1 /***************************************************************************
2 * Copyright (C) 2005 by Dominic Rath *
3 * Dominic.Rath@gmx.de *
5 * Copyright (C) 2007-2010 Øyvind Harboe *
6 * oyvind.harboe@zylin.com *
8 * Copyright (C) 2008 by Spencer Oliver *
9 * spen@spen-soft.co.uk *
11 * Copyright (C) 2008 by Hongtao Zheng *
14 * Copyright (C) 2009 by David Brownell *
16 * This program is free software; you can redistribute it and/or modify *
17 * it under the terms of the GNU General Public License as published by *
18 * the Free Software Foundation; either version 2 of the License, or *
19 * (at your option) any later version. *
21 * This program is distributed in the hope that it will be useful, *
22 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
23 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
24 * GNU General Public License for more details. *
26 * You should have received a copy of the GNU General Public License *
27 * along with this program. If not, see <http://www.gnu.org/licenses/>. *
28 ***************************************************************************/
34 #include "breakpoints.h"
35 #include "embeddedice.h"
36 #include "target_request.h"
38 #include <helper/time_support.h>
39 #include "arm_simulator.h"
40 #include "arm_semihosting.h"
41 #include "algorithm.h"
47 * Hold common code supporting the ARM7 and ARM9 core generations.
49 * While the ARM core implementations evolved substantially during these
50 * two generations, they look quite similar from the JTAG perspective.
51 * Both have similar debug facilities, based on the same two scan chains
52 * providing access to the core and to an EmbeddedICE module. Both can
53 * support similar ETM and ETB modules, for tracing. And both expose
54 * what could be viewed as "ARM Classic", with multiple processor modes,
55 * shadowed registers, and support for the Thumb instruction set.
57 * Processor differences include things like presence or absence of MMU
58 * and cache, pipeline sizes, use of a modified Harvard Architecure
59 * (with separate instruction and data busses from the CPU), support
60 * for cpu clock gating during idle, and more.
63 static int arm7_9_debug_entry(struct target
*target
);
66 * Clear watchpoints for an ARM7/9 target.
68 * @param arm7_9 Pointer to the common struct for an ARM7/9 target
69 * @return JTAG error status after executing queue
71 static int arm7_9_clear_watchpoints(struct arm7_9_common
*arm7_9
)
74 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], 0x0);
75 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
], 0x0);
76 arm7_9
->sw_breakpoint_count
= 0;
77 arm7_9
->sw_breakpoints_added
= 0;
79 arm7_9
->wp1_used
= arm7_9
->wp1_used_default
;
80 arm7_9
->wp_available
= arm7_9
->wp_available_max
;
82 return jtag_execute_queue();
86 * Assign a watchpoint to one of the two available hardware comparators in an
87 * ARM7 or ARM9 target.
89 * @param arm7_9 Pointer to the common struct for an ARM7/9 target
90 * @param breakpoint Pointer to the breakpoint to be used as a watchpoint
92 static void arm7_9_assign_wp(struct arm7_9_common
*arm7_9
, struct breakpoint
*breakpoint
)
94 if (!arm7_9
->wp0_used
) {
97 arm7_9
->wp_available
--;
98 } else if (!arm7_9
->wp1_used
) {
101 arm7_9
->wp_available
--;
103 LOG_ERROR("BUG: no hardware comparator available");
104 LOG_DEBUG("BPID: %" PRId32
" (0x%08" PRIx32
") using hw wp: %d",
105 breakpoint
->unique_id
,
111 * Setup an ARM7/9 target's embedded ICE registers for software breakpoints.
113 * @param arm7_9 Pointer to common struct for ARM7/9 targets
114 * @return Error codes if there is a problem finding a watchpoint or the result
115 * of executing the JTAG queue
117 static int arm7_9_set_software_breakpoints(struct arm7_9_common
*arm7_9
)
119 if (arm7_9
->sw_breakpoints_added
)
121 if (arm7_9
->wp_available
< 1) {
122 LOG_WARNING("can't enable sw breakpoints with no watchpoint unit available");
123 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
125 arm7_9
->wp_available
--;
127 /* pick a breakpoint unit */
128 if (!arm7_9
->wp0_used
) {
129 arm7_9
->sw_breakpoints_added
= 1;
130 arm7_9
->wp0_used
= 3;
131 } else if (!arm7_9
->wp1_used
) {
132 arm7_9
->sw_breakpoints_added
= 2;
133 arm7_9
->wp1_used
= 3;
135 LOG_ERROR("BUG: both watchpoints used, but wp_available >= 1");
139 if (arm7_9
->sw_breakpoints_added
== 1) {
140 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_VALUE
], arm7_9
->arm_bkpt
);
141 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
], 0x0);
142 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
], 0xffffffffu
);
143 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
], ~EICE_W_CTRL_nOPC
& 0xff);
144 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], EICE_W_CTRL_ENABLE
);
145 } else if (arm7_9
->sw_breakpoints_added
== 2) {
146 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_DATA_VALUE
], arm7_9
->arm_bkpt
);
147 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_DATA_MASK
], 0x0);
148 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_MASK
], 0xffffffffu
);
149 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_MASK
], ~EICE_W_CTRL_nOPC
& 0xff);
150 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
], EICE_W_CTRL_ENABLE
);
152 LOG_ERROR("BUG: both watchpoints used, but wp_available >= 1");
155 LOG_DEBUG("SW BP using hw wp: %d",
156 arm7_9
->sw_breakpoints_added
);
158 return jtag_execute_queue();
162 * Setup the common pieces for an ARM7/9 target after reset or on startup.
164 * @param target Pointer to an ARM7/9 target to setup
165 * @return Result of clearing the watchpoints on the target
167 static int arm7_9_setup(struct target
*target
)
169 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
171 return arm7_9_clear_watchpoints(arm7_9
);
175 * Set either a hardware or software breakpoint on an ARM7/9 target. The
176 * breakpoint is set up even if it is already set. Some actions, e.g. reset,
177 * might have erased the values in Embedded ICE.
179 * @param target Pointer to the target device to set the breakpoints on
180 * @param breakpoint Pointer to the breakpoint to be set
181 * @return For hardware breakpoints, this is the result of executing the JTAG
182 * queue. For software breakpoints, this will be the status of the
183 * required memory reads and writes
185 static int arm7_9_set_breakpoint(struct target
*target
, struct breakpoint
*breakpoint
)
187 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
188 int retval
= ERROR_OK
;
190 LOG_DEBUG("BPID: %" PRId32
", Address: 0x%08" PRIx32
", Type: %d",
191 breakpoint
->unique_id
,
195 if (target
->state
!= TARGET_HALTED
) {
196 LOG_WARNING("target not halted");
197 return ERROR_TARGET_NOT_HALTED
;
200 if (breakpoint
->type
== BKPT_HARD
) {
201 /* either an ARM (4 byte) or Thumb (2 byte) breakpoint */
202 uint32_t mask
= (breakpoint
->length
== 4) ? 0x3u
: 0x1u
;
204 /* reassign a hw breakpoint */
205 if (breakpoint
->set
== 0)
206 arm7_9_assign_wp(arm7_9
, breakpoint
);
208 if (breakpoint
->set
== 1) {
209 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_VALUE
], breakpoint
->address
);
210 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
], mask
);
211 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
], 0xffffffffu
);
212 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
], ~EICE_W_CTRL_nOPC
& 0xff);
213 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], EICE_W_CTRL_ENABLE
);
214 } else if (breakpoint
->set
== 2) {
215 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_VALUE
], breakpoint
->address
);
216 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_MASK
], mask
);
217 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_DATA_MASK
], 0xffffffffu
);
218 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_MASK
], ~EICE_W_CTRL_nOPC
& 0xff);
219 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
], EICE_W_CTRL_ENABLE
);
221 LOG_ERROR("BUG: no hardware comparator available");
225 retval
= jtag_execute_queue();
226 } else if (breakpoint
->type
== BKPT_SOFT
) {
227 /* did we already set this breakpoint? */
231 if (breakpoint
->length
== 4) {
232 uint32_t verify
= 0xffffffff;
233 /* keep the original instruction in target endianness */
234 retval
= target_read_memory(target
, breakpoint
->address
, 4, 1, breakpoint
->orig_instr
);
235 if (retval
!= ERROR_OK
)
237 /* write the breakpoint instruction in target
238 * endianness (arm7_9->arm_bkpt is host endian) */
239 retval
= target_write_u32(target
, breakpoint
->address
, arm7_9
->arm_bkpt
);
240 if (retval
!= ERROR_OK
)
243 retval
= target_read_u32(target
, breakpoint
->address
, &verify
);
244 if (retval
!= ERROR_OK
)
246 if (verify
!= arm7_9
->arm_bkpt
) {
247 LOG_ERROR("Unable to set 32 bit software breakpoint at address %08" PRIx32
248 " - check that memory is read/writable", breakpoint
->address
);
252 uint16_t verify
= 0xffff;
253 /* keep the original instruction in target endianness */
254 retval
= target_read_memory(target
, breakpoint
->address
, 2, 1, breakpoint
->orig_instr
);
255 if (retval
!= ERROR_OK
)
257 /* write the breakpoint instruction in target
258 * endianness (arm7_9->thumb_bkpt is host endian) */
259 retval
= target_write_u16(target
, breakpoint
->address
, arm7_9
->thumb_bkpt
);
260 if (retval
!= ERROR_OK
)
263 retval
= target_read_u16(target
, breakpoint
->address
, &verify
);
264 if (retval
!= ERROR_OK
)
266 if (verify
!= arm7_9
->thumb_bkpt
) {
267 LOG_ERROR("Unable to set thumb software breakpoint at address %08" PRIx32
268 " - check that memory is read/writable", breakpoint
->address
);
273 retval
= arm7_9_set_software_breakpoints(arm7_9
);
274 if (retval
!= ERROR_OK
)
277 arm7_9
->sw_breakpoint_count
++;
286 * Unsets an existing breakpoint on an ARM7/9 target. If it is a hardware
287 * breakpoint, the watchpoint used will be freed and the Embedded ICE registers
288 * will be updated. Otherwise, the software breakpoint will be restored to its
289 * original instruction if it hasn't already been modified.
291 * @param target Pointer to ARM7/9 target to unset the breakpoint from
292 * @param breakpoint Pointer to breakpoint to be unset
293 * @return For hardware breakpoints, this is the result of executing the JTAG
294 * queue. For software breakpoints, this will be the status of the
295 * required memory reads and writes
297 static int arm7_9_unset_breakpoint(struct target
*target
, struct breakpoint
*breakpoint
)
299 int retval
= ERROR_OK
;
300 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
302 LOG_DEBUG("BPID: %" PRId32
", Address: 0x%08" PRIx32
,
303 breakpoint
->unique_id
,
304 breakpoint
->address
);
306 if (!breakpoint
->set
) {
307 LOG_WARNING("breakpoint not set");
311 if (breakpoint
->type
== BKPT_HARD
) {
312 LOG_DEBUG("BPID: %" PRId32
" Releasing hw wp: %d",
313 breakpoint
->unique_id
,
315 if (breakpoint
->set
== 1) {
316 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], 0x0);
317 arm7_9
->wp0_used
= 0;
318 arm7_9
->wp_available
++;
319 } else if (breakpoint
->set
== 2) {
320 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
], 0x0);
321 arm7_9
->wp1_used
= 0;
322 arm7_9
->wp_available
++;
324 retval
= jtag_execute_queue();
327 /* restore original instruction (kept in target endianness) */
328 if (breakpoint
->length
== 4) {
329 uint32_t current_instr
;
330 /* check that user program as not modified breakpoint instruction */
331 retval
= target_read_memory(target
,
332 breakpoint
->address
, 4, 1, (uint8_t *)¤t_instr
);
333 if (retval
!= ERROR_OK
)
335 current_instr
= target_buffer_get_u32(target
, (uint8_t *)¤t_instr
);
336 if (current_instr
== arm7_9
->arm_bkpt
) {
337 retval
= target_write_memory(target
,
338 breakpoint
->address
, 4, 1, breakpoint
->orig_instr
);
339 if (retval
!= ERROR_OK
)
344 uint16_t current_instr
;
345 /* check that user program as not modified breakpoint instruction */
346 retval
= target_read_memory(target
,
347 breakpoint
->address
, 2, 1, (uint8_t *)¤t_instr
);
348 if (retval
!= ERROR_OK
)
350 current_instr
= target_buffer_get_u16(target
, (uint8_t *)¤t_instr
);
351 if (current_instr
== arm7_9
->thumb_bkpt
) {
352 retval
= target_write_memory(target
,
353 breakpoint
->address
, 2, 1, breakpoint
->orig_instr
);
354 if (retval
!= ERROR_OK
)
359 if (--arm7_9
->sw_breakpoint_count
== 0) {
360 /* We have removed the last sw breakpoint, clear the hw breakpoint we used
362 if (arm7_9
->sw_breakpoints_added
== 1)
363 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[
364 EICE_W0_CONTROL_VALUE
], 0);
365 else if (arm7_9
->sw_breakpoints_added
== 2)
366 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[
367 EICE_W1_CONTROL_VALUE
], 0);
377 * Add a breakpoint to an ARM7/9 target. This makes sure that there are no
378 * dangling breakpoints and that the desired breakpoint can be added.
380 * @param target Pointer to the target ARM7/9 device to add a breakpoint to
381 * @param breakpoint Pointer to the breakpoint to be added
382 * @return An error status if there is a problem adding the breakpoint or the
383 * result of setting the breakpoint
385 int arm7_9_add_breakpoint(struct target
*target
, struct breakpoint
*breakpoint
)
387 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
389 if (arm7_9
->breakpoint_count
== 0) {
390 /* make sure we don't have any dangling breakpoints. This is vital upon
391 * GDB connect/disconnect
393 arm7_9_clear_watchpoints(arm7_9
);
396 if ((breakpoint
->type
== BKPT_HARD
) && (arm7_9
->wp_available
< 1)) {
397 LOG_INFO("no watchpoint unit available for hardware breakpoint");
398 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
401 if ((breakpoint
->length
!= 2) && (breakpoint
->length
!= 4)) {
402 LOG_INFO("only breakpoints of two (Thumb) or four (ARM) bytes length supported");
403 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
406 if (breakpoint
->type
== BKPT_HARD
)
407 arm7_9_assign_wp(arm7_9
, breakpoint
);
409 arm7_9
->breakpoint_count
++;
411 return arm7_9_set_breakpoint(target
, breakpoint
);
415 * Removes a breakpoint from an ARM7/9 target. This will make sure there are no
416 * dangling breakpoints and updates available watchpoints if it is a hardware
419 * @param target Pointer to the target to have a breakpoint removed
420 * @param breakpoint Pointer to the breakpoint to be removed
421 * @return Error status if there was a problem unsetting the breakpoint or the
422 * watchpoints could not be cleared
424 int arm7_9_remove_breakpoint(struct target
*target
, struct breakpoint
*breakpoint
)
426 int retval
= ERROR_OK
;
427 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
429 retval
= arm7_9_unset_breakpoint(target
, breakpoint
);
430 if (retval
!= ERROR_OK
)
433 if (breakpoint
->type
== BKPT_HARD
)
434 arm7_9
->wp_available
++;
436 arm7_9
->breakpoint_count
--;
437 if (arm7_9
->breakpoint_count
== 0) {
438 /* make sure we don't have any dangling breakpoints */
439 retval
= arm7_9_clear_watchpoints(arm7_9
);
440 if (retval
!= ERROR_OK
)
448 * Sets a watchpoint for an ARM7/9 target in one of the watchpoint units. It is
449 * considered a bug to call this function when there are no available watchpoint
452 * @param target Pointer to an ARM7/9 target to set a watchpoint on
453 * @param watchpoint Pointer to the watchpoint to be set
454 * @return Error status if watchpoint set fails or the result of executing the
457 static int arm7_9_set_watchpoint(struct target
*target
, struct watchpoint
*watchpoint
)
459 int retval
= ERROR_OK
;
460 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
464 mask
= watchpoint
->length
- 1;
466 if (target
->state
!= TARGET_HALTED
) {
467 LOG_WARNING("target not halted");
468 return ERROR_TARGET_NOT_HALTED
;
471 if (watchpoint
->rw
== WPT_ACCESS
)
476 if (!arm7_9
->wp0_used
) {
477 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_VALUE
],
478 watchpoint
->address
);
479 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
], mask
);
480 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
],
482 if (watchpoint
->mask
!= 0xffffffffu
)
483 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_VALUE
],
485 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
],
486 0xff & ~EICE_W_CTRL_nOPC
& ~rw_mask
);
487 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
],
488 EICE_W_CTRL_ENABLE
| EICE_W_CTRL_nOPC
| (watchpoint
->rw
& 1));
490 retval
= jtag_execute_queue();
491 if (retval
!= ERROR_OK
)
494 arm7_9
->wp0_used
= 2;
495 } else if (!arm7_9
->wp1_used
) {
496 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_VALUE
],
497 watchpoint
->address
);
498 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_MASK
], mask
);
499 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_DATA_MASK
],
501 if (watchpoint
->mask
!= 0xffffffffu
)
502 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_DATA_VALUE
],
504 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_MASK
],
505 0xff & ~EICE_W_CTRL_nOPC
& ~rw_mask
);
506 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
],
507 EICE_W_CTRL_ENABLE
| EICE_W_CTRL_nOPC
| (watchpoint
->rw
& 1));
509 retval
= jtag_execute_queue();
510 if (retval
!= ERROR_OK
)
513 arm7_9
->wp1_used
= 2;
515 LOG_ERROR("BUG: no hardware comparator available");
523 * Unset an existing watchpoint and clear the used watchpoint unit.
525 * @param target Pointer to the target to have the watchpoint removed
526 * @param watchpoint Pointer to the watchpoint to be removed
527 * @return Error status while trying to unset the watchpoint or the result of
528 * executing the JTAG queue
530 static int arm7_9_unset_watchpoint(struct target
*target
, struct watchpoint
*watchpoint
)
532 int retval
= ERROR_OK
;
533 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
535 if (target
->state
!= TARGET_HALTED
) {
536 LOG_WARNING("target not halted");
537 return ERROR_TARGET_NOT_HALTED
;
540 if (!watchpoint
->set
) {
541 LOG_WARNING("breakpoint not set");
545 if (watchpoint
->set
== 1) {
546 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], 0x0);
547 retval
= jtag_execute_queue();
548 if (retval
!= ERROR_OK
)
550 arm7_9
->wp0_used
= 0;
551 } else if (watchpoint
->set
== 2) {
552 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
], 0x0);
553 retval
= jtag_execute_queue();
554 if (retval
!= ERROR_OK
)
556 arm7_9
->wp1_used
= 0;
564 * Add a watchpoint to an ARM7/9 target. If there are no watchpoint units
565 * available, an error response is returned.
567 * @param target Pointer to the ARM7/9 target to add a watchpoint to
568 * @param watchpoint Pointer to the watchpoint to be added
569 * @return Error status while trying to add the watchpoint
571 int arm7_9_add_watchpoint(struct target
*target
, struct watchpoint
*watchpoint
)
573 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
575 if (arm7_9
->wp_available
< 1)
576 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
578 if ((watchpoint
->length
!= 1) && (watchpoint
->length
!= 2) && (watchpoint
->length
!= 4))
579 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
581 arm7_9
->wp_available
--;
587 * Remove a watchpoint from an ARM7/9 target. The watchpoint will be unset and
588 * the used watchpoint unit will be reopened.
590 * @param target Pointer to the target to remove a watchpoint from
591 * @param watchpoint Pointer to the watchpoint to be removed
592 * @return Result of trying to unset the watchpoint
594 int arm7_9_remove_watchpoint(struct target
*target
, struct watchpoint
*watchpoint
)
596 int retval
= ERROR_OK
;
597 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
599 if (watchpoint
->set
) {
600 retval
= arm7_9_unset_watchpoint(target
, watchpoint
);
601 if (retval
!= ERROR_OK
)
605 arm7_9
->wp_available
++;
611 * Restarts the target by sending a RESTART instruction and moving the JTAG
612 * state to IDLE. This includes a timeout waiting for DBGACK and SYSCOMP to be
613 * asserted by the processor.
615 * @param target Pointer to target to issue commands to
616 * @return Error status if there is a timeout or a problem while executing the
619 int arm7_9_execute_sys_speed(struct target
*target
)
622 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
623 struct arm_jtag
*jtag_info
= &arm7_9
->jtag_info
;
624 struct reg
*dbg_stat
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_STAT
];
626 /* set RESTART instruction */
627 if (arm7_9
->need_bypass_before_restart
) {
628 arm7_9
->need_bypass_before_restart
= 0;
629 retval
= arm_jtag_set_instr(jtag_info
->tap
, 0xf, NULL
, TAP_IDLE
);
630 if (retval
!= ERROR_OK
)
633 retval
= arm_jtag_set_instr(jtag_info
->tap
, 0x4, NULL
, TAP_IDLE
);
634 if (retval
!= ERROR_OK
)
637 int64_t then
= timeval_ms();
639 while (!(timeout
= ((timeval_ms()-then
) > 1000))) {
640 /* read debug status register */
641 embeddedice_read_reg(dbg_stat
);
642 retval
= jtag_execute_queue();
643 if (retval
!= ERROR_OK
)
645 if ((buf_get_u32(dbg_stat
->value
, EICE_DBG_STATUS_DBGACK
, 1))
646 && (buf_get_u32(dbg_stat
->value
, EICE_DBG_STATUS_SYSCOMP
, 1)))
648 if (debug_level
>= 3)
654 LOG_ERROR("timeout waiting for SYSCOMP & DBGACK, last DBG_STATUS: %" PRIx32
"",
655 buf_get_u32(dbg_stat
->value
, 0, dbg_stat
->size
));
656 return ERROR_TARGET_TIMEOUT
;
663 * Restarts the target by sending a RESTART instruction and moving the JTAG
664 * state to IDLE. This validates that DBGACK and SYSCOMP are set without
665 * waiting until they are.
667 * @param target Pointer to the target to issue commands to
668 * @return Always ERROR_OK
670 static int arm7_9_execute_fast_sys_speed(struct target
*target
)
673 static uint8_t check_value
[4], check_mask
[4];
675 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
676 struct arm_jtag
*jtag_info
= &arm7_9
->jtag_info
;
677 struct reg
*dbg_stat
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_STAT
];
680 /* set RESTART instruction */
681 if (arm7_9
->need_bypass_before_restart
) {
682 arm7_9
->need_bypass_before_restart
= 0;
683 retval
= arm_jtag_set_instr(jtag_info
->tap
, 0xf, NULL
, TAP_IDLE
);
684 if (retval
!= ERROR_OK
)
687 retval
= arm_jtag_set_instr(jtag_info
->tap
, 0x4, NULL
, TAP_IDLE
);
688 if (retval
!= ERROR_OK
)
692 /* check for DBGACK and SYSCOMP set (others don't care) */
694 /* NB! These are constants that must be available until after next jtag_execute() and
695 * we evaluate the values upon first execution in lieu of setting up these constants
696 * during early setup.
698 buf_set_u32(check_value
, 0, 32, 0x9);
699 buf_set_u32(check_mask
, 0, 32, 0x9);
703 /* read debug status register */
704 embeddedice_read_reg_w_check(dbg_stat
, check_value
, check_mask
);
710 * Get some data from the ARM7/9 target.
712 * @param target Pointer to the ARM7/9 target to read data from
713 * @param size The number of 32bit words to be read
714 * @param buffer Pointer to the buffer that will hold the data
715 * @return The result of receiving data from the Embedded ICE unit
717 int arm7_9_target_request_data(struct target
*target
, uint32_t size
, uint8_t *buffer
)
719 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
720 struct arm_jtag
*jtag_info
= &arm7_9
->jtag_info
;
722 int retval
= ERROR_OK
;
725 data
= malloc(size
* (sizeof(uint32_t)));
727 retval
= embeddedice_receive(jtag_info
, data
, size
);
729 /* return the 32-bit ints in the 8-bit array */
730 for (i
= 0; i
< size
; i
++)
731 h_u32_to_le(buffer
+ (i
* 4), data
[i
]);
739 * Handles requests to an ARM7/9 target. If debug messaging is enabled, the
740 * target is running and the DCC control register has the W bit high, this will
741 * execute the request on the target.
743 * @param priv Void pointer expected to be a struct target pointer
744 * @return ERROR_OK unless there are issues with the JTAG queue or when reading
745 * from the Embedded ICE unit
747 static int arm7_9_handle_target_request(void *priv
)
749 int retval
= ERROR_OK
;
750 struct target
*target
= priv
;
751 if (!target_was_examined(target
))
753 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
754 struct arm_jtag
*jtag_info
= &arm7_9
->jtag_info
;
755 struct reg
*dcc_control
= &arm7_9
->eice_cache
->reg_list
[EICE_COMMS_CTRL
];
757 if (!target
->dbg_msg_enabled
)
760 if (target
->state
== TARGET_RUNNING
) {
761 /* read DCC control register */
762 embeddedice_read_reg(dcc_control
);
763 retval
= jtag_execute_queue();
764 if (retval
!= ERROR_OK
)
768 if (buf_get_u32(dcc_control
->value
, 1, 1) == 1) {
771 retval
= embeddedice_receive(jtag_info
, &request
, 1);
772 if (retval
!= ERROR_OK
)
774 retval
= target_request(target
, request
);
775 if (retval
!= ERROR_OK
)
784 * Polls an ARM7/9 target for its current status. If DBGACK is set, the target
785 * is manipulated to the right halted state based on its current state. This is
789 * <tr><th > State</th><th > Action</th></tr>
790 * <tr><td > TARGET_RUNNING | TARGET_RESET</td>
791 * <td > Enters debug mode. If TARGET_RESET, pc may be checked</td></tr>
792 * <tr><td > TARGET_UNKNOWN</td><td > Warning is logged</td></tr>
793 * <tr><td > TARGET_DEBUG_RUNNING</td><td > Enters debug mode</td></tr>
794 * <tr><td > TARGET_HALTED</td><td > Nothing</td></tr>
797 * If the target does not end up in the halted state, a warning is produced. If
798 * DBGACK is cleared, then the target is expected to either be running or
801 * @param target Pointer to the ARM7/9 target to poll
802 * @return ERROR_OK or an error status if a command fails
804 int arm7_9_poll(struct target
*target
)
807 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
808 struct reg
*dbg_stat
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_STAT
];
810 /* read debug status register */
811 embeddedice_read_reg(dbg_stat
);
812 retval
= jtag_execute_queue();
813 if (retval
!= ERROR_OK
)
816 if (buf_get_u32(dbg_stat
->value
, EICE_DBG_STATUS_DBGACK
, 1)) {
817 /* LOG_DEBUG("DBGACK set, dbg_state->value: 0x%x", buf_get_u32(dbg_stat->value, 0, *32));*/
818 if (target
->state
== TARGET_UNKNOWN
) {
819 /* Starting OpenOCD with target in debug-halt */
820 target
->state
= TARGET_RUNNING
;
821 LOG_DEBUG("DBGACK already set during server startup.");
823 if ((target
->state
== TARGET_RUNNING
) || (target
->state
== TARGET_RESET
)) {
824 target
->state
= TARGET_HALTED
;
826 retval
= arm7_9_debug_entry(target
);
827 if (retval
!= ERROR_OK
)
830 if (arm_semihosting(target
, &retval
) != 0)
833 retval
= target_call_event_callbacks(target
, TARGET_EVENT_HALTED
);
834 if (retval
!= ERROR_OK
)
837 if (target
->state
== TARGET_DEBUG_RUNNING
) {
838 target
->state
= TARGET_HALTED
;
839 retval
= arm7_9_debug_entry(target
);
840 if (retval
!= ERROR_OK
)
843 retval
= target_call_event_callbacks(target
, TARGET_EVENT_DEBUG_HALTED
);
844 if (retval
!= ERROR_OK
)
847 if (target
->state
!= TARGET_HALTED
)
849 "DBGACK set, but the target did not end up in the halted state %d",
852 if (target
->state
!= TARGET_DEBUG_RUNNING
)
853 target
->state
= TARGET_RUNNING
;
860 * Asserts the reset (SRST) on an ARM7/9 target. Some -S targets (ARM966E-S in
861 * the STR912 isn't affected, ARM926EJ-S in the LPC3180 and AT91SAM9260 is
862 * affected) completely stop the JTAG clock while the core is held in reset
863 * (SRST). It isn't possible to program the halt condition once reset is
864 * asserted, hence a hook that allows the target to set up its reset-halt
865 * condition is setup prior to asserting reset.
867 * @param target Pointer to an ARM7/9 target to assert reset on
868 * @return ERROR_FAIL if the JTAG device does not have SRST, otherwise ERROR_OK
870 int arm7_9_assert_reset(struct target
*target
)
872 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
873 enum reset_types jtag_reset_config
= jtag_get_reset_config();
874 bool use_event
= false;
876 /* TODO: apply hw reset signal in not examined state */
877 if (!(target_was_examined(target
))) {
878 LOG_WARNING("Reset is not asserted because the target is not examined.");
879 LOG_WARNING("Use a reset button or power cycle the target.");
880 return ERROR_TARGET_NOT_EXAMINED
;
883 LOG_DEBUG("target->state: %s", target_state_name(target
));
885 if (target_has_event_action(target
, TARGET_EVENT_RESET_ASSERT
))
887 else if (!(jtag_reset_config
& RESET_HAS_SRST
)) {
888 LOG_ERROR("%s: how to reset?", target_name(target
));
892 /* At this point trst has been asserted/deasserted once. We would
893 * like to program EmbeddedICE while SRST is asserted, instead of
894 * depending on SRST to leave that module alone. However, many CPUs
895 * gate the JTAG clock while SRST is asserted; or JTAG may need
896 * clock stability guarantees (adaptive clocking might help).
898 * So we assume JTAG access during SRST is off the menu unless it's
899 * been specifically enabled.
901 bool srst_asserted
= false;
903 if (!use_event
&& !(jtag_reset_config
& RESET_SRST_PULLS_TRST
)
904 && (jtag_reset_config
& RESET_SRST_NO_GATING
)) {
905 jtag_add_reset(0, 1);
906 srst_asserted
= true;
909 if (target
->reset_halt
) {
911 * For targets that don't support communication while SRST is
912 * asserted, we need to set up the reset vector catch first.
914 * When we use TRST+SRST and that's equivalent to a power-up
915 * reset, these settings may well be reset anyway; so setting
916 * them here won't matter.
918 if (arm7_9
->has_vector_catch
) {
919 /* program vector catch register to catch reset */
920 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_VEC_CATCH
], 0x1);
922 /* extra runtest added as issues were found with
923 * certain ARM9 cores (maybe more) - AT91SAM9260
926 jtag_add_runtest(1, TAP_IDLE
);
928 /* program watchpoint unit to match on reset vector
931 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_VALUE
], 0x0);
932 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
], 0x3);
933 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
], 0xffffffff);
934 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], EICE_W_CTRL_ENABLE
);
935 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
], ~EICE_W_CTRL_nOPC
& 0xff);
940 target_handle_event(target
, TARGET_EVENT_RESET_ASSERT
);
942 /* If we use SRST ... we'd like to issue just SRST, but the
943 * board or chip may be set up so we have to assert TRST as
944 * well. On some chips that combination is equivalent to a
945 * power-up reset, and generally clobbers EICE state.
947 if (jtag_reset_config
& RESET_SRST_PULLS_TRST
)
948 jtag_add_reset(1, 1);
949 else if (!srst_asserted
)
950 jtag_add_reset(0, 1);
951 jtag_add_sleep(50000);
954 target
->state
= TARGET_RESET
;
955 register_cache_invalidate(arm7_9
->arm
.core_cache
);
957 /* REVISIT why isn't standard debug entry logic sufficient?? */
958 if (target
->reset_halt
&& (!(jtag_reset_config
& RESET_SRST_PULLS_TRST
) || use_event
)) {
959 /* debug entry was prepared above */
960 target
->debug_reason
= DBG_REASON_DBGRQ
;
967 * Deassert the reset (SRST) signal on an ARM7/9 target. If SRST pulls TRST
968 * and the target is being reset into a halt, a warning will be triggered
969 * because it is not possible to reset into a halted mode in this case. The
970 * target is halted using the target's functions.
972 * @param target Pointer to the target to have the reset deasserted
973 * @return ERROR_OK or an error from polling or halting the target
975 int arm7_9_deassert_reset(struct target
*target
)
977 int retval
= ERROR_OK
;
978 LOG_DEBUG("target->state: %s", target_state_name(target
));
980 /* deassert reset lines */
981 jtag_add_reset(0, 0);
983 /* In case polling is disabled, we need to examine the
984 * target and poll here for this target to work correctly.
986 * Otherwise, e.g. halt will fail afterwards with bogus
987 * error messages as halt will believe that reset is
990 retval
= target_examine_one(target
);
991 if (retval
!= ERROR_OK
)
994 retval
= target_poll(target
);
995 if (retval
!= ERROR_OK
)
998 enum reset_types jtag_reset_config
= jtag_get_reset_config();
999 if (target
->reset_halt
&& (jtag_reset_config
& RESET_SRST_PULLS_TRST
) != 0) {
1001 "srst pulls trst - can not reset into halted mode. Issuing halt after reset.");
1002 retval
= target_halt(target
);
1003 if (retval
!= ERROR_OK
)
1010 * Clears the halt condition for an ARM7/9 target. If it isn't coming out of
1011 * reset and if DBGRQ is used, it is progammed to be deasserted. If the reset
1012 * vector catch was used, it is restored. Otherwise, the control value is
1013 * restored and the watchpoint unit is restored if it was in use.
1015 * @param target Pointer to the ARM7/9 target to have halt cleared
1016 * @return Always ERROR_OK
1018 static int arm7_9_clear_halt(struct target
*target
)
1020 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1021 struct reg
*dbg_ctrl
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_CTRL
];
1023 /* we used DBGRQ only if we didn't come out of reset */
1024 if (!arm7_9
->debug_entry_from_reset
&& arm7_9
->use_dbgrq
) {
1025 /* program EmbeddedICE Debug Control Register to deassert DBGRQ
1027 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGRQ
, 1, 0);
1028 embeddedice_store_reg(dbg_ctrl
);
1030 if (arm7_9
->debug_entry_from_reset
&& arm7_9
->has_vector_catch
) {
1031 /* if we came out of reset, and vector catch is supported, we used
1032 * vector catch to enter debug state
1033 * restore the register in that case
1035 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_VEC_CATCH
]);
1037 /* restore registers if watchpoint unit 0 was in use
1039 if (arm7_9
->wp0_used
) {
1040 if (arm7_9
->debug_entry_from_reset
)
1041 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[
1042 EICE_W0_ADDR_VALUE
]);
1043 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[
1044 EICE_W0_ADDR_MASK
]);
1045 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[
1046 EICE_W0_DATA_MASK
]);
1047 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[
1048 EICE_W0_CONTROL_MASK
]);
1050 /* control value always has to be restored, as it was either disabled,
1051 * or enabled with possibly different bits
1053 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
]);
1061 * Issue a software reset and halt to an ARM7/9 target. The target is halted
1062 * and then there is a wait until the processor shows the halt. This wait can
1063 * timeout and results in an error being returned. The software reset involves
1064 * clearing the halt, updating the debug control register, changing to ARM mode,
1065 * reset of the program counter, and reset of all of the registers.
1067 * @param target Pointer to the ARM7/9 target to be reset and halted by software
1068 * @return Error status if any of the commands fail, otherwise ERROR_OK
1070 int arm7_9_soft_reset_halt(struct target
*target
)
1072 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1073 struct arm
*arm
= &arm7_9
->arm
;
1074 struct reg
*dbg_stat
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_STAT
];
1075 struct reg
*dbg_ctrl
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_CTRL
];
1079 /* FIX!!! replace some of this code with tcl commands
1081 * halt # the halt command is synchronous
1082 * armv4_5 core_state arm
1086 retval
= target_halt(target
);
1087 if (retval
!= ERROR_OK
)
1090 long long then
= timeval_ms();
1092 while (!(timeout
= ((timeval_ms()-then
) > 1000))) {
1093 if (buf_get_u32(dbg_stat
->value
, EICE_DBG_STATUS_DBGACK
, 1) != 0)
1095 embeddedice_read_reg(dbg_stat
);
1096 retval
= jtag_execute_queue();
1097 if (retval
!= ERROR_OK
)
1099 if (debug_level
>= 3)
1105 LOG_ERROR("Failed to halt CPU after 1 sec");
1106 return ERROR_TARGET_TIMEOUT
;
1108 target
->state
= TARGET_HALTED
;
1110 /* program EmbeddedICE Debug Control Register to assert DBGACK and INTDIS
1111 * ensure that DBGRQ is cleared
1113 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGACK
, 1, 1);
1114 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGRQ
, 1, 0);
1115 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_INTDIS
, 1, 1);
1116 embeddedice_store_reg(dbg_ctrl
);
1118 retval
= arm7_9_clear_halt(target
);
1119 if (retval
!= ERROR_OK
)
1122 /* if the target is in Thumb state, change to ARM state */
1123 if (buf_get_u32(dbg_stat
->value
, EICE_DBG_STATUS_ITBIT
, 1)) {
1124 uint32_t r0_thumb
, pc_thumb
;
1125 LOG_DEBUG("target entered debug from Thumb state, changing to ARM");
1126 /* Entered debug from Thumb mode */
1127 arm
->core_state
= ARM_STATE_THUMB
;
1128 arm7_9
->change_to_arm(target
, &r0_thumb
, &pc_thumb
);
1131 /* REVISIT likewise for bit 5 -- switch Jazelle-to-ARM */
1133 /* all register content is now invalid */
1134 register_cache_invalidate(arm
->core_cache
);
1136 /* SVC, ARM state, IRQ and FIQ disabled */
1139 cpsr
= buf_get_u32(arm
->cpsr
->value
, 0, 32);
1142 arm_set_cpsr(arm
, cpsr
);
1143 arm
->cpsr
->dirty
= 1;
1145 /* start fetching from 0x0 */
1146 buf_set_u32(arm
->pc
->value
, 0, 32, 0x0);
1150 /* reset registers */
1151 for (i
= 0; i
<= 14; i
++) {
1152 struct reg
*r
= arm_reg_current(arm
, i
);
1154 buf_set_u32(r
->value
, 0, 32, 0xffffffff);
1159 retval
= target_call_event_callbacks(target
, TARGET_EVENT_HALTED
);
1160 if (retval
!= ERROR_OK
)
1167 * Halt an ARM7/9 target. This is accomplished by either asserting the DBGRQ
1168 * line or by programming a watchpoint to trigger on any address. It is
1169 * considered a bug to call this function while the target is in the
1170 * TARGET_RESET state.
1172 * @param target Pointer to the ARM7/9 target to be halted
1173 * @return Always ERROR_OK
1175 int arm7_9_halt(struct target
*target
)
1177 if (target
->state
== TARGET_RESET
) {
1179 "BUG: arm7/9 does not support halt during reset. This is handled in arm7_9_assert_reset()");
1183 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1184 struct reg
*dbg_ctrl
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_CTRL
];
1186 LOG_DEBUG("target->state: %s",
1187 target_state_name(target
));
1189 if (target
->state
== TARGET_HALTED
) {
1190 LOG_DEBUG("target was already halted");
1194 if (target
->state
== TARGET_UNKNOWN
)
1195 LOG_WARNING("target was in unknown state when halt was requested");
1197 if (arm7_9
->use_dbgrq
) {
1198 /* program EmbeddedICE Debug Control Register to assert DBGRQ
1200 if (arm7_9
->set_special_dbgrq
)
1201 arm7_9
->set_special_dbgrq(target
);
1203 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGRQ
, 1, 1);
1204 embeddedice_store_reg(dbg_ctrl
);
1207 /* program watchpoint unit to match on any address
1209 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
], 0xffffffff);
1210 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
], 0xffffffff);
1211 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
],
1212 EICE_W_CTRL_ENABLE
);
1213 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
],
1214 ~EICE_W_CTRL_nOPC
& 0xff);
1217 target
->debug_reason
= DBG_REASON_DBGRQ
;
1223 * Handle an ARM7/9 target's entry into debug mode. The halt is cleared on the
1224 * ARM. The JTAG queue is then executed and the reason for debug entry is
1225 * examined. Once done, the target is verified to be halted and the processor
1226 * is forced into ARM mode. The core registers are saved for the current core
1227 * mode and the program counter (register 15) is updated as needed. The core
1228 * registers and CPSR and SPSR are saved for restoration later.
1230 * @param target Pointer to target that is entering debug mode
1231 * @return Error code if anything fails, otherwise ERROR_OK
1233 static int arm7_9_debug_entry(struct target
*target
)
1236 uint32_t context
[16];
1237 uint32_t *context_p
[16];
1238 uint32_t r0_thumb
, pc_thumb
;
1239 uint32_t cpsr
, cpsr_mask
= 0;
1241 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1242 struct arm
*arm
= &arm7_9
->arm
;
1243 struct reg
*dbg_stat
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_STAT
];
1244 struct reg
*dbg_ctrl
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_CTRL
];
1246 #ifdef _DEBUG_ARM7_9_
1250 /* program EmbeddedICE Debug Control Register to assert DBGACK and INTDIS
1251 * ensure that DBGRQ is cleared
1253 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGACK
, 1, 1);
1254 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGRQ
, 1, 0);
1255 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_INTDIS
, 1, 1);
1256 embeddedice_store_reg(dbg_ctrl
);
1258 retval
= arm7_9_clear_halt(target
);
1259 if (retval
!= ERROR_OK
)
1262 retval
= jtag_execute_queue();
1263 if (retval
!= ERROR_OK
)
1266 retval
= arm7_9
->examine_debug_reason(target
);
1267 if (retval
!= ERROR_OK
)
1270 if (target
->state
!= TARGET_HALTED
) {
1271 LOG_WARNING("target not halted");
1272 return ERROR_TARGET_NOT_HALTED
;
1275 /* if the target is in Thumb state, change to ARM state */
1276 if (buf_get_u32(dbg_stat
->value
, EICE_DBG_STATUS_ITBIT
, 1)) {
1277 LOG_DEBUG("target entered debug from Thumb state");
1278 /* Entered debug from Thumb mode */
1279 arm
->core_state
= ARM_STATE_THUMB
;
1281 arm7_9
->change_to_arm(target
, &r0_thumb
, &pc_thumb
);
1282 LOG_DEBUG("r0_thumb: 0x%8.8" PRIx32
1283 ", pc_thumb: 0x%8.8" PRIx32
, r0_thumb
, pc_thumb
);
1284 } else if (buf_get_u32(dbg_stat
->value
, 5, 1)) {
1285 /* \todo Get some vaguely correct handling of Jazelle, if
1286 * anyone ever uses it and full info becomes available.
1287 * See ARM9EJS TRM B.7.1 for how to switch J->ARM; and
1288 * B.7.3 for the reverse. That'd be the bare minimum...
1290 LOG_DEBUG("target entered debug from Jazelle state");
1291 arm
->core_state
= ARM_STATE_JAZELLE
;
1292 cpsr_mask
= 1 << 24;
1293 LOG_ERROR("Jazelle debug entry -- BROKEN!");
1295 LOG_DEBUG("target entered debug from ARM state");
1296 /* Entered debug from ARM mode */
1297 arm
->core_state
= ARM_STATE_ARM
;
1300 for (i
= 0; i
< 16; i
++)
1301 context_p
[i
] = &context
[i
];
1302 /* save core registers (r0 - r15 of current core mode) */
1303 arm7_9
->read_core_regs(target
, 0xffff, context_p
);
1305 arm7_9
->read_xpsr(target
, &cpsr
, 0);
1307 retval
= jtag_execute_queue();
1308 if (retval
!= ERROR_OK
)
1311 /* Sync our CPSR copy with J or T bits EICE reported, but
1312 * which we then erased by putting the core into ARM mode.
1314 arm_set_cpsr(arm
, cpsr
| cpsr_mask
);
1316 if (!is_arm_mode(arm
->core_mode
)) {
1317 target
->state
= TARGET_UNKNOWN
;
1318 LOG_ERROR("cpsr contains invalid mode value - communication failure");
1319 return ERROR_TARGET_FAILURE
;
1322 LOG_DEBUG("target entered debug state in %s mode",
1323 arm_mode_name(arm
->core_mode
));
1325 if (arm
->core_state
== ARM_STATE_THUMB
) {
1326 LOG_DEBUG("thumb state, applying fixups");
1327 context
[0] = r0_thumb
;
1328 context
[15] = pc_thumb
;
1329 } else if (arm
->core_state
== ARM_STATE_ARM
) {
1330 /* adjust value stored by STM */
1331 context
[15] -= 3 * 4;
1334 if ((target
->debug_reason
!= DBG_REASON_DBGRQ
) || (!arm7_9
->use_dbgrq
))
1335 context
[15] -= 3 * ((arm
->core_state
== ARM_STATE_ARM
) ? 4 : 2);
1337 context
[15] -= arm7_9
->dbgreq_adjust_pc
*
1338 ((arm
->core_state
== ARM_STATE_ARM
) ? 4 : 2);
1340 for (i
= 0; i
<= 15; i
++) {
1341 struct reg
*r
= arm_reg_current(arm
, i
);
1343 LOG_DEBUG("r%i: 0x%8.8" PRIx32
"", i
, context
[i
]);
1345 buf_set_u32(r
->value
, 0, 32, context
[i
]);
1346 /* r0 and r15 (pc) have to be restored later */
1347 r
->dirty
= (i
== 0) || (i
== 15);
1351 LOG_DEBUG("entered debug state at PC 0x%" PRIx32
"", context
[15]);
1353 /* exceptions other than USR & SYS have a saved program status register */
1356 arm7_9
->read_xpsr(target
, &spsr
, 1);
1357 retval
= jtag_execute_queue();
1358 if (retval
!= ERROR_OK
)
1360 buf_set_u32(arm
->spsr
->value
, 0, 32, spsr
);
1361 arm
->spsr
->dirty
= 0;
1362 arm
->spsr
->valid
= 1;
1365 retval
= jtag_execute_queue();
1366 if (retval
!= ERROR_OK
)
1369 if (arm7_9
->post_debug_entry
) {
1370 retval
= arm7_9
->post_debug_entry(target
);
1371 if (retval
!= ERROR_OK
)
1379 * Validate the full context for an ARM7/9 target in all processor modes. If
1380 * there are any invalid registers for the target, they will all be read. This
1383 * @param target Pointer to the ARM7/9 target to capture the full context from
1384 * @return Error if the target is not halted, has an invalid core mode, or if
1385 * the JTAG queue fails to execute
1387 static int arm7_9_full_context(struct target
*target
)
1391 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1392 struct arm
*arm
= &arm7_9
->arm
;
1396 if (target
->state
!= TARGET_HALTED
) {
1397 LOG_WARNING("target not halted");
1398 return ERROR_TARGET_NOT_HALTED
;
1401 if (!is_arm_mode(arm
->core_mode
)) {
1402 LOG_ERROR("not a valid arm core mode - communication failure?");
1406 /* iterate through processor modes (User, FIQ, IRQ, SVC, ABT, UND)
1407 * SYS shares registers with User, so we don't touch SYS
1409 for (i
= 0; i
< 6; i
++) {
1411 uint32_t *reg_p
[16];
1415 /* check if there are invalid registers in the current mode
1417 for (j
= 0; j
<= 16; j
++) {
1418 if (ARMV4_5_CORE_REG_MODE(arm
->core_cache
, armv4_5_number_to_mode(i
), j
).valid
== 0)
1425 /* change processor mode (and mask T bit) */
1426 tmp_cpsr
= buf_get_u32(arm
->cpsr
->value
, 0, 8)
1428 tmp_cpsr
|= armv4_5_number_to_mode(i
);
1430 arm7_9
->write_xpsr_im8(target
, tmp_cpsr
& 0xff, 0, 0);
1432 for (j
= 0; j
< 15; j
++) {
1433 if (ARMV4_5_CORE_REG_MODE(arm
->core_cache
,
1434 armv4_5_number_to_mode(i
), j
).valid
== 0) {
1435 reg_p
[j
] = (uint32_t *)ARMV4_5_CORE_REG_MODE(
1437 armv4_5_number_to_mode(i
),
1440 ARMV4_5_CORE_REG_MODE(arm
->core_cache
,
1441 armv4_5_number_to_mode(i
),
1443 ARMV4_5_CORE_REG_MODE(arm
->core_cache
,
1444 armv4_5_number_to_mode(i
),
1449 /* if only the PSR is invalid, mask is all zeroes */
1451 arm7_9
->read_core_regs(target
, mask
, reg_p
);
1453 /* check if the PSR has to be read */
1454 if (ARMV4_5_CORE_REG_MODE(arm
->core_cache
, armv4_5_number_to_mode(i
),
1456 arm7_9
->read_xpsr(target
,
1457 (uint32_t *)ARMV4_5_CORE_REG_MODE(arm
->core_cache
,
1458 armv4_5_number_to_mode(i
), 16).value
, 1);
1459 ARMV4_5_CORE_REG_MODE(arm
->core_cache
, armv4_5_number_to_mode(i
),
1461 ARMV4_5_CORE_REG_MODE(arm
->core_cache
, armv4_5_number_to_mode(i
),
1467 /* restore processor mode (mask T bit) */
1468 arm7_9
->write_xpsr_im8(target
,
1469 buf_get_u32(arm
->cpsr
->value
, 0, 8) & ~0x20, 0, 0);
1471 retval
= jtag_execute_queue();
1472 if (retval
!= ERROR_OK
)
1478 * Restore the processor context on an ARM7/9 target. The full processor
1479 * context is analyzed to see if any of the registers are dirty on this end, but
1480 * have a valid new value. If this is the case, the processor is changed to the
1481 * appropriate mode and the new register values are written out to the
1482 * processor. If there happens to be a dirty register with an invalid value, an
1483 * error will be logged.
1485 * @param target Pointer to the ARM7/9 target to have its context restored
1486 * @return Error status if the target is not halted or the core mode in the
1487 * armv4_5 struct is invalid.
1489 static int arm7_9_restore_context(struct target
*target
)
1491 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1492 struct arm
*arm
= &arm7_9
->arm
;
1494 enum arm_mode current_mode
= arm
->core_mode
;
1501 if (target
->state
!= TARGET_HALTED
) {
1502 LOG_WARNING("target not halted");
1503 return ERROR_TARGET_NOT_HALTED
;
1506 if (arm7_9
->pre_restore_context
)
1507 arm7_9
->pre_restore_context(target
);
1509 if (!is_arm_mode(arm
->core_mode
)) {
1510 LOG_ERROR("not a valid arm core mode - communication failure?");
1514 /* iterate through processor modes (User, FIQ, IRQ, SVC, ABT, UND)
1515 * SYS shares registers with User, so we don't touch SYS
1517 for (i
= 0; i
< 6; i
++) {
1518 LOG_DEBUG("examining %s mode",
1519 arm_mode_name(arm
->core_mode
));
1522 /* check if there are dirty registers in the current mode
1524 for (j
= 0; j
<= 16; j
++) {
1525 reg
= &ARMV4_5_CORE_REG_MODE(arm
->core_cache
, armv4_5_number_to_mode(i
), j
);
1526 if (reg
->dirty
== 1) {
1527 if (reg
->valid
== 1) {
1529 LOG_DEBUG("examining dirty reg: %s", reg
->name
);
1530 struct arm_reg
*reg_arch_info
;
1531 reg_arch_info
= reg
->arch_info
;
1532 if ((reg_arch_info
->mode
!= ARM_MODE_ANY
)
1533 && (reg_arch_info
->mode
!= current_mode
)
1534 && !((reg_arch_info
->mode
== ARM_MODE_USR
)
1535 && (arm
->core_mode
== ARM_MODE_SYS
))
1536 && !((reg_arch_info
->mode
== ARM_MODE_SYS
)
1537 && (arm
->core_mode
== ARM_MODE_USR
))) {
1539 LOG_DEBUG("require mode change");
1542 LOG_ERROR("BUG: dirty register '%s', but no valid data",
1548 uint32_t mask
= 0x0;
1555 /* change processor mode (mask T bit) */
1556 tmp_cpsr
= buf_get_u32(arm
->cpsr
->value
,
1558 tmp_cpsr
|= armv4_5_number_to_mode(i
);
1560 arm7_9
->write_xpsr_im8(target
, tmp_cpsr
& 0xff, 0, 0);
1561 current_mode
= armv4_5_number_to_mode(i
);
1564 for (j
= 0; j
<= 14; j
++) {
1565 reg
= &ARMV4_5_CORE_REG_MODE(arm
->core_cache
,
1566 armv4_5_number_to_mode(i
),
1569 if (reg
->dirty
== 1) {
1570 regs
[j
] = buf_get_u32(reg
->value
, 0, 32);
1575 LOG_DEBUG("writing register %i mode %s "
1576 "with value 0x%8.8" PRIx32
, j
,
1577 arm_mode_name(arm
->core_mode
),
1583 arm7_9
->write_core_regs(target
, mask
, regs
);
1586 &ARMV4_5_CORE_REG_MODE(arm
->core_cache
, armv4_5_number_to_mode(
1588 struct arm_reg
*reg_arch_info
;
1589 reg_arch_info
= reg
->arch_info
;
1590 if ((reg
->dirty
) && (reg_arch_info
->mode
!= ARM_MODE_ANY
)) {
1591 LOG_DEBUG("writing SPSR of mode %i with value 0x%8.8" PRIx32
"",
1593 buf_get_u32(reg
->value
, 0, 32));
1594 arm7_9
->write_xpsr(target
, buf_get_u32(reg
->value
, 0, 32), 1);
1599 if (!arm
->cpsr
->dirty
&& (arm
->core_mode
!= current_mode
)) {
1600 /* restore processor mode (mask T bit) */
1603 tmp_cpsr
= buf_get_u32(arm
->cpsr
->value
, 0, 8) & 0xE0;
1604 tmp_cpsr
|= armv4_5_number_to_mode(i
);
1606 LOG_DEBUG("writing lower 8 bit of cpsr with value 0x%2.2x", (unsigned)(tmp_cpsr
));
1607 arm7_9
->write_xpsr_im8(target
, tmp_cpsr
& 0xff, 0, 0);
1609 } else if (arm
->cpsr
->dirty
) {
1610 /* CPSR has been changed, full restore necessary (mask T bit) */
1611 LOG_DEBUG("writing cpsr with value 0x%8.8" PRIx32
,
1612 buf_get_u32(arm
->cpsr
->value
, 0, 32));
1613 arm7_9
->write_xpsr(target
,
1614 buf_get_u32(arm
->cpsr
->value
, 0, 32)
1616 arm
->cpsr
->dirty
= 0;
1617 arm
->cpsr
->valid
= 1;
1621 LOG_DEBUG("writing PC with value 0x%8.8" PRIx32
,
1622 buf_get_u32(arm
->pc
->value
, 0, 32));
1623 arm7_9
->write_pc(target
, buf_get_u32(arm
->pc
->value
, 0, 32));
1630 * Restart the core of an ARM7/9 target. A RESTART command is sent to the
1631 * instruction register and the JTAG state is set to TAP_IDLE causing a core
1634 * @param target Pointer to the ARM7/9 target to be restarted
1635 * @return Result of executing the JTAG queue
1637 static int arm7_9_restart_core(struct target
*target
)
1639 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1640 struct arm_jtag
*jtag_info
= &arm7_9
->jtag_info
;
1643 /* set RESTART instruction */
1644 if (arm7_9
->need_bypass_before_restart
) {
1645 arm7_9
->need_bypass_before_restart
= 0;
1647 retval
= arm_jtag_set_instr(jtag_info
->tap
, 0xf, NULL
, TAP_IDLE
);
1648 if (retval
!= ERROR_OK
)
1651 retval
= arm_jtag_set_instr(jtag_info
->tap
, 0x4, NULL
, TAP_IDLE
);
1652 if (retval
!= ERROR_OK
)
1655 jtag_add_runtest(1, TAP_IDLE
);
1656 return jtag_execute_queue();
1660 * Enable the watchpoints on an ARM7/9 target. The target's watchpoints are
1661 * iterated through and are set on the target if they aren't already set.
1663 * @param target Pointer to the ARM7/9 target to enable watchpoints on
1665 static void arm7_9_enable_watchpoints(struct target
*target
)
1667 struct watchpoint
*watchpoint
= target
->watchpoints
;
1669 while (watchpoint
) {
1670 if (watchpoint
->set
== 0)
1671 arm7_9_set_watchpoint(target
, watchpoint
);
1672 watchpoint
= watchpoint
->next
;
1677 * Enable the breakpoints on an ARM7/9 target. The target's breakpoints are
1678 * iterated through and are set on the target.
1680 * @param target Pointer to the ARM7/9 target to enable breakpoints on
1682 static void arm7_9_enable_breakpoints(struct target
*target
)
1684 struct breakpoint
*breakpoint
= target
->breakpoints
;
1686 /* set any pending breakpoints */
1687 while (breakpoint
) {
1688 arm7_9_set_breakpoint(target
, breakpoint
);
1689 breakpoint
= breakpoint
->next
;
1693 int arm7_9_resume(struct target
*target
,
1696 int handle_breakpoints
,
1697 int debug_execution
)
1699 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1700 struct arm
*arm
= &arm7_9
->arm
;
1701 struct reg
*dbg_ctrl
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_CTRL
];
1702 int err
, retval
= ERROR_OK
;
1706 if (target
->state
!= TARGET_HALTED
) {
1707 LOG_WARNING("target not halted");
1708 return ERROR_TARGET_NOT_HALTED
;
1711 if (!debug_execution
)
1712 target_free_all_working_areas(target
);
1714 /* current = 1: continue on current pc, otherwise continue at <address> */
1716 buf_set_u32(arm
->pc
->value
, 0, 32, address
);
1718 uint32_t current_pc
;
1719 current_pc
= buf_get_u32(arm
->pc
->value
, 0, 32);
1721 /* the front-end may request us not to handle breakpoints */
1722 if (handle_breakpoints
) {
1723 struct breakpoint
*breakpoint
;
1724 breakpoint
= breakpoint_find(target
,
1725 buf_get_u32(arm
->pc
->value
, 0, 32));
1726 if (breakpoint
!= NULL
) {
1727 LOG_DEBUG("unset breakpoint at 0x%8.8" PRIx32
" (id: %" PRId32
,
1728 breakpoint
->address
,
1729 breakpoint
->unique_id
);
1730 retval
= arm7_9_unset_breakpoint(target
, breakpoint
);
1731 if (retval
!= ERROR_OK
)
1734 /* calculate PC of next instruction */
1736 retval
= arm_simulate_step(target
, &next_pc
);
1737 if (retval
!= ERROR_OK
) {
1738 uint32_t current_opcode
;
1739 target_read_u32(target
, current_pc
, ¤t_opcode
);
1741 "Couldn't calculate PC of next instruction, current opcode was 0x%8.8" PRIx32
"",
1746 LOG_DEBUG("enable single-step");
1747 arm7_9
->enable_single_step(target
, next_pc
);
1749 target
->debug_reason
= DBG_REASON_SINGLESTEP
;
1751 retval
= arm7_9_restore_context(target
);
1752 if (retval
!= ERROR_OK
)
1755 if (arm
->core_state
== ARM_STATE_ARM
)
1756 arm7_9
->branch_resume(target
);
1757 else if (arm
->core_state
== ARM_STATE_THUMB
)
1758 arm7_9
->branch_resume_thumb(target
);
1760 LOG_ERROR("unhandled core state");
1764 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGACK
, 1, 0);
1765 embeddedice_write_reg(dbg_ctrl
,
1766 buf_get_u32(dbg_ctrl
->value
, 0, dbg_ctrl
->size
));
1767 err
= arm7_9_execute_sys_speed(target
);
1769 LOG_DEBUG("disable single-step");
1770 arm7_9
->disable_single_step(target
);
1772 if (err
!= ERROR_OK
) {
1773 retval
= arm7_9_set_breakpoint(target
, breakpoint
);
1774 if (retval
!= ERROR_OK
)
1776 target
->state
= TARGET_UNKNOWN
;
1780 retval
= arm7_9_debug_entry(target
);
1781 if (retval
!= ERROR_OK
)
1783 LOG_DEBUG("new PC after step: 0x%8.8" PRIx32
,
1784 buf_get_u32(arm
->pc
->value
, 0, 32));
1786 LOG_DEBUG("set breakpoint at 0x%8.8" PRIx32
"", breakpoint
->address
);
1787 retval
= arm7_9_set_breakpoint(target
, breakpoint
);
1788 if (retval
!= ERROR_OK
)
1793 /* enable any pending breakpoints and watchpoints */
1794 arm7_9_enable_breakpoints(target
);
1795 arm7_9_enable_watchpoints(target
);
1797 retval
= arm7_9_restore_context(target
);
1798 if (retval
!= ERROR_OK
)
1801 if (arm
->core_state
== ARM_STATE_ARM
)
1802 arm7_9
->branch_resume(target
);
1803 else if (arm
->core_state
== ARM_STATE_THUMB
)
1804 arm7_9
->branch_resume_thumb(target
);
1806 LOG_ERROR("unhandled core state");
1810 /* deassert DBGACK and INTDIS */
1811 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGACK
, 1, 0);
1812 /* INTDIS only when we really resume, not during debug execution */
1813 if (!debug_execution
)
1814 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_INTDIS
, 1, 0);
1815 embeddedice_write_reg(dbg_ctrl
, buf_get_u32(dbg_ctrl
->value
, 0, dbg_ctrl
->size
));
1817 retval
= arm7_9_restart_core(target
);
1818 if (retval
!= ERROR_OK
)
1821 target
->debug_reason
= DBG_REASON_NOTHALTED
;
1823 if (!debug_execution
) {
1824 /* registers are now invalid */
1825 register_cache_invalidate(arm
->core_cache
);
1826 target
->state
= TARGET_RUNNING
;
1827 retval
= target_call_event_callbacks(target
, TARGET_EVENT_RESUMED
);
1828 if (retval
!= ERROR_OK
)
1831 target
->state
= TARGET_DEBUG_RUNNING
;
1832 retval
= target_call_event_callbacks(target
, TARGET_EVENT_DEBUG_RESUMED
);
1833 if (retval
!= ERROR_OK
)
1837 LOG_DEBUG("target resumed");
1842 void arm7_9_enable_eice_step(struct target
*target
, uint32_t next_pc
)
1844 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1845 struct arm
*arm
= &arm7_9
->arm
;
1846 uint32_t current_pc
;
1847 current_pc
= buf_get_u32(arm
->pc
->value
, 0, 32);
1849 if (next_pc
!= current_pc
) {
1850 /* setup an inverse breakpoint on the current PC
1851 * - comparator 1 matches the current address
1852 * - rangeout from comparator 1 is connected to comparator 0 rangein
1853 * - comparator 0 matches any address, as long as rangein is low */
1854 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
], 0xffffffff);
1855 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
], 0xffffffff);
1856 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
],
1857 EICE_W_CTRL_ENABLE
);
1858 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
],
1859 ~(EICE_W_CTRL_RANGE
| EICE_W_CTRL_nOPC
) & 0xff);
1860 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_VALUE
],
1862 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_MASK
], 0);
1863 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_DATA_MASK
], 0xffffffff);
1864 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
], 0x0);
1865 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_MASK
],
1866 ~EICE_W_CTRL_nOPC
& 0xff);
1868 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
], 0xffffffff);
1869 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
], 0xffffffff);
1870 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], 0x0);
1871 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
], 0xff);
1872 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_VALUE
], next_pc
);
1873 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_MASK
], 0);
1874 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_DATA_MASK
], 0xffffffff);
1875 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
],
1876 EICE_W_CTRL_ENABLE
);
1877 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_MASK
],
1878 ~EICE_W_CTRL_nOPC
& 0xff);
1882 void arm7_9_disable_eice_step(struct target
*target
)
1884 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1886 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
]);
1887 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
]);
1888 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
]);
1889 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
]);
1890 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_VALUE
]);
1891 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_MASK
]);
1892 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_DATA_MASK
]);
1893 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_MASK
]);
1894 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
]);
1897 int arm7_9_step(struct target
*target
, int current
, uint32_t address
, int handle_breakpoints
)
1899 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1900 struct arm
*arm
= &arm7_9
->arm
;
1901 struct breakpoint
*breakpoint
= NULL
;
1904 if (target
->state
!= TARGET_HALTED
) {
1905 LOG_WARNING("target not halted");
1906 return ERROR_TARGET_NOT_HALTED
;
1909 /* current = 1: continue on current pc, otherwise continue at <address> */
1911 buf_set_u32(arm
->pc
->value
, 0, 32, address
);
1913 uint32_t current_pc
= buf_get_u32(arm
->pc
->value
, 0, 32);
1915 /* the front-end may request us not to handle breakpoints */
1916 if (handle_breakpoints
)
1917 breakpoint
= breakpoint_find(target
, current_pc
);
1918 if (breakpoint
!= NULL
) {
1919 retval
= arm7_9_unset_breakpoint(target
, breakpoint
);
1920 if (retval
!= ERROR_OK
)
1924 target
->debug_reason
= DBG_REASON_SINGLESTEP
;
1926 /* calculate PC of next instruction */
1928 retval
= arm_simulate_step(target
, &next_pc
);
1929 if (retval
!= ERROR_OK
) {
1930 uint32_t current_opcode
;
1931 target_read_u32(target
, current_pc
, ¤t_opcode
);
1933 "Couldn't calculate PC of next instruction, current opcode was 0x%8.8" PRIx32
"",
1938 retval
= arm7_9_restore_context(target
);
1939 if (retval
!= ERROR_OK
)
1942 arm7_9
->enable_single_step(target
, next_pc
);
1944 if (arm
->core_state
== ARM_STATE_ARM
)
1945 arm7_9
->branch_resume(target
);
1946 else if (arm
->core_state
== ARM_STATE_THUMB
)
1947 arm7_9
->branch_resume_thumb(target
);
1949 LOG_ERROR("unhandled core state");
1953 retval
= target_call_event_callbacks(target
, TARGET_EVENT_RESUMED
);
1954 if (retval
!= ERROR_OK
)
1957 err
= arm7_9_execute_sys_speed(target
);
1958 arm7_9
->disable_single_step(target
);
1960 /* registers are now invalid */
1961 register_cache_invalidate(arm
->core_cache
);
1963 if (err
!= ERROR_OK
)
1964 target
->state
= TARGET_UNKNOWN
;
1966 retval
= arm7_9_debug_entry(target
);
1967 if (retval
!= ERROR_OK
)
1969 retval
= target_call_event_callbacks(target
, TARGET_EVENT_HALTED
);
1970 if (retval
!= ERROR_OK
)
1972 LOG_DEBUG("target stepped");
1976 retval
= arm7_9_set_breakpoint(target
, breakpoint
);
1977 if (retval
!= ERROR_OK
)
1984 static int arm7_9_read_core_reg(struct target
*target
, struct reg
*r
,
1985 int num
, enum arm_mode mode
)
1987 uint32_t *reg_p
[16];
1989 struct arm_reg
*areg
= r
->arch_info
;
1990 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1991 struct arm
*arm
= &arm7_9
->arm
;
1993 if (!is_arm_mode(arm
->core_mode
))
1995 if ((num
< 0) || (num
> 16))
1996 return ERROR_COMMAND_SYNTAX_ERROR
;
1998 if ((mode
!= ARM_MODE_ANY
) && (mode
!= arm
->core_mode
)
1999 && (areg
->mode
!= ARM_MODE_ANY
)) {
2002 /* change processor mode (mask T bit) */
2003 tmp_cpsr
= buf_get_u32(arm
->cpsr
->value
, 0, 8) & 0xE0;
2006 arm7_9
->write_xpsr_im8(target
, tmp_cpsr
& 0xff, 0, 0);
2010 if ((num
>= 0) && (num
<= 15)) {
2011 /* read a normal core register */
2012 reg_p
[num
] = &value
;
2014 arm7_9
->read_core_regs(target
, 1 << num
, reg_p
);
2016 /* read a program status register
2017 * if the register mode is MODE_ANY, we read the cpsr, otherwise a spsr
2019 arm7_9
->read_xpsr(target
, &value
, areg
->mode
!= ARM_MODE_ANY
);
2022 retval
= jtag_execute_queue();
2023 if (retval
!= ERROR_OK
)
2028 buf_set_u32(r
->value
, 0, 32, value
);
2030 if ((mode
!= ARM_MODE_ANY
) && (mode
!= arm
->core_mode
)
2031 && (areg
->mode
!= ARM_MODE_ANY
)) {
2032 /* restore processor mode (mask T bit) */
2033 arm7_9
->write_xpsr_im8(target
,
2034 buf_get_u32(arm
->cpsr
->value
, 0, 8) & ~0x20, 0, 0);
2040 static int arm7_9_write_core_reg(struct target
*target
, struct reg
*r
,
2041 int num
, enum arm_mode mode
, uint8_t *value
)
2044 struct arm_reg
*areg
= r
->arch_info
;
2045 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2046 struct arm
*arm
= &arm7_9
->arm
;
2048 if (!is_arm_mode(arm
->core_mode
))
2050 if ((num
< 0) || (num
> 16))
2051 return ERROR_COMMAND_SYNTAX_ERROR
;
2053 if ((mode
!= ARM_MODE_ANY
) && (mode
!= arm
->core_mode
)
2054 && (areg
->mode
!= ARM_MODE_ANY
)) {
2057 /* change processor mode (mask T bit) */
2058 tmp_cpsr
= buf_get_u32(arm
->cpsr
->value
, 0, 8) & 0xE0;
2061 arm7_9
->write_xpsr_im8(target
, tmp_cpsr
& 0xff, 0, 0);
2064 if ((num
>= 0) && (num
<= 15)) {
2065 /* write a normal core register */
2066 reg
[num
] = buf_get_u32(value
, 0, 32);
2068 arm7_9
->write_core_regs(target
, 1 << num
, reg
);
2070 /* write a program status register
2071 * if the register mode is MODE_ANY, we write the cpsr, otherwise a spsr
2073 int spsr
= (areg
->mode
!= ARM_MODE_ANY
);
2075 uint32_t t
= buf_get_u32(value
, 0, 32);
2076 /* if we're writing the CPSR, mask the T bit */
2080 arm7_9
->write_xpsr(target
, t
, spsr
);
2086 if ((mode
!= ARM_MODE_ANY
) && (mode
!= arm
->core_mode
)
2087 && (areg
->mode
!= ARM_MODE_ANY
)) {
2088 /* restore processor mode (mask T bit) */
2089 arm7_9
->write_xpsr_im8(target
,
2090 buf_get_u32(arm
->cpsr
->value
, 0, 8) & ~0x20, 0, 0);
2093 return jtag_execute_queue();
2096 int arm7_9_read_memory(struct target
*target
,
2102 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2103 struct arm
*arm
= &arm7_9
->arm
;
2105 uint32_t num_accesses
= 0;
2106 int thisrun_accesses
;
2112 LOG_DEBUG("address: 0x%8.8" PRIx32
", size: 0x%8.8" PRIx32
", count: 0x%8.8" PRIx32
"",
2113 address
, size
, count
);
2115 if (target
->state
!= TARGET_HALTED
) {
2116 LOG_WARNING("target not halted");
2117 return ERROR_TARGET_NOT_HALTED
;
2120 /* sanitize arguments */
2121 if (((size
!= 4) && (size
!= 2) && (size
!= 1)) || (count
== 0) || !(buffer
))
2122 return ERROR_COMMAND_SYNTAX_ERROR
;
2124 if (((size
== 4) && (address
& 0x3u
)) || ((size
== 2) && (address
& 0x1u
)))
2125 return ERROR_TARGET_UNALIGNED_ACCESS
;
2127 /* load the base register with the address of the first word */
2129 arm7_9
->write_core_regs(target
, 0x1, reg
);
2135 while (num_accesses
< count
) {
2138 ((count
- num_accesses
) >= 14) ? 14 : (count
- num_accesses
);
2139 reg_list
= (0xffff >> (15 - thisrun_accesses
)) & 0xfffe;
2141 if (last_reg
<= thisrun_accesses
)
2142 last_reg
= thisrun_accesses
;
2144 arm7_9
->load_word_regs(target
, reg_list
);
2146 /* fast memory reads are only safe when the target is running
2147 * from a sufficiently high clock (32 kHz is usually too slow)
2149 if (arm7_9
->fast_memory_access
)
2150 retval
= arm7_9_execute_fast_sys_speed(target
);
2152 retval
= arm7_9_execute_sys_speed(target
);
2153 if (retval
!= ERROR_OK
)
2156 arm7_9
->read_core_regs_target_buffer(target
, reg_list
, buffer
, 4);
2158 /* advance buffer, count number of accesses */
2159 buffer
+= thisrun_accesses
* 4;
2160 num_accesses
+= thisrun_accesses
;
2162 if ((j
++%1024) == 0)
2167 while (num_accesses
< count
) {
2170 ((count
- num_accesses
) >= 14) ? 14 : (count
- num_accesses
);
2171 reg_list
= (0xffff >> (15 - thisrun_accesses
)) & 0xfffe;
2173 for (i
= 1; i
<= thisrun_accesses
; i
++) {
2176 arm7_9
->load_hword_reg(target
, i
);
2177 /* fast memory reads are only safe when the target is running
2178 * from a sufficiently high clock (32 kHz is usually too slow)
2180 if (arm7_9
->fast_memory_access
)
2181 retval
= arm7_9_execute_fast_sys_speed(target
);
2183 retval
= arm7_9_execute_sys_speed(target
);
2184 if (retval
!= ERROR_OK
)
2189 arm7_9
->read_core_regs_target_buffer(target
, reg_list
, buffer
, 2);
2191 /* advance buffer, count number of accesses */
2192 buffer
+= thisrun_accesses
* 2;
2193 num_accesses
+= thisrun_accesses
;
2195 if ((j
++%1024) == 0)
2200 while (num_accesses
< count
) {
2203 ((count
- num_accesses
) >= 14) ? 14 : (count
- num_accesses
);
2204 reg_list
= (0xffff >> (15 - thisrun_accesses
)) & 0xfffe;
2206 for (i
= 1; i
<= thisrun_accesses
; i
++) {
2209 arm7_9
->load_byte_reg(target
, i
);
2210 /* fast memory reads are only safe when the target is running
2211 * from a sufficiently high clock (32 kHz is usually too slow)
2213 if (arm7_9
->fast_memory_access
)
2214 retval
= arm7_9_execute_fast_sys_speed(target
);
2216 retval
= arm7_9_execute_sys_speed(target
);
2217 if (retval
!= ERROR_OK
)
2221 arm7_9
->read_core_regs_target_buffer(target
, reg_list
, buffer
, 1);
2223 /* advance buffer, count number of accesses */
2224 buffer
+= thisrun_accesses
* 1;
2225 num_accesses
+= thisrun_accesses
;
2227 if ((j
++%1024) == 0)
2233 if (!is_arm_mode(arm
->core_mode
))
2236 for (i
= 0; i
<= last_reg
; i
++) {
2237 struct reg
*r
= arm_reg_current(arm
, i
);
2238 r
->dirty
= r
->valid
;
2241 arm7_9
->read_xpsr(target
, &cpsr
, 0);
2242 retval
= jtag_execute_queue();
2243 if (retval
!= ERROR_OK
) {
2244 LOG_ERROR("JTAG error while reading cpsr");
2245 return ERROR_TARGET_DATA_ABORT
;
2248 if (((cpsr
& 0x1f) == ARM_MODE_ABT
) && (arm
->core_mode
!= ARM_MODE_ABT
)) {
2250 "memory read caused data abort (address: 0x%8.8" PRIx32
", size: 0x%" PRIx32
", count: 0x%" PRIx32
")",
2255 arm7_9
->write_xpsr_im8(target
,
2256 buf_get_u32(arm
->cpsr
->value
, 0, 8)
2259 return ERROR_TARGET_DATA_ABORT
;
2265 int arm7_9_write_memory(struct target
*target
,
2269 const uint8_t *buffer
)
2271 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2272 struct arm
*arm
= &arm7_9
->arm
;
2273 struct reg
*dbg_ctrl
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_CTRL
];
2276 uint32_t num_accesses
= 0;
2277 int thisrun_accesses
;
2283 #ifdef _DEBUG_ARM7_9_
2284 LOG_DEBUG("address: 0x%8.8x, size: 0x%8.8x, count: 0x%8.8x", address
, size
, count
);
2287 if (target
->state
!= TARGET_HALTED
) {
2288 LOG_WARNING("target not halted");
2289 return ERROR_TARGET_NOT_HALTED
;
2292 /* sanitize arguments */
2293 if (((size
!= 4) && (size
!= 2) && (size
!= 1)) || (count
== 0) || !(buffer
))
2294 return ERROR_COMMAND_SYNTAX_ERROR
;
2296 if (((size
== 4) && (address
& 0x3u
)) || ((size
== 2) && (address
& 0x1u
)))
2297 return ERROR_TARGET_UNALIGNED_ACCESS
;
2299 /* load the base register with the address of the first word */
2301 arm7_9
->write_core_regs(target
, 0x1, reg
);
2303 /* Clear DBGACK, to make sure memory fetches work as expected */
2304 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGACK
, 1, 0);
2305 embeddedice_store_reg(dbg_ctrl
);
2309 while (num_accesses
< count
) {
2312 ((count
- num_accesses
) >= 14) ? 14 : (count
- num_accesses
);
2313 reg_list
= (0xffff >> (15 - thisrun_accesses
)) & 0xfffe;
2315 for (i
= 1; i
<= thisrun_accesses
; i
++) {
2318 reg
[i
] = target_buffer_get_u32(target
, buffer
);
2322 arm7_9
->write_core_regs(target
, reg_list
, reg
);
2324 arm7_9
->store_word_regs(target
, reg_list
);
2326 /* fast memory writes are only safe when the target is running
2327 * from a sufficiently high clock (32 kHz is usually too slow)
2329 if (arm7_9
->fast_memory_access
)
2330 retval
= arm7_9_execute_fast_sys_speed(target
);
2332 retval
= arm7_9_execute_sys_speed(target
);
2335 * if memory writes are made when the clock is running slow
2336 * (i.e. 32 kHz) which is necessary in some scripts to reconfigure
2337 * processor operations after a "reset halt" or "reset init",
2338 * need to immediately stroke the keep alive or will end up with
2339 * gdb "keep alive not sent error message" problem.
2345 if (retval
!= ERROR_OK
)
2348 num_accesses
+= thisrun_accesses
;
2352 while (num_accesses
< count
) {
2355 ((count
- num_accesses
) >= 14) ? 14 : (count
- num_accesses
);
2356 reg_list
= (0xffff >> (15 - thisrun_accesses
)) & 0xfffe;
2358 for (i
= 1; i
<= thisrun_accesses
; i
++) {
2361 reg
[i
] = target_buffer_get_u16(target
, buffer
) & 0xffff;
2365 arm7_9
->write_core_regs(target
, reg_list
, reg
);
2367 for (i
= 1; i
<= thisrun_accesses
; i
++) {
2368 arm7_9
->store_hword_reg(target
, i
);
2370 /* fast memory writes are only safe when the target is running
2371 * from a sufficiently high clock (32 kHz is usually too slow)
2373 if (arm7_9
->fast_memory_access
)
2374 retval
= arm7_9_execute_fast_sys_speed(target
);
2376 retval
= arm7_9_execute_sys_speed(target
);
2379 * if memory writes are made when the clock is running slow
2380 * (i.e. 32 kHz) which is necessary in some scripts to reconfigure
2381 * processor operations after a "reset halt" or "reset init",
2382 * need to immediately stroke the keep alive or will end up with
2383 * gdb "keep alive not sent error message" problem.
2389 if (retval
!= ERROR_OK
)
2393 num_accesses
+= thisrun_accesses
;
2397 while (num_accesses
< count
) {
2400 ((count
- num_accesses
) >= 14) ? 14 : (count
- num_accesses
);
2401 reg_list
= (0xffff >> (15 - thisrun_accesses
)) & 0xfffe;
2403 for (i
= 1; i
<= thisrun_accesses
; i
++) {
2406 reg
[i
] = *buffer
++ & 0xff;
2409 arm7_9
->write_core_regs(target
, reg_list
, reg
);
2411 for (i
= 1; i
<= thisrun_accesses
; i
++) {
2412 arm7_9
->store_byte_reg(target
, i
);
2413 /* fast memory writes are only safe when the target is running
2414 * from a sufficiently high clock (32 kHz is usually too slow)
2416 if (arm7_9
->fast_memory_access
)
2417 retval
= arm7_9_execute_fast_sys_speed(target
);
2419 retval
= arm7_9_execute_sys_speed(target
);
2422 * if memory writes are made when the clock is running slow
2423 * (i.e. 32 kHz) which is necessary in some scripts to reconfigure
2424 * processor operations after a "reset halt" or "reset init",
2425 * need to immediately stroke the keep alive or will end up with
2426 * gdb "keep alive not sent error message" problem.
2432 if (retval
!= ERROR_OK
)
2437 num_accesses
+= thisrun_accesses
;
2443 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGACK
, 1, 1);
2444 embeddedice_store_reg(dbg_ctrl
);
2446 if (!is_arm_mode(arm
->core_mode
))
2449 for (i
= 0; i
<= last_reg
; i
++) {
2450 struct reg
*r
= arm_reg_current(arm
, i
);
2451 r
->dirty
= r
->valid
;
2454 arm7_9
->read_xpsr(target
, &cpsr
, 0);
2455 retval
= jtag_execute_queue();
2456 if (retval
!= ERROR_OK
) {
2457 LOG_ERROR("JTAG error while reading cpsr");
2458 return ERROR_TARGET_DATA_ABORT
;
2461 if (((cpsr
& 0x1f) == ARM_MODE_ABT
) && (arm
->core_mode
!= ARM_MODE_ABT
)) {
2463 "memory write caused data abort (address: 0x%8.8" PRIx32
", size: 0x%" PRIx32
", count: 0x%" PRIx32
")",
2468 arm7_9
->write_xpsr_im8(target
,
2469 buf_get_u32(arm
->cpsr
->value
, 0, 8)
2472 return ERROR_TARGET_DATA_ABORT
;
2478 int arm7_9_write_memory_opt(struct target
*target
,
2482 const uint8_t *buffer
)
2484 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2487 if (size
== 4 && count
> 32 && arm7_9
->bulk_write_memory
) {
2488 /* Attempt to do a bulk write */
2489 retval
= arm7_9
->bulk_write_memory(target
, address
, count
, buffer
);
2491 if (retval
== ERROR_OK
)
2495 return arm7_9
->write_memory(target
, address
, size
, count
, buffer
);
2498 int arm7_9_write_memory_no_opt(struct target
*target
,
2502 const uint8_t *buffer
)
2504 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2506 return arm7_9
->write_memory(target
, address
, size
, count
, buffer
);
2509 static int dcc_count
;
2510 static const uint8_t *dcc_buffer
;
2512 static int arm7_9_dcc_completion(struct target
*target
,
2513 uint32_t exit_point
,
2517 int retval
= ERROR_OK
;
2518 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2520 retval
= target_wait_state(target
, TARGET_DEBUG_RUNNING
, 500);
2521 if (retval
!= ERROR_OK
)
2524 int little
= target
->endianness
== TARGET_LITTLE_ENDIAN
;
2525 int count
= dcc_count
;
2526 const uint8_t *buffer
= dcc_buffer
;
2528 /* Handle first & last using standard embeddedice_write_reg and the middle ones w/the
2529 * core function repeated. */
2530 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_COMMS_DATA
],
2531 fast_target_buffer_get_u32(buffer
, little
));
2534 struct embeddedice_reg
*ice_reg
=
2535 arm7_9
->eice_cache
->reg_list
[EICE_COMMS_DATA
].arch_info
;
2536 uint8_t reg_addr
= ice_reg
->addr
& 0x1f;
2537 struct jtag_tap
*tap
;
2538 tap
= ice_reg
->jtag_info
->tap
;
2540 embeddedice_write_dcc(tap
, reg_addr
, buffer
, little
, count
-2);
2541 buffer
+= (count
-2)*4;
2543 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_COMMS_DATA
],
2544 fast_target_buffer_get_u32(buffer
, little
));
2547 for (i
= 0; i
< count
; i
++) {
2548 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_COMMS_DATA
],
2549 fast_target_buffer_get_u32(buffer
, little
));
2554 retval
= target_halt(target
);
2555 if (retval
!= ERROR_OK
)
2557 return target_wait_state(target
, TARGET_HALTED
, 500);
2560 static const uint32_t dcc_code
[] = {
2561 /* r0 == input, points to memory buffer
2565 /* spin until DCC control (c0) reports data arrived */
2566 0xee101e10, /* w: mrc p14, #0, r1, c0, c0 */
2567 0xe3110001, /* tst r1, #1 */
2568 0x0afffffc, /* bne w */
2570 /* read word from DCC (c1), write to memory */
2571 0xee111e10, /* mrc p14, #0, r1, c1, c0 */
2572 0xe4801004, /* str r1, [r0], #4 */
2575 0xeafffff9 /* b w */
2578 int arm7_9_bulk_write_memory(struct target
*target
,
2581 const uint8_t *buffer
)
2584 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2586 if (address
% 4 != 0)
2587 return ERROR_TARGET_UNALIGNED_ACCESS
;
2589 if (!arm7_9
->dcc_downloads
)
2590 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
2592 /* regrab previously allocated working_area, or allocate a new one */
2593 if (!arm7_9
->dcc_working_area
) {
2594 uint8_t dcc_code_buf
[6 * 4];
2596 /* make sure we have a working area */
2597 if (target_alloc_working_area(target
, 24, &arm7_9
->dcc_working_area
) != ERROR_OK
) {
2598 LOG_INFO("no working area available, falling back to memory writes");
2599 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
2602 /* copy target instructions to target endianness */
2603 target_buffer_set_u32_array(target
, dcc_code_buf
, ARRAY_SIZE(dcc_code
), dcc_code
);
2605 /* write DCC code to working area, using the non-optimized
2606 * memory write to avoid ending up here again */
2607 retval
= arm7_9_write_memory_no_opt(target
,
2608 arm7_9
->dcc_working_area
->address
, 4, 6, dcc_code_buf
);
2609 if (retval
!= ERROR_OK
)
2613 struct arm_algorithm arm_algo
;
2614 struct reg_param reg_params
[1];
2616 arm_algo
.common_magic
= ARM_COMMON_MAGIC
;
2617 arm_algo
.core_mode
= ARM_MODE_SVC
;
2618 arm_algo
.core_state
= ARM_STATE_ARM
;
2620 init_reg_param(®_params
[0], "r0", 32, PARAM_IN_OUT
);
2622 buf_set_u32(reg_params
[0].value
, 0, 32, address
);
2625 dcc_buffer
= buffer
;
2626 retval
= armv4_5_run_algorithm_inner(target
, 0, NULL
, 1, reg_params
,
2627 arm7_9
->dcc_working_area
->address
,
2628 arm7_9
->dcc_working_area
->address
+ 6*4,
2629 20*1000, &arm_algo
, arm7_9_dcc_completion
);
2631 if (retval
== ERROR_OK
) {
2632 uint32_t endaddress
= buf_get_u32(reg_params
[0].value
, 0, 32);
2633 if (endaddress
!= (address
+ count
*4)) {
2635 "DCC write failed, expected end address 0x%08" PRIx32
" got 0x%0" PRIx32
"",
2636 (address
+ count
*4),
2638 retval
= ERROR_FAIL
;
2642 destroy_reg_param(®_params
[0]);
2648 * Perform per-target setup that requires JTAG access.
2650 int arm7_9_examine(struct target
*target
)
2652 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2655 if (!target_was_examined(target
)) {
2656 struct reg_cache
*t
, **cache_p
;
2658 t
= embeddedice_build_reg_cache(target
, arm7_9
);
2662 cache_p
= register_get_last_cache_p(&target
->reg_cache
);
2664 arm7_9
->eice_cache
= (*cache_p
);
2666 if (arm7_9
->arm
.etm
)
2667 (*cache_p
)->next
= etm_build_reg_cache(target
,
2671 target_set_examined(target
);
2674 retval
= embeddedice_setup(target
);
2675 if (retval
== ERROR_OK
)
2676 retval
= arm7_9_setup(target
);
2677 if (retval
== ERROR_OK
&& arm7_9
->arm
.etm
)
2678 retval
= etm_setup(target
);
2683 int arm7_9_check_reset(struct target
*target
)
2685 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2687 if (get_target_reset_nag() && !arm7_9
->dcc_downloads
)
2689 "NOTE! DCC downloads have not been enabled, defaulting to slow memory writes. Type 'help dcc'.");
2691 if (get_target_reset_nag() && (target
->working_area_size
== 0))
2692 LOG_WARNING("NOTE! Severe performance degradation without working memory enabled.");
2694 if (get_target_reset_nag() && !arm7_9
->fast_memory_access
)
2696 "NOTE! Severe performance degradation without fast memory access enabled. Type 'help fast'.");
2701 int arm7_9_endianness_callback(jtag_callback_data_t pu8_in
,
2702 jtag_callback_data_t i_size
, jtag_callback_data_t i_be
,
2703 jtag_callback_data_t i_flip
)
2705 uint8_t *in
= (uint8_t *)pu8_in
;
2706 int size
= (int)i_size
;
2708 int flip
= (int)i_flip
;
2713 readback
= le_to_h_u32(in
);
2715 readback
= flip_u32(readback
, 32);
2717 h_u32_to_be(in
, readback
);
2719 h_u32_to_le(in
, readback
);
2722 readback
= le_to_h_u16(in
);
2724 readback
= flip_u32(readback
, 16);
2726 h_u16_to_be(in
, readback
& 0xffff);
2728 h_u16_to_le(in
, readback
& 0xffff);
2733 readback
= flip_u32(readback
, 8);
2734 *in
= readback
& 0xff;
2741 COMMAND_HANDLER(handle_arm7_9_dbgrq_command
)
2743 struct target
*target
= get_current_target(CMD_CTX
);
2744 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2746 if (!is_arm7_9(arm7_9
)) {
2747 command_print(CMD_CTX
, "current target isn't an ARM7/ARM9 target");
2748 return ERROR_TARGET_INVALID
;
2752 COMMAND_PARSE_ENABLE(CMD_ARGV
[0], arm7_9
->use_dbgrq
);
2754 command_print(CMD_CTX
,
2755 "use of EmbeddedICE dbgrq instead of breakpoint for target halt %s",
2756 (arm7_9
->use_dbgrq
) ? "enabled" : "disabled");
2761 COMMAND_HANDLER(handle_arm7_9_fast_memory_access_command
)
2763 struct target
*target
= get_current_target(CMD_CTX
);
2764 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2766 if (!is_arm7_9(arm7_9
)) {
2767 command_print(CMD_CTX
, "current target isn't an ARM7/ARM9 target");
2768 return ERROR_TARGET_INVALID
;
2772 COMMAND_PARSE_ENABLE(CMD_ARGV
[0], arm7_9
->fast_memory_access
);
2774 command_print(CMD_CTX
,
2775 "fast memory access is %s",
2776 (arm7_9
->fast_memory_access
) ? "enabled" : "disabled");
2781 COMMAND_HANDLER(handle_arm7_9_dcc_downloads_command
)
2783 struct target
*target
= get_current_target(CMD_CTX
);
2784 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2786 if (!is_arm7_9(arm7_9
)) {
2787 command_print(CMD_CTX
, "current target isn't an ARM7/ARM9 target");
2788 return ERROR_TARGET_INVALID
;
2792 COMMAND_PARSE_ENABLE(CMD_ARGV
[0], arm7_9
->dcc_downloads
);
2794 command_print(CMD_CTX
,
2795 "dcc downloads are %s",
2796 (arm7_9
->dcc_downloads
) ? "enabled" : "disabled");
2801 static int arm7_9_setup_semihosting(struct target
*target
, int enable
)
2803 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2805 if (!is_arm7_9(arm7_9
)) {
2806 LOG_USER("current target isn't an ARM7/ARM9 target");
2807 return ERROR_TARGET_INVALID
;
2810 if (arm7_9
->has_vector_catch
) {
2811 struct reg
*vector_catch
= &arm7_9
->eice_cache
2812 ->reg_list
[EICE_VEC_CATCH
];
2814 if (!vector_catch
->valid
)
2815 embeddedice_read_reg(vector_catch
);
2816 buf_set_u32(vector_catch
->value
, 2, 1, enable
);
2817 embeddedice_store_reg(vector_catch
);
2819 /* TODO: allow optional high vectors and/or BKPT_HARD */
2821 breakpoint_add(target
, 8, 4, BKPT_SOFT
);
2823 breakpoint_remove(target
, 8);
2829 int arm7_9_init_arch_info(struct target
*target
, struct arm7_9_common
*arm7_9
)
2831 int retval
= ERROR_OK
;
2832 struct arm
*arm
= &arm7_9
->arm
;
2834 arm7_9
->common_magic
= ARM7_9_COMMON_MAGIC
;
2836 retval
= arm_jtag_setup_connection(&arm7_9
->jtag_info
);
2837 if (retval
!= ERROR_OK
)
2840 /* caller must have allocated via calloc(), so everything's zeroed */
2842 arm7_9
->wp_available_max
= 2;
2844 arm7_9
->fast_memory_access
= false;
2845 arm7_9
->dcc_downloads
= false;
2847 arm
->arch_info
= arm7_9
;
2848 arm
->core_type
= ARM_MODE_ANY
;
2849 arm
->read_core_reg
= arm7_9_read_core_reg
;
2850 arm
->write_core_reg
= arm7_9_write_core_reg
;
2851 arm
->full_context
= arm7_9_full_context
;
2852 arm
->setup_semihosting
= arm7_9_setup_semihosting
;
2854 retval
= arm_init_arch_info(target
, arm
);
2855 if (retval
!= ERROR_OK
)
2858 return target_register_timer_callback(arm7_9_handle_target_request
,
2862 static const struct command_registration arm7_9_any_command_handlers
[] = {
2865 .handler
= handle_arm7_9_dbgrq_command
,
2866 .mode
= COMMAND_ANY
,
2867 .usage
= "['enable'|'disable']",
2868 .help
= "use EmbeddedICE dbgrq instead of breakpoint "
2869 "for target halt requests",
2872 "fast_memory_access",
2873 .handler
= handle_arm7_9_fast_memory_access_command
,
2874 .mode
= COMMAND_ANY
,
2875 .usage
= "['enable'|'disable']",
2876 .help
= "use fast memory accesses instead of slower "
2877 "but potentially safer accesses",
2881 .handler
= handle_arm7_9_dcc_downloads_command
,
2882 .mode
= COMMAND_ANY
,
2883 .usage
= "['enable'|'disable']",
2884 .help
= "use DCC downloads for larger memory writes",
2886 COMMAND_REGISTRATION_DONE
2888 const struct command_registration arm7_9_command_handlers
[] = {
2890 .chain
= arm_command_handlers
,
2893 .chain
= etm_command_handlers
,
2897 .mode
= COMMAND_ANY
,
2898 .help
= "arm7/9 specific commands",
2900 .chain
= arm7_9_any_command_handlers
,
2902 COMMAND_REGISTRATION_DONE
Linking to existing account procedure
If you already have an account and want to add another login method
you
MUST first sign in with your existing account and
then change URL to read
https://review.openocd.org/login/?link
to get to this page again but this time it'll work for linking. Thank you.
SSH host keys fingerprints
1024 SHA256:YKx8b7u5ZWdcbp7/4AeXNaqElP49m6QrwfXaqQGJAOk gerrit-code-review@openocd.zylin.com (DSA)
384 SHA256:jHIbSQa4REvwCFG4cq5LBlBLxmxSqelQPem/EXIrxjk gerrit-code-review@openocd.org (ECDSA)
521 SHA256:UAOPYkU9Fjtcao0Ul/Rrlnj/OsQvt+pgdYSZ4jOYdgs gerrit-code-review@openocd.org (ECDSA)
256 SHA256:A13M5QlnozFOvTllybRZH6vm7iSt0XLxbA48yfc2yfY gerrit-code-review@openocd.org (ECDSA)
256 SHA256:spYMBqEYoAOtK7yZBrcwE8ZpYt6b68Cfh9yEVetvbXg gerrit-code-review@openocd.org (ED25519)
+--[ED25519 256]--+
|=.. |
|+o.. . |
|*.o . . |
|+B . . . |
|Bo. = o S |
|Oo.+ + = |
|oB=.* = . o |
| =+=.+ + E |
|. .=o . o |
+----[SHA256]-----+
2048 SHA256:0Onrb7/PHjpo6iVZ7xQX2riKN83FJ3KGU0TvI0TaFG4 gerrit-code-review@openocd.zylin.com (RSA)