X-Git-Url: https://review.openocd.org/gitweb?p=openocd.git;a=blobdiff_plain;f=src%2Ftarget%2Fetm.c;h=8475a99fe9ca66a4c652118a3beef989a2253002;hp=02c33104a35c08285944102fc03669018ba6a4d1;hb=3d6bcf07921753141a3905ee5619724573460cb3;hpb=237e894805dd757cc24029af1b4b1e824c51712b

diff --git a/src/target/etm.c b/src/target/etm.c
index 02c33104a3..8475a99fe9 100644
--- a/src/target/etm.c
+++ b/src/target/etm.c
@@ -28,6 +28,8 @@
 
 #include "armv4_5.h"
 #include "arm7_9_common.h"
+#include "arm_disassembler.h"
+#include "arm_simulator.h"
 
 #include "log.h"
 #include "arm_jtag.h"
@@ -283,12 +285,12 @@ reg_cache_t* etm_build_reg_cache(target_t *target, arm_jtag_t *jtag_info, etm_co
 		reg_cache->next = etb_build_reg_cache(etb);
 		
 		etb->reg_cache = reg_cache->next;
-		
-		if (etm_ctx->capture_driver->init(etm_ctx) != ERROR_OK)
-		{
-			ERROR("ETM capture driver initialization failed");
-			exit(-1);
-		}
+	}
+	
+	if (etm_ctx->capture_driver->init(etm_ctx) != ERROR_OK)
+	{
+		ERROR("ETM capture driver initialization failed");
+		exit(-1);
 	}
 	
 	return reg_cache;
@@ -354,13 +356,12 @@ int etm_read_reg_w_check(reg_t *reg, u8* check_value, u8* check_mask)
 	fields[2].in_handler = NULL;
 	fields[2].in_handler_priv = NULL;
 	
-	jtag_add_dr_scan(3, fields, -1, NULL);
+	jtag_add_dr_scan(3, fields, -1);
 	
 	fields[0].in_value = reg->value;
-	fields[0].in_check_value = check_value;
-	fields[0].in_check_mask = check_mask;
+	jtag_set_check_value(fields+0, check_value, check_mask, NULL);	
 		
-	jtag_add_dr_scan(3, fields, -1, NULL);
+	jtag_add_dr_scan(3, fields, -1);
 
 	free(fields[1].out_value);
 	free(fields[2].out_value);
@@ -445,7 +446,7 @@ int etm_write_reg(reg_t *reg, u32 value)
 	fields[2].in_handler = NULL;
 	fields[2].in_handler_priv = NULL;
 	
-	jtag_add_dr_scan(3, fields, -1, NULL);
+	jtag_add_dr_scan(3, fields, -1);
 	
 	free(fields[0].out_value);
 	free(fields[1].out_value);
@@ -463,10 +464,18 @@ int etm_store_reg(reg_t *reg)
  * 
  */
 extern etm_capture_driver_t etb_capture_driver;
+extern etm_capture_driver_t etm_dummy_capture_driver;
+#if BUILD_OOCD_TRACE == 1
+extern etm_capture_driver_t oocd_trace_capture_driver;
+#endif
 
 etm_capture_driver_t *etm_capture_drivers[] = 
 {
 	&etb_capture_driver,
+	&etm_dummy_capture_driver,
+#if BUILD_OOCD_TRACE == 1
+	&oocd_trace_capture_driver,
+#endif
 	NULL
 };
 
@@ -482,39 +491,537 @@ char *etmv1v1_branch_reason_strings[] =
 	"reserved",
 };
 
-int etmv1_next_packet(etm_context_t *ctx, u8 *packet)
+int etm_read_instruction(etm_context_t *ctx, arm_instruction_t *instruction)
 {
+	int i;
+	int section = -1;
+	u32 size_read;
+	u32 opcode;
+	int retval;
+	
+	if (!ctx->image)
+		return ERROR_TRACE_IMAGE_UNAVAILABLE;
+	
+	/* search for the section the current instruction belongs to */	
+	for (i = 0; i < ctx->image->num_sections; i++)
+	{
+		if ((ctx->image->sections[i].base_address <= ctx->current_pc) &&
+			(ctx->image->sections[i].base_address + ctx->image->sections[i].size > ctx->current_pc))
+		{
+			section = i;
+			break;
+		}
+	}
+	
+	if (section == -1)
+	{
+		/* current instruction couldn't be found in the image */
+		return ERROR_TRACE_INSTRUCTION_UNAVAILABLE;
+	}
 	
+	if (ctx->core_state == ARMV4_5_STATE_ARM)
+	{
+		u8 buf[4];
+		if ((retval = image_read_section(ctx->image, section, 
+			ctx->current_pc - ctx->image->sections[section].base_address,
+			4, buf, &size_read)) != ERROR_OK)
+		{
+			ERROR("error while reading instruction: %i", retval);
+			return ERROR_TRACE_INSTRUCTION_UNAVAILABLE;
+		}
+		opcode = target_buffer_get_u32(ctx->target, buf);
+		arm_evaluate_opcode(opcode, ctx->current_pc, instruction);
+	}
+	else if (ctx->core_state == ARMV4_5_STATE_THUMB)
+	{
+		u8 buf[2];
+		if ((retval = image_read_section(ctx->image, section, 
+			ctx->current_pc - ctx->image->sections[section].base_address,
+			2, buf, &size_read)) != ERROR_OK)
+		{
+			ERROR("error while reading instruction: %i", retval);
+			return ERROR_TRACE_INSTRUCTION_UNAVAILABLE;
+		}
+		opcode = target_buffer_get_u16(ctx->target, buf);
+		thumb_evaluate_opcode(opcode, ctx->current_pc, instruction);
+	}
+	else if (ctx->core_state == ARMV4_5_STATE_JAZELLE)
+	{
+		ERROR("BUG: tracing of jazelle code not supported");
+		exit(-1);
+	}
+	else
+	{
+		ERROR("BUG: unknown core state encountered");
+		exit(-1);
+	}
 	
 	return ERROR_OK;
 }
 
-int etmv1_analyse_trace(etm_context_t *ctx)
+int etmv1_next_packet(etm_context_t *ctx, u8 *packet, int apo)
+{
+	while (ctx->data_index < ctx->trace_depth)
+	{
+		/* if the caller specified an address packet offset, skip until the
+		 * we reach the n-th cycle marked with tracesync */
+		if (apo > 0)
+		{
+			if (ctx->trace_data[ctx->data_index].flags & ETMV1_TRACESYNC_CYCLE)
+				apo--;
+			
+			if (apo > 0)
+			{
+				ctx->data_index++;
+				ctx->data_half = 0;
+			}
+			continue;
+		}
+		
+		/* no tracedata output during a TD cycle
+		 * or in a trigger cycle */
+		if ((ctx->trace_data[ctx->data_index].pipestat == STAT_TD)
+			|| (ctx->trace_data[ctx->data_index].flags & ETMV1_TRIGGER_CYCLE))
+		{
+			ctx->data_index++;
+			ctx->data_half = 0;
+			continue;
+		}
+		
+		if ((ctx->portmode & ETM_PORT_WIDTH_MASK) == ETM_PORT_16BIT)
+		{
+			if (ctx->data_half == 0)
+			{
+				*packet = ctx->trace_data[ctx->data_index].packet & 0xff;
+				ctx->data_half = 1;
+			}
+			else
+			{
+				*packet = (ctx->trace_data[ctx->data_index].packet & 0xff00) >> 8;
+				ctx->data_half = 0;
+				ctx->data_index++;
+			}
+		}
+		else if ((ctx->portmode & ETM_PORT_WIDTH_MASK) == ETM_PORT_8BIT)
+		{
+			*packet = ctx->trace_data[ctx->data_index].packet & 0xff;
+			ctx->data_index++;
+		}
+		else
+		{
+			/* on a 4-bit port, a packet will be output during two consecutive cycles */
+			if (ctx->data_index > (ctx->trace_depth - 2))
+				return -1;
+			
+			*packet = ctx->trace_data[ctx->data_index].packet & 0xf;
+			*packet |= (ctx->trace_data[ctx->data_index + 1].packet & 0xf) << 4;
+			ctx->data_index += 2;
+		}
+					
+		return 0;
+	}
+	
+	return -1;
+}
+
+int etmv1_branch_address(etm_context_t *ctx)
 {
+	int retval;
+	u8 packet;
+	int shift = 0;
+	int apo;
+	int i;
+	
+	/* quit analysis if less than two cycles are left in the trace
+	 * because we can't extract the APO */
+	if (ctx->data_index > (ctx->trace_depth - 2))
+		return -1;
+		
+	/* a BE could be output during an APO cycle, skip the current
+	 * and continue with the new one */
+	if (ctx->trace_data[ctx->pipe_index + 1].pipestat & 0x4)
+		return 1;
+	if (ctx->trace_data[ctx->pipe_index + 2].pipestat & 0x4)
+		return 2;
+		
+	/* address packet offset encoded in the next two cycles' pipestat bits */
+	apo = ctx->trace_data[ctx->pipe_index + 1].pipestat & 0x3;
+	apo |= (ctx->trace_data[ctx->pipe_index + 2].pipestat & 0x3) << 2;
+	
+	/* count number of tracesync cycles between current pipe_index and data_index
+	 * i.e. the number of tracesyncs that data_index already passed by
+	 * to subtract them from the APO */
+	for (i = ctx->pipe_index; i < ctx->data_index; i++)
+	{
+		if (ctx->trace_data[ctx->pipe_index + 1].pipestat & ETMV1_TRACESYNC_CYCLE)
+			apo--;
+	}
+	
+	/* extract up to four 7-bit packets */
+	do {
+		if ((retval = etmv1_next_packet(ctx, &packet, (shift == 0) ? apo + 1 : 0)) != 0)
+			return -1;
+		ctx->last_branch &= ~(0x7f << shift);
+		ctx->last_branch |= (packet & 0x7f) << shift;
+		shift += 7;
+	} while ((packet & 0x80) && (shift < 28));
+	
+	/* one last packet holding 4 bits of the address, plus the branch reason code */
+	if ((shift == 28) && (packet & 0x80))
+	{
+		if ((retval = etmv1_next_packet(ctx, &packet, 0)) != 0)
+			return -1;
+		ctx->last_branch &= 0x0fffffff;
+		ctx->last_branch |= (packet & 0x0f) << 28;
+		ctx->last_branch_reason = (packet & 0x70) >> 4;
+		shift += 4;
+	}
+	else
+	{
+		ctx->last_branch_reason = 0;
+	}
+	
+	if (shift == 32)
+	{
+		ctx->pc_ok = 1;
+	}
+	
+	/* if a full address was output, we might have branched into Jazelle state */
+	if ((shift == 32) && (packet & 0x80))
+	{
+		ctx->core_state = ARMV4_5_STATE_JAZELLE;
+	}
+	else
+	{
+		/* if we didn't branch into Jazelle state, the current processor state is
+		 * encoded in bit 0 of the branch target address */
+		if (ctx->last_branch & 0x1)
+		{
+			ctx->core_state = ARMV4_5_STATE_THUMB;
+			ctx->last_branch &= ~0x1;
+		}
+		else
+		{
+			ctx->core_state = ARMV4_5_STATE_ARM;
+			ctx->last_branch &= ~0x3;
+		}
+	}
+	
+	return 0;
+}
+
+int etmv1_data(etm_context_t *ctx, int size, u32 *data)
+{
+	int j;
+	u8 buf[4];
+	int retval;
+	
+	for (j = 0; j < size; j++)
+	{
+		if ((retval = etmv1_next_packet(ctx, &buf[j], 0)) != 0)
+			return -1;
+	}
+	
+	if (size == 8)
+		ERROR("TODO: add support for 64-bit values");
+	else if (size == 4)
+		*data = target_buffer_get_u32(ctx->target, buf);
+	else if (size == 2)
+		*data = target_buffer_get_u16(ctx->target, buf);
+	else if (size == 1)
+		*data = buf[0];
+		
+	return 0;
+}
+
+int etmv1_analyze_trace(etm_context_t *ctx, struct command_context_s *cmd_ctx)
+{
+	int retval;
+	arm_instruction_t instruction;
+	
+	/* read the trace data if it wasn't read already */
+	if (ctx->trace_depth == 0)
+		ctx->capture_driver->read_trace(ctx);
+	
+	/* start at the beginning of the captured trace */
 	ctx->pipe_index = 0;
 	ctx->data_index = 0;
+	ctx->data_half = 0;
+
+	/* neither the PC nor the data pointer are valid */	
+	ctx->pc_ok = 0;
+	ctx->ptr_ok = 0;
 	
 	while (ctx->pipe_index < ctx->trace_depth)
 	{
-		switch (ctx->trace_data[ctx->pipe_index].pipestat)
+		u8 pipestat = ctx->trace_data[ctx->pipe_index].pipestat;
+		u32 next_pc = ctx->current_pc;
+		u32 old_data_index = ctx->data_index;
+		u32 old_data_half = ctx->data_half;
+		u32 old_index = ctx->pipe_index;
+		u32 last_instruction = ctx->last_instruction;
+		u32 cycles = 0;
+		int current_pc_ok = ctx->pc_ok;
+		
+		if (ctx->trace_data[ctx->pipe_index].flags & ETMV1_TRIGGER_CYCLE)
 		{
-			case STAT_IE:
-			case STAT_ID:
-				break;
-			case STAT_IN:
-				DEBUG("IN");
-				break;
-			case STAT_WT:
-				DEBUG("WT");
-				break;
-			case STAT_BE:
-			case STAT_BD:
-				break;
-			case STAT_TD:
-				/* TODO: in cycle accurate trace, we have to count cycles */
-				DEBUG("TD");
-				break;
+			command_print(cmd_ctx, "--- trigger ---");
+		}
+
+		/* instructions execute in IE/D or BE/D cycles */
+		if ((pipestat == STAT_IE) || (pipestat == STAT_ID))
+			ctx->last_instruction = ctx->pipe_index;
+		
+		/* if we don't have a valid pc skip until we reach an indirect branch */
+		if ((!ctx->pc_ok) && (pipestat != STAT_BE))
+		{
+			ctx->pipe_index++;
+			continue;
+		}
+		
+		/* any indirect branch could have interrupted instruction flow
+		 * - the branch reason code could indicate a trace discontinuity
+		 * - a branch to the exception vectors indicates an exception
+		 */
+		if ((pipestat == STAT_BE) || (pipestat == STAT_BD))
+		{
+			/* backup current data index, to be able to consume the branch address
+			 * before examining data address and values
+			 */
+			old_data_index = ctx->data_index;
+			old_data_half = ctx->data_half;
+
+			ctx->last_instruction = ctx->pipe_index;
+			
+			if ((retval = etmv1_branch_address(ctx)) != 0)
+			{
+				/* negative return value from etmv1_branch_address means we ran out of packets,
+				 * quit analysing the trace */
+				if (retval < 0)
+					break;
+				
+				/* a positive return values means the current branch was abandoned,
+				 * and a new branch was encountered in cycle ctx->pipe_index + retval;
+				 */
+				WARNING("abandoned branch encountered, correctnes of analysis uncertain");
+				ctx->pipe_index += retval;
+				continue;
+			}
+			
+			/* skip over APO cycles */
+			ctx->pipe_index += 2;
+			
+			switch (ctx->last_branch_reason)
+			{
+				case 0x0:	/* normal PC change */
+					next_pc = ctx->last_branch;
+					break;
+				case 0x1:	/* tracing enabled */
+					command_print(cmd_ctx, "--- tracing enabled at 0x%8.8x ---", ctx->last_branch);
+					ctx->current_pc = ctx->last_branch;
+					ctx->pipe_index++;
+					continue;
+					break;
+				case 0x2:	/* trace restarted after FIFO overflow */
+					command_print(cmd_ctx, "--- trace restarted after FIFO overflow at 0x%8.8x ---", ctx->last_branch);
+					ctx->current_pc = ctx->last_branch;
+					ctx->pipe_index++;
+					continue;
+					break;
+				case 0x3:	/* exit from debug state */
+					command_print(cmd_ctx, "--- exit from debug state at 0x%8.8x ---", ctx->last_branch);
+					ctx->current_pc = ctx->last_branch;
+					ctx->pipe_index++;
+					continue;
+					break;
+				case 0x4:	/* periodic synchronization point */
+					next_pc = ctx->last_branch;
+					/* if we had no valid PC prior to this synchronization point,
+					 * we have to move on with the next trace cycle
+					 */
+					if (!current_pc_ok)
+					{
+						command_print(cmd_ctx, "--- periodic synchronization point at 0x%8.8x ---", next_pc);
+						ctx->current_pc = next_pc;
+						ctx->pipe_index++;
+						continue;
+					}
+					break;
+				default:	/* reserved */
+					ERROR("BUG: branch reason code 0x%x is reserved", ctx->last_branch_reason);		
+					exit(-1);
+					break;
+			}
+			
+			/* if we got here the branch was a normal PC change
+			 * (or a periodic synchronization point, which means the same for that matter)
+			 * if we didn't accquire a complete PC continue with the next cycle
+			 */
+			if (!ctx->pc_ok)
+				continue;
+			
+			/* indirect branch to the exception vector means an exception occured */
+			if (((ctx->last_branch >= 0x0) && (ctx->last_branch <= 0x20))
+				|| ((ctx->last_branch >= 0xffff0000) && (ctx->last_branch <= 0xffff0020)))
+			{
+				if ((ctx->last_branch & 0xff) == 0x10)
+				{
+					command_print(cmd_ctx, "data abort");
+				}
+				else
+				{
+					command_print(cmd_ctx, "exception vector 0x%2.2x", ctx->last_branch);
+					ctx->current_pc = ctx->last_branch;
+					ctx->pipe_index++;
+					continue;
+				}
+			}
+		}
+		
+		/* an instruction was executed (or not, depending on the condition flags)
+		 * retrieve it from the image for displaying */
+		if (ctx->pc_ok && (pipestat != STAT_WT) && (pipestat != STAT_TD) &&
+			!(((pipestat == STAT_BE) || (pipestat == STAT_BD)) &&
+				((ctx->last_branch_reason != 0x0) && (ctx->last_branch_reason != 0x4))))  
+		{
+			if ((retval = etm_read_instruction(ctx, &instruction)) != ERROR_OK)
+			{
+				/* can't continue tracing with no image available */
+				if (retval == ERROR_TRACE_IMAGE_UNAVAILABLE)
+				{
+					return retval;
+				}
+				else if (retval == ERROR_TRACE_INSTRUCTION_UNAVAILABLE)
+				{
+					/* TODO: handle incomplete images 
+					 * for now we just quit the analsysis*/
+					return retval;
+				}
+			}
+			
+			cycles = old_index - last_instruction;
+		}
+		
+		if ((pipestat == STAT_ID) || (pipestat == STAT_BD))
+		{
+			u32 new_data_index = ctx->data_index;
+			u32 new_data_half = ctx->data_half;
+			
+			/* in case of a branch with data, the branch target address was consumed before
+			 * we temporarily go back to the saved data index */
+			if (pipestat == STAT_BD)
+			{
+				ctx->data_index = old_data_index;
+				ctx->data_half = old_data_half;
+			}
+			
+			if (ctx->tracemode & ETMV1_TRACE_ADDR)
+			{			
+				u8 packet;
+				int shift = 0;
+				
+				do {
+					if ((retval = etmv1_next_packet(ctx, &packet, 0)) != 0)
+						return ERROR_ETM_ANALYSIS_FAILED;
+					ctx->last_ptr &= ~(0x7f << shift);
+					ctx->last_ptr |= (packet & 0x7f) << shift;
+					shift += 7;
+				} while ((packet & 0x80) && (shift < 32));
+				
+				if (shift >= 32)
+					ctx->ptr_ok = 1;
+				
+				if (ctx->ptr_ok)
+				{
+					command_print(cmd_ctx, "address: 0x%8.8x", ctx->last_ptr);
+				}
+			}
+			
+			if (ctx->tracemode & ETMV1_TRACE_DATA)
+			{
+				if ((instruction.type == ARM_LDM) || (instruction.type == ARM_STM))
+				{
+					int i;
+					for (i = 0; i < 16; i++)
+					{
+						if (instruction.info.load_store_multiple.register_list & (1 << i))
+						{
+							u32 data;
+							if (etmv1_data(ctx, 4, &data) != 0)
+								return ERROR_ETM_ANALYSIS_FAILED;
+							command_print(cmd_ctx, "data: 0x%8.8x", data);
+						}
+					}
+				}
+				else if ((instruction.type >= ARM_LDR) && (instruction.type <= ARM_STRH))
+				{
+					u32 data;
+					if (etmv1_data(ctx, arm_access_size(&instruction), &data) != 0)
+						return ERROR_ETM_ANALYSIS_FAILED;
+					command_print(cmd_ctx, "data: 0x%8.8x", data);
+				}
+			}
+			
+			/* restore data index after consuming BD address and data */
+			if (pipestat == STAT_BD)
+			{
+				ctx->data_index = new_data_index;
+				ctx->data_half = new_data_half;
+			}
+		}
+		
+		/* adjust PC */
+		if ((pipestat == STAT_IE) || (pipestat == STAT_ID))
+		{
+			if (((instruction.type == ARM_B) ||
+				(instruction.type == ARM_BL) ||
+				(instruction.type == ARM_BLX)) &&
+				(instruction.info.b_bl_bx_blx.target_address != -1))
+			{
+				next_pc = instruction.info.b_bl_bx_blx.target_address;
+			}
+			else
+			{
+				next_pc += (ctx->core_state == ARMV4_5_STATE_ARM) ? 4 : 2;
+			}
+		}
+		else if (pipestat == STAT_IN)
+		{
+			next_pc += (ctx->core_state == ARMV4_5_STATE_ARM) ? 4 : 2;
+		}
+
+		if ((pipestat != STAT_TD) && (pipestat != STAT_WT))
+		{
+			char cycles_text[32] = "";
+			
+			/* if the trace was captured with cycle accurate tracing enabled,
+			 * output the number of cycles since the last executed instruction
+			 */
+			if (ctx->tracemode & ETMV1_CYCLE_ACCURATE)
+			{
+				snprintf(cycles_text, 32, " (%i %s)",
+					cycles,
+					(cycles == 1) ? "cycle" : "cycles");
+			}
+			
+			command_print(cmd_ctx, "%s%s%s",
+				instruction.text,
+				(pipestat == STAT_IN) ? " (not executed)" : "",
+				cycles_text);
+
+			ctx->current_pc = next_pc;
+			
+			/* packets for an instruction don't start on or before the preceding
+			 * functional pipestat (i.e. other than WT or TD)
+			 */
+			if (ctx->data_index <= ctx->pipe_index)
+			{
+				ctx->data_index = ctx->pipe_index + 1;
+				ctx->data_half = 0;
+			}
 		}
+		
+		ctx->pipe_index += 1;
 	}
 	
 	return ERROR_OK;
@@ -543,7 +1050,7 @@ int handle_etm_tracemode_command(struct command_context_s *cmd_ctx, char *cmd, c
 	
 	tracemode = arm7_9->etm_ctx->tracemode;
 
-	if (argc == 3)
+	if (argc == 4)
 	{
 		if (strcmp(args[0], "none") == 0)
 		{
@@ -599,10 +1106,24 @@ int handle_etm_tracemode_command(struct command_context_s *cmd_ctx, char *cmd, c
 			command_print(cmd_ctx, "invalid option '%s'", args[2]);
 			return ERROR_OK;
 		}
+		
+		if (strcmp(args[3], "enable") == 0)
+		{
+			tracemode |= ETMV1_BRANCH_OUTPUT;
+		}
+		else if (strcmp(args[3], "disable") == 0)
+		{
+			tracemode |= 0;
+		}
+		else
+		{
+			command_print(cmd_ctx, "invalid option '%s'", args[2]);
+			return ERROR_OK;
+		}
 	}
 	else if (argc != 0)
 	{
-		command_print(cmd_ctx, "usage: configure trace mode <none|data|address|all> <context id bits> <enable|disable cycle accurate>");
+		command_print(cmd_ctx, "usage: configure trace mode <none|data|address|all> <context id bits> <cycle accurate> <branch output>");
 		return ERROR_OK;
 	}
 	
@@ -648,6 +1169,15 @@ int handle_etm_tracemode_command(struct command_context_s *cmd_ctx, char *cmd, c
 	{
 		command_print(cmd_ctx, "cycle-accurate tracing disabled");
 	}
+
+	if (tracemode & ETMV1_BRANCH_OUTPUT)
+	{
+		command_print(cmd_ctx, "full branch address output enabled");
+	}
+	else
+	{
+		command_print(cmd_ctx, "full branch address output disabled");
+	}
 	
 	/* only update ETM_CTRL register if tracemode changed */
 	if (arm7_9->etm_ctx->tracemode != tracemode)
@@ -659,7 +1189,7 @@ int handle_etm_tracemode_command(struct command_context_s *cmd_ctx, char *cmd, c
 		buf_set_u32(etm_ctrl_reg->value, 2, 2, tracemode & ETMV1_TRACE_MASK);
 		buf_set_u32(etm_ctrl_reg->value, 14, 2, (tracemode & ETMV1_CONTEXTID_MASK) >> 4);
 		buf_set_u32(etm_ctrl_reg->value, 12, 1, (tracemode & ETMV1_CYCLE_ACCURATE) >> 8);
-		
+		buf_set_u32(etm_ctrl_reg->value, 8, 1, (tracemode & ETMV1_BRANCH_OUTPUT) >> 9);
 		etm_store_reg(etm_ctrl_reg);
 		
 		arm7_9->etm_ctx->tracemode = tracemode;
@@ -669,6 +1199,7 @@ int handle_etm_tracemode_command(struct command_context_s *cmd_ctx, char *cmd, c
 		if (arm7_9->etm_ctx->trace_depth > 0)
 		{
 			free(arm7_9->etm_ctx->trace_data);
+			arm7_9->etm_ctx->trace_data = NULL;
 		}
 		arm7_9->etm_ctx->trace_depth = 0;
 	}
@@ -769,18 +1300,32 @@ int handle_etm_config_command(struct command_context_s *cmd_ctx, char *cmd, char
 		}
 	}
 	
+	if (!etm_capture_drivers[i])
+	{
+		/* no supported capture driver found, don't register an ETM */
+		free(etm_ctx);
+		ERROR("trace capture driver '%s' not found", args[4]);
+		return ERROR_OK;
+	}
+	
+	etm_ctx->target = target;
+	etm_ctx->trigger_percent = 50;
 	etm_ctx->trace_data = NULL;
 	etm_ctx->trace_depth = 0;
 	etm_ctx->portmode = portmode;
 	etm_ctx->tracemode = 0x0;
 	etm_ctx->core_state = ARMV4_5_STATE_ARM;
+	etm_ctx->image = NULL;
 	etm_ctx->pipe_index = 0;
 	etm_ctx->data_index = 0;
 	etm_ctx->current_pc = 0x0;
 	etm_ctx->pc_ok = 0;
 	etm_ctx->last_branch = 0x0;
+	etm_ctx->last_branch_reason = 0x0;
 	etm_ctx->last_ptr = 0x0;
+	etm_ctx->ptr_ok = 0x0;
 	etm_ctx->context_id = 0x0;
+	etm_ctx->last_instruction = 0;
 	
 	arm7_9->etm_ctx = etm_ctx;
 	
@@ -789,6 +1334,78 @@ int handle_etm_config_command(struct command_context_s *cmd_ctx, char *cmd, char
 	return ERROR_OK;
 }
 
+int handle_etm_info_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc)
+{
+	target_t *target;
+	armv4_5_common_t *armv4_5;
+	arm7_9_common_t *arm7_9;
+	reg_t *etm_config_reg;
+	reg_t *etm_sys_config_reg;
+	
+	int max_port_size;
+		
+	target = get_current_target(cmd_ctx);
+	
+	if (arm7_9_get_arch_pointers(target, &armv4_5, &arm7_9) != ERROR_OK)
+	{
+		command_print(cmd_ctx, "current target isn't an ARM7/ARM9 target");
+		return ERROR_OK;
+	}
+	
+	if (!arm7_9->etm_ctx)
+	{
+		command_print(cmd_ctx, "current target doesn't have an ETM configured");
+		return ERROR_OK;
+	}
+	
+	etm_config_reg = &arm7_9->etm_ctx->reg_cache->reg_list[ETM_CONFIG];
+	etm_sys_config_reg = &arm7_9->etm_ctx->reg_cache->reg_list[ETM_SYS_CONFIG];
+	
+	etm_get_reg(etm_config_reg);
+	command_print(cmd_ctx, "pairs of address comparators: %i", buf_get_u32(etm_config_reg->value, 0, 4));
+	command_print(cmd_ctx, "pairs of data comparators: %i", buf_get_u32(etm_config_reg->value, 4, 4));
+	command_print(cmd_ctx, "memory map decoders: %i", buf_get_u32(etm_config_reg->value, 8, 5));
+	command_print(cmd_ctx, "number of counters: %i", buf_get_u32(etm_config_reg->value, 13, 3));
+	command_print(cmd_ctx, "sequencer %spresent",
+			(buf_get_u32(etm_config_reg->value, 16, 1) == 1) ? "" : "not ");
+	command_print(cmd_ctx, "number of ext. inputs: %i", buf_get_u32(etm_config_reg->value, 17, 3));
+	command_print(cmd_ctx, "number of ext. outputs: %i", buf_get_u32(etm_config_reg->value, 20, 3));
+	command_print(cmd_ctx, "FIFO full %spresent",
+			(buf_get_u32(etm_config_reg->value, 23, 1) == 1) ? "" : "not ");
+	command_print(cmd_ctx, "protocol version: %i", buf_get_u32(etm_config_reg->value, 28, 3));
+	
+	etm_get_reg(etm_sys_config_reg);
+
+	switch (buf_get_u32(etm_sys_config_reg->value, 0, 3))
+	{
+		case 0:
+			max_port_size = 4;
+			break;
+		case 1:
+			max_port_size = 8;
+			break;
+		case 2:
+			max_port_size = 16;
+			break;
+	}
+	command_print(cmd_ctx, "max. port size: %i", max_port_size);
+	
+	command_print(cmd_ctx, "half-rate clocking %ssupported",
+			(buf_get_u32(etm_sys_config_reg->value, 3, 1) == 1) ? "" : "not ");
+	command_print(cmd_ctx, "full-rate clocking %ssupported",
+			(buf_get_u32(etm_sys_config_reg->value, 4, 1) == 1) ? "" : "not ");
+	command_print(cmd_ctx, "normal trace format %ssupported",
+			(buf_get_u32(etm_sys_config_reg->value, 5, 1) == 1) ? "" : "not ");
+	command_print(cmd_ctx, "multiplex trace format %ssupported",
+			(buf_get_u32(etm_sys_config_reg->value, 6, 1) == 1) ? "" : "not ");
+	command_print(cmd_ctx, "demultiplex trace format %ssupported",
+			(buf_get_u32(etm_sys_config_reg->value, 7, 1) == 1) ? "" : "not ");
+	command_print(cmd_ctx, "FIFO full %ssupported",
+			(buf_get_u32(etm_sys_config_reg->value, 8, 1) == 1) ? "" : "not ");
+	
+	return ERROR_OK;
+}
+
 int handle_etm_status_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc)
 {
 	target_t *target;
@@ -837,6 +1454,66 @@ int handle_etm_status_command(struct command_context_s *cmd_ctx, char *cmd, char
 	return ERROR_OK;
 }
 
+int handle_etm_image_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc)
+{
+	target_t *target;
+	armv4_5_common_t *armv4_5;
+	arm7_9_common_t *arm7_9;
+	etm_context_t *etm_ctx;
+
+	if (argc < 1)
+	{
+		command_print(cmd_ctx, "usage: etm image <file> [base address] [type]");
+		return ERROR_OK;
+	}
+	
+	target = get_current_target(cmd_ctx);
+	
+	if (arm7_9_get_arch_pointers(target, &armv4_5, &arm7_9) != ERROR_OK)
+	{
+		command_print(cmd_ctx, "current target isn't an ARM7/ARM9 target");
+		return ERROR_OK;
+	}
+	
+	if (!(etm_ctx = arm7_9->etm_ctx))
+	{
+		command_print(cmd_ctx, "current target doesn't have an ETM configured");
+		return ERROR_OK;
+	}
+	
+	if (etm_ctx->image)
+	{
+		image_close(etm_ctx->image);
+		free(etm_ctx->image);
+		command_print(cmd_ctx, "previously loaded image found and closed");
+	}
+	
+	etm_ctx->image = malloc(sizeof(image_t));
+	etm_ctx->image->base_address_set = 0;
+	etm_ctx->image->start_address_set = 0;
+	
+	/* a base address isn't always necessary, default to 0x0 (i.e. don't relocate) */
+	if (argc >= 2)
+	{
+		etm_ctx->image->base_address_set = 1;
+		etm_ctx->image->base_address = strtoul(args[1], NULL, 0);
+	}
+	else
+	{
+		etm_ctx->image->base_address_set = 0;
+	}
+		
+	if (image_open(etm_ctx->image, args[0], (argc >= 3) ? args[2] : NULL) != ERROR_OK)
+	{
+		command_print(cmd_ctx, "image opening error: %s", etm_ctx->image->error_str);
+		free(etm_ctx->image);
+		etm_ctx->image = NULL;
+		return ERROR_OK;
+	}
+	
+	return ERROR_OK;
+}
+
 int handle_etm_dump_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc)
 {
 	fileio_t file;
@@ -844,7 +1521,7 @@ int handle_etm_dump_command(struct command_context_s *cmd_ctx, char *cmd, char *
 	armv4_5_common_t *armv4_5;
 	arm7_9_common_t *arm7_9;
 	etm_context_t *etm_ctx;
-	u32 size_written;
+	int i;
 	
 	if (argc != 1)
 	{
@@ -889,7 +1566,17 @@ int handle_etm_dump_command(struct command_context_s *cmd_ctx, char *cmd, char *
 		return ERROR_OK;
 	}
 	
-	//fileio_write(&file, etm_ctx->trace_depth * 4, (u8*)etm_ctx->trace_data, &size_written);
+	fileio_write_u32(&file, etm_ctx->capture_status);
+	fileio_write_u32(&file, etm_ctx->portmode);
+	fileio_write_u32(&file, etm_ctx->tracemode);
+	fileio_write_u32(&file, etm_ctx->trace_depth);
+	
+	for (i = 0; i < etm_ctx->trace_depth; i++)
+	{
+		fileio_write_u32(&file, etm_ctx->trace_data[i].pipestat);
+		fileio_write_u32(&file, etm_ctx->trace_data[i].packet);
+		fileio_write_u32(&file, etm_ctx->trace_data[i].flags);
+	}
 	
 	fileio_close(&file);
 	
@@ -903,7 +1590,7 @@ int handle_etm_load_command(struct command_context_s *cmd_ctx, char *cmd, char *
 	armv4_5_common_t *armv4_5;
 	arm7_9_common_t *arm7_9;
 	etm_context_t *etm_ctx;
-	u32 size_read;
+	int i;
 	
 	if (argc != 1)
 	{
@@ -948,15 +1635,69 @@ int handle_etm_load_command(struct command_context_s *cmd_ctx, char *cmd, char *
 		free(etm_ctx->trace_data);
 	}
 	
-	//fileio_read(&file, file.size, (u8*)etm_ctx->trace_data, &size_read);
-	etm_ctx->trace_depth = file.size / 4;
-	etm_ctx->capture_status = TRACE_COMPLETED;
+	fileio_read_u32(&file, &etm_ctx->capture_status);
+	fileio_read_u32(&file, &etm_ctx->portmode);
+	fileio_read_u32(&file, &etm_ctx->tracemode);
+	fileio_read_u32(&file, &etm_ctx->trace_depth);
+	
+	etm_ctx->trace_data = malloc(sizeof(etmv1_trace_data_t) * etm_ctx->trace_depth);
+	
+	for (i = 0; i < etm_ctx->trace_depth; i++)
+	{
+		u32 pipestat, packet, flags;
+		fileio_read_u32(&file, &pipestat);
+		fileio_read_u32(&file, &packet);
+		fileio_read_u32(&file, &flags);
+		etm_ctx->trace_data[i].pipestat = pipestat & 0xff;
+		etm_ctx->trace_data[i].packet = packet & 0xffff;
+		etm_ctx->trace_data[i].flags = flags;
+	}
 	
 	fileio_close(&file);
 	
 	return ERROR_OK;	
 }
 
+int handle_etm_trigger_percent_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc)
+{
+	target_t *target;
+	armv4_5_common_t *armv4_5;
+	arm7_9_common_t *arm7_9;
+	etm_context_t *etm_ctx;
+	
+	target = get_current_target(cmd_ctx);
+	
+	if (arm7_9_get_arch_pointers(target, &armv4_5, &arm7_9) != ERROR_OK)
+	{
+		command_print(cmd_ctx, "current target isn't an ARM7/ARM9 target");
+		return ERROR_OK;
+	}
+	
+	if (!(etm_ctx = arm7_9->etm_ctx))
+	{
+		command_print(cmd_ctx, "current target doesn't have an ETM configured");
+		return ERROR_OK;
+	}
+	
+	if (argc > 0)
+	{
+		u32 new_value = strtoul(args[0], NULL, 0);
+		
+		if ((new_value < 2) || (new_value > 100))
+		{
+			command_print(cmd_ctx, "valid settings are 2% to 100%");
+		}
+		else
+		{
+			etm_ctx->trigger_percent = new_value;
+		}
+	}
+	
+	command_print(cmd_ctx, "%i percent of the tracebuffer reserved for after the trigger", etm_ctx->trigger_percent);
+
+	return ERROR_OK;
+}
+
 int handle_etm_start_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc)
 {
 	target_t *target;
@@ -984,6 +1725,7 @@ int handle_etm_start_command(struct command_context_s *cmd_ctx, char *cmd, char
 	if (arm7_9->etm_ctx->trace_depth > 0)
 	{
 		free(arm7_9->etm_ctx->trace_data);
+		arm7_9->etm_ctx->trace_data = NULL;
 	}
 	arm7_9->etm_ctx->trace_depth = 0;
 		
@@ -1037,12 +1779,13 @@ int handle_etm_stop_command(struct command_context_s *cmd_ctx, char *cmd, char *
 	return ERROR_OK;
 }
 
-int handle_etm_analyse_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc)
+int handle_etm_analyze_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc)
 {
 	target_t *target;
 	armv4_5_common_t *armv4_5;
 	arm7_9_common_t *arm7_9;
 	etm_context_t *etm_ctx;
+	int retval;
 
 	target = get_current_target(cmd_ctx);
 	
@@ -1058,7 +1801,23 @@ int handle_etm_analyse_command(struct command_context_s *cmd_ctx, char *cmd, cha
 		return ERROR_OK;
 	}
 	
-	etmv1_analyse_trace(etm_ctx);
+	if ((retval = etmv1_analyze_trace(etm_ctx, cmd_ctx)) != ERROR_OK)
+	{
+		switch(retval)
+		{
+			case ERROR_ETM_ANALYSIS_FAILED:
+				command_print(cmd_ctx, "further analysis failed (corrupted trace data or just end of data");
+				break;
+			case ERROR_TRACE_INSTRUCTION_UNAVAILABLE:
+				command_print(cmd_ctx, "no instruction for current address available, analysis aborted");
+				break;
+			case ERROR_TRACE_IMAGE_UNAVAILABLE:
+				command_print(cmd_ctx, "no image available for trace analysis");
+				break;
+			default:
+				command_print(cmd_ctx, "unknown error: %i", retval);
+		}
+	}
 	
 	return ERROR_OK;
 }
@@ -1075,8 +1834,13 @@ int etm_register_commands(struct command_context_s *cmd_ctx)
 int etm_register_user_commands(struct command_context_s *cmd_ctx)
 {
 	register_command(cmd_ctx, etm_cmd, "tracemode", handle_etm_tracemode_command,
-		COMMAND_EXEC, "configure trace mode <none|data|address|all> <context id bits> <enable|disable cycle accurate>");
+		COMMAND_EXEC, "configure trace mode <none|data|address|all> <context id bits> <cycle accurate> <branch output");
 
+	register_command(cmd_ctx, etm_cmd, "info", handle_etm_info_command,
+		COMMAND_EXEC, "display info about the current target's ETM");
+
+	register_command(cmd_ctx, etm_cmd, "trigger_percent <percent>", handle_etm_trigger_percent_command,
+		COMMAND_EXEC, "amount (<percent>) of trace buffer to be filled after the trigger occured");
 	register_command(cmd_ctx, etm_cmd, "status", handle_etm_status_command,
 		COMMAND_EXEC, "display current target's ETM status");
 	register_command(cmd_ctx, etm_cmd, "start", handle_etm_start_command,
@@ -1084,9 +1848,12 @@ int etm_register_user_commands(struct command_context_s *cmd_ctx)
 	register_command(cmd_ctx, etm_cmd, "stop", handle_etm_stop_command,
 		COMMAND_EXEC, "stop ETM trace collection");
 
-	register_command(cmd_ctx, etm_cmd, "analyze", handle_etm_stop_command,
+	register_command(cmd_ctx, etm_cmd, "analyze", handle_etm_analyze_command,
 		COMMAND_EXEC, "anaylze collected ETM trace");
 
+	register_command(cmd_ctx, etm_cmd, "image", handle_etm_image_command,
+		COMMAND_EXEC, "load image from <file> [base address]");
+
 	register_command(cmd_ctx, etm_cmd, "dump", handle_etm_dump_command,
 		COMMAND_EXEC, "dump captured trace data <file>");
 	register_command(cmd_ctx, etm_cmd, "load", handle_etm_load_command,