1 /***************************************************************************
2 * Copyright (C) 2005 by Dominic Rath *
3 * Dominic.Rath@gmx.de *
5 * Copyright (C) 2007-2010 Øyvind Harboe *
6 * oyvind.harboe@zylin.com *
8 * Copyright (C) 2008 by Spencer Oliver *
9 * spen@spen-soft.co.uk *
11 * Copyright (C) 2008 by Hongtao Zheng *
14 * Copyright (C) 2009 by David Brownell *
16 * This program is free software; you can redistribute it and/or modify *
17 * it under the terms of the GNU General Public License as published by *
18 * the Free Software Foundation; either version 2 of the License, or *
19 * (at your option) any later version. *
21 * This program is distributed in the hope that it will be useful, *
22 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
23 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
24 * GNU General Public License for more details. *
26 * You should have received a copy of the GNU General Public License *
27 * along with this program; if not, write to the *
28 * Free Software Foundation, Inc., *
29 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
30 ***************************************************************************/
35 #include "breakpoints.h"
36 #include "embeddedice.h"
37 #include "target_request.h"
39 #include <helper/time_support.h>
40 #include "arm_simulator.h"
41 #include "arm_semihosting.h"
42 #include "algorithm.h"
49 * Hold common code supporting the ARM7 and ARM9 core generations.
51 * While the ARM core implementations evolved substantially during these
52 * two generations, they look quite similar from the JTAG perspective.
53 * Both have similar debug facilities, based on the same two scan chains
54 * providing access to the core and to an EmbeddedICE module. Both can
55 * support similar ETM and ETB modules, for tracing. And both expose
56 * what could be viewed as "ARM Classic", with multiple processor modes,
57 * shadowed registers, and support for the Thumb instruction set.
59 * Processor differences include things like presence or absence of MMU
60 * and cache, pipeline sizes, use of a modified Harvard Architecure
61 * (with separate instruction and data busses from the CPU), support
62 * for cpu clock gating during idle, and more.
65 static int arm7_9_debug_entry(struct target
*target
);
68 * Clear watchpoints for an ARM7/9 target.
70 * @param arm7_9 Pointer to the common struct for an ARM7/9 target
71 * @return JTAG error status after executing queue
73 static int arm7_9_clear_watchpoints(struct arm7_9_common
*arm7_9
)
76 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], 0x0);
77 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
], 0x0);
78 arm7_9
->sw_breakpoint_count
= 0;
79 arm7_9
->sw_breakpoints_added
= 0;
81 arm7_9
->wp1_used
= arm7_9
->wp1_used_default
;
82 arm7_9
->wp_available
= arm7_9
->wp_available_max
;
84 return jtag_execute_queue();
88 * Assign a watchpoint to one of the two available hardware comparators in an
89 * ARM7 or ARM9 target.
91 * @param arm7_9 Pointer to the common struct for an ARM7/9 target
92 * @param breakpoint Pointer to the breakpoint to be used as a watchpoint
94 static void arm7_9_assign_wp(struct arm7_9_common
*arm7_9
, struct breakpoint
*breakpoint
)
96 if (!arm7_9
->wp0_used
)
100 arm7_9
->wp_available
--;
102 else if (!arm7_9
->wp1_used
)
104 arm7_9
->wp1_used
= 1;
106 arm7_9
->wp_available
--;
110 LOG_ERROR("BUG: no hardware comparator available");
112 LOG_DEBUG("BPID: %d (0x%08" PRIx32
") using hw wp: %d",
113 breakpoint
->unique_id
,
119 * Setup an ARM7/9 target's embedded ICE registers for software breakpoints.
121 * @param arm7_9 Pointer to common struct for ARM7/9 targets
122 * @return Error codes if there is a problem finding a watchpoint or the result
123 * of executing the JTAG queue
125 static int arm7_9_set_software_breakpoints(struct arm7_9_common
*arm7_9
)
127 if (arm7_9
->sw_breakpoints_added
)
131 if (arm7_9
->wp_available
< 1)
133 LOG_WARNING("can't enable sw breakpoints with no watchpoint unit available");
134 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
136 arm7_9
->wp_available
--;
138 /* pick a breakpoint unit */
139 if (!arm7_9
->wp0_used
)
141 arm7_9
->sw_breakpoints_added
= 1;
142 arm7_9
->wp0_used
= 3;
143 } else if (!arm7_9
->wp1_used
)
145 arm7_9
->sw_breakpoints_added
= 2;
146 arm7_9
->wp1_used
= 3;
150 LOG_ERROR("BUG: both watchpoints used, but wp_available >= 1");
154 if (arm7_9
->sw_breakpoints_added
== 1)
156 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_VALUE
], arm7_9
->arm_bkpt
);
157 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
], 0x0);
158 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
], 0xffffffffu
);
159 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
], ~EICE_W_CTRL_nOPC
& 0xff);
160 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], EICE_W_CTRL_ENABLE
);
162 else if (arm7_9
->sw_breakpoints_added
== 2)
164 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_DATA_VALUE
], arm7_9
->arm_bkpt
);
165 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_DATA_MASK
], 0x0);
166 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_MASK
], 0xffffffffu
);
167 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_MASK
], ~EICE_W_CTRL_nOPC
& 0xff);
168 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
], EICE_W_CTRL_ENABLE
);
172 LOG_ERROR("BUG: both watchpoints used, but wp_available >= 1");
175 LOG_DEBUG("SW BP using hw wp: %d",
176 arm7_9
->sw_breakpoints_added
);
178 return jtag_execute_queue();
182 * Setup the common pieces for an ARM7/9 target after reset or on startup.
184 * @param target Pointer to an ARM7/9 target to setup
185 * @return Result of clearing the watchpoints on the target
187 static int arm7_9_setup(struct target
*target
)
189 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
191 return arm7_9_clear_watchpoints(arm7_9
);
195 * Set either a hardware or software breakpoint on an ARM7/9 target. The
196 * breakpoint is set up even if it is already set. Some actions, e.g. reset,
197 * might have erased the values in Embedded ICE.
199 * @param target Pointer to the target device to set the breakpoints on
200 * @param breakpoint Pointer to the breakpoint to be set
201 * @return For hardware breakpoints, this is the result of executing the JTAG
202 * queue. For software breakpoints, this will be the status of the
203 * required memory reads and writes
205 static int arm7_9_set_breakpoint(struct target
*target
, struct breakpoint
*breakpoint
)
207 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
208 int retval
= ERROR_OK
;
210 LOG_DEBUG("BPID: %d, Address: 0x%08" PRIx32
", Type: %d" ,
211 breakpoint
->unique_id
,
215 if (target
->state
!= TARGET_HALTED
)
217 LOG_WARNING("target not halted");
218 return ERROR_TARGET_NOT_HALTED
;
221 if (breakpoint
->type
== BKPT_HARD
)
223 /* either an ARM (4 byte) or Thumb (2 byte) breakpoint */
224 uint32_t mask
= (breakpoint
->length
== 4) ? 0x3u
: 0x1u
;
226 /* reassign a hw breakpoint */
227 if (breakpoint
->set
== 0)
229 arm7_9_assign_wp(arm7_9
, breakpoint
);
232 if (breakpoint
->set
== 1)
234 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_VALUE
], breakpoint
->address
);
235 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
], mask
);
236 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
], 0xffffffffu
);
237 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
], ~EICE_W_CTRL_nOPC
& 0xff);
238 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], EICE_W_CTRL_ENABLE
);
240 else if (breakpoint
->set
== 2)
242 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_VALUE
], breakpoint
->address
);
243 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_MASK
], mask
);
244 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_DATA_MASK
], 0xffffffffu
);
245 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_MASK
], ~EICE_W_CTRL_nOPC
& 0xff);
246 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
], EICE_W_CTRL_ENABLE
);
250 LOG_ERROR("BUG: no hardware comparator available");
254 retval
= jtag_execute_queue();
256 else if (breakpoint
->type
== BKPT_SOFT
)
258 /* did we already set this breakpoint? */
262 if (breakpoint
->length
== 4)
264 uint32_t verify
= 0xffffffff;
265 /* keep the original instruction in target endianness */
266 if ((retval
= target_read_memory(target
, breakpoint
->address
, 4, 1, breakpoint
->orig_instr
)) != ERROR_OK
)
270 /* write the breakpoint instruction in target endianness (arm7_9->arm_bkpt is host endian) */
271 if ((retval
= target_write_u32(target
, breakpoint
->address
, arm7_9
->arm_bkpt
)) != ERROR_OK
)
276 if ((retval
= target_read_u32(target
, breakpoint
->address
, &verify
)) != ERROR_OK
)
280 if (verify
!= arm7_9
->arm_bkpt
)
282 LOG_ERROR("Unable to set 32 bit software breakpoint at address %08" PRIx32
" - check that memory is read/writable", breakpoint
->address
);
288 uint16_t verify
= 0xffff;
289 /* keep the original instruction in target endianness */
290 if ((retval
= target_read_memory(target
, breakpoint
->address
, 2, 1, breakpoint
->orig_instr
)) != ERROR_OK
)
294 /* write the breakpoint instruction in target endianness (arm7_9->thumb_bkpt is host endian) */
295 if ((retval
= target_write_u16(target
, breakpoint
->address
, arm7_9
->thumb_bkpt
)) != ERROR_OK
)
300 if ((retval
= target_read_u16(target
, breakpoint
->address
, &verify
)) != ERROR_OK
)
304 if (verify
!= arm7_9
->thumb_bkpt
)
306 LOG_ERROR("Unable to set thumb software breakpoint at address %08" PRIx32
" - check that memory is read/writable", breakpoint
->address
);
311 if ((retval
= arm7_9_set_software_breakpoints(arm7_9
)) != ERROR_OK
)
314 arm7_9
->sw_breakpoint_count
++;
323 * Unsets an existing breakpoint on an ARM7/9 target. If it is a hardware
324 * breakpoint, the watchpoint used will be freed and the Embedded ICE registers
325 * will be updated. Otherwise, the software breakpoint will be restored to its
326 * original instruction if it hasn't already been modified.
328 * @param target Pointer to ARM7/9 target to unset the breakpoint from
329 * @param breakpoint Pointer to breakpoint to be unset
330 * @return For hardware breakpoints, this is the result of executing the JTAG
331 * queue. For software breakpoints, this will be the status of the
332 * required memory reads and writes
334 static int arm7_9_unset_breakpoint(struct target
*target
, struct breakpoint
*breakpoint
)
336 int retval
= ERROR_OK
;
337 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
339 LOG_DEBUG("BPID: %d, Address: 0x%08" PRIx32
,
340 breakpoint
->unique_id
,
341 breakpoint
->address
);
343 if (!breakpoint
->set
)
345 LOG_WARNING("breakpoint not set");
349 if (breakpoint
->type
== BKPT_HARD
)
351 LOG_DEBUG("BPID: %d Releasing hw wp: %d",
352 breakpoint
->unique_id
,
354 if (breakpoint
->set
== 1)
356 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], 0x0);
357 arm7_9
->wp0_used
= 0;
358 arm7_9
->wp_available
++;
360 else if (breakpoint
->set
== 2)
362 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
], 0x0);
363 arm7_9
->wp1_used
= 0;
364 arm7_9
->wp_available
++;
366 retval
= jtag_execute_queue();
371 /* restore original instruction (kept in target endianness) */
372 if (breakpoint
->length
== 4)
374 uint32_t current_instr
;
375 /* check that user program as not modified breakpoint instruction */
376 if ((retval
= target_read_memory(target
, breakpoint
->address
, 4, 1, (uint8_t*)¤t_instr
)) != ERROR_OK
)
380 current_instr
= target_buffer_get_u32(target
, (uint8_t *)¤t_instr
);
381 if (current_instr
== arm7_9
->arm_bkpt
)
382 if ((retval
= target_write_memory(target
, breakpoint
->address
, 4, 1, breakpoint
->orig_instr
)) != ERROR_OK
)
389 uint16_t current_instr
;
390 /* check that user program as not modified breakpoint instruction */
391 if ((retval
= target_read_memory(target
, breakpoint
->address
, 2, 1, (uint8_t*)¤t_instr
)) != ERROR_OK
)
395 current_instr
= target_buffer_get_u16(target
, (uint8_t *)¤t_instr
);
396 if (current_instr
== arm7_9
->thumb_bkpt
)
397 if ((retval
= target_write_memory(target
, breakpoint
->address
, 2, 1, breakpoint
->orig_instr
)) != ERROR_OK
)
403 if (--arm7_9
->sw_breakpoint_count
==0)
405 /* We have removed the last sw breakpoint, clear the hw breakpoint we used to implement it */
406 if (arm7_9
->sw_breakpoints_added
== 1)
408 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], 0);
410 else if (arm7_9
->sw_breakpoints_added
== 2)
412 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
], 0);
423 * Add a breakpoint to an ARM7/9 target. This makes sure that there are no
424 * dangling breakpoints and that the desired breakpoint can be added.
426 * @param target Pointer to the target ARM7/9 device to add a breakpoint to
427 * @param breakpoint Pointer to the breakpoint to be added
428 * @return An error status if there is a problem adding the breakpoint or the
429 * result of setting the breakpoint
431 int arm7_9_add_breakpoint(struct target
*target
, struct breakpoint
*breakpoint
)
433 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
435 if (arm7_9
->breakpoint_count
== 0)
437 /* make sure we don't have any dangling breakpoints. This is vital upon
438 * GDB connect/disconnect
440 arm7_9_clear_watchpoints(arm7_9
);
443 if ((breakpoint
->type
== BKPT_HARD
) && (arm7_9
->wp_available
< 1))
445 LOG_INFO("no watchpoint unit available for hardware breakpoint");
446 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
449 if ((breakpoint
->length
!= 2) && (breakpoint
->length
!= 4))
451 LOG_INFO("only breakpoints of two (Thumb) or four (ARM) bytes length supported");
452 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
455 if (breakpoint
->type
== BKPT_HARD
)
457 arm7_9_assign_wp(arm7_9
, breakpoint
);
460 arm7_9
->breakpoint_count
++;
462 return arm7_9_set_breakpoint(target
, breakpoint
);
466 * Removes a breakpoint from an ARM7/9 target. This will make sure there are no
467 * dangling breakpoints and updates available watchpoints if it is a hardware
470 * @param target Pointer to the target to have a breakpoint removed
471 * @param breakpoint Pointer to the breakpoint to be removed
472 * @return Error status if there was a problem unsetting the breakpoint or the
473 * watchpoints could not be cleared
475 int arm7_9_remove_breakpoint(struct target
*target
, struct breakpoint
*breakpoint
)
477 int retval
= ERROR_OK
;
478 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
480 if ((retval
= arm7_9_unset_breakpoint(target
, breakpoint
)) != ERROR_OK
)
485 if (breakpoint
->type
== BKPT_HARD
)
486 arm7_9
->wp_available
++;
488 arm7_9
->breakpoint_count
--;
489 if (arm7_9
->breakpoint_count
== 0)
491 /* make sure we don't have any dangling breakpoints */
492 if ((retval
= arm7_9_clear_watchpoints(arm7_9
)) != ERROR_OK
)
502 * Sets a watchpoint for an ARM7/9 target in one of the watchpoint units. It is
503 * considered a bug to call this function when there are no available watchpoint
506 * @param target Pointer to an ARM7/9 target to set a watchpoint on
507 * @param watchpoint Pointer to the watchpoint to be set
508 * @return Error status if watchpoint set fails or the result of executing the
511 static int arm7_9_set_watchpoint(struct target
*target
, struct watchpoint
*watchpoint
)
513 int retval
= ERROR_OK
;
514 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
518 mask
= watchpoint
->length
- 1;
520 if (target
->state
!= TARGET_HALTED
)
522 LOG_WARNING("target not halted");
523 return ERROR_TARGET_NOT_HALTED
;
526 if (watchpoint
->rw
== WPT_ACCESS
)
531 if (!arm7_9
->wp0_used
)
533 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_VALUE
], watchpoint
->address
);
534 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
], mask
);
535 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
], watchpoint
->mask
);
536 if (watchpoint
->mask
!= 0xffffffffu
)
537 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_VALUE
], watchpoint
->value
);
538 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
], 0xff & ~EICE_W_CTRL_nOPC
& ~rw_mask
);
539 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], EICE_W_CTRL_ENABLE
| EICE_W_CTRL_nOPC
| (watchpoint
->rw
& 1));
541 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
546 arm7_9
->wp0_used
= 2;
548 else if (!arm7_9
->wp1_used
)
550 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_VALUE
], watchpoint
->address
);
551 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_MASK
], mask
);
552 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_DATA_MASK
], watchpoint
->mask
);
553 if (watchpoint
->mask
!= 0xffffffffu
)
554 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_DATA_VALUE
], watchpoint
->value
);
555 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_MASK
], 0xff & ~EICE_W_CTRL_nOPC
& ~rw_mask
);
556 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
], EICE_W_CTRL_ENABLE
| EICE_W_CTRL_nOPC
| (watchpoint
->rw
& 1));
558 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
563 arm7_9
->wp1_used
= 2;
567 LOG_ERROR("BUG: no hardware comparator available");
575 * Unset an existing watchpoint and clear the used watchpoint unit.
577 * @param target Pointer to the target to have the watchpoint removed
578 * @param watchpoint Pointer to the watchpoint to be removed
579 * @return Error status while trying to unset the watchpoint or the result of
580 * executing the JTAG queue
582 static int arm7_9_unset_watchpoint(struct target
*target
, struct watchpoint
*watchpoint
)
584 int retval
= ERROR_OK
;
585 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
587 if (target
->state
!= TARGET_HALTED
)
589 LOG_WARNING("target not halted");
590 return ERROR_TARGET_NOT_HALTED
;
593 if (!watchpoint
->set
)
595 LOG_WARNING("breakpoint not set");
599 if (watchpoint
->set
== 1)
601 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], 0x0);
602 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
606 arm7_9
->wp0_used
= 0;
608 else if (watchpoint
->set
== 2)
610 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
], 0x0);
611 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
615 arm7_9
->wp1_used
= 0;
623 * Add a watchpoint to an ARM7/9 target. If there are no watchpoint units
624 * available, an error response is returned.
626 * @param target Pointer to the ARM7/9 target to add a watchpoint to
627 * @param watchpoint Pointer to the watchpoint to be added
628 * @return Error status while trying to add the watchpoint
630 int arm7_9_add_watchpoint(struct target
*target
, struct watchpoint
*watchpoint
)
632 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
634 if (arm7_9
->wp_available
< 1)
636 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
639 if ((watchpoint
->length
!= 1) && (watchpoint
->length
!= 2) && (watchpoint
->length
!= 4))
641 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
644 arm7_9
->wp_available
--;
650 * Remove a watchpoint from an ARM7/9 target. The watchpoint will be unset and
651 * the used watchpoint unit will be reopened.
653 * @param target Pointer to the target to remove a watchpoint from
654 * @param watchpoint Pointer to the watchpoint to be removed
655 * @return Result of trying to unset the watchpoint
657 int arm7_9_remove_watchpoint(struct target
*target
, struct watchpoint
*watchpoint
)
659 int retval
= ERROR_OK
;
660 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
664 if ((retval
= arm7_9_unset_watchpoint(target
, watchpoint
)) != ERROR_OK
)
670 arm7_9
->wp_available
++;
676 * Restarts the target by sending a RESTART instruction and moving the JTAG
677 * state to IDLE. This includes a timeout waiting for DBGACK and SYSCOMP to be
678 * asserted by the processor.
680 * @param target Pointer to target to issue commands to
681 * @return Error status if there is a timeout or a problem while executing the
684 int arm7_9_execute_sys_speed(struct target
*target
)
687 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
688 struct arm_jtag
*jtag_info
= &arm7_9
->jtag_info
;
689 struct reg
*dbg_stat
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_STAT
];
691 /* set RESTART instruction */
692 if (arm7_9
->need_bypass_before_restart
) {
693 arm7_9
->need_bypass_before_restart
= 0;
694 retval
= arm_jtag_set_instr(jtag_info
, 0xf, NULL
, TAP_IDLE
);
695 if (retval
!= ERROR_OK
)
698 retval
= arm_jtag_set_instr(jtag_info
, 0x4, NULL
, TAP_IDLE
);
699 if (retval
!= ERROR_OK
)
702 long long then
= timeval_ms();
704 while (!(timeout
= ((timeval_ms()-then
) > 1000)))
706 /* read debug status register */
707 embeddedice_read_reg(dbg_stat
);
708 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
710 if ((buf_get_u32(dbg_stat
->value
, EICE_DBG_STATUS_DBGACK
, 1))
711 && (buf_get_u32(dbg_stat
->value
, EICE_DBG_STATUS_SYSCOMP
, 1)))
713 if (debug_level
>= 3)
723 LOG_ERROR("timeout waiting for SYSCOMP & DBGACK, last DBG_STATUS: %" PRIx32
"", buf_get_u32(dbg_stat
->value
, 0, dbg_stat
->size
));
724 return ERROR_TARGET_TIMEOUT
;
731 * Restarts the target by sending a RESTART instruction and moving the JTAG
732 * state to IDLE. This validates that DBGACK and SYSCOMP are set without
733 * waiting until they are.
735 * @param target Pointer to the target to issue commands to
736 * @return Always ERROR_OK
738 static int arm7_9_execute_fast_sys_speed(struct target
*target
)
741 static uint8_t check_value
[4], check_mask
[4];
743 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
744 struct arm_jtag
*jtag_info
= &arm7_9
->jtag_info
;
745 struct reg
*dbg_stat
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_STAT
];
748 /* set RESTART instruction */
749 if (arm7_9
->need_bypass_before_restart
) {
750 arm7_9
->need_bypass_before_restart
= 0;
751 retval
= arm_jtag_set_instr(jtag_info
, 0xf, NULL
, TAP_IDLE
);
752 if (retval
!= ERROR_OK
)
755 retval
= arm_jtag_set_instr(jtag_info
, 0x4, NULL
, TAP_IDLE
);
756 if (retval
!= ERROR_OK
)
761 /* check for DBGACK and SYSCOMP set (others don't care) */
763 /* NB! These are constants that must be available until after next jtag_execute() and
764 * we evaluate the values upon first execution in lieu of setting up these constants
765 * during early setup.
767 buf_set_u32(check_value
, 0, 32, 0x9);
768 buf_set_u32(check_mask
, 0, 32, 0x9);
772 /* read debug status register */
773 embeddedice_read_reg_w_check(dbg_stat
, check_value
, check_mask
);
779 * Get some data from the ARM7/9 target.
781 * @param target Pointer to the ARM7/9 target to read data from
782 * @param size The number of 32bit words to be read
783 * @param buffer Pointer to the buffer that will hold the data
784 * @return The result of receiving data from the Embedded ICE unit
786 int arm7_9_target_request_data(struct target
*target
, uint32_t size
, uint8_t *buffer
)
788 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
789 struct arm_jtag
*jtag_info
= &arm7_9
->jtag_info
;
791 int retval
= ERROR_OK
;
794 data
= malloc(size
* (sizeof(uint32_t)));
796 retval
= embeddedice_receive(jtag_info
, data
, size
);
798 /* return the 32-bit ints in the 8-bit array */
799 for (i
= 0; i
< size
; i
++)
801 h_u32_to_le(buffer
+ (i
* 4), data
[i
]);
810 * Handles requests to an ARM7/9 target. If debug messaging is enabled, the
811 * target is running and the DCC control register has the W bit high, this will
812 * execute the request on the target.
814 * @param priv Void pointer expected to be a struct target pointer
815 * @return ERROR_OK unless there are issues with the JTAG queue or when reading
816 * from the Embedded ICE unit
818 static int arm7_9_handle_target_request(void *priv
)
820 int retval
= ERROR_OK
;
821 struct target
*target
= priv
;
822 if (!target_was_examined(target
))
824 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
825 struct arm_jtag
*jtag_info
= &arm7_9
->jtag_info
;
826 struct reg
*dcc_control
= &arm7_9
->eice_cache
->reg_list
[EICE_COMMS_CTRL
];
828 if (!target
->dbg_msg_enabled
)
831 if (target
->state
== TARGET_RUNNING
)
833 /* read DCC control register */
834 embeddedice_read_reg(dcc_control
);
835 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
841 if (buf_get_u32(dcc_control
->value
, 1, 1) == 1)
845 if ((retval
= embeddedice_receive(jtag_info
, &request
, 1)) != ERROR_OK
)
849 if ((retval
= target_request(target
, request
)) != ERROR_OK
)
860 * Polls an ARM7/9 target for its current status. If DBGACK is set, the target
861 * is manipulated to the right halted state based on its current state. This is
865 * <tr><th > State</th><th > Action</th></tr>
866 * <tr><td > TARGET_RUNNING | TARGET_RESET</td><td > Enters debug mode. If TARGET_RESET, pc may be checked</td></tr>
867 * <tr><td > TARGET_UNKNOWN</td><td > Warning is logged</td></tr>
868 * <tr><td > TARGET_DEBUG_RUNNING</td><td > Enters debug mode</td></tr>
869 * <tr><td > TARGET_HALTED</td><td > Nothing</td></tr>
872 * If the target does not end up in the halted state, a warning is produced. If
873 * DBGACK is cleared, then the target is expected to either be running or
876 * @param target Pointer to the ARM7/9 target to poll
877 * @return ERROR_OK or an error status if a command fails
879 int arm7_9_poll(struct target
*target
)
882 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
883 struct reg
*dbg_stat
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_STAT
];
885 /* read debug status register */
886 embeddedice_read_reg(dbg_stat
);
887 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
892 if (buf_get_u32(dbg_stat
->value
, EICE_DBG_STATUS_DBGACK
, 1))
894 /* LOG_DEBUG("DBGACK set, dbg_state->value: 0x%x", buf_get_u32(dbg_stat->value, 0, 32));*/
895 if (target
->state
== TARGET_UNKNOWN
)
897 /* Starting OpenOCD with target in debug-halt */
898 target
->state
= TARGET_RUNNING
;
899 LOG_DEBUG("DBGACK already set during server startup.");
901 if ((target
->state
== TARGET_RUNNING
) || (target
->state
== TARGET_RESET
))
903 target
->state
= TARGET_HALTED
;
905 if ((retval
= arm7_9_debug_entry(target
)) != ERROR_OK
)
908 if (arm_semihosting(target
, &retval
) != 0)
911 if ((retval
= target_call_event_callbacks(target
, TARGET_EVENT_HALTED
)) != ERROR_OK
)
916 if (target
->state
== TARGET_DEBUG_RUNNING
)
918 target
->state
= TARGET_HALTED
;
919 if ((retval
= arm7_9_debug_entry(target
)) != ERROR_OK
)
922 if ((retval
= target_call_event_callbacks(target
, TARGET_EVENT_DEBUG_HALTED
)) != ERROR_OK
)
927 if (target
->state
!= TARGET_HALTED
)
929 LOG_WARNING("DBGACK set, but the target did not end up in the halted state %d", target
->state
);
934 if (target
->state
!= TARGET_DEBUG_RUNNING
)
935 target
->state
= TARGET_RUNNING
;
942 * Asserts the reset (SRST) on an ARM7/9 target. Some -S targets (ARM966E-S in
943 * the STR912 isn't affected, ARM926EJ-S in the LPC3180 and AT91SAM9260 is
944 * affected) completely stop the JTAG clock while the core is held in reset
945 * (SRST). It isn't possible to program the halt condition once reset is
946 * asserted, hence a hook that allows the target to set up its reset-halt
947 * condition is setup prior to asserting reset.
949 * @param target Pointer to an ARM7/9 target to assert reset on
950 * @return ERROR_FAIL if the JTAG device does not have SRST, otherwise ERROR_OK
952 int arm7_9_assert_reset(struct target
*target
)
954 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
955 enum reset_types jtag_reset_config
= jtag_get_reset_config();
956 bool use_event
= false;
958 LOG_DEBUG("target->state: %s",
959 target_state_name(target
));
961 if (target_has_event_action(target
, TARGET_EVENT_RESET_ASSERT
))
963 else if (!(jtag_reset_config
& RESET_HAS_SRST
)) {
964 LOG_ERROR("%s: how to reset?", target_name(target
));
968 /* At this point trst has been asserted/deasserted once. We would
969 * like to program EmbeddedICE while SRST is asserted, instead of
970 * depending on SRST to leave that module alone. However, many CPUs
971 * gate the JTAG clock while SRST is asserted; or JTAG may need
972 * clock stability guarantees (adaptive clocking might help).
974 * So we assume JTAG access during SRST is off the menu unless it's
975 * been specifically enabled.
977 bool srst_asserted
= false;
980 && !(jtag_reset_config
& RESET_SRST_PULLS_TRST
)
981 && (jtag_reset_config
& RESET_SRST_NO_GATING
))
983 jtag_add_reset(0, 1);
984 srst_asserted
= true;
987 if (target
->reset_halt
)
990 * For targets that don't support communication while SRST is
991 * asserted, we need to set up the reset vector catch first.
993 * When we use TRST+SRST and that's equivalent to a power-up
994 * reset, these settings may well be reset anyway; so setting
995 * them here won't matter.
997 if (arm7_9
->has_vector_catch
)
999 /* program vector catch register to catch reset */
1000 embeddedice_write_reg(&arm7_9
->eice_cache
1001 ->reg_list
[EICE_VEC_CATCH
], 0x1);
1003 /* extra runtest added as issues were found with
1004 * certain ARM9 cores (maybe more) - AT91SAM9260
1007 jtag_add_runtest(1, TAP_IDLE
);
1011 /* program watchpoint unit to match on reset vector
1014 embeddedice_write_reg(&arm7_9
->eice_cache
1015 ->reg_list
[EICE_W0_ADDR_VALUE
], 0x0);
1016 embeddedice_write_reg(&arm7_9
->eice_cache
1017 ->reg_list
[EICE_W0_ADDR_MASK
], 0x3);
1018 embeddedice_write_reg(&arm7_9
->eice_cache
1019 ->reg_list
[EICE_W0_DATA_MASK
],
1021 embeddedice_write_reg(&arm7_9
->eice_cache
1022 ->reg_list
[EICE_W0_CONTROL_VALUE
],
1023 EICE_W_CTRL_ENABLE
);
1024 embeddedice_write_reg(&arm7_9
->eice_cache
1025 ->reg_list
[EICE_W0_CONTROL_MASK
],
1026 ~EICE_W_CTRL_nOPC
& 0xff);
1031 target_handle_event(target
, TARGET_EVENT_RESET_ASSERT
);
1033 /* If we use SRST ... we'd like to issue just SRST, but the
1034 * board or chip may be set up so we have to assert TRST as
1035 * well. On some chips that combination is equivalent to a
1036 * power-up reset, and generally clobbers EICE state.
1038 if (jtag_reset_config
& RESET_SRST_PULLS_TRST
)
1039 jtag_add_reset(1, 1);
1040 else if (!srst_asserted
)
1041 jtag_add_reset(0, 1);
1042 jtag_add_sleep(50000);
1045 target
->state
= TARGET_RESET
;
1046 register_cache_invalidate(arm7_9
->armv4_5_common
.core_cache
);
1048 /* REVISIT why isn't standard debug entry logic sufficient?? */
1049 if (target
->reset_halt
1050 && (!(jtag_reset_config
& RESET_SRST_PULLS_TRST
)
1053 /* debug entry was prepared above */
1054 target
->debug_reason
= DBG_REASON_DBGRQ
;
1061 * Deassert the reset (SRST) signal on an ARM7/9 target. If SRST pulls TRST
1062 * and the target is being reset into a halt, a warning will be triggered
1063 * because it is not possible to reset into a halted mode in this case. The
1064 * target is halted using the target's functions.
1066 * @param target Pointer to the target to have the reset deasserted
1067 * @return ERROR_OK or an error from polling or halting the target
1069 int arm7_9_deassert_reset(struct target
*target
)
1071 int retval
= ERROR_OK
;
1072 LOG_DEBUG("target->state: %s",
1073 target_state_name(target
));
1075 /* deassert reset lines */
1076 jtag_add_reset(0, 0);
1078 /* In case polling is disabled, we need to examine the
1079 * target and poll here for this target to work correctly.
1081 * Otherwise, e.g. halt will fail afterwards with bogus
1082 * error messages as halt will believe that reset is
1085 if ((retval
= target_examine_one(target
)) != ERROR_OK
)
1088 if ((retval
= target_poll(target
)) != ERROR_OK
)
1093 enum reset_types jtag_reset_config
= jtag_get_reset_config();
1094 if (target
->reset_halt
&& (jtag_reset_config
& RESET_SRST_PULLS_TRST
) != 0)
1096 LOG_WARNING("srst pulls trst - can not reset into halted mode. Issuing halt after reset.");
1097 if ((retval
= target_halt(target
)) != ERROR_OK
)
1106 * Clears the halt condition for an ARM7/9 target. If it isn't coming out of
1107 * reset and if DBGRQ is used, it is progammed to be deasserted. If the reset
1108 * vector catch was used, it is restored. Otherwise, the control value is
1109 * restored and the watchpoint unit is restored if it was in use.
1111 * @param target Pointer to the ARM7/9 target to have halt cleared
1112 * @return Always ERROR_OK
1114 static int arm7_9_clear_halt(struct target
*target
)
1116 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1117 struct reg
*dbg_ctrl
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_CTRL
];
1119 /* we used DBGRQ only if we didn't come out of reset */
1120 if (!arm7_9
->debug_entry_from_reset
&& arm7_9
->use_dbgrq
)
1122 /* program EmbeddedICE Debug Control Register to deassert DBGRQ
1124 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGRQ
, 1, 0);
1125 embeddedice_store_reg(dbg_ctrl
);
1129 if (arm7_9
->debug_entry_from_reset
&& arm7_9
->has_vector_catch
)
1131 /* if we came out of reset, and vector catch is supported, we used
1132 * vector catch to enter debug state
1133 * restore the register in that case
1135 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_VEC_CATCH
]);
1139 /* restore registers if watchpoint unit 0 was in use
1141 if (arm7_9
->wp0_used
)
1143 if (arm7_9
->debug_entry_from_reset
)
1145 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_VALUE
]);
1147 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
]);
1148 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
]);
1149 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
]);
1151 /* control value always has to be restored, as it was either disabled,
1152 * or enabled with possibly different bits
1154 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
]);
1162 * Issue a software reset and halt to an ARM7/9 target. The target is halted
1163 * and then there is a wait until the processor shows the halt. This wait can
1164 * timeout and results in an error being returned. The software reset involves
1165 * clearing the halt, updating the debug control register, changing to ARM mode,
1166 * reset of the program counter, and reset of all of the registers.
1168 * @param target Pointer to the ARM7/9 target to be reset and halted by software
1169 * @return Error status if any of the commands fail, otherwise ERROR_OK
1171 int arm7_9_soft_reset_halt(struct target
*target
)
1173 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1174 struct arm
*armv4_5
= &arm7_9
->armv4_5_common
;
1175 struct reg
*dbg_stat
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_STAT
];
1176 struct reg
*dbg_ctrl
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_CTRL
];
1180 /* FIX!!! replace some of this code with tcl commands
1182 * halt # the halt command is synchronous
1183 * armv4_5 core_state arm
1187 if ((retval
= target_halt(target
)) != ERROR_OK
)
1190 long long then
= timeval_ms();
1192 while (!(timeout
= ((timeval_ms()-then
) > 1000)))
1194 if (buf_get_u32(dbg_stat
->value
, EICE_DBG_STATUS_DBGACK
, 1) != 0)
1196 embeddedice_read_reg(dbg_stat
);
1197 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
1199 if (debug_level
>= 3)
1209 LOG_ERROR("Failed to halt CPU after 1 sec");
1210 return ERROR_TARGET_TIMEOUT
;
1212 target
->state
= TARGET_HALTED
;
1214 /* program EmbeddedICE Debug Control Register to assert DBGACK and INTDIS
1215 * ensure that DBGRQ is cleared
1217 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGACK
, 1, 1);
1218 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGRQ
, 1, 0);
1219 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_INTDIS
, 1, 1);
1220 embeddedice_store_reg(dbg_ctrl
);
1222 if ((retval
= arm7_9_clear_halt(target
)) != ERROR_OK
)
1227 /* if the target is in Thumb state, change to ARM state */
1228 if (buf_get_u32(dbg_stat
->value
, EICE_DBG_STATUS_ITBIT
, 1))
1230 uint32_t r0_thumb
, pc_thumb
;
1231 LOG_DEBUG("target entered debug from Thumb state, changing to ARM");
1232 /* Entered debug from Thumb mode */
1233 armv4_5
->core_state
= ARM_STATE_THUMB
;
1234 arm7_9
->change_to_arm(target
, &r0_thumb
, &pc_thumb
);
1237 /* REVISIT likewise for bit 5 -- switch Jazelle-to-ARM */
1239 /* all register content is now invalid */
1240 register_cache_invalidate(armv4_5
->core_cache
);
1242 /* SVC, ARM state, IRQ and FIQ disabled */
1245 cpsr
= buf_get_u32(armv4_5
->cpsr
->value
, 0, 32);
1248 arm_set_cpsr(armv4_5
, cpsr
);
1249 armv4_5
->cpsr
->dirty
= 1;
1251 /* start fetching from 0x0 */
1252 buf_set_u32(armv4_5
->pc
->value
, 0, 32, 0x0);
1253 armv4_5
->pc
->dirty
= 1;
1254 armv4_5
->pc
->valid
= 1;
1256 /* reset registers */
1257 for (i
= 0; i
<= 14; i
++)
1259 struct reg
*r
= arm_reg_current(armv4_5
, i
);
1261 buf_set_u32(r
->value
, 0, 32, 0xffffffff);
1266 if ((retval
= target_call_event_callbacks(target
, TARGET_EVENT_HALTED
)) != ERROR_OK
)
1275 * Halt an ARM7/9 target. This is accomplished by either asserting the DBGRQ
1276 * line or by programming a watchpoint to trigger on any address. It is
1277 * considered a bug to call this function while the target is in the
1278 * TARGET_RESET state.
1280 * @param target Pointer to the ARM7/9 target to be halted
1281 * @return Always ERROR_OK
1283 int arm7_9_halt(struct target
*target
)
1285 if (target
->state
== TARGET_RESET
)
1287 LOG_ERROR("BUG: arm7/9 does not support halt during reset. This is handled in arm7_9_assert_reset()");
1291 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1292 struct reg
*dbg_ctrl
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_CTRL
];
1294 LOG_DEBUG("target->state: %s",
1295 target_state_name(target
));
1297 if (target
->state
== TARGET_HALTED
)
1299 LOG_DEBUG("target was already halted");
1303 if (target
->state
== TARGET_UNKNOWN
)
1305 LOG_WARNING("target was in unknown state when halt was requested");
1308 if (arm7_9
->use_dbgrq
)
1310 /* program EmbeddedICE Debug Control Register to assert DBGRQ
1312 if (arm7_9
->set_special_dbgrq
) {
1313 arm7_9
->set_special_dbgrq(target
);
1315 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGRQ
, 1, 1);
1316 embeddedice_store_reg(dbg_ctrl
);
1321 /* program watchpoint unit to match on any address
1323 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
], 0xffffffff);
1324 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
], 0xffffffff);
1325 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], EICE_W_CTRL_ENABLE
);
1326 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
], ~EICE_W_CTRL_nOPC
& 0xff);
1329 target
->debug_reason
= DBG_REASON_DBGRQ
;
1335 * Handle an ARM7/9 target's entry into debug mode. The halt is cleared on the
1336 * ARM. The JTAG queue is then executed and the reason for debug entry is
1337 * examined. Once done, the target is verified to be halted and the processor
1338 * is forced into ARM mode. The core registers are saved for the current core
1339 * mode and the program counter (register 15) is updated as needed. The core
1340 * registers and CPSR and SPSR are saved for restoration later.
1342 * @param target Pointer to target that is entering debug mode
1343 * @return Error code if anything fails, otherwise ERROR_OK
1345 static int arm7_9_debug_entry(struct target
*target
)
1348 uint32_t context
[16];
1349 uint32_t* context_p
[16];
1350 uint32_t r0_thumb
, pc_thumb
;
1351 uint32_t cpsr
, cpsr_mask
= 0;
1353 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1354 struct arm
*armv4_5
= &arm7_9
->armv4_5_common
;
1355 struct reg
*dbg_stat
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_STAT
];
1356 struct reg
*dbg_ctrl
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_CTRL
];
1358 #ifdef _DEBUG_ARM7_9_
1362 /* program EmbeddedICE Debug Control Register to assert DBGACK and INTDIS
1363 * ensure that DBGRQ is cleared
1365 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGACK
, 1, 1);
1366 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGRQ
, 1, 0);
1367 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_INTDIS
, 1, 1);
1368 embeddedice_store_reg(dbg_ctrl
);
1370 if ((retval
= arm7_9_clear_halt(target
)) != ERROR_OK
)
1375 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
1380 if ((retval
= arm7_9
->examine_debug_reason(target
)) != ERROR_OK
)
1384 if (target
->state
!= TARGET_HALTED
)
1386 LOG_WARNING("target not halted");
1387 return ERROR_TARGET_NOT_HALTED
;
1390 /* if the target is in Thumb state, change to ARM state */
1391 if (buf_get_u32(dbg_stat
->value
, EICE_DBG_STATUS_ITBIT
, 1))
1393 LOG_DEBUG("target entered debug from Thumb state");
1394 /* Entered debug from Thumb mode */
1395 armv4_5
->core_state
= ARM_STATE_THUMB
;
1397 arm7_9
->change_to_arm(target
, &r0_thumb
, &pc_thumb
);
1398 LOG_DEBUG("r0_thumb: 0x%8.8" PRIx32
1399 ", pc_thumb: 0x%8.8" PRIx32
, r0_thumb
, pc_thumb
);
1400 } else if (buf_get_u32(dbg_stat
->value
, 5, 1)) {
1401 /* \todo Get some vaguely correct handling of Jazelle, if
1402 * anyone ever uses it and full info becomes available.
1403 * See ARM9EJS TRM B.7.1 for how to switch J->ARM; and
1404 * B.7.3 for the reverse. That'd be the bare minimum...
1406 LOG_DEBUG("target entered debug from Jazelle state");
1407 armv4_5
->core_state
= ARM_STATE_JAZELLE
;
1408 cpsr_mask
= 1 << 24;
1409 LOG_ERROR("Jazelle debug entry -- BROKEN!");
1411 LOG_DEBUG("target entered debug from ARM state");
1412 /* Entered debug from ARM mode */
1413 armv4_5
->core_state
= ARM_STATE_ARM
;
1416 for (i
= 0; i
< 16; i
++)
1417 context_p
[i
] = &context
[i
];
1418 /* save core registers (r0 - r15 of current core mode) */
1419 arm7_9
->read_core_regs(target
, 0xffff, context_p
);
1421 arm7_9
->read_xpsr(target
, &cpsr
, 0);
1423 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
1426 /* Sync our CPSR copy with J or T bits EICE reported, but
1427 * which we then erased by putting the core into ARM mode.
1429 arm_set_cpsr(armv4_5
, cpsr
| cpsr_mask
);
1431 if (!is_arm_mode(armv4_5
->core_mode
))
1433 target
->state
= TARGET_UNKNOWN
;
1434 LOG_ERROR("cpsr contains invalid mode value - communication failure");
1435 return ERROR_TARGET_FAILURE
;
1438 LOG_DEBUG("target entered debug state in %s mode",
1439 arm_mode_name(armv4_5
->core_mode
));
1441 if (armv4_5
->core_state
== ARM_STATE_THUMB
)
1443 LOG_DEBUG("thumb state, applying fixups");
1444 context
[0] = r0_thumb
;
1445 context
[15] = pc_thumb
;
1446 } else if (armv4_5
->core_state
== ARM_STATE_ARM
)
1448 /* adjust value stored by STM */
1449 context
[15] -= 3 * 4;
1452 if ((target
->debug_reason
!= DBG_REASON_DBGRQ
) || (!arm7_9
->use_dbgrq
))
1453 context
[15] -= 3 * ((armv4_5
->core_state
== ARM_STATE_ARM
) ? 4 : 2);
1455 context
[15] -= arm7_9
->dbgreq_adjust_pc
* ((armv4_5
->core_state
== ARM_STATE_ARM
) ? 4 : 2);
1457 for (i
= 0; i
<= 15; i
++)
1459 struct reg
*r
= arm_reg_current(armv4_5
, i
);
1461 LOG_DEBUG("r%i: 0x%8.8" PRIx32
"", i
, context
[i
]);
1463 buf_set_u32(r
->value
, 0, 32, context
[i
]);
1464 /* r0 and r15 (pc) have to be restored later */
1465 r
->dirty
= (i
== 0) || (i
== 15);
1469 LOG_DEBUG("entered debug state at PC 0x%" PRIx32
"", context
[15]);
1471 /* exceptions other than USR & SYS have a saved program status register */
1472 if (armv4_5
->spsr
) {
1474 arm7_9
->read_xpsr(target
, &spsr
, 1);
1475 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
1479 buf_set_u32(armv4_5
->spsr
->value
, 0, 32, spsr
);
1480 armv4_5
->spsr
->dirty
= 0;
1481 armv4_5
->spsr
->valid
= 1;
1484 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
1487 if (arm7_9
->post_debug_entry
)
1489 retval
= arm7_9
->post_debug_entry(target
);
1490 if (retval
!= ERROR_OK
)
1498 * Validate the full context for an ARM7/9 target in all processor modes. If
1499 * there are any invalid registers for the target, they will all be read. This
1502 * @param target Pointer to the ARM7/9 target to capture the full context from
1503 * @return Error if the target is not halted, has an invalid core mode, or if
1504 * the JTAG queue fails to execute
1506 static int arm7_9_full_context(struct target
*target
)
1510 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1511 struct arm
*armv4_5
= &arm7_9
->armv4_5_common
;
1515 if (target
->state
!= TARGET_HALTED
)
1517 LOG_WARNING("target not halted");
1518 return ERROR_TARGET_NOT_HALTED
;
1521 if (!is_arm_mode(armv4_5
->core_mode
))
1523 LOG_ERROR("not a valid arm core mode - communication failure?");
1527 /* iterate through processor modes (User, FIQ, IRQ, SVC, ABT, UND)
1528 * SYS shares registers with User, so we don't touch SYS
1530 for (i
= 0; i
< 6; i
++)
1533 uint32_t* reg_p
[16];
1537 /* check if there are invalid registers in the current mode
1539 for (j
= 0; j
<= 16; j
++)
1541 if (ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5_number_to_mode(i
), j
).valid
== 0)
1549 /* change processor mode (and mask T bit) */
1550 tmp_cpsr
= buf_get_u32(armv4_5
->cpsr
->value
, 0, 8)
1552 tmp_cpsr
|= armv4_5_number_to_mode(i
);
1554 arm7_9
->write_xpsr_im8(target
, tmp_cpsr
& 0xff, 0, 0);
1556 for (j
= 0; j
< 15; j
++)
1558 if (ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5_number_to_mode(i
), j
).valid
== 0)
1560 reg_p
[j
] = (uint32_t*)ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5_number_to_mode(i
), j
).value
;
1562 ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5_number_to_mode(i
), j
).valid
= 1;
1563 ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5_number_to_mode(i
), j
).dirty
= 0;
1567 /* if only the PSR is invalid, mask is all zeroes */
1569 arm7_9
->read_core_regs(target
, mask
, reg_p
);
1571 /* check if the PSR has to be read */
1572 if (ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5_number_to_mode(i
), 16).valid
== 0)
1574 arm7_9
->read_xpsr(target
, (uint32_t*)ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5_number_to_mode(i
), 16).value
, 1);
1575 ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5_number_to_mode(i
), 16).valid
= 1;
1576 ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5_number_to_mode(i
), 16).dirty
= 0;
1581 /* restore processor mode (mask T bit) */
1582 arm7_9
->write_xpsr_im8(target
,
1583 buf_get_u32(armv4_5
->cpsr
->value
, 0, 8) & ~0x20,
1586 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
1594 * Restore the processor context on an ARM7/9 target. The full processor
1595 * context is analyzed to see if any of the registers are dirty on this end, but
1596 * have a valid new value. If this is the case, the processor is changed to the
1597 * appropriate mode and the new register values are written out to the
1598 * processor. If there happens to be a dirty register with an invalid value, an
1599 * error will be logged.
1601 * @param target Pointer to the ARM7/9 target to have its context restored
1602 * @return Error status if the target is not halted or the core mode in the
1603 * armv4_5 struct is invalid.
1605 static int arm7_9_restore_context(struct target
*target
)
1607 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1608 struct arm
*armv4_5
= &arm7_9
->armv4_5_common
;
1610 struct arm_reg
*reg_arch_info
;
1611 enum arm_mode current_mode
= armv4_5
->core_mode
;
1618 if (target
->state
!= TARGET_HALTED
)
1620 LOG_WARNING("target not halted");
1621 return ERROR_TARGET_NOT_HALTED
;
1624 if (arm7_9
->pre_restore_context
)
1625 arm7_9
->pre_restore_context(target
);
1627 if (!is_arm_mode(armv4_5
->core_mode
))
1629 LOG_ERROR("not a valid arm core mode - communication failure?");
1633 /* iterate through processor modes (User, FIQ, IRQ, SVC, ABT, UND)
1634 * SYS shares registers with User, so we don't touch SYS
1636 for (i
= 0; i
< 6; i
++)
1638 LOG_DEBUG("examining %s mode",
1639 arm_mode_name(armv4_5
->core_mode
));
1642 /* check if there are dirty registers in the current mode
1644 for (j
= 0; j
<= 16; j
++)
1646 reg
= &ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5_number_to_mode(i
), j
);
1647 reg_arch_info
= reg
->arch_info
;
1648 if (reg
->dirty
== 1)
1650 if (reg
->valid
== 1)
1653 LOG_DEBUG("examining dirty reg: %s", reg
->name
);
1654 if ((reg_arch_info
->mode
!= ARM_MODE_ANY
)
1655 && (reg_arch_info
->mode
!= current_mode
)
1656 && !((reg_arch_info
->mode
== ARM_MODE_USR
) && (armv4_5
->core_mode
== ARM_MODE_SYS
))
1657 && !((reg_arch_info
->mode
== ARM_MODE_SYS
) && (armv4_5
->core_mode
== ARM_MODE_USR
)))
1660 LOG_DEBUG("require mode change");
1665 LOG_ERROR("BUG: dirty register '%s', but no valid data", reg
->name
);
1672 uint32_t mask
= 0x0;
1680 /* change processor mode (mask T bit) */
1681 tmp_cpsr
= buf_get_u32(armv4_5
->cpsr
->value
,
1683 tmp_cpsr
|= armv4_5_number_to_mode(i
);
1685 arm7_9
->write_xpsr_im8(target
, tmp_cpsr
& 0xff, 0, 0);
1686 current_mode
= armv4_5_number_to_mode(i
);
1689 for (j
= 0; j
<= 14; j
++)
1691 reg
= &ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5_number_to_mode(i
), j
);
1692 reg_arch_info
= reg
->arch_info
;
1695 if (reg
->dirty
== 1)
1697 regs
[j
] = buf_get_u32(reg
->value
, 0, 32);
1702 LOG_DEBUG("writing register %i mode %s "
1703 "with value 0x%8.8" PRIx32
, j
,
1704 arm_mode_name(armv4_5
->core_mode
),
1711 arm7_9
->write_core_regs(target
, mask
, regs
);
1714 reg
= &ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5_number_to_mode(i
), 16);
1715 reg_arch_info
= reg
->arch_info
;
1716 if ((reg
->dirty
) && (reg_arch_info
->mode
!= ARM_MODE_ANY
))
1718 LOG_DEBUG("writing SPSR of mode %i with value 0x%8.8" PRIx32
"", i
, buf_get_u32(reg
->value
, 0, 32));
1719 arm7_9
->write_xpsr(target
, buf_get_u32(reg
->value
, 0, 32), 1);
1724 if (!armv4_5
->cpsr
->dirty
&& (armv4_5
->core_mode
!= current_mode
))
1726 /* restore processor mode (mask T bit) */
1729 tmp_cpsr
= buf_get_u32(armv4_5
->cpsr
->value
, 0, 8) & 0xE0;
1730 tmp_cpsr
|= armv4_5_number_to_mode(i
);
1732 LOG_DEBUG("writing lower 8 bit of cpsr with value 0x%2.2x", (unsigned)(tmp_cpsr
));
1733 arm7_9
->write_xpsr_im8(target
, tmp_cpsr
& 0xff, 0, 0);
1735 else if (armv4_5
->cpsr
->dirty
)
1737 /* CPSR has been changed, full restore necessary (mask T bit) */
1738 LOG_DEBUG("writing cpsr with value 0x%8.8" PRIx32
,
1739 buf_get_u32(armv4_5
->cpsr
->value
, 0, 32));
1740 arm7_9
->write_xpsr(target
,
1741 buf_get_u32(armv4_5
->cpsr
->value
, 0, 32)
1743 armv4_5
->cpsr
->dirty
= 0;
1744 armv4_5
->cpsr
->valid
= 1;
1748 LOG_DEBUG("writing PC with value 0x%8.8" PRIx32
,
1749 buf_get_u32(armv4_5
->pc
->value
, 0, 32));
1750 arm7_9
->write_pc(target
, buf_get_u32(armv4_5
->pc
->value
, 0, 32));
1751 armv4_5
->pc
->dirty
= 0;
1757 * Restart the core of an ARM7/9 target. A RESTART command is sent to the
1758 * instruction register and the JTAG state is set to TAP_IDLE causing a core
1761 * @param target Pointer to the ARM7/9 target to be restarted
1762 * @return Result of executing the JTAG queue
1764 static int arm7_9_restart_core(struct target
*target
)
1766 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1767 struct arm_jtag
*jtag_info
= &arm7_9
->jtag_info
;
1770 /* set RESTART instruction */
1771 if (arm7_9
->need_bypass_before_restart
) {
1772 arm7_9
->need_bypass_before_restart
= 0;
1774 retval
= arm_jtag_set_instr(jtag_info
, 0xf, NULL
, TAP_IDLE
);
1775 if (retval
!= ERROR_OK
)
1778 retval
= arm_jtag_set_instr(jtag_info
, 0x4, NULL
, TAP_IDLE
);
1779 if (retval
!= ERROR_OK
)
1782 jtag_add_runtest(1, TAP_IDLE
);
1783 return jtag_execute_queue();
1787 * Enable the watchpoints on an ARM7/9 target. The target's watchpoints are
1788 * iterated through and are set on the target if they aren't already set.
1790 * @param target Pointer to the ARM7/9 target to enable watchpoints on
1792 static void arm7_9_enable_watchpoints(struct target
*target
)
1794 struct watchpoint
*watchpoint
= target
->watchpoints
;
1798 if (watchpoint
->set
== 0)
1799 arm7_9_set_watchpoint(target
, watchpoint
);
1800 watchpoint
= watchpoint
->next
;
1805 * Enable the breakpoints on an ARM7/9 target. The target's breakpoints are
1806 * iterated through and are set on the target.
1808 * @param target Pointer to the ARM7/9 target to enable breakpoints on
1810 static void arm7_9_enable_breakpoints(struct target
*target
)
1812 struct breakpoint
*breakpoint
= target
->breakpoints
;
1814 /* set any pending breakpoints */
1817 arm7_9_set_breakpoint(target
, breakpoint
);
1818 breakpoint
= breakpoint
->next
;
1822 int arm7_9_resume(struct target
*target
, int current
, uint32_t address
, int handle_breakpoints
, int debug_execution
)
1824 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1825 struct arm
*armv4_5
= &arm7_9
->armv4_5_common
;
1826 struct breakpoint
*breakpoint
= target
->breakpoints
;
1827 struct reg
*dbg_ctrl
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_CTRL
];
1828 int err
, retval
= ERROR_OK
;
1832 if (target
->state
!= TARGET_HALTED
)
1834 LOG_WARNING("target not halted");
1835 return ERROR_TARGET_NOT_HALTED
;
1838 if (!debug_execution
)
1840 target_free_all_working_areas(target
);
1843 /* current = 1: continue on current pc, otherwise continue at <address> */
1845 buf_set_u32(armv4_5
->pc
->value
, 0, 32, address
);
1847 uint32_t current_pc
;
1848 current_pc
= buf_get_u32(armv4_5
->pc
->value
, 0, 32);
1850 /* the front-end may request us not to handle breakpoints */
1851 if (handle_breakpoints
)
1853 breakpoint
= breakpoint_find(target
,
1854 buf_get_u32(armv4_5
->pc
->value
, 0, 32));
1855 if (breakpoint
!= NULL
)
1857 LOG_DEBUG("unset breakpoint at 0x%8.8" PRIx32
" (id: %d)", breakpoint
->address
, breakpoint
->unique_id
);
1858 if ((retval
= arm7_9_unset_breakpoint(target
, breakpoint
)) != ERROR_OK
)
1863 /* calculate PC of next instruction */
1865 if ((retval
= arm_simulate_step(target
, &next_pc
)) != ERROR_OK
)
1867 uint32_t current_opcode
;
1868 target_read_u32(target
, current_pc
, ¤t_opcode
);
1869 LOG_ERROR("Couldn't calculate PC of next instruction, current opcode was 0x%8.8" PRIx32
"", current_opcode
);
1873 LOG_DEBUG("enable single-step");
1874 arm7_9
->enable_single_step(target
, next_pc
);
1876 target
->debug_reason
= DBG_REASON_SINGLESTEP
;
1878 if ((retval
= arm7_9_restore_context(target
)) != ERROR_OK
)
1883 if (armv4_5
->core_state
== ARM_STATE_ARM
)
1884 arm7_9
->branch_resume(target
);
1885 else if (armv4_5
->core_state
== ARM_STATE_THUMB
)
1887 arm7_9
->branch_resume_thumb(target
);
1891 LOG_ERROR("unhandled core state");
1895 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGACK
, 1, 0);
1896 embeddedice_write_reg(dbg_ctrl
, buf_get_u32(dbg_ctrl
->value
, 0, dbg_ctrl
->size
));
1897 err
= arm7_9_execute_sys_speed(target
);
1899 LOG_DEBUG("disable single-step");
1900 arm7_9
->disable_single_step(target
);
1902 if (err
!= ERROR_OK
)
1904 if ((retval
= arm7_9_set_breakpoint(target
, breakpoint
)) != ERROR_OK
)
1908 target
->state
= TARGET_UNKNOWN
;
1912 retval
= arm7_9_debug_entry(target
);
1913 if (retval
!= ERROR_OK
)
1915 LOG_DEBUG("new PC after step: 0x%8.8" PRIx32
,
1916 buf_get_u32(armv4_5
->pc
->value
, 0, 32));
1918 LOG_DEBUG("set breakpoint at 0x%8.8" PRIx32
"", breakpoint
->address
);
1919 if ((retval
= arm7_9_set_breakpoint(target
, breakpoint
)) != ERROR_OK
)
1926 /* enable any pending breakpoints and watchpoints */
1927 arm7_9_enable_breakpoints(target
);
1928 arm7_9_enable_watchpoints(target
);
1930 if ((retval
= arm7_9_restore_context(target
)) != ERROR_OK
)
1935 if (armv4_5
->core_state
== ARM_STATE_ARM
)
1937 arm7_9
->branch_resume(target
);
1939 else if (armv4_5
->core_state
== ARM_STATE_THUMB
)
1941 arm7_9
->branch_resume_thumb(target
);
1945 LOG_ERROR("unhandled core state");
1949 /* deassert DBGACK and INTDIS */
1950 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGACK
, 1, 0);
1951 /* INTDIS only when we really resume, not during debug execution */
1952 if (!debug_execution
)
1953 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_INTDIS
, 1, 0);
1954 embeddedice_write_reg(dbg_ctrl
, buf_get_u32(dbg_ctrl
->value
, 0, dbg_ctrl
->size
));
1956 if ((retval
= arm7_9_restart_core(target
)) != ERROR_OK
)
1961 target
->debug_reason
= DBG_REASON_NOTHALTED
;
1963 if (!debug_execution
)
1965 /* registers are now invalid */
1966 register_cache_invalidate(armv4_5
->core_cache
);
1967 target
->state
= TARGET_RUNNING
;
1968 if ((retval
= target_call_event_callbacks(target
, TARGET_EVENT_RESUMED
)) != ERROR_OK
)
1975 target
->state
= TARGET_DEBUG_RUNNING
;
1976 if ((retval
= target_call_event_callbacks(target
, TARGET_EVENT_DEBUG_RESUMED
)) != ERROR_OK
)
1982 LOG_DEBUG("target resumed");
1987 void arm7_9_enable_eice_step(struct target
*target
, uint32_t next_pc
)
1989 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1990 struct arm
*armv4_5
= &arm7_9
->armv4_5_common
;
1991 uint32_t current_pc
;
1992 current_pc
= buf_get_u32(armv4_5
->pc
->value
, 0, 32);
1994 if (next_pc
!= current_pc
)
1996 /* setup an inverse breakpoint on the current PC
1997 * - comparator 1 matches the current address
1998 * - rangeout from comparator 1 is connected to comparator 0 rangein
1999 * - comparator 0 matches any address, as long as rangein is low */
2000 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
], 0xffffffff);
2001 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
], 0xffffffff);
2002 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], EICE_W_CTRL_ENABLE
);
2003 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
], ~(EICE_W_CTRL_RANGE
| EICE_W_CTRL_nOPC
) & 0xff);
2004 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_VALUE
], current_pc
);
2005 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_MASK
], 0);
2006 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_DATA_MASK
], 0xffffffff);
2007 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
], 0x0);
2008 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_MASK
], ~EICE_W_CTRL_nOPC
& 0xff);
2012 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
], 0xffffffff);
2013 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
], 0xffffffff);
2014 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], 0x0);
2015 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
], 0xff);
2016 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_VALUE
], next_pc
);
2017 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_MASK
], 0);
2018 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_DATA_MASK
], 0xffffffff);
2019 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
], EICE_W_CTRL_ENABLE
);
2020 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_MASK
], ~EICE_W_CTRL_nOPC
& 0xff);
2024 void arm7_9_disable_eice_step(struct target
*target
)
2026 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2028 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
]);
2029 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
]);
2030 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
]);
2031 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
]);
2032 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_VALUE
]);
2033 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_MASK
]);
2034 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_DATA_MASK
]);
2035 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_MASK
]);
2036 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
]);
2039 int arm7_9_step(struct target
*target
, int current
, uint32_t address
, int handle_breakpoints
)
2041 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2042 struct arm
*armv4_5
= &arm7_9
->armv4_5_common
;
2043 struct breakpoint
*breakpoint
= NULL
;
2046 if (target
->state
!= TARGET_HALTED
)
2048 LOG_WARNING("target not halted");
2049 return ERROR_TARGET_NOT_HALTED
;
2052 /* current = 1: continue on current pc, otherwise continue at <address> */
2054 buf_set_u32(armv4_5
->pc
->value
, 0, 32, address
);
2056 uint32_t current_pc
= buf_get_u32(armv4_5
->pc
->value
, 0, 32);
2058 /* the front-end may request us not to handle breakpoints */
2059 if (handle_breakpoints
)
2060 breakpoint
= breakpoint_find(target
, current_pc
);
2061 if (breakpoint
!= NULL
) {
2062 retval
= arm7_9_unset_breakpoint(target
, breakpoint
);
2063 if (retval
!= ERROR_OK
)
2067 target
->debug_reason
= DBG_REASON_SINGLESTEP
;
2069 /* calculate PC of next instruction */
2071 if ((retval
= arm_simulate_step(target
, &next_pc
)) != ERROR_OK
)
2073 uint32_t current_opcode
;
2074 target_read_u32(target
, current_pc
, ¤t_opcode
);
2075 LOG_ERROR("Couldn't calculate PC of next instruction, current opcode was 0x%8.8" PRIx32
"", current_opcode
);
2079 if ((retval
= arm7_9_restore_context(target
)) != ERROR_OK
)
2084 arm7_9
->enable_single_step(target
, next_pc
);
2086 if (armv4_5
->core_state
== ARM_STATE_ARM
)
2088 arm7_9
->branch_resume(target
);
2090 else if (armv4_5
->core_state
== ARM_STATE_THUMB
)
2092 arm7_9
->branch_resume_thumb(target
);
2096 LOG_ERROR("unhandled core state");
2100 if ((retval
= target_call_event_callbacks(target
, TARGET_EVENT_RESUMED
)) != ERROR_OK
)
2105 err
= arm7_9_execute_sys_speed(target
);
2106 arm7_9
->disable_single_step(target
);
2108 /* registers are now invalid */
2109 register_cache_invalidate(armv4_5
->core_cache
);
2111 if (err
!= ERROR_OK
)
2113 target
->state
= TARGET_UNKNOWN
;
2115 retval
= arm7_9_debug_entry(target
);
2116 if (retval
!= ERROR_OK
)
2118 if ((retval
= target_call_event_callbacks(target
, TARGET_EVENT_HALTED
)) != ERROR_OK
)
2122 LOG_DEBUG("target stepped");
2126 if ((retval
= arm7_9_set_breakpoint(target
, breakpoint
)) != ERROR_OK
)
2134 static int arm7_9_read_core_reg(struct target
*target
, struct reg
*r
,
2135 int num
, enum arm_mode mode
)
2137 uint32_t* reg_p
[16];
2140 struct arm_reg
*areg
= r
->arch_info
;
2141 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2142 struct arm
*armv4_5
= &arm7_9
->armv4_5_common
;
2144 if (!is_arm_mode(armv4_5
->core_mode
))
2146 if ((num
< 0) || (num
> 16))
2147 return ERROR_INVALID_ARGUMENTS
;
2149 if ((mode
!= ARM_MODE_ANY
)
2150 && (mode
!= armv4_5
->core_mode
)
2151 && (areg
->mode
!= ARM_MODE_ANY
))
2155 /* change processor mode (mask T bit) */
2156 tmp_cpsr
= buf_get_u32(armv4_5
->cpsr
->value
, 0, 8) & 0xE0;
2159 arm7_9
->write_xpsr_im8(target
, tmp_cpsr
& 0xff, 0, 0);
2162 if ((num
>= 0) && (num
<= 15))
2164 /* read a normal core register */
2165 reg_p
[num
] = &value
;
2167 arm7_9
->read_core_regs(target
, 1 << num
, reg_p
);
2171 /* read a program status register
2172 * if the register mode is MODE_ANY, we read the cpsr, otherwise a spsr
2174 arm7_9
->read_xpsr(target
, &value
, areg
->mode
!= ARM_MODE_ANY
);
2177 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
2184 buf_set_u32(r
->value
, 0, 32, value
);
2186 if ((mode
!= ARM_MODE_ANY
)
2187 && (mode
!= armv4_5
->core_mode
)
2188 && (areg
->mode
!= ARM_MODE_ANY
)) {
2189 /* restore processor mode (mask T bit) */
2190 arm7_9
->write_xpsr_im8(target
,
2191 buf_get_u32(armv4_5
->cpsr
->value
, 0, 8)
2198 static int arm7_9_write_core_reg(struct target
*target
, struct reg
*r
,
2199 int num
, enum arm_mode mode
, uint32_t value
)
2202 struct arm_reg
*areg
= r
->arch_info
;
2203 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2204 struct arm
*armv4_5
= &arm7_9
->armv4_5_common
;
2206 if (!is_arm_mode(armv4_5
->core_mode
))
2208 if ((num
< 0) || (num
> 16))
2209 return ERROR_INVALID_ARGUMENTS
;
2211 if ((mode
!= ARM_MODE_ANY
)
2212 && (mode
!= armv4_5
->core_mode
)
2213 && (areg
->mode
!= ARM_MODE_ANY
)) {
2216 /* change processor mode (mask T bit) */
2217 tmp_cpsr
= buf_get_u32(armv4_5
->cpsr
->value
, 0, 8) & 0xE0;
2220 arm7_9
->write_xpsr_im8(target
, tmp_cpsr
& 0xff, 0, 0);
2223 if ((num
>= 0) && (num
<= 15))
2225 /* write a normal core register */
2228 arm7_9
->write_core_regs(target
, 1 << num
, reg
);
2232 /* write a program status register
2233 * if the register mode is MODE_ANY, we write the cpsr, otherwise a spsr
2235 int spsr
= (areg
->mode
!= ARM_MODE_ANY
);
2237 /* if we're writing the CPSR, mask the T bit */
2241 arm7_9
->write_xpsr(target
, value
, spsr
);
2247 if ((mode
!= ARM_MODE_ANY
)
2248 && (mode
!= armv4_5
->core_mode
)
2249 && (areg
->mode
!= ARM_MODE_ANY
)) {
2250 /* restore processor mode (mask T bit) */
2251 arm7_9
->write_xpsr_im8(target
,
2252 buf_get_u32(armv4_5
->cpsr
->value
, 0, 8)
2256 return jtag_execute_queue();
2259 int arm7_9_read_memory(struct target
*target
, uint32_t address
, uint32_t size
, uint32_t count
, uint8_t *buffer
)
2261 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2262 struct arm
*armv4_5
= &arm7_9
->armv4_5_common
;
2264 uint32_t num_accesses
= 0;
2265 int thisrun_accesses
;
2271 LOG_DEBUG("address: 0x%8.8" PRIx32
", size: 0x%8.8" PRIx32
", count: 0x%8.8" PRIx32
"", address
, size
, count
);
2273 if (target
->state
!= TARGET_HALTED
)
2275 LOG_WARNING("target not halted");
2276 return ERROR_TARGET_NOT_HALTED
;
2279 /* sanitize arguments */
2280 if (((size
!= 4) && (size
!= 2) && (size
!= 1)) || (count
== 0) || !(buffer
))
2281 return ERROR_INVALID_ARGUMENTS
;
2283 if (((size
== 4) && (address
& 0x3u
)) || ((size
== 2) && (address
& 0x1u
)))
2284 return ERROR_TARGET_UNALIGNED_ACCESS
;
2286 /* load the base register with the address of the first word */
2288 arm7_9
->write_core_regs(target
, 0x1, reg
);
2295 while (num_accesses
< count
)
2298 thisrun_accesses
= ((count
- num_accesses
) >= 14) ? 14 : (count
- num_accesses
);
2299 reg_list
= (0xffff >> (15 - thisrun_accesses
)) & 0xfffe;
2301 if (last_reg
<= thisrun_accesses
)
2302 last_reg
= thisrun_accesses
;
2304 arm7_9
->load_word_regs(target
, reg_list
);
2306 /* fast memory reads are only safe when the target is running
2307 * from a sufficiently high clock (32 kHz is usually too slow)
2309 if (arm7_9
->fast_memory_access
)
2310 retval
= arm7_9_execute_fast_sys_speed(target
);
2312 retval
= arm7_9_execute_sys_speed(target
);
2313 if (retval
!= ERROR_OK
)
2316 arm7_9
->read_core_regs_target_buffer(target
, reg_list
, buffer
, 4);
2318 /* advance buffer, count number of accesses */
2319 buffer
+= thisrun_accesses
* 4;
2320 num_accesses
+= thisrun_accesses
;
2322 if ((j
++%1024) == 0)
2329 while (num_accesses
< count
)
2332 thisrun_accesses
= ((count
- num_accesses
) >= 14) ? 14 : (count
- num_accesses
);
2333 reg_list
= (0xffff >> (15 - thisrun_accesses
)) & 0xfffe;
2335 for (i
= 1; i
<= thisrun_accesses
; i
++)
2339 arm7_9
->load_hword_reg(target
, i
);
2340 /* fast memory reads are only safe when the target is running
2341 * from a sufficiently high clock (32 kHz is usually too slow)
2343 if (arm7_9
->fast_memory_access
)
2344 retval
= arm7_9_execute_fast_sys_speed(target
);
2346 retval
= arm7_9_execute_sys_speed(target
);
2347 if (retval
!= ERROR_OK
)
2354 arm7_9
->read_core_regs_target_buffer(target
, reg_list
, buffer
, 2);
2356 /* advance buffer, count number of accesses */
2357 buffer
+= thisrun_accesses
* 2;
2358 num_accesses
+= thisrun_accesses
;
2360 if ((j
++%1024) == 0)
2367 while (num_accesses
< count
)
2370 thisrun_accesses
= ((count
- num_accesses
) >= 14) ? 14 : (count
- num_accesses
);
2371 reg_list
= (0xffff >> (15 - thisrun_accesses
)) & 0xfffe;
2373 for (i
= 1; i
<= thisrun_accesses
; i
++)
2377 arm7_9
->load_byte_reg(target
, i
);
2378 /* fast memory reads are only safe when the target is running
2379 * from a sufficiently high clock (32 kHz is usually too slow)
2381 if (arm7_9
->fast_memory_access
)
2382 retval
= arm7_9_execute_fast_sys_speed(target
);
2384 retval
= arm7_9_execute_sys_speed(target
);
2385 if (retval
!= ERROR_OK
)
2391 arm7_9
->read_core_regs_target_buffer(target
, reg_list
, buffer
, 1);
2393 /* advance buffer, count number of accesses */
2394 buffer
+= thisrun_accesses
* 1;
2395 num_accesses
+= thisrun_accesses
;
2397 if ((j
++%1024) == 0)
2405 if (!is_arm_mode(armv4_5
->core_mode
))
2408 for (i
= 0; i
<= last_reg
; i
++) {
2409 struct reg
*r
= arm_reg_current(armv4_5
, i
);
2411 r
->dirty
= r
->valid
;
2414 arm7_9
->read_xpsr(target
, &cpsr
, 0);
2415 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
2417 LOG_ERROR("JTAG error while reading cpsr");
2418 return ERROR_TARGET_DATA_ABORT
;
2421 if (((cpsr
& 0x1f) == ARM_MODE_ABT
) && (armv4_5
->core_mode
!= ARM_MODE_ABT
))
2423 LOG_WARNING("memory read caused data abort (address: 0x%8.8" PRIx32
", size: 0x%" PRIx32
", count: 0x%" PRIx32
")", address
, size
, count
);
2425 arm7_9
->write_xpsr_im8(target
,
2426 buf_get_u32(armv4_5
->cpsr
->value
, 0, 8)
2429 return ERROR_TARGET_DATA_ABORT
;
2435 int arm7_9_write_memory(struct target
*target
, uint32_t address
, uint32_t size
, uint32_t count
, const uint8_t *buffer
)
2437 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2438 struct arm
*armv4_5
= &arm7_9
->armv4_5_common
;
2439 struct reg
*dbg_ctrl
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_CTRL
];
2442 uint32_t num_accesses
= 0;
2443 int thisrun_accesses
;
2449 #ifdef _DEBUG_ARM7_9_
2450 LOG_DEBUG("address: 0x%8.8x, size: 0x%8.8x, count: 0x%8.8x", address
, size
, count
);
2453 if (target
->state
!= TARGET_HALTED
)
2455 LOG_WARNING("target not halted");
2456 return ERROR_TARGET_NOT_HALTED
;
2459 /* sanitize arguments */
2460 if (((size
!= 4) && (size
!= 2) && (size
!= 1)) || (count
== 0) || !(buffer
))
2461 return ERROR_INVALID_ARGUMENTS
;
2463 if (((size
== 4) && (address
& 0x3u
)) || ((size
== 2) && (address
& 0x1u
)))
2464 return ERROR_TARGET_UNALIGNED_ACCESS
;
2466 /* load the base register with the address of the first word */
2468 arm7_9
->write_core_regs(target
, 0x1, reg
);
2470 /* Clear DBGACK, to make sure memory fetches work as expected */
2471 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGACK
, 1, 0);
2472 embeddedice_store_reg(dbg_ctrl
);
2477 while (num_accesses
< count
)
2480 thisrun_accesses
= ((count
- num_accesses
) >= 14) ? 14 : (count
- num_accesses
);
2481 reg_list
= (0xffff >> (15 - thisrun_accesses
)) & 0xfffe;
2483 for (i
= 1; i
<= thisrun_accesses
; i
++)
2487 reg
[i
] = target_buffer_get_u32(target
, buffer
);
2491 arm7_9
->write_core_regs(target
, reg_list
, reg
);
2493 arm7_9
->store_word_regs(target
, reg_list
);
2495 /* fast memory writes are only safe when the target is running
2496 * from a sufficiently high clock (32 kHz is usually too slow)
2498 if (arm7_9
->fast_memory_access
)
2499 retval
= arm7_9_execute_fast_sys_speed(target
);
2502 retval
= arm7_9_execute_sys_speed(target
);
2505 * if memory writes are made when the clock is running slow
2506 * (i.e. 32 kHz) which is necessary in some scripts to reconfigure
2507 * processor operations after a "reset halt" or "reset init",
2508 * need to immediately stroke the keep alive or will end up with
2509 * gdb "keep alive not sent error message" problem.
2515 if (retval
!= ERROR_OK
)
2520 num_accesses
+= thisrun_accesses
;
2524 while (num_accesses
< count
)
2527 thisrun_accesses
= ((count
- num_accesses
) >= 14) ? 14 : (count
- num_accesses
);
2528 reg_list
= (0xffff >> (15 - thisrun_accesses
)) & 0xfffe;
2530 for (i
= 1; i
<= thisrun_accesses
; i
++)
2534 reg
[i
] = target_buffer_get_u16(target
, buffer
) & 0xffff;
2538 arm7_9
->write_core_regs(target
, reg_list
, reg
);
2540 for (i
= 1; i
<= thisrun_accesses
; i
++)
2542 arm7_9
->store_hword_reg(target
, i
);
2544 /* fast memory writes are only safe when the target is running
2545 * from a sufficiently high clock (32 kHz is usually too slow)
2547 if (arm7_9
->fast_memory_access
)
2548 retval
= arm7_9_execute_fast_sys_speed(target
);
2551 retval
= arm7_9_execute_sys_speed(target
);
2554 * if memory writes are made when the clock is running slow
2555 * (i.e. 32 kHz) which is necessary in some scripts to reconfigure
2556 * processor operations after a "reset halt" or "reset init",
2557 * need to immediately stroke the keep alive or will end up with
2558 * gdb "keep alive not sent error message" problem.
2564 if (retval
!= ERROR_OK
)
2570 num_accesses
+= thisrun_accesses
;
2574 while (num_accesses
< count
)
2577 thisrun_accesses
= ((count
- num_accesses
) >= 14) ? 14 : (count
- num_accesses
);
2578 reg_list
= (0xffff >> (15 - thisrun_accesses
)) & 0xfffe;
2580 for (i
= 1; i
<= thisrun_accesses
; i
++)
2584 reg
[i
] = *buffer
++ & 0xff;
2587 arm7_9
->write_core_regs(target
, reg_list
, reg
);
2589 for (i
= 1; i
<= thisrun_accesses
; i
++)
2591 arm7_9
->store_byte_reg(target
, i
);
2592 /* fast memory writes are only safe when the target is running
2593 * from a sufficiently high clock (32 kHz is usually too slow)
2595 if (arm7_9
->fast_memory_access
)
2596 retval
= arm7_9_execute_fast_sys_speed(target
);
2599 retval
= arm7_9_execute_sys_speed(target
);
2602 * if memory writes are made when the clock is running slow
2603 * (i.e. 32 kHz) which is necessary in some scripts to reconfigure
2604 * processor operations after a "reset halt" or "reset init",
2605 * need to immediately stroke the keep alive or will end up with
2606 * gdb "keep alive not sent error message" problem.
2612 if (retval
!= ERROR_OK
)
2619 num_accesses
+= thisrun_accesses
;
2625 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGACK
, 1, 1);
2626 embeddedice_store_reg(dbg_ctrl
);
2628 if (!is_arm_mode(armv4_5
->core_mode
))
2631 for (i
= 0; i
<= last_reg
; i
++) {
2632 struct reg
*r
= arm_reg_current(armv4_5
, i
);
2634 r
->dirty
= r
->valid
;
2637 arm7_9
->read_xpsr(target
, &cpsr
, 0);
2638 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
2640 LOG_ERROR("JTAG error while reading cpsr");
2641 return ERROR_TARGET_DATA_ABORT
;
2644 if (((cpsr
& 0x1f) == ARM_MODE_ABT
) && (armv4_5
->core_mode
!= ARM_MODE_ABT
))
2646 LOG_WARNING("memory write caused data abort (address: 0x%8.8" PRIx32
", size: 0x%" PRIx32
", count: 0x%" PRIx32
")", address
, size
, count
);
2648 arm7_9
->write_xpsr_im8(target
,
2649 buf_get_u32(armv4_5
->cpsr
->value
, 0, 8)
2652 return ERROR_TARGET_DATA_ABORT
;
2658 static int dcc_count
;
2659 static const uint8_t *dcc_buffer
;
2661 static int arm7_9_dcc_completion(struct target
*target
, uint32_t exit_point
, int timeout_ms
, void *arch_info
)
2663 int retval
= ERROR_OK
;
2664 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2666 if ((retval
= target_wait_state(target
, TARGET_DEBUG_RUNNING
, 500)) != ERROR_OK
)
2669 int little
= target
->endianness
== TARGET_LITTLE_ENDIAN
;
2670 int count
= dcc_count
;
2671 const uint8_t *buffer
= dcc_buffer
;
2674 /* Handle first & last using standard embeddedice_write_reg and the middle ones w/the
2675 * core function repeated. */
2676 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_COMMS_DATA
], fast_target_buffer_get_u32(buffer
, little
));
2679 struct embeddedice_reg
*ice_reg
= arm7_9
->eice_cache
->reg_list
[EICE_COMMS_DATA
].arch_info
;
2680 uint8_t reg_addr
= ice_reg
->addr
& 0x1f;
2681 struct jtag_tap
*tap
;
2682 tap
= ice_reg
->jtag_info
->tap
;
2684 embeddedice_write_dcc(tap
, reg_addr
, buffer
, little
, count
-2);
2685 buffer
+= (count
-2)*4;
2687 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_COMMS_DATA
], fast_target_buffer_get_u32(buffer
, little
));
2691 for (i
= 0; i
< count
; i
++)
2693 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_COMMS_DATA
], fast_target_buffer_get_u32(buffer
, little
));
2698 if ((retval
= target_halt(target
))!= ERROR_OK
)
2702 return target_wait_state(target
, TARGET_HALTED
, 500);
2705 static const uint32_t dcc_code
[] =
2707 /* r0 == input, points to memory buffer
2711 /* spin until DCC control (c0) reports data arrived */
2712 0xee101e10, /* w: mrc p14, #0, r1, c0, c0 */
2713 0xe3110001, /* tst r1, #1 */
2714 0x0afffffc, /* bne w */
2716 /* read word from DCC (c1), write to memory */
2717 0xee111e10, /* mrc p14, #0, r1, c1, c0 */
2718 0xe4801004, /* str r1, [r0], #4 */
2721 0xeafffff9 /* b w */
2724 int arm7_9_bulk_write_memory(struct target
*target
, uint32_t address
, uint32_t count
, const uint8_t *buffer
)
2727 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2730 if (!arm7_9
->dcc_downloads
)
2731 return target_write_memory(target
, address
, 4, count
, buffer
);
2733 /* regrab previously allocated working_area, or allocate a new one */
2734 if (!arm7_9
->dcc_working_area
)
2736 uint8_t dcc_code_buf
[6 * 4];
2738 /* make sure we have a working area */
2739 if (target_alloc_working_area(target
, 24, &arm7_9
->dcc_working_area
) != ERROR_OK
)
2741 LOG_INFO("no working area available, falling back to memory writes");
2742 return target_write_memory(target
, address
, 4, count
, buffer
);
2745 /* copy target instructions to target endianness */
2746 for (i
= 0; i
< 6; i
++)
2748 target_buffer_set_u32(target
, dcc_code_buf
+ i
*4, dcc_code
[i
]);
2751 /* write DCC code to working area */
2752 if ((retval
= target_write_memory(target
, arm7_9
->dcc_working_area
->address
, 4, 6, dcc_code_buf
)) != ERROR_OK
)
2758 struct arm_algorithm armv4_5_info
;
2759 struct reg_param reg_params
[1];
2761 armv4_5_info
.common_magic
= ARM_COMMON_MAGIC
;
2762 armv4_5_info
.core_mode
= ARM_MODE_SVC
;
2763 armv4_5_info
.core_state
= ARM_STATE_ARM
;
2765 init_reg_param(®_params
[0], "r0", 32, PARAM_IN_OUT
);
2767 buf_set_u32(reg_params
[0].value
, 0, 32, address
);
2770 dcc_buffer
= buffer
;
2771 retval
= armv4_5_run_algorithm_inner(target
, 0, NULL
, 1, reg_params
,
2772 arm7_9
->dcc_working_area
->address
,
2773 arm7_9
->dcc_working_area
->address
+ 6*4,
2774 20*1000, &armv4_5_info
, arm7_9_dcc_completion
);
2776 if (retval
== ERROR_OK
)
2778 uint32_t endaddress
= buf_get_u32(reg_params
[0].value
, 0, 32);
2779 if (endaddress
!= (address
+ count
*4))
2781 LOG_ERROR("DCC write failed, expected end address 0x%08" PRIx32
" got 0x%0" PRIx32
"", (address
+ count
*4), endaddress
);
2782 retval
= ERROR_FAIL
;
2786 destroy_reg_param(®_params
[0]);
2792 * Perform per-target setup that requires JTAG access.
2794 int arm7_9_examine(struct target
*target
)
2796 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2799 if (!target_was_examined(target
)) {
2800 struct reg_cache
*t
, **cache_p
;
2802 t
= embeddedice_build_reg_cache(target
, arm7_9
);
2806 cache_p
= register_get_last_cache_p(&target
->reg_cache
);
2808 arm7_9
->eice_cache
= (*cache_p
);
2810 if (arm7_9
->armv4_5_common
.etm
)
2811 (*cache_p
)->next
= etm_build_reg_cache(target
,
2813 arm7_9
->armv4_5_common
.etm
);
2815 target_set_examined(target
);
2818 retval
= embeddedice_setup(target
);
2819 if (retval
== ERROR_OK
)
2820 retval
= arm7_9_setup(target
);
2821 if (retval
== ERROR_OK
&& arm7_9
->armv4_5_common
.etm
)
2822 retval
= etm_setup(target
);
2827 int arm7_9_check_reset(struct target
*target
)
2829 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2831 if (get_target_reset_nag() && !arm7_9
->dcc_downloads
)
2833 LOG_WARNING("NOTE! DCC downloads have not been enabled, defaulting to slow memory writes. Type 'help dcc'.");
2836 if (get_target_reset_nag() && (target
->working_area_size
== 0))
2838 LOG_WARNING("NOTE! Severe performance degradation without working memory enabled.");
2841 if (get_target_reset_nag() && !arm7_9
->fast_memory_access
)
2843 LOG_WARNING("NOTE! Severe performance degradation without fast memory access enabled. Type 'help fast'.");
2849 COMMAND_HANDLER(handle_arm7_9_dbgrq_command
)
2851 struct target
*target
= get_current_target(CMD_CTX
);
2852 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2854 if (!is_arm7_9(arm7_9
))
2856 command_print(CMD_CTX
, "current target isn't an ARM7/ARM9 target");
2857 return ERROR_TARGET_INVALID
;
2861 COMMAND_PARSE_ENABLE(CMD_ARGV
[0],arm7_9
->use_dbgrq
);
2863 command_print(CMD_CTX
, "use of EmbeddedICE dbgrq instead of breakpoint for target halt %s", (arm7_9
->use_dbgrq
) ? "enabled" : "disabled");
2868 COMMAND_HANDLER(handle_arm7_9_fast_memory_access_command
)
2870 struct target
*target
= get_current_target(CMD_CTX
);
2871 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2873 if (!is_arm7_9(arm7_9
))
2875 command_print(CMD_CTX
, "current target isn't an ARM7/ARM9 target");
2876 return ERROR_TARGET_INVALID
;
2880 COMMAND_PARSE_ENABLE(CMD_ARGV
[0], arm7_9
->fast_memory_access
);
2882 command_print(CMD_CTX
, "fast memory access is %s", (arm7_9
->fast_memory_access
) ? "enabled" : "disabled");
2887 COMMAND_HANDLER(handle_arm7_9_dcc_downloads_command
)
2889 struct target
*target
= get_current_target(CMD_CTX
);
2890 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2892 if (!is_arm7_9(arm7_9
))
2894 command_print(CMD_CTX
, "current target isn't an ARM7/ARM9 target");
2895 return ERROR_TARGET_INVALID
;
2899 COMMAND_PARSE_ENABLE(CMD_ARGV
[0], arm7_9
->dcc_downloads
);
2901 command_print(CMD_CTX
, "dcc downloads are %s", (arm7_9
->dcc_downloads
) ? "enabled" : "disabled");
2906 static int arm7_9_setup_semihosting(struct target
*target
, int enable
)
2908 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2910 if (!is_arm7_9(arm7_9
))
2912 LOG_USER("current target isn't an ARM7/ARM9 target");
2913 return ERROR_TARGET_INVALID
;
2916 if (arm7_9
->has_vector_catch
) {
2917 struct reg
*vector_catch
= &arm7_9
->eice_cache
2918 ->reg_list
[EICE_VEC_CATCH
];
2920 if (!vector_catch
->valid
)
2921 embeddedice_read_reg(vector_catch
);
2922 buf_set_u32(vector_catch
->value
, 2, 1, enable
);
2923 embeddedice_store_reg(vector_catch
);
2925 /* TODO: allow optional high vectors and/or BKPT_HARD */
2927 breakpoint_add(target
, 8, 4, BKPT_SOFT
);
2929 breakpoint_remove(target
, 8);
2935 int arm7_9_init_arch_info(struct target
*target
, struct arm7_9_common
*arm7_9
)
2937 int retval
= ERROR_OK
;
2938 struct arm
*armv4_5
= &arm7_9
->armv4_5_common
;
2940 arm7_9
->common_magic
= ARM7_9_COMMON_MAGIC
;
2942 if ((retval
= arm_jtag_setup_connection(&arm7_9
->jtag_info
)) != ERROR_OK
)
2945 /* caller must have allocated via calloc(), so everything's zeroed */
2947 arm7_9
->wp_available_max
= 2;
2949 arm7_9
->fast_memory_access
= false;
2950 arm7_9
->dcc_downloads
= false;
2952 armv4_5
->arch_info
= arm7_9
;
2953 armv4_5
->read_core_reg
= arm7_9_read_core_reg
;
2954 armv4_5
->write_core_reg
= arm7_9_write_core_reg
;
2955 armv4_5
->full_context
= arm7_9_full_context
;
2956 armv4_5
->setup_semihosting
= arm7_9_setup_semihosting
;
2958 retval
= arm_init_arch_info(target
, armv4_5
);
2959 if (retval
!= ERROR_OK
)
2962 return target_register_timer_callback(arm7_9_handle_target_request
,
2966 static const struct command_registration arm7_9_any_command_handlers
[] = {
2969 .handler
= handle_arm7_9_dbgrq_command
,
2970 .mode
= COMMAND_ANY
,
2971 .usage
= "['enable'|'disable']",
2972 .help
= "use EmbeddedICE dbgrq instead of breakpoint "
2973 "for target halt requests",
2976 "fast_memory_access",
2977 .handler
= handle_arm7_9_fast_memory_access_command
,
2978 .mode
= COMMAND_ANY
,
2979 .usage
= "['enable'|'disable']",
2980 .help
= "use fast memory accesses instead of slower "
2981 "but potentially safer accesses",
2985 .handler
= handle_arm7_9_dcc_downloads_command
,
2986 .mode
= COMMAND_ANY
,
2987 .usage
= "['enable'|'disable']",
2988 .help
= "use DCC downloads for larger memory writes",
2990 COMMAND_REGISTRATION_DONE
2992 const struct command_registration arm7_9_command_handlers
[] = {
2994 .chain
= arm_command_handlers
,
2997 .chain
= etm_command_handlers
,
3001 .mode
= COMMAND_ANY
,
3002 .help
= "arm7/9 specific commands",
3003 .chain
= arm7_9_any_command_handlers
,
3005 COMMAND_REGISTRATION_DONE
Linking to existing account procedure
If you already have an account and want to add another login method
you
MUST first sign in with your existing account and
then change URL to read
https://review.openocd.org/login/?link
to get to this page again but this time it'll work for linking. Thank you.
SSH host keys fingerprints
1024 SHA256:YKx8b7u5ZWdcbp7/4AeXNaqElP49m6QrwfXaqQGJAOk gerrit-code-review@openocd.zylin.com (DSA)
384 SHA256:jHIbSQa4REvwCFG4cq5LBlBLxmxSqelQPem/EXIrxjk gerrit-code-review@openocd.org (ECDSA)
521 SHA256:UAOPYkU9Fjtcao0Ul/Rrlnj/OsQvt+pgdYSZ4jOYdgs gerrit-code-review@openocd.org (ECDSA)
256 SHA256:A13M5QlnozFOvTllybRZH6vm7iSt0XLxbA48yfc2yfY gerrit-code-review@openocd.org (ECDSA)
256 SHA256:spYMBqEYoAOtK7yZBrcwE8ZpYt6b68Cfh9yEVetvbXg gerrit-code-review@openocd.org (ED25519)
+--[ED25519 256]--+
|=.. |
|+o.. . |
|*.o . . |
|+B . . . |
|Bo. = o S |
|Oo.+ + = |
|oB=.* = . o |
| =+=.+ + E |
|. .=o . o |
+----[SHA256]-----+
2048 SHA256:0Onrb7/PHjpo6iVZ7xQX2riKN83FJ3KGU0TvI0TaFG4 gerrit-code-review@openocd.zylin.com (RSA)