer Manager
also exports routines whichallow clients
to
maintainlinked lists
ofbuffers.
The
modules whichimplement the
Buffer Manager
areBuffer.
c andQueue.
c.The
communications software consists oftwo
modules titledDatalink.c
and Transport.c. These modules contain code toinitialize
and finalize serial connections with
debugger
target systems,transmit
frames
for
thedebugger
host,
and process receivedframes
from
target systemsusing
the transport anddatalink
protocols
described
in sections2.2.3
and 2.2.4.The
Terminal
Handler
is contained in the moduleTerminal.
c.Its
function
isto
queue terminalbuffers
to
the
VAX
terminal
driver
for
keyboard inputfrom
the user, to queue completedbuffers
to
the
Buffer
Dispatcher subsystem, andto
process userabort requests
(control
C).The LDP
support routines are procedures to generate and parseLDP
messages.These
include routinesto
serialize anddeserialize
LDP
command
headers,
addresses,descriptors,
bytes,
words,
andlong
words. Also included in these routines is a procedure to
dump
outLDP frames
in symbolicform
on the terminalto
assistin
protocoldebugging.
These
routines are implementedin the
modulesLDPS.c
and
LDPP.c.
subsystem forwards a
completed line of terminal input to the Command
Parser
andtarget
response messages tothe
Response
Handler. It is contained in
the
main procedure in moduleDBA.c.
TheCommand
Parser
is responsible forparsing
aline
of user input andinvoking
the
propercommand
handler
to execute the command line.The
output of theparsing
phase is adata
structure containing a command opcode and parameter strings copiedfrom
the
commandline.
The
parser is contained in modulesDBB
c andDBT.mar.
The
debugger
commandhandlers
containthe
processorindependent code
that
implement
debugger
commandsBy
convention,the
handlers
are procedures whose name starts with'Exec'
(e.g.
ExecRead
orExecWrite).
The
following
table lists
the location of each commandhandler:
Module
Command
(s)
DBA.c
Radix,
Select,
Synch
DBC.c
Breakpoint,
Control
DBD.c
Read,
Write
DBE.c
Download
DBH.c
Disassembler
The
Response
Handler
processes unsolicited responsesfrom
the target systems.These
areLDP
Error
messages which aretransmitted
by
the target
when a protocol violationis detected
andLDP
Exception
messages which are generated when the targetdetects
a runtime error or interrupt.The
Response
Handler
iscontained in the module DBF.c.
The
8086
personality
implementation is contained in modulesi8086.c,
18086 A.c and i8086B.c.i8086.c
contains routines tointerconvert LDP
addresses andstrings,
a procedureto
convertLDP
exception codes receivedfrom
a targetto
strings,
routinesto
serialize and deserialize data
in
and out ofLDP
communicationsbuffers,
and a procedure to printdata from target
memory.The
module i8086A.c contains a disassembler for 8086 machine code.
i8086B.c
contains codeto
downloadIntel
ObjectModule Format files
into target memory.The
Symbol
Table
routines support the construction of a program symboltable for
each target system and conversion of a symbolic address referenceto
a targetmemory
address.The
program symboltable
is
constructed while a program isbeing
downloaded
to
a target.The
symbol table is consultedduring
debugger
commands which read or write target memory.The
Symbol
Table
routines are containedin
thefile Symtab.c.
Figure 3.1
illustrates the flow of datathrough the debugger.
A
completed user command buffer is passed to the
Terminal
Handler which enqueues thebuffer
on the terminal linked list. The BufferDispatcher
dequeues
the
buffer and calls the Command Parserwhich parses
the
command and calls the appropriate commandhandler.
A message received
from
a target system is first stored in acommunications
buffer
by
theVMS terminal driver.
The message is then processedby
the
datalink
andtransport
communications software.If the
messageis
anLDP frame
(rather
than a transport control message),it is
enqueued on the appropriate target receiverlinked
list.
The
messageis asynchronously
dequeued
by
either acommand handler which is
processing
adebugger
command orby
Target
]
Target TargetTerminal
VMSTerminal Driver
Terminal Handler
A
KS
Terminal
Linked List
VMS TerminalDriver
Datalink Layer
Transport Layer
W
A
\S
A
\y
Target Receiver
Linked Lists
Buffer Dispatcher
Command Parser Response Handler
Command Handlers
Figure 3.1.
DebuggerData Flow
3.2 Procedures and data structures
3.2.1
Buffer
Manager
Data
Structures:
struct
Queue_Head
{
/m Queue.
h
*/
unsigned
first;
unsigned
last,
unsigned
password;
};
struct
Buffer
{
/*m
Buffer.
h*/
struct
Buffer
*frontlink,
struct
Buffer
"backlink;
unsigned
password;
struct
DataLink_Channel 'channel;
struct
IOSB
iosb;
unsigned charstate;
unsigned
parselndex;
unsigned
frameL;
unsigned
maxFrameL,
unsigned char stx;
unsigned char
frame
[l];
};
Exported
procedures:struct
Queue_Head *Queue_Init
();
Queue-Enqueue
(queue,
buffer);
struct
Buffer *Queue_Dequeue
(queue);
Buffer_Init
(nBuffers,
bufferSize);
struct
Buffer
"Buffer-Allocate();
Buffer-Deallocate
(buffer);
Buffer_IsBuffer
(buffer);
The Queue
routines are usedto
manipulatelinked lists
ofBuffer
elements.
The
function
ofQueue_Init
is to create a newlinked
list.It
returns a pointer to a new instance of theQueue_Head
structurewhich contains
the
head
andtail
pointers ofthe linked list
andthe
password
field.
The
returned valueis
the queue parameter used inthe
otherQueue
routines.The
passwordfield is
used to validate aQueue_Head
parameter passedto
otherQueue
routines at runtime.Queue-Enqueue
adds the specifiedBuffer
elementto the tail
ofthe designated linked
list. Queue-Dequeuedequeues the
first buffer
on
the
specifiedlinked list
and returns a pointer toit;
ifthe
queueand Dequeue routines are implemented using the VMS
library
routinesLIB$INSQTI
andLIB$REMQHI
and are therefore atomic[19].
The Buffer routines allow a client to allocate and deallocate
Buffer elements
from
a global pool of buffers created when thedebugger starts up.
This
pool is usedby
the commandhandlers,
the communications software and theTerminal
Handler. TheBuffer
routines use
the
Queue
packageto
maintain thelinked list
offree
buffers.The
Buffer_Init
procedure creates thebuffer pool;
the number ofbytes in each
buffer
availablefor
LDP
messages, communicationscontrol messages or
terminal
input is
determined
by
the bufferSizeparameter.
The total
number of buffersinitially
allocated for thepool
is
setby
the
nBuffersparameter.Buffer-Allocate
returns a pointer to a freeBuffer
element; if afree
buffer
isunavailable,
the
procedure returns aNULL
pointer.Buffer-Deallocate returns
the
specifiedBuffer
elementback
to thefree pool.
Buffer_IsBuffer
allows a client toverify
that the bufferparameter
is
alegal
Buffer
pointer.The
Buffer
data
structure contains fields usedby
various debugger subsystems. The frontLink andbackLink
fields are usedby
the Queue routinesfor
linked list maintenance.The
passwora field is usedby
Buffer_IsBuffer to perform simple runtime typechecking of
buffer
pointer parameters.The
statefield
maintains the element's allocationstate;
it is used toverify
that bufferspassed to
the
Buffer-Deallocate
routine haven't already beendeallocated.
The
parselndexfield
is usedby
the LDP serialize anddeserialize
routines to maintain the position of the nextbyte
toremove or append in the
Buffer's
frame field.The
frameL fieldstores
the
actual number of databytes
in
theframe
field
of aBuffer.
The
datalink software setsthis
field when a packet isreceived;
the debugger host
software setsthis field
whenbuilding
packetsto
be
transmittedto
a target system.The
maxFrameLcontains the number of
bytes
allocatedfor
theframe
field,
it isinitialized
by
the Buffer_Init routine.3.2.2 Datalink Layer
Data structures:
struct
DataLink_Connection
{
/* inDataLink.h
*/
int
password,
intchanNum;
int
nCRCErrors,
nRunts,
nRx, nTx; char
*clientParam,
char
*devName,
j>
Exported
procedures:struct
DataLink-Connection *Datalink_CreateChannel
(
devName,
status,
clientParam)
Datalink-DeleteChannel
(channel)
Datalink-GetMaxBufferSize
()
Datalink_Queue
(channel,
buffer)
Datalink-Stats
(channel)
Datalink-Transmit
(channel,
buffer)
Imported
procedures:Transport-RxHandler
(clientParam,
buffer)
Transport_TxHandler
(clientParam,
buffer)
Private
Procedures:RxAST
(buffer)
TxAST
(buffer)
The function
of Datalink-CreateChannel is to create afull duplex
serial
datalink
channel.The
transportlayer
calls thisprocedure,
passing the
name ofthe
serial channel(e.g.
"TXI7:"),
a pointer to a completion status word, andthe
clientParamlongword
which thedatalink
layer
passesback
to
the transportlayer
on upcallsfor
received and transmitted frames.
The
transportlayer
uses this parameter as a pointerto
transportlayer
connection information.The
status values returned from this call are the same as thosereturned
from
the
VMS
SYS$ASSIGN
library
call.Datalink-CreateChannel returns a pointer to an instance of the
Datalink-Connection
structure;this
pointeris
the
channelparameter used
in
most of the other Datalink layer calls.Datalink-DeleteChannel
cancels pendingI/O
onthe
specifiedchannel and returns the storage used
for
maintenance ofthe
channel.
It is
invoked whenthe
debuggeris
finishing
up.Datalink-GetMaxBufferSize returns
the
number of overheadencapsulation.
Datalink_Queue
queues a buffer for frame reception at thespecified channel.
An
arbitrary
number of buffersmay be
queued at a channel.Data
willbe
lost if a frame is received at the VAX and nobuffers
arein the
channel's receive pool.Datalink-Stats
prints out the statisticsfor
the specified datalinkchannel.
Included
in
the
statistics are the number of framesreceived and
transmitted
and error counts such asframing
errors,number of runt
frames
and CRC errors.Datalink-Transmit
asynchronously
transmits
a client's frame onthe
specifiedthe
serialI/O
channel.The
client'sdata is
copied intoa new buffer with
DLE
stuffing,
framing
characters,
and two CRCbytes,
and queuedfor
transmission
using
the
VMS
QIO
call. On completion of thetransmission,
theVMS
operating
system invokesthe
TxAST
procedureusing the
AST(Asynchronous
Service
Trap)
mechanism.
TxAST
upcallsthe
transportlayer
Transport_TxHandler
procedure,
passing
a pointerto
thebuffer
that
was transmittedand
the
transportlayer's
clientParam which identifies thetransport connection associated with the buffer.
Received
frames
are handledby
the RxAST procedure which isalso invoked via the
VMS
AST mechanism.The
RxAST
routineverifies that the received frame's size is valid, strips off DLE characters, and checks the
frame's
CRC.If
all is well, the Transport_RxHandler procedure is upcalled with two parametersa pointer to the received frame and
the
transport clientParam. Ifany
errors aredetected
in theframe,
thebuffer
is requeued forframe
reception.3.2.3 Transport
Layer
Data structures:
struct
Transport-Connection {
/* inTransport.
h*/
unsigned
password,
structDataLink_Channel
"channel,
unsigned chartransportState;
unsigned char
nr,
ns;
unsigned charnUA,
structBuffer
HxBuffer;
int
txEventFlag;
unsigned
retransmitCount;
int
nRxBuffersQueued;
int
uaFlag;
char
"clientParam;
};
Exported procedures:
struct
Transport-Connection *Transport_CreateConnection
(
devname,
status,
clientParam)
int
Transport_GetMaxBufferSize
()
Transport-ReturnBuffer
(connection,
buffer)
Transport-RxHandler
(connection,
buffer)
Transport-Synch
(connection)
boolean
Transport-TransmitFrame
(connection,
buffer)
Transport-TxHandler
(connection,
buffer)
Imported
procedures:LDP_Handler
(clientParam,
buffer)
The debugger
host
callsTransport-CreateConnection
to
setup
atransport layer
connection with a target.This
procedure is passed a serial channel namestring,
a pointerto
a completion statuslongword,
and a clientParam value which is passedback
to
thedebugger's
LDP_Handler
on receivedframe
upcalls.The
debugger
host
usesthe
clientParam valueto
associate atransport
connection with adata
structuremaintaining debugger level information for
eachtarget.
call to
Transport_Synch
to synchronize the host's sequence numbers with thetarget's
sequence numbers.Transport-GetMaxBufferS