======================== = EMAC INC. = POB 2042 = CARBONDALE, IL 62902 = = 618-529-4525 PHONE = 618-457-0110 FAX = 618-529 5708 BBS ======================== Following is information for using the BUFFALO MONITOR on the MICROPAC HC11. * BUFFALO * "Bit User's Fast Friendly Aid to Logical Operation" * * Rev 2.0 - 4/23/85 - added disassembler. * - variables now PTRn and TMPn. * Rev 2.1 - 4/29/85 - added byte erase to chgbyt routine. * Rev 2.2 - 5/16/85 - added hooks for evb board - acia * drivers, init and host routines. * 7/8/85 - fixed dump wraparound problem. * 7/10/85 - added evm board commands. * - added fill instruction. * 7/18/85 - added jump to EEPROM. * Rev 2.3 - 8/22/85 - call targco to disconnect sci from host * in reset routine for evb board. * 10/3/85 - modified load for download through terminal. * Rev 2.4 - 7/1/86 - Changed DFLOP address to fix conflicts with * EEPROM. (was at A000) * Rev 2.5 - 9/8/86 - Modified to provide additional protection from * program run-away on power down. Also fixed bugs * in MM and MOVE. Changed to 1 stop bit from 2. * Rev 2.6 - 9/25/86 - Modified boot routine for variable length download * for use with 'HC11E8. * Rev 3.0 1/15/87 - EEPROM programming routines consolidated into WRITE. * Fill, Assem, and breakpoints will now do EEPROM. * - Added compare a to $0D to WSKIP routine. * 2/11/87 - Set up load to detect receiver error. * Rev 3.2 7/7/87 - Add disassembly to trace. * - Add entries to jump table. * 9/20/87 - Rewrote trace to use XIRQ, added STOPAT Command * 11/24/87- Write block protect reg for 'E9 version * - Modified variable length download for use * with 'E9 bootloader (XBOOT command) * Rev 3.3 3/17/88 - Set I bit to block interrupts on Warm Start and * return from CALL command. * - Added EEMOD Command. * - Rearranged source so that HELP command overlaps * EEPROM in test mode. * 3/24/88 - Added '+', '-', '=', '.' to MEM and ASM commands. * - Added check for 16 byte boundary to MEM * space sub-command. * - LOAD command now puts dummy (~) command into * inbuff so that any stray cr's won`t hang. * Rev 3.4 8/15/88 - Changed WRITE subroutine so that config register * gets byte erased before programmed. The original * value of config is used for EEBYTE so that config * RAM value doesn't get changed in test mode. * 8/17/88 - Fixed MOVE command so that it doesn't hang when move * is done to a ROM location. * - Added OFFSET command for download offset capability. * * 1/4/95 - EMAC modified the code to disable functions used by * EVB board and to enable single stepping. * * 3/8/95 - EMAC modified the code to allow the BUFFALO monitor to * boot up in SPECIAL TEST MODE. * * 6/6/96 - EMAC modified the code to check for the optional * serial port and to use it as the default if it * exists. This version also sets the tx enable * for the RS422 (handshake out for CN1 RS232). * **************************************************** **** N O T E **** Before using the TRACE and STOPAT commands of the BUFFALO Monitor, a connection must be made from the OC5 output to the XIRQ input. This is done different ways on different revisions of the MICROPAC HC11. REV. 0 The OC5 pin is available on HDR3 pin 41 (on REV0 boards, it is the pin closest to the "L" in the "LD1" written on the silkscreen layer). The XIRQ pin is available on HDR1 pin 18 (on REV0 boards, it is the pin closest to "SI" in "EXPANSION" written on the silkscreen layer). REV. 1 Simply move JP10 (this is close to EPROM pin 14) to the SS position. The MICROPAC HC11 memory map is as follows: 0000-03FF 68HC11 INTERNAL RAM (1K) 0400-7FFF U7 SRAM. PORT G bits 0 and 1 are programmed as outputs and they select one of the four 32K RAM banks available when a 128K SRAM is populated. Remember that since the internal RAM overlaps this RAM, the first 1K of each bank is not accessable. 8000-805F internal registers (See 68hc11 technical data) 8060 LCD command register 8061 LCD data register (SCN2651 PORTS. See SCN2651 data sheets for details) 8064 SEDR 8065 SERCNST 8066 SERMODE 8067 SERCMD 8068 Keypad data port (read only). 8800-$8FFF External I/O select (available on expansion bus connector HDR2) (The following are write-only addresses) E000 High current data latch (available on PX12-19 of HDR3). E004-E007 D/A outputs 0 - 3. 8FFF-FFFF Monitor EPROM The 512 byte internal EEPROM can be relocated on 4k boundaries (nE00 to nFFF, where n is any valid hex digit). 7 6 5 4 3 2 1 0 <== BIT NUMBER | EE3 | EE2 | EE1 | EE0 | 1 |NOCOP| 1 |EEON| <== CONFIG REGISTER ($803F) EE3-EE0 selects the upper nibble (n) of the address of the EEPROM. NOCOP set to 1 disable the watchdog timer (0 enables). EEON set to 1 enables the EEPROM to be mapped into the address selected. If 0, the EEPROM is no longer in the memory map. For example, to move the EEPROM so it overlaps the a portion of the EXTERNAL I/O SELECT, type MM 803F The monitor responds with: 803F 0E (note that this could be any value, not only 0E) You type in the new value and press return: 803F 0E 8F Note that for the CONFIG port, it returns the value that it had at the last RESET. The new value will be in effect only after RESETing the board. Care should be taken not to locate the EEPROM to an area which would conflict with the monitor's reserved areas. This will totally disable your board! These areas are: RESERVED AREAS D000-FFFF BUFFALO monitor code in EPROM 0041-00FF RAM used by the BUFFALO monitor 0000-0040 USER STACK (not used by monitor) The user stack (not used by the monitor) defaults to start at $40 and grows down. If you should by chance locate the EEPROM in a place which conflicts with the monitor and you are using a version dated 3/95 or greater, you have a way out. Remove power from the MICROPAC and look for JP7 which is closest to the 5V regulator (JP7 has nothing to do with the solution, it is just a jumper that can be sacrificed temporarily). Remember what position it is in so you can put back in the same place when you are finished. Put this jumper in the JP5 (MODB) position to enable SPECIAL TEST MODE of the 68hc11F1 which disables the EEPROM. Now when you power up the board it should boot up and allow you to change the CONFIG register. Note that it will read a different value than what was written previously, but you must still write to it to relocate or disable the EEPROM. After this, remove power from the board and relocate the jumper to JP7. The BUFFALO monitor should work correctly now. Note when in SPECIAL TEST mode that you should only change the CONFIG register since other features of the BUFFALO monitor may not work in this mode. Following are reserved RAM addresses used for the interrupt vectors. You must store a jump instruction (code $7E) here followed by the desired interrupt handler address. (Note that XIRQ is used by the TRACE command so its vector will be changed by the buffalo monitor.) $00C4 SCI SERIAL SYSTEM. $00C7 SPI TRANSFER COMPLETE $00CA PULSE ACCUMULATOR INPUT EDGE $00CD PULSE ACCUMULATOR OVERFLOW $00D0 TIMER OVERFLOW $00D3 TIMER OUTPUT COMPARE 5 $00D6 TIMER OUTPUT COMPARE 4 $00D9 TIMER OUTPUT COMPARE 3 $00DC TIMER OUTPUT COMPARE 2 $00DF TIMER OUTPUT COMPARE 1 $00E2 TIMER INPUT CAPTURE 3 $00E5 TIMER INPUT CAPTURE 2 $00E8 TIMER INPUT CAPTURE 1 $00EB REAL TIME INTERRUPT $00EE IRQ INTERRUPT $00F1 XIRQ INTERRUPT. $00F4 SOFTWARE INTERRUPT $00F7 ILLEGAL OPCODE TRAP $00FA WATCH DOG TIMER FAIL (COP). $00FD CLOCK MONITOR FAIL. By default, BUFFALO Monitor communicates through serial port CN1 at 9600 baud, 8 data, no parity and 1 stop bit. If you have two serial ports then it will communicate through CN2 instead. You may connect the HC11 to a dumb terminal or you may use a PC as a terminal by using terminal emulator or MODEM software. If there is a complete serial link between your terminal and the MICROPAC HC11 (and the terminal software is configured properly, powering up the board or resetting it will cause the following message to be displayed: BUFFALO 3.4 (ext) - Bit User Fast Friendly Aid to Logical Operation Pressing twice, at this point, will bring up the HELP screen which is a summary of the monitor commands: ASM [] Line asm/disasm [/,=] Same addr, [^,-] Prev addr, [+,CTLJ] Next addr [CR] Next opcode, [CTLA,.] Quit BF [] Block fill memory BR [-][] Set up bkpt table BULK Erase EEPROM CALL [] Call subroutine GO [] Execute code at addr, PROCEED Continue execution EEMOD [ []] Modify EEPROM range LOAD Load S-records MD [ []] Memory dump MM [] or []/ Memory Modify [/,=] Same addr, [^,-,CTLH] Prev addr, [+,CTLJ,SPACE] Next addr O Compute offset, [CR] Quit MOVE [] Block move OFFSET [-] Offset for download RM [P,Y,X,A,B,C,S] Register modify STOPAT Trace until addr T [] Trace n instructions [CTLW] Wait, [CTLX,DEL] Abort [CR] Repeat last cmd > The commands will now be described in more detail. Note the following: You may exit a command by typing CTL-X or CTL-C. You may pause and resume a screen output by typing CTL-W. Typing will repeat the last command. In descriptions below, bracketed parameters are optional. Some commands may be abbreviated with a single letter. ASM [] This disassembles the opcode at (or 0000 if no address is selected) and allows you to type in an opcode (and operands when needed). BF [] This allows you to Block Fill memory from to with optional . If is left off it defaults to writing $FF. BR [-] [] This enables or disables up to 4 software breakpoints. Typing "BR" by itself shows the settings of the 4 breakpoints (they default to 0000). Typing "BR " sets a breakpoint at . Typing "BR -" clears that breakpoint, leaving the others unchanged. Typing "BR -" clears all breakpoints. EEMOD [ []] EEMOD typed by itself will tell you the current range of the EEPROM, which defaults to $8E00 to $8FFF. This command notifies the monitor of the range of the EEPROM, so that the "MM", "MOVE" and "BF" commands can execute special code to allow writing to the EEPROM. EEMOD followed by one address will make the range to +$7FF. EEMOD followed by two addresses will give a range of to . Note that no error checking is done to see if these are valid start and end addresses, nor does this command move the EEPROM block. It is just a way for the user to notify the monitor if the EEPROM is not in the default location. BULK This erases the EEPROM. It writes $FF to all the addresses in the default EEPROM range or to the range selected by the last EEMOD command. CALL [] This allows you to execute a subroutine at . After the first CALL in which you have selected an , subsequent CALLs in which you don't select an address will execute the same subroutine. MD [ []] This allows you to do a Memory Dump, starting at the last address used and showing $90 bytes, if no parameter given, starting at and showing $90 bytes, if one parameter given, or starting at and showing all bytes till if both parameters given. Note that if you are dumping a large block, CTL-W will pause and resume the display, and CTL-X will abort the command. MM [] or []/ Memory Modify This is one of the most useful commands. It allows you to view/modify, RAM, EEPROM, registers, and data ports. Type "MM" followed by an address and the address and data at that address will be displayed. If you type a number and , the data at that address will be changed and you will be returned to the ">" prompt. If you type a number and "/" the data will be changed and the same command with the same address will be immediately executed allowing you to type new data for the same address. If you type numbers delimited by spaces, the data will be stored sequentially. MOVE [] MOVE moves the block of memory starting at and ending at and moves it to . If there is no parameter, it moves the block to +1 (the block is moved up one byte). OFFSET [-] This specifies the offset to be added to the address field of the S-record which will be download in the next LOAD command. OFFSET without an argument will return the current offset (defaults to 0000). You can have negative offsets also. This allows automatic relocation of your program upon download. LOAD To download an S-record file to the MICROPAC HC11 type LOAD and then send the file from your terminal emulator (or modem software). When the file is loaded the BUFFALO monitor will respond with "done". If the S-record contained addresses which would write to ROM the monitor will respond with "ROM=" followed by the address where the write was attempted. You may do a memory dump of the data loaded with the command "MD " where is the starting address of the s-record file. You may disassemble the data in memory using "ASM ". This will give the dissasembly of the instruction at . Pressing enter after this will disassemble the following instructions. Typing a period will terminate this function. RM [P,Y,X,A,B,C,S] This allows the CPU Registers to be Modified. RM without a parameter will allow you to modify the register that was last modified. GO [] This starts executing code at or if no parameter is given, at the instruction pointed to by the PC (program counter) register. PROCEED This is the same as GO except it ignores a breakpoint if it is on the first instruction. STOPAT This starts executing code from the address in PC and stops at . Note that this command will cause a noticable decrease in the speed of the program, especially in delay loops. T [] This Traces a instructions beginning at the PC's current address. If no value is given for , only one instruction is Traced.