1 /***************************************************************************
2 * Copyright (C) 2005 by Dominic Rath *
3 * Dominic.Rath@gmx.de *
5 * Copyright (C) 2007,2008 Øyvind Harboe *
6 * oyvind.harboe@zylin.com *
8 * Copyright (C) 2008 by Spencer Oliver *
9 * spen@spen-soft.co.uk *
11 * Copyright (C) 2008 by Hongtao Zheng *
14 * This program is free software; you can redistribute it and/or modify *
15 * it under the terms of the GNU General Public License as published by *
16 * the Free Software Foundation; either version 2 of the License, or *
17 * (at your option) any later version. *
19 * This program is distributed in the hope that it will be useful, *
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
22 * GNU General Public License for more details. *
24 * You should have received a copy of the GNU General Public License *
25 * along with this program; if not, write to the *
26 * Free Software Foundation, Inc., *
27 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
28 ***************************************************************************/
33 #include "breakpoints.h"
34 #include "embeddedice.h"
35 #include "target_request.h"
36 #include "arm7_9_common.h"
37 #include "time_support.h"
38 #include "arm_simulator.h"
39 #include "algorithm.h"
44 * Hold common code supporting the ARM7 and ARM9 core generations.
46 * While the ARM core implementations evolved substantially during these
47 * two generations, they look quite similar from the JTAG perspective.
48 * Both have similar debug facilities, based on the same two scan chains
49 * providing access to the core and to an EmbeddedICE module. Both can
50 * support similar ETM and ETB modules, for tracing. And both expose
51 * what could be viewed as "ARM Classic", with multiple processor modes,
52 * shadowed registers, and support for the Thumb instruction set.
54 * Processor differences include things like presence or absence of MMU
55 * and cache, pipeline sizes, use of a modified Harvard Architecure
56 * (with separate instruction and data busses from the CPU), support
57 * for cpu clock gating during idle, and more.
60 static int arm7_9_debug_entry(struct target
*target
);
63 * Clear watchpoints for an ARM7/9 target.
65 * @param arm7_9 Pointer to the common struct for an ARM7/9 target
66 * @return JTAG error status after executing queue
68 static int arm7_9_clear_watchpoints(struct arm7_9_common
*arm7_9
)
71 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], 0x0);
72 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
], 0x0);
73 arm7_9
->sw_breakpoint_count
= 0;
74 arm7_9
->sw_breakpoints_added
= 0;
76 arm7_9
->wp1_used
= arm7_9
->wp1_used_default
;
77 arm7_9
->wp_available
= arm7_9
->wp_available_max
;
79 return jtag_execute_queue();
83 * Assign a watchpoint to one of the two available hardware comparators in an
84 * ARM7 or ARM9 target.
86 * @param arm7_9 Pointer to the common struct for an ARM7/9 target
87 * @param breakpoint Pointer to the breakpoint to be used as a watchpoint
89 static void arm7_9_assign_wp(struct arm7_9_common
*arm7_9
, struct breakpoint
*breakpoint
)
91 if (!arm7_9
->wp0_used
)
95 arm7_9
->wp_available
--;
97 else if (!arm7_9
->wp1_used
)
101 arm7_9
->wp_available
--;
105 LOG_ERROR("BUG: no hardware comparator available");
107 LOG_DEBUG("BPID: %d (0x%08" PRIx32
") using hw wp: %d",
108 breakpoint
->unique_id
,
114 * Setup an ARM7/9 target's embedded ICE registers for software breakpoints.
116 * @param arm7_9 Pointer to common struct for ARM7/9 targets
117 * @return Error codes if there is a problem finding a watchpoint or the result
118 * of executing the JTAG queue
120 static int arm7_9_set_software_breakpoints(struct arm7_9_common
*arm7_9
)
122 if (arm7_9
->sw_breakpoints_added
)
126 if (arm7_9
->wp_available
< 1)
128 LOG_WARNING("can't enable sw breakpoints with no watchpoint unit available");
129 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
131 arm7_9
->wp_available
--;
133 /* pick a breakpoint unit */
134 if (!arm7_9
->wp0_used
)
136 arm7_9
->sw_breakpoints_added
= 1;
137 arm7_9
->wp0_used
= 3;
138 } else if (!arm7_9
->wp1_used
)
140 arm7_9
->sw_breakpoints_added
= 2;
141 arm7_9
->wp1_used
= 3;
145 LOG_ERROR("BUG: both watchpoints used, but wp_available >= 1");
149 if (arm7_9
->sw_breakpoints_added
== 1)
151 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_VALUE
], arm7_9
->arm_bkpt
);
152 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
], 0x0);
153 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
], 0xffffffffu
);
154 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
], ~EICE_W_CTRL_nOPC
& 0xff);
155 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], EICE_W_CTRL_ENABLE
);
157 else if (arm7_9
->sw_breakpoints_added
== 2)
159 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_DATA_VALUE
], arm7_9
->arm_bkpt
);
160 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_DATA_MASK
], 0x0);
161 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_MASK
], 0xffffffffu
);
162 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_MASK
], ~EICE_W_CTRL_nOPC
& 0xff);
163 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
], EICE_W_CTRL_ENABLE
);
167 LOG_ERROR("BUG: both watchpoints used, but wp_available >= 1");
170 LOG_DEBUG("SW BP using hw wp: %d",
171 arm7_9
->sw_breakpoints_added
);
173 return jtag_execute_queue();
177 * Setup the common pieces for an ARM7/9 target after reset or on startup.
179 * @param target Pointer to an ARM7/9 target to setup
180 * @return Result of clearing the watchpoints on the target
182 int arm7_9_setup(struct target
*target
)
184 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
186 return arm7_9_clear_watchpoints(arm7_9
);
190 * Set either a hardware or software breakpoint on an ARM7/9 target. The
191 * breakpoint is set up even if it is already set. Some actions, e.g. reset,
192 * might have erased the values in Embedded ICE.
194 * @param target Pointer to the target device to set the breakpoints on
195 * @param breakpoint Pointer to the breakpoint to be set
196 * @return For hardware breakpoints, this is the result of executing the JTAG
197 * queue. For software breakpoints, this will be the status of the
198 * required memory reads and writes
200 int arm7_9_set_breakpoint(struct target
*target
, struct breakpoint
*breakpoint
)
202 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
203 int retval
= ERROR_OK
;
205 LOG_DEBUG("BPID: %d, Address: 0x%08" PRIx32
", Type: %d" ,
206 breakpoint
->unique_id
,
210 if (target
->state
!= TARGET_HALTED
)
212 LOG_WARNING("target not halted");
213 return ERROR_TARGET_NOT_HALTED
;
216 if (breakpoint
->type
== BKPT_HARD
)
218 /* either an ARM (4 byte) or Thumb (2 byte) breakpoint */
219 uint32_t mask
= (breakpoint
->length
== 4) ? 0x3u
: 0x1u
;
221 /* reassign a hw breakpoint */
222 if (breakpoint
->set
== 0)
224 arm7_9_assign_wp(arm7_9
, breakpoint
);
227 if (breakpoint
->set
== 1)
229 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_VALUE
], breakpoint
->address
);
230 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
], mask
);
231 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
], 0xffffffffu
);
232 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
], ~EICE_W_CTRL_nOPC
& 0xff);
233 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], EICE_W_CTRL_ENABLE
);
235 else if (breakpoint
->set
== 2)
237 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_VALUE
], breakpoint
->address
);
238 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_MASK
], mask
);
239 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_DATA_MASK
], 0xffffffffu
);
240 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_MASK
], ~EICE_W_CTRL_nOPC
& 0xff);
241 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
], EICE_W_CTRL_ENABLE
);
245 LOG_ERROR("BUG: no hardware comparator available");
249 retval
= jtag_execute_queue();
251 else if (breakpoint
->type
== BKPT_SOFT
)
253 /* did we already set this breakpoint? */
257 if (breakpoint
->length
== 4)
259 uint32_t verify
= 0xffffffff;
260 /* keep the original instruction in target endianness */
261 if ((retval
= target_read_memory(target
, breakpoint
->address
, 4, 1, breakpoint
->orig_instr
)) != ERROR_OK
)
265 /* write the breakpoint instruction in target endianness (arm7_9->arm_bkpt is host endian) */
266 if ((retval
= target_write_u32(target
, breakpoint
->address
, arm7_9
->arm_bkpt
)) != ERROR_OK
)
271 if ((retval
= target_read_u32(target
, breakpoint
->address
, &verify
)) != ERROR_OK
)
275 if (verify
!= arm7_9
->arm_bkpt
)
277 LOG_ERROR("Unable to set 32 bit software breakpoint at address %08" PRIx32
" - check that memory is read/writable", breakpoint
->address
);
283 uint16_t verify
= 0xffff;
284 /* keep the original instruction in target endianness */
285 if ((retval
= target_read_memory(target
, breakpoint
->address
, 2, 1, breakpoint
->orig_instr
)) != ERROR_OK
)
289 /* write the breakpoint instruction in target endianness (arm7_9->thumb_bkpt is host endian) */
290 if ((retval
= target_write_u16(target
, breakpoint
->address
, arm7_9
->thumb_bkpt
)) != ERROR_OK
)
295 if ((retval
= target_read_u16(target
, breakpoint
->address
, &verify
)) != ERROR_OK
)
299 if (verify
!= arm7_9
->thumb_bkpt
)
301 LOG_ERROR("Unable to set thumb software breakpoint at address %08" PRIx32
" - check that memory is read/writable", breakpoint
->address
);
306 if ((retval
= arm7_9_set_software_breakpoints(arm7_9
)) != ERROR_OK
)
309 arm7_9
->sw_breakpoint_count
++;
318 * Unsets an existing breakpoint on an ARM7/9 target. If it is a hardware
319 * breakpoint, the watchpoint used will be freed and the Embedded ICE registers
320 * will be updated. Otherwise, the software breakpoint will be restored to its
321 * original instruction if it hasn't already been modified.
323 * @param target Pointer to ARM7/9 target to unset the breakpoint from
324 * @param breakpoint Pointer to breakpoint to be unset
325 * @return For hardware breakpoints, this is the result of executing the JTAG
326 * queue. For software breakpoints, this will be the status of the
327 * required memory reads and writes
329 int arm7_9_unset_breakpoint(struct target
*target
, struct breakpoint
*breakpoint
)
331 int retval
= ERROR_OK
;
332 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
334 LOG_DEBUG("BPID: %d, Address: 0x%08" PRIx32
,
335 breakpoint
->unique_id
,
336 breakpoint
->address
);
338 if (!breakpoint
->set
)
340 LOG_WARNING("breakpoint not set");
344 if (breakpoint
->type
== BKPT_HARD
)
346 LOG_DEBUG("BPID: %d Releasing hw wp: %d",
347 breakpoint
->unique_id
,
349 if (breakpoint
->set
== 1)
351 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], 0x0);
352 arm7_9
->wp0_used
= 0;
353 arm7_9
->wp_available
++;
355 else if (breakpoint
->set
== 2)
357 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
], 0x0);
358 arm7_9
->wp1_used
= 0;
359 arm7_9
->wp_available
++;
361 retval
= jtag_execute_queue();
366 /* restore original instruction (kept in target endianness) */
367 if (breakpoint
->length
== 4)
369 uint32_t current_instr
;
370 /* check that user program as not modified breakpoint instruction */
371 if ((retval
= target_read_memory(target
, breakpoint
->address
, 4, 1, (uint8_t*)¤t_instr
)) != ERROR_OK
)
375 if (current_instr
== arm7_9
->arm_bkpt
)
376 if ((retval
= target_write_memory(target
, breakpoint
->address
, 4, 1, breakpoint
->orig_instr
)) != ERROR_OK
)
383 uint16_t current_instr
;
384 /* check that user program as not modified breakpoint instruction */
385 if ((retval
= target_read_memory(target
, breakpoint
->address
, 2, 1, (uint8_t*)¤t_instr
)) != ERROR_OK
)
389 if (current_instr
== arm7_9
->thumb_bkpt
)
390 if ((retval
= target_write_memory(target
, breakpoint
->address
, 2, 1, breakpoint
->orig_instr
)) != ERROR_OK
)
396 if (--arm7_9
->sw_breakpoint_count
==0)
398 /* We have removed the last sw breakpoint, clear the hw breakpoint we used to implement it */
399 if (arm7_9
->sw_breakpoints_added
== 1)
401 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], 0);
403 else if (arm7_9
->sw_breakpoints_added
== 2)
405 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
], 0);
416 * Add a breakpoint to an ARM7/9 target. This makes sure that there are no
417 * dangling breakpoints and that the desired breakpoint can be added.
419 * @param target Pointer to the target ARM7/9 device to add a breakpoint to
420 * @param breakpoint Pointer to the breakpoint to be added
421 * @return An error status if there is a problem adding the breakpoint or the
422 * result of setting the breakpoint
424 int arm7_9_add_breakpoint(struct target
*target
, struct breakpoint
*breakpoint
)
426 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
428 if (target
->state
!= TARGET_HALTED
)
430 LOG_WARNING("target not halted");
431 return ERROR_TARGET_NOT_HALTED
;
434 if (arm7_9
->breakpoint_count
== 0)
436 /* make sure we don't have any dangling breakpoints. This is vital upon
437 * GDB connect/disconnect
439 arm7_9_clear_watchpoints(arm7_9
);
442 if ((breakpoint
->type
== BKPT_HARD
) && (arm7_9
->wp_available
< 1))
444 LOG_INFO("no watchpoint unit available for hardware breakpoint");
445 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
448 if ((breakpoint
->length
!= 2) && (breakpoint
->length
!= 4))
450 LOG_INFO("only breakpoints of two (Thumb) or four (ARM) bytes length supported");
451 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
454 if (breakpoint
->type
== BKPT_HARD
)
456 arm7_9_assign_wp(arm7_9
, breakpoint
);
459 arm7_9
->breakpoint_count
++;
461 return arm7_9_set_breakpoint(target
, breakpoint
);
465 * Removes a breakpoint from an ARM7/9 target. This will make sure there are no
466 * dangling breakpoints and updates available watchpoints if it is a hardware
469 * @param target Pointer to the target to have a breakpoint removed
470 * @param breakpoint Pointer to the breakpoint to be removed
471 * @return Error status if there was a problem unsetting the breakpoint or the
472 * watchpoints could not be cleared
474 int arm7_9_remove_breakpoint(struct target
*target
, struct breakpoint
*breakpoint
)
476 int retval
= ERROR_OK
;
477 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
479 if ((retval
= arm7_9_unset_breakpoint(target
, breakpoint
)) != ERROR_OK
)
484 if (breakpoint
->type
== BKPT_HARD
)
485 arm7_9
->wp_available
++;
487 arm7_9
->breakpoint_count
--;
488 if (arm7_9
->breakpoint_count
== 0)
490 /* make sure we don't have any dangling breakpoints */
491 if ((retval
= arm7_9_clear_watchpoints(arm7_9
)) != ERROR_OK
)
501 * Sets a watchpoint for an ARM7/9 target in one of the watchpoint units. It is
502 * considered a bug to call this function when there are no available watchpoint
505 * @param target Pointer to an ARM7/9 target to set a watchpoint on
506 * @param watchpoint Pointer to the watchpoint to be set
507 * @return Error status if watchpoint set fails or the result of executing the
510 int arm7_9_set_watchpoint(struct target
*target
, struct watchpoint
*watchpoint
)
512 int retval
= ERROR_OK
;
513 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
517 mask
= watchpoint
->length
- 1;
519 if (target
->state
!= TARGET_HALTED
)
521 LOG_WARNING("target not halted");
522 return ERROR_TARGET_NOT_HALTED
;
525 if (watchpoint
->rw
== WPT_ACCESS
)
530 if (!arm7_9
->wp0_used
)
532 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_VALUE
], watchpoint
->address
);
533 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
], mask
);
534 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
], watchpoint
->mask
);
535 if (watchpoint
->mask
!= 0xffffffffu
)
536 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_VALUE
], watchpoint
->value
);
537 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
], 0xff & ~EICE_W_CTRL_nOPC
& ~rw_mask
);
538 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], EICE_W_CTRL_ENABLE
| EICE_W_CTRL_nOPC
| (watchpoint
->rw
& 1));
540 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
545 arm7_9
->wp0_used
= 2;
547 else if (!arm7_9
->wp1_used
)
549 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_VALUE
], watchpoint
->address
);
550 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_MASK
], mask
);
551 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_DATA_MASK
], watchpoint
->mask
);
552 if (watchpoint
->mask
!= 0xffffffffu
)
553 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_DATA_VALUE
], watchpoint
->value
);
554 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_MASK
], 0xff & ~EICE_W_CTRL_nOPC
& ~rw_mask
);
555 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
], EICE_W_CTRL_ENABLE
| EICE_W_CTRL_nOPC
| (watchpoint
->rw
& 1));
557 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
562 arm7_9
->wp1_used
= 2;
566 LOG_ERROR("BUG: no hardware comparator available");
574 * Unset an existing watchpoint and clear the used watchpoint unit.
576 * @param target Pointer to the target to have the watchpoint removed
577 * @param watchpoint Pointer to the watchpoint to be removed
578 * @return Error status while trying to unset the watchpoint or the result of
579 * executing the JTAG queue
581 int arm7_9_unset_watchpoint(struct target
*target
, struct watchpoint
*watchpoint
)
583 int retval
= ERROR_OK
;
584 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
586 if (target
->state
!= TARGET_HALTED
)
588 LOG_WARNING("target not halted");
589 return ERROR_TARGET_NOT_HALTED
;
592 if (!watchpoint
->set
)
594 LOG_WARNING("breakpoint not set");
598 if (watchpoint
->set
== 1)
600 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], 0x0);
601 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
605 arm7_9
->wp0_used
= 0;
607 else if (watchpoint
->set
== 2)
609 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
], 0x0);
610 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
614 arm7_9
->wp1_used
= 0;
622 * Add a watchpoint to an ARM7/9 target. If there are no watchpoint units
623 * available, an error response is returned.
625 * @param target Pointer to the ARM7/9 target to add a watchpoint to
626 * @param watchpoint Pointer to the watchpoint to be added
627 * @return Error status while trying to add the watchpoint
629 int arm7_9_add_watchpoint(struct target
*target
, struct watchpoint
*watchpoint
)
631 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
633 if (target
->state
!= TARGET_HALTED
)
635 LOG_WARNING("target not halted");
636 return ERROR_TARGET_NOT_HALTED
;
639 if (arm7_9
->wp_available
< 1)
641 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
644 if ((watchpoint
->length
!= 1) && (watchpoint
->length
!= 2) && (watchpoint
->length
!= 4))
646 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
649 arm7_9
->wp_available
--;
655 * Remove a watchpoint from an ARM7/9 target. The watchpoint will be unset and
656 * the used watchpoint unit will be reopened.
658 * @param target Pointer to the target to remove a watchpoint from
659 * @param watchpoint Pointer to the watchpoint to be removed
660 * @return Result of trying to unset the watchpoint
662 int arm7_9_remove_watchpoint(struct target
*target
, struct watchpoint
*watchpoint
)
664 int retval
= ERROR_OK
;
665 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
669 if ((retval
= arm7_9_unset_watchpoint(target
, watchpoint
)) != ERROR_OK
)
675 arm7_9
->wp_available
++;
681 * Restarts the target by sending a RESTART instruction and moving the JTAG
682 * state to IDLE. This includes a timeout waiting for DBGACK and SYSCOMP to be
683 * asserted by the processor.
685 * @param target Pointer to target to issue commands to
686 * @return Error status if there is a timeout or a problem while executing the
689 int arm7_9_execute_sys_speed(struct target
*target
)
692 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
693 struct arm_jtag
*jtag_info
= &arm7_9
->jtag_info
;
694 struct reg
*dbg_stat
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_STAT
];
696 /* set RESTART instruction */
697 jtag_set_end_state(TAP_IDLE
);
698 if (arm7_9
->need_bypass_before_restart
) {
699 arm7_9
->need_bypass_before_restart
= 0;
700 arm_jtag_set_instr(jtag_info
, 0xf, NULL
);
702 arm_jtag_set_instr(jtag_info
, 0x4, NULL
);
704 long long then
= timeval_ms();
706 while (!(timeout
= ((timeval_ms()-then
) > 1000)))
708 /* read debug status register */
709 embeddedice_read_reg(dbg_stat
);
710 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
712 if ((buf_get_u32(dbg_stat
->value
, EICE_DBG_STATUS_DBGACK
, 1))
713 && (buf_get_u32(dbg_stat
->value
, EICE_DBG_STATUS_SYSCOMP
, 1)))
715 if (debug_level
>= 3)
725 LOG_ERROR("timeout waiting for SYSCOMP & DBGACK, last DBG_STATUS: %" PRIx32
"", buf_get_u32(dbg_stat
->value
, 0, dbg_stat
->size
));
726 return ERROR_TARGET_TIMEOUT
;
733 * Restarts the target by sending a RESTART instruction and moving the JTAG
734 * state to IDLE. This validates that DBGACK and SYSCOMP are set without
735 * waiting until they are.
737 * @param target Pointer to the target to issue commands to
738 * @return Always ERROR_OK
740 int arm7_9_execute_fast_sys_speed(struct target
*target
)
743 static uint8_t check_value
[4], check_mask
[4];
745 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
746 struct arm_jtag
*jtag_info
= &arm7_9
->jtag_info
;
747 struct reg
*dbg_stat
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_STAT
];
749 /* set RESTART instruction */
750 jtag_set_end_state(TAP_IDLE
);
751 if (arm7_9
->need_bypass_before_restart
) {
752 arm7_9
->need_bypass_before_restart
= 0;
753 arm_jtag_set_instr(jtag_info
, 0xf, NULL
);
755 arm_jtag_set_instr(jtag_info
, 0x4, NULL
);
759 /* check for DBGACK and SYSCOMP set (others don't care) */
761 /* NB! These are constants that must be available until after next jtag_execute() and
762 * we evaluate the values upon first execution in lieu of setting up these constants
763 * during early setup.
765 buf_set_u32(check_value
, 0, 32, 0x9);
766 buf_set_u32(check_mask
, 0, 32, 0x9);
770 /* read debug status register */
771 embeddedice_read_reg_w_check(dbg_stat
, check_value
, check_mask
);
777 * Get some data from the ARM7/9 target.
779 * @param target Pointer to the ARM7/9 target to read data from
780 * @param size The number of 32bit words to be read
781 * @param buffer Pointer to the buffer that will hold the data
782 * @return The result of receiving data from the Embedded ICE unit
784 int arm7_9_target_request_data(struct target
*target
, uint32_t size
, uint8_t *buffer
)
786 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
787 struct arm_jtag
*jtag_info
= &arm7_9
->jtag_info
;
789 int retval
= ERROR_OK
;
792 data
= malloc(size
* (sizeof(uint32_t)));
794 retval
= embeddedice_receive(jtag_info
, data
, size
);
796 /* return the 32-bit ints in the 8-bit array */
797 for (i
= 0; i
< size
; i
++)
799 h_u32_to_le(buffer
+ (i
* 4), data
[i
]);
808 * Handles requests to an ARM7/9 target. If debug messaging is enabled, the
809 * target is running and the DCC control register has the W bit high, this will
810 * execute the request on the target.
812 * @param priv Void pointer expected to be a struct target pointer
813 * @return ERROR_OK unless there are issues with the JTAG queue or when reading
814 * from the Embedded ICE unit
816 int arm7_9_handle_target_request(void *priv
)
818 int retval
= ERROR_OK
;
819 struct target
*target
= priv
;
820 if (!target_was_examined(target
))
822 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
823 struct arm_jtag
*jtag_info
= &arm7_9
->jtag_info
;
824 struct reg
*dcc_control
= &arm7_9
->eice_cache
->reg_list
[EICE_COMMS_CTRL
];
826 if (!target
->dbg_msg_enabled
)
829 if (target
->state
== TARGET_RUNNING
)
831 /* read DCC control register */
832 embeddedice_read_reg(dcc_control
);
833 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
839 if (buf_get_u32(dcc_control
->value
, 1, 1) == 1)
843 if ((retval
= embeddedice_receive(jtag_info
, &request
, 1)) != ERROR_OK
)
847 if ((retval
= target_request(target
, request
)) != ERROR_OK
)
858 * Polls an ARM7/9 target for its current status. If DBGACK is set, the target
859 * is manipulated to the right halted state based on its current state. This is
863 * <tr><th > State</th><th > Action</th></tr>
864 * <tr><td > TARGET_RUNNING | TARGET_RESET</td><td > Enters debug mode. If TARGET_RESET, pc may be checked</td></tr>
865 * <tr><td > TARGET_UNKNOWN</td><td > Warning is logged</td></tr>
866 * <tr><td > TARGET_DEBUG_RUNNING</td><td > Enters debug mode</td></tr>
867 * <tr><td > TARGET_HALTED</td><td > Nothing</td></tr>
870 * If the target does not end up in the halted state, a warning is produced. If
871 * DBGACK is cleared, then the target is expected to either be running or
874 * @param target Pointer to the ARM7/9 target to poll
875 * @return ERROR_OK or an error status if a command fails
877 int arm7_9_poll(struct target
*target
)
880 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
881 struct reg
*dbg_stat
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_STAT
];
883 /* read debug status register */
884 embeddedice_read_reg(dbg_stat
);
885 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
890 if (buf_get_u32(dbg_stat
->value
, EICE_DBG_STATUS_DBGACK
, 1))
892 /* LOG_DEBUG("DBGACK set, dbg_state->value: 0x%x", buf_get_u32(dbg_stat->value, 0, 32));*/
893 if (target
->state
== TARGET_UNKNOWN
)
895 /* Starting OpenOCD with target in debug-halt */
896 target
->state
= TARGET_RUNNING
;
897 LOG_DEBUG("DBGACK already set during server startup.");
899 if ((target
->state
== TARGET_RUNNING
) || (target
->state
== TARGET_RESET
))
902 if (target
->state
== TARGET_RESET
)
904 if (target
->reset_halt
)
906 enum reset_types jtag_reset_config
= jtag_get_reset_config();
907 if ((jtag_reset_config
& RESET_SRST_PULLS_TRST
) == 0)
914 target
->state
= TARGET_HALTED
;
916 if ((retval
= arm7_9_debug_entry(target
)) != ERROR_OK
)
921 struct reg
*reg
= register_get_by_name(target
->reg_cache
, "pc", 1);
922 uint32_t t
=*((uint32_t *)reg
->value
);
925 LOG_ERROR("PC was not 0. Does this target need srst_pulls_trst?");
929 if ((retval
= target_call_event_callbacks(target
, TARGET_EVENT_HALTED
)) != ERROR_OK
)
934 if (target
->state
== TARGET_DEBUG_RUNNING
)
936 target
->state
= TARGET_HALTED
;
937 if ((retval
= arm7_9_debug_entry(target
)) != ERROR_OK
)
940 if ((retval
= target_call_event_callbacks(target
, TARGET_EVENT_DEBUG_HALTED
)) != ERROR_OK
)
945 if (target
->state
!= TARGET_HALTED
)
947 LOG_WARNING("DBGACK set, but the target did not end up in the halted state %d", target
->state
);
952 if (target
->state
!= TARGET_DEBUG_RUNNING
)
953 target
->state
= TARGET_RUNNING
;
960 * Asserts the reset (SRST) on an ARM7/9 target. Some -S targets (ARM966E-S in
961 * the STR912 isn't affected, ARM926EJ-S in the LPC3180 and AT91SAM9260 is
962 * affected) completely stop the JTAG clock while the core is held in reset
963 * (SRST). It isn't possible to program the halt condition once reset is
964 * asserted, hence a hook that allows the target to set up its reset-halt
965 * condition is setup prior to asserting reset.
967 * @param target Pointer to an ARM7/9 target to assert reset on
968 * @return ERROR_FAIL if the JTAG device does not have SRST, otherwise ERROR_OK
970 int arm7_9_assert_reset(struct target
*target
)
972 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
974 LOG_DEBUG("target->state: %s",
975 target_state_name(target
));
977 enum reset_types jtag_reset_config
= jtag_get_reset_config();
978 if (!(jtag_reset_config
& RESET_HAS_SRST
))
980 LOG_ERROR("Can't assert SRST");
984 /* At this point trst has been asserted/deasserted once. We would
985 * like to program EmbeddedICE while SRST is asserted, instead of
986 * depending on SRST to leave that module alone. However, many CPUs
987 * gate the JTAG clock while SRST is asserted; or JTAG may need
988 * clock stability guarantees (adaptive clocking might help).
990 * So we assume JTAG access during SRST is off the menu unless it's
991 * been specifically enabled.
993 bool srst_asserted
= false;
995 if (((jtag_reset_config
& RESET_SRST_PULLS_TRST
) == 0)
996 && (jtag_reset_config
& RESET_SRST_NO_GATING
))
998 jtag_add_reset(0, 1);
999 srst_asserted
= true;
1002 if (target
->reset_halt
)
1005 * Some targets do not support communication while SRST is asserted. We need to
1006 * set up the reset vector catch here.
1008 * If TRST is asserted, then these settings will be reset anyway, so setting them
1011 if (arm7_9
->has_vector_catch
)
1013 /* program vector catch register to catch reset vector */
1014 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_VEC_CATCH
], 0x1);
1016 /* extra runtest added as issues were found with certain ARM9 cores (maybe more) - AT91SAM9260 and STR9 */
1017 jtag_add_runtest(1, jtag_get_end_state());
1021 /* program watchpoint unit to match on reset vector address */
1022 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_VALUE
], 0x0);
1023 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
], 0x3);
1024 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
], 0xffffffff);
1025 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], EICE_W_CTRL_ENABLE
);
1026 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
], ~EICE_W_CTRL_nOPC
& 0xff);
1030 /* here we should issue an SRST only, but we may have to assert TRST as well */
1031 if (jtag_reset_config
& RESET_SRST_PULLS_TRST
)
1033 jtag_add_reset(1, 1);
1034 } else if (!srst_asserted
)
1036 jtag_add_reset(0, 1);
1039 target
->state
= TARGET_RESET
;
1040 jtag_add_sleep(50000);
1042 armv4_5_invalidate_core_regs(target
);
1044 if ((target
->reset_halt
) && ((jtag_reset_config
& RESET_SRST_PULLS_TRST
) == 0))
1046 /* debug entry was already prepared in arm7_9_assert_reset() */
1047 target
->debug_reason
= DBG_REASON_DBGRQ
;
1054 * Deassert the reset (SRST) signal on an ARM7/9 target. If SRST pulls TRST
1055 * and the target is being reset into a halt, a warning will be triggered
1056 * because it is not possible to reset into a halted mode in this case. The
1057 * target is halted using the target's functions.
1059 * @param target Pointer to the target to have the reset deasserted
1060 * @return ERROR_OK or an error from polling or halting the target
1062 int arm7_9_deassert_reset(struct target
*target
)
1064 int retval
= ERROR_OK
;
1065 LOG_DEBUG("target->state: %s",
1066 target_state_name(target
));
1068 /* deassert reset lines */
1069 jtag_add_reset(0, 0);
1071 enum reset_types jtag_reset_config
= jtag_get_reset_config();
1072 if (target
->reset_halt
&& (jtag_reset_config
& RESET_SRST_PULLS_TRST
) != 0)
1074 LOG_WARNING("srst pulls trst - can not reset into halted mode. Issuing halt after reset.");
1075 /* set up embedded ice registers again */
1076 if ((retval
= target_examine_one(target
)) != ERROR_OK
)
1079 if ((retval
= target_poll(target
)) != ERROR_OK
)
1084 if ((retval
= target_halt(target
)) != ERROR_OK
)
1094 * Clears the halt condition for an ARM7/9 target. If it isn't coming out of
1095 * reset and if DBGRQ is used, it is progammed to be deasserted. If the reset
1096 * vector catch was used, it is restored. Otherwise, the control value is
1097 * restored and the watchpoint unit is restored if it was in use.
1099 * @param target Pointer to the ARM7/9 target to have halt cleared
1100 * @return Always ERROR_OK
1102 int arm7_9_clear_halt(struct target
*target
)
1104 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1105 struct reg
*dbg_ctrl
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_CTRL
];
1107 /* we used DBGRQ only if we didn't come out of reset */
1108 if (!arm7_9
->debug_entry_from_reset
&& arm7_9
->use_dbgrq
)
1110 /* program EmbeddedICE Debug Control Register to deassert DBGRQ
1112 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGRQ
, 1, 0);
1113 embeddedice_store_reg(dbg_ctrl
);
1117 if (arm7_9
->debug_entry_from_reset
&& arm7_9
->has_vector_catch
)
1119 /* if we came out of reset, and vector catch is supported, we used
1120 * vector catch to enter debug state
1121 * restore the register in that case
1123 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_VEC_CATCH
]);
1127 /* restore registers if watchpoint unit 0 was in use
1129 if (arm7_9
->wp0_used
)
1131 if (arm7_9
->debug_entry_from_reset
)
1133 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_VALUE
]);
1135 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
]);
1136 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
]);
1137 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
]);
1139 /* control value always has to be restored, as it was either disabled,
1140 * or enabled with possibly different bits
1142 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
]);
1150 * Issue a software reset and halt to an ARM7/9 target. The target is halted
1151 * and then there is a wait until the processor shows the halt. This wait can
1152 * timeout and results in an error being returned. The software reset involves
1153 * clearing the halt, updating the debug control register, changing to ARM mode,
1154 * reset of the program counter, and reset of all of the registers.
1156 * @param target Pointer to the ARM7/9 target to be reset and halted by software
1157 * @return Error status if any of the commands fail, otherwise ERROR_OK
1159 int arm7_9_soft_reset_halt(struct target
*target
)
1161 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1162 struct armv4_5_common_s
*armv4_5
= &arm7_9
->armv4_5_common
;
1163 struct reg
*dbg_stat
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_STAT
];
1164 struct reg
*dbg_ctrl
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_CTRL
];
1168 /* FIX!!! replace some of this code with tcl commands
1170 * halt # the halt command is synchronous
1171 * armv4_5 core_state arm
1175 if ((retval
= target_halt(target
)) != ERROR_OK
)
1178 long long then
= timeval_ms();
1180 while (!(timeout
= ((timeval_ms()-then
) > 1000)))
1182 if (buf_get_u32(dbg_stat
->value
, EICE_DBG_STATUS_DBGACK
, 1) != 0)
1184 embeddedice_read_reg(dbg_stat
);
1185 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
1187 if (debug_level
>= 3)
1197 LOG_ERROR("Failed to halt CPU after 1 sec");
1198 return ERROR_TARGET_TIMEOUT
;
1200 target
->state
= TARGET_HALTED
;
1202 /* program EmbeddedICE Debug Control Register to assert DBGACK and INTDIS
1203 * ensure that DBGRQ is cleared
1205 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGACK
, 1, 1);
1206 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGRQ
, 1, 0);
1207 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_INTDIS
, 1, 1);
1208 embeddedice_store_reg(dbg_ctrl
);
1210 if ((retval
= arm7_9_clear_halt(target
)) != ERROR_OK
)
1215 /* if the target is in Thumb state, change to ARM state */
1216 if (buf_get_u32(dbg_stat
->value
, EICE_DBG_STATUS_ITBIT
, 1))
1218 uint32_t r0_thumb
, pc_thumb
;
1219 LOG_DEBUG("target entered debug from Thumb state, changing to ARM");
1220 /* Entered debug from Thumb mode */
1221 armv4_5
->core_state
= ARMV4_5_STATE_THUMB
;
1222 arm7_9
->change_to_arm(target
, &r0_thumb
, &pc_thumb
);
1225 /* all register content is now invalid */
1226 if ((retval
= armv4_5_invalidate_core_regs(target
)) != ERROR_OK
)
1231 /* SVC, ARM state, IRQ and FIQ disabled */
1232 buf_set_u32(armv4_5
->core_cache
->reg_list
[ARMV4_5_CPSR
].value
, 0, 8, 0xd3);
1233 armv4_5
->core_cache
->reg_list
[ARMV4_5_CPSR
].dirty
= 1;
1234 armv4_5
->core_cache
->reg_list
[ARMV4_5_CPSR
].valid
= 1;
1236 /* start fetching from 0x0 */
1237 buf_set_u32(armv4_5
->core_cache
->reg_list
[15].value
, 0, 32, 0x0);
1238 armv4_5
->core_cache
->reg_list
[15].dirty
= 1;
1239 armv4_5
->core_cache
->reg_list
[15].valid
= 1;
1241 armv4_5
->core_mode
= ARMV4_5_MODE_SVC
;
1242 armv4_5
->core_state
= ARMV4_5_STATE_ARM
;
1244 if (armv4_5_mode_to_number(armv4_5
->core_mode
)==-1)
1247 /* reset registers */
1248 for (i
= 0; i
<= 14; i
++)
1250 buf_set_u32(ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5
->core_mode
, i
).value
, 0, 32, 0xffffffff);
1251 ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5
->core_mode
, i
).dirty
= 1;
1252 ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5
->core_mode
, i
).valid
= 1;
1255 if ((retval
= target_call_event_callbacks(target
, TARGET_EVENT_HALTED
)) != ERROR_OK
)
1264 * Halt an ARM7/9 target. This is accomplished by either asserting the DBGRQ
1265 * line or by programming a watchpoint to trigger on any address. It is
1266 * considered a bug to call this function while the target is in the
1267 * TARGET_RESET state.
1269 * @param target Pointer to the ARM7/9 target to be halted
1270 * @return Always ERROR_OK
1272 int arm7_9_halt(struct target
*target
)
1274 if (target
->state
== TARGET_RESET
)
1276 LOG_ERROR("BUG: arm7/9 does not support halt during reset. This is handled in arm7_9_assert_reset()");
1280 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1281 struct reg
*dbg_ctrl
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_CTRL
];
1283 LOG_DEBUG("target->state: %s",
1284 target_state_name(target
));
1286 if (target
->state
== TARGET_HALTED
)
1288 LOG_DEBUG("target was already halted");
1292 if (target
->state
== TARGET_UNKNOWN
)
1294 LOG_WARNING("target was in unknown state when halt was requested");
1297 if (arm7_9
->use_dbgrq
)
1299 /* program EmbeddedICE Debug Control Register to assert DBGRQ
1301 if (arm7_9
->set_special_dbgrq
) {
1302 arm7_9
->set_special_dbgrq(target
);
1304 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGRQ
, 1, 1);
1305 embeddedice_store_reg(dbg_ctrl
);
1310 /* program watchpoint unit to match on any address
1312 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
], 0xffffffff);
1313 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
], 0xffffffff);
1314 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], EICE_W_CTRL_ENABLE
);
1315 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
], ~EICE_W_CTRL_nOPC
& 0xff);
1318 target
->debug_reason
= DBG_REASON_DBGRQ
;
1324 * Handle an ARM7/9 target's entry into debug mode. The halt is cleared on the
1325 * ARM. The JTAG queue is then executed and the reason for debug entry is
1326 * examined. Once done, the target is verified to be halted and the processor
1327 * is forced into ARM mode. The core registers are saved for the current core
1328 * mode and the program counter (register 15) is updated as needed. The core
1329 * registers and CPSR and SPSR are saved for restoration later.
1331 * @param target Pointer to target that is entering debug mode
1332 * @return Error code if anything fails, otherwise ERROR_OK
1334 static int arm7_9_debug_entry(struct target
*target
)
1337 uint32_t context
[16];
1338 uint32_t* context_p
[16];
1339 uint32_t r0_thumb
, pc_thumb
;
1342 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1343 struct armv4_5_common_s
*armv4_5
= &arm7_9
->armv4_5_common
;
1344 struct reg
*dbg_stat
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_STAT
];
1345 struct reg
*dbg_ctrl
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_CTRL
];
1347 #ifdef _DEBUG_ARM7_9_
1351 /* program EmbeddedICE Debug Control Register to assert DBGACK and INTDIS
1352 * ensure that DBGRQ is cleared
1354 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGACK
, 1, 1);
1355 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGRQ
, 1, 0);
1356 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_INTDIS
, 1, 1);
1357 embeddedice_store_reg(dbg_ctrl
);
1359 if ((retval
= arm7_9_clear_halt(target
)) != ERROR_OK
)
1364 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
1369 if ((retval
= arm7_9
->examine_debug_reason(target
)) != ERROR_OK
)
1373 if (target
->state
!= TARGET_HALTED
)
1375 LOG_WARNING("target not halted");
1376 return ERROR_TARGET_NOT_HALTED
;
1379 /* if the target is in Thumb state, change to ARM state */
1380 if (buf_get_u32(dbg_stat
->value
, EICE_DBG_STATUS_ITBIT
, 1))
1382 LOG_DEBUG("target entered debug from Thumb state");
1383 /* Entered debug from Thumb mode */
1384 armv4_5
->core_state
= ARMV4_5_STATE_THUMB
;
1385 arm7_9
->change_to_arm(target
, &r0_thumb
, &pc_thumb
);
1386 LOG_DEBUG("r0_thumb: 0x%8.8" PRIx32
", pc_thumb: 0x%8.8" PRIx32
"", r0_thumb
, pc_thumb
);
1390 LOG_DEBUG("target entered debug from ARM state");
1391 /* Entered debug from ARM mode */
1392 armv4_5
->core_state
= ARMV4_5_STATE_ARM
;
1395 for (i
= 0; i
< 16; i
++)
1396 context_p
[i
] = &context
[i
];
1397 /* save core registers (r0 - r15 of current core mode) */
1398 arm7_9
->read_core_regs(target
, 0xffff, context_p
);
1400 arm7_9
->read_xpsr(target
, &cpsr
, 0);
1402 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
1405 /* if the core has been executing in Thumb state, set the T bit */
1406 if (armv4_5
->core_state
== ARMV4_5_STATE_THUMB
)
1409 buf_set_u32(armv4_5
->core_cache
->reg_list
[ARMV4_5_CPSR
].value
, 0, 32, cpsr
);
1410 armv4_5
->core_cache
->reg_list
[ARMV4_5_CPSR
].dirty
= 0;
1411 armv4_5
->core_cache
->reg_list
[ARMV4_5_CPSR
].valid
= 1;
1413 armv4_5
->core_mode
= cpsr
& 0x1f;
1415 if (armv4_5_mode_to_number(armv4_5
->core_mode
) == -1)
1417 target
->state
= TARGET_UNKNOWN
;
1418 LOG_ERROR("cpsr contains invalid mode value - communication failure");
1419 return ERROR_TARGET_FAILURE
;
1422 LOG_DEBUG("target entered debug state in %s mode", armv4_5_mode_strings
[armv4_5_mode_to_number(armv4_5
->core_mode
)]);
1424 if (armv4_5
->core_state
== ARMV4_5_STATE_THUMB
)
1426 LOG_DEBUG("thumb state, applying fixups");
1427 context
[0] = r0_thumb
;
1428 context
[15] = pc_thumb
;
1429 } else if (armv4_5
->core_state
== ARMV4_5_STATE_ARM
)
1431 /* adjust value stored by STM */
1432 context
[15] -= 3 * 4;
1435 if ((target
->debug_reason
!= DBG_REASON_DBGRQ
) || (!arm7_9
->use_dbgrq
))
1436 context
[15] -= 3 * ((armv4_5
->core_state
== ARMV4_5_STATE_ARM
) ? 4 : 2);
1438 context
[15] -= arm7_9
->dbgreq_adjust_pc
* ((armv4_5
->core_state
== ARMV4_5_STATE_ARM
) ? 4 : 2);
1440 if (armv4_5_mode_to_number(armv4_5
->core_mode
)==-1)
1443 for (i
= 0; i
<= 15; i
++)
1445 LOG_DEBUG("r%i: 0x%8.8" PRIx32
"", i
, context
[i
]);
1446 buf_set_u32(ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5
->core_mode
, i
).value
, 0, 32, context
[i
]);
1447 ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5
->core_mode
, i
).dirty
= 0;
1448 ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5
->core_mode
, i
).valid
= 1;
1451 LOG_DEBUG("entered debug state at PC 0x%" PRIx32
"", context
[15]);
1453 if (armv4_5_mode_to_number(armv4_5
->core_mode
)==-1)
1456 /* exceptions other than USR & SYS have a saved program status register */
1457 if ((armv4_5
->core_mode
!= ARMV4_5_MODE_USR
) && (armv4_5
->core_mode
!= ARMV4_5_MODE_SYS
))
1460 arm7_9
->read_xpsr(target
, &spsr
, 1);
1461 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
1465 buf_set_u32(ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5
->core_mode
, 16).value
, 0, 32, spsr
);
1466 ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5
->core_mode
, 16).dirty
= 0;
1467 ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5
->core_mode
, 16).valid
= 1;
1470 /* r0 and r15 (pc) have to be restored later */
1471 ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5
->core_mode
, 0).dirty
= ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5
->core_mode
, 0).valid
;
1472 ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5
->core_mode
, 15).dirty
= ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5
->core_mode
, 15).valid
;
1474 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
1477 if (arm7_9
->post_debug_entry
)
1478 arm7_9
->post_debug_entry(target
);
1484 * Validate the full context for an ARM7/9 target in all processor modes. If
1485 * there are any invalid registers for the target, they will all be read. This
1488 * @param target Pointer to the ARM7/9 target to capture the full context from
1489 * @return Error if the target is not halted, has an invalid core mode, or if
1490 * the JTAG queue fails to execute
1492 int arm7_9_full_context(struct target
*target
)
1496 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1497 struct armv4_5_common_s
*armv4_5
= &arm7_9
->armv4_5_common
;
1501 if (target
->state
!= TARGET_HALTED
)
1503 LOG_WARNING("target not halted");
1504 return ERROR_TARGET_NOT_HALTED
;
1507 if (armv4_5_mode_to_number(armv4_5
->core_mode
)==-1)
1510 /* iterate through processor modes (User, FIQ, IRQ, SVC, ABT, UND)
1511 * SYS shares registers with User, so we don't touch SYS
1513 for (i
= 0; i
< 6; i
++)
1516 uint32_t* reg_p
[16];
1520 /* check if there are invalid registers in the current mode
1522 for (j
= 0; j
<= 16; j
++)
1524 if (ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5_number_to_mode(i
), j
).valid
== 0)
1532 /* change processor mode (and mask T bit) */
1533 tmp_cpsr
= buf_get_u32(armv4_5
->core_cache
->reg_list
[ARMV4_5_CPSR
].value
, 0, 8) & 0xE0;
1534 tmp_cpsr
|= armv4_5_number_to_mode(i
);
1536 arm7_9
->write_xpsr_im8(target
, tmp_cpsr
& 0xff, 0, 0);
1538 for (j
= 0; j
< 15; j
++)
1540 if (ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5_number_to_mode(i
), j
).valid
== 0)
1542 reg_p
[j
] = (uint32_t*)ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5_number_to_mode(i
), j
).value
;
1544 ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5_number_to_mode(i
), j
).valid
= 1;
1545 ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5_number_to_mode(i
), j
).dirty
= 0;
1549 /* if only the PSR is invalid, mask is all zeroes */
1551 arm7_9
->read_core_regs(target
, mask
, reg_p
);
1553 /* check if the PSR has to be read */
1554 if (ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5_number_to_mode(i
), 16).valid
== 0)
1556 arm7_9
->read_xpsr(target
, (uint32_t*)ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5_number_to_mode(i
), 16).value
, 1);
1557 ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5_number_to_mode(i
), 16).valid
= 1;
1558 ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5_number_to_mode(i
), 16).dirty
= 0;
1563 /* restore processor mode (mask T bit) */
1564 arm7_9
->write_xpsr_im8(target
, buf_get_u32(armv4_5
->core_cache
->reg_list
[ARMV4_5_CPSR
].value
, 0, 8) & ~0x20, 0, 0);
1566 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
1574 * Restore the processor context on an ARM7/9 target. The full processor
1575 * context is analyzed to see if any of the registers are dirty on this end, but
1576 * have a valid new value. If this is the case, the processor is changed to the
1577 * appropriate mode and the new register values are written out to the
1578 * processor. If there happens to be a dirty register with an invalid value, an
1579 * error will be logged.
1581 * @param target Pointer to the ARM7/9 target to have its context restored
1582 * @return Error status if the target is not halted or the core mode in the
1583 * armv4_5 struct is invalid.
1585 int arm7_9_restore_context(struct target
*target
)
1587 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1588 struct armv4_5_common_s
*armv4_5
= &arm7_9
->armv4_5_common
;
1590 struct armv4_5_core_reg
*reg_arch_info
;
1591 enum armv4_5_mode current_mode
= armv4_5
->core_mode
;
1598 if (target
->state
!= TARGET_HALTED
)
1600 LOG_WARNING("target not halted");
1601 return ERROR_TARGET_NOT_HALTED
;
1604 if (arm7_9
->pre_restore_context
)
1605 arm7_9
->pre_restore_context(target
);
1607 if (armv4_5_mode_to_number(armv4_5
->core_mode
)==-1)
1610 /* iterate through processor modes (User, FIQ, IRQ, SVC, ABT, UND)
1611 * SYS shares registers with User, so we don't touch SYS
1613 for (i
= 0; i
< 6; i
++)
1615 LOG_DEBUG("examining %s mode", armv4_5_mode_strings
[i
]);
1618 /* check if there are dirty registers in the current mode
1620 for (j
= 0; j
<= 16; j
++)
1622 reg
= &ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5_number_to_mode(i
), j
);
1623 reg_arch_info
= reg
->arch_info
;
1624 if (reg
->dirty
== 1)
1626 if (reg
->valid
== 1)
1629 LOG_DEBUG("examining dirty reg: %s", reg
->name
);
1630 if ((reg_arch_info
->mode
!= ARMV4_5_MODE_ANY
)
1631 && (reg_arch_info
->mode
!= current_mode
)
1632 && !((reg_arch_info
->mode
== ARMV4_5_MODE_USR
) && (armv4_5
->core_mode
== ARMV4_5_MODE_SYS
))
1633 && !((reg_arch_info
->mode
== ARMV4_5_MODE_SYS
) && (armv4_5
->core_mode
== ARMV4_5_MODE_USR
)))
1636 LOG_DEBUG("require mode change");
1641 LOG_ERROR("BUG: dirty register '%s', but no valid data", reg
->name
);
1648 uint32_t mask
= 0x0;
1656 /* change processor mode (mask T bit) */
1657 tmp_cpsr
= buf_get_u32(armv4_5
->core_cache
->reg_list
[ARMV4_5_CPSR
].value
, 0, 8) & 0xE0;
1658 tmp_cpsr
|= armv4_5_number_to_mode(i
);
1660 arm7_9
->write_xpsr_im8(target
, tmp_cpsr
& 0xff, 0, 0);
1661 current_mode
= armv4_5_number_to_mode(i
);
1664 for (j
= 0; j
<= 14; j
++)
1666 reg
= &ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5_number_to_mode(i
), j
);
1667 reg_arch_info
= reg
->arch_info
;
1670 if (reg
->dirty
== 1)
1672 regs
[j
] = buf_get_u32(reg
->value
, 0, 32);
1677 LOG_DEBUG("writing register %i of mode %s with value 0x%8.8" PRIx32
"", j
, armv4_5_mode_strings
[i
], regs
[j
]);
1683 arm7_9
->write_core_regs(target
, mask
, regs
);
1686 reg
= &ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5_number_to_mode(i
), 16);
1687 reg_arch_info
= reg
->arch_info
;
1688 if ((reg
->dirty
) && (reg_arch_info
->mode
!= ARMV4_5_MODE_ANY
))
1690 LOG_DEBUG("writing SPSR of mode %i with value 0x%8.8" PRIx32
"", i
, buf_get_u32(reg
->value
, 0, 32));
1691 arm7_9
->write_xpsr(target
, buf_get_u32(reg
->value
, 0, 32), 1);
1696 if ((armv4_5
->core_cache
->reg_list
[ARMV4_5_CPSR
].dirty
== 0) && (armv4_5
->core_mode
!= current_mode
))
1698 /* restore processor mode (mask T bit) */
1701 tmp_cpsr
= buf_get_u32(armv4_5
->core_cache
->reg_list
[ARMV4_5_CPSR
].value
, 0, 8) & 0xE0;
1702 tmp_cpsr
|= armv4_5_number_to_mode(i
);
1704 LOG_DEBUG("writing lower 8 bit of cpsr with value 0x%2.2x", (unsigned)(tmp_cpsr
));
1705 arm7_9
->write_xpsr_im8(target
, tmp_cpsr
& 0xff, 0, 0);
1707 else if (armv4_5
->core_cache
->reg_list
[ARMV4_5_CPSR
].dirty
== 1)
1709 /* CPSR has been changed, full restore necessary (mask T bit) */
1710 LOG_DEBUG("writing cpsr with value 0x%8.8" PRIx32
"", buf_get_u32(armv4_5
->core_cache
->reg_list
[ARMV4_5_CPSR
].value
, 0, 32));
1711 arm7_9
->write_xpsr(target
, buf_get_u32(armv4_5
->core_cache
->reg_list
[ARMV4_5_CPSR
].value
, 0, 32) & ~0x20, 0);
1712 armv4_5
->core_cache
->reg_list
[ARMV4_5_CPSR
].dirty
= 0;
1713 armv4_5
->core_cache
->reg_list
[ARMV4_5_CPSR
].valid
= 1;
1717 LOG_DEBUG("writing PC with value 0x%8.8" PRIx32
"", buf_get_u32(armv4_5
->core_cache
->reg_list
[15].value
, 0, 32));
1718 arm7_9
->write_pc(target
, buf_get_u32(armv4_5
->core_cache
->reg_list
[15].value
, 0, 32));
1719 armv4_5
->core_cache
->reg_list
[15].dirty
= 0;
1721 if (arm7_9
->post_restore_context
)
1722 arm7_9
->post_restore_context(target
);
1728 * Restart the core of an ARM7/9 target. A RESTART command is sent to the
1729 * instruction register and the JTAG state is set to TAP_IDLE causing a core
1732 * @param target Pointer to the ARM7/9 target to be restarted
1733 * @return Result of executing the JTAG queue
1735 int arm7_9_restart_core(struct target
*target
)
1737 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1738 struct arm_jtag
*jtag_info
= &arm7_9
->jtag_info
;
1740 /* set RESTART instruction */
1741 jtag_set_end_state(TAP_IDLE
);
1742 if (arm7_9
->need_bypass_before_restart
) {
1743 arm7_9
->need_bypass_before_restart
= 0;
1744 arm_jtag_set_instr(jtag_info
, 0xf, NULL
);
1746 arm_jtag_set_instr(jtag_info
, 0x4, NULL
);
1748 jtag_add_runtest(1, jtag_set_end_state(TAP_IDLE
));
1749 return jtag_execute_queue();
1753 * Enable the watchpoints on an ARM7/9 target. The target's watchpoints are
1754 * iterated through and are set on the target if they aren't already set.
1756 * @param target Pointer to the ARM7/9 target to enable watchpoints on
1758 void arm7_9_enable_watchpoints(struct target
*target
)
1760 struct watchpoint
*watchpoint
= target
->watchpoints
;
1764 if (watchpoint
->set
== 0)
1765 arm7_9_set_watchpoint(target
, watchpoint
);
1766 watchpoint
= watchpoint
->next
;
1771 * Enable the breakpoints on an ARM7/9 target. The target's breakpoints are
1772 * iterated through and are set on the target.
1774 * @param target Pointer to the ARM7/9 target to enable breakpoints on
1776 void arm7_9_enable_breakpoints(struct target
*target
)
1778 struct breakpoint
*breakpoint
= target
->breakpoints
;
1780 /* set any pending breakpoints */
1783 arm7_9_set_breakpoint(target
, breakpoint
);
1784 breakpoint
= breakpoint
->next
;
1788 int arm7_9_resume(struct target
*target
, int current
, uint32_t address
, int handle_breakpoints
, int debug_execution
)
1790 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1791 struct armv4_5_common_s
*armv4_5
= &arm7_9
->armv4_5_common
;
1792 struct breakpoint
*breakpoint
= target
->breakpoints
;
1793 struct reg
*dbg_ctrl
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_CTRL
];
1794 int err
, retval
= ERROR_OK
;
1798 if (target
->state
!= TARGET_HALTED
)
1800 LOG_WARNING("target not halted");
1801 return ERROR_TARGET_NOT_HALTED
;
1804 if (!debug_execution
)
1806 target_free_all_working_areas(target
);
1809 /* current = 1: continue on current pc, otherwise continue at <address> */
1811 buf_set_u32(armv4_5
->core_cache
->reg_list
[15].value
, 0, 32, address
);
1813 uint32_t current_pc
;
1814 current_pc
= buf_get_u32(armv4_5
->core_cache
->reg_list
[15].value
, 0, 32);
1816 /* the front-end may request us not to handle breakpoints */
1817 if (handle_breakpoints
)
1819 if ((breakpoint
= breakpoint_find(target
, buf_get_u32(armv4_5
->core_cache
->reg_list
[15].value
, 0, 32))))
1821 LOG_DEBUG("unset breakpoint at 0x%8.8" PRIx32
" (id: %d)", breakpoint
->address
, breakpoint
->unique_id
);
1822 if ((retval
= arm7_9_unset_breakpoint(target
, breakpoint
)) != ERROR_OK
)
1827 /* calculate PC of next instruction */
1829 if ((retval
= arm_simulate_step(target
, &next_pc
)) != ERROR_OK
)
1831 uint32_t current_opcode
;
1832 target_read_u32(target
, current_pc
, ¤t_opcode
);
1833 LOG_ERROR("Couldn't calculate PC of next instruction, current opcode was 0x%8.8" PRIx32
"", current_opcode
);
1837 LOG_DEBUG("enable single-step");
1838 arm7_9
->enable_single_step(target
, next_pc
);
1840 target
->debug_reason
= DBG_REASON_SINGLESTEP
;
1842 if ((retval
= arm7_9_restore_context(target
)) != ERROR_OK
)
1847 if (armv4_5
->core_state
== ARMV4_5_STATE_ARM
)
1848 arm7_9
->branch_resume(target
);
1849 else if (armv4_5
->core_state
== ARMV4_5_STATE_THUMB
)
1851 arm7_9
->branch_resume_thumb(target
);
1855 LOG_ERROR("unhandled core state");
1859 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGACK
, 1, 0);
1860 embeddedice_write_reg(dbg_ctrl
, buf_get_u32(dbg_ctrl
->value
, 0, dbg_ctrl
->size
));
1861 err
= arm7_9_execute_sys_speed(target
);
1863 LOG_DEBUG("disable single-step");
1864 arm7_9
->disable_single_step(target
);
1866 if (err
!= ERROR_OK
)
1868 if ((retval
= arm7_9_set_breakpoint(target
, breakpoint
)) != ERROR_OK
)
1872 target
->state
= TARGET_UNKNOWN
;
1876 arm7_9_debug_entry(target
);
1877 LOG_DEBUG("new PC after step: 0x%8.8" PRIx32
"", buf_get_u32(armv4_5
->core_cache
->reg_list
[15].value
, 0, 32));
1879 LOG_DEBUG("set breakpoint at 0x%8.8" PRIx32
"", breakpoint
->address
);
1880 if ((retval
= arm7_9_set_breakpoint(target
, breakpoint
)) != ERROR_OK
)
1887 /* enable any pending breakpoints and watchpoints */
1888 arm7_9_enable_breakpoints(target
);
1889 arm7_9_enable_watchpoints(target
);
1891 if ((retval
= arm7_9_restore_context(target
)) != ERROR_OK
)
1896 if (armv4_5
->core_state
== ARMV4_5_STATE_ARM
)
1898 arm7_9
->branch_resume(target
);
1900 else if (armv4_5
->core_state
== ARMV4_5_STATE_THUMB
)
1902 arm7_9
->branch_resume_thumb(target
);
1906 LOG_ERROR("unhandled core state");
1910 /* deassert DBGACK and INTDIS */
1911 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGACK
, 1, 0);
1912 /* INTDIS only when we really resume, not during debug execution */
1913 if (!debug_execution
)
1914 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_INTDIS
, 1, 0);
1915 embeddedice_write_reg(dbg_ctrl
, buf_get_u32(dbg_ctrl
->value
, 0, dbg_ctrl
->size
));
1917 if ((retval
= arm7_9_restart_core(target
)) != ERROR_OK
)
1922 target
->debug_reason
= DBG_REASON_NOTHALTED
;
1924 if (!debug_execution
)
1926 /* registers are now invalid */
1927 armv4_5_invalidate_core_regs(target
);
1928 target
->state
= TARGET_RUNNING
;
1929 if ((retval
= target_call_event_callbacks(target
, TARGET_EVENT_RESUMED
)) != ERROR_OK
)
1936 target
->state
= TARGET_DEBUG_RUNNING
;
1937 if ((retval
= target_call_event_callbacks(target
, TARGET_EVENT_DEBUG_RESUMED
)) != ERROR_OK
)
1943 LOG_DEBUG("target resumed");
1948 void arm7_9_enable_eice_step(struct target
*target
, uint32_t next_pc
)
1950 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1951 struct armv4_5_common_s
*armv4_5
= &arm7_9
->armv4_5_common
;
1952 uint32_t current_pc
;
1953 current_pc
= buf_get_u32(armv4_5
->core_cache
->reg_list
[15].value
, 0, 32);
1955 if (next_pc
!= current_pc
)
1957 /* setup an inverse breakpoint on the current PC
1958 * - comparator 1 matches the current address
1959 * - rangeout from comparator 1 is connected to comparator 0 rangein
1960 * - comparator 0 matches any address, as long as rangein is low */
1961 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
], 0xffffffff);
1962 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
], 0xffffffff);
1963 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], EICE_W_CTRL_ENABLE
);
1964 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
], ~(EICE_W_CTRL_RANGE
| EICE_W_CTRL_nOPC
) & 0xff);
1965 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_VALUE
], current_pc
);
1966 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_MASK
], 0);
1967 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_DATA_MASK
], 0xffffffff);
1968 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
], 0x0);
1969 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_MASK
], ~EICE_W_CTRL_nOPC
& 0xff);
1973 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
], 0xffffffff);
1974 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
], 0xffffffff);
1975 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], 0x0);
1976 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
], 0xff);
1977 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_VALUE
], next_pc
);
1978 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_MASK
], 0);
1979 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_DATA_MASK
], 0xffffffff);
1980 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
], EICE_W_CTRL_ENABLE
);
1981 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_MASK
], ~EICE_W_CTRL_nOPC
& 0xff);
1985 void arm7_9_disable_eice_step(struct target
*target
)
1987 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1989 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
]);
1990 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
]);
1991 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
]);
1992 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
]);
1993 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_VALUE
]);
1994 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_MASK
]);
1995 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_DATA_MASK
]);
1996 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_MASK
]);
1997 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
]);
2000 int arm7_9_step(struct target
*target
, int current
, uint32_t address
, int handle_breakpoints
)
2002 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2003 struct armv4_5_common_s
*armv4_5
= &arm7_9
->armv4_5_common
;
2004 struct breakpoint
*breakpoint
= NULL
;
2007 if (target
->state
!= TARGET_HALTED
)
2009 LOG_WARNING("target not halted");
2010 return ERROR_TARGET_NOT_HALTED
;
2013 /* current = 1: continue on current pc, otherwise continue at <address> */
2015 buf_set_u32(armv4_5
->core_cache
->reg_list
[15].value
, 0, 32, address
);
2017 uint32_t current_pc
;
2018 current_pc
= buf_get_u32(armv4_5
->core_cache
->reg_list
[15].value
, 0, 32);
2020 /* the front-end may request us not to handle breakpoints */
2021 if (handle_breakpoints
)
2022 if ((breakpoint
= breakpoint_find(target
, buf_get_u32(armv4_5
->core_cache
->reg_list
[15].value
, 0, 32))))
2023 if ((retval
= arm7_9_unset_breakpoint(target
, breakpoint
)) != ERROR_OK
)
2028 target
->debug_reason
= DBG_REASON_SINGLESTEP
;
2030 /* calculate PC of next instruction */
2032 if ((retval
= arm_simulate_step(target
, &next_pc
)) != ERROR_OK
)
2034 uint32_t current_opcode
;
2035 target_read_u32(target
, current_pc
, ¤t_opcode
);
2036 LOG_ERROR("Couldn't calculate PC of next instruction, current opcode was 0x%8.8" PRIx32
"", current_opcode
);
2040 if ((retval
= arm7_9_restore_context(target
)) != ERROR_OK
)
2045 arm7_9
->enable_single_step(target
, next_pc
);
2047 if (armv4_5
->core_state
== ARMV4_5_STATE_ARM
)
2049 arm7_9
->branch_resume(target
);
2051 else if (armv4_5
->core_state
== ARMV4_5_STATE_THUMB
)
2053 arm7_9
->branch_resume_thumb(target
);
2057 LOG_ERROR("unhandled core state");
2061 if ((retval
= target_call_event_callbacks(target
, TARGET_EVENT_RESUMED
)) != ERROR_OK
)
2066 err
= arm7_9_execute_sys_speed(target
);
2067 arm7_9
->disable_single_step(target
);
2069 /* registers are now invalid */
2070 armv4_5_invalidate_core_regs(target
);
2072 if (err
!= ERROR_OK
)
2074 target
->state
= TARGET_UNKNOWN
;
2076 arm7_9_debug_entry(target
);
2077 if ((retval
= target_call_event_callbacks(target
, TARGET_EVENT_HALTED
)) != ERROR_OK
)
2081 LOG_DEBUG("target stepped");
2085 if ((retval
= arm7_9_set_breakpoint(target
, breakpoint
)) != ERROR_OK
)
2093 int arm7_9_read_core_reg(struct target
*target
, int num
, enum armv4_5_mode mode
)
2095 uint32_t* reg_p
[16];
2098 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2099 struct armv4_5_common_s
*armv4_5
= &arm7_9
->armv4_5_common
;
2101 if (armv4_5_mode_to_number(armv4_5
->core_mode
)==-1)
2104 enum armv4_5_mode reg_mode
= ((struct armv4_5_core_reg
*)ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, mode
, num
).arch_info
)->mode
;
2106 if ((num
< 0) || (num
> 16))
2107 return ERROR_INVALID_ARGUMENTS
;
2109 if ((mode
!= ARMV4_5_MODE_ANY
)
2110 && (mode
!= armv4_5
->core_mode
)
2111 && (reg_mode
!= ARMV4_5_MODE_ANY
))
2115 /* change processor mode (mask T bit) */
2116 tmp_cpsr
= buf_get_u32(armv4_5
->core_cache
->reg_list
[ARMV4_5_CPSR
].value
, 0, 8) & 0xE0;
2119 arm7_9
->write_xpsr_im8(target
, tmp_cpsr
& 0xff, 0, 0);
2122 if ((num
>= 0) && (num
<= 15))
2124 /* read a normal core register */
2125 reg_p
[num
] = &value
;
2127 arm7_9
->read_core_regs(target
, 1 << num
, reg_p
);
2131 /* read a program status register
2132 * if the register mode is MODE_ANY, we read the cpsr, otherwise a spsr
2134 struct armv4_5_core_reg
*arch_info
= ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, mode
, num
).arch_info
;
2135 int spsr
= (arch_info
->mode
== ARMV4_5_MODE_ANY
) ? 0 : 1;
2137 arm7_9
->read_xpsr(target
, &value
, spsr
);
2140 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
2145 ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, mode
, num
).valid
= 1;
2146 ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, mode
, num
).dirty
= 0;
2147 buf_set_u32(ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, mode
, num
).value
, 0, 32, value
);
2149 if ((mode
!= ARMV4_5_MODE_ANY
)
2150 && (mode
!= armv4_5
->core_mode
)
2151 && (reg_mode
!= ARMV4_5_MODE_ANY
)) {
2152 /* restore processor mode (mask T bit) */
2153 arm7_9
->write_xpsr_im8(target
, buf_get_u32(armv4_5
->core_cache
->reg_list
[ARMV4_5_CPSR
].value
, 0, 8) & ~0x20, 0, 0);
2159 int arm7_9_write_core_reg(struct target
*target
, int num
, enum armv4_5_mode mode
, uint32_t value
)
2162 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2163 struct armv4_5_common_s
*armv4_5
= &arm7_9
->armv4_5_common
;
2165 if (armv4_5_mode_to_number(armv4_5
->core_mode
)==-1)
2168 enum armv4_5_mode reg_mode
= ((struct armv4_5_core_reg
*)ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, mode
, num
).arch_info
)->mode
;
2170 if ((num
< 0) || (num
> 16))
2171 return ERROR_INVALID_ARGUMENTS
;
2173 if ((mode
!= ARMV4_5_MODE_ANY
)
2174 && (mode
!= armv4_5
->core_mode
)
2175 && (reg_mode
!= ARMV4_5_MODE_ANY
)) {
2178 /* change processor mode (mask T bit) */
2179 tmp_cpsr
= buf_get_u32(armv4_5
->core_cache
->reg_list
[ARMV4_5_CPSR
].value
, 0, 8) & 0xE0;
2182 arm7_9
->write_xpsr_im8(target
, tmp_cpsr
& 0xff, 0, 0);
2185 if ((num
>= 0) && (num
<= 15))
2187 /* write a normal core register */
2190 arm7_9
->write_core_regs(target
, 1 << num
, reg
);
2194 /* write a program status register
2195 * if the register mode is MODE_ANY, we write the cpsr, otherwise a spsr
2197 struct armv4_5_core_reg
*arch_info
= ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, mode
, num
).arch_info
;
2198 int spsr
= (arch_info
->mode
== ARMV4_5_MODE_ANY
) ? 0 : 1;
2200 /* if we're writing the CPSR, mask the T bit */
2204 arm7_9
->write_xpsr(target
, value
, spsr
);
2207 ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, mode
, num
).valid
= 1;
2208 ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, mode
, num
).dirty
= 0;
2210 if ((mode
!= ARMV4_5_MODE_ANY
)
2211 && (mode
!= armv4_5
->core_mode
)
2212 && (reg_mode
!= ARMV4_5_MODE_ANY
)) {
2213 /* restore processor mode (mask T bit) */
2214 arm7_9
->write_xpsr_im8(target
, buf_get_u32(armv4_5
->core_cache
->reg_list
[ARMV4_5_CPSR
].value
, 0, 8) & ~0x20, 0, 0);
2217 return jtag_execute_queue();
2220 int arm7_9_read_memory(struct target
*target
, uint32_t address
, uint32_t size
, uint32_t count
, uint8_t *buffer
)
2222 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2223 struct armv4_5_common_s
*armv4_5
= &arm7_9
->armv4_5_common
;
2225 uint32_t num_accesses
= 0;
2226 int thisrun_accesses
;
2232 LOG_DEBUG("address: 0x%8.8" PRIx32
", size: 0x%8.8" PRIx32
", count: 0x%8.8" PRIx32
"", address
, size
, count
);
2234 if (target
->state
!= TARGET_HALTED
)
2236 LOG_WARNING("target not halted");
2237 return ERROR_TARGET_NOT_HALTED
;
2240 /* sanitize arguments */
2241 if (((size
!= 4) && (size
!= 2) && (size
!= 1)) || (count
== 0) || !(buffer
))
2242 return ERROR_INVALID_ARGUMENTS
;
2244 if (((size
== 4) && (address
& 0x3u
)) || ((size
== 2) && (address
& 0x1u
)))
2245 return ERROR_TARGET_UNALIGNED_ACCESS
;
2247 /* load the base register with the address of the first word */
2249 arm7_9
->write_core_regs(target
, 0x1, reg
);
2256 while (num_accesses
< count
)
2259 thisrun_accesses
= ((count
- num_accesses
) >= 14) ? 14 : (count
- num_accesses
);
2260 reg_list
= (0xffff >> (15 - thisrun_accesses
)) & 0xfffe;
2262 if (last_reg
<= thisrun_accesses
)
2263 last_reg
= thisrun_accesses
;
2265 arm7_9
->load_word_regs(target
, reg_list
);
2267 /* fast memory reads are only safe when the target is running
2268 * from a sufficiently high clock (32 kHz is usually too slow)
2270 if (arm7_9
->fast_memory_access
)
2271 retval
= arm7_9_execute_fast_sys_speed(target
);
2273 retval
= arm7_9_execute_sys_speed(target
);
2274 if (retval
!= ERROR_OK
)
2277 arm7_9
->read_core_regs_target_buffer(target
, reg_list
, buffer
, 4);
2279 /* advance buffer, count number of accesses */
2280 buffer
+= thisrun_accesses
* 4;
2281 num_accesses
+= thisrun_accesses
;
2283 if ((j
++%1024) == 0)
2290 while (num_accesses
< count
)
2293 thisrun_accesses
= ((count
- num_accesses
) >= 14) ? 14 : (count
- num_accesses
);
2294 reg_list
= (0xffff >> (15 - thisrun_accesses
)) & 0xfffe;
2296 for (i
= 1; i
<= thisrun_accesses
; i
++)
2300 arm7_9
->load_hword_reg(target
, i
);
2301 /* fast memory reads are only safe when the target is running
2302 * from a sufficiently high clock (32 kHz is usually too slow)
2304 if (arm7_9
->fast_memory_access
)
2305 retval
= arm7_9_execute_fast_sys_speed(target
);
2307 retval
= arm7_9_execute_sys_speed(target
);
2308 if (retval
!= ERROR_OK
)
2315 arm7_9
->read_core_regs_target_buffer(target
, reg_list
, buffer
, 2);
2317 /* advance buffer, count number of accesses */
2318 buffer
+= thisrun_accesses
* 2;
2319 num_accesses
+= thisrun_accesses
;
2321 if ((j
++%1024) == 0)
2328 while (num_accesses
< count
)
2331 thisrun_accesses
= ((count
- num_accesses
) >= 14) ? 14 : (count
- num_accesses
);
2332 reg_list
= (0xffff >> (15 - thisrun_accesses
)) & 0xfffe;
2334 for (i
= 1; i
<= thisrun_accesses
; i
++)
2338 arm7_9
->load_byte_reg(target
, i
);
2339 /* fast memory reads are only safe when the target is running
2340 * from a sufficiently high clock (32 kHz is usually too slow)
2342 if (arm7_9
->fast_memory_access
)
2343 retval
= arm7_9_execute_fast_sys_speed(target
);
2345 retval
= arm7_9_execute_sys_speed(target
);
2346 if (retval
!= ERROR_OK
)
2352 arm7_9
->read_core_regs_target_buffer(target
, reg_list
, buffer
, 1);
2354 /* advance buffer, count number of accesses */
2355 buffer
+= thisrun_accesses
* 1;
2356 num_accesses
+= thisrun_accesses
;
2358 if ((j
++%1024) == 0)
2365 LOG_ERROR("BUG: we shouldn't get here");
2370 if (armv4_5_mode_to_number(armv4_5
->core_mode
)==-1)
2373 for (i
= 0; i
<= last_reg
; i
++)
2374 ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5
->core_mode
, i
).dirty
= ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5
->core_mode
, i
).valid
;
2376 arm7_9
->read_xpsr(target
, &cpsr
, 0);
2377 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
2379 LOG_ERROR("JTAG error while reading cpsr");
2380 return ERROR_TARGET_DATA_ABORT
;
2383 if (((cpsr
& 0x1f) == ARMV4_5_MODE_ABT
) && (armv4_5
->core_mode
!= ARMV4_5_MODE_ABT
))
2385 LOG_WARNING("memory read caused data abort (address: 0x%8.8" PRIx32
", size: 0x%" PRIx32
", count: 0x%" PRIx32
")", address
, size
, count
);
2387 arm7_9
->write_xpsr_im8(target
, buf_get_u32(armv4_5
->core_cache
->reg_list
[ARMV4_5_CPSR
].value
, 0, 8) & ~0x20, 0, 0);
2389 return ERROR_TARGET_DATA_ABORT
;
2395 int arm7_9_write_memory(struct target
*target
, uint32_t address
, uint32_t size
, uint32_t count
, uint8_t *buffer
)
2397 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2398 struct armv4_5_common_s
*armv4_5
= &arm7_9
->armv4_5_common
;
2399 struct reg
*dbg_ctrl
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_CTRL
];
2402 uint32_t num_accesses
= 0;
2403 int thisrun_accesses
;
2409 #ifdef _DEBUG_ARM7_9_
2410 LOG_DEBUG("address: 0x%8.8x, size: 0x%8.8x, count: 0x%8.8x", address
, size
, count
);
2413 if (target
->state
!= TARGET_HALTED
)
2415 LOG_WARNING("target not halted");
2416 return ERROR_TARGET_NOT_HALTED
;
2419 /* sanitize arguments */
2420 if (((size
!= 4) && (size
!= 2) && (size
!= 1)) || (count
== 0) || !(buffer
))
2421 return ERROR_INVALID_ARGUMENTS
;
2423 if (((size
== 4) && (address
& 0x3u
)) || ((size
== 2) && (address
& 0x1u
)))
2424 return ERROR_TARGET_UNALIGNED_ACCESS
;
2426 /* load the base register with the address of the first word */
2428 arm7_9
->write_core_regs(target
, 0x1, reg
);
2430 /* Clear DBGACK, to make sure memory fetches work as expected */
2431 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGACK
, 1, 0);
2432 embeddedice_store_reg(dbg_ctrl
);
2437 while (num_accesses
< count
)
2440 thisrun_accesses
= ((count
- num_accesses
) >= 14) ? 14 : (count
- num_accesses
);
2441 reg_list
= (0xffff >> (15 - thisrun_accesses
)) & 0xfffe;
2443 for (i
= 1; i
<= thisrun_accesses
; i
++)
2447 reg
[i
] = target_buffer_get_u32(target
, buffer
);
2451 arm7_9
->write_core_regs(target
, reg_list
, reg
);
2453 arm7_9
->store_word_regs(target
, reg_list
);
2455 /* fast memory writes are only safe when the target is running
2456 * from a sufficiently high clock (32 kHz is usually too slow)
2458 if (arm7_9
->fast_memory_access
)
2459 retval
= arm7_9_execute_fast_sys_speed(target
);
2461 retval
= arm7_9_execute_sys_speed(target
);
2462 if (retval
!= ERROR_OK
)
2467 num_accesses
+= thisrun_accesses
;
2471 while (num_accesses
< count
)
2474 thisrun_accesses
= ((count
- num_accesses
) >= 14) ? 14 : (count
- num_accesses
);
2475 reg_list
= (0xffff >> (15 - thisrun_accesses
)) & 0xfffe;
2477 for (i
= 1; i
<= thisrun_accesses
; i
++)
2481 reg
[i
] = target_buffer_get_u16(target
, buffer
) & 0xffff;
2485 arm7_9
->write_core_regs(target
, reg_list
, reg
);
2487 for (i
= 1; i
<= thisrun_accesses
; i
++)
2489 arm7_9
->store_hword_reg(target
, i
);
2491 /* fast memory writes are only safe when the target is running
2492 * from a sufficiently high clock (32 kHz is usually too slow)
2494 if (arm7_9
->fast_memory_access
)
2495 retval
= arm7_9_execute_fast_sys_speed(target
);
2497 retval
= arm7_9_execute_sys_speed(target
);
2498 if (retval
!= ERROR_OK
)
2504 num_accesses
+= thisrun_accesses
;
2508 while (num_accesses
< count
)
2511 thisrun_accesses
= ((count
- num_accesses
) >= 14) ? 14 : (count
- num_accesses
);
2512 reg_list
= (0xffff >> (15 - thisrun_accesses
)) & 0xfffe;
2514 for (i
= 1; i
<= thisrun_accesses
; i
++)
2518 reg
[i
] = *buffer
++ & 0xff;
2521 arm7_9
->write_core_regs(target
, reg_list
, reg
);
2523 for (i
= 1; i
<= thisrun_accesses
; i
++)
2525 arm7_9
->store_byte_reg(target
, i
);
2526 /* fast memory writes are only safe when the target is running
2527 * from a sufficiently high clock (32 kHz is usually too slow)
2529 if (arm7_9
->fast_memory_access
)
2530 retval
= arm7_9_execute_fast_sys_speed(target
);
2532 retval
= arm7_9_execute_sys_speed(target
);
2533 if (retval
!= ERROR_OK
)
2540 num_accesses
+= thisrun_accesses
;
2544 LOG_ERROR("BUG: we shouldn't get here");
2550 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGACK
, 1, 1);
2551 embeddedice_store_reg(dbg_ctrl
);
2553 if (armv4_5_mode_to_number(armv4_5
->core_mode
)==-1)
2556 for (i
= 0; i
<= last_reg
; i
++)
2557 ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5
->core_mode
, i
).dirty
= ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5
->core_mode
, i
).valid
;
2559 arm7_9
->read_xpsr(target
, &cpsr
, 0);
2560 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
2562 LOG_ERROR("JTAG error while reading cpsr");
2563 return ERROR_TARGET_DATA_ABORT
;
2566 if (((cpsr
& 0x1f) == ARMV4_5_MODE_ABT
) && (armv4_5
->core_mode
!= ARMV4_5_MODE_ABT
))
2568 LOG_WARNING("memory write caused data abort (address: 0x%8.8" PRIx32
", size: 0x%" PRIx32
", count: 0x%" PRIx32
")", address
, size
, count
);
2570 arm7_9
->write_xpsr_im8(target
, buf_get_u32(armv4_5
->core_cache
->reg_list
[ARMV4_5_CPSR
].value
, 0, 8) & ~0x20, 0, 0);
2572 return ERROR_TARGET_DATA_ABORT
;
2578 static int dcc_count
;
2579 static uint8_t *dcc_buffer
;
2581 static int arm7_9_dcc_completion(struct target
*target
, uint32_t exit_point
, int timeout_ms
, void *arch_info
)
2583 int retval
= ERROR_OK
;
2584 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2586 if ((retval
= target_wait_state(target
, TARGET_DEBUG_RUNNING
, 500)) != ERROR_OK
)
2589 int little
= target
->endianness
== TARGET_LITTLE_ENDIAN
;
2590 int count
= dcc_count
;
2591 uint8_t *buffer
= dcc_buffer
;
2594 /* Handle first & last using standard embeddedice_write_reg and the middle ones w/the
2595 * core function repeated. */
2596 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_COMMS_DATA
], fast_target_buffer_get_u32(buffer
, little
));
2599 struct embeddedice_reg
*ice_reg
= arm7_9
->eice_cache
->reg_list
[EICE_COMMS_DATA
].arch_info
;
2600 uint8_t reg_addr
= ice_reg
->addr
& 0x1f;
2601 struct jtag_tap
*tap
;
2602 tap
= ice_reg
->jtag_info
->tap
;
2604 embeddedice_write_dcc(tap
, reg_addr
, buffer
, little
, count
-2);
2605 buffer
+= (count
-2)*4;
2607 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_COMMS_DATA
], fast_target_buffer_get_u32(buffer
, little
));
2611 for (i
= 0; i
< count
; i
++)
2613 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_COMMS_DATA
], fast_target_buffer_get_u32(buffer
, little
));
2618 if ((retval
= target_halt(target
))!= ERROR_OK
)
2622 return target_wait_state(target
, TARGET_HALTED
, 500);
2625 static const uint32_t dcc_code
[] =
2627 /* r0 == input, points to memory buffer
2631 /* spin until DCC control (c0) reports data arrived */
2632 0xee101e10, /* w: mrc p14, #0, r1, c0, c0 */
2633 0xe3110001, /* tst r1, #1 */
2634 0x0afffffc, /* bne w */
2636 /* read word from DCC (c1), write to memory */
2637 0xee111e10, /* mrc p14, #0, r1, c1, c0 */
2638 0xe4801004, /* str r1, [r0], #4 */
2641 0xeafffff9 /* b w */
2644 int armv4_5_run_algorithm_inner(struct target
*target
, int num_mem_params
, struct mem_param
*mem_params
, int num_reg_params
, struct reg_param
*reg_params
, uint32_t entry_point
, uint32_t exit_point
, int timeout_ms
, void *arch_info
, int (*run_it
)(struct target
*target
, uint32_t exit_point
, int timeout_ms
, void *arch_info
));
2646 int arm7_9_bulk_write_memory(struct target
*target
, uint32_t address
, uint32_t count
, uint8_t *buffer
)
2649 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2652 if (!arm7_9
->dcc_downloads
)
2653 return target_write_memory(target
, address
, 4, count
, buffer
);
2655 /* regrab previously allocated working_area, or allocate a new one */
2656 if (!arm7_9
->dcc_working_area
)
2658 uint8_t dcc_code_buf
[6 * 4];
2660 /* make sure we have a working area */
2661 if (target_alloc_working_area(target
, 24, &arm7_9
->dcc_working_area
) != ERROR_OK
)
2663 LOG_INFO("no working area available, falling back to memory writes");
2664 return target_write_memory(target
, address
, 4, count
, buffer
);
2667 /* copy target instructions to target endianness */
2668 for (i
= 0; i
< 6; i
++)
2670 target_buffer_set_u32(target
, dcc_code_buf
+ i
*4, dcc_code
[i
]);
2673 /* write DCC code to working area */
2674 if ((retval
= target_write_memory(target
, arm7_9
->dcc_working_area
->address
, 4, 6, dcc_code_buf
)) != ERROR_OK
)
2680 struct armv4_5_algorithm armv4_5_info
;
2681 struct reg_param reg_params
[1];
2683 armv4_5_info
.common_magic
= ARMV4_5_COMMON_MAGIC
;
2684 armv4_5_info
.core_mode
= ARMV4_5_MODE_SVC
;
2685 armv4_5_info
.core_state
= ARMV4_5_STATE_ARM
;
2687 init_reg_param(®_params
[0], "r0", 32, PARAM_IN_OUT
);
2689 buf_set_u32(reg_params
[0].value
, 0, 32, address
);
2692 dcc_buffer
= buffer
;
2693 retval
= armv4_5_run_algorithm_inner(target
, 0, NULL
, 1, reg_params
,
2694 arm7_9
->dcc_working_area
->address
, arm7_9
->dcc_working_area
->address
+ 6*4, 20*1000, &armv4_5_info
, arm7_9_dcc_completion
);
2696 if (retval
== ERROR_OK
)
2698 uint32_t endaddress
= buf_get_u32(reg_params
[0].value
, 0, 32);
2699 if (endaddress
!= (address
+ count
*4))
2701 LOG_ERROR("DCC write failed, expected end address 0x%08" PRIx32
" got 0x%0" PRIx32
"", (address
+ count
*4), endaddress
);
2702 retval
= ERROR_FAIL
;
2706 destroy_reg_param(®_params
[0]);
2712 * Perform per-target setup that requires JTAG access.
2714 int arm7_9_examine(struct target
*target
)
2716 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2719 if (!target_was_examined(target
)) {
2720 struct reg_cache
*t
, **cache_p
;
2722 t
= embeddedice_build_reg_cache(target
, arm7_9
);
2726 cache_p
= register_get_last_cache_p(&target
->reg_cache
);
2728 arm7_9
->eice_cache
= (*cache_p
);
2730 if (arm7_9
->armv4_5_common
.etm
)
2731 (*cache_p
)->next
= etm_build_reg_cache(target
,
2733 arm7_9
->armv4_5_common
.etm
);
2735 target_set_examined(target
);
2738 retval
= embeddedice_setup(target
);
2739 if (retval
== ERROR_OK
)
2740 retval
= arm7_9_setup(target
);
2741 if (retval
== ERROR_OK
&& arm7_9
->armv4_5_common
.etm
)
2742 retval
= etm_setup(target
);
2747 COMMAND_HANDLER(handle_arm7_9_write_xpsr_command
)
2752 struct target
*target
= get_current_target(cmd_ctx
);
2753 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2755 if (!is_arm7_9(arm7_9
))
2757 command_print(cmd_ctx
, "current target isn't an ARM7/ARM9 target");
2758 return ERROR_TARGET_INVALID
;
2761 if (target
->state
!= TARGET_HALTED
)
2763 command_print(cmd_ctx
, "can't write registers while running");
2769 command_print(cmd_ctx
, "usage: write_xpsr <value> <not cpsr | spsr>");
2773 COMMAND_PARSE_NUMBER(u32
, args
[0], value
);
2774 COMMAND_PARSE_NUMBER(int, args
[1], spsr
);
2776 /* if we're writing the CPSR, mask the T bit */
2780 arm7_9
->write_xpsr(target
, value
, spsr
);
2781 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
2783 LOG_ERROR("JTAG error while writing to xpsr");
2790 COMMAND_HANDLER(handle_arm7_9_write_xpsr_im8_command
)
2796 struct target
*target
= get_current_target(cmd_ctx
);
2797 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2799 if (!is_arm7_9(arm7_9
))
2801 command_print(cmd_ctx
, "current target isn't an ARM7/ARM9 target");
2802 return ERROR_TARGET_INVALID
;
2805 if (target
->state
!= TARGET_HALTED
)
2807 command_print(cmd_ctx
, "can't write registers while running");
2813 command_print(cmd_ctx
, "usage: write_xpsr_im8 <im8> <rotate> <not cpsr | spsr>");
2817 COMMAND_PARSE_NUMBER(u32
, args
[0], value
);
2818 COMMAND_PARSE_NUMBER(int, args
[1], rotate
);
2819 COMMAND_PARSE_NUMBER(int, args
[2], spsr
);
2821 arm7_9
->write_xpsr_im8(target
, value
, rotate
, spsr
);
2822 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
2824 LOG_ERROR("JTAG error while writing 8-bit immediate to xpsr");
2831 COMMAND_HANDLER(handle_arm7_9_write_core_reg_command
)
2836 struct target
*target
= get_current_target(cmd_ctx
);
2837 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2839 if (!is_arm7_9(arm7_9
))
2841 command_print(cmd_ctx
, "current target isn't an ARM7/ARM9 target");
2842 return ERROR_TARGET_INVALID
;
2845 if (target
->state
!= TARGET_HALTED
)
2847 command_print(cmd_ctx
, "can't write registers while running");
2853 command_print(cmd_ctx
, "usage: write_core_reg <num> <mode> <value>");
2857 COMMAND_PARSE_NUMBER(int, args
[0], num
);
2858 COMMAND_PARSE_NUMBER(u32
, args
[1], mode
);
2859 COMMAND_PARSE_NUMBER(u32
, args
[2], value
);
2861 return arm7_9_write_core_reg(target
, num
, mode
, value
);
2864 COMMAND_HANDLER(handle_arm7_9_dbgrq_command
)
2866 struct target
*target
= get_current_target(cmd_ctx
);
2867 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2869 if (!is_arm7_9(arm7_9
))
2871 command_print(cmd_ctx
, "current target isn't an ARM7/ARM9 target");
2872 return ERROR_TARGET_INVALID
;
2877 if (strcmp("enable", args
[0]) == 0)
2879 arm7_9
->use_dbgrq
= 1;
2881 else if (strcmp("disable", args
[0]) == 0)
2883 arm7_9
->use_dbgrq
= 0;
2887 command_print(cmd_ctx
, "usage: arm7_9 dbgrq <enable | disable>");
2891 command_print(cmd_ctx
, "use of EmbeddedICE dbgrq instead of breakpoint for target halt %s", (arm7_9
->use_dbgrq
) ? "enabled" : "disabled");
2896 COMMAND_HANDLER(handle_arm7_9_fast_memory_access_command
)
2898 struct target
*target
= get_current_target(cmd_ctx
);
2899 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2901 if (!is_arm7_9(arm7_9
))
2903 command_print(cmd_ctx
, "current target isn't an ARM7/ARM9 target");
2904 return ERROR_TARGET_INVALID
;
2909 if (strcmp("enable", args
[0]) == 0)
2911 arm7_9
->fast_memory_access
= 1;
2913 else if (strcmp("disable", args
[0]) == 0)
2915 arm7_9
->fast_memory_access
= 0;
2919 command_print(cmd_ctx
, "usage: arm7_9 fast_memory_access <enable | disable>");
2923 command_print(cmd_ctx
, "fast memory access is %s", (arm7_9
->fast_memory_access
) ? "enabled" : "disabled");
2928 COMMAND_HANDLER(handle_arm7_9_dcc_downloads_command
)
2930 struct target
*target
= get_current_target(cmd_ctx
);
2931 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2933 if (!is_arm7_9(arm7_9
))
2935 command_print(cmd_ctx
, "current target isn't an ARM7/ARM9 target");
2936 return ERROR_TARGET_INVALID
;
2941 if (strcmp("enable", args
[0]) == 0)
2943 arm7_9
->dcc_downloads
= 1;
2945 else if (strcmp("disable", args
[0]) == 0)
2947 arm7_9
->dcc_downloads
= 0;
2951 command_print(cmd_ctx
, "usage: arm7_9 dcc_downloads <enable | disable>");
2955 command_print(cmd_ctx
, "dcc downloads are %s", (arm7_9
->dcc_downloads
) ? "enabled" : "disabled");
2960 int arm7_9_init_arch_info(struct target
*target
, struct arm7_9_common
*arm7_9
)
2962 int retval
= ERROR_OK
;
2963 struct arm
*armv4_5
= &arm7_9
->armv4_5_common
;
2965 arm7_9
->common_magic
= ARM7_9_COMMON_MAGIC
;
2967 if ((retval
= arm_jtag_setup_connection(&arm7_9
->jtag_info
)) != ERROR_OK
)
2970 /* caller must have allocated via calloc(), so everything's zeroed */
2972 arm7_9
->wp_available_max
= 2;
2974 arm7_9
->fast_memory_access
= fast_and_dangerous
;
2975 arm7_9
->dcc_downloads
= fast_and_dangerous
;
2977 armv4_5
->arch_info
= arm7_9
;
2978 armv4_5
->read_core_reg
= arm7_9_read_core_reg
;
2979 armv4_5
->write_core_reg
= arm7_9_write_core_reg
;
2980 armv4_5
->full_context
= arm7_9_full_context
;
2982 if ((retval
= armv4_5_init_arch_info(target
, armv4_5
)) != ERROR_OK
)
2985 return target_register_timer_callback(arm7_9_handle_target_request
,
2989 int arm7_9_register_commands(struct command_context
*cmd_ctx
)
2991 struct command
*arm7_9_cmd
;
2993 arm7_9_cmd
= register_command(cmd_ctx
, NULL
, "arm7_9",
2994 NULL
, COMMAND_ANY
, "arm7/9 specific commands");
2996 register_command(cmd_ctx
, arm7_9_cmd
, "write_xpsr",
2997 handle_arm7_9_write_xpsr_command
, COMMAND_EXEC
,
2998 "write program status register <value> <not cpsr | spsr>");
2999 register_command(cmd_ctx
, arm7_9_cmd
, "write_xpsr_im8",
3000 handle_arm7_9_write_xpsr_im8_command
, COMMAND_EXEC
,
3001 "write program status register "
3002 "<8bit immediate> <rotate> <not cpsr | spsr>");
3004 register_command(cmd_ctx
, arm7_9_cmd
, "write_core_reg",
3005 handle_arm7_9_write_core_reg_command
, COMMAND_EXEC
,
3006 "write core register <num> <mode> <value>");
3008 register_command(cmd_ctx
, arm7_9_cmd
, "dbgrq",
3009 handle_arm7_9_dbgrq_command
, COMMAND_ANY
,
3010 "use EmbeddedICE dbgrq instead of breakpoint "
3011 "for target halt requests <enable | disable>");
3012 register_command(cmd_ctx
, arm7_9_cmd
, "fast_memory_access",
3013 handle_arm7_9_fast_memory_access_command
, COMMAND_ANY
,
3014 "use fast memory accesses instead of slower "
3015 "but potentially safer accesses <enable | disable>");
3016 register_command(cmd_ctx
, arm7_9_cmd
, "dcc_downloads",
3017 handle_arm7_9_dcc_downloads_command
, COMMAND_ANY
,
3018 "use DCC downloads for larger memory writes <enable | disable>");
3020 armv4_5_register_commands(cmd_ctx
);
3022 etm_register_commands(cmd_ctx
);
Linking to existing account procedure
If you already have an account and want to add another login method
you
MUST first sign in with your existing account and
then change URL to read
https://review.openocd.org/login/?link
to get to this page again but this time it'll work for linking. Thank you.
SSH host keys fingerprints
1024 SHA256:YKx8b7u5ZWdcbp7/4AeXNaqElP49m6QrwfXaqQGJAOk gerrit-code-review@openocd.zylin.com (DSA)
384 SHA256:jHIbSQa4REvwCFG4cq5LBlBLxmxSqelQPem/EXIrxjk gerrit-code-review@openocd.org (ECDSA)
521 SHA256:UAOPYkU9Fjtcao0Ul/Rrlnj/OsQvt+pgdYSZ4jOYdgs gerrit-code-review@openocd.org (ECDSA)
256 SHA256:A13M5QlnozFOvTllybRZH6vm7iSt0XLxbA48yfc2yfY gerrit-code-review@openocd.org (ECDSA)
256 SHA256:spYMBqEYoAOtK7yZBrcwE8ZpYt6b68Cfh9yEVetvbXg gerrit-code-review@openocd.org (ED25519)
+--[ED25519 256]--+
|=.. |
|+o.. . |
|*.o . . |
|+B . . . |
|Bo. = o S |
|Oo.+ + = |
|oB=.* = . o |
| =+=.+ + E |
|. .=o . o |
+----[SHA256]-----+
2048 SHA256:0Onrb7/PHjpo6iVZ7xQX2riKN83FJ3KGU0TvI0TaFG4 gerrit-code-review@openocd.zylin.com (RSA)