1 /***************************************************************************
2 * Copyright (C) 2005 by Dominic Rath *
3 * Dominic.Rath@gmx.de *
5 * Copyright (C) 2007-2009 Øyvind Harboe *
6 * oyvind.harboe@zylin.com *
8 * Copyright (C) 2008 by Spencer Oliver *
9 * spen@spen-soft.co.uk *
11 * Copyright (C) 2008 by Hongtao Zheng *
14 * Copyright (C) 2009 by David Brownell *
16 * This program is free software; you can redistribute it and/or modify *
17 * it under the terms of the GNU General Public License as published by *
18 * the Free Software Foundation; either version 2 of the License, or *
19 * (at your option) any later version. *
21 * This program is distributed in the hope that it will be useful, *
22 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
23 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
24 * GNU General Public License for more details. *
26 * You should have received a copy of the GNU General Public License *
27 * along with this program; if not, write to the *
28 * Free Software Foundation, Inc., *
29 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
30 ***************************************************************************/
35 #include "breakpoints.h"
36 #include "embeddedice.h"
37 #include "target_request.h"
39 #include <helper/time_support.h>
40 #include "arm_simulator.h"
41 #include "arm_semihosting.h"
42 #include "algorithm.h"
49 * Hold common code supporting the ARM7 and ARM9 core generations.
51 * While the ARM core implementations evolved substantially during these
52 * two generations, they look quite similar from the JTAG perspective.
53 * Both have similar debug facilities, based on the same two scan chains
54 * providing access to the core and to an EmbeddedICE module. Both can
55 * support similar ETM and ETB modules, for tracing. And both expose
56 * what could be viewed as "ARM Classic", with multiple processor modes,
57 * shadowed registers, and support for the Thumb instruction set.
59 * Processor differences include things like presence or absence of MMU
60 * and cache, pipeline sizes, use of a modified Harvard Architecure
61 * (with separate instruction and data busses from the CPU), support
62 * for cpu clock gating during idle, and more.
65 static int arm7_9_debug_entry(struct target
*target
);
68 * Clear watchpoints for an ARM7/9 target.
70 * @param arm7_9 Pointer to the common struct for an ARM7/9 target
71 * @return JTAG error status after executing queue
73 static int arm7_9_clear_watchpoints(struct arm7_9_common
*arm7_9
)
76 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], 0x0);
77 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
], 0x0);
78 arm7_9
->sw_breakpoint_count
= 0;
79 arm7_9
->sw_breakpoints_added
= 0;
81 arm7_9
->wp1_used
= arm7_9
->wp1_used_default
;
82 arm7_9
->wp_available
= arm7_9
->wp_available_max
;
84 return jtag_execute_queue();
88 * Assign a watchpoint to one of the two available hardware comparators in an
89 * ARM7 or ARM9 target.
91 * @param arm7_9 Pointer to the common struct for an ARM7/9 target
92 * @param breakpoint Pointer to the breakpoint to be used as a watchpoint
94 static void arm7_9_assign_wp(struct arm7_9_common
*arm7_9
, struct breakpoint
*breakpoint
)
96 if (!arm7_9
->wp0_used
)
100 arm7_9
->wp_available
--;
102 else if (!arm7_9
->wp1_used
)
104 arm7_9
->wp1_used
= 1;
106 arm7_9
->wp_available
--;
110 LOG_ERROR("BUG: no hardware comparator available");
112 LOG_DEBUG("BPID: %d (0x%08" PRIx32
") using hw wp: %d",
113 breakpoint
->unique_id
,
119 * Setup an ARM7/9 target's embedded ICE registers for software breakpoints.
121 * @param arm7_9 Pointer to common struct for ARM7/9 targets
122 * @return Error codes if there is a problem finding a watchpoint or the result
123 * of executing the JTAG queue
125 static int arm7_9_set_software_breakpoints(struct arm7_9_common
*arm7_9
)
127 if (arm7_9
->sw_breakpoints_added
)
131 if (arm7_9
->wp_available
< 1)
133 LOG_WARNING("can't enable sw breakpoints with no watchpoint unit available");
134 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
136 arm7_9
->wp_available
--;
138 /* pick a breakpoint unit */
139 if (!arm7_9
->wp0_used
)
141 arm7_9
->sw_breakpoints_added
= 1;
142 arm7_9
->wp0_used
= 3;
143 } else if (!arm7_9
->wp1_used
)
145 arm7_9
->sw_breakpoints_added
= 2;
146 arm7_9
->wp1_used
= 3;
150 LOG_ERROR("BUG: both watchpoints used, but wp_available >= 1");
154 if (arm7_9
->sw_breakpoints_added
== 1)
156 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_VALUE
], arm7_9
->arm_bkpt
);
157 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
], 0x0);
158 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
], 0xffffffffu
);
159 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
], ~EICE_W_CTRL_nOPC
& 0xff);
160 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], EICE_W_CTRL_ENABLE
);
162 else if (arm7_9
->sw_breakpoints_added
== 2)
164 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_DATA_VALUE
], arm7_9
->arm_bkpt
);
165 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_DATA_MASK
], 0x0);
166 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_MASK
], 0xffffffffu
);
167 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_MASK
], ~EICE_W_CTRL_nOPC
& 0xff);
168 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
], EICE_W_CTRL_ENABLE
);
172 LOG_ERROR("BUG: both watchpoints used, but wp_available >= 1");
175 LOG_DEBUG("SW BP using hw wp: %d",
176 arm7_9
->sw_breakpoints_added
);
178 return jtag_execute_queue();
182 * Setup the common pieces for an ARM7/9 target after reset or on startup.
184 * @param target Pointer to an ARM7/9 target to setup
185 * @return Result of clearing the watchpoints on the target
187 static int arm7_9_setup(struct target
*target
)
189 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
191 return arm7_9_clear_watchpoints(arm7_9
);
195 * Set either a hardware or software breakpoint on an ARM7/9 target. The
196 * breakpoint is set up even if it is already set. Some actions, e.g. reset,
197 * might have erased the values in Embedded ICE.
199 * @param target Pointer to the target device to set the breakpoints on
200 * @param breakpoint Pointer to the breakpoint to be set
201 * @return For hardware breakpoints, this is the result of executing the JTAG
202 * queue. For software breakpoints, this will be the status of the
203 * required memory reads and writes
205 static int arm7_9_set_breakpoint(struct target
*target
, struct breakpoint
*breakpoint
)
207 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
208 int retval
= ERROR_OK
;
210 LOG_DEBUG("BPID: %d, Address: 0x%08" PRIx32
", Type: %d" ,
211 breakpoint
->unique_id
,
215 if (target
->state
!= TARGET_HALTED
)
217 LOG_WARNING("target not halted");
218 return ERROR_TARGET_NOT_HALTED
;
221 if (breakpoint
->type
== BKPT_HARD
)
223 /* either an ARM (4 byte) or Thumb (2 byte) breakpoint */
224 uint32_t mask
= (breakpoint
->length
== 4) ? 0x3u
: 0x1u
;
226 /* reassign a hw breakpoint */
227 if (breakpoint
->set
== 0)
229 arm7_9_assign_wp(arm7_9
, breakpoint
);
232 if (breakpoint
->set
== 1)
234 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_VALUE
], breakpoint
->address
);
235 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
], mask
);
236 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
], 0xffffffffu
);
237 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
], ~EICE_W_CTRL_nOPC
& 0xff);
238 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], EICE_W_CTRL_ENABLE
);
240 else if (breakpoint
->set
== 2)
242 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_VALUE
], breakpoint
->address
);
243 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_MASK
], mask
);
244 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_DATA_MASK
], 0xffffffffu
);
245 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_MASK
], ~EICE_W_CTRL_nOPC
& 0xff);
246 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
], EICE_W_CTRL_ENABLE
);
250 LOG_ERROR("BUG: no hardware comparator available");
254 retval
= jtag_execute_queue();
256 else if (breakpoint
->type
== BKPT_SOFT
)
258 /* did we already set this breakpoint? */
262 if (breakpoint
->length
== 4)
264 uint32_t verify
= 0xffffffff;
265 /* keep the original instruction in target endianness */
266 if ((retval
= target_read_memory(target
, breakpoint
->address
, 4, 1, breakpoint
->orig_instr
)) != ERROR_OK
)
270 /* write the breakpoint instruction in target endianness (arm7_9->arm_bkpt is host endian) */
271 if ((retval
= target_write_u32(target
, breakpoint
->address
, arm7_9
->arm_bkpt
)) != ERROR_OK
)
276 if ((retval
= target_read_u32(target
, breakpoint
->address
, &verify
)) != ERROR_OK
)
280 if (verify
!= arm7_9
->arm_bkpt
)
282 LOG_ERROR("Unable to set 32 bit software breakpoint at address %08" PRIx32
" - check that memory is read/writable", breakpoint
->address
);
288 uint16_t verify
= 0xffff;
289 /* keep the original instruction in target endianness */
290 if ((retval
= target_read_memory(target
, breakpoint
->address
, 2, 1, breakpoint
->orig_instr
)) != ERROR_OK
)
294 /* write the breakpoint instruction in target endianness (arm7_9->thumb_bkpt is host endian) */
295 if ((retval
= target_write_u16(target
, breakpoint
->address
, arm7_9
->thumb_bkpt
)) != ERROR_OK
)
300 if ((retval
= target_read_u16(target
, breakpoint
->address
, &verify
)) != ERROR_OK
)
304 if (verify
!= arm7_9
->thumb_bkpt
)
306 LOG_ERROR("Unable to set thumb software breakpoint at address %08" PRIx32
" - check that memory is read/writable", breakpoint
->address
);
311 if ((retval
= arm7_9_set_software_breakpoints(arm7_9
)) != ERROR_OK
)
314 arm7_9
->sw_breakpoint_count
++;
323 * Unsets an existing breakpoint on an ARM7/9 target. If it is a hardware
324 * breakpoint, the watchpoint used will be freed and the Embedded ICE registers
325 * will be updated. Otherwise, the software breakpoint will be restored to its
326 * original instruction if it hasn't already been modified.
328 * @param target Pointer to ARM7/9 target to unset the breakpoint from
329 * @param breakpoint Pointer to breakpoint to be unset
330 * @return For hardware breakpoints, this is the result of executing the JTAG
331 * queue. For software breakpoints, this will be the status of the
332 * required memory reads and writes
334 static int arm7_9_unset_breakpoint(struct target
*target
, struct breakpoint
*breakpoint
)
336 int retval
= ERROR_OK
;
337 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
339 LOG_DEBUG("BPID: %d, Address: 0x%08" PRIx32
,
340 breakpoint
->unique_id
,
341 breakpoint
->address
);
343 if (!breakpoint
->set
)
345 LOG_WARNING("breakpoint not set");
349 if (breakpoint
->type
== BKPT_HARD
)
351 LOG_DEBUG("BPID: %d Releasing hw wp: %d",
352 breakpoint
->unique_id
,
354 if (breakpoint
->set
== 1)
356 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], 0x0);
357 arm7_9
->wp0_used
= 0;
358 arm7_9
->wp_available
++;
360 else if (breakpoint
->set
== 2)
362 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
], 0x0);
363 arm7_9
->wp1_used
= 0;
364 arm7_9
->wp_available
++;
366 retval
= jtag_execute_queue();
371 /* restore original instruction (kept in target endianness) */
372 if (breakpoint
->length
== 4)
374 uint32_t current_instr
;
375 /* check that user program as not modified breakpoint instruction */
376 if ((retval
= target_read_memory(target
, breakpoint
->address
, 4, 1, (uint8_t*)¤t_instr
)) != ERROR_OK
)
380 current_instr
= target_buffer_get_u32(target
, (uint8_t *)¤t_instr
);
381 if (current_instr
== arm7_9
->arm_bkpt
)
382 if ((retval
= target_write_memory(target
, breakpoint
->address
, 4, 1, breakpoint
->orig_instr
)) != ERROR_OK
)
389 uint16_t current_instr
;
390 /* check that user program as not modified breakpoint instruction */
391 if ((retval
= target_read_memory(target
, breakpoint
->address
, 2, 1, (uint8_t*)¤t_instr
)) != ERROR_OK
)
395 if (current_instr
== arm7_9
->thumb_bkpt
)
396 if ((retval
= target_write_memory(target
, breakpoint
->address
, 2, 1, breakpoint
->orig_instr
)) != ERROR_OK
)
402 if (--arm7_9
->sw_breakpoint_count
==0)
404 /* We have removed the last sw breakpoint, clear the hw breakpoint we used to implement it */
405 if (arm7_9
->sw_breakpoints_added
== 1)
407 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], 0);
409 else if (arm7_9
->sw_breakpoints_added
== 2)
411 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
], 0);
422 * Add a breakpoint to an ARM7/9 target. This makes sure that there are no
423 * dangling breakpoints and that the desired breakpoint can be added.
425 * @param target Pointer to the target ARM7/9 device to add a breakpoint to
426 * @param breakpoint Pointer to the breakpoint to be added
427 * @return An error status if there is a problem adding the breakpoint or the
428 * result of setting the breakpoint
430 int arm7_9_add_breakpoint(struct target
*target
, struct breakpoint
*breakpoint
)
432 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
434 if (arm7_9
->breakpoint_count
== 0)
436 /* make sure we don't have any dangling breakpoints. This is vital upon
437 * GDB connect/disconnect
439 arm7_9_clear_watchpoints(arm7_9
);
442 if ((breakpoint
->type
== BKPT_HARD
) && (arm7_9
->wp_available
< 1))
444 LOG_INFO("no watchpoint unit available for hardware breakpoint");
445 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
448 if ((breakpoint
->length
!= 2) && (breakpoint
->length
!= 4))
450 LOG_INFO("only breakpoints of two (Thumb) or four (ARM) bytes length supported");
451 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
454 if (breakpoint
->type
== BKPT_HARD
)
456 arm7_9_assign_wp(arm7_9
, breakpoint
);
459 arm7_9
->breakpoint_count
++;
461 return arm7_9_set_breakpoint(target
, breakpoint
);
465 * Removes a breakpoint from an ARM7/9 target. This will make sure there are no
466 * dangling breakpoints and updates available watchpoints if it is a hardware
469 * @param target Pointer to the target to have a breakpoint removed
470 * @param breakpoint Pointer to the breakpoint to be removed
471 * @return Error status if there was a problem unsetting the breakpoint or the
472 * watchpoints could not be cleared
474 int arm7_9_remove_breakpoint(struct target
*target
, struct breakpoint
*breakpoint
)
476 int retval
= ERROR_OK
;
477 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
479 if ((retval
= arm7_9_unset_breakpoint(target
, breakpoint
)) != ERROR_OK
)
484 if (breakpoint
->type
== BKPT_HARD
)
485 arm7_9
->wp_available
++;
487 arm7_9
->breakpoint_count
--;
488 if (arm7_9
->breakpoint_count
== 0)
490 /* make sure we don't have any dangling breakpoints */
491 if ((retval
= arm7_9_clear_watchpoints(arm7_9
)) != ERROR_OK
)
501 * Sets a watchpoint for an ARM7/9 target in one of the watchpoint units. It is
502 * considered a bug to call this function when there are no available watchpoint
505 * @param target Pointer to an ARM7/9 target to set a watchpoint on
506 * @param watchpoint Pointer to the watchpoint to be set
507 * @return Error status if watchpoint set fails or the result of executing the
510 static int arm7_9_set_watchpoint(struct target
*target
, struct watchpoint
*watchpoint
)
512 int retval
= ERROR_OK
;
513 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
517 mask
= watchpoint
->length
- 1;
519 if (target
->state
!= TARGET_HALTED
)
521 LOG_WARNING("target not halted");
522 return ERROR_TARGET_NOT_HALTED
;
525 if (watchpoint
->rw
== WPT_ACCESS
)
530 if (!arm7_9
->wp0_used
)
532 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_VALUE
], watchpoint
->address
);
533 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
], mask
);
534 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
], watchpoint
->mask
);
535 if (watchpoint
->mask
!= 0xffffffffu
)
536 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_VALUE
], watchpoint
->value
);
537 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
], 0xff & ~EICE_W_CTRL_nOPC
& ~rw_mask
);
538 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], EICE_W_CTRL_ENABLE
| EICE_W_CTRL_nOPC
| (watchpoint
->rw
& 1));
540 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
545 arm7_9
->wp0_used
= 2;
547 else if (!arm7_9
->wp1_used
)
549 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_VALUE
], watchpoint
->address
);
550 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_MASK
], mask
);
551 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_DATA_MASK
], watchpoint
->mask
);
552 if (watchpoint
->mask
!= 0xffffffffu
)
553 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_DATA_VALUE
], watchpoint
->value
);
554 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_MASK
], 0xff & ~EICE_W_CTRL_nOPC
& ~rw_mask
);
555 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
], EICE_W_CTRL_ENABLE
| EICE_W_CTRL_nOPC
| (watchpoint
->rw
& 1));
557 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
562 arm7_9
->wp1_used
= 2;
566 LOG_ERROR("BUG: no hardware comparator available");
574 * Unset an existing watchpoint and clear the used watchpoint unit.
576 * @param target Pointer to the target to have the watchpoint removed
577 * @param watchpoint Pointer to the watchpoint to be removed
578 * @return Error status while trying to unset the watchpoint or the result of
579 * executing the JTAG queue
581 static int arm7_9_unset_watchpoint(struct target
*target
, struct watchpoint
*watchpoint
)
583 int retval
= ERROR_OK
;
584 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
586 if (target
->state
!= TARGET_HALTED
)
588 LOG_WARNING("target not halted");
589 return ERROR_TARGET_NOT_HALTED
;
592 if (!watchpoint
->set
)
594 LOG_WARNING("breakpoint not set");
598 if (watchpoint
->set
== 1)
600 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], 0x0);
601 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
605 arm7_9
->wp0_used
= 0;
607 else if (watchpoint
->set
== 2)
609 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
], 0x0);
610 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
614 arm7_9
->wp1_used
= 0;
622 * Add a watchpoint to an ARM7/9 target. If there are no watchpoint units
623 * available, an error response is returned.
625 * @param target Pointer to the ARM7/9 target to add a watchpoint to
626 * @param watchpoint Pointer to the watchpoint to be added
627 * @return Error status while trying to add the watchpoint
629 int arm7_9_add_watchpoint(struct target
*target
, struct watchpoint
*watchpoint
)
631 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
633 if (arm7_9
->wp_available
< 1)
635 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
638 if ((watchpoint
->length
!= 1) && (watchpoint
->length
!= 2) && (watchpoint
->length
!= 4))
640 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
643 arm7_9
->wp_available
--;
649 * Remove a watchpoint from an ARM7/9 target. The watchpoint will be unset and
650 * the used watchpoint unit will be reopened.
652 * @param target Pointer to the target to remove a watchpoint from
653 * @param watchpoint Pointer to the watchpoint to be removed
654 * @return Result of trying to unset the watchpoint
656 int arm7_9_remove_watchpoint(struct target
*target
, struct watchpoint
*watchpoint
)
658 int retval
= ERROR_OK
;
659 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
663 if ((retval
= arm7_9_unset_watchpoint(target
, watchpoint
)) != ERROR_OK
)
669 arm7_9
->wp_available
++;
675 * Restarts the target by sending a RESTART instruction and moving the JTAG
676 * state to IDLE. This includes a timeout waiting for DBGACK and SYSCOMP to be
677 * asserted by the processor.
679 * @param target Pointer to target to issue commands to
680 * @return Error status if there is a timeout or a problem while executing the
683 int arm7_9_execute_sys_speed(struct target
*target
)
686 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
687 struct arm_jtag
*jtag_info
= &arm7_9
->jtag_info
;
688 struct reg
*dbg_stat
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_STAT
];
690 /* set RESTART instruction */
691 if (arm7_9
->need_bypass_before_restart
) {
692 arm7_9
->need_bypass_before_restart
= 0;
693 retval
= arm_jtag_set_instr(jtag_info
, 0xf, NULL
, TAP_IDLE
);
694 if (retval
!= ERROR_OK
)
697 retval
= arm_jtag_set_instr(jtag_info
, 0x4, NULL
, TAP_IDLE
);
698 if (retval
!= ERROR_OK
)
701 long long then
= timeval_ms();
703 while (!(timeout
= ((timeval_ms()-then
) > 1000)))
705 /* read debug status register */
706 embeddedice_read_reg(dbg_stat
);
707 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
709 if ((buf_get_u32(dbg_stat
->value
, EICE_DBG_STATUS_DBGACK
, 1))
710 && (buf_get_u32(dbg_stat
->value
, EICE_DBG_STATUS_SYSCOMP
, 1)))
712 if (debug_level
>= 3)
722 LOG_ERROR("timeout waiting for SYSCOMP & DBGACK, last DBG_STATUS: %" PRIx32
"", buf_get_u32(dbg_stat
->value
, 0, dbg_stat
->size
));
723 return ERROR_TARGET_TIMEOUT
;
730 * Restarts the target by sending a RESTART instruction and moving the JTAG
731 * state to IDLE. This validates that DBGACK and SYSCOMP are set without
732 * waiting until they are.
734 * @param target Pointer to the target to issue commands to
735 * @return Always ERROR_OK
737 static int arm7_9_execute_fast_sys_speed(struct target
*target
)
740 static uint8_t check_value
[4], check_mask
[4];
742 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
743 struct arm_jtag
*jtag_info
= &arm7_9
->jtag_info
;
744 struct reg
*dbg_stat
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_STAT
];
747 /* set RESTART instruction */
748 if (arm7_9
->need_bypass_before_restart
) {
749 arm7_9
->need_bypass_before_restart
= 0;
750 retval
= arm_jtag_set_instr(jtag_info
, 0xf, NULL
, TAP_IDLE
);
751 if (retval
!= ERROR_OK
)
754 retval
= arm_jtag_set_instr(jtag_info
, 0x4, NULL
, TAP_IDLE
);
755 if (retval
!= ERROR_OK
)
760 /* check for DBGACK and SYSCOMP set (others don't care) */
762 /* NB! These are constants that must be available until after next jtag_execute() and
763 * we evaluate the values upon first execution in lieu of setting up these constants
764 * during early setup.
766 buf_set_u32(check_value
, 0, 32, 0x9);
767 buf_set_u32(check_mask
, 0, 32, 0x9);
771 /* read debug status register */
772 embeddedice_read_reg_w_check(dbg_stat
, check_value
, check_mask
);
778 * Get some data from the ARM7/9 target.
780 * @param target Pointer to the ARM7/9 target to read data from
781 * @param size The number of 32bit words to be read
782 * @param buffer Pointer to the buffer that will hold the data
783 * @return The result of receiving data from the Embedded ICE unit
785 int arm7_9_target_request_data(struct target
*target
, uint32_t size
, uint8_t *buffer
)
787 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
788 struct arm_jtag
*jtag_info
= &arm7_9
->jtag_info
;
790 int retval
= ERROR_OK
;
793 data
= malloc(size
* (sizeof(uint32_t)));
795 retval
= embeddedice_receive(jtag_info
, data
, size
);
797 /* return the 32-bit ints in the 8-bit array */
798 for (i
= 0; i
< size
; i
++)
800 h_u32_to_le(buffer
+ (i
* 4), data
[i
]);
809 * Handles requests to an ARM7/9 target. If debug messaging is enabled, the
810 * target is running and the DCC control register has the W bit high, this will
811 * execute the request on the target.
813 * @param priv Void pointer expected to be a struct target pointer
814 * @return ERROR_OK unless there are issues with the JTAG queue or when reading
815 * from the Embedded ICE unit
817 static int arm7_9_handle_target_request(void *priv
)
819 int retval
= ERROR_OK
;
820 struct target
*target
= priv
;
821 if (!target_was_examined(target
))
823 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
824 struct arm_jtag
*jtag_info
= &arm7_9
->jtag_info
;
825 struct reg
*dcc_control
= &arm7_9
->eice_cache
->reg_list
[EICE_COMMS_CTRL
];
827 if (!target
->dbg_msg_enabled
)
830 if (target
->state
== TARGET_RUNNING
)
832 /* read DCC control register */
833 embeddedice_read_reg(dcc_control
);
834 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
840 if (buf_get_u32(dcc_control
->value
, 1, 1) == 1)
844 if ((retval
= embeddedice_receive(jtag_info
, &request
, 1)) != ERROR_OK
)
848 if ((retval
= target_request(target
, request
)) != ERROR_OK
)
859 * Polls an ARM7/9 target for its current status. If DBGACK is set, the target
860 * is manipulated to the right halted state based on its current state. This is
864 * <tr><th > State</th><th > Action</th></tr>
865 * <tr><td > TARGET_RUNNING | TARGET_RESET</td><td > Enters debug mode. If TARGET_RESET, pc may be checked</td></tr>
866 * <tr><td > TARGET_UNKNOWN</td><td > Warning is logged</td></tr>
867 * <tr><td > TARGET_DEBUG_RUNNING</td><td > Enters debug mode</td></tr>
868 * <tr><td > TARGET_HALTED</td><td > Nothing</td></tr>
871 * If the target does not end up in the halted state, a warning is produced. If
872 * DBGACK is cleared, then the target is expected to either be running or
875 * @param target Pointer to the ARM7/9 target to poll
876 * @return ERROR_OK or an error status if a command fails
878 int arm7_9_poll(struct target
*target
)
881 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
882 struct reg
*dbg_stat
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_STAT
];
884 /* read debug status register */
885 embeddedice_read_reg(dbg_stat
);
886 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
891 if (buf_get_u32(dbg_stat
->value
, EICE_DBG_STATUS_DBGACK
, 1))
893 /* LOG_DEBUG("DBGACK set, dbg_state->value: 0x%x", buf_get_u32(dbg_stat->value, 0, 32));*/
894 if (target
->state
== TARGET_UNKNOWN
)
896 /* Starting OpenOCD with target in debug-halt */
897 target
->state
= TARGET_RUNNING
;
898 LOG_DEBUG("DBGACK already set during server startup.");
900 if ((target
->state
== TARGET_RUNNING
) || (target
->state
== TARGET_RESET
))
902 target
->state
= TARGET_HALTED
;
904 if ((retval
= arm7_9_debug_entry(target
)) != ERROR_OK
)
907 if (arm_semihosting(target
, &retval
) != 0)
910 if ((retval
= target_call_event_callbacks(target
, TARGET_EVENT_HALTED
)) != ERROR_OK
)
915 if (target
->state
== TARGET_DEBUG_RUNNING
)
917 target
->state
= TARGET_HALTED
;
918 if ((retval
= arm7_9_debug_entry(target
)) != ERROR_OK
)
921 if ((retval
= target_call_event_callbacks(target
, TARGET_EVENT_DEBUG_HALTED
)) != ERROR_OK
)
926 if (target
->state
!= TARGET_HALTED
)
928 LOG_WARNING("DBGACK set, but the target did not end up in the halted state %d", target
->state
);
933 if (target
->state
!= TARGET_DEBUG_RUNNING
)
934 target
->state
= TARGET_RUNNING
;
941 * Asserts the reset (SRST) on an ARM7/9 target. Some -S targets (ARM966E-S in
942 * the STR912 isn't affected, ARM926EJ-S in the LPC3180 and AT91SAM9260 is
943 * affected) completely stop the JTAG clock while the core is held in reset
944 * (SRST). It isn't possible to program the halt condition once reset is
945 * asserted, hence a hook that allows the target to set up its reset-halt
946 * condition is setup prior to asserting reset.
948 * @param target Pointer to an ARM7/9 target to assert reset on
949 * @return ERROR_FAIL if the JTAG device does not have SRST, otherwise ERROR_OK
951 int arm7_9_assert_reset(struct target
*target
)
953 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
954 enum reset_types jtag_reset_config
= jtag_get_reset_config();
955 bool use_event
= false;
957 LOG_DEBUG("target->state: %s",
958 target_state_name(target
));
960 if (target_has_event_action(target
, TARGET_EVENT_RESET_ASSERT
))
962 else if (!(jtag_reset_config
& RESET_HAS_SRST
)) {
963 LOG_ERROR("%s: how to reset?", target_name(target
));
967 /* At this point trst has been asserted/deasserted once. We would
968 * like to program EmbeddedICE while SRST is asserted, instead of
969 * depending on SRST to leave that module alone. However, many CPUs
970 * gate the JTAG clock while SRST is asserted; or JTAG may need
971 * clock stability guarantees (adaptive clocking might help).
973 * So we assume JTAG access during SRST is off the menu unless it's
974 * been specifically enabled.
976 bool srst_asserted
= false;
979 && !(jtag_reset_config
& RESET_SRST_PULLS_TRST
)
980 && (jtag_reset_config
& RESET_SRST_NO_GATING
))
982 jtag_add_reset(0, 1);
983 srst_asserted
= true;
986 if (target
->reset_halt
)
989 * For targets that don't support communication while SRST is
990 * asserted, we need to set up the reset vector catch first.
992 * When we use TRST+SRST and that's equivalent to a power-up
993 * reset, these settings may well be reset anyway; so setting
994 * them here won't matter.
996 if (arm7_9
->has_vector_catch
)
998 /* program vector catch register to catch reset */
999 embeddedice_write_reg(&arm7_9
->eice_cache
1000 ->reg_list
[EICE_VEC_CATCH
], 0x1);
1002 /* extra runtest added as issues were found with
1003 * certain ARM9 cores (maybe more) - AT91SAM9260
1006 jtag_add_runtest(1, TAP_IDLE
);
1010 /* program watchpoint unit to match on reset vector
1013 embeddedice_write_reg(&arm7_9
->eice_cache
1014 ->reg_list
[EICE_W0_ADDR_VALUE
], 0x0);
1015 embeddedice_write_reg(&arm7_9
->eice_cache
1016 ->reg_list
[EICE_W0_ADDR_MASK
], 0x3);
1017 embeddedice_write_reg(&arm7_9
->eice_cache
1018 ->reg_list
[EICE_W0_DATA_MASK
],
1020 embeddedice_write_reg(&arm7_9
->eice_cache
1021 ->reg_list
[EICE_W0_CONTROL_VALUE
],
1022 EICE_W_CTRL_ENABLE
);
1023 embeddedice_write_reg(&arm7_9
->eice_cache
1024 ->reg_list
[EICE_W0_CONTROL_MASK
],
1025 ~EICE_W_CTRL_nOPC
& 0xff);
1030 target_handle_event(target
, TARGET_EVENT_RESET_ASSERT
);
1032 /* If we use SRST ... we'd like to issue just SRST, but the
1033 * board or chip may be set up so we have to assert TRST as
1034 * well. On some chips that combination is equivalent to a
1035 * power-up reset, and generally clobbers EICE state.
1037 if (jtag_reset_config
& RESET_SRST_PULLS_TRST
)
1038 jtag_add_reset(1, 1);
1039 else if (!srst_asserted
)
1040 jtag_add_reset(0, 1);
1041 jtag_add_sleep(50000);
1044 target
->state
= TARGET_RESET
;
1045 register_cache_invalidate(arm7_9
->armv4_5_common
.core_cache
);
1047 /* REVISIT why isn't standard debug entry logic sufficient?? */
1048 if (target
->reset_halt
1049 && (!(jtag_reset_config
& RESET_SRST_PULLS_TRST
)
1052 /* debug entry was prepared above */
1053 target
->debug_reason
= DBG_REASON_DBGRQ
;
1060 * Deassert the reset (SRST) signal on an ARM7/9 target. If SRST pulls TRST
1061 * and the target is being reset into a halt, a warning will be triggered
1062 * because it is not possible to reset into a halted mode in this case. The
1063 * target is halted using the target's functions.
1065 * @param target Pointer to the target to have the reset deasserted
1066 * @return ERROR_OK or an error from polling or halting the target
1068 int arm7_9_deassert_reset(struct target
*target
)
1070 int retval
= ERROR_OK
;
1071 LOG_DEBUG("target->state: %s",
1072 target_state_name(target
));
1074 /* deassert reset lines */
1075 jtag_add_reset(0, 0);
1077 /* In case polling is disabled, we need to examine the
1078 * target and poll here for this target to work correctly.
1080 * Otherwise, e.g. halt will fail afterwards with bogus
1081 * error messages as halt will believe that reset is
1084 if ((retval
= target_examine_one(target
)) != ERROR_OK
)
1087 if ((retval
= target_poll(target
)) != ERROR_OK
)
1092 enum reset_types jtag_reset_config
= jtag_get_reset_config();
1093 if (target
->reset_halt
&& (jtag_reset_config
& RESET_SRST_PULLS_TRST
) != 0)
1095 LOG_WARNING("srst pulls trst - can not reset into halted mode. Issuing halt after reset.");
1096 if ((retval
= target_halt(target
)) != ERROR_OK
)
1105 * Clears the halt condition for an ARM7/9 target. If it isn't coming out of
1106 * reset and if DBGRQ is used, it is progammed to be deasserted. If the reset
1107 * vector catch was used, it is restored. Otherwise, the control value is
1108 * restored and the watchpoint unit is restored if it was in use.
1110 * @param target Pointer to the ARM7/9 target to have halt cleared
1111 * @return Always ERROR_OK
1113 static int arm7_9_clear_halt(struct target
*target
)
1115 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1116 struct reg
*dbg_ctrl
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_CTRL
];
1118 /* we used DBGRQ only if we didn't come out of reset */
1119 if (!arm7_9
->debug_entry_from_reset
&& arm7_9
->use_dbgrq
)
1121 /* program EmbeddedICE Debug Control Register to deassert DBGRQ
1123 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGRQ
, 1, 0);
1124 embeddedice_store_reg(dbg_ctrl
);
1128 if (arm7_9
->debug_entry_from_reset
&& arm7_9
->has_vector_catch
)
1130 /* if we came out of reset, and vector catch is supported, we used
1131 * vector catch to enter debug state
1132 * restore the register in that case
1134 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_VEC_CATCH
]);
1138 /* restore registers if watchpoint unit 0 was in use
1140 if (arm7_9
->wp0_used
)
1142 if (arm7_9
->debug_entry_from_reset
)
1144 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_VALUE
]);
1146 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
]);
1147 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
]);
1148 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
]);
1150 /* control value always has to be restored, as it was either disabled,
1151 * or enabled with possibly different bits
1153 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
]);
1161 * Issue a software reset and halt to an ARM7/9 target. The target is halted
1162 * and then there is a wait until the processor shows the halt. This wait can
1163 * timeout and results in an error being returned. The software reset involves
1164 * clearing the halt, updating the debug control register, changing to ARM mode,
1165 * reset of the program counter, and reset of all of the registers.
1167 * @param target Pointer to the ARM7/9 target to be reset and halted by software
1168 * @return Error status if any of the commands fail, otherwise ERROR_OK
1170 int arm7_9_soft_reset_halt(struct target
*target
)
1172 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1173 struct arm
*armv4_5
= &arm7_9
->armv4_5_common
;
1174 struct reg
*dbg_stat
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_STAT
];
1175 struct reg
*dbg_ctrl
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_CTRL
];
1179 /* FIX!!! replace some of this code with tcl commands
1181 * halt # the halt command is synchronous
1182 * armv4_5 core_state arm
1186 if ((retval
= target_halt(target
)) != ERROR_OK
)
1189 long long then
= timeval_ms();
1191 while (!(timeout
= ((timeval_ms()-then
) > 1000)))
1193 if (buf_get_u32(dbg_stat
->value
, EICE_DBG_STATUS_DBGACK
, 1) != 0)
1195 embeddedice_read_reg(dbg_stat
);
1196 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
1198 if (debug_level
>= 3)
1208 LOG_ERROR("Failed to halt CPU after 1 sec");
1209 return ERROR_TARGET_TIMEOUT
;
1211 target
->state
= TARGET_HALTED
;
1213 /* program EmbeddedICE Debug Control Register to assert DBGACK and INTDIS
1214 * ensure that DBGRQ is cleared
1216 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGACK
, 1, 1);
1217 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGRQ
, 1, 0);
1218 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_INTDIS
, 1, 1);
1219 embeddedice_store_reg(dbg_ctrl
);
1221 if ((retval
= arm7_9_clear_halt(target
)) != ERROR_OK
)
1226 /* if the target is in Thumb state, change to ARM state */
1227 if (buf_get_u32(dbg_stat
->value
, EICE_DBG_STATUS_ITBIT
, 1))
1229 uint32_t r0_thumb
, pc_thumb
;
1230 LOG_DEBUG("target entered debug from Thumb state, changing to ARM");
1231 /* Entered debug from Thumb mode */
1232 armv4_5
->core_state
= ARM_STATE_THUMB
;
1233 arm7_9
->change_to_arm(target
, &r0_thumb
, &pc_thumb
);
1236 /* REVISIT likewise for bit 5 -- switch Jazelle-to-ARM */
1238 /* all register content is now invalid */
1239 register_cache_invalidate(armv4_5
->core_cache
);
1241 /* SVC, ARM state, IRQ and FIQ disabled */
1244 cpsr
= buf_get_u32(armv4_5
->cpsr
->value
, 0, 32);
1247 arm_set_cpsr(armv4_5
, cpsr
);
1248 armv4_5
->cpsr
->dirty
= 1;
1250 /* start fetching from 0x0 */
1251 buf_set_u32(armv4_5
->pc
->value
, 0, 32, 0x0);
1252 armv4_5
->pc
->dirty
= 1;
1253 armv4_5
->pc
->valid
= 1;
1255 /* reset registers */
1256 for (i
= 0; i
<= 14; i
++)
1258 struct reg
*r
= arm_reg_current(armv4_5
, i
);
1260 buf_set_u32(r
->value
, 0, 32, 0xffffffff);
1265 if ((retval
= target_call_event_callbacks(target
, TARGET_EVENT_HALTED
)) != ERROR_OK
)
1274 * Halt an ARM7/9 target. This is accomplished by either asserting the DBGRQ
1275 * line or by programming a watchpoint to trigger on any address. It is
1276 * considered a bug to call this function while the target is in the
1277 * TARGET_RESET state.
1279 * @param target Pointer to the ARM7/9 target to be halted
1280 * @return Always ERROR_OK
1282 int arm7_9_halt(struct target
*target
)
1284 if (target
->state
== TARGET_RESET
)
1286 LOG_ERROR("BUG: arm7/9 does not support halt during reset. This is handled in arm7_9_assert_reset()");
1290 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1291 struct reg
*dbg_ctrl
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_CTRL
];
1293 LOG_DEBUG("target->state: %s",
1294 target_state_name(target
));
1296 if (target
->state
== TARGET_HALTED
)
1298 LOG_DEBUG("target was already halted");
1302 if (target
->state
== TARGET_UNKNOWN
)
1304 LOG_WARNING("target was in unknown state when halt was requested");
1307 if (arm7_9
->use_dbgrq
)
1309 /* program EmbeddedICE Debug Control Register to assert DBGRQ
1311 if (arm7_9
->set_special_dbgrq
) {
1312 arm7_9
->set_special_dbgrq(target
);
1314 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGRQ
, 1, 1);
1315 embeddedice_store_reg(dbg_ctrl
);
1320 /* program watchpoint unit to match on any address
1322 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
], 0xffffffff);
1323 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
], 0xffffffff);
1324 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], EICE_W_CTRL_ENABLE
);
1325 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
], ~EICE_W_CTRL_nOPC
& 0xff);
1328 target
->debug_reason
= DBG_REASON_DBGRQ
;
1334 * Handle an ARM7/9 target's entry into debug mode. The halt is cleared on the
1335 * ARM. The JTAG queue is then executed and the reason for debug entry is
1336 * examined. Once done, the target is verified to be halted and the processor
1337 * is forced into ARM mode. The core registers are saved for the current core
1338 * mode and the program counter (register 15) is updated as needed. The core
1339 * registers and CPSR and SPSR are saved for restoration later.
1341 * @param target Pointer to target that is entering debug mode
1342 * @return Error code if anything fails, otherwise ERROR_OK
1344 static int arm7_9_debug_entry(struct target
*target
)
1347 uint32_t context
[16];
1348 uint32_t* context_p
[16];
1349 uint32_t r0_thumb
, pc_thumb
;
1350 uint32_t cpsr
, cpsr_mask
= 0;
1352 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1353 struct arm
*armv4_5
= &arm7_9
->armv4_5_common
;
1354 struct reg
*dbg_stat
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_STAT
];
1355 struct reg
*dbg_ctrl
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_CTRL
];
1357 #ifdef _DEBUG_ARM7_9_
1361 /* program EmbeddedICE Debug Control Register to assert DBGACK and INTDIS
1362 * ensure that DBGRQ is cleared
1364 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGACK
, 1, 1);
1365 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGRQ
, 1, 0);
1366 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_INTDIS
, 1, 1);
1367 embeddedice_store_reg(dbg_ctrl
);
1369 if ((retval
= arm7_9_clear_halt(target
)) != ERROR_OK
)
1374 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
1379 if ((retval
= arm7_9
->examine_debug_reason(target
)) != ERROR_OK
)
1383 if (target
->state
!= TARGET_HALTED
)
1385 LOG_WARNING("target not halted");
1386 return ERROR_TARGET_NOT_HALTED
;
1389 /* if the target is in Thumb state, change to ARM state */
1390 if (buf_get_u32(dbg_stat
->value
, EICE_DBG_STATUS_ITBIT
, 1))
1392 LOG_DEBUG("target entered debug from Thumb state");
1393 /* Entered debug from Thumb mode */
1394 armv4_5
->core_state
= ARM_STATE_THUMB
;
1396 arm7_9
->change_to_arm(target
, &r0_thumb
, &pc_thumb
);
1397 LOG_DEBUG("r0_thumb: 0x%8.8" PRIx32
1398 ", pc_thumb: 0x%8.8" PRIx32
, r0_thumb
, pc_thumb
);
1399 } else if (buf_get_u32(dbg_stat
->value
, 5, 1)) {
1400 /* \todo Get some vaguely correct handling of Jazelle, if
1401 * anyone ever uses it and full info becomes available.
1402 * See ARM9EJS TRM B.7.1 for how to switch J->ARM; and
1403 * B.7.3 for the reverse. That'd be the bare minimum...
1405 LOG_DEBUG("target entered debug from Jazelle state");
1406 armv4_5
->core_state
= ARM_STATE_JAZELLE
;
1407 cpsr_mask
= 1 << 24;
1408 LOG_ERROR("Jazelle debug entry -- BROKEN!");
1410 LOG_DEBUG("target entered debug from ARM state");
1411 /* Entered debug from ARM mode */
1412 armv4_5
->core_state
= ARM_STATE_ARM
;
1415 for (i
= 0; i
< 16; i
++)
1416 context_p
[i
] = &context
[i
];
1417 /* save core registers (r0 - r15 of current core mode) */
1418 arm7_9
->read_core_regs(target
, 0xffff, context_p
);
1420 arm7_9
->read_xpsr(target
, &cpsr
, 0);
1422 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
1425 /* Sync our CPSR copy with J or T bits EICE reported, but
1426 * which we then erased by putting the core into ARM mode.
1428 arm_set_cpsr(armv4_5
, cpsr
| cpsr_mask
);
1430 if (!is_arm_mode(armv4_5
->core_mode
))
1432 target
->state
= TARGET_UNKNOWN
;
1433 LOG_ERROR("cpsr contains invalid mode value - communication failure");
1434 return ERROR_TARGET_FAILURE
;
1437 LOG_DEBUG("target entered debug state in %s mode",
1438 arm_mode_name(armv4_5
->core_mode
));
1440 if (armv4_5
->core_state
== ARM_STATE_THUMB
)
1442 LOG_DEBUG("thumb state, applying fixups");
1443 context
[0] = r0_thumb
;
1444 context
[15] = pc_thumb
;
1445 } else if (armv4_5
->core_state
== ARM_STATE_ARM
)
1447 /* adjust value stored by STM */
1448 context
[15] -= 3 * 4;
1451 if ((target
->debug_reason
!= DBG_REASON_DBGRQ
) || (!arm7_9
->use_dbgrq
))
1452 context
[15] -= 3 * ((armv4_5
->core_state
== ARM_STATE_ARM
) ? 4 : 2);
1454 context
[15] -= arm7_9
->dbgreq_adjust_pc
* ((armv4_5
->core_state
== ARM_STATE_ARM
) ? 4 : 2);
1456 for (i
= 0; i
<= 15; i
++)
1458 struct reg
*r
= arm_reg_current(armv4_5
, i
);
1460 LOG_DEBUG("r%i: 0x%8.8" PRIx32
"", i
, context
[i
]);
1462 buf_set_u32(r
->value
, 0, 32, context
[i
]);
1463 /* r0 and r15 (pc) have to be restored later */
1464 r
->dirty
= (i
== 0) || (i
== 15);
1468 LOG_DEBUG("entered debug state at PC 0x%" PRIx32
"", context
[15]);
1470 /* exceptions other than USR & SYS have a saved program status register */
1471 if (armv4_5
->spsr
) {
1473 arm7_9
->read_xpsr(target
, &spsr
, 1);
1474 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
1478 buf_set_u32(armv4_5
->spsr
->value
, 0, 32, spsr
);
1479 armv4_5
->spsr
->dirty
= 0;
1480 armv4_5
->spsr
->valid
= 1;
1483 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
1486 if (arm7_9
->post_debug_entry
)
1488 retval
= arm7_9
->post_debug_entry(target
);
1489 if (retval
!= ERROR_OK
)
1497 * Validate the full context for an ARM7/9 target in all processor modes. If
1498 * there are any invalid registers for the target, they will all be read. This
1501 * @param target Pointer to the ARM7/9 target to capture the full context from
1502 * @return Error if the target is not halted, has an invalid core mode, or if
1503 * the JTAG queue fails to execute
1505 static int arm7_9_full_context(struct target
*target
)
1509 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1510 struct arm
*armv4_5
= &arm7_9
->armv4_5_common
;
1514 if (target
->state
!= TARGET_HALTED
)
1516 LOG_WARNING("target not halted");
1517 return ERROR_TARGET_NOT_HALTED
;
1520 if (!is_arm_mode(armv4_5
->core_mode
))
1523 /* iterate through processor modes (User, FIQ, IRQ, SVC, ABT, UND)
1524 * SYS shares registers with User, so we don't touch SYS
1526 for (i
= 0; i
< 6; i
++)
1529 uint32_t* reg_p
[16];
1533 /* check if there are invalid registers in the current mode
1535 for (j
= 0; j
<= 16; j
++)
1537 if (ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5_number_to_mode(i
), j
).valid
== 0)
1545 /* change processor mode (and mask T bit) */
1546 tmp_cpsr
= buf_get_u32(armv4_5
->cpsr
->value
, 0, 8)
1548 tmp_cpsr
|= armv4_5_number_to_mode(i
);
1550 arm7_9
->write_xpsr_im8(target
, tmp_cpsr
& 0xff, 0, 0);
1552 for (j
= 0; j
< 15; j
++)
1554 if (ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5_number_to_mode(i
), j
).valid
== 0)
1556 reg_p
[j
] = (uint32_t*)ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5_number_to_mode(i
), j
).value
;
1558 ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5_number_to_mode(i
), j
).valid
= 1;
1559 ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5_number_to_mode(i
), j
).dirty
= 0;
1563 /* if only the PSR is invalid, mask is all zeroes */
1565 arm7_9
->read_core_regs(target
, mask
, reg_p
);
1567 /* check if the PSR has to be read */
1568 if (ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5_number_to_mode(i
), 16).valid
== 0)
1570 arm7_9
->read_xpsr(target
, (uint32_t*)ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5_number_to_mode(i
), 16).value
, 1);
1571 ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5_number_to_mode(i
), 16).valid
= 1;
1572 ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5_number_to_mode(i
), 16).dirty
= 0;
1577 /* restore processor mode (mask T bit) */
1578 arm7_9
->write_xpsr_im8(target
,
1579 buf_get_u32(armv4_5
->cpsr
->value
, 0, 8) & ~0x20,
1582 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
1590 * Restore the processor context on an ARM7/9 target. The full processor
1591 * context is analyzed to see if any of the registers are dirty on this end, but
1592 * have a valid new value. If this is the case, the processor is changed to the
1593 * appropriate mode and the new register values are written out to the
1594 * processor. If there happens to be a dirty register with an invalid value, an
1595 * error will be logged.
1597 * @param target Pointer to the ARM7/9 target to have its context restored
1598 * @return Error status if the target is not halted or the core mode in the
1599 * armv4_5 struct is invalid.
1601 static int arm7_9_restore_context(struct target
*target
)
1603 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1604 struct arm
*armv4_5
= &arm7_9
->armv4_5_common
;
1606 struct arm_reg
*reg_arch_info
;
1607 enum arm_mode current_mode
= armv4_5
->core_mode
;
1614 if (target
->state
!= TARGET_HALTED
)
1616 LOG_WARNING("target not halted");
1617 return ERROR_TARGET_NOT_HALTED
;
1620 if (arm7_9
->pre_restore_context
)
1621 arm7_9
->pre_restore_context(target
);
1623 if (!is_arm_mode(armv4_5
->core_mode
))
1626 /* iterate through processor modes (User, FIQ, IRQ, SVC, ABT, UND)
1627 * SYS shares registers with User, so we don't touch SYS
1629 for (i
= 0; i
< 6; i
++)
1631 LOG_DEBUG("examining %s mode",
1632 arm_mode_name(armv4_5
->core_mode
));
1635 /* check if there are dirty registers in the current mode
1637 for (j
= 0; j
<= 16; j
++)
1639 reg
= &ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5_number_to_mode(i
), j
);
1640 reg_arch_info
= reg
->arch_info
;
1641 if (reg
->dirty
== 1)
1643 if (reg
->valid
== 1)
1646 LOG_DEBUG("examining dirty reg: %s", reg
->name
);
1647 if ((reg_arch_info
->mode
!= ARM_MODE_ANY
)
1648 && (reg_arch_info
->mode
!= current_mode
)
1649 && !((reg_arch_info
->mode
== ARM_MODE_USR
) && (armv4_5
->core_mode
== ARM_MODE_SYS
))
1650 && !((reg_arch_info
->mode
== ARM_MODE_SYS
) && (armv4_5
->core_mode
== ARM_MODE_USR
)))
1653 LOG_DEBUG("require mode change");
1658 LOG_ERROR("BUG: dirty register '%s', but no valid data", reg
->name
);
1665 uint32_t mask
= 0x0;
1673 /* change processor mode (mask T bit) */
1674 tmp_cpsr
= buf_get_u32(armv4_5
->cpsr
->value
,
1676 tmp_cpsr
|= armv4_5_number_to_mode(i
);
1678 arm7_9
->write_xpsr_im8(target
, tmp_cpsr
& 0xff, 0, 0);
1679 current_mode
= armv4_5_number_to_mode(i
);
1682 for (j
= 0; j
<= 14; j
++)
1684 reg
= &ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5_number_to_mode(i
), j
);
1685 reg_arch_info
= reg
->arch_info
;
1688 if (reg
->dirty
== 1)
1690 regs
[j
] = buf_get_u32(reg
->value
, 0, 32);
1695 LOG_DEBUG("writing register %i mode %s "
1696 "with value 0x%8.8" PRIx32
, j
,
1697 arm_mode_name(armv4_5
->core_mode
),
1704 arm7_9
->write_core_regs(target
, mask
, regs
);
1707 reg
= &ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5_number_to_mode(i
), 16);
1708 reg_arch_info
= reg
->arch_info
;
1709 if ((reg
->dirty
) && (reg_arch_info
->mode
!= ARM_MODE_ANY
))
1711 LOG_DEBUG("writing SPSR of mode %i with value 0x%8.8" PRIx32
"", i
, buf_get_u32(reg
->value
, 0, 32));
1712 arm7_9
->write_xpsr(target
, buf_get_u32(reg
->value
, 0, 32), 1);
1717 if (!armv4_5
->cpsr
->dirty
&& (armv4_5
->core_mode
!= current_mode
))
1719 /* restore processor mode (mask T bit) */
1722 tmp_cpsr
= buf_get_u32(armv4_5
->cpsr
->value
, 0, 8) & 0xE0;
1723 tmp_cpsr
|= armv4_5_number_to_mode(i
);
1725 LOG_DEBUG("writing lower 8 bit of cpsr with value 0x%2.2x", (unsigned)(tmp_cpsr
));
1726 arm7_9
->write_xpsr_im8(target
, tmp_cpsr
& 0xff, 0, 0);
1728 else if (armv4_5
->cpsr
->dirty
)
1730 /* CPSR has been changed, full restore necessary (mask T bit) */
1731 LOG_DEBUG("writing cpsr with value 0x%8.8" PRIx32
,
1732 buf_get_u32(armv4_5
->cpsr
->value
, 0, 32));
1733 arm7_9
->write_xpsr(target
,
1734 buf_get_u32(armv4_5
->cpsr
->value
, 0, 32)
1736 armv4_5
->cpsr
->dirty
= 0;
1737 armv4_5
->cpsr
->valid
= 1;
1741 LOG_DEBUG("writing PC with value 0x%8.8" PRIx32
,
1742 buf_get_u32(armv4_5
->pc
->value
, 0, 32));
1743 arm7_9
->write_pc(target
, buf_get_u32(armv4_5
->pc
->value
, 0, 32));
1744 armv4_5
->pc
->dirty
= 0;
1750 * Restart the core of an ARM7/9 target. A RESTART command is sent to the
1751 * instruction register and the JTAG state is set to TAP_IDLE causing a core
1754 * @param target Pointer to the ARM7/9 target to be restarted
1755 * @return Result of executing the JTAG queue
1757 static int arm7_9_restart_core(struct target
*target
)
1759 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1760 struct arm_jtag
*jtag_info
= &arm7_9
->jtag_info
;
1763 /* set RESTART instruction */
1764 if (arm7_9
->need_bypass_before_restart
) {
1765 arm7_9
->need_bypass_before_restart
= 0;
1767 retval
= arm_jtag_set_instr(jtag_info
, 0xf, NULL
, TAP_IDLE
);
1768 if (retval
!= ERROR_OK
)
1771 retval
= arm_jtag_set_instr(jtag_info
, 0x4, NULL
, TAP_IDLE
);
1772 if (retval
!= ERROR_OK
)
1775 jtag_add_runtest(1, TAP_IDLE
);
1776 return jtag_execute_queue();
1780 * Enable the watchpoints on an ARM7/9 target. The target's watchpoints are
1781 * iterated through and are set on the target if they aren't already set.
1783 * @param target Pointer to the ARM7/9 target to enable watchpoints on
1785 static void arm7_9_enable_watchpoints(struct target
*target
)
1787 struct watchpoint
*watchpoint
= target
->watchpoints
;
1791 if (watchpoint
->set
== 0)
1792 arm7_9_set_watchpoint(target
, watchpoint
);
1793 watchpoint
= watchpoint
->next
;
1798 * Enable the breakpoints on an ARM7/9 target. The target's breakpoints are
1799 * iterated through and are set on the target.
1801 * @param target Pointer to the ARM7/9 target to enable breakpoints on
1803 static void arm7_9_enable_breakpoints(struct target
*target
)
1805 struct breakpoint
*breakpoint
= target
->breakpoints
;
1807 /* set any pending breakpoints */
1810 arm7_9_set_breakpoint(target
, breakpoint
);
1811 breakpoint
= breakpoint
->next
;
1815 int arm7_9_resume(struct target
*target
, int current
, uint32_t address
, int handle_breakpoints
, int debug_execution
)
1817 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1818 struct arm
*armv4_5
= &arm7_9
->armv4_5_common
;
1819 struct breakpoint
*breakpoint
= target
->breakpoints
;
1820 struct reg
*dbg_ctrl
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_CTRL
];
1821 int err
, retval
= ERROR_OK
;
1825 if (target
->state
!= TARGET_HALTED
)
1827 LOG_WARNING("target not halted");
1828 return ERROR_TARGET_NOT_HALTED
;
1831 if (!debug_execution
)
1833 target_free_all_working_areas(target
);
1836 /* current = 1: continue on current pc, otherwise continue at <address> */
1838 buf_set_u32(armv4_5
->pc
->value
, 0, 32, address
);
1840 uint32_t current_pc
;
1841 current_pc
= buf_get_u32(armv4_5
->pc
->value
, 0, 32);
1843 /* the front-end may request us not to handle breakpoints */
1844 if (handle_breakpoints
)
1846 breakpoint
= breakpoint_find(target
,
1847 buf_get_u32(armv4_5
->pc
->value
, 0, 32));
1848 if (breakpoint
!= NULL
)
1850 LOG_DEBUG("unset breakpoint at 0x%8.8" PRIx32
" (id: %d)", breakpoint
->address
, breakpoint
->unique_id
);
1851 if ((retval
= arm7_9_unset_breakpoint(target
, breakpoint
)) != ERROR_OK
)
1856 /* calculate PC of next instruction */
1858 if ((retval
= arm_simulate_step(target
, &next_pc
)) != ERROR_OK
)
1860 uint32_t current_opcode
;
1861 target_read_u32(target
, current_pc
, ¤t_opcode
);
1862 LOG_ERROR("Couldn't calculate PC of next instruction, current opcode was 0x%8.8" PRIx32
"", current_opcode
);
1866 LOG_DEBUG("enable single-step");
1867 arm7_9
->enable_single_step(target
, next_pc
);
1869 target
->debug_reason
= DBG_REASON_SINGLESTEP
;
1871 if ((retval
= arm7_9_restore_context(target
)) != ERROR_OK
)
1876 if (armv4_5
->core_state
== ARM_STATE_ARM
)
1877 arm7_9
->branch_resume(target
);
1878 else if (armv4_5
->core_state
== ARM_STATE_THUMB
)
1880 arm7_9
->branch_resume_thumb(target
);
1884 LOG_ERROR("unhandled core state");
1888 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGACK
, 1, 0);
1889 embeddedice_write_reg(dbg_ctrl
, buf_get_u32(dbg_ctrl
->value
, 0, dbg_ctrl
->size
));
1890 err
= arm7_9_execute_sys_speed(target
);
1892 LOG_DEBUG("disable single-step");
1893 arm7_9
->disable_single_step(target
);
1895 if (err
!= ERROR_OK
)
1897 if ((retval
= arm7_9_set_breakpoint(target
, breakpoint
)) != ERROR_OK
)
1901 target
->state
= TARGET_UNKNOWN
;
1905 retval
= arm7_9_debug_entry(target
);
1906 if (retval
!= ERROR_OK
)
1908 LOG_DEBUG("new PC after step: 0x%8.8" PRIx32
,
1909 buf_get_u32(armv4_5
->pc
->value
, 0, 32));
1911 LOG_DEBUG("set breakpoint at 0x%8.8" PRIx32
"", breakpoint
->address
);
1912 if ((retval
= arm7_9_set_breakpoint(target
, breakpoint
)) != ERROR_OK
)
1919 /* enable any pending breakpoints and watchpoints */
1920 arm7_9_enable_breakpoints(target
);
1921 arm7_9_enable_watchpoints(target
);
1923 if ((retval
= arm7_9_restore_context(target
)) != ERROR_OK
)
1928 if (armv4_5
->core_state
== ARM_STATE_ARM
)
1930 arm7_9
->branch_resume(target
);
1932 else if (armv4_5
->core_state
== ARM_STATE_THUMB
)
1934 arm7_9
->branch_resume_thumb(target
);
1938 LOG_ERROR("unhandled core state");
1942 /* deassert DBGACK and INTDIS */
1943 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGACK
, 1, 0);
1944 /* INTDIS only when we really resume, not during debug execution */
1945 if (!debug_execution
)
1946 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_INTDIS
, 1, 0);
1947 embeddedice_write_reg(dbg_ctrl
, buf_get_u32(dbg_ctrl
->value
, 0, dbg_ctrl
->size
));
1949 if ((retval
= arm7_9_restart_core(target
)) != ERROR_OK
)
1954 target
->debug_reason
= DBG_REASON_NOTHALTED
;
1956 if (!debug_execution
)
1958 /* registers are now invalid */
1959 register_cache_invalidate(armv4_5
->core_cache
);
1960 target
->state
= TARGET_RUNNING
;
1961 if ((retval
= target_call_event_callbacks(target
, TARGET_EVENT_RESUMED
)) != ERROR_OK
)
1968 target
->state
= TARGET_DEBUG_RUNNING
;
1969 if ((retval
= target_call_event_callbacks(target
, TARGET_EVENT_DEBUG_RESUMED
)) != ERROR_OK
)
1975 LOG_DEBUG("target resumed");
1980 void arm7_9_enable_eice_step(struct target
*target
, uint32_t next_pc
)
1982 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1983 struct arm
*armv4_5
= &arm7_9
->armv4_5_common
;
1984 uint32_t current_pc
;
1985 current_pc
= buf_get_u32(armv4_5
->pc
->value
, 0, 32);
1987 if (next_pc
!= current_pc
)
1989 /* setup an inverse breakpoint on the current PC
1990 * - comparator 1 matches the current address
1991 * - rangeout from comparator 1 is connected to comparator 0 rangein
1992 * - comparator 0 matches any address, as long as rangein is low */
1993 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
], 0xffffffff);
1994 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
], 0xffffffff);
1995 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], EICE_W_CTRL_ENABLE
);
1996 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
], ~(EICE_W_CTRL_RANGE
| EICE_W_CTRL_nOPC
) & 0xff);
1997 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_VALUE
], current_pc
);
1998 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_MASK
], 0);
1999 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_DATA_MASK
], 0xffffffff);
2000 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
], 0x0);
2001 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_MASK
], ~EICE_W_CTRL_nOPC
& 0xff);
2005 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
], 0xffffffff);
2006 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
], 0xffffffff);
2007 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], 0x0);
2008 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
], 0xff);
2009 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_VALUE
], next_pc
);
2010 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_MASK
], 0);
2011 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_DATA_MASK
], 0xffffffff);
2012 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
], EICE_W_CTRL_ENABLE
);
2013 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_MASK
], ~EICE_W_CTRL_nOPC
& 0xff);
2017 void arm7_9_disable_eice_step(struct target
*target
)
2019 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2021 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
]);
2022 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
]);
2023 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
]);
2024 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
]);
2025 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_VALUE
]);
2026 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_MASK
]);
2027 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_DATA_MASK
]);
2028 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_MASK
]);
2029 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
]);
2032 int arm7_9_step(struct target
*target
, int current
, uint32_t address
, int handle_breakpoints
)
2034 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2035 struct arm
*armv4_5
= &arm7_9
->armv4_5_common
;
2036 struct breakpoint
*breakpoint
= NULL
;
2039 if (target
->state
!= TARGET_HALTED
)
2041 LOG_WARNING("target not halted");
2042 return ERROR_TARGET_NOT_HALTED
;
2045 /* current = 1: continue on current pc, otherwise continue at <address> */
2047 buf_set_u32(armv4_5
->pc
->value
, 0, 32, address
);
2049 uint32_t current_pc
= buf_get_u32(armv4_5
->pc
->value
, 0, 32);
2051 /* the front-end may request us not to handle breakpoints */
2052 if (handle_breakpoints
)
2053 breakpoint
= breakpoint_find(target
, current_pc
);
2054 if (breakpoint
!= NULL
) {
2055 retval
= arm7_9_unset_breakpoint(target
, breakpoint
);
2056 if (retval
!= ERROR_OK
)
2060 target
->debug_reason
= DBG_REASON_SINGLESTEP
;
2062 /* calculate PC of next instruction */
2064 if ((retval
= arm_simulate_step(target
, &next_pc
)) != ERROR_OK
)
2066 uint32_t current_opcode
;
2067 target_read_u32(target
, current_pc
, ¤t_opcode
);
2068 LOG_ERROR("Couldn't calculate PC of next instruction, current opcode was 0x%8.8" PRIx32
"", current_opcode
);
2072 if ((retval
= arm7_9_restore_context(target
)) != ERROR_OK
)
2077 arm7_9
->enable_single_step(target
, next_pc
);
2079 if (armv4_5
->core_state
== ARM_STATE_ARM
)
2081 arm7_9
->branch_resume(target
);
2083 else if (armv4_5
->core_state
== ARM_STATE_THUMB
)
2085 arm7_9
->branch_resume_thumb(target
);
2089 LOG_ERROR("unhandled core state");
2093 if ((retval
= target_call_event_callbacks(target
, TARGET_EVENT_RESUMED
)) != ERROR_OK
)
2098 err
= arm7_9_execute_sys_speed(target
);
2099 arm7_9
->disable_single_step(target
);
2101 /* registers are now invalid */
2102 register_cache_invalidate(armv4_5
->core_cache
);
2104 if (err
!= ERROR_OK
)
2106 target
->state
= TARGET_UNKNOWN
;
2108 retval
= arm7_9_debug_entry(target
);
2109 if (retval
!= ERROR_OK
)
2111 if ((retval
= target_call_event_callbacks(target
, TARGET_EVENT_HALTED
)) != ERROR_OK
)
2115 LOG_DEBUG("target stepped");
2119 if ((retval
= arm7_9_set_breakpoint(target
, breakpoint
)) != ERROR_OK
)
2127 static int arm7_9_read_core_reg(struct target
*target
, struct reg
*r
,
2128 int num
, enum arm_mode mode
)
2130 uint32_t* reg_p
[16];
2133 struct arm_reg
*areg
= r
->arch_info
;
2134 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2135 struct arm
*armv4_5
= &arm7_9
->armv4_5_common
;
2137 if (!is_arm_mode(armv4_5
->core_mode
))
2139 if ((num
< 0) || (num
> 16))
2140 return ERROR_INVALID_ARGUMENTS
;
2142 if ((mode
!= ARM_MODE_ANY
)
2143 && (mode
!= armv4_5
->core_mode
)
2144 && (areg
->mode
!= ARM_MODE_ANY
))
2148 /* change processor mode (mask T bit) */
2149 tmp_cpsr
= buf_get_u32(armv4_5
->cpsr
->value
, 0, 8) & 0xE0;
2152 arm7_9
->write_xpsr_im8(target
, tmp_cpsr
& 0xff, 0, 0);
2155 if ((num
>= 0) && (num
<= 15))
2157 /* read a normal core register */
2158 reg_p
[num
] = &value
;
2160 arm7_9
->read_core_regs(target
, 1 << num
, reg_p
);
2164 /* read a program status register
2165 * if the register mode is MODE_ANY, we read the cpsr, otherwise a spsr
2167 arm7_9
->read_xpsr(target
, &value
, areg
->mode
!= ARM_MODE_ANY
);
2170 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
2177 buf_set_u32(r
->value
, 0, 32, value
);
2179 if ((mode
!= ARM_MODE_ANY
)
2180 && (mode
!= armv4_5
->core_mode
)
2181 && (areg
->mode
!= ARM_MODE_ANY
)) {
2182 /* restore processor mode (mask T bit) */
2183 arm7_9
->write_xpsr_im8(target
,
2184 buf_get_u32(armv4_5
->cpsr
->value
, 0, 8)
2191 static int arm7_9_write_core_reg(struct target
*target
, struct reg
*r
,
2192 int num
, enum arm_mode mode
, uint32_t value
)
2195 struct arm_reg
*areg
= r
->arch_info
;
2196 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2197 struct arm
*armv4_5
= &arm7_9
->armv4_5_common
;
2199 if (!is_arm_mode(armv4_5
->core_mode
))
2201 if ((num
< 0) || (num
> 16))
2202 return ERROR_INVALID_ARGUMENTS
;
2204 if ((mode
!= ARM_MODE_ANY
)
2205 && (mode
!= armv4_5
->core_mode
)
2206 && (areg
->mode
!= ARM_MODE_ANY
)) {
2209 /* change processor mode (mask T bit) */
2210 tmp_cpsr
= buf_get_u32(armv4_5
->cpsr
->value
, 0, 8) & 0xE0;
2213 arm7_9
->write_xpsr_im8(target
, tmp_cpsr
& 0xff, 0, 0);
2216 if ((num
>= 0) && (num
<= 15))
2218 /* write a normal core register */
2221 arm7_9
->write_core_regs(target
, 1 << num
, reg
);
2225 /* write a program status register
2226 * if the register mode is MODE_ANY, we write the cpsr, otherwise a spsr
2228 int spsr
= (areg
->mode
!= ARM_MODE_ANY
);
2230 /* if we're writing the CPSR, mask the T bit */
2234 arm7_9
->write_xpsr(target
, value
, spsr
);
2240 if ((mode
!= ARM_MODE_ANY
)
2241 && (mode
!= armv4_5
->core_mode
)
2242 && (areg
->mode
!= ARM_MODE_ANY
)) {
2243 /* restore processor mode (mask T bit) */
2244 arm7_9
->write_xpsr_im8(target
,
2245 buf_get_u32(armv4_5
->cpsr
->value
, 0, 8)
2249 return jtag_execute_queue();
2252 int arm7_9_read_memory(struct target
*target
, uint32_t address
, uint32_t size
, uint32_t count
, uint8_t *buffer
)
2254 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2255 struct arm
*armv4_5
= &arm7_9
->armv4_5_common
;
2257 uint32_t num_accesses
= 0;
2258 int thisrun_accesses
;
2264 LOG_DEBUG("address: 0x%8.8" PRIx32
", size: 0x%8.8" PRIx32
", count: 0x%8.8" PRIx32
"", address
, size
, count
);
2266 if (target
->state
!= TARGET_HALTED
)
2268 LOG_WARNING("target not halted");
2269 return ERROR_TARGET_NOT_HALTED
;
2272 /* sanitize arguments */
2273 if (((size
!= 4) && (size
!= 2) && (size
!= 1)) || (count
== 0) || !(buffer
))
2274 return ERROR_INVALID_ARGUMENTS
;
2276 if (((size
== 4) && (address
& 0x3u
)) || ((size
== 2) && (address
& 0x1u
)))
2277 return ERROR_TARGET_UNALIGNED_ACCESS
;
2279 /* load the base register with the address of the first word */
2281 arm7_9
->write_core_regs(target
, 0x1, reg
);
2288 while (num_accesses
< count
)
2291 thisrun_accesses
= ((count
- num_accesses
) >= 14) ? 14 : (count
- num_accesses
);
2292 reg_list
= (0xffff >> (15 - thisrun_accesses
)) & 0xfffe;
2294 if (last_reg
<= thisrun_accesses
)
2295 last_reg
= thisrun_accesses
;
2297 arm7_9
->load_word_regs(target
, reg_list
);
2299 /* fast memory reads are only safe when the target is running
2300 * from a sufficiently high clock (32 kHz is usually too slow)
2302 if (arm7_9
->fast_memory_access
)
2303 retval
= arm7_9_execute_fast_sys_speed(target
);
2305 retval
= arm7_9_execute_sys_speed(target
);
2306 if (retval
!= ERROR_OK
)
2309 arm7_9
->read_core_regs_target_buffer(target
, reg_list
, buffer
, 4);
2311 /* advance buffer, count number of accesses */
2312 buffer
+= thisrun_accesses
* 4;
2313 num_accesses
+= thisrun_accesses
;
2315 if ((j
++%1024) == 0)
2322 while (num_accesses
< count
)
2325 thisrun_accesses
= ((count
- num_accesses
) >= 14) ? 14 : (count
- num_accesses
);
2326 reg_list
= (0xffff >> (15 - thisrun_accesses
)) & 0xfffe;
2328 for (i
= 1; i
<= thisrun_accesses
; i
++)
2332 arm7_9
->load_hword_reg(target
, i
);
2333 /* fast memory reads are only safe when the target is running
2334 * from a sufficiently high clock (32 kHz is usually too slow)
2336 if (arm7_9
->fast_memory_access
)
2337 retval
= arm7_9_execute_fast_sys_speed(target
);
2339 retval
= arm7_9_execute_sys_speed(target
);
2340 if (retval
!= ERROR_OK
)
2347 arm7_9
->read_core_regs_target_buffer(target
, reg_list
, buffer
, 2);
2349 /* advance buffer, count number of accesses */
2350 buffer
+= thisrun_accesses
* 2;
2351 num_accesses
+= thisrun_accesses
;
2353 if ((j
++%1024) == 0)
2360 while (num_accesses
< count
)
2363 thisrun_accesses
= ((count
- num_accesses
) >= 14) ? 14 : (count
- num_accesses
);
2364 reg_list
= (0xffff >> (15 - thisrun_accesses
)) & 0xfffe;
2366 for (i
= 1; i
<= thisrun_accesses
; i
++)
2370 arm7_9
->load_byte_reg(target
, i
);
2371 /* fast memory reads are only safe when the target is running
2372 * from a sufficiently high clock (32 kHz is usually too slow)
2374 if (arm7_9
->fast_memory_access
)
2375 retval
= arm7_9_execute_fast_sys_speed(target
);
2377 retval
= arm7_9_execute_sys_speed(target
);
2378 if (retval
!= ERROR_OK
)
2384 arm7_9
->read_core_regs_target_buffer(target
, reg_list
, buffer
, 1);
2386 /* advance buffer, count number of accesses */
2387 buffer
+= thisrun_accesses
* 1;
2388 num_accesses
+= thisrun_accesses
;
2390 if ((j
++%1024) == 0)
2398 if (!is_arm_mode(armv4_5
->core_mode
))
2401 for (i
= 0; i
<= last_reg
; i
++) {
2402 struct reg
*r
= arm_reg_current(armv4_5
, i
);
2404 r
->dirty
= r
->valid
;
2407 arm7_9
->read_xpsr(target
, &cpsr
, 0);
2408 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
2410 LOG_ERROR("JTAG error while reading cpsr");
2411 return ERROR_TARGET_DATA_ABORT
;
2414 if (((cpsr
& 0x1f) == ARM_MODE_ABT
) && (armv4_5
->core_mode
!= ARM_MODE_ABT
))
2416 LOG_WARNING("memory read caused data abort (address: 0x%8.8" PRIx32
", size: 0x%" PRIx32
", count: 0x%" PRIx32
")", address
, size
, count
);
2418 arm7_9
->write_xpsr_im8(target
,
2419 buf_get_u32(armv4_5
->cpsr
->value
, 0, 8)
2422 return ERROR_TARGET_DATA_ABORT
;
2428 int arm7_9_write_memory(struct target
*target
, uint32_t address
, uint32_t size
, uint32_t count
, uint8_t *buffer
)
2430 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2431 struct arm
*armv4_5
= &arm7_9
->armv4_5_common
;
2432 struct reg
*dbg_ctrl
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_CTRL
];
2435 uint32_t num_accesses
= 0;
2436 int thisrun_accesses
;
2442 #ifdef _DEBUG_ARM7_9_
2443 LOG_DEBUG("address: 0x%8.8x, size: 0x%8.8x, count: 0x%8.8x", address
, size
, count
);
2446 if (target
->state
!= TARGET_HALTED
)
2448 LOG_WARNING("target not halted");
2449 return ERROR_TARGET_NOT_HALTED
;
2452 /* sanitize arguments */
2453 if (((size
!= 4) && (size
!= 2) && (size
!= 1)) || (count
== 0) || !(buffer
))
2454 return ERROR_INVALID_ARGUMENTS
;
2456 if (((size
== 4) && (address
& 0x3u
)) || ((size
== 2) && (address
& 0x1u
)))
2457 return ERROR_TARGET_UNALIGNED_ACCESS
;
2459 /* load the base register with the address of the first word */
2461 arm7_9
->write_core_regs(target
, 0x1, reg
);
2463 /* Clear DBGACK, to make sure memory fetches work as expected */
2464 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGACK
, 1, 0);
2465 embeddedice_store_reg(dbg_ctrl
);
2470 while (num_accesses
< count
)
2473 thisrun_accesses
= ((count
- num_accesses
) >= 14) ? 14 : (count
- num_accesses
);
2474 reg_list
= (0xffff >> (15 - thisrun_accesses
)) & 0xfffe;
2476 for (i
= 1; i
<= thisrun_accesses
; i
++)
2480 reg
[i
] = target_buffer_get_u32(target
, buffer
);
2484 arm7_9
->write_core_regs(target
, reg_list
, reg
);
2486 arm7_9
->store_word_regs(target
, reg_list
);
2488 /* fast memory writes are only safe when the target is running
2489 * from a sufficiently high clock (32 kHz is usually too slow)
2491 if (arm7_9
->fast_memory_access
)
2492 retval
= arm7_9_execute_fast_sys_speed(target
);
2495 retval
= arm7_9_execute_sys_speed(target
);
2498 * if memory writes are made when the clock is running slow
2499 * (i.e. 32 kHz) which is necessary in some scripts to reconfigure
2500 * processor operations after a "reset halt" or "reset init",
2501 * need to immediately stroke the keep alive or will end up with
2502 * gdb "keep alive not sent error message" problem.
2508 if (retval
!= ERROR_OK
)
2513 num_accesses
+= thisrun_accesses
;
2517 while (num_accesses
< count
)
2520 thisrun_accesses
= ((count
- num_accesses
) >= 14) ? 14 : (count
- num_accesses
);
2521 reg_list
= (0xffff >> (15 - thisrun_accesses
)) & 0xfffe;
2523 for (i
= 1; i
<= thisrun_accesses
; i
++)
2527 reg
[i
] = target_buffer_get_u16(target
, buffer
) & 0xffff;
2531 arm7_9
->write_core_regs(target
, reg_list
, reg
);
2533 for (i
= 1; i
<= thisrun_accesses
; i
++)
2535 arm7_9
->store_hword_reg(target
, i
);
2537 /* fast memory writes are only safe when the target is running
2538 * from a sufficiently high clock (32 kHz is usually too slow)
2540 if (arm7_9
->fast_memory_access
)
2541 retval
= arm7_9_execute_fast_sys_speed(target
);
2544 retval
= arm7_9_execute_sys_speed(target
);
2547 * if memory writes are made when the clock is running slow
2548 * (i.e. 32 kHz) which is necessary in some scripts to reconfigure
2549 * processor operations after a "reset halt" or "reset init",
2550 * need to immediately stroke the keep alive or will end up with
2551 * gdb "keep alive not sent error message" problem.
2557 if (retval
!= ERROR_OK
)
2563 num_accesses
+= thisrun_accesses
;
2567 while (num_accesses
< count
)
2570 thisrun_accesses
= ((count
- num_accesses
) >= 14) ? 14 : (count
- num_accesses
);
2571 reg_list
= (0xffff >> (15 - thisrun_accesses
)) & 0xfffe;
2573 for (i
= 1; i
<= thisrun_accesses
; i
++)
2577 reg
[i
] = *buffer
++ & 0xff;
2580 arm7_9
->write_core_regs(target
, reg_list
, reg
);
2582 for (i
= 1; i
<= thisrun_accesses
; i
++)
2584 arm7_9
->store_byte_reg(target
, i
);
2585 /* fast memory writes are only safe when the target is running
2586 * from a sufficiently high clock (32 kHz is usually too slow)
2588 if (arm7_9
->fast_memory_access
)
2589 retval
= arm7_9_execute_fast_sys_speed(target
);
2592 retval
= arm7_9_execute_sys_speed(target
);
2595 * if memory writes are made when the clock is running slow
2596 * (i.e. 32 kHz) which is necessary in some scripts to reconfigure
2597 * processor operations after a "reset halt" or "reset init",
2598 * need to immediately stroke the keep alive or will end up with
2599 * gdb "keep alive not sent error message" problem.
2605 if (retval
!= ERROR_OK
)
2612 num_accesses
+= thisrun_accesses
;
2618 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGACK
, 1, 1);
2619 embeddedice_store_reg(dbg_ctrl
);
2621 if (!is_arm_mode(armv4_5
->core_mode
))
2624 for (i
= 0; i
<= last_reg
; i
++) {
2625 struct reg
*r
= arm_reg_current(armv4_5
, i
);
2627 r
->dirty
= r
->valid
;
2630 arm7_9
->read_xpsr(target
, &cpsr
, 0);
2631 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
2633 LOG_ERROR("JTAG error while reading cpsr");
2634 return ERROR_TARGET_DATA_ABORT
;
2637 if (((cpsr
& 0x1f) == ARM_MODE_ABT
) && (armv4_5
->core_mode
!= ARM_MODE_ABT
))
2639 LOG_WARNING("memory write caused data abort (address: 0x%8.8" PRIx32
", size: 0x%" PRIx32
", count: 0x%" PRIx32
")", address
, size
, count
);
2641 arm7_9
->write_xpsr_im8(target
,
2642 buf_get_u32(armv4_5
->cpsr
->value
, 0, 8)
2645 return ERROR_TARGET_DATA_ABORT
;
2651 static int dcc_count
;
2652 static uint8_t *dcc_buffer
;
2654 static int arm7_9_dcc_completion(struct target
*target
, uint32_t exit_point
, int timeout_ms
, void *arch_info
)
2656 int retval
= ERROR_OK
;
2657 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2659 if ((retval
= target_wait_state(target
, TARGET_DEBUG_RUNNING
, 500)) != ERROR_OK
)
2662 int little
= target
->endianness
== TARGET_LITTLE_ENDIAN
;
2663 int count
= dcc_count
;
2664 uint8_t *buffer
= dcc_buffer
;
2667 /* Handle first & last using standard embeddedice_write_reg and the middle ones w/the
2668 * core function repeated. */
2669 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_COMMS_DATA
], fast_target_buffer_get_u32(buffer
, little
));
2672 struct embeddedice_reg
*ice_reg
= arm7_9
->eice_cache
->reg_list
[EICE_COMMS_DATA
].arch_info
;
2673 uint8_t reg_addr
= ice_reg
->addr
& 0x1f;
2674 struct jtag_tap
*tap
;
2675 tap
= ice_reg
->jtag_info
->tap
;
2677 embeddedice_write_dcc(tap
, reg_addr
, buffer
, little
, count
-2);
2678 buffer
+= (count
-2)*4;
2680 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_COMMS_DATA
], fast_target_buffer_get_u32(buffer
, little
));
2684 for (i
= 0; i
< count
; i
++)
2686 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_COMMS_DATA
], fast_target_buffer_get_u32(buffer
, little
));
2691 if ((retval
= target_halt(target
))!= ERROR_OK
)
2695 return target_wait_state(target
, TARGET_HALTED
, 500);
2698 static const uint32_t dcc_code
[] =
2700 /* r0 == input, points to memory buffer
2704 /* spin until DCC control (c0) reports data arrived */
2705 0xee101e10, /* w: mrc p14, #0, r1, c0, c0 */
2706 0xe3110001, /* tst r1, #1 */
2707 0x0afffffc, /* bne w */
2709 /* read word from DCC (c1), write to memory */
2710 0xee111e10, /* mrc p14, #0, r1, c1, c0 */
2711 0xe4801004, /* str r1, [r0], #4 */
2714 0xeafffff9 /* b w */
2717 int arm7_9_bulk_write_memory(struct target
*target
, uint32_t address
, uint32_t count
, uint8_t *buffer
)
2720 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2723 if (!arm7_9
->dcc_downloads
)
2724 return target_write_memory(target
, address
, 4, count
, buffer
);
2726 /* regrab previously allocated working_area, or allocate a new one */
2727 if (!arm7_9
->dcc_working_area
)
2729 uint8_t dcc_code_buf
[6 * 4];
2731 /* make sure we have a working area */
2732 if (target_alloc_working_area(target
, 24, &arm7_9
->dcc_working_area
) != ERROR_OK
)
2734 LOG_INFO("no working area available, falling back to memory writes");
2735 return target_write_memory(target
, address
, 4, count
, buffer
);
2738 /* copy target instructions to target endianness */
2739 for (i
= 0; i
< 6; i
++)
2741 target_buffer_set_u32(target
, dcc_code_buf
+ i
*4, dcc_code
[i
]);
2744 /* write DCC code to working area */
2745 if ((retval
= target_write_memory(target
, arm7_9
->dcc_working_area
->address
, 4, 6, dcc_code_buf
)) != ERROR_OK
)
2751 struct arm_algorithm armv4_5_info
;
2752 struct reg_param reg_params
[1];
2754 armv4_5_info
.common_magic
= ARM_COMMON_MAGIC
;
2755 armv4_5_info
.core_mode
= ARM_MODE_SVC
;
2756 armv4_5_info
.core_state
= ARM_STATE_ARM
;
2758 init_reg_param(®_params
[0], "r0", 32, PARAM_IN_OUT
);
2760 buf_set_u32(reg_params
[0].value
, 0, 32, address
);
2763 dcc_buffer
= buffer
;
2764 retval
= armv4_5_run_algorithm_inner(target
, 0, NULL
, 1, reg_params
,
2765 arm7_9
->dcc_working_area
->address
,
2766 arm7_9
->dcc_working_area
->address
+ 6*4,
2767 20*1000, &armv4_5_info
, arm7_9_dcc_completion
);
2769 if (retval
== ERROR_OK
)
2771 uint32_t endaddress
= buf_get_u32(reg_params
[0].value
, 0, 32);
2772 if (endaddress
!= (address
+ count
*4))
2774 LOG_ERROR("DCC write failed, expected end address 0x%08" PRIx32
" got 0x%0" PRIx32
"", (address
+ count
*4), endaddress
);
2775 retval
= ERROR_FAIL
;
2779 destroy_reg_param(®_params
[0]);
2785 * Perform per-target setup that requires JTAG access.
2787 int arm7_9_examine(struct target
*target
)
2789 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2792 if (!target_was_examined(target
)) {
2793 struct reg_cache
*t
, **cache_p
;
2795 t
= embeddedice_build_reg_cache(target
, arm7_9
);
2799 cache_p
= register_get_last_cache_p(&target
->reg_cache
);
2801 arm7_9
->eice_cache
= (*cache_p
);
2803 if (arm7_9
->armv4_5_common
.etm
)
2804 (*cache_p
)->next
= etm_build_reg_cache(target
,
2806 arm7_9
->armv4_5_common
.etm
);
2808 target_set_examined(target
);
2811 retval
= embeddedice_setup(target
);
2812 if (retval
== ERROR_OK
)
2813 retval
= arm7_9_setup(target
);
2814 if (retval
== ERROR_OK
&& arm7_9
->armv4_5_common
.etm
)
2815 retval
= etm_setup(target
);
2820 int arm7_9_check_reset(struct target
*target
)
2822 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2824 if (get_target_reset_nag() && !arm7_9
->dcc_downloads
)
2826 LOG_WARNING("NOTE! DCC downloads have not been enabled, defaulting to slow memory writes. Type 'help dcc'.");
2829 if (get_target_reset_nag() && (target
->working_area_size
== 0))
2831 LOG_WARNING("NOTE! Severe performance degradation without working memory enabled.");
2834 if (get_target_reset_nag() && !arm7_9
->fast_memory_access
)
2836 LOG_WARNING("NOTE! Severe performance degradation without fast memory access enabled. Type 'help fast'.");
2842 COMMAND_HANDLER(handle_arm7_9_dbgrq_command
)
2844 struct target
*target
= get_current_target(CMD_CTX
);
2845 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2847 if (!is_arm7_9(arm7_9
))
2849 command_print(CMD_CTX
, "current target isn't an ARM7/ARM9 target");
2850 return ERROR_TARGET_INVALID
;
2854 COMMAND_PARSE_ENABLE(CMD_ARGV
[0],arm7_9
->use_dbgrq
);
2856 command_print(CMD_CTX
, "use of EmbeddedICE dbgrq instead of breakpoint for target halt %s", (arm7_9
->use_dbgrq
) ? "enabled" : "disabled");
2861 COMMAND_HANDLER(handle_arm7_9_fast_memory_access_command
)
2863 struct target
*target
= get_current_target(CMD_CTX
);
2864 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2866 if (!is_arm7_9(arm7_9
))
2868 command_print(CMD_CTX
, "current target isn't an ARM7/ARM9 target");
2869 return ERROR_TARGET_INVALID
;
2873 COMMAND_PARSE_ENABLE(CMD_ARGV
[0], arm7_9
->fast_memory_access
);
2875 command_print(CMD_CTX
, "fast memory access is %s", (arm7_9
->fast_memory_access
) ? "enabled" : "disabled");
2880 COMMAND_HANDLER(handle_arm7_9_dcc_downloads_command
)
2882 struct target
*target
= get_current_target(CMD_CTX
);
2883 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2885 if (!is_arm7_9(arm7_9
))
2887 command_print(CMD_CTX
, "current target isn't an ARM7/ARM9 target");
2888 return ERROR_TARGET_INVALID
;
2892 COMMAND_PARSE_ENABLE(CMD_ARGV
[0], arm7_9
->dcc_downloads
);
2894 command_print(CMD_CTX
, "dcc downloads are %s", (arm7_9
->dcc_downloads
) ? "enabled" : "disabled");
2899 static int arm7_9_setup_semihosting(struct target
*target
, int enable
)
2901 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2903 if (!is_arm7_9(arm7_9
))
2905 LOG_USER("current target isn't an ARM7/ARM9 target");
2906 return ERROR_TARGET_INVALID
;
2909 if (arm7_9
->has_vector_catch
) {
2910 struct reg
*vector_catch
= &arm7_9
->eice_cache
2911 ->reg_list
[EICE_VEC_CATCH
];
2913 if (!vector_catch
->valid
)
2914 embeddedice_read_reg(vector_catch
);
2915 buf_set_u32(vector_catch
->value
, 2, 1, enable
);
2916 embeddedice_store_reg(vector_catch
);
2918 /* TODO: allow optional high vectors and/or BKPT_HARD */
2920 breakpoint_add(target
, 8, 4, BKPT_SOFT
);
2922 breakpoint_remove(target
, 8);
2928 int arm7_9_init_arch_info(struct target
*target
, struct arm7_9_common
*arm7_9
)
2930 int retval
= ERROR_OK
;
2931 struct arm
*armv4_5
= &arm7_9
->armv4_5_common
;
2933 arm7_9
->common_magic
= ARM7_9_COMMON_MAGIC
;
2935 if ((retval
= arm_jtag_setup_connection(&arm7_9
->jtag_info
)) != ERROR_OK
)
2938 /* caller must have allocated via calloc(), so everything's zeroed */
2940 arm7_9
->wp_available_max
= 2;
2942 arm7_9
->fast_memory_access
= false;
2943 arm7_9
->dcc_downloads
= false;
2945 armv4_5
->arch_info
= arm7_9
;
2946 armv4_5
->read_core_reg
= arm7_9_read_core_reg
;
2947 armv4_5
->write_core_reg
= arm7_9_write_core_reg
;
2948 armv4_5
->full_context
= arm7_9_full_context
;
2949 armv4_5
->setup_semihosting
= arm7_9_setup_semihosting
;
2951 retval
= arm_init_arch_info(target
, armv4_5
);
2952 if (retval
!= ERROR_OK
)
2955 return target_register_timer_callback(arm7_9_handle_target_request
,
2959 static const struct command_registration arm7_9_any_command_handlers
[] = {
2962 .handler
= handle_arm7_9_dbgrq_command
,
2963 .mode
= COMMAND_ANY
,
2964 .usage
= "['enable'|'disable']",
2965 .help
= "use EmbeddedICE dbgrq instead of breakpoint "
2966 "for target halt requests",
2969 "fast_memory_access",
2970 .handler
= handle_arm7_9_fast_memory_access_command
,
2971 .mode
= COMMAND_ANY
,
2972 .usage
= "['enable'|'disable']",
2973 .help
= "use fast memory accesses instead of slower "
2974 "but potentially safer accesses",
2978 .handler
= handle_arm7_9_dcc_downloads_command
,
2979 .mode
= COMMAND_ANY
,
2980 .usage
= "['enable'|'disable']",
2981 .help
= "use DCC downloads for larger memory writes",
2983 COMMAND_REGISTRATION_DONE
2985 const struct command_registration arm7_9_command_handlers
[] = {
2987 .chain
= arm_command_handlers
,
2990 .chain
= etm_command_handlers
,
2994 .mode
= COMMAND_ANY
,
2995 .help
= "arm7/9 specific commands",
2996 .chain
= arm7_9_any_command_handlers
,
2998 COMMAND_REGISTRATION_DONE
Linking to existing account procedure
If you already have an account and want to add another login method
you
MUST first sign in with your existing account and
then change URL to read
https://review.openocd.org/login/?link
to get to this page again but this time it'll work for linking. Thank you.
SSH host keys fingerprints
1024 SHA256:YKx8b7u5ZWdcbp7/4AeXNaqElP49m6QrwfXaqQGJAOk gerrit-code-review@openocd.zylin.com (DSA)
384 SHA256:jHIbSQa4REvwCFG4cq5LBlBLxmxSqelQPem/EXIrxjk gerrit-code-review@openocd.org (ECDSA)
521 SHA256:UAOPYkU9Fjtcao0Ul/Rrlnj/OsQvt+pgdYSZ4jOYdgs gerrit-code-review@openocd.org (ECDSA)
256 SHA256:A13M5QlnozFOvTllybRZH6vm7iSt0XLxbA48yfc2yfY gerrit-code-review@openocd.org (ECDSA)
256 SHA256:spYMBqEYoAOtK7yZBrcwE8ZpYt6b68Cfh9yEVetvbXg gerrit-code-review@openocd.org (ED25519)
+--[ED25519 256]--+
|=.. |
|+o.. . |
|*.o . . |
|+B . . . |
|Bo. = o S |
|Oo.+ + = |
|oB=.* = . o |
| =+=.+ + E |
|. .=o . o |
+----[SHA256]-----+
2048 SHA256:0Onrb7/PHjpo6iVZ7xQX2riKN83FJ3KGU0TvI0TaFG4 gerrit-code-review@openocd.zylin.com (RSA)