1 /***************************************************************************
2 * Copyright (C) 2008 digenius technology GmbH. *
5 * Copyright (C) 2008,2009 Oyvind Harboe oyvind.harboe@zylin.com *
7 * Copyright (C) 2008 Georg Acher <acher@in.tum.de> *
9 * This program is free software; you can redistribute it and/or modify *
10 * it under the terms of the GNU General Public License as published by *
11 * the Free Software Foundation; either version 2 of the License, or *
12 * (at your option) any later version. *
14 * This program is distributed in the hope that it will be useful, *
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
17 * GNU General Public License for more details. *
19 * You should have received a copy of the GNU General Public License *
20 * along with this program; if not, write to the *
21 * Free Software Foundation, Inc., *
22 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
23 ***************************************************************************/
30 #include "breakpoints.h"
31 #include "arm11_dbgtap.h"
32 #include "arm_simulator.h"
33 #include "time_support.h"
34 #include "target_type.h"
35 #include "algorithm.h"
40 #define _DEBUG_INSTRUCTION_EXECUTION_
43 static bool arm11_config_memwrite_burst
= true;
44 static bool arm11_config_memwrite_error_fatal
= true;
45 static uint32_t arm11_vcr
= 0;
46 static bool arm11_config_step_irq_enable
= false;
47 static bool arm11_config_hardware_step
= false;
61 enum arm11_regtype type
;
64 /* update arm11_regcache_ids when changing this */
65 static const struct arm11_reg_defs arm11_reg_defs
[] =
68 {"dscr", 0, -1, ARM11_REGISTER_DSCR
},
71 enum arm11_regcache_ids
78 static int arm11_step(struct target
*target
, int current
,
79 uint32_t address
, int handle_breakpoints
);
81 static int arm11_build_reg_cache(struct target
*target
);
82 static int arm11_set_reg(struct reg
*reg
, uint8_t *buf
);
83 static int arm11_get_reg(struct reg
*reg
);
86 /** Check and if necessary take control of the system
88 * \param arm11 Target state variable.
89 * \param dscr If the current DSCR content is
90 * available a pointer to a word holding the
91 * DSCR can be passed. Otherwise use NULL.
93 static int arm11_check_init(struct arm11_common
*arm11
, uint32_t *dscr
)
95 uint32_t dscr_local_tmp_copy
;
99 dscr
= &dscr_local_tmp_copy
;
101 CHECK_RETVAL(arm11_read_DSCR(arm11
, dscr
));
104 if (!(*dscr
& ARM11_DSCR_MODE_SELECT
))
106 LOG_DEBUG("Bringing target into debug mode");
108 *dscr
|= ARM11_DSCR_MODE_SELECT
; /* Halt debug-mode */
109 arm11_write_DSCR(arm11
, *dscr
);
111 /* add further reset initialization here */
113 arm11
->simulate_reset_on_next_halt
= true;
115 if (*dscr
& ARM11_DSCR_CORE_HALTED
)
117 /** \todo TODO: this needs further scrutiny because
118 * arm11_debug_entry() never gets called. (WHY NOT?)
119 * As a result we don't read the actual register states from
123 arm11
->arm
.target
->state
= TARGET_HALTED
;
124 arm11
->arm
.target
->debug_reason
=
125 arm11_get_DSCR_debug_reason(*dscr
);
129 arm11
->arm
.target
->state
= TARGET_RUNNING
;
130 arm11
->arm
.target
->debug_reason
= DBG_REASON_NOTHALTED
;
133 arm11_sc7_clear_vbw(arm11
);
142 (arm11->reg_values[ARM11_RC_##x])
145 * Save processor state. This is called after a HALT instruction
146 * succeeds, and on other occasions the processor enters debug mode
147 * (breakpoint, watchpoint, etc).
149 static int arm11_debug_entry(struct arm11_common
*arm11
, uint32_t dscr
)
153 arm11
->arm
.target
->state
= TARGET_HALTED
;
154 arm11
->arm
.target
->debug_reason
= arm11_get_DSCR_debug_reason(dscr
);
156 /* REVISIT entire cache should already be invalid !!! */
157 register_cache_invalidate(arm11
->arm
.core_cache
);
159 for (size_t i
= 0; i
< ARRAY_SIZE(arm11
->reg_values
); i
++)
161 arm11
->reg_list
[i
].valid
= 1;
162 arm11
->reg_list
[i
].dirty
= 0;
165 /* See e.g. ARM1136 TRM, "14.8.4 Entering Debug state" */
171 arm11
->is_wdtr_saved
= !!(dscr
& ARM11_DSCR_WDTR_FULL
);
172 if (arm11
->is_wdtr_saved
)
174 arm11_add_debug_SCAN_N(arm11
, 0x05, ARM11_TAP_DEFAULT
);
176 arm11_add_IR(arm11
, ARM11_INTEST
, ARM11_TAP_DEFAULT
);
178 struct scan_field chain5_fields
[3];
180 arm11_setup_field(arm11
, 32, NULL
,
181 &arm11
->saved_wdtr
, chain5_fields
+ 0);
182 arm11_setup_field(arm11
, 1, NULL
, NULL
, chain5_fields
+ 1);
183 arm11_setup_field(arm11
, 1, NULL
, NULL
, chain5_fields
+ 2);
185 arm11_add_dr_scan_vc(ARRAY_SIZE(chain5_fields
), chain5_fields
, TAP_DRPAUSE
);
188 /* DSCR: set ARM11_DSCR_EXECUTE_ARM_INSTRUCTION_ENABLE
190 * ARM1176 spec says this is needed only for wDTR/rDTR's "ITR mode",
191 * but not to issue ITRs. ARM1136 seems to require this to issue
194 uint32_t new_dscr
= dscr
| ARM11_DSCR_EXECUTE_ARM_INSTRUCTION_ENABLE
;
196 /* this executes JTAG queue: */
198 arm11_write_DSCR(arm11
, new_dscr
);
202 Before executing any instruction in debug state you have to drain the write buffer.
203 This ensures that no imprecise Data Aborts can return at a later point:*/
205 /** \todo TODO: Test drain write buffer. */
210 /* MRC p14,0,R0,c5,c10,0 */
211 // arm11_run_instr_no_data1(arm11, /*0xee150e1a*/0xe320f000);
213 /* mcr 15, 0, r0, cr7, cr10, {4} */
214 arm11_run_instr_no_data1(arm11
, 0xee070f9a);
216 uint32_t dscr
= arm11_read_DSCR(arm11
);
218 LOG_DEBUG("DRAIN, DSCR %08x", dscr
);
220 if (dscr
& ARM11_DSCR_STICKY_IMPRECISE_DATA_ABORT
)
222 arm11_run_instr_no_data1(arm11
, 0xe320f000);
224 dscr
= arm11_read_DSCR(arm11
);
226 LOG_DEBUG("DRAIN, DSCR %08x (DONE)", dscr
);
235 * NOTE: ARM1136 TRM suggests saving just R0 here now, then
236 * CPSR and PC after the rDTR stuff. We do it all at once.
238 retval
= arm_dpm_read_current_registers(&arm11
->dpm
);
239 if (retval
!= ERROR_OK
)
240 LOG_ERROR("DPM REG READ -- fail %d", retval
);
242 retval
= arm11_run_instr_data_prepare(arm11
);
243 if (retval
!= ERROR_OK
)
246 /* maybe save rDTR */
247 arm11
->is_rdtr_saved
= !!(dscr
& ARM11_DSCR_RDTR_FULL
);
248 if (arm11
->is_rdtr_saved
)
250 /* MRC p14,0,R0,c0,c5,0 (move rDTR -> r0 (-> wDTR -> local var)) */
251 retval
= arm11_run_instr_data_from_core_via_r0(arm11
,
252 0xEE100E15, &arm11
->saved_rdtr
);
253 if (retval
!= ERROR_OK
)
257 /* REVISIT Now that we've saved core state, there's may also
258 * be MMU and cache state to care about ...
261 if (arm11
->simulate_reset_on_next_halt
)
263 arm11
->simulate_reset_on_next_halt
= false;
265 LOG_DEBUG("Reset c1 Control Register");
267 /* Write 0 (reset value) to Control register 0 to disable MMU/Cache etc. */
269 /* MCR p15,0,R0,c1,c0,0 */
270 retval
= arm11_run_instr_data_to_core_via_r0(arm11
, 0xee010f10, 0);
271 if (retval
!= ERROR_OK
)
276 retval
= arm11_run_instr_data_finish(arm11
);
277 if (retval
!= ERROR_OK
)
284 * Restore processor state. This is called in preparation for
285 * the RESTART function.
287 static int arm11_leave_debug_state(struct arm11_common
*arm11
, bool bpwp
)
291 /* See e.g. ARM1136 TRM, "14.8.5 Leaving Debug state" */
293 /* NOTE: the ARM1136 TRM suggests restoring all registers
294 * except R0/PC/CPSR right now. Instead, we do them all
295 * at once, just a bit later on.
298 /* REVISIT once we start caring about MMU and cache state,
299 * address it here ...
302 /* spec says clear wDTR and rDTR; we assume they are clear as
303 otherwise our programming would be sloppy */
307 CHECK_RETVAL(arm11_read_DSCR(arm11
, &DSCR
));
309 if (DSCR
& (ARM11_DSCR_RDTR_FULL
| ARM11_DSCR_WDTR_FULL
))
312 The wDTR/rDTR two registers that are used to send/receive data to/from
313 the core in tandem with corresponding instruction codes that are
314 written into the core. The RDTR FULL/WDTR FULL flag indicates that the
315 registers hold data that was written by one side (CPU or JTAG) and not
316 read out by the other side.
318 LOG_ERROR("wDTR/rDTR inconsistent (DSCR %08" PRIx32
")", DSCR
);
323 /* maybe restore original wDTR */
324 if (arm11
->is_wdtr_saved
)
326 retval
= arm11_run_instr_data_prepare(arm11
);
327 if (retval
!= ERROR_OK
)
330 /* MCR p14,0,R0,c0,c5,0 */
331 retval
= arm11_run_instr_data_to_core_via_r0(arm11
,
332 0xee000e15, arm11
->saved_wdtr
);
333 if (retval
!= ERROR_OK
)
336 retval
= arm11_run_instr_data_finish(arm11
);
337 if (retval
!= ERROR_OK
)
341 /* restore CPSR, PC, and R0 ... after flushing any modified
344 retval
= arm_dpm_write_dirty_registers(&arm11
->dpm
, bpwp
);
346 register_cache_invalidate(arm11
->arm
.core_cache
);
350 arm11_write_DSCR(arm11
, R(DSCR
));
352 /* maybe restore rDTR */
354 if (arm11
->is_rdtr_saved
)
356 arm11_add_debug_SCAN_N(arm11
, 0x05, ARM11_TAP_DEFAULT
);
358 arm11_add_IR(arm11
, ARM11_EXTEST
, ARM11_TAP_DEFAULT
);
360 struct scan_field chain5_fields
[3];
362 uint8_t Ready
= 0; /* ignored */
363 uint8_t Valid
= 0; /* ignored */
365 arm11_setup_field(arm11
, 32, &arm11
->saved_rdtr
,
366 NULL
, chain5_fields
+ 0);
367 arm11_setup_field(arm11
, 1, &Ready
, NULL
, chain5_fields
+ 1);
368 arm11_setup_field(arm11
, 1, &Valid
, NULL
, chain5_fields
+ 2);
370 arm11_add_dr_scan_vc(ARRAY_SIZE(chain5_fields
), chain5_fields
, TAP_DRPAUSE
);
373 /* now processor is ready to RESTART */
378 /* poll current target status */
379 static int arm11_poll(struct target
*target
)
382 struct arm11_common
*arm11
= target_to_arm11(target
);
385 CHECK_RETVAL(arm11_read_DSCR(arm11
, &dscr
));
387 LOG_DEBUG("DSCR %08" PRIx32
"", dscr
);
389 CHECK_RETVAL(arm11_check_init(arm11
, &dscr
));
391 if (dscr
& ARM11_DSCR_CORE_HALTED
)
393 if (target
->state
!= TARGET_HALTED
)
395 enum target_state old_state
= target
->state
;
397 LOG_DEBUG("enter TARGET_HALTED");
398 retval
= arm11_debug_entry(arm11
, dscr
);
399 if (retval
!= ERROR_OK
)
402 target_call_event_callbacks(target
,
403 old_state
== TARGET_DEBUG_RUNNING
? TARGET_EVENT_DEBUG_HALTED
: TARGET_EVENT_HALTED
);
408 if (target
->state
!= TARGET_RUNNING
&& target
->state
!= TARGET_DEBUG_RUNNING
)
410 LOG_DEBUG("enter TARGET_RUNNING");
411 target
->state
= TARGET_RUNNING
;
412 target
->debug_reason
= DBG_REASON_NOTHALTED
;
418 /* architecture specific status reply */
419 static int arm11_arch_state(struct target
*target
)
423 retval
= armv4_5_arch_state(target
);
425 /* REVISIT also display ARM11-specific MMU and cache status ... */
430 /* target request support */
431 static int arm11_target_request_data(struct target
*target
,
432 uint32_t size
, uint8_t *buffer
)
434 LOG_WARNING("Not implemented: %s", __func__
);
439 /* target execution control */
440 static int arm11_halt(struct target
*target
)
442 struct arm11_common
*arm11
= target_to_arm11(target
);
444 LOG_DEBUG("target->state: %s",
445 target_state_name(target
));
447 if (target
->state
== TARGET_UNKNOWN
)
449 arm11
->simulate_reset_on_next_halt
= true;
452 if (target
->state
== TARGET_HALTED
)
454 LOG_DEBUG("target was already halted");
458 arm11_add_IR(arm11
, ARM11_HALT
, TAP_IDLE
);
460 CHECK_RETVAL(jtag_execute_queue());
467 CHECK_RETVAL(arm11_read_DSCR(arm11
, &dscr
));
469 if (dscr
& ARM11_DSCR_CORE_HALTED
)
480 if ((timeval_ms()-then
) > 1000)
482 LOG_WARNING("Timeout (1000ms) waiting for instructions to complete");
489 enum target_state old_state
= target
->state
;
491 arm11_debug_entry(arm11
, dscr
);
494 target_call_event_callbacks(target
,
495 old_state
== TARGET_DEBUG_RUNNING
? TARGET_EVENT_DEBUG_HALTED
: TARGET_EVENT_HALTED
));
501 arm11_nextpc(struct arm11_common
*arm11
, int current
, uint32_t address
)
503 void *value
= arm11
->arm
.core_cache
->reg_list
[15].value
;
506 buf_set_u32(value
, 0, 32, address
);
508 address
= buf_get_u32(value
, 0, 32);
513 static int arm11_resume(struct target
*target
, int current
,
514 uint32_t address
, int handle_breakpoints
, int debug_execution
)
516 // LOG_DEBUG("current %d address %08x handle_breakpoints %d debug_execution %d",
517 // current, address, handle_breakpoints, debug_execution);
519 struct arm11_common
*arm11
= target_to_arm11(target
);
521 LOG_DEBUG("target->state: %s",
522 target_state_name(target
));
525 if (target
->state
!= TARGET_HALTED
)
527 LOG_ERROR("Target not halted");
528 return ERROR_TARGET_NOT_HALTED
;
531 address
= arm11_nextpc(arm11
, current
, address
);
533 LOG_DEBUG("RESUME PC %08" PRIx32
"%s", address
, !current
? "!" : "");
535 /* clear breakpoints/watchpoints and VCR*/
536 arm11_sc7_clear_vbw(arm11
);
538 if (!debug_execution
)
539 target_free_all_working_areas(target
);
541 /* Set up breakpoints */
542 if (handle_breakpoints
)
544 /* check if one matches PC and step over it if necessary */
546 struct breakpoint
* bp
;
548 for (bp
= target
->breakpoints
; bp
; bp
= bp
->next
)
550 if (bp
->address
== address
)
552 LOG_DEBUG("must step over %08" PRIx32
"", bp
->address
);
553 arm11_step(target
, 1, 0, 0);
558 /* set all breakpoints */
560 unsigned brp_num
= 0;
562 for (bp
= target
->breakpoints
; bp
; bp
= bp
->next
)
564 struct arm11_sc7_action brp
[2];
567 brp
[0].address
= ARM11_SC7_BVR0
+ brp_num
;
568 brp
[0].value
= bp
->address
;
570 brp
[1].address
= ARM11_SC7_BCR0
+ brp_num
;
571 brp
[1].value
= 0x1 | (3 << 1) | (0x0F << 5) | (0 << 14) | (0 << 16) | (0 << 20) | (0 << 21);
573 arm11_sc7_run(arm11
, brp
, ARRAY_SIZE(brp
));
575 LOG_DEBUG("Add BP %d at %08" PRIx32
, brp_num
,
581 arm11_sc7_set_vcr(arm11
, arm11_vcr
);
584 arm11_leave_debug_state(arm11
, handle_breakpoints
);
586 arm11_add_IR(arm11
, ARM11_RESTART
, TAP_IDLE
);
588 CHECK_RETVAL(jtag_execute_queue());
595 CHECK_RETVAL(arm11_read_DSCR(arm11
, &dscr
));
597 LOG_DEBUG("DSCR %08" PRIx32
"", dscr
);
599 if (dscr
& ARM11_DSCR_CORE_RESTARTED
)
610 if ((timeval_ms()-then
) > 1000)
612 LOG_WARNING("Timeout (1000ms) waiting for instructions to complete");
619 if (!debug_execution
)
621 target
->state
= TARGET_RUNNING
;
622 target
->debug_reason
= DBG_REASON_NOTHALTED
;
624 CHECK_RETVAL(target_call_event_callbacks(target
, TARGET_EVENT_RESUMED
));
628 target
->state
= TARGET_DEBUG_RUNNING
;
629 target
->debug_reason
= DBG_REASON_NOTHALTED
;
631 CHECK_RETVAL(target_call_event_callbacks(target
, TARGET_EVENT_RESUMED
));
637 static int arm11_step(struct target
*target
, int current
,
638 uint32_t address
, int handle_breakpoints
)
640 LOG_DEBUG("target->state: %s",
641 target_state_name(target
));
643 if (target
->state
!= TARGET_HALTED
)
645 LOG_WARNING("target was not halted");
646 return ERROR_TARGET_NOT_HALTED
;
649 struct arm11_common
*arm11
= target_to_arm11(target
);
651 address
= arm11_nextpc(arm11
, current
, address
);
653 LOG_DEBUG("STEP PC %08" PRIx32
"%s", address
, !current
? "!" : "");
656 /** \todo TODO: Thumb not supported here */
658 uint32_t next_instruction
;
660 CHECK_RETVAL(arm11_read_memory_word(arm11
, address
, &next_instruction
));
663 if ((next_instruction
& 0xFFF00070) == 0xe1200070)
665 address
= arm11_nextpc(arm11
, 0, address
+ 4);
666 LOG_DEBUG("Skipping BKPT");
668 /* skip over Wait for interrupt / Standby */
669 /* mcr 15, 0, r?, cr7, cr0, {4} */
670 else if ((next_instruction
& 0xFFFF0FFF) == 0xee070f90)
672 address
= arm11_nextpc(arm11
, 0, address
+ 4);
673 LOG_DEBUG("Skipping WFI");
675 /* ignore B to self */
676 else if ((next_instruction
& 0xFEFFFFFF) == 0xeafffffe)
678 LOG_DEBUG("Not stepping jump to self");
682 /** \todo TODO: check if break-/watchpoints make any sense at all in combination
685 /** \todo TODO: check if disabling IRQs might be a good idea here. Alternatively
686 * the VCR might be something worth looking into. */
689 /* Set up breakpoint for stepping */
691 struct arm11_sc7_action brp
[2];
694 brp
[0].address
= ARM11_SC7_BVR0
;
696 brp
[1].address
= ARM11_SC7_BCR0
;
698 if (arm11_config_hardware_step
)
700 /* Hardware single stepping ("instruction address
701 * mismatch") is used if enabled. It's not quite
702 * exactly "run one instruction"; "branch to here"
703 * loops won't break, neither will some other cases,
704 * but it's probably the best default.
706 * Hardware single stepping isn't supported on v6
707 * debug modules. ARM1176 and v7 can support it...
709 * FIXME Thumb stepping likely needs to use 0x03
710 * or 0xc0 byte masks, not 0x0f.
712 brp
[0].value
= address
;
713 brp
[1].value
= 0x1 | (3 << 1) | (0x0F << 5)
714 | (0 << 14) | (0 << 16) | (0 << 20)
718 /* Sets a breakpoint on the next PC, as calculated
719 * by instruction set simulation.
721 * REVISIT stepping Thumb on ARM1156 requires Thumb2
722 * support from the simulator.
727 retval
= arm_simulate_step(target
, &next_pc
);
728 if (retval
!= ERROR_OK
)
731 brp
[0].value
= next_pc
;
732 brp
[1].value
= 0x1 | (3 << 1) | (0x0F << 5)
733 | (0 << 14) | (0 << 16) | (0 << 20)
737 CHECK_RETVAL(arm11_sc7_run(arm11
, brp
, ARRAY_SIZE(brp
)));
742 if (arm11_config_step_irq_enable
)
743 R(DSCR
) &= ~ARM11_DSCR_INTERRUPTS_DISABLE
; /* should be redundant */
745 R(DSCR
) |= ARM11_DSCR_INTERRUPTS_DISABLE
;
748 CHECK_RETVAL(arm11_leave_debug_state(arm11
, handle_breakpoints
));
750 arm11_add_IR(arm11
, ARM11_RESTART
, TAP_IDLE
);
752 CHECK_RETVAL(jtag_execute_queue());
760 CHECK_RETVAL(arm11_read_DSCR(arm11
, &dscr
));
762 LOG_DEBUG("DSCR %08" PRIx32
"e", dscr
);
764 if ((dscr
& (ARM11_DSCR_CORE_RESTARTED
| ARM11_DSCR_CORE_HALTED
)) ==
765 (ARM11_DSCR_CORE_RESTARTED
| ARM11_DSCR_CORE_HALTED
))
775 if ((timeval_ms()-then
) > 1000)
777 LOG_WARNING("Timeout (1000ms) waiting for instructions to complete");
784 /* clear breakpoint */
785 arm11_sc7_clear_vbw(arm11
);
788 CHECK_RETVAL(arm11_debug_entry(arm11
, dscr
));
790 /* restore default state */
791 R(DSCR
) &= ~ARM11_DSCR_INTERRUPTS_DISABLE
;
795 target
->debug_reason
= DBG_REASON_SINGLESTEP
;
797 CHECK_RETVAL(target_call_event_callbacks(target
, TARGET_EVENT_HALTED
));
802 static int arm11_assert_reset(struct target
*target
)
805 struct arm11_common
*arm11
= target_to_arm11(target
);
807 retval
= arm11_check_init(arm11
, NULL
);
808 if (retval
!= ERROR_OK
)
811 target
->state
= TARGET_UNKNOWN
;
813 /* we would very much like to reset into the halted, state,
814 * but resetting and halting is second best... */
815 if (target
->reset_halt
)
817 CHECK_RETVAL(target_halt(target
));
821 /* srst is funny. We can not do *anything* else while it's asserted
822 * and it has unkonwn side effects. Make sure no other code runs
825 * Code below assumes srst:
827 * - Causes power-on-reset (but of what parts of the system?). Bug
830 * - Messes us TAP state without asserting trst.
832 * - There is another bug in the arm11 core. When you generate an access to
833 * external logic (for example ddr controller via AHB bus) and that block
834 * is not configured (perhaps it is still held in reset), that transaction
835 * will never complete. This will hang arm11 core but it will also hang
836 * JTAG controller. Nothing, short of srst assertion will bring it out of
841 * - What should the PC be after an srst reset when starting in the halted
845 jtag_add_reset(0, 1);
846 jtag_add_reset(0, 0);
848 /* How long do we have to wait? */
849 jtag_add_sleep(5000);
851 /* un-mess up TAP state */
854 retval
= jtag_execute_queue();
855 if (retval
!= ERROR_OK
)
863 static int arm11_deassert_reset(struct target
*target
)
868 static int arm11_soft_reset_halt(struct target
*target
)
870 LOG_WARNING("Not implemented: %s", __func__
);
875 /* target memory access
876 * size: 1 = byte (8bit), 2 = half-word (16bit), 4 = word (32bit)
877 * count: number of items of <size>
879 * arm11_config_memrw_no_increment - in the future we may want to be able
880 * to read/write a range of data to a "port". a "port" is an action on
881 * read memory address for some peripheral.
883 static int arm11_read_memory_inner(struct target
*target
,
884 uint32_t address
, uint32_t size
, uint32_t count
, uint8_t *buffer
,
885 bool arm11_config_memrw_no_increment
)
887 /** \todo TODO: check if buffer cast to uint32_t* and uint16_t* might cause alignment problems */
890 if (target
->state
!= TARGET_HALTED
)
892 LOG_WARNING("target was not halted");
893 return ERROR_TARGET_NOT_HALTED
;
896 LOG_DEBUG("ADDR %08" PRIx32
" SIZE %08" PRIx32
" COUNT %08" PRIx32
"", address
, size
, count
);
898 struct arm11_common
*arm11
= target_to_arm11(target
);
900 retval
= arm11_run_instr_data_prepare(arm11
);
901 if (retval
!= ERROR_OK
)
904 /* MRC p14,0,r0,c0,c5,0 */
905 retval
= arm11_run_instr_data_to_core1(arm11
, 0xee100e15, address
);
906 if (retval
!= ERROR_OK
)
912 arm11
->arm
.core_cache
->reg_list
[1].dirty
= true;
914 for (size_t i
= 0; i
< count
; i
++)
916 /* ldrb r1, [r0], #1 */
918 arm11_run_instr_no_data1(arm11
,
919 !arm11_config_memrw_no_increment
? 0xe4d01001 : 0xe5d01000);
922 /* MCR p14,0,R1,c0,c5,0 */
923 arm11_run_instr_data_from_core(arm11
, 0xEE001E15, &res
, 1);
932 arm11
->arm
.core_cache
->reg_list
[1].dirty
= true;
934 for (size_t i
= 0; i
< count
; i
++)
936 /* ldrh r1, [r0], #2 */
937 arm11_run_instr_no_data1(arm11
,
938 !arm11_config_memrw_no_increment
? 0xe0d010b2 : 0xe1d010b0);
942 /* MCR p14,0,R1,c0,c5,0 */
943 arm11_run_instr_data_from_core(arm11
, 0xEE001E15, &res
, 1);
945 uint16_t svalue
= res
;
946 memcpy(buffer
+ i
* sizeof(uint16_t), &svalue
, sizeof(uint16_t));
954 uint32_t instr
= !arm11_config_memrw_no_increment
? 0xecb05e01 : 0xed905e00;
955 /** \todo TODO: buffer cast to uint32_t* causes alignment warnings */
956 uint32_t *words
= (uint32_t *)buffer
;
958 /* LDC p14,c5,[R0],#4 */
959 /* LDC p14,c5,[R0] */
960 arm11_run_instr_data_from_core(arm11
, instr
, words
, count
);
965 return arm11_run_instr_data_finish(arm11
);
968 static int arm11_read_memory(struct target
*target
, uint32_t address
, uint32_t size
, uint32_t count
, uint8_t *buffer
)
970 return arm11_read_memory_inner(target
, address
, size
, count
, buffer
, false);
974 * no_increment - in the future we may want to be able
975 * to read/write a range of data to a "port". a "port" is an action on
976 * read memory address for some peripheral.
978 static int arm11_write_memory_inner(struct target
*target
,
979 uint32_t address
, uint32_t size
,
980 uint32_t count
, uint8_t *buffer
,
985 if (target
->state
!= TARGET_HALTED
)
987 LOG_WARNING("target was not halted");
988 return ERROR_TARGET_NOT_HALTED
;
991 LOG_DEBUG("ADDR %08" PRIx32
" SIZE %08" PRIx32
" COUNT %08" PRIx32
"", address
, size
, count
);
993 struct arm11_common
*arm11
= target_to_arm11(target
);
995 retval
= arm11_run_instr_data_prepare(arm11
);
996 if (retval
!= ERROR_OK
)
999 /* MRC p14,0,r0,c0,c5,0 */
1000 retval
= arm11_run_instr_data_to_core1(arm11
, 0xee100e15, address
);
1001 if (retval
!= ERROR_OK
)
1004 /* burst writes are not used for single words as those may well be
1005 * reset init script writes.
1007 * The other advantage is that as burst writes are default, we'll
1008 * now exercise both burst and non-burst code paths with the
1009 * default settings, increasing code coverage.
1011 bool burst
= arm11_config_memwrite_burst
&& (count
> 1);
1017 arm11
->arm
.core_cache
->reg_list
[1].dirty
= true;
1019 for (size_t i
= 0; i
< count
; i
++)
1021 /* MRC p14,0,r1,c0,c5,0 */
1022 retval
= arm11_run_instr_data_to_core1(arm11
, 0xee101e15, *buffer
++);
1023 if (retval
!= ERROR_OK
)
1026 /* strb r1, [r0], #1 */
1028 retval
= arm11_run_instr_no_data1(arm11
,
1032 if (retval
!= ERROR_OK
)
1041 arm11
->arm
.core_cache
->reg_list
[1].dirty
= true;
1043 for (size_t i
= 0; i
< count
; i
++)
1046 memcpy(&value
, buffer
+ i
* sizeof(uint16_t), sizeof(uint16_t));
1048 /* MRC p14,0,r1,c0,c5,0 */
1049 retval
= arm11_run_instr_data_to_core1(arm11
, 0xee101e15, value
);
1050 if (retval
!= ERROR_OK
)
1053 /* strh r1, [r0], #2 */
1055 retval
= arm11_run_instr_no_data1(arm11
,
1059 if (retval
!= ERROR_OK
)
1067 uint32_t instr
= !no_increment
? 0xeca05e01 : 0xed805e00;
1069 /** \todo TODO: buffer cast to uint32_t* causes alignment warnings */
1070 uint32_t *words
= (uint32_t*)buffer
;
1074 /* STC p14,c5,[R0],#4 */
1075 /* STC p14,c5,[R0]*/
1076 retval
= arm11_run_instr_data_to_core(arm11
, instr
, words
, count
);
1077 if (retval
!= ERROR_OK
)
1082 /* STC p14,c5,[R0],#4 */
1083 /* STC p14,c5,[R0]*/
1084 retval
= arm11_run_instr_data_to_core_noack(arm11
, instr
, words
, count
);
1085 if (retval
!= ERROR_OK
)
1093 /* r0 verification */
1098 /* MCR p14,0,R0,c0,c5,0 */
1099 retval
= arm11_run_instr_data_from_core(arm11
, 0xEE000E15, &r0
, 1);
1100 if (retval
!= ERROR_OK
)
1103 if (address
+ size
* count
!= r0
)
1105 LOG_ERROR("Data transfer failed. Expected end "
1106 "address 0x%08x, got 0x%08x",
1107 (unsigned) (address
+ size
* count
),
1111 LOG_ERROR("use 'arm11 memwrite burst disable' to disable fast burst mode");
1113 if (arm11_config_memwrite_error_fatal
)
1118 return arm11_run_instr_data_finish(arm11
);
1121 static int arm11_write_memory(struct target
*target
,
1122 uint32_t address
, uint32_t size
,
1123 uint32_t count
, uint8_t *buffer
)
1125 /* pointer increment matters only for multi-unit writes ...
1126 * not e.g. to a "reset the chip" controller.
1128 return arm11_write_memory_inner(target
, address
, size
,
1129 count
, buffer
, count
== 1);
1132 /* write target memory in multiples of 4 byte, optimized for writing large quantities of data */
1133 static int arm11_bulk_write_memory(struct target
*target
,
1134 uint32_t address
, uint32_t count
, uint8_t *buffer
)
1136 if (target
->state
!= TARGET_HALTED
)
1138 LOG_WARNING("target was not halted");
1139 return ERROR_TARGET_NOT_HALTED
;
1142 return arm11_write_memory(target
, address
, 4, count
, buffer
);
1145 /* target break-/watchpoint control
1146 * rw: 0 = write, 1 = read, 2 = access
1148 static int arm11_add_breakpoint(struct target
*target
,
1149 struct breakpoint
*breakpoint
)
1151 struct arm11_common
*arm11
= target_to_arm11(target
);
1154 if (breakpoint
->type
== BKPT_SOFT
)
1156 LOG_INFO("sw breakpoint requested, but software breakpoints not enabled");
1157 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
1161 if (!arm11
->free_brps
)
1163 LOG_DEBUG("no breakpoint unit available for hardware breakpoint");
1164 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
1167 if (breakpoint
->length
!= 4)
1169 LOG_DEBUG("only breakpoints of four bytes length supported");
1170 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
1178 static int arm11_remove_breakpoint(struct target
*target
,
1179 struct breakpoint
*breakpoint
)
1181 struct arm11_common
*arm11
= target_to_arm11(target
);
1188 static int arm11_target_create(struct target
*target
, Jim_Interp
*interp
)
1190 struct arm11_common
*arm11
;
1192 if (target
->tap
== NULL
)
1195 if (target
->tap
->ir_length
!= 5)
1197 LOG_ERROR("'target arm11' expects IR LENGTH = 5");
1198 return ERROR_COMMAND_SYNTAX_ERROR
;
1201 arm11
= calloc(1, sizeof *arm11
);
1205 armv4_5_init_arch_info(target
, &arm11
->arm
);
1207 arm11
->jtag_info
.tap
= target
->tap
;
1208 arm11
->jtag_info
.scann_size
= 5;
1209 arm11
->jtag_info
.scann_instr
= ARM11_SCAN_N
;
1210 /* cur_scan_chain == 0 */
1211 arm11
->jtag_info
.intest_instr
= ARM11_INTEST
;
1216 static int arm11_init_target(struct command_context
*cmd_ctx
,
1217 struct target
*target
)
1219 /* Initialize anything we can set up without talking to the target */
1221 /* REVISIT do we really want such a debug-registers-only cache?
1222 * If we do, it should probably be handled purely by the DPM code,
1223 * so it works identically on the v7a/v7r cores.
1225 return arm11_build_reg_cache(target
);
1228 /* talk to the target and set things up */
1229 static int arm11_examine(struct target
*target
)
1233 struct arm11_common
*arm11
= target_to_arm11(target
);
1234 uint32_t didr
, device_id
;
1235 uint8_t implementor
;
1237 /* FIXME split into do-first-time and do-every-time logic ... */
1241 arm11_add_IR(arm11
, ARM11_IDCODE
, ARM11_TAP_DEFAULT
);
1243 struct scan_field idcode_field
;
1245 arm11_setup_field(arm11
, 32, NULL
, &device_id
, &idcode_field
);
1247 arm11_add_dr_scan_vc(1, &idcode_field
, TAP_DRPAUSE
);
1251 arm11_add_debug_SCAN_N(arm11
, 0x00, ARM11_TAP_DEFAULT
);
1253 arm11_add_IR(arm11
, ARM11_INTEST
, ARM11_TAP_DEFAULT
);
1255 struct scan_field chain0_fields
[2];
1257 arm11_setup_field(arm11
, 32, NULL
, &didr
, chain0_fields
+ 0);
1258 arm11_setup_field(arm11
, 8, NULL
, &implementor
, chain0_fields
+ 1);
1260 arm11_add_dr_scan_vc(ARRAY_SIZE(chain0_fields
), chain0_fields
, TAP_IDLE
);
1262 CHECK_RETVAL(jtag_execute_queue());
1264 switch (device_id
& 0x0FFFF000)
1273 arm11
->arm
.core_type
= ARM_MODE_MON
;
1277 LOG_ERROR("'target arm11' expects IDCODE 0x*7B*7****");
1280 LOG_INFO("found %s", type
);
1282 /* unlikely this could ever fail, but ... */
1283 switch ((didr
>> 16) & 0x0F) {
1284 case ARM11_DEBUG_V6
:
1285 case ARM11_DEBUG_V61
: /* supports security extensions */
1288 LOG_ERROR("Only ARM v6 and v6.1 debug supported.");
1292 arm11
->brp
= ((didr
>> 24) & 0x0F) + 1;
1293 arm11
->wrp
= ((didr
>> 28) & 0x0F) + 1;
1295 /** \todo TODO: reserve one brp slot if we allow breakpoints during step */
1296 arm11
->free_brps
= arm11
->brp
;
1298 LOG_DEBUG("IDCODE %08" PRIx32
" IMPLEMENTOR %02x DIDR %08" PRIx32
,
1299 device_id
, implementor
, didr
);
1301 /* as a side-effect this reads DSCR and thus
1302 * clears the ARM11_DSCR_STICKY_PRECISE_DATA_ABORT / Sticky Precise Data Abort Flag
1303 * as suggested by the spec.
1306 retval
= arm11_check_init(arm11
, NULL
);
1307 if (retval
!= ERROR_OK
)
1310 /* Build register cache "late", after target_init(), since we
1311 * want to know if this core supports Secure Monitor mode.
1313 if (!target_was_examined(target
))
1314 retval
= arm11_dpm_init(arm11
, didr
);
1316 /* ETM on ARM11 still uses original scanchain 6 access mode */
1317 if (arm11
->arm
.etm
&& !target_was_examined(target
)) {
1318 *register_get_last_cache_p(&target
->reg_cache
) =
1319 etm_build_reg_cache(target
, &arm11
->jtag_info
,
1321 retval
= etm_setup(target
);
1324 target_set_examined(target
);
1330 /** Load a register that is marked !valid in the register cache */
1331 static int arm11_get_reg(struct reg
*reg
)
1333 struct arm11_reg_state
*r
= reg
->arch_info
;
1334 struct target
*target
= r
->target
;
1336 if (target
->state
!= TARGET_HALTED
)
1338 LOG_WARNING("target was not halted");
1339 return ERROR_TARGET_NOT_HALTED
;
1342 /** \todo TODO: Check this. We assume that all registers are fetched at debug entry. */
1345 struct arm11_common
*arm11
= target_to_arm11(target
);
1346 const struct arm11_reg_defs
*arm11_reg_info
= arm11_reg_defs
+ ((struct arm11_reg_state
*)reg
->arch_info
)->def_index
;
1352 /** Change a value in the register cache */
1353 static int arm11_set_reg(struct reg
*reg
, uint8_t *buf
)
1355 struct arm11_reg_state
*r
= reg
->arch_info
;
1356 struct target
*target
= r
->target
;
1357 struct arm11_common
*arm11
= target_to_arm11(target
);
1358 // const struct arm11_reg_defs *arm11_reg_info = arm11_reg_defs + ((struct arm11_reg_state *)reg->arch_info)->def_index;
1360 arm11
->reg_values
[((struct arm11_reg_state
*)reg
->arch_info
)->def_index
] = buf_get_u32(buf
, 0, 32);
1367 static const struct reg_arch_type arm11_reg_type
= {
1368 .get
= arm11_get_reg
,
1369 .set
= arm11_set_reg
,
1372 static int arm11_build_reg_cache(struct target
*target
)
1374 struct arm11_common
*arm11
= target_to_arm11(target
);
1375 struct reg_cache
*cache
;
1376 struct reg
*reg_list
;
1377 struct arm11_reg_state
*arm11_reg_states
;
1379 cache
= calloc(1, sizeof *cache
);
1380 reg_list
= calloc(ARM11_REGCACHE_COUNT
, sizeof *reg_list
);
1381 arm11_reg_states
= calloc(ARM11_REGCACHE_COUNT
,
1382 sizeof *arm11_reg_states
);
1383 if (!cache
|| !reg_list
|| !arm11_reg_states
) {
1386 free(arm11_reg_states
);
1390 arm11
->reg_list
= reg_list
;
1392 /* build cache for some of the debug registers */
1393 cache
->name
= "arm11 debug registers";
1394 cache
->reg_list
= reg_list
;
1395 cache
->num_regs
= ARM11_REGCACHE_COUNT
;
1397 struct reg_cache
**cache_p
= register_get_last_cache_p(&target
->reg_cache
);
1400 arm11
->core_cache
= cache
;
1404 /* Not very elegant assertion */
1405 if (ARM11_REGCACHE_COUNT
!= ARRAY_SIZE(arm11
->reg_values
) ||
1406 ARM11_REGCACHE_COUNT
!= ARRAY_SIZE(arm11_reg_defs
) ||
1407 ARM11_REGCACHE_COUNT
!= ARM11_RC_MAX
)
1409 LOG_ERROR("BUG: arm11->reg_values inconsistent (%d %u %u %d)",
1410 ARM11_REGCACHE_COUNT
,
1411 (unsigned) ARRAY_SIZE(arm11
->reg_values
),
1412 (unsigned) ARRAY_SIZE(arm11_reg_defs
),
1414 /* FIXME minimally, use a build_bug_on(X) mechanism;
1415 * runtime exit() here is bad!
1420 for (i
= 0; i
< ARM11_REGCACHE_COUNT
; i
++)
1422 struct reg
* r
= reg_list
+ i
;
1423 const struct arm11_reg_defs
* rd
= arm11_reg_defs
+ i
;
1424 struct arm11_reg_state
* rs
= arm11_reg_states
+ i
;
1428 r
->value
= (uint8_t *)(arm11
->reg_values
+ i
);
1431 r
->type
= &arm11_reg_type
;
1435 rs
->target
= target
;
1441 /* FIXME all these BOOL_WRAPPER things should be modifying
1442 * per-instance state, not shared state; ditto the vector
1443 * catch register support. Scan chains with multiple cores
1444 * should be able to say "work with this core like this,
1445 * that core like that". Example, ARM11 MPCore ...
1448 #define ARM11_BOOL_WRAPPER(name, print_name) \
1449 COMMAND_HANDLER(arm11_handle_bool_##name) \
1451 return CALL_COMMAND_HANDLER(handle_command_parse_bool, \
1452 &arm11_config_##name, print_name); \
1455 ARM11_BOOL_WRAPPER(memwrite_burst
, "memory write burst mode")
1456 ARM11_BOOL_WRAPPER(memwrite_error_fatal
, "fatal error mode for memory writes")
1457 ARM11_BOOL_WRAPPER(step_irq_enable
, "IRQs while stepping")
1458 ARM11_BOOL_WRAPPER(hardware_step
, "hardware single step")
1460 COMMAND_HANDLER(arm11_handle_vcr
)
1466 COMMAND_PARSE_NUMBER(u32
, CMD_ARGV
[0], arm11_vcr
);
1469 return ERROR_COMMAND_SYNTAX_ERROR
;
1472 LOG_INFO("VCR 0x%08" PRIx32
"", arm11_vcr
);
1476 static const struct command_registration arm11_mw_command_handlers
[] = {
1479 .handler
= &arm11_handle_bool_memwrite_burst
,
1480 .mode
= COMMAND_ANY
,
1481 .help
= "Enable/Disable non-standard but fast burst mode"
1482 " (default: enabled)",
1485 .name
= "error_fatal",
1486 .handler
= &arm11_handle_bool_memwrite_error_fatal
,
1487 .mode
= COMMAND_ANY
,
1488 .help
= "Terminate program if transfer error was found"
1489 " (default: enabled)",
1491 COMMAND_REGISTRATION_DONE
1493 static const struct command_registration arm11_any_command_handlers
[] = {
1495 /* "hardware_step" is only here to check if the default
1496 * simulate + breakpoint implementation is broken.
1497 * TEMPORARY! NOT DOCUMENTED! */
1498 .name
= "hardware_step",
1499 .handler
= &arm11_handle_bool_hardware_step
,
1500 .mode
= COMMAND_ANY
,
1501 .help
= "DEBUG ONLY - Hardware single stepping"
1502 " (default: disabled)",
1503 .usage
= "(enable|disable)",
1507 .mode
= COMMAND_ANY
,
1508 .help
= "memwrite command group",
1509 .chain
= arm11_mw_command_handlers
,
1512 .name
= "step_irq_enable",
1513 .handler
= &arm11_handle_bool_step_irq_enable
,
1514 .mode
= COMMAND_ANY
,
1515 .help
= "Enable interrupts while stepping"
1516 " (default: disabled)",
1520 .handler
= &arm11_handle_vcr
,
1521 .mode
= COMMAND_ANY
,
1522 .help
= "Control (Interrupt) Vector Catch Register",
1524 COMMAND_REGISTRATION_DONE
1526 static const struct command_registration arm11_command_handlers
[] = {
1528 .chain
= arm_command_handlers
,
1531 .chain
= etm_command_handlers
,
1535 .mode
= COMMAND_ANY
,
1536 .help
= "ARM11 command group",
1537 .chain
= arm11_any_command_handlers
,
1539 COMMAND_REGISTRATION_DONE
1542 /** Holds methods for ARM11xx targets. */
1543 struct target_type arm11_target
= {
1547 .arch_state
= arm11_arch_state
,
1549 .target_request_data
= arm11_target_request_data
,
1552 .resume
= arm11_resume
,
1555 .assert_reset
= arm11_assert_reset
,
1556 .deassert_reset
= arm11_deassert_reset
,
1557 .soft_reset_halt
= arm11_soft_reset_halt
,
1559 .get_gdb_reg_list
= armv4_5_get_gdb_reg_list
,
1561 .read_memory
= arm11_read_memory
,
1562 .write_memory
= arm11_write_memory
,
1564 .bulk_write_memory
= arm11_bulk_write_memory
,
1566 .checksum_memory
= arm_checksum_memory
,
1567 .blank_check_memory
= arm_blank_check_memory
,
1569 .add_breakpoint
= arm11_add_breakpoint
,
1570 .remove_breakpoint
= arm11_remove_breakpoint
,
1572 .run_algorithm
= armv4_5_run_algorithm
,
1574 .commands
= arm11_command_handlers
,
1575 .target_create
= arm11_target_create
,
1576 .init_target
= arm11_init_target
,
1577 .examine
= arm11_examine
,
Linking to existing account procedure
If you already have an account and want to add another login method
you
MUST first sign in with your existing account and
then change URL to read
https://review.openocd.org/login/?link
to get to this page again but this time it'll work for linking. Thank you.
SSH host keys fingerprints
1024 SHA256:YKx8b7u5ZWdcbp7/4AeXNaqElP49m6QrwfXaqQGJAOk gerrit-code-review@openocd.zylin.com (DSA)
384 SHA256:jHIbSQa4REvwCFG4cq5LBlBLxmxSqelQPem/EXIrxjk gerrit-code-review@openocd.org (ECDSA)
521 SHA256:UAOPYkU9Fjtcao0Ul/Rrlnj/OsQvt+pgdYSZ4jOYdgs gerrit-code-review@openocd.org (ECDSA)
256 SHA256:A13M5QlnozFOvTllybRZH6vm7iSt0XLxbA48yfc2yfY gerrit-code-review@openocd.org (ECDSA)
256 SHA256:spYMBqEYoAOtK7yZBrcwE8ZpYt6b68Cfh9yEVetvbXg gerrit-code-review@openocd.org (ED25519)
+--[ED25519 256]--+
|=.. |
|+o.. . |
|*.o . . |
|+B . . . |
|Bo. = o S |
|Oo.+ + = |
|oB=.* = . o |
| =+=.+ + E |
|. .=o . o |
+----[SHA256]-----+
2048 SHA256:0Onrb7/PHjpo6iVZ7xQX2riKN83FJ3KGU0TvI0TaFG4 gerrit-code-review@openocd.zylin.com (RSA)