1 /***************************************************************************
2 * Copyright (C) 2008 digenius technology GmbH. *
5 * Copyright (C) 2008,2009 Oyvind Harboe oyvind.harboe@zylin.com *
7 * Copyright (C) 2008 Georg Acher <acher@in.tum.de> *
9 * This program is free software; you can redistribute it and/or modify *
10 * it under the terms of the GNU General Public License as published by *
11 * the Free Software Foundation; either version 2 of the License, or *
12 * (at your option) any later version. *
14 * This program is distributed in the hope that it will be useful, *
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
17 * GNU General Public License for more details. *
19 * You should have received a copy of the GNU General Public License *
20 * along with this program; if not, write to the *
21 * Free Software Foundation, Inc., *
22 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
23 ***************************************************************************/
30 #include "breakpoints.h"
31 #include "arm11_dbgtap.h"
32 #include "arm_simulator.h"
33 #include <helper/time_support.h>
34 #include "target_type.h"
35 #include "algorithm.h"
40 #define _DEBUG_INSTRUCTION_EXECUTION_
44 /* FIXME none of these flags should be global to all ARM11 cores!
45 * Most of them shouldn't exist at all, once the code works...
47 static bool arm11_config_memwrite_burst
= true;
48 static bool arm11_config_memwrite_error_fatal
= true;
49 static uint32_t arm11_vcr
= 0;
50 static bool arm11_config_step_irq_enable
= false;
51 static bool arm11_config_hardware_step
= false;
53 static int arm11_step(struct target
*target
, int current
,
54 uint32_t address
, int handle_breakpoints
);
57 /** Check and if necessary take control of the system
59 * \param arm11 Target state variable.
61 static int arm11_check_init(struct arm11_common
*arm11
)
63 CHECK_RETVAL(arm11_read_DSCR(arm11
));
64 LOG_DEBUG("DSCR %08x", (unsigned) arm11
->dscr
);
66 if (!(arm11
->dscr
& DSCR_HALT_DBG_MODE
))
68 LOG_DEBUG("Bringing target into debug mode");
70 arm11
->dscr
|= DSCR_HALT_DBG_MODE
;
71 arm11_write_DSCR(arm11
, arm11
->dscr
);
73 /* add further reset initialization here */
75 arm11
->simulate_reset_on_next_halt
= true;
77 if (arm11
->dscr
& DSCR_CORE_HALTED
)
79 /** \todo TODO: this needs further scrutiny because
80 * arm11_debug_entry() never gets called. (WHY NOT?)
81 * As a result we don't read the actual register states from
85 arm11
->arm
.target
->state
= TARGET_HALTED
;
86 arm11
->arm
.target
->debug_reason
=
87 arm11_get_DSCR_debug_reason(arm11
->dscr
);
91 arm11
->arm
.target
->state
= TARGET_RUNNING
;
92 arm11
->arm
.target
->debug_reason
= DBG_REASON_NOTHALTED
;
95 arm11_sc7_clear_vbw(arm11
);
102 * Save processor state. This is called after a HALT instruction
103 * succeeds, and on other occasions the processor enters debug mode
104 * (breakpoint, watchpoint, etc). Caller has updated arm11->dscr.
106 static int arm11_debug_entry(struct arm11_common
*arm11
)
110 arm11
->arm
.target
->state
= TARGET_HALTED
;
111 arm11
->arm
.target
->debug_reason
=
112 arm11_get_DSCR_debug_reason(arm11
->dscr
);
114 /* REVISIT entire cache should already be invalid !!! */
115 register_cache_invalidate(arm11
->arm
.core_cache
);
117 /* See e.g. ARM1136 TRM, "14.8.4 Entering Debug state" */
119 /* maybe save wDTR (pending DCC write to debug SW, e.g. libdcc) */
120 arm11
->is_wdtr_saved
= !!(arm11
->dscr
& DSCR_DTR_TX_FULL
);
121 if (arm11
->is_wdtr_saved
)
123 arm11_add_debug_SCAN_N(arm11
, 0x05, ARM11_TAP_DEFAULT
);
125 arm11_add_IR(arm11
, ARM11_INTEST
, ARM11_TAP_DEFAULT
);
127 struct scan_field chain5_fields
[3];
129 arm11_setup_field(arm11
, 32, NULL
,
130 &arm11
->saved_wdtr
, chain5_fields
+ 0);
131 arm11_setup_field(arm11
, 1, NULL
, NULL
, chain5_fields
+ 1);
132 arm11_setup_field(arm11
, 1, NULL
, NULL
, chain5_fields
+ 2);
134 arm11_add_dr_scan_vc(ARRAY_SIZE(chain5_fields
), chain5_fields
, TAP_DRPAUSE
);
138 /* DSCR: set the Execute ARM instruction enable bit.
140 * ARM1176 spec says this is needed only for wDTR/rDTR's "ITR mode",
141 * but not to issue ITRs(?). The ARMv7 arch spec says it's required
142 * for executing instructions via ITR.
144 arm11_write_DSCR(arm11
, DSCR_ITR_EN
| arm11
->dscr
);
148 Before executing any instruction in debug state you have to drain the write buffer.
149 This ensures that no imprecise Data Aborts can return at a later point:*/
151 /** \todo TODO: Test drain write buffer. */
156 /* MRC p14,0,R0,c5,c10,0 */
157 // arm11_run_instr_no_data1(arm11, /*0xee150e1a*/0xe320f000);
159 /* mcr 15, 0, r0, cr7, cr10, {4} */
160 arm11_run_instr_no_data1(arm11
, 0xee070f9a);
162 uint32_t dscr
= arm11_read_DSCR(arm11
);
164 LOG_DEBUG("DRAIN, DSCR %08x", dscr
);
166 if (dscr
& ARM11_DSCR_STICKY_IMPRECISE_DATA_ABORT
)
168 arm11_run_instr_no_data1(arm11
, 0xe320f000);
170 dscr
= arm11_read_DSCR(arm11
);
172 LOG_DEBUG("DRAIN, DSCR %08x (DONE)", dscr
);
181 * NOTE: ARM1136 TRM suggests saving just R0 here now, then
182 * CPSR and PC after the rDTR stuff. We do it all at once.
184 retval
= arm_dpm_read_current_registers(&arm11
->dpm
);
185 if (retval
!= ERROR_OK
)
186 LOG_ERROR("DPM REG READ -- fail %d", retval
);
188 retval
= arm11_run_instr_data_prepare(arm11
);
189 if (retval
!= ERROR_OK
)
192 /* maybe save rDTR (pending DCC read from debug SW, e.g. libdcc) */
193 arm11
->is_rdtr_saved
= !!(arm11
->dscr
& DSCR_DTR_RX_FULL
);
194 if (arm11
->is_rdtr_saved
)
196 /* MRC p14,0,R0,c0,c5,0 (move rDTR -> r0 (-> wDTR -> local var)) */
197 retval
= arm11_run_instr_data_from_core_via_r0(arm11
,
198 0xEE100E15, &arm11
->saved_rdtr
);
199 if (retval
!= ERROR_OK
)
203 /* REVISIT Now that we've saved core state, there's may also
204 * be MMU and cache state to care about ...
207 if (arm11
->simulate_reset_on_next_halt
)
209 arm11
->simulate_reset_on_next_halt
= false;
211 LOG_DEBUG("Reset c1 Control Register");
213 /* Write 0 (reset value) to Control register 0 to disable MMU/Cache etc. */
215 /* MCR p15,0,R0,c1,c0,0 */
216 retval
= arm11_run_instr_data_to_core_via_r0(arm11
, 0xee010f10, 0);
217 if (retval
!= ERROR_OK
)
222 retval
= arm11_run_instr_data_finish(arm11
);
223 if (retval
!= ERROR_OK
)
230 * Restore processor state. This is called in preparation for
231 * the RESTART function.
233 static int arm11_leave_debug_state(struct arm11_common
*arm11
, bool bpwp
)
237 /* See e.g. ARM1136 TRM, "14.8.5 Leaving Debug state" */
239 /* NOTE: the ARM1136 TRM suggests restoring all registers
240 * except R0/PC/CPSR right now. Instead, we do them all
241 * at once, just a bit later on.
244 /* REVISIT once we start caring about MMU and cache state,
245 * address it here ...
248 /* spec says clear wDTR and rDTR; we assume they are clear as
249 otherwise our programming would be sloppy */
251 CHECK_RETVAL(arm11_read_DSCR(arm11
));
253 if (arm11
->dscr
& (DSCR_DTR_RX_FULL
| DSCR_DTR_TX_FULL
))
256 The wDTR/rDTR two registers that are used to send/receive data to/from
257 the core in tandem with corresponding instruction codes that are
258 written into the core. The RDTR FULL/WDTR FULL flag indicates that the
259 registers hold data that was written by one side (CPU or JTAG) and not
260 read out by the other side.
262 LOG_ERROR("wDTR/rDTR inconsistent (DSCR %08x)",
263 (unsigned) arm11
->dscr
);
268 /* maybe restore original wDTR */
269 if (arm11
->is_wdtr_saved
)
271 retval
= arm11_run_instr_data_prepare(arm11
);
272 if (retval
!= ERROR_OK
)
275 /* MCR p14,0,R0,c0,c5,0 */
276 retval
= arm11_run_instr_data_to_core_via_r0(arm11
,
277 0xee000e15, arm11
->saved_wdtr
);
278 if (retval
!= ERROR_OK
)
281 retval
= arm11_run_instr_data_finish(arm11
);
282 if (retval
!= ERROR_OK
)
286 /* restore CPSR, PC, and R0 ... after flushing any modified
289 retval
= arm_dpm_write_dirty_registers(&arm11
->dpm
, bpwp
);
291 register_cache_invalidate(arm11
->arm
.core_cache
);
294 arm11_write_DSCR(arm11
, arm11
->dscr
);
296 /* maybe restore rDTR */
297 if (arm11
->is_rdtr_saved
)
299 arm11_add_debug_SCAN_N(arm11
, 0x05, ARM11_TAP_DEFAULT
);
301 arm11_add_IR(arm11
, ARM11_EXTEST
, ARM11_TAP_DEFAULT
);
303 struct scan_field chain5_fields
[3];
305 uint8_t Ready
= 0; /* ignored */
306 uint8_t Valid
= 0; /* ignored */
308 arm11_setup_field(arm11
, 32, &arm11
->saved_rdtr
,
309 NULL
, chain5_fields
+ 0);
310 arm11_setup_field(arm11
, 1, &Ready
, NULL
, chain5_fields
+ 1);
311 arm11_setup_field(arm11
, 1, &Valid
, NULL
, chain5_fields
+ 2);
313 arm11_add_dr_scan_vc(ARRAY_SIZE(chain5_fields
), chain5_fields
, TAP_DRPAUSE
);
316 /* now processor is ready to RESTART */
321 /* poll current target status */
322 static int arm11_poll(struct target
*target
)
325 struct arm11_common
*arm11
= target_to_arm11(target
);
327 CHECK_RETVAL(arm11_check_init(arm11
));
329 if (arm11
->dscr
& DSCR_CORE_HALTED
)
331 if (target
->state
!= TARGET_HALTED
)
333 enum target_state old_state
= target
->state
;
335 LOG_DEBUG("enter TARGET_HALTED");
336 retval
= arm11_debug_entry(arm11
);
337 if (retval
!= ERROR_OK
)
340 target_call_event_callbacks(target
,
341 old_state
== TARGET_DEBUG_RUNNING
? TARGET_EVENT_DEBUG_HALTED
: TARGET_EVENT_HALTED
);
346 if (target
->state
!= TARGET_RUNNING
&& target
->state
!= TARGET_DEBUG_RUNNING
)
348 LOG_DEBUG("enter TARGET_RUNNING");
349 target
->state
= TARGET_RUNNING
;
350 target
->debug_reason
= DBG_REASON_NOTHALTED
;
356 /* architecture specific status reply */
357 static int arm11_arch_state(struct target
*target
)
361 retval
= armv4_5_arch_state(target
);
363 /* REVISIT also display ARM11-specific MMU and cache status ... */
368 /* target request support */
369 static int arm11_target_request_data(struct target
*target
,
370 uint32_t size
, uint8_t *buffer
)
372 LOG_WARNING("Not implemented: %s", __func__
);
377 /* target execution control */
378 static int arm11_halt(struct target
*target
)
380 struct arm11_common
*arm11
= target_to_arm11(target
);
382 LOG_DEBUG("target->state: %s",
383 target_state_name(target
));
385 if (target
->state
== TARGET_UNKNOWN
)
387 arm11
->simulate_reset_on_next_halt
= true;
390 if (target
->state
== TARGET_HALTED
)
392 LOG_DEBUG("target was already halted");
396 arm11_add_IR(arm11
, ARM11_HALT
, TAP_IDLE
);
398 CHECK_RETVAL(jtag_execute_queue());
404 CHECK_RETVAL(arm11_read_DSCR(arm11
));
406 if (arm11
->dscr
& DSCR_CORE_HALTED
)
417 if ((timeval_ms()-then
) > 1000)
419 LOG_WARNING("Timeout (1000ms) waiting for instructions to complete");
426 enum target_state old_state
= target
->state
;
428 arm11_debug_entry(arm11
);
431 target_call_event_callbacks(target
,
432 old_state
== TARGET_DEBUG_RUNNING
? TARGET_EVENT_DEBUG_HALTED
: TARGET_EVENT_HALTED
));
438 arm11_nextpc(struct arm11_common
*arm11
, int current
, uint32_t address
)
440 void *value
= arm11
->arm
.core_cache
->reg_list
[15].value
;
443 buf_set_u32(value
, 0, 32, address
);
445 address
= buf_get_u32(value
, 0, 32);
450 static int arm11_resume(struct target
*target
, int current
,
451 uint32_t address
, int handle_breakpoints
, int debug_execution
)
453 // LOG_DEBUG("current %d address %08x handle_breakpoints %d debug_execution %d",
454 // current, address, handle_breakpoints, debug_execution);
456 struct arm11_common
*arm11
= target_to_arm11(target
);
458 LOG_DEBUG("target->state: %s",
459 target_state_name(target
));
462 if (target
->state
!= TARGET_HALTED
)
464 LOG_ERROR("Target not halted");
465 return ERROR_TARGET_NOT_HALTED
;
468 address
= arm11_nextpc(arm11
, current
, address
);
470 LOG_DEBUG("RESUME PC %08" PRIx32
"%s", address
, !current
? "!" : "");
472 /* clear breakpoints/watchpoints and VCR*/
473 arm11_sc7_clear_vbw(arm11
);
475 if (!debug_execution
)
476 target_free_all_working_areas(target
);
478 /* Set up breakpoints */
479 if (handle_breakpoints
)
481 /* check if one matches PC and step over it if necessary */
483 struct breakpoint
* bp
;
485 for (bp
= target
->breakpoints
; bp
; bp
= bp
->next
)
487 if (bp
->address
== address
)
489 LOG_DEBUG("must step over %08" PRIx32
"", bp
->address
);
490 arm11_step(target
, 1, 0, 0);
495 /* set all breakpoints */
497 unsigned brp_num
= 0;
499 for (bp
= target
->breakpoints
; bp
; bp
= bp
->next
)
501 struct arm11_sc7_action brp
[2];
504 brp
[0].address
= ARM11_SC7_BVR0
+ brp_num
;
505 brp
[0].value
= bp
->address
;
507 brp
[1].address
= ARM11_SC7_BCR0
+ brp_num
;
508 brp
[1].value
= 0x1 | (3 << 1) | (0x0F << 5) | (0 << 14) | (0 << 16) | (0 << 20) | (0 << 21);
510 arm11_sc7_run(arm11
, brp
, ARRAY_SIZE(brp
));
512 LOG_DEBUG("Add BP %d at %08" PRIx32
, brp_num
,
518 arm11_sc7_set_vcr(arm11
, arm11_vcr
);
521 arm11_leave_debug_state(arm11
, handle_breakpoints
);
523 arm11_add_IR(arm11
, ARM11_RESTART
, TAP_IDLE
);
525 CHECK_RETVAL(jtag_execute_queue());
530 CHECK_RETVAL(arm11_read_DSCR(arm11
));
532 LOG_DEBUG("DSCR %08x", (unsigned) arm11
->dscr
);
534 if (arm11
->dscr
& DSCR_CORE_RESTARTED
)
545 if ((timeval_ms()-then
) > 1000)
547 LOG_WARNING("Timeout (1000ms) waiting for instructions to complete");
554 if (!debug_execution
)
556 target
->state
= TARGET_RUNNING
;
557 target
->debug_reason
= DBG_REASON_NOTHALTED
;
559 CHECK_RETVAL(target_call_event_callbacks(target
, TARGET_EVENT_RESUMED
));
563 target
->state
= TARGET_DEBUG_RUNNING
;
564 target
->debug_reason
= DBG_REASON_NOTHALTED
;
566 CHECK_RETVAL(target_call_event_callbacks(target
, TARGET_EVENT_RESUMED
));
572 static int arm11_step(struct target
*target
, int current
,
573 uint32_t address
, int handle_breakpoints
)
575 LOG_DEBUG("target->state: %s",
576 target_state_name(target
));
578 if (target
->state
!= TARGET_HALTED
)
580 LOG_WARNING("target was not halted");
581 return ERROR_TARGET_NOT_HALTED
;
584 struct arm11_common
*arm11
= target_to_arm11(target
);
586 address
= arm11_nextpc(arm11
, current
, address
);
588 LOG_DEBUG("STEP PC %08" PRIx32
"%s", address
, !current
? "!" : "");
591 /** \todo TODO: Thumb not supported here */
593 uint32_t next_instruction
;
595 CHECK_RETVAL(arm11_read_memory_word(arm11
, address
, &next_instruction
));
598 if ((next_instruction
& 0xFFF00070) == 0xe1200070)
600 address
= arm11_nextpc(arm11
, 0, address
+ 4);
601 LOG_DEBUG("Skipping BKPT");
603 /* skip over Wait for interrupt / Standby */
604 /* mcr 15, 0, r?, cr7, cr0, {4} */
605 else if ((next_instruction
& 0xFFFF0FFF) == 0xee070f90)
607 address
= arm11_nextpc(arm11
, 0, address
+ 4);
608 LOG_DEBUG("Skipping WFI");
610 /* ignore B to self */
611 else if ((next_instruction
& 0xFEFFFFFF) == 0xeafffffe)
613 LOG_DEBUG("Not stepping jump to self");
617 /** \todo TODO: check if break-/watchpoints make any sense at all in combination
620 /** \todo TODO: check if disabling IRQs might be a good idea here. Alternatively
621 * the VCR might be something worth looking into. */
624 /* Set up breakpoint for stepping */
626 struct arm11_sc7_action brp
[2];
629 brp
[0].address
= ARM11_SC7_BVR0
;
631 brp
[1].address
= ARM11_SC7_BCR0
;
633 if (arm11_config_hardware_step
)
635 /* Hardware single stepping ("instruction address
636 * mismatch") is used if enabled. It's not quite
637 * exactly "run one instruction"; "branch to here"
638 * loops won't break, neither will some other cases,
639 * but it's probably the best default.
641 * Hardware single stepping isn't supported on v6
642 * debug modules. ARM1176 and v7 can support it...
644 * FIXME Thumb stepping likely needs to use 0x03
645 * or 0xc0 byte masks, not 0x0f.
647 brp
[0].value
= address
;
648 brp
[1].value
= 0x1 | (3 << 1) | (0x0F << 5)
649 | (0 << 14) | (0 << 16) | (0 << 20)
653 /* Sets a breakpoint on the next PC, as calculated
654 * by instruction set simulation.
656 * REVISIT stepping Thumb on ARM1156 requires Thumb2
657 * support from the simulator.
662 retval
= arm_simulate_step(target
, &next_pc
);
663 if (retval
!= ERROR_OK
)
666 brp
[0].value
= next_pc
;
667 brp
[1].value
= 0x1 | (3 << 1) | (0x0F << 5)
668 | (0 << 14) | (0 << 16) | (0 << 20)
672 CHECK_RETVAL(arm11_sc7_run(arm11
, brp
, ARRAY_SIZE(brp
)));
677 if (arm11_config_step_irq_enable
)
678 /* this disable should be redundant ... */
679 arm11
->dscr
&= ~DSCR_INT_DIS
;
681 arm11
->dscr
|= DSCR_INT_DIS
;
684 CHECK_RETVAL(arm11_leave_debug_state(arm11
, handle_breakpoints
));
686 arm11_add_IR(arm11
, ARM11_RESTART
, TAP_IDLE
);
688 CHECK_RETVAL(jtag_execute_queue());
695 const uint32_t mask
= DSCR_CORE_RESTARTED
698 CHECK_RETVAL(arm11_read_DSCR(arm11
));
699 LOG_DEBUG("DSCR %08x e", (unsigned) arm11
->dscr
);
701 if ((arm11
->dscr
& mask
) == mask
)
711 if ((timeval_ms()-then
) > 1000)
713 LOG_WARNING("Timeout (1000ms) waiting for instructions to complete");
720 /* clear breakpoint */
721 arm11_sc7_clear_vbw(arm11
);
724 CHECK_RETVAL(arm11_debug_entry(arm11
));
726 /* restore default state */
727 arm11
->dscr
&= ~DSCR_INT_DIS
;
731 target
->debug_reason
= DBG_REASON_SINGLESTEP
;
733 CHECK_RETVAL(target_call_event_callbacks(target
, TARGET_EVENT_HALTED
));
738 static int arm11_assert_reset(struct target
*target
)
741 struct arm11_common
*arm11
= target_to_arm11(target
);
743 retval
= arm11_check_init(arm11
);
744 if (retval
!= ERROR_OK
)
747 target
->state
= TARGET_UNKNOWN
;
749 /* we would very much like to reset into the halted, state,
750 * but resetting and halting is second best... */
751 if (target
->reset_halt
)
753 CHECK_RETVAL(target_halt(target
));
757 /* srst is funny. We can not do *anything* else while it's asserted
758 * and it has unkonwn side effects. Make sure no other code runs
761 * Code below assumes srst:
763 * - Causes power-on-reset (but of what parts of the system?). Bug
766 * - Messes us TAP state without asserting trst.
768 * - There is another bug in the arm11 core. When you generate an access to
769 * external logic (for example ddr controller via AHB bus) and that block
770 * is not configured (perhaps it is still held in reset), that transaction
771 * will never complete. This will hang arm11 core but it will also hang
772 * JTAG controller. Nothing, short of srst assertion will bring it out of
777 * - What should the PC be after an srst reset when starting in the halted
781 jtag_add_reset(0, 1);
782 jtag_add_reset(0, 0);
784 /* How long do we have to wait? */
785 jtag_add_sleep(5000);
787 /* un-mess up TAP state */
790 retval
= jtag_execute_queue();
791 if (retval
!= ERROR_OK
)
799 static int arm11_deassert_reset(struct target
*target
)
804 static int arm11_soft_reset_halt(struct target
*target
)
806 LOG_WARNING("Not implemented: %s", __func__
);
811 /* target memory access
812 * size: 1 = byte (8bit), 2 = half-word (16bit), 4 = word (32bit)
813 * count: number of items of <size>
815 * arm11_config_memrw_no_increment - in the future we may want to be able
816 * to read/write a range of data to a "port". a "port" is an action on
817 * read memory address for some peripheral.
819 static int arm11_read_memory_inner(struct target
*target
,
820 uint32_t address
, uint32_t size
, uint32_t count
, uint8_t *buffer
,
821 bool arm11_config_memrw_no_increment
)
823 /** \todo TODO: check if buffer cast to uint32_t* and uint16_t* might cause alignment problems */
826 if (target
->state
!= TARGET_HALTED
)
828 LOG_WARNING("target was not halted");
829 return ERROR_TARGET_NOT_HALTED
;
832 LOG_DEBUG("ADDR %08" PRIx32
" SIZE %08" PRIx32
" COUNT %08" PRIx32
"", address
, size
, count
);
834 struct arm11_common
*arm11
= target_to_arm11(target
);
836 retval
= arm11_run_instr_data_prepare(arm11
);
837 if (retval
!= ERROR_OK
)
840 /* MRC p14,0,r0,c0,c5,0 */
841 retval
= arm11_run_instr_data_to_core1(arm11
, 0xee100e15, address
);
842 if (retval
!= ERROR_OK
)
848 arm11
->arm
.core_cache
->reg_list
[1].dirty
= true;
850 for (size_t i
= 0; i
< count
; i
++)
852 /* ldrb r1, [r0], #1 */
854 arm11_run_instr_no_data1(arm11
,
855 !arm11_config_memrw_no_increment
? 0xe4d01001 : 0xe5d01000);
858 /* MCR p14,0,R1,c0,c5,0 */
859 arm11_run_instr_data_from_core(arm11
, 0xEE001E15, &res
, 1);
868 arm11
->arm
.core_cache
->reg_list
[1].dirty
= true;
870 for (size_t i
= 0; i
< count
; i
++)
872 /* ldrh r1, [r0], #2 */
873 arm11_run_instr_no_data1(arm11
,
874 !arm11_config_memrw_no_increment
? 0xe0d010b2 : 0xe1d010b0);
878 /* MCR p14,0,R1,c0,c5,0 */
879 arm11_run_instr_data_from_core(arm11
, 0xEE001E15, &res
, 1);
881 uint16_t svalue
= res
;
882 memcpy(buffer
+ i
* sizeof(uint16_t), &svalue
, sizeof(uint16_t));
890 uint32_t instr
= !arm11_config_memrw_no_increment
? 0xecb05e01 : 0xed905e00;
891 /** \todo TODO: buffer cast to uint32_t* causes alignment warnings */
892 uint32_t *words
= (uint32_t *)buffer
;
894 /* LDC p14,c5,[R0],#4 */
895 /* LDC p14,c5,[R0] */
896 arm11_run_instr_data_from_core(arm11
, instr
, words
, count
);
901 return arm11_run_instr_data_finish(arm11
);
904 static int arm11_read_memory(struct target
*target
, uint32_t address
, uint32_t size
, uint32_t count
, uint8_t *buffer
)
906 return arm11_read_memory_inner(target
, address
, size
, count
, buffer
, false);
910 * no_increment - in the future we may want to be able
911 * to read/write a range of data to a "port". a "port" is an action on
912 * read memory address for some peripheral.
914 static int arm11_write_memory_inner(struct target
*target
,
915 uint32_t address
, uint32_t size
,
916 uint32_t count
, uint8_t *buffer
,
921 if (target
->state
!= TARGET_HALTED
)
923 LOG_WARNING("target was not halted");
924 return ERROR_TARGET_NOT_HALTED
;
927 LOG_DEBUG("ADDR %08" PRIx32
" SIZE %08" PRIx32
" COUNT %08" PRIx32
"", address
, size
, count
);
929 struct arm11_common
*arm11
= target_to_arm11(target
);
931 retval
= arm11_run_instr_data_prepare(arm11
);
932 if (retval
!= ERROR_OK
)
935 /* MRC p14,0,r0,c0,c5,0 */
936 retval
= arm11_run_instr_data_to_core1(arm11
, 0xee100e15, address
);
937 if (retval
!= ERROR_OK
)
940 /* burst writes are not used for single words as those may well be
941 * reset init script writes.
943 * The other advantage is that as burst writes are default, we'll
944 * now exercise both burst and non-burst code paths with the
945 * default settings, increasing code coverage.
947 bool burst
= arm11_config_memwrite_burst
&& (count
> 1);
953 arm11
->arm
.core_cache
->reg_list
[1].dirty
= true;
955 for (size_t i
= 0; i
< count
; i
++)
957 /* MRC p14,0,r1,c0,c5,0 */
958 retval
= arm11_run_instr_data_to_core1(arm11
, 0xee101e15, *buffer
++);
959 if (retval
!= ERROR_OK
)
962 /* strb r1, [r0], #1 */
964 retval
= arm11_run_instr_no_data1(arm11
,
968 if (retval
!= ERROR_OK
)
977 arm11
->arm
.core_cache
->reg_list
[1].dirty
= true;
979 for (size_t i
= 0; i
< count
; i
++)
982 memcpy(&value
, buffer
+ i
* sizeof(uint16_t), sizeof(uint16_t));
984 /* MRC p14,0,r1,c0,c5,0 */
985 retval
= arm11_run_instr_data_to_core1(arm11
, 0xee101e15, value
);
986 if (retval
!= ERROR_OK
)
989 /* strh r1, [r0], #2 */
991 retval
= arm11_run_instr_no_data1(arm11
,
995 if (retval
!= ERROR_OK
)
1003 uint32_t instr
= !no_increment
? 0xeca05e01 : 0xed805e00;
1005 /** \todo TODO: buffer cast to uint32_t* causes alignment warnings */
1006 uint32_t *words
= (uint32_t*)buffer
;
1010 /* STC p14,c5,[R0],#4 */
1011 /* STC p14,c5,[R0]*/
1012 retval
= arm11_run_instr_data_to_core(arm11
, instr
, words
, count
);
1013 if (retval
!= ERROR_OK
)
1018 /* STC p14,c5,[R0],#4 */
1019 /* STC p14,c5,[R0]*/
1020 retval
= arm11_run_instr_data_to_core_noack(arm11
, instr
, words
, count
);
1021 if (retval
!= ERROR_OK
)
1029 /* r0 verification */
1034 /* MCR p14,0,R0,c0,c5,0 */
1035 retval
= arm11_run_instr_data_from_core(arm11
, 0xEE000E15, &r0
, 1);
1036 if (retval
!= ERROR_OK
)
1039 if (address
+ size
* count
!= r0
)
1041 LOG_ERROR("Data transfer failed. Expected end "
1042 "address 0x%08x, got 0x%08x",
1043 (unsigned) (address
+ size
* count
),
1047 LOG_ERROR("use 'arm11 memwrite burst disable' to disable fast burst mode");
1049 if (arm11_config_memwrite_error_fatal
)
1054 return arm11_run_instr_data_finish(arm11
);
1057 static int arm11_write_memory(struct target
*target
,
1058 uint32_t address
, uint32_t size
,
1059 uint32_t count
, uint8_t *buffer
)
1061 /* pointer increment matters only for multi-unit writes ...
1062 * not e.g. to a "reset the chip" controller.
1064 return arm11_write_memory_inner(target
, address
, size
,
1065 count
, buffer
, count
== 1);
1068 /* write target memory in multiples of 4 byte, optimized for writing large quantities of data */
1069 static int arm11_bulk_write_memory(struct target
*target
,
1070 uint32_t address
, uint32_t count
, uint8_t *buffer
)
1072 if (target
->state
!= TARGET_HALTED
)
1074 LOG_WARNING("target was not halted");
1075 return ERROR_TARGET_NOT_HALTED
;
1078 return arm11_write_memory(target
, address
, 4, count
, buffer
);
1081 /* target break-/watchpoint control
1082 * rw: 0 = write, 1 = read, 2 = access
1084 static int arm11_add_breakpoint(struct target
*target
,
1085 struct breakpoint
*breakpoint
)
1087 struct arm11_common
*arm11
= target_to_arm11(target
);
1090 if (breakpoint
->type
== BKPT_SOFT
)
1092 LOG_INFO("sw breakpoint requested, but software breakpoints not enabled");
1093 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
1097 if (!arm11
->free_brps
)
1099 LOG_DEBUG("no breakpoint unit available for hardware breakpoint");
1100 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
1103 if (breakpoint
->length
!= 4)
1105 LOG_DEBUG("only breakpoints of four bytes length supported");
1106 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
1114 static int arm11_remove_breakpoint(struct target
*target
,
1115 struct breakpoint
*breakpoint
)
1117 struct arm11_common
*arm11
= target_to_arm11(target
);
1124 static int arm11_target_create(struct target
*target
, Jim_Interp
*interp
)
1126 struct arm11_common
*arm11
;
1128 if (target
->tap
== NULL
)
1131 if (target
->tap
->ir_length
!= 5)
1133 LOG_ERROR("'target arm11' expects IR LENGTH = 5");
1134 return ERROR_COMMAND_SYNTAX_ERROR
;
1137 arm11
= calloc(1, sizeof *arm11
);
1141 armv4_5_init_arch_info(target
, &arm11
->arm
);
1143 arm11
->jtag_info
.tap
= target
->tap
;
1144 arm11
->jtag_info
.scann_size
= 5;
1145 arm11
->jtag_info
.scann_instr
= ARM11_SCAN_N
;
1146 /* cur_scan_chain == 0 */
1147 arm11
->jtag_info
.intest_instr
= ARM11_INTEST
;
1152 static int arm11_init_target(struct command_context
*cmd_ctx
,
1153 struct target
*target
)
1155 /* Initialize anything we can set up without talking to the target */
1159 /* talk to the target and set things up */
1160 static int arm11_examine(struct target
*target
)
1164 struct arm11_common
*arm11
= target_to_arm11(target
);
1165 uint32_t didr
, device_id
;
1166 uint8_t implementor
;
1168 /* FIXME split into do-first-time and do-every-time logic ... */
1172 arm11_add_IR(arm11
, ARM11_IDCODE
, ARM11_TAP_DEFAULT
);
1174 struct scan_field idcode_field
;
1176 arm11_setup_field(arm11
, 32, NULL
, &device_id
, &idcode_field
);
1178 arm11_add_dr_scan_vc(1, &idcode_field
, TAP_DRPAUSE
);
1182 arm11_add_debug_SCAN_N(arm11
, 0x00, ARM11_TAP_DEFAULT
);
1184 arm11_add_IR(arm11
, ARM11_INTEST
, ARM11_TAP_DEFAULT
);
1186 struct scan_field chain0_fields
[2];
1188 arm11_setup_field(arm11
, 32, NULL
, &didr
, chain0_fields
+ 0);
1189 arm11_setup_field(arm11
, 8, NULL
, &implementor
, chain0_fields
+ 1);
1191 arm11_add_dr_scan_vc(ARRAY_SIZE(chain0_fields
), chain0_fields
, TAP_IDLE
);
1193 CHECK_RETVAL(jtag_execute_queue());
1195 switch (device_id
& 0x0FFFF000)
1204 arm11
->arm
.core_type
= ARM_MODE_MON
;
1208 LOG_ERROR("'target arm11' expects IDCODE 0x*7B*7****");
1211 LOG_INFO("found %s", type
);
1213 /* unlikely this could ever fail, but ... */
1214 switch ((didr
>> 16) & 0x0F) {
1215 case ARM11_DEBUG_V6
:
1216 case ARM11_DEBUG_V61
: /* supports security extensions */
1219 LOG_ERROR("Only ARM v6 and v6.1 debug supported.");
1223 arm11
->brp
= ((didr
>> 24) & 0x0F) + 1;
1224 arm11
->wrp
= ((didr
>> 28) & 0x0F) + 1;
1226 /** \todo TODO: reserve one brp slot if we allow breakpoints during step */
1227 arm11
->free_brps
= arm11
->brp
;
1229 LOG_DEBUG("IDCODE %08" PRIx32
" IMPLEMENTOR %02x DIDR %08" PRIx32
,
1230 device_id
, implementor
, didr
);
1232 /* as a side-effect this reads DSCR and thus
1233 * clears the ARM11_DSCR_STICKY_PRECISE_DATA_ABORT / Sticky Precise Data Abort Flag
1234 * as suggested by the spec.
1237 retval
= arm11_check_init(arm11
);
1238 if (retval
!= ERROR_OK
)
1241 /* Build register cache "late", after target_init(), since we
1242 * want to know if this core supports Secure Monitor mode.
1244 if (!target_was_examined(target
))
1245 retval
= arm11_dpm_init(arm11
, didr
);
1247 /* ETM on ARM11 still uses original scanchain 6 access mode */
1248 if (arm11
->arm
.etm
&& !target_was_examined(target
)) {
1249 *register_get_last_cache_p(&target
->reg_cache
) =
1250 etm_build_reg_cache(target
, &arm11
->jtag_info
,
1252 retval
= etm_setup(target
);
1255 target_set_examined(target
);
1261 /* FIXME all these BOOL_WRAPPER things should be modifying
1262 * per-instance state, not shared state; ditto the vector
1263 * catch register support. Scan chains with multiple cores
1264 * should be able to say "work with this core like this,
1265 * that core like that". Example, ARM11 MPCore ...
1268 #define ARM11_BOOL_WRAPPER(name, print_name) \
1269 COMMAND_HANDLER(arm11_handle_bool_##name) \
1271 return CALL_COMMAND_HANDLER(handle_command_parse_bool, \
1272 &arm11_config_##name, print_name); \
1275 ARM11_BOOL_WRAPPER(memwrite_burst
, "memory write burst mode")
1276 ARM11_BOOL_WRAPPER(memwrite_error_fatal
, "fatal error mode for memory writes")
1277 ARM11_BOOL_WRAPPER(step_irq_enable
, "IRQs while stepping")
1278 ARM11_BOOL_WRAPPER(hardware_step
, "hardware single step")
1280 COMMAND_HANDLER(arm11_handle_vcr
)
1286 COMMAND_PARSE_NUMBER(u32
, CMD_ARGV
[0], arm11_vcr
);
1289 return ERROR_COMMAND_SYNTAX_ERROR
;
1292 LOG_INFO("VCR 0x%08" PRIx32
"", arm11_vcr
);
1296 static const struct command_registration arm11_mw_command_handlers
[] = {
1299 .handler
= &arm11_handle_bool_memwrite_burst
,
1300 .mode
= COMMAND_ANY
,
1301 .help
= "Enable/Disable non-standard but fast burst mode"
1302 " (default: enabled)",
1305 .name
= "error_fatal",
1306 .handler
= &arm11_handle_bool_memwrite_error_fatal
,
1307 .mode
= COMMAND_ANY
,
1308 .help
= "Terminate program if transfer error was found"
1309 " (default: enabled)",
1311 COMMAND_REGISTRATION_DONE
1313 static const struct command_registration arm11_any_command_handlers
[] = {
1315 /* "hardware_step" is only here to check if the default
1316 * simulate + breakpoint implementation is broken.
1317 * TEMPORARY! NOT DOCUMENTED! */
1318 .name
= "hardware_step",
1319 .handler
= &arm11_handle_bool_hardware_step
,
1320 .mode
= COMMAND_ANY
,
1321 .help
= "DEBUG ONLY - Hardware single stepping"
1322 " (default: disabled)",
1323 .usage
= "(enable|disable)",
1327 .mode
= COMMAND_ANY
,
1328 .help
= "memwrite command group",
1329 .chain
= arm11_mw_command_handlers
,
1332 .name
= "step_irq_enable",
1333 .handler
= &arm11_handle_bool_step_irq_enable
,
1334 .mode
= COMMAND_ANY
,
1335 .help
= "Enable interrupts while stepping"
1336 " (default: disabled)",
1340 .handler
= &arm11_handle_vcr
,
1341 .mode
= COMMAND_ANY
,
1342 .help
= "Control (Interrupt) Vector Catch Register",
1344 COMMAND_REGISTRATION_DONE
1346 static const struct command_registration arm11_command_handlers
[] = {
1348 .chain
= arm_command_handlers
,
1351 .chain
= etm_command_handlers
,
1355 .mode
= COMMAND_ANY
,
1356 .help
= "ARM11 command group",
1357 .chain
= arm11_any_command_handlers
,
1359 COMMAND_REGISTRATION_DONE
1362 /** Holds methods for ARM11xx targets. */
1363 struct target_type arm11_target
= {
1367 .arch_state
= arm11_arch_state
,
1369 .target_request_data
= arm11_target_request_data
,
1372 .resume
= arm11_resume
,
1375 .assert_reset
= arm11_assert_reset
,
1376 .deassert_reset
= arm11_deassert_reset
,
1377 .soft_reset_halt
= arm11_soft_reset_halt
,
1379 .get_gdb_reg_list
= armv4_5_get_gdb_reg_list
,
1381 .read_memory
= arm11_read_memory
,
1382 .write_memory
= arm11_write_memory
,
1384 .bulk_write_memory
= arm11_bulk_write_memory
,
1386 .checksum_memory
= arm_checksum_memory
,
1387 .blank_check_memory
= arm_blank_check_memory
,
1389 .add_breakpoint
= arm11_add_breakpoint
,
1390 .remove_breakpoint
= arm11_remove_breakpoint
,
1392 .run_algorithm
= armv4_5_run_algorithm
,
1394 .commands
= arm11_command_handlers
,
1395 .target_create
= arm11_target_create
,
1396 .init_target
= arm11_init_target
,
1397 .examine
= arm11_examine
,
Linking to existing account procedure
If you already have an account and want to add another login method
you
MUST first sign in with your existing account and
then change URL to read
https://review.openocd.org/login/?link
to get to this page again but this time it'll work for linking. Thank you.
SSH host keys fingerprints
1024 SHA256:YKx8b7u5ZWdcbp7/4AeXNaqElP49m6QrwfXaqQGJAOk gerrit-code-review@openocd.zylin.com (DSA)
384 SHA256:jHIbSQa4REvwCFG4cq5LBlBLxmxSqelQPem/EXIrxjk gerrit-code-review@openocd.org (ECDSA)
521 SHA256:UAOPYkU9Fjtcao0Ul/Rrlnj/OsQvt+pgdYSZ4jOYdgs gerrit-code-review@openocd.org (ECDSA)
256 SHA256:A13M5QlnozFOvTllybRZH6vm7iSt0XLxbA48yfc2yfY gerrit-code-review@openocd.org (ECDSA)
256 SHA256:spYMBqEYoAOtK7yZBrcwE8ZpYt6b68Cfh9yEVetvbXg gerrit-code-review@openocd.org (ED25519)
+--[ED25519 256]--+
|=.. |
|+o.. . |
|*.o . . |
|+B . . . |
|Bo. = o S |
|Oo.+ + = |
|oB=.* = . o |
| =+=.+ + E |
|. .=o . o |
+----[SHA256]-----+
2048 SHA256:0Onrb7/PHjpo6iVZ7xQX2riKN83FJ3KGU0TvI0TaFG4 gerrit-code-review@openocd.zylin.com (RSA)