1 /***************************************************************************
2 * Copyright (C) 2015 by David Ung *
4 * This program is free software; you can redistribute it and/or modify *
5 * it under the terms of the GNU General Public License as published by *
6 * the Free Software Foundation; either version 2 of the License, or *
7 * (at your option) any later version. *
9 * This program is distributed in the hope that it will be useful, *
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
12 * GNU General Public License for more details. *
14 * You should have received a copy of the GNU General Public License *
15 * along with this program; if not, write to the *
16 * Free Software Foundation, Inc., *
18 ***************************************************************************/
24 #include "breakpoints.h"
27 #include "target_request.h"
28 #include "target_type.h"
29 #include "armv8_opcodes.h"
30 #include <helper/time_support.h>
32 static int aarch64_poll(struct target
*target
);
33 static int aarch64_debug_entry(struct target
*target
);
34 static int aarch64_restore_context(struct target
*target
, bool bpwp
);
35 static int aarch64_set_breakpoint(struct target
*target
,
36 struct breakpoint
*breakpoint
, uint8_t matchmode
);
37 static int aarch64_set_context_breakpoint(struct target
*target
,
38 struct breakpoint
*breakpoint
, uint8_t matchmode
);
39 static int aarch64_set_hybrid_breakpoint(struct target
*target
,
40 struct breakpoint
*breakpoint
);
41 static int aarch64_unset_breakpoint(struct target
*target
,
42 struct breakpoint
*breakpoint
);
43 static int aarch64_mmu(struct target
*target
, int *enabled
);
44 static int aarch64_virt2phys(struct target
*target
,
45 target_addr_t virt
, target_addr_t
*phys
);
46 static int aarch64_read_apb_ap_memory(struct target
*target
,
47 uint64_t address
, uint32_t size
, uint32_t count
, uint8_t *buffer
);
48 static int aarch64_instr_write_data_r0(struct arm_dpm
*dpm
,
49 uint32_t opcode
, uint32_t data
);
51 static int aarch64_restore_system_control_reg(struct target
*target
)
53 int retval
= ERROR_OK
;
55 struct aarch64_common
*aarch64
= target_to_aarch64(target
);
56 struct armv8_common
*armv8
= target_to_armv8(target
);
58 if (aarch64
->system_control_reg
!= aarch64
->system_control_reg_curr
) {
59 aarch64
->system_control_reg_curr
= aarch64
->system_control_reg
;
60 /* LOG_INFO("cp15_control_reg: %8.8" PRIx32, cortex_v8->cp15_control_reg); */
62 switch (armv8
->arm
.core_mode
) {
66 retval
= armv8
->arm
.msr(target
, 3, /*op 0*/
69 aarch64
->system_control_reg
);
70 if (retval
!= ERROR_OK
)
75 retval
= armv8
->arm
.msr(target
, 3, /*op 0*/
78 aarch64
->system_control_reg
);
79 if (retval
!= ERROR_OK
)
84 retval
= armv8
->arm
.msr(target
, 3, /*op 0*/
87 aarch64
->system_control_reg
);
88 if (retval
!= ERROR_OK
)
92 LOG_DEBUG("unknow cpu state 0x%x" PRIx32
, armv8
->arm
.core_state
);
98 /* check address before aarch64_apb read write access with mmu on
99 * remove apb predictible data abort */
100 static int aarch64_check_address(struct target
*target
, uint32_t address
)
105 /* modify system_control_reg in order to enable or disable mmu for :
106 * - virt2phys address conversion
107 * - read or write memory in phys or virt address */
108 static int aarch64_mmu_modify(struct target
*target
, int enable
)
110 struct aarch64_common
*aarch64
= target_to_aarch64(target
);
111 struct armv8_common
*armv8
= &aarch64
->armv8_common
;
112 int retval
= ERROR_OK
;
115 /* if mmu enabled at target stop and mmu not enable */
116 if (!(aarch64
->system_control_reg
& 0x1U
)) {
117 LOG_ERROR("trying to enable mmu on target stopped with mmu disable");
120 if (!(aarch64
->system_control_reg_curr
& 0x1U
)) {
121 aarch64
->system_control_reg_curr
|= 0x1U
;
122 switch (armv8
->arm
.core_mode
) {
126 retval
= armv8
->arm
.msr(target
, 3, /*op 0*/
129 aarch64
->system_control_reg_curr
);
130 if (retval
!= ERROR_OK
)
135 retval
= armv8
->arm
.msr(target
, 3, /*op 0*/
138 aarch64
->system_control_reg_curr
);
139 if (retval
!= ERROR_OK
)
144 retval
= armv8
->arm
.msr(target
, 3, /*op 0*/
147 aarch64
->system_control_reg_curr
);
148 if (retval
!= ERROR_OK
)
152 LOG_DEBUG("unknow cpu state 0x%x" PRIx32
, armv8
->arm
.core_state
);
156 if (aarch64
->system_control_reg_curr
& 0x4U
) {
157 /* data cache is active */
158 aarch64
->system_control_reg_curr
&= ~0x4U
;
159 /* flush data cache armv7 function to be called */
160 if (armv8
->armv8_mmu
.armv8_cache
.flush_all_data_cache
)
161 armv8
->armv8_mmu
.armv8_cache
.flush_all_data_cache(target
);
163 if ((aarch64
->system_control_reg_curr
& 0x1U
)) {
164 aarch64
->system_control_reg_curr
&= ~0x1U
;
165 switch (armv8
->arm
.core_mode
) {
169 retval
= armv8
->arm
.msr(target
, 3, /*op 0*/
172 aarch64
->system_control_reg_curr
);
173 if (retval
!= ERROR_OK
)
178 retval
= armv8
->arm
.msr(target
, 3, /*op 0*/
181 aarch64
->system_control_reg_curr
);
182 if (retval
!= ERROR_OK
)
187 retval
= armv8
->arm
.msr(target
, 3, /*op 0*/
190 aarch64
->system_control_reg_curr
);
191 if (retval
!= ERROR_OK
)
195 LOG_DEBUG("unknow cpu state 0x%x" PRIx32
, armv8
->arm
.core_state
);
204 * Basic debug access, very low level assumes state is saved
206 static int aarch64_init_debug_access(struct target
*target
)
208 struct armv8_common
*armv8
= target_to_armv8(target
);
214 /* Unlocking the debug registers for modification
215 * The debugport might be uninitialised so try twice */
216 retval
= mem_ap_write_atomic_u32(armv8
->debug_ap
,
217 armv8
->debug_base
+ CPUV8_DBG_LOCKACCESS
, 0xC5ACCE55);
218 if (retval
!= ERROR_OK
) {
220 retval
= mem_ap_write_atomic_u32(armv8
->debug_ap
,
221 armv8
->debug_base
+ CPUV8_DBG_LOCKACCESS
, 0xC5ACCE55);
222 if (retval
== ERROR_OK
)
223 LOG_USER("Locking debug access failed on first, but succeeded on second try.");
225 if (retval
!= ERROR_OK
)
227 /* Clear Sticky Power Down status Bit in PRSR to enable access to
228 the registers in the Core Power Domain */
229 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
230 armv8
->debug_base
+ CPUV8_DBG_PRSR
, &dummy
);
231 if (retval
!= ERROR_OK
)
234 /* Enabling of instruction execution in debug mode is done in debug_entry code */
236 /* Resync breakpoint registers */
238 /* Since this is likely called from init or reset, update target state information*/
239 return aarch64_poll(target
);
242 /* To reduce needless round-trips, pass in a pointer to the current
243 * DSCR value. Initialize it to zero if you just need to know the
244 * value on return from this function; or DSCR_ITE if you
245 * happen to know that no instruction is pending.
247 static int aarch64_exec_opcode(struct target
*target
,
248 uint32_t opcode
, uint32_t *dscr_p
)
252 struct armv8_common
*armv8
= target_to_armv8(target
);
253 dscr
= dscr_p
? *dscr_p
: 0;
255 LOG_DEBUG("exec opcode 0x%08" PRIx32
, opcode
);
257 /* Wait for InstrCompl bit to be set */
258 long long then
= timeval_ms();
259 while ((dscr
& DSCR_ITE
) == 0) {
260 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
261 armv8
->debug_base
+ CPUV8_DBG_DSCR
, &dscr
);
262 if (retval
!= ERROR_OK
) {
263 LOG_ERROR("Could not read DSCR register, opcode = 0x%08" PRIx32
, opcode
);
266 if (timeval_ms() > then
+ 1000) {
267 LOG_ERROR("Timeout waiting for aarch64_exec_opcode");
272 retval
= mem_ap_write_u32(armv8
->debug_ap
,
273 armv8
->debug_base
+ CPUV8_DBG_ITR
, opcode
);
274 if (retval
!= ERROR_OK
)
279 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
280 armv8
->debug_base
+ CPUV8_DBG_DSCR
, &dscr
);
281 if (retval
!= ERROR_OK
) {
282 LOG_ERROR("Could not read DSCR register");
285 if (timeval_ms() > then
+ 1000) {
286 LOG_ERROR("Timeout waiting for aarch64_exec_opcode");
289 } while ((dscr
& DSCR_ITE
) == 0); /* Wait for InstrCompl bit to be set */
297 /* Write to memory mapped registers directly with no cache or mmu handling */
298 static int aarch64_dap_write_memap_register_u32(struct target
*target
,
303 struct armv8_common
*armv8
= target_to_armv8(target
);
305 retval
= mem_ap_write_atomic_u32(armv8
->debug_ap
, address
, value
);
311 * AARCH64 implementation of Debug Programmer's Model
313 * NOTE the invariant: these routines return with DSCR_ITE set,
314 * so there's no need to poll for it before executing an instruction.
316 * NOTE that in several of these cases the "stall" mode might be useful.
317 * It'd let us queue a few operations together... prepare/finish might
318 * be the places to enable/disable that mode.
321 static inline struct aarch64_common
*dpm_to_a8(struct arm_dpm
*dpm
)
323 return container_of(dpm
, struct aarch64_common
, armv8_common
.dpm
);
326 static int aarch64_write_dcc(struct armv8_common
*armv8
, uint32_t data
)
328 LOG_DEBUG("write DCC 0x%08" PRIx32
, data
);
329 return mem_ap_write_u32(armv8
->debug_ap
,
330 armv8
->debug_base
+ CPUV8_DBG_DTRRX
, data
);
333 static int aarch64_write_dcc_64(struct armv8_common
*armv8
, uint64_t data
)
336 LOG_DEBUG("write DCC Low word0x%08" PRIx32
, (unsigned)data
);
337 LOG_DEBUG("write DCC High word 0x%08" PRIx32
, (unsigned)(data
>> 32));
338 ret
= mem_ap_write_u32(armv8
->debug_ap
,
339 armv8
->debug_base
+ CPUV8_DBG_DTRRX
, data
);
340 ret
+= mem_ap_write_u32(armv8
->debug_ap
,
341 armv8
->debug_base
+ CPUV8_DBG_DTRTX
, data
>> 32);
345 static int aarch64_read_dcc(struct armv8_common
*armv8
, uint32_t *data
,
348 uint32_t dscr
= DSCR_ITE
;
354 /* Wait for DTRRXfull */
355 long long then
= timeval_ms();
356 while ((dscr
& DSCR_DTR_TX_FULL
) == 0) {
357 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
358 armv8
->debug_base
+ CPUV8_DBG_DSCR
,
360 if (retval
!= ERROR_OK
)
362 if (timeval_ms() > then
+ 1000) {
363 LOG_ERROR("Timeout waiting for read dcc");
368 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
369 armv8
->debug_base
+ CPUV8_DBG_DTRTX
,
371 if (retval
!= ERROR_OK
)
373 LOG_DEBUG("read DCC 0x%08" PRIx32
, *data
);
381 static int aarch64_read_dcc_64(struct armv8_common
*armv8
, uint64_t *data
,
384 uint32_t dscr
= DSCR_ITE
;
391 /* Wait for DTRRXfull */
392 long long then
= timeval_ms();
393 while ((dscr
& DSCR_DTR_TX_FULL
) == 0) {
394 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
395 armv8
->debug_base
+ CPUV8_DBG_DSCR
,
397 if (retval
!= ERROR_OK
)
399 if (timeval_ms() > then
+ 1000) {
400 LOG_ERROR("Timeout waiting for read dcc");
405 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
406 armv8
->debug_base
+ CPUV8_DBG_DTRTX
,
408 if (retval
!= ERROR_OK
)
411 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
412 armv8
->debug_base
+ CPUV8_DBG_DTRRX
,
414 if (retval
!= ERROR_OK
)
417 *data
= *(uint32_t *)data
| (uint64_t)higher
<< 32;
418 LOG_DEBUG("read DCC 0x%16.16" PRIx64
, *data
);
426 static int aarch64_dpm_prepare(struct arm_dpm
*dpm
)
428 struct aarch64_common
*a8
= dpm_to_a8(dpm
);
432 /* set up invariant: INSTR_COMP is set after ever DPM operation */
433 long long then
= timeval_ms();
435 retval
= mem_ap_read_atomic_u32(a8
->armv8_common
.debug_ap
,
436 a8
->armv8_common
.debug_base
+ CPUV8_DBG_DSCR
,
438 if (retval
!= ERROR_OK
)
440 if ((dscr
& DSCR_ITE
) != 0)
442 if (timeval_ms() > then
+ 1000) {
443 LOG_ERROR("Timeout waiting for dpm prepare");
448 /* this "should never happen" ... */
449 if (dscr
& DSCR_DTR_RX_FULL
) {
450 LOG_ERROR("DSCR_DTR_RX_FULL, dscr 0x%08" PRIx32
, dscr
);
452 retval
= mem_ap_read_u32(a8
->armv8_common
.debug_ap
,
453 a8
->armv8_common
.debug_base
+ CPUV8_DBG_DTRRX
, &dscr
);
454 if (retval
!= ERROR_OK
)
457 /* Clear sticky error */
458 retval
= mem_ap_write_u32(a8
->armv8_common
.debug_ap
,
459 a8
->armv8_common
.debug_base
+ CPUV8_DBG_DRCR
, DRCR_CSE
);
460 if (retval
!= ERROR_OK
)
467 static int aarch64_dpm_finish(struct arm_dpm
*dpm
)
469 /* REVISIT what could be done here? */
473 static int aarch64_instr_execute(struct arm_dpm
*dpm
,
476 struct aarch64_common
*a8
= dpm_to_a8(dpm
);
477 uint32_t dscr
= DSCR_ITE
;
479 return aarch64_exec_opcode(
480 a8
->armv8_common
.arm
.target
,
485 static int aarch64_instr_write_data_dcc(struct arm_dpm
*dpm
,
486 uint32_t opcode
, uint32_t data
)
488 struct aarch64_common
*a8
= dpm_to_a8(dpm
);
490 uint32_t dscr
= DSCR_ITE
;
492 retval
= aarch64_write_dcc(&a8
->armv8_common
, data
);
493 if (retval
!= ERROR_OK
)
496 return aarch64_exec_opcode(
497 a8
->armv8_common
.arm
.target
,
502 static int aarch64_instr_write_data_dcc_64(struct arm_dpm
*dpm
,
503 uint32_t opcode
, uint64_t data
)
505 struct aarch64_common
*a8
= dpm_to_a8(dpm
);
507 uint32_t dscr
= DSCR_ITE
;
509 retval
= aarch64_write_dcc_64(&a8
->armv8_common
, data
);
510 if (retval
!= ERROR_OK
)
513 return aarch64_exec_opcode(
514 a8
->armv8_common
.arm
.target
,
519 static int aarch64_instr_write_data_r0(struct arm_dpm
*dpm
,
520 uint32_t opcode
, uint32_t data
)
522 struct aarch64_common
*a8
= dpm_to_a8(dpm
);
523 uint32_t dscr
= DSCR_ITE
;
526 retval
= aarch64_write_dcc(&a8
->armv8_common
, data
);
527 if (retval
!= ERROR_OK
)
530 retval
= aarch64_exec_opcode(
531 a8
->armv8_common
.arm
.target
,
532 ARMV8_MRS(SYSTEM_DBG_DTRRX_EL0
, 0),
534 if (retval
!= ERROR_OK
)
537 /* then the opcode, taking data from R0 */
538 retval
= aarch64_exec_opcode(
539 a8
->armv8_common
.arm
.target
,
546 static int aarch64_instr_write_data_r0_64(struct arm_dpm
*dpm
,
547 uint32_t opcode
, uint64_t data
)
549 struct aarch64_common
*a8
= dpm_to_a8(dpm
);
550 uint32_t dscr
= DSCR_ITE
;
553 retval
= aarch64_write_dcc_64(&a8
->armv8_common
, data
);
554 if (retval
!= ERROR_OK
)
557 retval
= aarch64_exec_opcode(
558 a8
->armv8_common
.arm
.target
,
559 ARMV8_MRS(SYSTEM_DBG_DBGDTR_EL0
, 0),
561 if (retval
!= ERROR_OK
)
564 /* then the opcode, taking data from R0 */
565 retval
= aarch64_exec_opcode(
566 a8
->armv8_common
.arm
.target
,
573 static int aarch64_instr_cpsr_sync(struct arm_dpm
*dpm
)
575 struct target
*target
= dpm
->arm
->target
;
576 uint32_t dscr
= DSCR_ITE
;
578 /* "Prefetch flush" after modifying execution status in CPSR */
579 return aarch64_exec_opcode(target
,
584 static int aarch64_instr_read_data_dcc(struct arm_dpm
*dpm
,
585 uint32_t opcode
, uint32_t *data
)
587 struct aarch64_common
*a8
= dpm_to_a8(dpm
);
589 uint32_t dscr
= DSCR_ITE
;
591 /* the opcode, writing data to DCC */
592 retval
= aarch64_exec_opcode(
593 a8
->armv8_common
.arm
.target
,
596 if (retval
!= ERROR_OK
)
599 return aarch64_read_dcc(&a8
->armv8_common
, data
, &dscr
);
602 static int aarch64_instr_read_data_dcc_64(struct arm_dpm
*dpm
,
603 uint32_t opcode
, uint64_t *data
)
605 struct aarch64_common
*a8
= dpm_to_a8(dpm
);
607 uint32_t dscr
= DSCR_ITE
;
609 /* the opcode, writing data to DCC */
610 retval
= aarch64_exec_opcode(
611 a8
->armv8_common
.arm
.target
,
614 if (retval
!= ERROR_OK
)
617 return aarch64_read_dcc_64(&a8
->armv8_common
, data
, &dscr
);
620 static int aarch64_instr_read_data_r0(struct arm_dpm
*dpm
,
621 uint32_t opcode
, uint32_t *data
)
623 struct aarch64_common
*a8
= dpm_to_a8(dpm
);
624 uint32_t dscr
= DSCR_ITE
;
627 /* the opcode, writing data to R0 */
628 retval
= aarch64_exec_opcode(
629 a8
->armv8_common
.arm
.target
,
632 if (retval
!= ERROR_OK
)
635 /* write R0 to DCC */
636 retval
= aarch64_exec_opcode(
637 a8
->armv8_common
.arm
.target
,
638 ARMV8_MSR_GP(SYSTEM_DBG_DTRTX_EL0
, 0), /* msr dbgdtr_el0, x0 */
640 if (retval
!= ERROR_OK
)
643 return aarch64_read_dcc(&a8
->armv8_common
, data
, &dscr
);
646 static int aarch64_instr_read_data_r0_64(struct arm_dpm
*dpm
,
647 uint32_t opcode
, uint64_t *data
)
649 struct aarch64_common
*a8
= dpm_to_a8(dpm
);
650 uint32_t dscr
= DSCR_ITE
;
653 /* the opcode, writing data to R0 */
654 retval
= aarch64_exec_opcode(
655 a8
->armv8_common
.arm
.target
,
658 if (retval
!= ERROR_OK
)
661 /* write R0 to DCC */
662 retval
= aarch64_exec_opcode(
663 a8
->armv8_common
.arm
.target
,
664 ARMV8_MSR_GP(SYSTEM_DBG_DBGDTR_EL0
, 0), /* msr dbgdtr_el0, x0 */
666 if (retval
!= ERROR_OK
)
669 return aarch64_read_dcc_64(&a8
->armv8_common
, data
, &dscr
);
672 static int aarch64_bpwp_enable(struct arm_dpm
*dpm
, unsigned index_t
,
673 uint32_t addr
, uint32_t control
)
675 struct aarch64_common
*a8
= dpm_to_a8(dpm
);
676 uint32_t vr
= a8
->armv8_common
.debug_base
;
677 uint32_t cr
= a8
->armv8_common
.debug_base
;
681 case 0 ... 15: /* breakpoints */
682 vr
+= CPUV8_DBG_BVR_BASE
;
683 cr
+= CPUV8_DBG_BCR_BASE
;
685 case 16 ... 31: /* watchpoints */
686 vr
+= CPUV8_DBG_WVR_BASE
;
687 cr
+= CPUV8_DBG_WCR_BASE
;
696 LOG_DEBUG("A8: bpwp enable, vr %08x cr %08x",
697 (unsigned) vr
, (unsigned) cr
);
699 retval
= aarch64_dap_write_memap_register_u32(dpm
->arm
->target
,
701 if (retval
!= ERROR_OK
)
703 retval
= aarch64_dap_write_memap_register_u32(dpm
->arm
->target
,
708 static int aarch64_bpwp_disable(struct arm_dpm
*dpm
, unsigned index_t
)
710 struct aarch64_common
*a
= dpm_to_a8(dpm
);
715 cr
= a
->armv8_common
.debug_base
+ CPUV8_DBG_BCR_BASE
;
718 cr
= a
->armv8_common
.debug_base
+ CPUV8_DBG_WCR_BASE
;
726 LOG_DEBUG("A: bpwp disable, cr %08x", (unsigned) cr
);
728 /* clear control register */
729 return aarch64_dap_write_memap_register_u32(dpm
->arm
->target
, cr
, 0);
733 static int aarch64_dpm_setup(struct aarch64_common
*a8
, uint64_t debug
)
735 struct arm_dpm
*dpm
= &a8
->armv8_common
.dpm
;
738 dpm
->arm
= &a8
->armv8_common
.arm
;
741 dpm
->prepare
= aarch64_dpm_prepare
;
742 dpm
->finish
= aarch64_dpm_finish
;
744 dpm
->instr_execute
= aarch64_instr_execute
;
745 dpm
->instr_write_data_dcc
= aarch64_instr_write_data_dcc
;
746 dpm
->instr_write_data_dcc_64
= aarch64_instr_write_data_dcc_64
;
747 dpm
->instr_write_data_r0
= aarch64_instr_write_data_r0
;
748 dpm
->instr_write_data_r0_64
= aarch64_instr_write_data_r0_64
;
749 dpm
->instr_cpsr_sync
= aarch64_instr_cpsr_sync
;
751 dpm
->instr_read_data_dcc
= aarch64_instr_read_data_dcc
;
752 dpm
->instr_read_data_dcc_64
= aarch64_instr_read_data_dcc_64
;
753 dpm
->instr_read_data_r0
= aarch64_instr_read_data_r0
;
754 dpm
->instr_read_data_r0_64
= aarch64_instr_read_data_r0_64
;
756 dpm
->arm_reg_current
= armv8_reg_current
;
758 dpm
->bpwp_enable
= aarch64_bpwp_enable
;
759 dpm
->bpwp_disable
= aarch64_bpwp_disable
;
761 retval
= armv8_dpm_setup(dpm
);
762 if (retval
== ERROR_OK
)
763 retval
= armv8_dpm_initialize(dpm
);
767 static struct target
*get_aarch64(struct target
*target
, int32_t coreid
)
769 struct target_list
*head
;
773 while (head
!= (struct target_list
*)NULL
) {
775 if ((curr
->coreid
== coreid
) && (curr
->state
== TARGET_HALTED
))
781 static int aarch64_halt(struct target
*target
);
783 static int aarch64_halt_smp(struct target
*target
)
786 struct target_list
*head
;
789 while (head
!= (struct target_list
*)NULL
) {
791 if ((curr
!= target
) && (curr
->state
!= TARGET_HALTED
))
792 retval
+= aarch64_halt(curr
);
798 static int update_halt_gdb(struct target
*target
)
801 if (target
->gdb_service
&& target
->gdb_service
->core
[0] == -1) {
802 target
->gdb_service
->target
= target
;
803 target
->gdb_service
->core
[0] = target
->coreid
;
804 retval
+= aarch64_halt_smp(target
);
810 * Cortex-A8 Run control
813 static int aarch64_poll(struct target
*target
)
815 int retval
= ERROR_OK
;
817 struct aarch64_common
*aarch64
= target_to_aarch64(target
);
818 struct armv8_common
*armv8
= &aarch64
->armv8_common
;
819 enum target_state prev_target_state
= target
->state
;
820 /* toggle to another core is done by gdb as follow */
821 /* maint packet J core_id */
823 /* the next polling trigger an halt event sent to gdb */
824 if ((target
->state
== TARGET_HALTED
) && (target
->smp
) &&
825 (target
->gdb_service
) &&
826 (target
->gdb_service
->target
== NULL
)) {
827 target
->gdb_service
->target
=
828 get_aarch64(target
, target
->gdb_service
->core
[1]);
829 target_call_event_callbacks(target
, TARGET_EVENT_HALTED
);
832 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
833 armv8
->debug_base
+ CPUV8_DBG_DSCR
, &dscr
);
834 if (retval
!= ERROR_OK
)
836 aarch64
->cpudbg_dscr
= dscr
;
838 if (DSCR_RUN_MODE(dscr
) == 0x3) {
839 if (prev_target_state
!= TARGET_HALTED
) {
840 /* We have a halting debug event */
841 LOG_DEBUG("Target halted");
842 target
->state
= TARGET_HALTED
;
843 if ((prev_target_state
== TARGET_RUNNING
)
844 || (prev_target_state
== TARGET_UNKNOWN
)
845 || (prev_target_state
== TARGET_RESET
)) {
846 retval
= aarch64_debug_entry(target
);
847 if (retval
!= ERROR_OK
)
850 retval
= update_halt_gdb(target
);
851 if (retval
!= ERROR_OK
)
854 target_call_event_callbacks(target
,
855 TARGET_EVENT_HALTED
);
857 if (prev_target_state
== TARGET_DEBUG_RUNNING
) {
860 retval
= aarch64_debug_entry(target
);
861 if (retval
!= ERROR_OK
)
864 retval
= update_halt_gdb(target
);
865 if (retval
!= ERROR_OK
)
869 target_call_event_callbacks(target
,
870 TARGET_EVENT_DEBUG_HALTED
);
874 target
->state
= TARGET_RUNNING
;
879 static int aarch64_halt(struct target
*target
)
881 int retval
= ERROR_OK
;
883 struct armv8_common
*armv8
= target_to_armv8(target
);
886 retval
= mem_ap_write_atomic_u32(armv8
->debug_ap
,
887 armv8
->cti_base
+ CTI_CTR
, 1);
888 if (retval
!= ERROR_OK
)
891 retval
= mem_ap_write_atomic_u32(armv8
->debug_ap
,
892 armv8
->cti_base
+ CTI_GATE
, 3);
893 if (retval
!= ERROR_OK
)
896 retval
= mem_ap_write_atomic_u32(armv8
->debug_ap
,
897 armv8
->cti_base
+ CTI_OUTEN0
, 1);
898 if (retval
!= ERROR_OK
)
901 retval
= mem_ap_write_atomic_u32(armv8
->debug_ap
,
902 armv8
->cti_base
+ CTI_OUTEN1
, 2);
903 if (retval
!= ERROR_OK
)
907 * add HDE in halting debug mode
909 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
910 armv8
->debug_base
+ CPUV8_DBG_DSCR
, &dscr
);
911 if (retval
!= ERROR_OK
)
914 retval
= mem_ap_write_atomic_u32(armv8
->debug_ap
,
915 armv8
->debug_base
+ CPUV8_DBG_DSCR
, dscr
| DSCR_HDE
);
916 if (retval
!= ERROR_OK
)
919 retval
= mem_ap_write_atomic_u32(armv8
->debug_ap
,
920 armv8
->cti_base
+ CTI_APPPULSE
, 1);
921 if (retval
!= ERROR_OK
)
924 retval
= mem_ap_write_atomic_u32(armv8
->debug_ap
,
925 armv8
->cti_base
+ CTI_INACK
, 1);
926 if (retval
!= ERROR_OK
)
930 long long then
= timeval_ms();
932 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
933 armv8
->debug_base
+ CPUV8_DBG_DSCR
, &dscr
);
934 if (retval
!= ERROR_OK
)
936 if ((dscr
& DSCRV8_HALT_MASK
) != 0)
938 if (timeval_ms() > then
+ 1000) {
939 LOG_ERROR("Timeout waiting for halt");
944 target
->debug_reason
= DBG_REASON_DBGRQ
;
949 static int aarch64_internal_restore(struct target
*target
, int current
,
950 uint64_t *address
, int handle_breakpoints
, int debug_execution
)
952 struct armv8_common
*armv8
= target_to_armv8(target
);
953 struct arm
*arm
= &armv8
->arm
;
957 if (!debug_execution
)
958 target_free_all_working_areas(target
);
960 /* current = 1: continue on current pc, otherwise continue at <address> */
961 resume_pc
= buf_get_u64(arm
->pc
->value
, 0, 64);
963 resume_pc
= *address
;
965 *address
= resume_pc
;
967 /* Make sure that the Armv7 gdb thumb fixups does not
968 * kill the return address
970 switch (arm
->core_state
) {
972 resume_pc
&= 0xFFFFFFFC;
974 case ARM_STATE_AARCH64
:
975 resume_pc
&= 0xFFFFFFFFFFFFFFFC;
977 case ARM_STATE_THUMB
:
978 case ARM_STATE_THUMB_EE
:
979 /* When the return address is loaded into PC
980 * bit 0 must be 1 to stay in Thumb state
984 case ARM_STATE_JAZELLE
:
985 LOG_ERROR("How do I resume into Jazelle state??");
988 LOG_DEBUG("resume pc = 0x%16" PRIx64
, resume_pc
);
989 buf_set_u64(arm
->pc
->value
, 0, 64, resume_pc
);
992 dpmv8_modeswitch(&armv8
->dpm
, ARM_MODE_ANY
);
994 /* called it now before restoring context because it uses cpu
995 * register r0 for restoring system control register */
996 retval
= aarch64_restore_system_control_reg(target
);
997 if (retval
!= ERROR_OK
)
999 retval
= aarch64_restore_context(target
, handle_breakpoints
);
1000 if (retval
!= ERROR_OK
)
1002 target
->debug_reason
= DBG_REASON_NOTHALTED
;
1003 target
->state
= TARGET_RUNNING
;
1005 /* registers are now invalid */
1006 register_cache_invalidate(arm
->core_cache
);
1009 /* the front-end may request us not to handle breakpoints */
1010 if (handle_breakpoints
) {
1011 /* Single step past breakpoint at current address */
1012 breakpoint
= breakpoint_find(target
, resume_pc
);
1014 LOG_DEBUG("unset breakpoint at 0x%8.8x", breakpoint
->address
);
1015 cortex_m3_unset_breakpoint(target
, breakpoint
);
1016 cortex_m3_single_step_core(target
);
1017 cortex_m3_set_breakpoint(target
, breakpoint
);
1025 static int aarch64_internal_restart(struct target
*target
)
1027 struct armv8_common
*armv8
= target_to_armv8(target
);
1028 struct arm
*arm
= &armv8
->arm
;
1032 * * Restart core and wait for it to be started. Clear ITRen and sticky
1033 * * exception flags: see ARMv7 ARM, C5.9.
1035 * REVISIT: for single stepping, we probably want to
1036 * disable IRQs by default, with optional override...
1039 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
1040 armv8
->debug_base
+ CPUV8_DBG_DSCR
, &dscr
);
1041 if (retval
!= ERROR_OK
)
1044 if ((dscr
& DSCR_ITE
) == 0)
1045 LOG_ERROR("DSCR InstrCompl must be set before leaving debug!");
1047 retval
= mem_ap_write_atomic_u32(armv8
->debug_ap
,
1048 armv8
->cti_base
+ CTI_APPPULSE
, 2);
1049 if (retval
!= ERROR_OK
)
1052 long long then
= timeval_ms();
1054 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
1055 armv8
->debug_base
+ CPUV8_DBG_DSCR
, &dscr
);
1056 if (retval
!= ERROR_OK
)
1058 if ((dscr
& DSCR_HDE
) != 0)
1060 if (timeval_ms() > then
+ 1000) {
1061 LOG_ERROR("Timeout waiting for resume");
1066 target
->debug_reason
= DBG_REASON_NOTHALTED
;
1067 target
->state
= TARGET_RUNNING
;
1069 /* registers are now invalid */
1070 register_cache_invalidate(arm
->core_cache
);
1075 static int aarch64_restore_smp(struct target
*target
, int handle_breakpoints
)
1078 struct target_list
*head
;
1079 struct target
*curr
;
1081 head
= target
->head
;
1082 while (head
!= (struct target_list
*)NULL
) {
1083 curr
= head
->target
;
1084 if ((curr
!= target
) && (curr
->state
!= TARGET_RUNNING
)) {
1085 /* resume current address , not in step mode */
1086 retval
+= aarch64_internal_restore(curr
, 1, &address
,
1087 handle_breakpoints
, 0);
1088 retval
+= aarch64_internal_restart(curr
);
1096 static int aarch64_resume(struct target
*target
, int current
,
1097 target_addr_t address
, int handle_breakpoints
, int debug_execution
)
1100 uint64_t addr
= address
;
1102 /* dummy resume for smp toggle in order to reduce gdb impact */
1103 if ((target
->smp
) && (target
->gdb_service
->core
[1] != -1)) {
1104 /* simulate a start and halt of target */
1105 target
->gdb_service
->target
= NULL
;
1106 target
->gdb_service
->core
[0] = target
->gdb_service
->core
[1];
1107 /* fake resume at next poll we play the target core[1], see poll*/
1108 target_call_event_callbacks(target
, TARGET_EVENT_RESUMED
);
1111 aarch64_internal_restore(target
, current
, &addr
, handle_breakpoints
,
1114 target
->gdb_service
->core
[0] = -1;
1115 retval
= aarch64_restore_smp(target
, handle_breakpoints
);
1116 if (retval
!= ERROR_OK
)
1119 aarch64_internal_restart(target
);
1121 if (!debug_execution
) {
1122 target
->state
= TARGET_RUNNING
;
1123 target_call_event_callbacks(target
, TARGET_EVENT_RESUMED
);
1124 LOG_DEBUG("target resumed at 0x%" PRIx64
, addr
);
1126 target
->state
= TARGET_DEBUG_RUNNING
;
1127 target_call_event_callbacks(target
, TARGET_EVENT_DEBUG_RESUMED
);
1128 LOG_DEBUG("target debug resumed at 0x%" PRIx64
, addr
);
1134 static int aarch64_debug_entry(struct target
*target
)
1136 int retval
= ERROR_OK
;
1137 struct aarch64_common
*aarch64
= target_to_aarch64(target
);
1138 struct armv8_common
*armv8
= target_to_armv8(target
);
1140 LOG_DEBUG("dscr = 0x%08" PRIx32
, aarch64
->cpudbg_dscr
);
1142 /* REVISIT see A8 TRM 12.11.4 steps 2..3 -- make sure that any
1143 * imprecise data aborts get discarded by issuing a Data
1144 * Synchronization Barrier: ARMV4_5_MCR(15, 0, 0, 7, 10, 4).
1147 /* make sure to clear all sticky errors */
1148 retval
= mem_ap_write_atomic_u32(armv8
->debug_ap
,
1149 armv8
->debug_base
+ CPUV8_DBG_DRCR
, DRCR_CSE
);
1150 if (retval
!= ERROR_OK
)
1153 /* Examine debug reason */
1154 armv8_dpm_report_dscr(&armv8
->dpm
, aarch64
->cpudbg_dscr
);
1156 /* save address of instruction that triggered the watchpoint? */
1157 if (target
->debug_reason
== DBG_REASON_WATCHPOINT
) {
1161 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
1162 armv8
->debug_base
+ CPUV8_DBG_WFAR1
,
1164 if (retval
!= ERROR_OK
)
1167 wfar
= (wfar
<< 32);
1168 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
1169 armv8
->debug_base
+ CPUV8_DBG_WFAR0
,
1171 if (retval
!= ERROR_OK
)
1174 armv8_dpm_report_wfar(&armv8
->dpm
, wfar
);
1177 retval
= armv8_dpm_read_current_registers(&armv8
->dpm
);
1179 if (armv8
->post_debug_entry
) {
1180 retval
= armv8
->post_debug_entry(target
);
1181 if (retval
!= ERROR_OK
)
1188 static int aarch64_post_debug_entry(struct target
*target
)
1190 struct aarch64_common
*aarch64
= target_to_aarch64(target
);
1191 struct armv8_common
*armv8
= &aarch64
->armv8_common
;
1194 mem_ap_write_atomic_u32(armv8
->debug_ap
,
1195 armv8
->debug_base
+ CPUV8_DBG_DRCR
, 1<<2);
1196 switch (armv8
->arm
.core_mode
) {
1200 retval
= armv8
->arm
.mrs(target
, 3, /*op 0*/
1201 0, 0, /* op1, op2 */
1202 1, 0, /* CRn, CRm */
1203 &aarch64
->system_control_reg
);
1204 if (retval
!= ERROR_OK
)
1209 retval
= armv8
->arm
.mrs(target
, 3, /*op 0*/
1210 4, 0, /* op1, op2 */
1211 1, 0, /* CRn, CRm */
1212 &aarch64
->system_control_reg
);
1213 if (retval
!= ERROR_OK
)
1218 retval
= armv8
->arm
.mrs(target
, 3, /*op 0*/
1219 6, 0, /* op1, op2 */
1220 1, 0, /* CRn, CRm */
1221 &aarch64
->system_control_reg
);
1222 if (retval
!= ERROR_OK
)
1226 LOG_DEBUG("unknow cpu state 0x%x" PRIx32
, armv8
->arm
.core_state
);
1228 LOG_DEBUG("System_register: %8.8" PRIx32
, aarch64
->system_control_reg
);
1229 aarch64
->system_control_reg_curr
= aarch64
->system_control_reg
;
1231 if (armv8
->armv8_mmu
.armv8_cache
.ctype
== -1)
1232 armv8_identify_cache(target
);
1234 armv8
->armv8_mmu
.mmu_enabled
=
1235 (aarch64
->system_control_reg
& 0x1U
) ? 1 : 0;
1236 armv8
->armv8_mmu
.armv8_cache
.d_u_cache_enabled
=
1237 (aarch64
->system_control_reg
& 0x4U
) ? 1 : 0;
1238 armv8
->armv8_mmu
.armv8_cache
.i_cache_enabled
=
1239 (aarch64
->system_control_reg
& 0x1000U
) ? 1 : 0;
1240 aarch64
->curr_mode
= armv8
->arm
.core_mode
;
1244 static int aarch64_step(struct target
*target
, int current
, target_addr_t address
,
1245 int handle_breakpoints
)
1247 struct armv8_common
*armv8
= target_to_armv8(target
);
1251 if (target
->state
!= TARGET_HALTED
) {
1252 LOG_WARNING("target not halted");
1253 return ERROR_TARGET_NOT_HALTED
;
1256 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
1257 armv8
->debug_base
+ CPUV8_DBG_EDECR
, &edecr
);
1258 if (retval
!= ERROR_OK
)
1261 /* make sure EDECR.SS is not set when restoring the register */
1264 /* set EDECR.SS to enter hardware step mode */
1265 retval
= mem_ap_write_atomic_u32(armv8
->debug_ap
,
1266 armv8
->debug_base
+ CPUV8_DBG_EDECR
, (edecr
|0x4));
1267 if (retval
!= ERROR_OK
)
1270 /* resume the target */
1271 retval
= aarch64_resume(target
, current
, address
, 0, 0);
1272 if (retval
!= ERROR_OK
)
1275 long long then
= timeval_ms();
1276 while (target
->state
!= TARGET_HALTED
) {
1277 retval
= aarch64_poll(target
);
1278 if (retval
!= ERROR_OK
)
1280 if (timeval_ms() > then
+ 1000) {
1281 LOG_ERROR("timeout waiting for target halt");
1287 retval
= mem_ap_write_atomic_u32(armv8
->debug_ap
,
1288 armv8
->debug_base
+ CPUV8_DBG_EDECR
, edecr
);
1289 if (retval
!= ERROR_OK
)
1295 static int aarch64_restore_context(struct target
*target
, bool bpwp
)
1297 struct armv8_common
*armv8
= target_to_armv8(target
);
1301 if (armv8
->pre_restore_context
)
1302 armv8
->pre_restore_context(target
);
1304 return armv8_dpm_write_dirty_registers(&armv8
->dpm
, bpwp
);
1309 * Cortex-A8 Breakpoint and watchpoint functions
1312 /* Setup hardware Breakpoint Register Pair */
1313 static int aarch64_set_breakpoint(struct target
*target
,
1314 struct breakpoint
*breakpoint
, uint8_t matchmode
)
1319 uint8_t byte_addr_select
= 0x0F;
1320 struct aarch64_common
*aarch64
= target_to_aarch64(target
);
1321 struct armv8_common
*armv8
= &aarch64
->armv8_common
;
1322 struct aarch64_brp
*brp_list
= aarch64
->brp_list
;
1325 if (breakpoint
->set
) {
1326 LOG_WARNING("breakpoint already set");
1330 if (breakpoint
->type
== BKPT_HARD
) {
1332 while (brp_list
[brp_i
].used
&& (brp_i
< aarch64
->brp_num
))
1334 if (brp_i
>= aarch64
->brp_num
) {
1335 LOG_ERROR("ERROR Can not find free Breakpoint Register Pair");
1336 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
1338 breakpoint
->set
= brp_i
+ 1;
1339 if (breakpoint
->length
== 2)
1340 byte_addr_select
= (3 << (breakpoint
->address
& 0x02));
1341 control
= ((matchmode
& 0x7) << 20)
1343 | (byte_addr_select
<< 5)
1345 brp_list
[brp_i
].used
= 1;
1346 brp_list
[brp_i
].value
= breakpoint
->address
& 0xFFFFFFFFFFFFFFFC;
1347 brp_list
[brp_i
].control
= control
;
1348 bpt_value
= brp_list
[brp_i
].value
;
1350 retval
= aarch64_dap_write_memap_register_u32(target
, armv8
->debug_base
1351 + CPUV8_DBG_BVR_BASE
+ 16 * brp_list
[brp_i
].BRPn
,
1352 (uint32_t)(bpt_value
& 0xFFFFFFFF));
1353 if (retval
!= ERROR_OK
)
1355 retval
= aarch64_dap_write_memap_register_u32(target
, armv8
->debug_base
1356 + CPUV8_DBG_BVR_BASE
+ 4 + 16 * brp_list
[brp_i
].BRPn
,
1357 (uint32_t)(bpt_value
>> 32));
1358 if (retval
!= ERROR_OK
)
1361 retval
= aarch64_dap_write_memap_register_u32(target
, armv8
->debug_base
1362 + CPUV8_DBG_BCR_BASE
+ 16 * brp_list
[brp_i
].BRPn
,
1363 brp_list
[brp_i
].control
);
1364 if (retval
!= ERROR_OK
)
1366 LOG_DEBUG("brp %i control 0x%0" PRIx32
" value 0x%" TARGET_PRIxADDR
, brp_i
,
1367 brp_list
[brp_i
].control
,
1368 brp_list
[brp_i
].value
);
1370 } else if (breakpoint
->type
== BKPT_SOFT
) {
1372 buf_set_u32(code
, 0, 32, ARMV8_HLT(0x11));
1373 retval
= target_read_memory(target
,
1374 breakpoint
->address
& 0xFFFFFFFFFFFFFFFE,
1375 breakpoint
->length
, 1,
1376 breakpoint
->orig_instr
);
1377 if (retval
!= ERROR_OK
)
1379 retval
= target_write_memory(target
,
1380 breakpoint
->address
& 0xFFFFFFFFFFFFFFFE,
1381 breakpoint
->length
, 1, code
);
1382 if (retval
!= ERROR_OK
)
1384 breakpoint
->set
= 0x11; /* Any nice value but 0 */
1387 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
1388 armv8
->debug_base
+ CPUV8_DBG_DSCR
, &dscr
);
1389 /* Ensure that halting debug mode is enable */
1390 dscr
= dscr
| DSCR_HDE
;
1391 retval
= mem_ap_write_atomic_u32(armv8
->debug_ap
,
1392 armv8
->debug_base
+ CPUV8_DBG_DSCR
, dscr
);
1393 if (retval
!= ERROR_OK
) {
1394 LOG_DEBUG("Failed to set DSCR.HDE");
1401 static int aarch64_set_context_breakpoint(struct target
*target
,
1402 struct breakpoint
*breakpoint
, uint8_t matchmode
)
1404 int retval
= ERROR_FAIL
;
1407 uint8_t byte_addr_select
= 0x0F;
1408 struct aarch64_common
*aarch64
= target_to_aarch64(target
);
1409 struct armv8_common
*armv8
= &aarch64
->armv8_common
;
1410 struct aarch64_brp
*brp_list
= aarch64
->brp_list
;
1412 if (breakpoint
->set
) {
1413 LOG_WARNING("breakpoint already set");
1416 /*check available context BRPs*/
1417 while ((brp_list
[brp_i
].used
||
1418 (brp_list
[brp_i
].type
!= BRP_CONTEXT
)) && (brp_i
< aarch64
->brp_num
))
1421 if (brp_i
>= aarch64
->brp_num
) {
1422 LOG_ERROR("ERROR Can not find free Breakpoint Register Pair");
1426 breakpoint
->set
= brp_i
+ 1;
1427 control
= ((matchmode
& 0x7) << 20)
1429 | (byte_addr_select
<< 5)
1431 brp_list
[brp_i
].used
= 1;
1432 brp_list
[brp_i
].value
= (breakpoint
->asid
);
1433 brp_list
[brp_i
].control
= control
;
1434 retval
= aarch64_dap_write_memap_register_u32(target
, armv8
->debug_base
1435 + CPUV8_DBG_BVR_BASE
+ 16 * brp_list
[brp_i
].BRPn
,
1436 brp_list
[brp_i
].value
);
1437 if (retval
!= ERROR_OK
)
1439 retval
= aarch64_dap_write_memap_register_u32(target
, armv8
->debug_base
1440 + CPUV8_DBG_BCR_BASE
+ 16 * brp_list
[brp_i
].BRPn
,
1441 brp_list
[brp_i
].control
);
1442 if (retval
!= ERROR_OK
)
1444 LOG_DEBUG("brp %i control 0x%0" PRIx32
" value 0x%" TARGET_PRIxADDR
, brp_i
,
1445 brp_list
[brp_i
].control
,
1446 brp_list
[brp_i
].value
);
1451 static int aarch64_set_hybrid_breakpoint(struct target
*target
, struct breakpoint
*breakpoint
)
1453 int retval
= ERROR_FAIL
;
1454 int brp_1
= 0; /* holds the contextID pair */
1455 int brp_2
= 0; /* holds the IVA pair */
1456 uint32_t control_CTX
, control_IVA
;
1457 uint8_t CTX_byte_addr_select
= 0x0F;
1458 uint8_t IVA_byte_addr_select
= 0x0F;
1459 uint8_t CTX_machmode
= 0x03;
1460 uint8_t IVA_machmode
= 0x01;
1461 struct aarch64_common
*aarch64
= target_to_aarch64(target
);
1462 struct armv8_common
*armv8
= &aarch64
->armv8_common
;
1463 struct aarch64_brp
*brp_list
= aarch64
->brp_list
;
1465 if (breakpoint
->set
) {
1466 LOG_WARNING("breakpoint already set");
1469 /*check available context BRPs*/
1470 while ((brp_list
[brp_1
].used
||
1471 (brp_list
[brp_1
].type
!= BRP_CONTEXT
)) && (brp_1
< aarch64
->brp_num
))
1474 printf("brp(CTX) found num: %d\n", brp_1
);
1475 if (brp_1
>= aarch64
->brp_num
) {
1476 LOG_ERROR("ERROR Can not find free Breakpoint Register Pair");
1480 while ((brp_list
[brp_2
].used
||
1481 (brp_list
[brp_2
].type
!= BRP_NORMAL
)) && (brp_2
< aarch64
->brp_num
))
1484 printf("brp(IVA) found num: %d\n", brp_2
);
1485 if (brp_2
>= aarch64
->brp_num
) {
1486 LOG_ERROR("ERROR Can not find free Breakpoint Register Pair");
1490 breakpoint
->set
= brp_1
+ 1;
1491 breakpoint
->linked_BRP
= brp_2
;
1492 control_CTX
= ((CTX_machmode
& 0x7) << 20)
1495 | (CTX_byte_addr_select
<< 5)
1497 brp_list
[brp_1
].used
= 1;
1498 brp_list
[brp_1
].value
= (breakpoint
->asid
);
1499 brp_list
[brp_1
].control
= control_CTX
;
1500 retval
= aarch64_dap_write_memap_register_u32(target
, armv8
->debug_base
1501 + CPUV8_DBG_BVR_BASE
+ 16 * brp_list
[brp_1
].BRPn
,
1502 brp_list
[brp_1
].value
);
1503 if (retval
!= ERROR_OK
)
1505 retval
= aarch64_dap_write_memap_register_u32(target
, armv8
->debug_base
1506 + CPUV8_DBG_BCR_BASE
+ 16 * brp_list
[brp_1
].BRPn
,
1507 brp_list
[brp_1
].control
);
1508 if (retval
!= ERROR_OK
)
1511 control_IVA
= ((IVA_machmode
& 0x7) << 20)
1514 | (IVA_byte_addr_select
<< 5)
1516 brp_list
[brp_2
].used
= 1;
1517 brp_list
[brp_2
].value
= breakpoint
->address
& 0xFFFFFFFFFFFFFFFC;
1518 brp_list
[brp_2
].control
= control_IVA
;
1519 retval
= aarch64_dap_write_memap_register_u32(target
, armv8
->debug_base
1520 + CPUV8_DBG_BVR_BASE
+ 16 * brp_list
[brp_2
].BRPn
,
1521 brp_list
[brp_2
].value
& 0xFFFFFFFF);
1522 if (retval
!= ERROR_OK
)
1524 retval
= aarch64_dap_write_memap_register_u32(target
, armv8
->debug_base
1525 + CPUV8_DBG_BVR_BASE
+ 4 + 16 * brp_list
[brp_2
].BRPn
,
1526 brp_list
[brp_2
].value
>> 32);
1527 if (retval
!= ERROR_OK
)
1529 retval
= aarch64_dap_write_memap_register_u32(target
, armv8
->debug_base
1530 + CPUV8_DBG_BCR_BASE
+ 16 * brp_list
[brp_2
].BRPn
,
1531 brp_list
[brp_2
].control
);
1532 if (retval
!= ERROR_OK
)
1538 static int aarch64_unset_breakpoint(struct target
*target
, struct breakpoint
*breakpoint
)
1541 struct aarch64_common
*aarch64
= target_to_aarch64(target
);
1542 struct armv8_common
*armv8
= &aarch64
->armv8_common
;
1543 struct aarch64_brp
*brp_list
= aarch64
->brp_list
;
1545 if (!breakpoint
->set
) {
1546 LOG_WARNING("breakpoint not set");
1550 if (breakpoint
->type
== BKPT_HARD
) {
1551 if ((breakpoint
->address
!= 0) && (breakpoint
->asid
!= 0)) {
1552 int brp_i
= breakpoint
->set
- 1;
1553 int brp_j
= breakpoint
->linked_BRP
;
1554 if ((brp_i
< 0) || (brp_i
>= aarch64
->brp_num
)) {
1555 LOG_DEBUG("Invalid BRP number in breakpoint");
1558 LOG_DEBUG("rbp %i control 0x%0" PRIx32
" value 0x%" TARGET_PRIxADDR
, brp_i
,
1559 brp_list
[brp_i
].control
, brp_list
[brp_i
].value
);
1560 brp_list
[brp_i
].used
= 0;
1561 brp_list
[brp_i
].value
= 0;
1562 brp_list
[brp_i
].control
= 0;
1563 retval
= aarch64_dap_write_memap_register_u32(target
, armv8
->debug_base
1564 + CPUV8_DBG_BCR_BASE
+ 16 * brp_list
[brp_i
].BRPn
,
1565 brp_list
[brp_i
].control
);
1566 if (retval
!= ERROR_OK
)
1568 retval
= aarch64_dap_write_memap_register_u32(target
, armv8
->debug_base
1569 + CPUV8_DBG_BVR_BASE
+ 16 * brp_list
[brp_i
].BRPn
,
1570 (uint32_t)brp_list
[brp_i
].value
);
1571 if (retval
!= ERROR_OK
)
1573 retval
= aarch64_dap_write_memap_register_u32(target
, armv8
->debug_base
1574 + CPUV8_DBG_BVR_BASE
+ 4 + 16 * brp_list
[brp_i
].BRPn
,
1575 (uint32_t)brp_list
[brp_i
].value
);
1576 if (retval
!= ERROR_OK
)
1578 if ((brp_j
< 0) || (brp_j
>= aarch64
->brp_num
)) {
1579 LOG_DEBUG("Invalid BRP number in breakpoint");
1582 LOG_DEBUG("rbp %i control 0x%0" PRIx32
" value 0x%0" PRIx64
, brp_j
,
1583 brp_list
[brp_j
].control
, brp_list
[brp_j
].value
);
1584 brp_list
[brp_j
].used
= 0;
1585 brp_list
[brp_j
].value
= 0;
1586 brp_list
[brp_j
].control
= 0;
1587 retval
= aarch64_dap_write_memap_register_u32(target
, armv8
->debug_base
1588 + CPUV8_DBG_BCR_BASE
+ 16 * brp_list
[brp_j
].BRPn
,
1589 brp_list
[brp_j
].control
);
1590 if (retval
!= ERROR_OK
)
1592 retval
= aarch64_dap_write_memap_register_u32(target
, armv8
->debug_base
1593 + CPUV8_DBG_BVR_BASE
+ 16 * brp_list
[brp_j
].BRPn
,
1594 (uint32_t)brp_list
[brp_j
].value
);
1595 if (retval
!= ERROR_OK
)
1597 retval
= aarch64_dap_write_memap_register_u32(target
, armv8
->debug_base
1598 + CPUV8_DBG_BVR_BASE
+ 4 + 16 * brp_list
[brp_j
].BRPn
,
1599 (uint32_t)brp_list
[brp_j
].value
);
1600 if (retval
!= ERROR_OK
)
1603 breakpoint
->linked_BRP
= 0;
1604 breakpoint
->set
= 0;
1608 int brp_i
= breakpoint
->set
- 1;
1609 if ((brp_i
< 0) || (brp_i
>= aarch64
->brp_num
)) {
1610 LOG_DEBUG("Invalid BRP number in breakpoint");
1613 LOG_DEBUG("rbp %i control 0x%0" PRIx32
" value 0x%0" PRIx64
, brp_i
,
1614 brp_list
[brp_i
].control
, brp_list
[brp_i
].value
);
1615 brp_list
[brp_i
].used
= 0;
1616 brp_list
[brp_i
].value
= 0;
1617 brp_list
[brp_i
].control
= 0;
1618 retval
= aarch64_dap_write_memap_register_u32(target
, armv8
->debug_base
1619 + CPUV8_DBG_BCR_BASE
+ 16 * brp_list
[brp_i
].BRPn
,
1620 brp_list
[brp_i
].control
);
1621 if (retval
!= ERROR_OK
)
1623 retval
= aarch64_dap_write_memap_register_u32(target
, armv8
->debug_base
1624 + CPUV8_DBG_BVR_BASE
+ 16 * brp_list
[brp_i
].BRPn
,
1625 brp_list
[brp_i
].value
);
1626 if (retval
!= ERROR_OK
)
1629 retval
= aarch64_dap_write_memap_register_u32(target
, armv8
->debug_base
1630 + CPUV8_DBG_BVR_BASE
+ 4 + 16 * brp_list
[brp_i
].BRPn
,
1631 (uint32_t)brp_list
[brp_i
].value
);
1632 if (retval
!= ERROR_OK
)
1634 breakpoint
->set
= 0;
1638 /* restore original instruction (kept in target endianness) */
1639 if (breakpoint
->length
== 4) {
1640 retval
= target_write_memory(target
,
1641 breakpoint
->address
& 0xFFFFFFFFFFFFFFFE,
1642 4, 1, breakpoint
->orig_instr
);
1643 if (retval
!= ERROR_OK
)
1646 retval
= target_write_memory(target
,
1647 breakpoint
->address
& 0xFFFFFFFFFFFFFFFE,
1648 2, 1, breakpoint
->orig_instr
);
1649 if (retval
!= ERROR_OK
)
1653 breakpoint
->set
= 0;
1658 static int aarch64_add_breakpoint(struct target
*target
,
1659 struct breakpoint
*breakpoint
)
1661 struct aarch64_common
*aarch64
= target_to_aarch64(target
);
1663 if ((breakpoint
->type
== BKPT_HARD
) && (aarch64
->brp_num_available
< 1)) {
1664 LOG_INFO("no hardware breakpoint available");
1665 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
1668 if (breakpoint
->type
== BKPT_HARD
)
1669 aarch64
->brp_num_available
--;
1671 return aarch64_set_breakpoint(target
, breakpoint
, 0x00); /* Exact match */
1674 static int aarch64_add_context_breakpoint(struct target
*target
,
1675 struct breakpoint
*breakpoint
)
1677 struct aarch64_common
*aarch64
= target_to_aarch64(target
);
1679 if ((breakpoint
->type
== BKPT_HARD
) && (aarch64
->brp_num_available
< 1)) {
1680 LOG_INFO("no hardware breakpoint available");
1681 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
1684 if (breakpoint
->type
== BKPT_HARD
)
1685 aarch64
->brp_num_available
--;
1687 return aarch64_set_context_breakpoint(target
, breakpoint
, 0x02); /* asid match */
1690 static int aarch64_add_hybrid_breakpoint(struct target
*target
,
1691 struct breakpoint
*breakpoint
)
1693 struct aarch64_common
*aarch64
= target_to_aarch64(target
);
1695 if ((breakpoint
->type
== BKPT_HARD
) && (aarch64
->brp_num_available
< 1)) {
1696 LOG_INFO("no hardware breakpoint available");
1697 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
1700 if (breakpoint
->type
== BKPT_HARD
)
1701 aarch64
->brp_num_available
--;
1703 return aarch64_set_hybrid_breakpoint(target
, breakpoint
); /* ??? */
1707 static int aarch64_remove_breakpoint(struct target
*target
, struct breakpoint
*breakpoint
)
1709 struct aarch64_common
*aarch64
= target_to_aarch64(target
);
1712 /* It is perfectly possible to remove breakpoints while the target is running */
1713 if (target
->state
!= TARGET_HALTED
) {
1714 LOG_WARNING("target not halted");
1715 return ERROR_TARGET_NOT_HALTED
;
1719 if (breakpoint
->set
) {
1720 aarch64_unset_breakpoint(target
, breakpoint
);
1721 if (breakpoint
->type
== BKPT_HARD
)
1722 aarch64
->brp_num_available
++;
1729 * Cortex-A8 Reset functions
1732 static int aarch64_assert_reset(struct target
*target
)
1734 struct armv8_common
*armv8
= target_to_armv8(target
);
1738 /* FIXME when halt is requested, make it work somehow... */
1740 /* Issue some kind of warm reset. */
1741 if (target_has_event_action(target
, TARGET_EVENT_RESET_ASSERT
))
1742 target_handle_event(target
, TARGET_EVENT_RESET_ASSERT
);
1743 else if (jtag_get_reset_config() & RESET_HAS_SRST
) {
1744 /* REVISIT handle "pulls" cases, if there's
1745 * hardware that needs them to work.
1747 jtag_add_reset(0, 1);
1749 LOG_ERROR("%s: how to reset?", target_name(target
));
1753 /* registers are now invalid */
1754 register_cache_invalidate(armv8
->arm
.core_cache
);
1756 target
->state
= TARGET_RESET
;
1761 static int aarch64_deassert_reset(struct target
*target
)
1767 /* be certain SRST is off */
1768 jtag_add_reset(0, 0);
1770 retval
= aarch64_poll(target
);
1771 if (retval
!= ERROR_OK
)
1774 if (target
->reset_halt
) {
1775 if (target
->state
!= TARGET_HALTED
) {
1776 LOG_WARNING("%s: ran after reset and before halt ...",
1777 target_name(target
));
1778 retval
= target_halt(target
);
1779 if (retval
!= ERROR_OK
)
1787 static int aarch64_write_apb_ap_memory(struct target
*target
,
1788 uint64_t address
, uint32_t size
,
1789 uint32_t count
, const uint8_t *buffer
)
1791 /* write memory through APB-AP */
1792 int retval
= ERROR_COMMAND_SYNTAX_ERROR
;
1793 struct armv8_common
*armv8
= target_to_armv8(target
);
1794 struct arm
*arm
= &armv8
->arm
;
1795 int total_bytes
= count
* size
;
1797 int start_byte
= address
& 0x3;
1798 int end_byte
= (address
+ total_bytes
) & 0x3;
1801 uint8_t *tmp_buff
= NULL
;
1803 LOG_DEBUG("Writing APB-AP memory address 0x%" PRIx64
" size %" PRIu32
" count%" PRIu32
,
1804 address
, size
, count
);
1805 if (target
->state
!= TARGET_HALTED
) {
1806 LOG_WARNING("target not halted");
1807 return ERROR_TARGET_NOT_HALTED
;
1810 total_u32
= DIV_ROUND_UP((address
& 3) + total_bytes
, 4);
1812 /* Mark register R0 as dirty, as it will be used
1813 * for transferring the data.
1814 * It will be restored automatically when exiting
1817 reg
= armv8_reg_current(arm
, 1);
1820 reg
= armv8_reg_current(arm
, 0);
1823 /* clear any abort */
1824 retval
= mem_ap_write_atomic_u32(armv8
->debug_ap
,
1825 armv8
->debug_base
+ CPUV8_DBG_DRCR
, DRCR_CSE
);
1826 if (retval
!= ERROR_OK
)
1830 /* This algorithm comes from DDI0487A.g, chapter J9.1 */
1832 /* The algorithm only copies 32 bit words, so the buffer
1833 * should be expanded to include the words at either end.
1834 * The first and last words will be read first to avoid
1835 * corruption if needed.
1837 tmp_buff
= malloc(total_u32
* 4);
1839 if ((start_byte
!= 0) && (total_u32
> 1)) {
1840 /* First bytes not aligned - read the 32 bit word to avoid corrupting
1841 * the other bytes in the word.
1843 retval
= aarch64_read_apb_ap_memory(target
, (address
& ~0x3), 4, 1, tmp_buff
);
1844 if (retval
!= ERROR_OK
)
1845 goto error_free_buff_w
;
1848 /* If end of write is not aligned, or the write is less than 4 bytes */
1849 if ((end_byte
!= 0) ||
1850 ((total_u32
== 1) && (total_bytes
!= 4))) {
1852 /* Read the last word to avoid corruption during 32 bit write */
1853 int mem_offset
= (total_u32
-1) * 4;
1854 retval
= aarch64_read_apb_ap_memory(target
, (address
& ~0x3) + mem_offset
, 4, 1, &tmp_buff
[mem_offset
]);
1855 if (retval
!= ERROR_OK
)
1856 goto error_free_buff_w
;
1859 /* Copy the write buffer over the top of the temporary buffer */
1860 memcpy(&tmp_buff
[start_byte
], buffer
, total_bytes
);
1862 /* We now have a 32 bit aligned buffer that can be written */
1865 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
1866 armv8
->debug_base
+ CPUV8_DBG_DSCR
, &dscr
);
1867 if (retval
!= ERROR_OK
)
1868 goto error_free_buff_w
;
1870 /* Set Normal access mode */
1871 dscr
= (dscr
& ~DSCR_MA
);
1872 retval
= mem_ap_write_atomic_u32(armv8
->debug_ap
,
1873 armv8
->debug_base
+ CPUV8_DBG_DSCR
, dscr
);
1875 if (arm
->core_state
== ARM_STATE_AARCH64
) {
1876 /* Write X0 with value 'address' using write procedure */
1877 /* Step 1.a+b - Write the address for read access into DBGDTR_EL0 */
1878 retval
+= aarch64_write_dcc_64(armv8
, address
& ~0x3ULL
);
1879 /* Step 1.c - Copy value from DTR to R0 using instruction mrs DBGDTR_EL0, x0 */
1880 retval
+= aarch64_exec_opcode(target
,
1881 ARMV8_MRS(SYSTEM_DBG_DBGDTR_EL0
, 0), &dscr
);
1883 /* Write R0 with value 'address' using write procedure */
1884 /* Step 1.a+b - Write the address for read access into DBGDTRRX */
1885 retval
+= aarch64_write_dcc(armv8
, address
& ~0x3ULL
);
1886 /* Step 1.c - Copy value from DTR to R0 using instruction mrc DBGDTRTXint, r0 */
1887 retval
+= aarch64_exec_opcode(target
,
1888 T32_FMTITR(ARMV4_5_MRC(14, 0, 0, 0, 5, 0)), &dscr
);
1891 /* Step 1.d - Change DCC to memory mode */
1892 dscr
= dscr
| DSCR_MA
;
1893 retval
+= mem_ap_write_atomic_u32(armv8
->debug_ap
,
1894 armv8
->debug_base
+ CPUV8_DBG_DSCR
, dscr
);
1895 if (retval
!= ERROR_OK
)
1896 goto error_unset_dtr_w
;
1899 /* Step 2.a - Do the write */
1900 retval
= mem_ap_write_buf_noincr(armv8
->debug_ap
,
1901 tmp_buff
, 4, total_u32
, armv8
->debug_base
+ CPUV8_DBG_DTRRX
);
1902 if (retval
!= ERROR_OK
)
1903 goto error_unset_dtr_w
;
1905 /* Step 3.a - Switch DTR mode back to Normal mode */
1906 dscr
= (dscr
& ~DSCR_MA
);
1907 retval
= mem_ap_write_atomic_u32(armv8
->debug_ap
,
1908 armv8
->debug_base
+ CPUV8_DBG_DSCR
, dscr
);
1909 if (retval
!= ERROR_OK
)
1910 goto error_unset_dtr_w
;
1912 /* Check for sticky abort flags in the DSCR */
1913 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
1914 armv8
->debug_base
+ CPUV8_DBG_DSCR
, &dscr
);
1915 if (retval
!= ERROR_OK
)
1916 goto error_free_buff_w
;
1917 if (dscr
& (DSCR_ERR
| DSCR_SYS_ERROR_PEND
)) {
1918 /* Abort occurred - clear it and exit */
1919 LOG_ERROR("abort occurred - dscr = 0x%08" PRIx32
, dscr
);
1920 mem_ap_write_atomic_u32(armv8
->debug_ap
,
1921 armv8
->debug_base
+ CPUV8_DBG_DRCR
, 1<<2);
1922 goto error_free_buff_w
;
1930 /* Unset DTR mode */
1931 mem_ap_read_atomic_u32(armv8
->debug_ap
,
1932 armv8
->debug_base
+ CPUV8_DBG_DSCR
, &dscr
);
1933 dscr
= (dscr
& ~DSCR_MA
);
1934 mem_ap_write_atomic_u32(armv8
->debug_ap
,
1935 armv8
->debug_base
+ CPUV8_DBG_DSCR
, dscr
);
1942 static int aarch64_read_apb_ap_memory(struct target
*target
,
1943 target_addr_t address
, uint32_t size
,
1944 uint32_t count
, uint8_t *buffer
)
1946 /* read memory through APB-AP */
1947 int retval
= ERROR_COMMAND_SYNTAX_ERROR
;
1948 struct armv8_common
*armv8
= target_to_armv8(target
);
1949 struct arm
*arm
= &armv8
->arm
;
1950 int total_bytes
= count
* size
;
1952 int start_byte
= address
& 0x3;
1953 int end_byte
= (address
+ total_bytes
) & 0x3;
1956 uint8_t *tmp_buff
= NULL
;
1960 LOG_DEBUG("Reading APB-AP memory address 0x%" TARGET_PRIxADDR
" size %" PRIu32
" count%" PRIu32
,
1961 address
, size
, count
);
1962 if (target
->state
!= TARGET_HALTED
) {
1963 LOG_WARNING("target not halted");
1964 return ERROR_TARGET_NOT_HALTED
;
1967 total_u32
= DIV_ROUND_UP((address
& 3) + total_bytes
, 4);
1968 /* Mark register X0, X1 as dirty, as it will be used
1969 * for transferring the data.
1970 * It will be restored automatically when exiting
1973 reg
= armv8_reg_current(arm
, 1);
1976 reg
= armv8_reg_current(arm
, 0);
1979 /* clear any abort */
1980 retval
= mem_ap_write_atomic_u32(armv8
->debug_ap
,
1981 armv8
->debug_base
+ CPUV8_DBG_DRCR
, DRCR_CSE
);
1982 if (retval
!= ERROR_OK
)
1983 goto error_free_buff_r
;
1986 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
1987 armv8
->debug_base
+ CPUV8_DBG_DSCR
, &dscr
);
1989 /* This algorithm comes from DDI0487A.g, chapter J9.1 */
1991 /* Set Normal access mode */
1992 dscr
= (dscr
& ~DSCR_MA
);
1993 retval
+= mem_ap_write_atomic_u32(armv8
->debug_ap
,
1994 armv8
->debug_base
+ CPUV8_DBG_DSCR
, dscr
);
1996 if (arm
->core_state
== ARM_STATE_AARCH64
) {
1997 /* Write X0 with value 'address' using write procedure */
1998 /* Step 1.a+b - Write the address for read access into DBGDTR_EL0 */
1999 retval
+= aarch64_write_dcc_64(armv8
, address
& ~0x3ULL
);
2000 /* Step 1.c - Copy value from DTR to R0 using instruction mrs DBGDTR_EL0, x0 */
2001 retval
+= aarch64_exec_opcode(target
, ARMV8_MRS(SYSTEM_DBG_DBGDTR_EL0
, 0), &dscr
);
2002 /* Step 1.d - Dummy operation to ensure EDSCR.Txfull == 1 */
2003 retval
+= aarch64_exec_opcode(target
, ARMV8_MSR_GP(SYSTEM_DBG_DBGDTR_EL0
, 0), &dscr
);
2004 /* Step 1.e - Change DCC to memory mode */
2005 dscr
= dscr
| DSCR_MA
;
2006 retval
+= mem_ap_write_atomic_u32(armv8
->debug_ap
,
2007 armv8
->debug_base
+ CPUV8_DBG_DSCR
, dscr
);
2008 /* Step 1.f - read DBGDTRTX and discard the value */
2009 retval
+= mem_ap_read_atomic_u32(armv8
->debug_ap
,
2010 armv8
->debug_base
+ CPUV8_DBG_DTRTX
, &value
);
2012 /* Write R0 with value 'address' using write procedure */
2013 /* Step 1.a+b - Write the address for read access into DBGDTRRXint */
2014 retval
+= aarch64_write_dcc(armv8
, address
& ~0x3ULL
);
2015 /* Step 1.c - Copy value from DTR to R0 using instruction mrc DBGDTRTXint, r0 */
2016 retval
+= aarch64_exec_opcode(target
,
2017 T32_FMTITR(ARMV4_5_MRC(14, 0, 0, 0, 5, 0)), &dscr
);
2018 /* Step 1.d - Dummy operation to ensure EDSCR.Txfull == 1 */
2019 retval
+= aarch64_exec_opcode(target
,
2020 T32_FMTITR(ARMV4_5_MCR(14, 0, 0, 0, 5, 0)), &dscr
);
2021 /* Step 1.e - Change DCC to memory mode */
2022 dscr
= dscr
| DSCR_MA
;
2023 retval
+= mem_ap_write_atomic_u32(armv8
->debug_ap
,
2024 armv8
->debug_base
+ CPUV8_DBG_DSCR
, dscr
);
2025 /* Step 1.f - read DBGDTRTX and discard the value */
2026 retval
+= mem_ap_read_atomic_u32(armv8
->debug_ap
,
2027 armv8
->debug_base
+ CPUV8_DBG_DTRTX
, &value
);
2030 if (retval
!= ERROR_OK
)
2031 goto error_unset_dtr_r
;
2033 /* Optimize the read as much as we can, either way we read in a single pass */
2034 if ((start_byte
) || (end_byte
)) {
2035 /* The algorithm only copies 32 bit words, so the buffer
2036 * should be expanded to include the words at either end.
2037 * The first and last words will be read into a temp buffer
2038 * to avoid corruption
2040 tmp_buff
= malloc(total_u32
* 4);
2042 goto error_unset_dtr_r
;
2044 /* use the tmp buffer to read the entire data */
2045 u8buf_ptr
= tmp_buff
;
2047 /* address and read length are aligned so read directly into the passed buffer */
2050 /* Read the data - Each read of the DTRTX register causes the instruction to be reissued
2051 * Abort flags are sticky, so can be read at end of transactions
2053 * This data is read in aligned to 32 bit boundary.
2056 /* Step 2.a - Loop n-1 times, each read of DBGDTRTX reads the data from [X0] and
2057 * increments X0 by 4. */
2058 retval
= mem_ap_read_buf_noincr(armv8
->debug_ap
, u8buf_ptr
, 4, total_u32
-1,
2059 armv8
->debug_base
+ CPUV8_DBG_DTRTX
);
2060 if (retval
!= ERROR_OK
)
2061 goto error_unset_dtr_r
;
2063 /* Step 3.a - set DTR access mode back to Normal mode */
2064 dscr
= (dscr
& ~DSCR_MA
);
2065 retval
= mem_ap_write_atomic_u32(armv8
->debug_ap
,
2066 armv8
->debug_base
+ CPUV8_DBG_DSCR
, dscr
);
2067 if (retval
!= ERROR_OK
)
2068 goto error_free_buff_r
;
2070 /* Step 3.b - read DBGDTRTX for the final value */
2071 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
2072 armv8
->debug_base
+ CPUV8_DBG_DTRTX
, &value
);
2073 memcpy(u8buf_ptr
+ (total_u32
-1) * 4, &value
, 4);
2075 /* Check for sticky abort flags in the DSCR */
2076 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
2077 armv8
->debug_base
+ CPUV8_DBG_DSCR
, &dscr
);
2078 if (retval
!= ERROR_OK
)
2079 goto error_free_buff_r
;
2080 if (dscr
& (DSCR_ERR
| DSCR_SYS_ERROR_PEND
)) {
2081 /* Abort occurred - clear it and exit */
2082 LOG_ERROR("abort occurred - dscr = 0x%08" PRIx32
, dscr
);
2083 mem_ap_write_atomic_u32(armv8
->debug_ap
,
2084 armv8
->debug_base
+ CPUV8_DBG_DRCR
, DRCR_CSE
);
2085 goto error_free_buff_r
;
2088 /* check if we need to copy aligned data by applying any shift necessary */
2090 memcpy(buffer
, tmp_buff
+ start_byte
, total_bytes
);
2098 /* Unset DTR mode */
2099 mem_ap_read_atomic_u32(armv8
->debug_ap
,
2100 armv8
->debug_base
+ CPUV8_DBG_DSCR
, &dscr
);
2101 dscr
= (dscr
& ~DSCR_MA
);
2102 mem_ap_write_atomic_u32(armv8
->debug_ap
,
2103 armv8
->debug_base
+ CPUV8_DBG_DSCR
, dscr
);
2110 static int aarch64_read_phys_memory(struct target
*target
,
2111 target_addr_t address
, uint32_t size
,
2112 uint32_t count
, uint8_t *buffer
)
2114 int retval
= ERROR_COMMAND_SYNTAX_ERROR
;
2115 LOG_DEBUG("Reading memory at real address 0x%" TARGET_PRIxADDR
"; size %" PRId32
"; count %" PRId32
,
2116 address
, size
, count
);
2118 if (count
&& buffer
) {
2119 /* read memory through APB-AP */
2120 retval
= aarch64_mmu_modify(target
, 0);
2121 if (retval
!= ERROR_OK
)
2123 retval
= aarch64_read_apb_ap_memory(target
, address
, size
, count
, buffer
);
2128 static int aarch64_read_memory(struct target
*target
, target_addr_t address
,
2129 uint32_t size
, uint32_t count
, uint8_t *buffer
)
2131 int mmu_enabled
= 0;
2134 /* aarch64 handles unaligned memory access */
2135 LOG_DEBUG("Reading memory at address 0x%" TARGET_PRIxADDR
"; size %" PRId32
"; count %" PRId32
, address
,
2138 /* determine if MMU was enabled on target stop */
2139 retval
= aarch64_mmu(target
, &mmu_enabled
);
2140 if (retval
!= ERROR_OK
)
2144 retval
= aarch64_check_address(target
, address
);
2145 if (retval
!= ERROR_OK
)
2147 /* enable MMU as we could have disabled it for phys access */
2148 retval
= aarch64_mmu_modify(target
, 1);
2149 if (retval
!= ERROR_OK
)
2152 return aarch64_read_apb_ap_memory(target
, address
, size
, count
, buffer
);
2155 static int aarch64_write_phys_memory(struct target
*target
,
2156 target_addr_t address
, uint32_t size
,
2157 uint32_t count
, const uint8_t *buffer
)
2159 int retval
= ERROR_COMMAND_SYNTAX_ERROR
;
2161 LOG_DEBUG("Writing memory to real address 0x%" TARGET_PRIxADDR
"; size %" PRId32
"; count %" PRId32
, address
,
2164 if (count
&& buffer
) {
2165 /* write memory through APB-AP */
2166 retval
= aarch64_mmu_modify(target
, 0);
2167 if (retval
!= ERROR_OK
)
2169 return aarch64_write_apb_ap_memory(target
, address
, size
, count
, buffer
);
2175 static int aarch64_write_memory(struct target
*target
, target_addr_t address
,
2176 uint32_t size
, uint32_t count
, const uint8_t *buffer
)
2178 int mmu_enabled
= 0;
2181 /* aarch64 handles unaligned memory access */
2182 LOG_DEBUG("Writing memory at address 0x%" TARGET_PRIxADDR
"; size %" PRId32
2183 "; count %" PRId32
, address
, size
, count
);
2185 /* determine if MMU was enabled on target stop */
2186 retval
= aarch64_mmu(target
, &mmu_enabled
);
2187 if (retval
!= ERROR_OK
)
2191 retval
= aarch64_check_address(target
, address
);
2192 if (retval
!= ERROR_OK
)
2194 /* enable MMU as we could have disabled it for phys access */
2195 retval
= aarch64_mmu_modify(target
, 1);
2196 if (retval
!= ERROR_OK
)
2199 return aarch64_write_apb_ap_memory(target
, address
, size
, count
, buffer
);
2202 static int aarch64_handle_target_request(void *priv
)
2204 struct target
*target
= priv
;
2205 struct armv8_common
*armv8
= target_to_armv8(target
);
2208 if (!target_was_examined(target
))
2210 if (!target
->dbg_msg_enabled
)
2213 if (target
->state
== TARGET_RUNNING
) {
2216 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
2217 armv8
->debug_base
+ CPUV8_DBG_DSCR
, &dscr
);
2219 /* check if we have data */
2220 while ((dscr
& DSCR_DTR_TX_FULL
) && (retval
== ERROR_OK
)) {
2221 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
2222 armv8
->debug_base
+ CPUV8_DBG_DTRTX
, &request
);
2223 if (retval
== ERROR_OK
) {
2224 target_request(target
, request
);
2225 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
2226 armv8
->debug_base
+ CPUV8_DBG_DSCR
, &dscr
);
2234 static int aarch64_examine_first(struct target
*target
)
2236 struct aarch64_common
*aarch64
= target_to_aarch64(target
);
2237 struct armv8_common
*armv8
= &aarch64
->armv8_common
;
2238 struct adiv5_dap
*swjdp
= armv8
->arm
.dap
;
2240 int retval
= ERROR_OK
;
2241 uint64_t debug
, ttypr
;
2243 uint32_t tmp0
, tmp1
;
2244 debug
= ttypr
= cpuid
= 0;
2246 /* We do one extra read to ensure DAP is configured,
2247 * we call ahbap_debugport_init(swjdp) instead
2249 retval
= dap_dp_init(swjdp
);
2250 if (retval
!= ERROR_OK
)
2253 /* Search for the APB-AB - it is needed for access to debug registers */
2254 retval
= dap_find_ap(swjdp
, AP_TYPE_APB_AP
, &armv8
->debug_ap
);
2255 if (retval
!= ERROR_OK
) {
2256 LOG_ERROR("Could not find APB-AP for debug access");
2260 retval
= mem_ap_init(armv8
->debug_ap
);
2261 if (retval
!= ERROR_OK
) {
2262 LOG_ERROR("Could not initialize the APB-AP");
2266 armv8
->debug_ap
->memaccess_tck
= 80;
2268 if (!target
->dbgbase_set
) {
2270 /* Get ROM Table base */
2272 int32_t coreidx
= target
->coreid
;
2273 retval
= dap_get_debugbase(armv8
->debug_ap
, &dbgbase
, &apid
);
2274 if (retval
!= ERROR_OK
)
2276 /* Lookup 0x15 -- Processor DAP */
2277 retval
= dap_lookup_cs_component(armv8
->debug_ap
, dbgbase
, 0x15,
2278 &armv8
->debug_base
, &coreidx
);
2279 if (retval
!= ERROR_OK
)
2281 LOG_DEBUG("Detected core %" PRId32
" dbgbase: %08" PRIx32
2282 " apid: %08" PRIx32
, coreidx
, armv8
->debug_base
, apid
);
2284 armv8
->debug_base
= target
->dbgbase
;
2286 retval
= mem_ap_write_atomic_u32(armv8
->debug_ap
,
2287 armv8
->debug_base
+ CPUV8_DBG_LOCKACCESS
, 0xC5ACCE55);
2288 if (retval
!= ERROR_OK
) {
2289 LOG_DEBUG("LOCK debug access fail");
2293 retval
= mem_ap_write_atomic_u32(armv8
->debug_ap
,
2294 armv8
->debug_base
+ CPUV8_DBG_OSLAR
, 0);
2295 if (retval
!= ERROR_OK
) {
2296 LOG_DEBUG("Examine %s failed", "oslock");
2300 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
2301 armv8
->debug_base
+ CPUV8_DBG_MAINID0
, &cpuid
);
2302 if (retval
!= ERROR_OK
) {
2303 LOG_DEBUG("Examine %s failed", "CPUID");
2307 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
2308 armv8
->debug_base
+ CPUV8_DBG_MEMFEATURE0
, &tmp0
);
2309 retval
+= mem_ap_read_atomic_u32(armv8
->debug_ap
,
2310 armv8
->debug_base
+ CPUV8_DBG_MEMFEATURE0
+ 4, &tmp1
);
2311 if (retval
!= ERROR_OK
) {
2312 LOG_DEBUG("Examine %s failed", "Memory Model Type");
2316 ttypr
= (ttypr
<< 32) | tmp0
;
2318 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
2319 armv8
->debug_base
+ CPUV8_DBG_DBGFEATURE0
, &tmp0
);
2320 retval
+= mem_ap_read_atomic_u32(armv8
->debug_ap
,
2321 armv8
->debug_base
+ CPUV8_DBG_DBGFEATURE0
+ 4, &tmp1
);
2322 if (retval
!= ERROR_OK
) {
2323 LOG_DEBUG("Examine %s failed", "ID_AA64DFR0_EL1");
2327 debug
= (debug
<< 32) | tmp0
;
2329 LOG_DEBUG("cpuid = 0x%08" PRIx32
, cpuid
);
2330 LOG_DEBUG("ttypr = 0x%08" PRIx64
, ttypr
);
2331 LOG_DEBUG("debug = 0x%08" PRIx64
, debug
);
2333 if (target
->ctibase
== 0) {
2334 /* assume a v8 rom table layout */
2335 armv8
->cti_base
= target
->ctibase
= armv8
->debug_base
+ 0x10000;
2336 LOG_INFO("Target ctibase is not set, assuming 0x%0" PRIx32
, target
->ctibase
);
2338 armv8
->cti_base
= target
->ctibase
;
2340 retval
= mem_ap_write_atomic_u32(armv8
->debug_ap
,
2341 armv8
->cti_base
+ CTI_UNLOCK
, 0xC5ACCE55);
2342 if (retval
!= ERROR_OK
)
2346 armv8
->arm
.core_type
= ARM_MODE_MON
;
2347 retval
= aarch64_dpm_setup(aarch64
, debug
);
2348 if (retval
!= ERROR_OK
)
2351 /* Setup Breakpoint Register Pairs */
2352 aarch64
->brp_num
= (uint32_t)((debug
>> 12) & 0x0F) + 1;
2353 aarch64
->brp_num_context
= (uint32_t)((debug
>> 28) & 0x0F) + 1;
2354 aarch64
->brp_num_available
= aarch64
->brp_num
;
2355 aarch64
->brp_list
= calloc(aarch64
->brp_num
, sizeof(struct aarch64_brp
));
2356 for (i
= 0; i
< aarch64
->brp_num
; i
++) {
2357 aarch64
->brp_list
[i
].used
= 0;
2358 if (i
< (aarch64
->brp_num
-aarch64
->brp_num_context
))
2359 aarch64
->brp_list
[i
].type
= BRP_NORMAL
;
2361 aarch64
->brp_list
[i
].type
= BRP_CONTEXT
;
2362 aarch64
->brp_list
[i
].value
= 0;
2363 aarch64
->brp_list
[i
].control
= 0;
2364 aarch64
->brp_list
[i
].BRPn
= i
;
2367 LOG_DEBUG("Configured %i hw breakpoints", aarch64
->brp_num
);
2369 target_set_examined(target
);
2373 static int aarch64_examine(struct target
*target
)
2375 int retval
= ERROR_OK
;
2377 /* don't re-probe hardware after each reset */
2378 if (!target_was_examined(target
))
2379 retval
= aarch64_examine_first(target
);
2381 /* Configure core debug access */
2382 if (retval
== ERROR_OK
)
2383 retval
= aarch64_init_debug_access(target
);
2389 * Cortex-A8 target creation and initialization
2392 static int aarch64_init_target(struct command_context
*cmd_ctx
,
2393 struct target
*target
)
2395 /* examine_first() does a bunch of this */
2399 static int aarch64_init_arch_info(struct target
*target
,
2400 struct aarch64_common
*aarch64
, struct jtag_tap
*tap
)
2402 struct armv8_common
*armv8
= &aarch64
->armv8_common
;
2403 struct adiv5_dap
*dap
= armv8
->arm
.dap
;
2405 armv8
->arm
.dap
= dap
;
2407 /* Setup struct aarch64_common */
2408 aarch64
->common_magic
= AARCH64_COMMON_MAGIC
;
2409 /* tap has no dap initialized */
2411 tap
->dap
= dap_init();
2413 /* Leave (only) generic DAP stuff for debugport_init() */
2414 tap
->dap
->tap
= tap
;
2417 armv8
->arm
.dap
= tap
->dap
;
2419 aarch64
->fast_reg_read
= 0;
2421 /* register arch-specific functions */
2422 armv8
->examine_debug_reason
= NULL
;
2424 armv8
->post_debug_entry
= aarch64_post_debug_entry
;
2426 armv8
->pre_restore_context
= NULL
;
2428 armv8
->armv8_mmu
.read_physical_memory
= aarch64_read_phys_memory
;
2430 /* REVISIT v7a setup should be in a v7a-specific routine */
2431 armv8_init_arch_info(target
, armv8
);
2432 target_register_timer_callback(aarch64_handle_target_request
, 1, 1, target
);
2437 static int aarch64_target_create(struct target
*target
, Jim_Interp
*interp
)
2439 struct aarch64_common
*aarch64
= calloc(1, sizeof(struct aarch64_common
));
2441 return aarch64_init_arch_info(target
, aarch64
, target
->tap
);
2444 static int aarch64_mmu(struct target
*target
, int *enabled
)
2446 if (target
->state
!= TARGET_HALTED
) {
2447 LOG_ERROR("%s: target not halted", __func__
);
2448 return ERROR_TARGET_INVALID
;
2451 *enabled
= target_to_aarch64(target
)->armv8_common
.armv8_mmu
.mmu_enabled
;
2455 static int aarch64_virt2phys(struct target
*target
, target_addr_t virt
,
2456 target_addr_t
*phys
)
2458 return armv8_mmu_translate_va(target
, virt
, phys
);
2461 COMMAND_HANDLER(aarch64_handle_cache_info_command
)
2463 struct target
*target
= get_current_target(CMD_CTX
);
2464 struct armv8_common
*armv8
= target_to_armv8(target
);
2466 return armv8_handle_cache_info_command(CMD_CTX
,
2467 &armv8
->armv8_mmu
.armv8_cache
);
2471 COMMAND_HANDLER(aarch64_handle_dbginit_command
)
2473 struct target
*target
= get_current_target(CMD_CTX
);
2474 if (!target_was_examined(target
)) {
2475 LOG_ERROR("target not examined yet");
2479 return aarch64_init_debug_access(target
);
2481 COMMAND_HANDLER(aarch64_handle_smp_off_command
)
2483 struct target
*target
= get_current_target(CMD_CTX
);
2484 /* check target is an smp target */
2485 struct target_list
*head
;
2486 struct target
*curr
;
2487 head
= target
->head
;
2489 if (head
!= (struct target_list
*)NULL
) {
2490 while (head
!= (struct target_list
*)NULL
) {
2491 curr
= head
->target
;
2495 /* fixes the target display to the debugger */
2496 target
->gdb_service
->target
= target
;
2501 COMMAND_HANDLER(aarch64_handle_smp_on_command
)
2503 struct target
*target
= get_current_target(CMD_CTX
);
2504 struct target_list
*head
;
2505 struct target
*curr
;
2506 head
= target
->head
;
2507 if (head
!= (struct target_list
*)NULL
) {
2509 while (head
!= (struct target_list
*)NULL
) {
2510 curr
= head
->target
;
2518 COMMAND_HANDLER(aarch64_handle_smp_gdb_command
)
2520 struct target
*target
= get_current_target(CMD_CTX
);
2521 int retval
= ERROR_OK
;
2522 struct target_list
*head
;
2523 head
= target
->head
;
2524 if (head
!= (struct target_list
*)NULL
) {
2525 if (CMD_ARGC
== 1) {
2527 COMMAND_PARSE_NUMBER(int, CMD_ARGV
[0], coreid
);
2528 if (ERROR_OK
!= retval
)
2530 target
->gdb_service
->core
[1] = coreid
;
2533 command_print(CMD_CTX
, "gdb coreid %" PRId32
" -> %" PRId32
, target
->gdb_service
->core
[0]
2534 , target
->gdb_service
->core
[1]);
2539 static const struct command_registration aarch64_exec_command_handlers
[] = {
2541 .name
= "cache_info",
2542 .handler
= aarch64_handle_cache_info_command
,
2543 .mode
= COMMAND_EXEC
,
2544 .help
= "display information about target caches",
2549 .handler
= aarch64_handle_dbginit_command
,
2550 .mode
= COMMAND_EXEC
,
2551 .help
= "Initialize core debug",
2554 { .name
= "smp_off",
2555 .handler
= aarch64_handle_smp_off_command
,
2556 .mode
= COMMAND_EXEC
,
2557 .help
= "Stop smp handling",
2562 .handler
= aarch64_handle_smp_on_command
,
2563 .mode
= COMMAND_EXEC
,
2564 .help
= "Restart smp handling",
2569 .handler
= aarch64_handle_smp_gdb_command
,
2570 .mode
= COMMAND_EXEC
,
2571 .help
= "display/fix current core played to gdb",
2576 COMMAND_REGISTRATION_DONE
2578 static const struct command_registration aarch64_command_handlers
[] = {
2580 .chain
= arm_command_handlers
,
2583 .chain
= armv8_command_handlers
,
2587 .mode
= COMMAND_ANY
,
2588 .help
= "Cortex-A command group",
2590 .chain
= aarch64_exec_command_handlers
,
2592 COMMAND_REGISTRATION_DONE
2595 struct target_type aarch64_target
= {
2598 .poll
= aarch64_poll
,
2599 .arch_state
= armv8_arch_state
,
2601 .halt
= aarch64_halt
,
2602 .resume
= aarch64_resume
,
2603 .step
= aarch64_step
,
2605 .assert_reset
= aarch64_assert_reset
,
2606 .deassert_reset
= aarch64_deassert_reset
,
2608 /* REVISIT allow exporting VFP3 registers ... */
2609 .get_gdb_reg_list
= armv8_get_gdb_reg_list
,
2611 .read_memory
= aarch64_read_memory
,
2612 .write_memory
= aarch64_write_memory
,
2614 .checksum_memory
= arm_checksum_memory
,
2615 .blank_check_memory
= arm_blank_check_memory
,
2617 .run_algorithm
= armv4_5_run_algorithm
,
2619 .add_breakpoint
= aarch64_add_breakpoint
,
2620 .add_context_breakpoint
= aarch64_add_context_breakpoint
,
2621 .add_hybrid_breakpoint
= aarch64_add_hybrid_breakpoint
,
2622 .remove_breakpoint
= aarch64_remove_breakpoint
,
2623 .add_watchpoint
= NULL
,
2624 .remove_watchpoint
= NULL
,
2626 .commands
= aarch64_command_handlers
,
2627 .target_create
= aarch64_target_create
,
2628 .init_target
= aarch64_init_target
,
2629 .examine
= aarch64_examine
,
2631 .read_phys_memory
= aarch64_read_phys_memory
,
2632 .write_phys_memory
= aarch64_write_phys_memory
,
2634 .virt2phys
= aarch64_virt2phys
,
Linking to existing account procedure
If you already have an account and want to add another login method
you
MUST first sign in with your existing account and
then change URL to read
https://review.openocd.org/login/?link
to get to this page again but this time it'll work for linking. Thank you.
SSH host keys fingerprints
1024 SHA256:YKx8b7u5ZWdcbp7/4AeXNaqElP49m6QrwfXaqQGJAOk gerrit-code-review@openocd.zylin.com (DSA)
384 SHA256:jHIbSQa4REvwCFG4cq5LBlBLxmxSqelQPem/EXIrxjk gerrit-code-review@openocd.org (ECDSA)
521 SHA256:UAOPYkU9Fjtcao0Ul/Rrlnj/OsQvt+pgdYSZ4jOYdgs gerrit-code-review@openocd.org (ECDSA)
256 SHA256:A13M5QlnozFOvTllybRZH6vm7iSt0XLxbA48yfc2yfY gerrit-code-review@openocd.org (ECDSA)
256 SHA256:spYMBqEYoAOtK7yZBrcwE8ZpYt6b68Cfh9yEVetvbXg gerrit-code-review@openocd.org (ED25519)
+--[ED25519 256]--+
|=.. |
|+o.. . |
|*.o . . |
|+B . . . |
|Bo. = o S |
|Oo.+ + = |
|oB=.* = . o |
| =+=.+ + E |
|. .=o . o |
+----[SHA256]-----+
2048 SHA256:0Onrb7/PHjpo6iVZ7xQX2riKN83FJ3KGU0TvI0TaFG4 gerrit-code-review@openocd.zylin.com (RSA)