1 /***************************************************************************
2 * Copyright (C) 2008 digenius technology GmbH. *
5 * Copyright (C) 2008,2009 Oyvind Harboe oyvind.harboe@zylin.com *
7 * Copyright (C) 2008 Georg Acher <acher@in.tum.de> *
9 * This program is free software; you can redistribute it and/or modify *
10 * it under the terms of the GNU General Public License as published by *
11 * the Free Software Foundation; either version 2 of the License, or *
12 * (at your option) any later version. *
14 * This program is distributed in the hope that it will be useful, *
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
17 * GNU General Public License for more details. *
19 * You should have received a copy of the GNU General Public License *
20 * along with this program; if not, write to the *
21 * Free Software Foundation, Inc., *
22 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
23 ***************************************************************************/
30 #include "breakpoints.h"
31 #include "arm11_dbgtap.h"
32 #include "arm_simulator.h"
33 #include "time_support.h"
34 #include "target_type.h"
35 #include "algorithm.h"
40 #define _DEBUG_INSTRUCTION_EXECUTION_
43 static bool arm11_config_memwrite_burst
= true;
44 static bool arm11_config_memwrite_error_fatal
= true;
45 static uint32_t arm11_vcr
= 0;
46 static bool arm11_config_step_irq_enable
= false;
47 static bool arm11_config_hardware_step
= false;
63 enum arm11_regtype type
;
66 /* update arm11_regcache_ids when changing this */
67 static const struct arm11_reg_defs arm11_reg_defs
[] =
70 {"dscr", 0, -1, ARM11_REGISTER_DSCR
},
71 {"wdtr", 0, -1, ARM11_REGISTER_WDTR
},
72 {"rdtr", 0, -1, ARM11_REGISTER_RDTR
},
75 enum arm11_regcache_ids
84 static int arm11_step(struct target
*target
, int current
,
85 uint32_t address
, int handle_breakpoints
);
87 static int arm11_build_reg_cache(struct target
*target
);
88 static int arm11_set_reg(struct reg
*reg
, uint8_t *buf
);
89 static int arm11_get_reg(struct reg
*reg
);
92 /** Check and if necessary take control of the system
94 * \param arm11 Target state variable.
95 * \param dscr If the current DSCR content is
96 * available a pointer to a word holding the
97 * DSCR can be passed. Otherwise use NULL.
99 static int arm11_check_init(struct arm11_common
*arm11
, uint32_t *dscr
)
101 uint32_t dscr_local_tmp_copy
;
105 dscr
= &dscr_local_tmp_copy
;
107 CHECK_RETVAL(arm11_read_DSCR(arm11
, dscr
));
110 if (!(*dscr
& ARM11_DSCR_MODE_SELECT
))
112 LOG_DEBUG("Bringing target into debug mode");
114 *dscr
|= ARM11_DSCR_MODE_SELECT
; /* Halt debug-mode */
115 arm11_write_DSCR(arm11
, *dscr
);
117 /* add further reset initialization here */
119 arm11
->simulate_reset_on_next_halt
= true;
121 if (*dscr
& ARM11_DSCR_CORE_HALTED
)
123 /** \todo TODO: this needs further scrutiny because
124 * arm11_debug_entry() never gets called. (WHY NOT?)
125 * As a result we don't read the actual register states from
129 arm11
->arm
.target
->state
= TARGET_HALTED
;
130 arm11
->arm
.target
->debug_reason
=
131 arm11_get_DSCR_debug_reason(*dscr
);
135 arm11
->arm
.target
->state
= TARGET_RUNNING
;
136 arm11
->arm
.target
->debug_reason
= DBG_REASON_NOTHALTED
;
139 arm11_sc7_clear_vbw(arm11
);
148 (arm11->reg_values[ARM11_RC_##x])
151 * Save processor state. This is called after a HALT instruction
152 * succeeds, and on other occasions the processor enters debug mode
153 * (breakpoint, watchpoint, etc).
155 static int arm11_debug_entry(struct arm11_common
*arm11
, uint32_t dscr
)
159 arm11
->arm
.target
->state
= TARGET_HALTED
;
160 arm11
->arm
.target
->debug_reason
= arm11_get_DSCR_debug_reason(dscr
);
162 /* REVISIT entire cache should already be invalid !!! */
163 register_cache_invalidate(arm11
->arm
.core_cache
);
165 for (size_t i
= 0; i
< ARRAY_SIZE(arm11
->reg_values
); i
++)
167 arm11
->reg_list
[i
].valid
= 1;
168 arm11
->reg_list
[i
].dirty
= 0;
171 /* See e.g. ARM1136 TRM, "14.8.4 Entering Debug state" */
178 if (dscr
& ARM11_DSCR_WDTR_FULL
)
180 arm11_add_debug_SCAN_N(arm11
, 0x05, ARM11_TAP_DEFAULT
);
182 arm11_add_IR(arm11
, ARM11_INTEST
, ARM11_TAP_DEFAULT
);
184 struct scan_field chain5_fields
[3];
186 arm11_setup_field(arm11
, 32, NULL
, &R(WDTR
), chain5_fields
+ 0);
187 arm11_setup_field(arm11
, 1, NULL
, NULL
, chain5_fields
+ 1);
188 arm11_setup_field(arm11
, 1, NULL
, NULL
, chain5_fields
+ 2);
190 arm11_add_dr_scan_vc(ARRAY_SIZE(chain5_fields
), chain5_fields
, TAP_DRPAUSE
);
194 arm11
->reg_list
[ARM11_RC_WDTR
].valid
= 0;
198 /* DSCR: set ARM11_DSCR_EXECUTE_ARM_INSTRUCTION_ENABLE
200 * ARM1176 spec says this is needed only for wDTR/rDTR's "ITR mode",
201 * but not to issue ITRs. ARM1136 seems to require this to issue
204 uint32_t new_dscr
= dscr
| ARM11_DSCR_EXECUTE_ARM_INSTRUCTION_ENABLE
;
206 /* this executes JTAG queue: */
208 arm11_write_DSCR(arm11
, new_dscr
);
212 Before executing any instruction in debug state you have to drain the write buffer.
213 This ensures that no imprecise Data Aborts can return at a later point:*/
215 /** \todo TODO: Test drain write buffer. */
220 /* MRC p14,0,R0,c5,c10,0 */
221 // arm11_run_instr_no_data1(arm11, /*0xee150e1a*/0xe320f000);
223 /* mcr 15, 0, r0, cr7, cr10, {4} */
224 arm11_run_instr_no_data1(arm11
, 0xee070f9a);
226 uint32_t dscr
= arm11_read_DSCR(arm11
);
228 LOG_DEBUG("DRAIN, DSCR %08x", dscr
);
230 if (dscr
& ARM11_DSCR_STICKY_IMPRECISE_DATA_ABORT
)
232 arm11_run_instr_no_data1(arm11
, 0xe320f000);
234 dscr
= arm11_read_DSCR(arm11
);
236 LOG_DEBUG("DRAIN, DSCR %08x (DONE)", dscr
);
245 * NOTE: ARM1136 TRM suggests saving just R0 here now, then
246 * CPSR and PC after the rDTR stuff. We do it all at once.
248 retval
= arm_dpm_read_current_registers(&arm11
->dpm
);
249 if (retval
!= ERROR_OK
)
250 LOG_ERROR("DPM REG READ -- fail %d", retval
);
252 retval
= arm11_run_instr_data_prepare(arm11
);
253 if (retval
!= ERROR_OK
)
256 /* maybe save rDTR */
258 /* check rDTRfull in DSCR */
260 if (dscr
& ARM11_DSCR_RDTR_FULL
)
262 /* MRC p14,0,R0,c0,c5,0 (move rDTR -> r0 (-> wDTR -> local var)) */
263 retval
= arm11_run_instr_data_from_core_via_r0(arm11
, 0xEE100E15, &R(RDTR
));
264 if (retval
!= ERROR_OK
)
269 arm11
->reg_list
[ARM11_RC_RDTR
].valid
= 0;
272 /* REVISIT Now that we've saved core state, there's may also
273 * be MMU and cache state to care about ...
276 if (arm11
->simulate_reset_on_next_halt
)
278 arm11
->simulate_reset_on_next_halt
= false;
280 LOG_DEBUG("Reset c1 Control Register");
282 /* Write 0 (reset value) to Control register 0 to disable MMU/Cache etc. */
284 /* MCR p15,0,R0,c1,c0,0 */
285 retval
= arm11_run_instr_data_to_core_via_r0(arm11
, 0xee010f10, 0);
286 if (retval
!= ERROR_OK
)
291 retval
= arm11_run_instr_data_finish(arm11
);
292 if (retval
!= ERROR_OK
)
299 * Restore processor state. This is called in preparation for
300 * the RESTART function.
302 static int arm11_leave_debug_state(struct arm11_common
*arm11
, bool bpwp
)
306 /* See e.g. ARM1136 TRM, "14.8.5 Leaving Debug state" */
308 /* NOTE: the ARM1136 TRM suggests restoring all registers
309 * except R0/PC/CPSR right now. Instead, we do them all
310 * at once, just a bit later on.
313 /* REVISIT once we start caring about MMU and cache state,
314 * address it here ...
317 /* spec says clear wDTR and rDTR; we assume they are clear as
318 otherwise our programming would be sloppy */
322 CHECK_RETVAL(arm11_read_DSCR(arm11
, &DSCR
));
324 if (DSCR
& (ARM11_DSCR_RDTR_FULL
| ARM11_DSCR_WDTR_FULL
))
327 The wDTR/rDTR two registers that are used to send/receive data to/from
328 the core in tandem with corresponding instruction codes that are
329 written into the core. The RDTR FULL/WDTR FULL flag indicates that the
330 registers hold data that was written by one side (CPU or JTAG) and not
331 read out by the other side.
333 LOG_ERROR("wDTR/rDTR inconsistent (DSCR %08" PRIx32
")", DSCR
);
338 /* maybe restore original wDTR */
339 if ((R(DSCR
) & ARM11_DSCR_WDTR_FULL
) || arm11
->reg_list
[ARM11_RC_WDTR
].dirty
)
341 retval
= arm11_run_instr_data_prepare(arm11
);
342 if (retval
!= ERROR_OK
)
345 /* MCR p14,0,R0,c0,c5,0 */
346 retval
= arm11_run_instr_data_to_core_via_r0(arm11
, 0xee000e15, R(WDTR
));
347 if (retval
!= ERROR_OK
)
350 retval
= arm11_run_instr_data_finish(arm11
);
351 if (retval
!= ERROR_OK
)
355 /* restore CPSR, PC, and R0 ... after flushing any modified
358 retval
= arm_dpm_write_dirty_registers(&arm11
->dpm
, bpwp
);
360 register_cache_invalidate(arm11
->arm
.core_cache
);
364 arm11_write_DSCR(arm11
, R(DSCR
));
366 /* maybe restore rDTR */
368 if (R(DSCR
) & ARM11_DSCR_RDTR_FULL
|| arm11
->reg_list
[ARM11_RC_RDTR
].dirty
)
370 arm11_add_debug_SCAN_N(arm11
, 0x05, ARM11_TAP_DEFAULT
);
372 arm11_add_IR(arm11
, ARM11_EXTEST
, ARM11_TAP_DEFAULT
);
374 struct scan_field chain5_fields
[3];
376 uint8_t Ready
= 0; /* ignored */
377 uint8_t Valid
= 0; /* ignored */
379 arm11_setup_field(arm11
, 32, &R(RDTR
), NULL
, chain5_fields
+ 0);
380 arm11_setup_field(arm11
, 1, &Ready
, NULL
, chain5_fields
+ 1);
381 arm11_setup_field(arm11
, 1, &Valid
, NULL
, chain5_fields
+ 2);
383 arm11_add_dr_scan_vc(ARRAY_SIZE(chain5_fields
), chain5_fields
, TAP_DRPAUSE
);
386 /* now processor is ready to RESTART */
391 /* poll current target status */
392 static int arm11_poll(struct target
*target
)
395 struct arm11_common
*arm11
= target_to_arm11(target
);
398 CHECK_RETVAL(arm11_read_DSCR(arm11
, &dscr
));
400 LOG_DEBUG("DSCR %08" PRIx32
"", dscr
);
402 CHECK_RETVAL(arm11_check_init(arm11
, &dscr
));
404 if (dscr
& ARM11_DSCR_CORE_HALTED
)
406 if (target
->state
!= TARGET_HALTED
)
408 enum target_state old_state
= target
->state
;
410 LOG_DEBUG("enter TARGET_HALTED");
411 retval
= arm11_debug_entry(arm11
, dscr
);
412 if (retval
!= ERROR_OK
)
415 target_call_event_callbacks(target
,
416 old_state
== TARGET_DEBUG_RUNNING
? TARGET_EVENT_DEBUG_HALTED
: TARGET_EVENT_HALTED
);
421 if (target
->state
!= TARGET_RUNNING
&& target
->state
!= TARGET_DEBUG_RUNNING
)
423 LOG_DEBUG("enter TARGET_RUNNING");
424 target
->state
= TARGET_RUNNING
;
425 target
->debug_reason
= DBG_REASON_NOTHALTED
;
431 /* architecture specific status reply */
432 static int arm11_arch_state(struct target
*target
)
436 retval
= armv4_5_arch_state(target
);
438 /* REVISIT also display ARM11-specific MMU and cache status ... */
443 /* target request support */
444 static int arm11_target_request_data(struct target
*target
,
445 uint32_t size
, uint8_t *buffer
)
447 LOG_WARNING("Not implemented: %s", __func__
);
452 /* target execution control */
453 static int arm11_halt(struct target
*target
)
455 struct arm11_common
*arm11
= target_to_arm11(target
);
457 LOG_DEBUG("target->state: %s",
458 target_state_name(target
));
460 if (target
->state
== TARGET_UNKNOWN
)
462 arm11
->simulate_reset_on_next_halt
= true;
465 if (target
->state
== TARGET_HALTED
)
467 LOG_DEBUG("target was already halted");
471 arm11_add_IR(arm11
, ARM11_HALT
, TAP_IDLE
);
473 CHECK_RETVAL(jtag_execute_queue());
480 CHECK_RETVAL(arm11_read_DSCR(arm11
, &dscr
));
482 if (dscr
& ARM11_DSCR_CORE_HALTED
)
493 if ((timeval_ms()-then
) > 1000)
495 LOG_WARNING("Timeout (1000ms) waiting for instructions to complete");
502 enum target_state old_state
= target
->state
;
504 arm11_debug_entry(arm11
, dscr
);
507 target_call_event_callbacks(target
,
508 old_state
== TARGET_DEBUG_RUNNING
? TARGET_EVENT_DEBUG_HALTED
: TARGET_EVENT_HALTED
));
514 arm11_nextpc(struct arm11_common
*arm11
, int current
, uint32_t address
)
516 void *value
= arm11
->arm
.core_cache
->reg_list
[15].value
;
519 buf_set_u32(value
, 0, 32, address
);
521 address
= buf_get_u32(value
, 0, 32);
526 static int arm11_resume(struct target
*target
, int current
,
527 uint32_t address
, int handle_breakpoints
, int debug_execution
)
529 // LOG_DEBUG("current %d address %08x handle_breakpoints %d debug_execution %d",
530 // current, address, handle_breakpoints, debug_execution);
532 struct arm11_common
*arm11
= target_to_arm11(target
);
534 LOG_DEBUG("target->state: %s",
535 target_state_name(target
));
538 if (target
->state
!= TARGET_HALTED
)
540 LOG_ERROR("Target not halted");
541 return ERROR_TARGET_NOT_HALTED
;
544 address
= arm11_nextpc(arm11
, current
, address
);
546 LOG_DEBUG("RESUME PC %08" PRIx32
"%s", address
, !current
? "!" : "");
548 /* clear breakpoints/watchpoints and VCR*/
549 arm11_sc7_clear_vbw(arm11
);
551 if (!debug_execution
)
552 target_free_all_working_areas(target
);
554 /* Set up breakpoints */
555 if (handle_breakpoints
)
557 /* check if one matches PC and step over it if necessary */
559 struct breakpoint
* bp
;
561 for (bp
= target
->breakpoints
; bp
; bp
= bp
->next
)
563 if (bp
->address
== address
)
565 LOG_DEBUG("must step over %08" PRIx32
"", bp
->address
);
566 arm11_step(target
, 1, 0, 0);
571 /* set all breakpoints */
573 unsigned brp_num
= 0;
575 for (bp
= target
->breakpoints
; bp
; bp
= bp
->next
)
577 struct arm11_sc7_action brp
[2];
580 brp
[0].address
= ARM11_SC7_BVR0
+ brp_num
;
581 brp
[0].value
= bp
->address
;
583 brp
[1].address
= ARM11_SC7_BCR0
+ brp_num
;
584 brp
[1].value
= 0x1 | (3 << 1) | (0x0F << 5) | (0 << 14) | (0 << 16) | (0 << 20) | (0 << 21);
586 arm11_sc7_run(arm11
, brp
, ARRAY_SIZE(brp
));
588 LOG_DEBUG("Add BP %d at %08" PRIx32
, brp_num
,
594 arm11_sc7_set_vcr(arm11
, arm11_vcr
);
597 arm11_leave_debug_state(arm11
, handle_breakpoints
);
599 arm11_add_IR(arm11
, ARM11_RESTART
, TAP_IDLE
);
601 CHECK_RETVAL(jtag_execute_queue());
608 CHECK_RETVAL(arm11_read_DSCR(arm11
, &dscr
));
610 LOG_DEBUG("DSCR %08" PRIx32
"", dscr
);
612 if (dscr
& ARM11_DSCR_CORE_RESTARTED
)
623 if ((timeval_ms()-then
) > 1000)
625 LOG_WARNING("Timeout (1000ms) waiting for instructions to complete");
632 if (!debug_execution
)
634 target
->state
= TARGET_RUNNING
;
635 target
->debug_reason
= DBG_REASON_NOTHALTED
;
637 CHECK_RETVAL(target_call_event_callbacks(target
, TARGET_EVENT_RESUMED
));
641 target
->state
= TARGET_DEBUG_RUNNING
;
642 target
->debug_reason
= DBG_REASON_NOTHALTED
;
644 CHECK_RETVAL(target_call_event_callbacks(target
, TARGET_EVENT_RESUMED
));
650 static int arm11_step(struct target
*target
, int current
,
651 uint32_t address
, int handle_breakpoints
)
653 LOG_DEBUG("target->state: %s",
654 target_state_name(target
));
656 if (target
->state
!= TARGET_HALTED
)
658 LOG_WARNING("target was not halted");
659 return ERROR_TARGET_NOT_HALTED
;
662 struct arm11_common
*arm11
= target_to_arm11(target
);
664 address
= arm11_nextpc(arm11
, current
, address
);
666 LOG_DEBUG("STEP PC %08" PRIx32
"%s", address
, !current
? "!" : "");
669 /** \todo TODO: Thumb not supported here */
671 uint32_t next_instruction
;
673 CHECK_RETVAL(arm11_read_memory_word(arm11
, address
, &next_instruction
));
676 if ((next_instruction
& 0xFFF00070) == 0xe1200070)
678 address
= arm11_nextpc(arm11
, 0, address
+ 4);
679 LOG_DEBUG("Skipping BKPT");
681 /* skip over Wait for interrupt / Standby */
682 /* mcr 15, 0, r?, cr7, cr0, {4} */
683 else if ((next_instruction
& 0xFFFF0FFF) == 0xee070f90)
685 address
= arm11_nextpc(arm11
, 0, address
+ 4);
686 LOG_DEBUG("Skipping WFI");
688 /* ignore B to self */
689 else if ((next_instruction
& 0xFEFFFFFF) == 0xeafffffe)
691 LOG_DEBUG("Not stepping jump to self");
695 /** \todo TODO: check if break-/watchpoints make any sense at all in combination
698 /** \todo TODO: check if disabling IRQs might be a good idea here. Alternatively
699 * the VCR might be something worth looking into. */
702 /* Set up breakpoint for stepping */
704 struct arm11_sc7_action brp
[2];
707 brp
[0].address
= ARM11_SC7_BVR0
;
709 brp
[1].address
= ARM11_SC7_BCR0
;
711 if (arm11_config_hardware_step
)
713 /* Hardware single stepping ("instruction address
714 * mismatch") is used if enabled. It's not quite
715 * exactly "run one instruction"; "branch to here"
716 * loops won't break, neither will some other cases,
717 * but it's probably the best default.
719 * Hardware single stepping isn't supported on v6
720 * debug modules. ARM1176 and v7 can support it...
722 * FIXME Thumb stepping likely needs to use 0x03
723 * or 0xc0 byte masks, not 0x0f.
725 brp
[0].value
= address
;
726 brp
[1].value
= 0x1 | (3 << 1) | (0x0F << 5)
727 | (0 << 14) | (0 << 16) | (0 << 20)
731 /* Sets a breakpoint on the next PC, as calculated
732 * by instruction set simulation.
734 * REVISIT stepping Thumb on ARM1156 requires Thumb2
735 * support from the simulator.
740 retval
= arm_simulate_step(target
, &next_pc
);
741 if (retval
!= ERROR_OK
)
744 brp
[0].value
= next_pc
;
745 brp
[1].value
= 0x1 | (3 << 1) | (0x0F << 5)
746 | (0 << 14) | (0 << 16) | (0 << 20)
750 CHECK_RETVAL(arm11_sc7_run(arm11
, brp
, ARRAY_SIZE(brp
)));
755 if (arm11_config_step_irq_enable
)
756 R(DSCR
) &= ~ARM11_DSCR_INTERRUPTS_DISABLE
; /* should be redundant */
758 R(DSCR
) |= ARM11_DSCR_INTERRUPTS_DISABLE
;
761 CHECK_RETVAL(arm11_leave_debug_state(arm11
, handle_breakpoints
));
763 arm11_add_IR(arm11
, ARM11_RESTART
, TAP_IDLE
);
765 CHECK_RETVAL(jtag_execute_queue());
773 CHECK_RETVAL(arm11_read_DSCR(arm11
, &dscr
));
775 LOG_DEBUG("DSCR %08" PRIx32
"e", dscr
);
777 if ((dscr
& (ARM11_DSCR_CORE_RESTARTED
| ARM11_DSCR_CORE_HALTED
)) ==
778 (ARM11_DSCR_CORE_RESTARTED
| ARM11_DSCR_CORE_HALTED
))
788 if ((timeval_ms()-then
) > 1000)
790 LOG_WARNING("Timeout (1000ms) waiting for instructions to complete");
797 /* clear breakpoint */
798 arm11_sc7_clear_vbw(arm11
);
801 CHECK_RETVAL(arm11_debug_entry(arm11
, dscr
));
803 /* restore default state */
804 R(DSCR
) &= ~ARM11_DSCR_INTERRUPTS_DISABLE
;
808 target
->debug_reason
= DBG_REASON_SINGLESTEP
;
810 CHECK_RETVAL(target_call_event_callbacks(target
, TARGET_EVENT_HALTED
));
815 static int arm11_assert_reset(struct target
*target
)
818 struct arm11_common
*arm11
= target_to_arm11(target
);
820 retval
= arm11_check_init(arm11
, NULL
);
821 if (retval
!= ERROR_OK
)
824 target
->state
= TARGET_UNKNOWN
;
826 /* we would very much like to reset into the halted, state,
827 * but resetting and halting is second best... */
828 if (target
->reset_halt
)
830 CHECK_RETVAL(target_halt(target
));
834 /* srst is funny. We can not do *anything* else while it's asserted
835 * and it has unkonwn side effects. Make sure no other code runs
838 * Code below assumes srst:
840 * - Causes power-on-reset (but of what parts of the system?). Bug
843 * - Messes us TAP state without asserting trst.
845 * - There is another bug in the arm11 core. When you generate an access to
846 * external logic (for example ddr controller via AHB bus) and that block
847 * is not configured (perhaps it is still held in reset), that transaction
848 * will never complete. This will hang arm11 core but it will also hang
849 * JTAG controller. Nothing, short of srst assertion will bring it out of
854 * - What should the PC be after an srst reset when starting in the halted
858 jtag_add_reset(0, 1);
859 jtag_add_reset(0, 0);
861 /* How long do we have to wait? */
862 jtag_add_sleep(5000);
864 /* un-mess up TAP state */
867 retval
= jtag_execute_queue();
868 if (retval
!= ERROR_OK
)
876 static int arm11_deassert_reset(struct target
*target
)
881 static int arm11_soft_reset_halt(struct target
*target
)
883 LOG_WARNING("Not implemented: %s", __func__
);
888 /* target memory access
889 * size: 1 = byte (8bit), 2 = half-word (16bit), 4 = word (32bit)
890 * count: number of items of <size>
892 * arm11_config_memrw_no_increment - in the future we may want to be able
893 * to read/write a range of data to a "port". a "port" is an action on
894 * read memory address for some peripheral.
896 static int arm11_read_memory_inner(struct target
*target
,
897 uint32_t address
, uint32_t size
, uint32_t count
, uint8_t *buffer
,
898 bool arm11_config_memrw_no_increment
)
900 /** \todo TODO: check if buffer cast to uint32_t* and uint16_t* might cause alignment problems */
903 if (target
->state
!= TARGET_HALTED
)
905 LOG_WARNING("target was not halted");
906 return ERROR_TARGET_NOT_HALTED
;
909 LOG_DEBUG("ADDR %08" PRIx32
" SIZE %08" PRIx32
" COUNT %08" PRIx32
"", address
, size
, count
);
911 struct arm11_common
*arm11
= target_to_arm11(target
);
913 retval
= arm11_run_instr_data_prepare(arm11
);
914 if (retval
!= ERROR_OK
)
917 /* MRC p14,0,r0,c0,c5,0 */
918 retval
= arm11_run_instr_data_to_core1(arm11
, 0xee100e15, address
);
919 if (retval
!= ERROR_OK
)
925 arm11
->arm
.core_cache
->reg_list
[1].dirty
= true;
927 for (size_t i
= 0; i
< count
; i
++)
929 /* ldrb r1, [r0], #1 */
931 arm11_run_instr_no_data1(arm11
,
932 !arm11_config_memrw_no_increment
? 0xe4d01001 : 0xe5d01000);
935 /* MCR p14,0,R1,c0,c5,0 */
936 arm11_run_instr_data_from_core(arm11
, 0xEE001E15, &res
, 1);
945 arm11
->arm
.core_cache
->reg_list
[1].dirty
= true;
947 for (size_t i
= 0; i
< count
; i
++)
949 /* ldrh r1, [r0], #2 */
950 arm11_run_instr_no_data1(arm11
,
951 !arm11_config_memrw_no_increment
? 0xe0d010b2 : 0xe1d010b0);
955 /* MCR p14,0,R1,c0,c5,0 */
956 arm11_run_instr_data_from_core(arm11
, 0xEE001E15, &res
, 1);
958 uint16_t svalue
= res
;
959 memcpy(buffer
+ i
* sizeof(uint16_t), &svalue
, sizeof(uint16_t));
967 uint32_t instr
= !arm11_config_memrw_no_increment
? 0xecb05e01 : 0xed905e00;
968 /** \todo TODO: buffer cast to uint32_t* causes alignment warnings */
969 uint32_t *words
= (uint32_t *)buffer
;
971 /* LDC p14,c5,[R0],#4 */
972 /* LDC p14,c5,[R0] */
973 arm11_run_instr_data_from_core(arm11
, instr
, words
, count
);
978 return arm11_run_instr_data_finish(arm11
);
981 static int arm11_read_memory(struct target
*target
, uint32_t address
, uint32_t size
, uint32_t count
, uint8_t *buffer
)
983 return arm11_read_memory_inner(target
, address
, size
, count
, buffer
, false);
987 * no_increment - in the future we may want to be able
988 * to read/write a range of data to a "port". a "port" is an action on
989 * read memory address for some peripheral.
991 static int arm11_write_memory_inner(struct target
*target
,
992 uint32_t address
, uint32_t size
,
993 uint32_t count
, uint8_t *buffer
,
998 if (target
->state
!= TARGET_HALTED
)
1000 LOG_WARNING("target was not halted");
1001 return ERROR_TARGET_NOT_HALTED
;
1004 LOG_DEBUG("ADDR %08" PRIx32
" SIZE %08" PRIx32
" COUNT %08" PRIx32
"", address
, size
, count
);
1006 struct arm11_common
*arm11
= target_to_arm11(target
);
1008 retval
= arm11_run_instr_data_prepare(arm11
);
1009 if (retval
!= ERROR_OK
)
1012 /* MRC p14,0,r0,c0,c5,0 */
1013 retval
= arm11_run_instr_data_to_core1(arm11
, 0xee100e15, address
);
1014 if (retval
!= ERROR_OK
)
1017 /* burst writes are not used for single words as those may well be
1018 * reset init script writes.
1020 * The other advantage is that as burst writes are default, we'll
1021 * now exercise both burst and non-burst code paths with the
1022 * default settings, increasing code coverage.
1024 bool burst
= arm11_config_memwrite_burst
&& (count
> 1);
1030 arm11
->arm
.core_cache
->reg_list
[1].dirty
= true;
1032 for (size_t i
= 0; i
< count
; i
++)
1034 /* MRC p14,0,r1,c0,c5,0 */
1035 retval
= arm11_run_instr_data_to_core1(arm11
, 0xee101e15, *buffer
++);
1036 if (retval
!= ERROR_OK
)
1039 /* strb r1, [r0], #1 */
1041 retval
= arm11_run_instr_no_data1(arm11
,
1045 if (retval
!= ERROR_OK
)
1054 arm11
->arm
.core_cache
->reg_list
[1].dirty
= true;
1056 for (size_t i
= 0; i
< count
; i
++)
1059 memcpy(&value
, buffer
+ i
* sizeof(uint16_t), sizeof(uint16_t));
1061 /* MRC p14,0,r1,c0,c5,0 */
1062 retval
= arm11_run_instr_data_to_core1(arm11
, 0xee101e15, value
);
1063 if (retval
!= ERROR_OK
)
1066 /* strh r1, [r0], #2 */
1068 retval
= arm11_run_instr_no_data1(arm11
,
1072 if (retval
!= ERROR_OK
)
1080 uint32_t instr
= !no_increment
? 0xeca05e01 : 0xed805e00;
1082 /** \todo TODO: buffer cast to uint32_t* causes alignment warnings */
1083 uint32_t *words
= (uint32_t*)buffer
;
1087 /* STC p14,c5,[R0],#4 */
1088 /* STC p14,c5,[R0]*/
1089 retval
= arm11_run_instr_data_to_core(arm11
, instr
, words
, count
);
1090 if (retval
!= ERROR_OK
)
1095 /* STC p14,c5,[R0],#4 */
1096 /* STC p14,c5,[R0]*/
1097 retval
= arm11_run_instr_data_to_core_noack(arm11
, instr
, words
, count
);
1098 if (retval
!= ERROR_OK
)
1106 /* r0 verification */
1111 /* MCR p14,0,R0,c0,c5,0 */
1112 retval
= arm11_run_instr_data_from_core(arm11
, 0xEE000E15, &r0
, 1);
1113 if (retval
!= ERROR_OK
)
1116 if (address
+ size
* count
!= r0
)
1118 LOG_ERROR("Data transfer failed. Expected end "
1119 "address 0x%08x, got 0x%08x",
1120 (unsigned) (address
+ size
* count
),
1124 LOG_ERROR("use 'arm11 memwrite burst disable' to disable fast burst mode");
1126 if (arm11_config_memwrite_error_fatal
)
1131 return arm11_run_instr_data_finish(arm11
);
1134 static int arm11_write_memory(struct target
*target
,
1135 uint32_t address
, uint32_t size
,
1136 uint32_t count
, uint8_t *buffer
)
1138 /* pointer increment matters only for multi-unit writes ...
1139 * not e.g. to a "reset the chip" controller.
1141 return arm11_write_memory_inner(target
, address
, size
,
1142 count
, buffer
, count
== 1);
1145 /* write target memory in multiples of 4 byte, optimized for writing large quantities of data */
1146 static int arm11_bulk_write_memory(struct target
*target
,
1147 uint32_t address
, uint32_t count
, uint8_t *buffer
)
1149 if (target
->state
!= TARGET_HALTED
)
1151 LOG_WARNING("target was not halted");
1152 return ERROR_TARGET_NOT_HALTED
;
1155 return arm11_write_memory(target
, address
, 4, count
, buffer
);
1158 /* target break-/watchpoint control
1159 * rw: 0 = write, 1 = read, 2 = access
1161 static int arm11_add_breakpoint(struct target
*target
,
1162 struct breakpoint
*breakpoint
)
1164 struct arm11_common
*arm11
= target_to_arm11(target
);
1167 if (breakpoint
->type
== BKPT_SOFT
)
1169 LOG_INFO("sw breakpoint requested, but software breakpoints not enabled");
1170 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
1174 if (!arm11
->free_brps
)
1176 LOG_DEBUG("no breakpoint unit available for hardware breakpoint");
1177 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
1180 if (breakpoint
->length
!= 4)
1182 LOG_DEBUG("only breakpoints of four bytes length supported");
1183 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
1191 static int arm11_remove_breakpoint(struct target
*target
,
1192 struct breakpoint
*breakpoint
)
1194 struct arm11_common
*arm11
= target_to_arm11(target
);
1201 static int arm11_target_create(struct target
*target
, Jim_Interp
*interp
)
1203 struct arm11_common
*arm11
;
1205 if (target
->tap
== NULL
)
1208 if (target
->tap
->ir_length
!= 5)
1210 LOG_ERROR("'target arm11' expects IR LENGTH = 5");
1211 return ERROR_COMMAND_SYNTAX_ERROR
;
1214 arm11
= calloc(1, sizeof *arm11
);
1218 armv4_5_init_arch_info(target
, &arm11
->arm
);
1220 arm11
->jtag_info
.tap
= target
->tap
;
1221 arm11
->jtag_info
.scann_size
= 5;
1222 arm11
->jtag_info
.scann_instr
= ARM11_SCAN_N
;
1223 /* cur_scan_chain == 0 */
1224 arm11
->jtag_info
.intest_instr
= ARM11_INTEST
;
1229 static int arm11_init_target(struct command_context
*cmd_ctx
,
1230 struct target
*target
)
1232 /* Initialize anything we can set up without talking to the target */
1234 /* REVISIT do we really want such a debug-registers-only cache?
1235 * If we do, it should probably be handled purely by the DPM code,
1236 * so it works identically on the v7a/v7r cores.
1238 return arm11_build_reg_cache(target
);
1241 /* talk to the target and set things up */
1242 static int arm11_examine(struct target
*target
)
1246 struct arm11_common
*arm11
= target_to_arm11(target
);
1247 uint32_t didr
, device_id
;
1248 uint8_t implementor
;
1250 /* FIXME split into do-first-time and do-every-time logic ... */
1254 arm11_add_IR(arm11
, ARM11_IDCODE
, ARM11_TAP_DEFAULT
);
1256 struct scan_field idcode_field
;
1258 arm11_setup_field(arm11
, 32, NULL
, &device_id
, &idcode_field
);
1260 arm11_add_dr_scan_vc(1, &idcode_field
, TAP_DRPAUSE
);
1264 arm11_add_debug_SCAN_N(arm11
, 0x00, ARM11_TAP_DEFAULT
);
1266 arm11_add_IR(arm11
, ARM11_INTEST
, ARM11_TAP_DEFAULT
);
1268 struct scan_field chain0_fields
[2];
1270 arm11_setup_field(arm11
, 32, NULL
, &didr
, chain0_fields
+ 0);
1271 arm11_setup_field(arm11
, 8, NULL
, &implementor
, chain0_fields
+ 1);
1273 arm11_add_dr_scan_vc(ARRAY_SIZE(chain0_fields
), chain0_fields
, TAP_IDLE
);
1275 CHECK_RETVAL(jtag_execute_queue());
1277 switch (device_id
& 0x0FFFF000)
1286 arm11
->arm
.core_type
= ARM_MODE_MON
;
1290 LOG_ERROR("'target arm11' expects IDCODE 0x*7B*7****");
1293 LOG_INFO("found %s", type
);
1295 /* unlikely this could ever fail, but ... */
1296 switch ((didr
>> 16) & 0x0F) {
1297 case ARM11_DEBUG_V6
:
1298 case ARM11_DEBUG_V61
: /* supports security extensions */
1301 LOG_ERROR("Only ARM v6 and v6.1 debug supported.");
1305 arm11
->brp
= ((didr
>> 24) & 0x0F) + 1;
1306 arm11
->wrp
= ((didr
>> 28) & 0x0F) + 1;
1308 /** \todo TODO: reserve one brp slot if we allow breakpoints during step */
1309 arm11
->free_brps
= arm11
->brp
;
1311 LOG_DEBUG("IDCODE %08" PRIx32
" IMPLEMENTOR %02x DIDR %08" PRIx32
,
1312 device_id
, implementor
, didr
);
1314 /* as a side-effect this reads DSCR and thus
1315 * clears the ARM11_DSCR_STICKY_PRECISE_DATA_ABORT / Sticky Precise Data Abort Flag
1316 * as suggested by the spec.
1319 retval
= arm11_check_init(arm11
, NULL
);
1320 if (retval
!= ERROR_OK
)
1323 /* Build register cache "late", after target_init(), since we
1324 * want to know if this core supports Secure Monitor mode.
1326 if (!target_was_examined(target
))
1327 retval
= arm11_dpm_init(arm11
, didr
);
1329 /* ETM on ARM11 still uses original scanchain 6 access mode */
1330 if (arm11
->arm
.etm
&& !target_was_examined(target
)) {
1331 *register_get_last_cache_p(&target
->reg_cache
) =
1332 etm_build_reg_cache(target
, &arm11
->jtag_info
,
1334 retval
= etm_setup(target
);
1337 target_set_examined(target
);
1343 /** Load a register that is marked !valid in the register cache */
1344 static int arm11_get_reg(struct reg
*reg
)
1346 struct arm11_reg_state
*r
= reg
->arch_info
;
1347 struct target
*target
= r
->target
;
1349 if (target
->state
!= TARGET_HALTED
)
1351 LOG_WARNING("target was not halted");
1352 return ERROR_TARGET_NOT_HALTED
;
1355 /** \todo TODO: Check this. We assume that all registers are fetched at debug entry. */
1358 struct arm11_common
*arm11
= target_to_arm11(target
);
1359 const struct arm11_reg_defs
*arm11_reg_info
= arm11_reg_defs
+ ((struct arm11_reg_state
*)reg
->arch_info
)->def_index
;
1365 /** Change a value in the register cache */
1366 static int arm11_set_reg(struct reg
*reg
, uint8_t *buf
)
1368 struct arm11_reg_state
*r
= reg
->arch_info
;
1369 struct target
*target
= r
->target
;
1370 struct arm11_common
*arm11
= target_to_arm11(target
);
1371 // const struct arm11_reg_defs *arm11_reg_info = arm11_reg_defs + ((struct arm11_reg_state *)reg->arch_info)->def_index;
1373 arm11
->reg_values
[((struct arm11_reg_state
*)reg
->arch_info
)->def_index
] = buf_get_u32(buf
, 0, 32);
1380 static const struct reg_arch_type arm11_reg_type
= {
1381 .get
= arm11_get_reg
,
1382 .set
= arm11_set_reg
,
1385 static int arm11_build_reg_cache(struct target
*target
)
1387 struct arm11_common
*arm11
= target_to_arm11(target
);
1388 struct reg_cache
*cache
;
1389 struct reg
*reg_list
;
1390 struct arm11_reg_state
*arm11_reg_states
;
1392 cache
= calloc(1, sizeof *cache
);
1393 reg_list
= calloc(ARM11_REGCACHE_COUNT
, sizeof *reg_list
);
1394 arm11_reg_states
= calloc(ARM11_REGCACHE_COUNT
,
1395 sizeof *arm11_reg_states
);
1396 if (!cache
|| !reg_list
|| !arm11_reg_states
) {
1399 free(arm11_reg_states
);
1403 arm11
->reg_list
= reg_list
;
1405 /* build cache for some of the debug registers */
1406 cache
->name
= "arm11 debug registers";
1407 cache
->reg_list
= reg_list
;
1408 cache
->num_regs
= ARM11_REGCACHE_COUNT
;
1410 struct reg_cache
**cache_p
= register_get_last_cache_p(&target
->reg_cache
);
1413 arm11
->core_cache
= cache
;
1417 /* Not very elegant assertion */
1418 if (ARM11_REGCACHE_COUNT
!= ARRAY_SIZE(arm11
->reg_values
) ||
1419 ARM11_REGCACHE_COUNT
!= ARRAY_SIZE(arm11_reg_defs
) ||
1420 ARM11_REGCACHE_COUNT
!= ARM11_RC_MAX
)
1422 LOG_ERROR("BUG: arm11->reg_values inconsistent (%d %u %u %d)",
1423 ARM11_REGCACHE_COUNT
,
1424 (unsigned) ARRAY_SIZE(arm11
->reg_values
),
1425 (unsigned) ARRAY_SIZE(arm11_reg_defs
),
1427 /* FIXME minimally, use a build_bug_on(X) mechanism;
1428 * runtime exit() here is bad!
1433 for (i
= 0; i
< ARM11_REGCACHE_COUNT
; i
++)
1435 struct reg
* r
= reg_list
+ i
;
1436 const struct arm11_reg_defs
* rd
= arm11_reg_defs
+ i
;
1437 struct arm11_reg_state
* rs
= arm11_reg_states
+ i
;
1441 r
->value
= (uint8_t *)(arm11
->reg_values
+ i
);
1444 r
->type
= &arm11_reg_type
;
1448 rs
->target
= target
;
1454 /* FIXME all these BOOL_WRAPPER things should be modifying
1455 * per-instance state, not shared state; ditto the vector
1456 * catch register support. Scan chains with multiple cores
1457 * should be able to say "work with this core like this,
1458 * that core like that". Example, ARM11 MPCore ...
1461 #define ARM11_BOOL_WRAPPER(name, print_name) \
1462 COMMAND_HANDLER(arm11_handle_bool_##name) \
1464 return CALL_COMMAND_HANDLER(handle_command_parse_bool, \
1465 &arm11_config_##name, print_name); \
1468 ARM11_BOOL_WRAPPER(memwrite_burst
, "memory write burst mode")
1469 ARM11_BOOL_WRAPPER(memwrite_error_fatal
, "fatal error mode for memory writes")
1470 ARM11_BOOL_WRAPPER(step_irq_enable
, "IRQs while stepping")
1471 ARM11_BOOL_WRAPPER(hardware_step
, "hardware single step")
1473 COMMAND_HANDLER(arm11_handle_vcr
)
1479 COMMAND_PARSE_NUMBER(u32
, CMD_ARGV
[0], arm11_vcr
);
1482 return ERROR_COMMAND_SYNTAX_ERROR
;
1485 LOG_INFO("VCR 0x%08" PRIx32
"", arm11_vcr
);
1489 static const struct command_registration arm11_mw_command_handlers
[] = {
1492 .handler
= &arm11_handle_bool_memwrite_burst
,
1493 .mode
= COMMAND_ANY
,
1494 .help
= "Enable/Disable non-standard but fast burst mode"
1495 " (default: enabled)",
1498 .name
= "error_fatal",
1499 .handler
= &arm11_handle_bool_memwrite_error_fatal
,
1500 .mode
= COMMAND_ANY
,
1501 .help
= "Terminate program if transfer error was found"
1502 " (default: enabled)",
1504 COMMAND_REGISTRATION_DONE
1506 static const struct command_registration arm11_any_command_handlers
[] = {
1508 /* "hardware_step" is only here to check if the default
1509 * simulate + breakpoint implementation is broken.
1510 * TEMPORARY! NOT DOCUMENTED! */
1511 .name
= "hardware_step",
1512 .handler
= &arm11_handle_bool_hardware_step
,
1513 .mode
= COMMAND_ANY
,
1514 .help
= "DEBUG ONLY - Hardware single stepping"
1515 " (default: disabled)",
1516 .usage
= "(enable|disable)",
1520 .mode
= COMMAND_ANY
,
1521 .help
= "memwrite command group",
1522 .chain
= arm11_mw_command_handlers
,
1525 .name
= "step_irq_enable",
1526 .handler
= &arm11_handle_bool_step_irq_enable
,
1527 .mode
= COMMAND_ANY
,
1528 .help
= "Enable interrupts while stepping"
1529 " (default: disabled)",
1533 .handler
= &arm11_handle_vcr
,
1534 .mode
= COMMAND_ANY
,
1535 .help
= "Control (Interrupt) Vector Catch Register",
1537 COMMAND_REGISTRATION_DONE
1539 static const struct command_registration arm11_command_handlers
[] = {
1541 .chain
= arm_command_handlers
,
1544 .chain
= etm_command_handlers
,
1548 .mode
= COMMAND_ANY
,
1549 .help
= "ARM11 command group",
1550 .chain
= arm11_any_command_handlers
,
1552 COMMAND_REGISTRATION_DONE
1555 /** Holds methods for ARM11xx targets. */
1556 struct target_type arm11_target
= {
1560 .arch_state
= arm11_arch_state
,
1562 .target_request_data
= arm11_target_request_data
,
1565 .resume
= arm11_resume
,
1568 .assert_reset
= arm11_assert_reset
,
1569 .deassert_reset
= arm11_deassert_reset
,
1570 .soft_reset_halt
= arm11_soft_reset_halt
,
1572 .get_gdb_reg_list
= armv4_5_get_gdb_reg_list
,
1574 .read_memory
= arm11_read_memory
,
1575 .write_memory
= arm11_write_memory
,
1577 .bulk_write_memory
= arm11_bulk_write_memory
,
1579 .checksum_memory
= arm_checksum_memory
,
1580 .blank_check_memory
= arm_blank_check_memory
,
1582 .add_breakpoint
= arm11_add_breakpoint
,
1583 .remove_breakpoint
= arm11_remove_breakpoint
,
1585 .run_algorithm
= armv4_5_run_algorithm
,
1587 .commands
= arm11_command_handlers
,
1588 .target_create
= arm11_target_create
,
1589 .init_target
= arm11_init_target
,
1590 .examine
= arm11_examine
,
Linking to existing account procedure
If you already have an account and want to add another login method
you
MUST first sign in with your existing account and
then change URL to read
https://review.openocd.org/login/?link
to get to this page again but this time it'll work for linking. Thank you.
SSH host keys fingerprints
1024 SHA256:YKx8b7u5ZWdcbp7/4AeXNaqElP49m6QrwfXaqQGJAOk gerrit-code-review@openocd.zylin.com (DSA)
384 SHA256:jHIbSQa4REvwCFG4cq5LBlBLxmxSqelQPem/EXIrxjk gerrit-code-review@openocd.org (ECDSA)
521 SHA256:UAOPYkU9Fjtcao0Ul/Rrlnj/OsQvt+pgdYSZ4jOYdgs gerrit-code-review@openocd.org (ECDSA)
256 SHA256:A13M5QlnozFOvTllybRZH6vm7iSt0XLxbA48yfc2yfY gerrit-code-review@openocd.org (ECDSA)
256 SHA256:spYMBqEYoAOtK7yZBrcwE8ZpYt6b68Cfh9yEVetvbXg gerrit-code-review@openocd.org (ED25519)
+--[ED25519 256]--+
|=.. |
|+o.. . |
|*.o . . |
|+B . . . |
|Bo. = o S |
|Oo.+ + = |
|oB=.* = . o |
| =+=.+ + E |
|. .=o . o |
+----[SHA256]-----+
2048 SHA256:0Onrb7/PHjpo6iVZ7xQX2riKN83FJ3KGU0TvI0TaFG4 gerrit-code-review@openocd.zylin.com (RSA)