1 /***************************************************************************
2 * Copyright (C) 2015 by David Ung *
4 * This program is free software; you can redistribute it and/or modify *
5 * it under the terms of the GNU General Public License as published by *
6 * the Free Software Foundation; either version 2 of the License, or *
7 * (at your option) any later version. *
9 * This program is distributed in the hope that it will be useful, *
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
12 * GNU General Public License for more details. *
14 * You should have received a copy of the GNU General Public License *
15 * along with this program; if not, write to the *
16 * Free Software Foundation, Inc., *
18 ***************************************************************************/
24 #include "breakpoints.h"
27 #include "target_request.h"
28 #include "target_type.h"
29 #include "armv8_opcodes.h"
30 #include <helper/time_support.h>
32 static int aarch64_poll(struct target
*target
);
33 static int aarch64_debug_entry(struct target
*target
);
34 static int aarch64_restore_context(struct target
*target
, bool bpwp
);
35 static int aarch64_set_breakpoint(struct target
*target
,
36 struct breakpoint
*breakpoint
, uint8_t matchmode
);
37 static int aarch64_set_context_breakpoint(struct target
*target
,
38 struct breakpoint
*breakpoint
, uint8_t matchmode
);
39 static int aarch64_set_hybrid_breakpoint(struct target
*target
,
40 struct breakpoint
*breakpoint
);
41 static int aarch64_unset_breakpoint(struct target
*target
,
42 struct breakpoint
*breakpoint
);
43 static int aarch64_mmu(struct target
*target
, int *enabled
);
44 static int aarch64_virt2phys(struct target
*target
,
45 target_addr_t virt
, target_addr_t
*phys
);
46 static int aarch64_read_apb_ap_memory(struct target
*target
,
47 uint64_t address
, uint32_t size
, uint32_t count
, uint8_t *buffer
);
48 static int aarch64_instr_write_data_r0(struct arm_dpm
*dpm
,
49 uint32_t opcode
, uint32_t data
);
51 static int aarch64_restore_system_control_reg(struct target
*target
)
53 int retval
= ERROR_OK
;
55 struct aarch64_common
*aarch64
= target_to_aarch64(target
);
56 struct armv8_common
*armv8
= target_to_armv8(target
);
58 if (aarch64
->system_control_reg
!= aarch64
->system_control_reg_curr
) {
59 aarch64
->system_control_reg_curr
= aarch64
->system_control_reg
;
60 /* LOG_INFO("cp15_control_reg: %8.8" PRIx32, cortex_v8->cp15_control_reg); */
62 switch (armv8
->arm
.core_mode
) {
66 retval
= armv8
->arm
.msr(target
, 3, /*op 0*/
69 aarch64
->system_control_reg
);
70 if (retval
!= ERROR_OK
)
75 retval
= armv8
->arm
.msr(target
, 3, /*op 0*/
78 aarch64
->system_control_reg
);
79 if (retval
!= ERROR_OK
)
84 retval
= armv8
->arm
.msr(target
, 3, /*op 0*/
87 aarch64
->system_control_reg
);
88 if (retval
!= ERROR_OK
)
92 LOG_DEBUG("unknow cpu state 0x%x" PRIx32
, armv8
->arm
.core_state
);
98 /* check address before aarch64_apb read write access with mmu on
99 * remove apb predictible data abort */
100 static int aarch64_check_address(struct target
*target
, uint32_t address
)
105 /* modify system_control_reg in order to enable or disable mmu for :
106 * - virt2phys address conversion
107 * - read or write memory in phys or virt address */
108 static int aarch64_mmu_modify(struct target
*target
, int enable
)
110 struct aarch64_common
*aarch64
= target_to_aarch64(target
);
111 struct armv8_common
*armv8
= &aarch64
->armv8_common
;
112 int retval
= ERROR_OK
;
115 /* if mmu enabled at target stop and mmu not enable */
116 if (!(aarch64
->system_control_reg
& 0x1U
)) {
117 LOG_ERROR("trying to enable mmu on target stopped with mmu disable");
120 if (!(aarch64
->system_control_reg_curr
& 0x1U
)) {
121 aarch64
->system_control_reg_curr
|= 0x1U
;
122 switch (armv8
->arm
.core_mode
) {
126 retval
= armv8
->arm
.msr(target
, 3, /*op 0*/
129 aarch64
->system_control_reg_curr
);
130 if (retval
!= ERROR_OK
)
135 retval
= armv8
->arm
.msr(target
, 3, /*op 0*/
138 aarch64
->system_control_reg_curr
);
139 if (retval
!= ERROR_OK
)
144 retval
= armv8
->arm
.msr(target
, 3, /*op 0*/
147 aarch64
->system_control_reg_curr
);
148 if (retval
!= ERROR_OK
)
152 LOG_DEBUG("unknow cpu state 0x%x" PRIx32
, armv8
->arm
.core_state
);
156 if (aarch64
->system_control_reg_curr
& 0x4U
) {
157 /* data cache is active */
158 aarch64
->system_control_reg_curr
&= ~0x4U
;
159 /* flush data cache armv7 function to be called */
160 if (armv8
->armv8_mmu
.armv8_cache
.flush_all_data_cache
)
161 armv8
->armv8_mmu
.armv8_cache
.flush_all_data_cache(target
);
163 if ((aarch64
->system_control_reg_curr
& 0x1U
)) {
164 aarch64
->system_control_reg_curr
&= ~0x1U
;
165 switch (armv8
->arm
.core_mode
) {
169 retval
= armv8
->arm
.msr(target
, 3, /*op 0*/
172 aarch64
->system_control_reg_curr
);
173 if (retval
!= ERROR_OK
)
178 retval
= armv8
->arm
.msr(target
, 3, /*op 0*/
181 aarch64
->system_control_reg_curr
);
182 if (retval
!= ERROR_OK
)
187 retval
= armv8
->arm
.msr(target
, 3, /*op 0*/
190 aarch64
->system_control_reg_curr
);
191 if (retval
!= ERROR_OK
)
195 LOG_DEBUG("unknow cpu state 0x%x" PRIx32
, armv8
->arm
.core_state
);
204 * Basic debug access, very low level assumes state is saved
206 static int aarch64_init_debug_access(struct target
*target
)
208 struct armv8_common
*armv8
= target_to_armv8(target
);
214 /* Unlocking the debug registers for modification
215 * The debugport might be uninitialised so try twice */
216 retval
= mem_ap_write_atomic_u32(armv8
->debug_ap
,
217 armv8
->debug_base
+ CPUV8_DBG_LOCKACCESS
, 0xC5ACCE55);
218 if (retval
!= ERROR_OK
) {
220 retval
= mem_ap_write_atomic_u32(armv8
->debug_ap
,
221 armv8
->debug_base
+ CPUV8_DBG_LOCKACCESS
, 0xC5ACCE55);
222 if (retval
== ERROR_OK
)
223 LOG_USER("Locking debug access failed on first, but succeeded on second try.");
225 if (retval
!= ERROR_OK
)
227 /* Clear Sticky Power Down status Bit in PRSR to enable access to
228 the registers in the Core Power Domain */
229 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
230 armv8
->debug_base
+ CPUV8_DBG_PRSR
, &dummy
);
231 if (retval
!= ERROR_OK
)
234 /* Enabling of instruction execution in debug mode is done in debug_entry code */
236 /* Resync breakpoint registers */
238 /* Since this is likely called from init or reset, update target state information*/
239 return aarch64_poll(target
);
242 /* To reduce needless round-trips, pass in a pointer to the current
243 * DSCR value. Initialize it to zero if you just need to know the
244 * value on return from this function; or DSCR_ITE if you
245 * happen to know that no instruction is pending.
247 static int aarch64_exec_opcode(struct target
*target
,
248 uint32_t opcode
, uint32_t *dscr_p
)
252 struct armv8_common
*armv8
= target_to_armv8(target
);
253 dscr
= dscr_p
? *dscr_p
: 0;
255 LOG_DEBUG("exec opcode 0x%08" PRIx32
, opcode
);
257 /* Wait for InstrCompl bit to be set */
258 long long then
= timeval_ms();
259 while ((dscr
& DSCR_ITE
) == 0) {
260 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
261 armv8
->debug_base
+ CPUV8_DBG_DSCR
, &dscr
);
262 if (retval
!= ERROR_OK
) {
263 LOG_ERROR("Could not read DSCR register, opcode = 0x%08" PRIx32
, opcode
);
266 if (timeval_ms() > then
+ 1000) {
267 LOG_ERROR("Timeout waiting for aarch64_exec_opcode");
272 retval
= mem_ap_write_u32(armv8
->debug_ap
,
273 armv8
->debug_base
+ CPUV8_DBG_ITR
, opcode
);
274 if (retval
!= ERROR_OK
)
279 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
280 armv8
->debug_base
+ CPUV8_DBG_DSCR
, &dscr
);
281 if (retval
!= ERROR_OK
) {
282 LOG_ERROR("Could not read DSCR register");
285 if (timeval_ms() > then
+ 1000) {
286 LOG_ERROR("Timeout waiting for aarch64_exec_opcode");
289 } while ((dscr
& DSCR_ITE
) == 0); /* Wait for InstrCompl bit to be set */
297 /* Write to memory mapped registers directly with no cache or mmu handling */
298 static int aarch64_dap_write_memap_register_u32(struct target
*target
,
303 struct armv8_common
*armv8
= target_to_armv8(target
);
305 retval
= mem_ap_write_atomic_u32(armv8
->debug_ap
, address
, value
);
311 * AARCH64 implementation of Debug Programmer's Model
313 * NOTE the invariant: these routines return with DSCR_ITE set,
314 * so there's no need to poll for it before executing an instruction.
316 * NOTE that in several of these cases the "stall" mode might be useful.
317 * It'd let us queue a few operations together... prepare/finish might
318 * be the places to enable/disable that mode.
321 static inline struct aarch64_common
*dpm_to_a8(struct arm_dpm
*dpm
)
323 return container_of(dpm
, struct aarch64_common
, armv8_common
.dpm
);
326 static int aarch64_write_dcc(struct armv8_common
*armv8
, uint32_t data
)
328 LOG_DEBUG("write DCC 0x%08" PRIx32
, data
);
329 return mem_ap_write_u32(armv8
->debug_ap
,
330 armv8
->debug_base
+ CPUV8_DBG_DTRRX
, data
);
333 static int aarch64_write_dcc_64(struct armv8_common
*armv8
, uint64_t data
)
336 LOG_DEBUG("write DCC Low word0x%08" PRIx32
, (unsigned)data
);
337 LOG_DEBUG("write DCC High word 0x%08" PRIx32
, (unsigned)(data
>> 32));
338 ret
= mem_ap_write_u32(armv8
->debug_ap
,
339 armv8
->debug_base
+ CPUV8_DBG_DTRRX
, data
);
340 ret
+= mem_ap_write_u32(armv8
->debug_ap
,
341 armv8
->debug_base
+ CPUV8_DBG_DTRTX
, data
>> 32);
345 static int aarch64_read_dcc(struct armv8_common
*armv8
, uint32_t *data
,
348 uint32_t dscr
= DSCR_ITE
;
354 /* Wait for DTRRXfull */
355 long long then
= timeval_ms();
356 while ((dscr
& DSCR_DTR_TX_FULL
) == 0) {
357 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
358 armv8
->debug_base
+ CPUV8_DBG_DSCR
,
360 if (retval
!= ERROR_OK
)
362 if (timeval_ms() > then
+ 1000) {
363 LOG_ERROR("Timeout waiting for read dcc");
368 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
369 armv8
->debug_base
+ CPUV8_DBG_DTRTX
,
371 if (retval
!= ERROR_OK
)
373 LOG_DEBUG("read DCC 0x%08" PRIx32
, *data
);
381 static int aarch64_read_dcc_64(struct armv8_common
*armv8
, uint64_t *data
,
384 uint32_t dscr
= DSCR_ITE
;
391 /* Wait for DTRRXfull */
392 long long then
= timeval_ms();
393 while ((dscr
& DSCR_DTR_TX_FULL
) == 0) {
394 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
395 armv8
->debug_base
+ CPUV8_DBG_DSCR
,
397 if (retval
!= ERROR_OK
)
399 if (timeval_ms() > then
+ 1000) {
400 LOG_ERROR("Timeout waiting for read dcc");
405 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
406 armv8
->debug_base
+ CPUV8_DBG_DTRTX
,
408 if (retval
!= ERROR_OK
)
411 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
412 armv8
->debug_base
+ CPUV8_DBG_DTRRX
,
414 if (retval
!= ERROR_OK
)
417 *data
= *(uint32_t *)data
| (uint64_t)higher
<< 32;
418 LOG_DEBUG("read DCC 0x%16.16" PRIx64
, *data
);
426 static int aarch64_dpm_prepare(struct arm_dpm
*dpm
)
428 struct aarch64_common
*a8
= dpm_to_a8(dpm
);
432 /* set up invariant: INSTR_COMP is set after ever DPM operation */
433 long long then
= timeval_ms();
435 retval
= mem_ap_read_atomic_u32(a8
->armv8_common
.debug_ap
,
436 a8
->armv8_common
.debug_base
+ CPUV8_DBG_DSCR
,
438 if (retval
!= ERROR_OK
)
440 if ((dscr
& DSCR_ITE
) != 0)
442 if (timeval_ms() > then
+ 1000) {
443 LOG_ERROR("Timeout waiting for dpm prepare");
448 /* this "should never happen" ... */
449 if (dscr
& DSCR_DTR_RX_FULL
) {
450 LOG_ERROR("DSCR_DTR_RX_FULL, dscr 0x%08" PRIx32
, dscr
);
452 retval
= mem_ap_read_u32(a8
->armv8_common
.debug_ap
,
453 a8
->armv8_common
.debug_base
+ CPUV8_DBG_DTRRX
, &dscr
);
454 if (retval
!= ERROR_OK
)
457 /* Clear sticky error */
458 retval
= mem_ap_write_u32(a8
->armv8_common
.debug_ap
,
459 a8
->armv8_common
.debug_base
+ CPUV8_DBG_DRCR
, DRCR_CSE
);
460 if (retval
!= ERROR_OK
)
467 static int aarch64_dpm_finish(struct arm_dpm
*dpm
)
469 /* REVISIT what could be done here? */
473 static int aarch64_instr_execute(struct arm_dpm
*dpm
,
476 struct aarch64_common
*a8
= dpm_to_a8(dpm
);
477 uint32_t dscr
= DSCR_ITE
;
479 return aarch64_exec_opcode(
480 a8
->armv8_common
.arm
.target
,
485 static int aarch64_instr_write_data_dcc(struct arm_dpm
*dpm
,
486 uint32_t opcode
, uint32_t data
)
488 struct aarch64_common
*a8
= dpm_to_a8(dpm
);
490 uint32_t dscr
= DSCR_ITE
;
492 retval
= aarch64_write_dcc(&a8
->armv8_common
, data
);
493 if (retval
!= ERROR_OK
)
496 return aarch64_exec_opcode(
497 a8
->armv8_common
.arm
.target
,
502 static int aarch64_instr_write_data_dcc_64(struct arm_dpm
*dpm
,
503 uint32_t opcode
, uint64_t data
)
505 struct aarch64_common
*a8
= dpm_to_a8(dpm
);
507 uint32_t dscr
= DSCR_ITE
;
509 retval
= aarch64_write_dcc_64(&a8
->armv8_common
, data
);
510 if (retval
!= ERROR_OK
)
513 return aarch64_exec_opcode(
514 a8
->armv8_common
.arm
.target
,
519 static int aarch64_instr_write_data_r0(struct arm_dpm
*dpm
,
520 uint32_t opcode
, uint32_t data
)
522 struct aarch64_common
*a8
= dpm_to_a8(dpm
);
523 uint32_t dscr
= DSCR_ITE
;
526 retval
= aarch64_write_dcc(&a8
->armv8_common
, data
);
527 if (retval
!= ERROR_OK
)
530 retval
= aarch64_exec_opcode(
531 a8
->armv8_common
.arm
.target
,
532 ARMV8_MRS(SYSTEM_DBG_DTRRX_EL0
, 0),
534 if (retval
!= ERROR_OK
)
537 /* then the opcode, taking data from R0 */
538 retval
= aarch64_exec_opcode(
539 a8
->armv8_common
.arm
.target
,
546 static int aarch64_instr_write_data_r0_64(struct arm_dpm
*dpm
,
547 uint32_t opcode
, uint64_t data
)
549 struct aarch64_common
*a8
= dpm_to_a8(dpm
);
550 uint32_t dscr
= DSCR_ITE
;
553 retval
= aarch64_write_dcc_64(&a8
->armv8_common
, data
);
554 if (retval
!= ERROR_OK
)
557 retval
= aarch64_exec_opcode(
558 a8
->armv8_common
.arm
.target
,
559 ARMV8_MRS(SYSTEM_DBG_DBGDTR_EL0
, 0),
561 if (retval
!= ERROR_OK
)
564 /* then the opcode, taking data from R0 */
565 retval
= aarch64_exec_opcode(
566 a8
->armv8_common
.arm
.target
,
573 static int aarch64_instr_cpsr_sync(struct arm_dpm
*dpm
)
575 struct target
*target
= dpm
->arm
->target
;
576 uint32_t dscr
= DSCR_ITE
;
578 /* "Prefetch flush" after modifying execution status in CPSR */
579 return aarch64_exec_opcode(target
,
584 static int aarch64_instr_read_data_dcc(struct arm_dpm
*dpm
,
585 uint32_t opcode
, uint32_t *data
)
587 struct aarch64_common
*a8
= dpm_to_a8(dpm
);
589 uint32_t dscr
= DSCR_ITE
;
591 /* the opcode, writing data to DCC */
592 retval
= aarch64_exec_opcode(
593 a8
->armv8_common
.arm
.target
,
596 if (retval
!= ERROR_OK
)
599 return aarch64_read_dcc(&a8
->armv8_common
, data
, &dscr
);
602 static int aarch64_instr_read_data_dcc_64(struct arm_dpm
*dpm
,
603 uint32_t opcode
, uint64_t *data
)
605 struct aarch64_common
*a8
= dpm_to_a8(dpm
);
607 uint32_t dscr
= DSCR_ITE
;
609 /* the opcode, writing data to DCC */
610 retval
= aarch64_exec_opcode(
611 a8
->armv8_common
.arm
.target
,
614 if (retval
!= ERROR_OK
)
617 return aarch64_read_dcc_64(&a8
->armv8_common
, data
, &dscr
);
620 static int aarch64_instr_read_data_r0(struct arm_dpm
*dpm
,
621 uint32_t opcode
, uint32_t *data
)
623 struct aarch64_common
*a8
= dpm_to_a8(dpm
);
624 uint32_t dscr
= DSCR_ITE
;
627 /* the opcode, writing data to R0 */
628 retval
= aarch64_exec_opcode(
629 a8
->armv8_common
.arm
.target
,
632 if (retval
!= ERROR_OK
)
635 /* write R0 to DCC */
636 retval
= aarch64_exec_opcode(
637 a8
->armv8_common
.arm
.target
,
638 ARMV8_MSR_GP(SYSTEM_DBG_DTRTX_EL0
, 0), /* msr dbgdtr_el0, x0 */
640 if (retval
!= ERROR_OK
)
643 return aarch64_read_dcc(&a8
->armv8_common
, data
, &dscr
);
646 static int aarch64_instr_read_data_r0_64(struct arm_dpm
*dpm
,
647 uint32_t opcode
, uint64_t *data
)
649 struct aarch64_common
*a8
= dpm_to_a8(dpm
);
650 uint32_t dscr
= DSCR_ITE
;
653 /* the opcode, writing data to R0 */
654 retval
= aarch64_exec_opcode(
655 a8
->armv8_common
.arm
.target
,
658 if (retval
!= ERROR_OK
)
661 /* write R0 to DCC */
662 retval
= aarch64_exec_opcode(
663 a8
->armv8_common
.arm
.target
,
664 ARMV8_MSR_GP(SYSTEM_DBG_DBGDTR_EL0
, 0), /* msr dbgdtr_el0, x0 */
666 if (retval
!= ERROR_OK
)
669 return aarch64_read_dcc_64(&a8
->armv8_common
, data
, &dscr
);
672 static int aarch64_bpwp_enable(struct arm_dpm
*dpm
, unsigned index_t
,
673 uint32_t addr
, uint32_t control
)
675 struct aarch64_common
*a8
= dpm_to_a8(dpm
);
676 uint32_t vr
= a8
->armv8_common
.debug_base
;
677 uint32_t cr
= a8
->armv8_common
.debug_base
;
681 case 0 ... 15: /* breakpoints */
682 vr
+= CPUV8_DBG_BVR_BASE
;
683 cr
+= CPUV8_DBG_BCR_BASE
;
685 case 16 ... 31: /* watchpoints */
686 vr
+= CPUV8_DBG_WVR_BASE
;
687 cr
+= CPUV8_DBG_WCR_BASE
;
696 LOG_DEBUG("A8: bpwp enable, vr %08x cr %08x",
697 (unsigned) vr
, (unsigned) cr
);
699 retval
= aarch64_dap_write_memap_register_u32(dpm
->arm
->target
,
701 if (retval
!= ERROR_OK
)
703 retval
= aarch64_dap_write_memap_register_u32(dpm
->arm
->target
,
708 static int aarch64_bpwp_disable(struct arm_dpm
*dpm
, unsigned index_t
)
710 struct aarch64_common
*a
= dpm_to_a8(dpm
);
715 cr
= a
->armv8_common
.debug_base
+ CPUV8_DBG_BCR_BASE
;
718 cr
= a
->armv8_common
.debug_base
+ CPUV8_DBG_WCR_BASE
;
726 LOG_DEBUG("A: bpwp disable, cr %08x", (unsigned) cr
);
728 /* clear control register */
729 return aarch64_dap_write_memap_register_u32(dpm
->arm
->target
, cr
, 0);
733 static int aarch64_dpm_setup(struct aarch64_common
*a8
, uint64_t debug
)
735 struct arm_dpm
*dpm
= &a8
->armv8_common
.dpm
;
738 dpm
->arm
= &a8
->armv8_common
.arm
;
741 dpm
->prepare
= aarch64_dpm_prepare
;
742 dpm
->finish
= aarch64_dpm_finish
;
744 dpm
->instr_execute
= aarch64_instr_execute
;
745 dpm
->instr_write_data_dcc
= aarch64_instr_write_data_dcc
;
746 dpm
->instr_write_data_dcc_64
= aarch64_instr_write_data_dcc_64
;
747 dpm
->instr_write_data_r0
= aarch64_instr_write_data_r0
;
748 dpm
->instr_write_data_r0_64
= aarch64_instr_write_data_r0_64
;
749 dpm
->instr_cpsr_sync
= aarch64_instr_cpsr_sync
;
751 dpm
->instr_read_data_dcc
= aarch64_instr_read_data_dcc
;
752 dpm
->instr_read_data_dcc_64
= aarch64_instr_read_data_dcc_64
;
753 dpm
->instr_read_data_r0
= aarch64_instr_read_data_r0
;
754 dpm
->instr_read_data_r0_64
= aarch64_instr_read_data_r0_64
;
756 dpm
->arm_reg_current
= armv8_reg_current
;
758 dpm
->bpwp_enable
= aarch64_bpwp_enable
;
759 dpm
->bpwp_disable
= aarch64_bpwp_disable
;
761 retval
= armv8_dpm_setup(dpm
);
762 if (retval
== ERROR_OK
)
763 retval
= armv8_dpm_initialize(dpm
);
767 static struct target
*get_aarch64(struct target
*target
, int32_t coreid
)
769 struct target_list
*head
;
773 while (head
!= (struct target_list
*)NULL
) {
775 if ((curr
->coreid
== coreid
) && (curr
->state
== TARGET_HALTED
))
781 static int aarch64_halt(struct target
*target
);
783 static int aarch64_halt_smp(struct target
*target
)
786 struct target_list
*head
;
789 while (head
!= (struct target_list
*)NULL
) {
791 if ((curr
!= target
) && (curr
->state
!= TARGET_HALTED
))
792 retval
+= aarch64_halt(curr
);
798 static int update_halt_gdb(struct target
*target
)
801 if (target
->gdb_service
&& target
->gdb_service
->core
[0] == -1) {
802 target
->gdb_service
->target
= target
;
803 target
->gdb_service
->core
[0] = target
->coreid
;
804 retval
+= aarch64_halt_smp(target
);
810 * Cortex-A8 Run control
813 static int aarch64_poll(struct target
*target
)
815 int retval
= ERROR_OK
;
817 struct aarch64_common
*aarch64
= target_to_aarch64(target
);
818 struct armv8_common
*armv8
= &aarch64
->armv8_common
;
819 enum target_state prev_target_state
= target
->state
;
820 /* toggle to another core is done by gdb as follow */
821 /* maint packet J core_id */
823 /* the next polling trigger an halt event sent to gdb */
824 if ((target
->state
== TARGET_HALTED
) && (target
->smp
) &&
825 (target
->gdb_service
) &&
826 (target
->gdb_service
->target
== NULL
)) {
827 target
->gdb_service
->target
=
828 get_aarch64(target
, target
->gdb_service
->core
[1]);
829 target_call_event_callbacks(target
, TARGET_EVENT_HALTED
);
832 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
833 armv8
->debug_base
+ CPUV8_DBG_DSCR
, &dscr
);
834 if (retval
!= ERROR_OK
)
836 aarch64
->cpudbg_dscr
= dscr
;
838 if (DSCR_RUN_MODE(dscr
) == 0x3) {
839 if (prev_target_state
!= TARGET_HALTED
) {
840 /* We have a halting debug event */
841 LOG_DEBUG("Target halted");
842 target
->state
= TARGET_HALTED
;
843 if ((prev_target_state
== TARGET_RUNNING
)
844 || (prev_target_state
== TARGET_UNKNOWN
)
845 || (prev_target_state
== TARGET_RESET
)) {
846 retval
= aarch64_debug_entry(target
);
847 if (retval
!= ERROR_OK
)
850 retval
= update_halt_gdb(target
);
851 if (retval
!= ERROR_OK
)
854 target_call_event_callbacks(target
,
855 TARGET_EVENT_HALTED
);
857 if (prev_target_state
== TARGET_DEBUG_RUNNING
) {
860 retval
= aarch64_debug_entry(target
);
861 if (retval
!= ERROR_OK
)
864 retval
= update_halt_gdb(target
);
865 if (retval
!= ERROR_OK
)
869 target_call_event_callbacks(target
,
870 TARGET_EVENT_DEBUG_HALTED
);
874 target
->state
= TARGET_RUNNING
;
879 static int aarch64_halt(struct target
*target
)
881 int retval
= ERROR_OK
;
883 struct armv8_common
*armv8
= target_to_armv8(target
);
886 retval
= mem_ap_write_atomic_u32(armv8
->debug_ap
,
887 armv8
->cti_base
+ CTI_CTR
, 1);
888 if (retval
!= ERROR_OK
)
891 retval
= mem_ap_write_atomic_u32(armv8
->debug_ap
,
892 armv8
->cti_base
+ CTI_GATE
, 3);
893 if (retval
!= ERROR_OK
)
896 retval
= mem_ap_write_atomic_u32(armv8
->debug_ap
,
897 armv8
->cti_base
+ CTI_OUTEN0
, 1);
898 if (retval
!= ERROR_OK
)
901 retval
= mem_ap_write_atomic_u32(armv8
->debug_ap
,
902 armv8
->cti_base
+ CTI_OUTEN1
, 2);
903 if (retval
!= ERROR_OK
)
907 * add HDE in halting debug mode
909 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
910 armv8
->debug_base
+ CPUV8_DBG_DSCR
, &dscr
);
911 if (retval
!= ERROR_OK
)
914 retval
= mem_ap_write_atomic_u32(armv8
->debug_ap
,
915 armv8
->debug_base
+ CPUV8_DBG_DSCR
, dscr
| DSCR_HDE
);
916 if (retval
!= ERROR_OK
)
919 retval
= mem_ap_write_atomic_u32(armv8
->debug_ap
,
920 armv8
->cti_base
+ CTI_APPPULSE
, 1);
921 if (retval
!= ERROR_OK
)
924 retval
= mem_ap_write_atomic_u32(armv8
->debug_ap
,
925 armv8
->cti_base
+ CTI_INACK
, 1);
926 if (retval
!= ERROR_OK
)
930 long long then
= timeval_ms();
932 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
933 armv8
->debug_base
+ CPUV8_DBG_DSCR
, &dscr
);
934 if (retval
!= ERROR_OK
)
936 if ((dscr
& DSCRV8_HALT_MASK
) != 0)
938 if (timeval_ms() > then
+ 1000) {
939 LOG_ERROR("Timeout waiting for halt");
944 target
->debug_reason
= DBG_REASON_DBGRQ
;
949 static int aarch64_internal_restore(struct target
*target
, int current
,
950 uint64_t *address
, int handle_breakpoints
, int debug_execution
)
952 struct armv8_common
*armv8
= target_to_armv8(target
);
953 struct arm
*arm
= &armv8
->arm
;
957 if (!debug_execution
)
958 target_free_all_working_areas(target
);
960 /* current = 1: continue on current pc, otherwise continue at <address> */
961 resume_pc
= buf_get_u64(arm
->pc
->value
, 0, 64);
963 resume_pc
= *address
;
965 *address
= resume_pc
;
967 /* Make sure that the Armv7 gdb thumb fixups does not
968 * kill the return address
970 switch (arm
->core_state
) {
972 resume_pc
&= 0xFFFFFFFC;
974 case ARM_STATE_AARCH64
:
975 resume_pc
&= 0xFFFFFFFFFFFFFFFC;
977 case ARM_STATE_THUMB
:
978 case ARM_STATE_THUMB_EE
:
979 /* When the return address is loaded into PC
980 * bit 0 must be 1 to stay in Thumb state
984 case ARM_STATE_JAZELLE
:
985 LOG_ERROR("How do I resume into Jazelle state??");
988 LOG_DEBUG("resume pc = 0x%16" PRIx64
, resume_pc
);
989 buf_set_u64(arm
->pc
->value
, 0, 64, resume_pc
);
992 dpmv8_modeswitch(&armv8
->dpm
, ARM_MODE_ANY
);
994 /* called it now before restoring context because it uses cpu
995 * register r0 for restoring system control register */
996 retval
= aarch64_restore_system_control_reg(target
);
997 if (retval
!= ERROR_OK
)
999 retval
= aarch64_restore_context(target
, handle_breakpoints
);
1000 if (retval
!= ERROR_OK
)
1002 target
->debug_reason
= DBG_REASON_NOTHALTED
;
1003 target
->state
= TARGET_RUNNING
;
1005 /* registers are now invalid */
1006 register_cache_invalidate(arm
->core_cache
);
1009 /* the front-end may request us not to handle breakpoints */
1010 if (handle_breakpoints
) {
1011 /* Single step past breakpoint at current address */
1012 breakpoint
= breakpoint_find(target
, resume_pc
);
1014 LOG_DEBUG("unset breakpoint at 0x%8.8x", breakpoint
->address
);
1015 cortex_m3_unset_breakpoint(target
, breakpoint
);
1016 cortex_m3_single_step_core(target
);
1017 cortex_m3_set_breakpoint(target
, breakpoint
);
1025 static int aarch64_internal_restart(struct target
*target
)
1027 struct armv8_common
*armv8
= target_to_armv8(target
);
1028 struct arm
*arm
= &armv8
->arm
;
1032 * * Restart core and wait for it to be started. Clear ITRen and sticky
1033 * * exception flags: see ARMv7 ARM, C5.9.
1035 * REVISIT: for single stepping, we probably want to
1036 * disable IRQs by default, with optional override...
1039 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
1040 armv8
->debug_base
+ CPUV8_DBG_DSCR
, &dscr
);
1041 if (retval
!= ERROR_OK
)
1044 if ((dscr
& DSCR_ITE
) == 0)
1045 LOG_ERROR("DSCR InstrCompl must be set before leaving debug!");
1047 retval
= mem_ap_write_atomic_u32(armv8
->debug_ap
,
1048 armv8
->cti_base
+ CTI_APPPULSE
, 2);
1049 if (retval
!= ERROR_OK
)
1052 long long then
= timeval_ms();
1054 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
1055 armv8
->debug_base
+ CPUV8_DBG_DSCR
, &dscr
);
1056 if (retval
!= ERROR_OK
)
1058 if ((dscr
& DSCR_HDE
) != 0)
1060 if (timeval_ms() > then
+ 1000) {
1061 LOG_ERROR("Timeout waiting for resume");
1066 target
->debug_reason
= DBG_REASON_NOTHALTED
;
1067 target
->state
= TARGET_RUNNING
;
1069 /* registers are now invalid */
1070 register_cache_invalidate(arm
->core_cache
);
1075 static int aarch64_restore_smp(struct target
*target
, int handle_breakpoints
)
1078 struct target_list
*head
;
1079 struct target
*curr
;
1081 head
= target
->head
;
1082 while (head
!= (struct target_list
*)NULL
) {
1083 curr
= head
->target
;
1084 if ((curr
!= target
) && (curr
->state
!= TARGET_RUNNING
)) {
1085 /* resume current address , not in step mode */
1086 retval
+= aarch64_internal_restore(curr
, 1, &address
,
1087 handle_breakpoints
, 0);
1088 retval
+= aarch64_internal_restart(curr
);
1096 static int aarch64_resume(struct target
*target
, int current
,
1097 target_addr_t address
, int handle_breakpoints
, int debug_execution
)
1100 uint64_t addr
= address
;
1102 /* dummy resume for smp toggle in order to reduce gdb impact */
1103 if ((target
->smp
) && (target
->gdb_service
->core
[1] != -1)) {
1104 /* simulate a start and halt of target */
1105 target
->gdb_service
->target
= NULL
;
1106 target
->gdb_service
->core
[0] = target
->gdb_service
->core
[1];
1107 /* fake resume at next poll we play the target core[1], see poll*/
1108 target_call_event_callbacks(target
, TARGET_EVENT_RESUMED
);
1111 aarch64_internal_restore(target
, current
, &addr
, handle_breakpoints
,
1114 target
->gdb_service
->core
[0] = -1;
1115 retval
= aarch64_restore_smp(target
, handle_breakpoints
);
1116 if (retval
!= ERROR_OK
)
1119 aarch64_internal_restart(target
);
1121 if (!debug_execution
) {
1122 target
->state
= TARGET_RUNNING
;
1123 target_call_event_callbacks(target
, TARGET_EVENT_RESUMED
);
1124 LOG_DEBUG("target resumed at 0x%" PRIx64
, addr
);
1126 target
->state
= TARGET_DEBUG_RUNNING
;
1127 target_call_event_callbacks(target
, TARGET_EVENT_DEBUG_RESUMED
);
1128 LOG_DEBUG("target debug resumed at 0x%" PRIx64
, addr
);
1134 static int aarch64_debug_entry(struct target
*target
)
1136 int retval
= ERROR_OK
;
1137 struct aarch64_common
*aarch64
= target_to_aarch64(target
);
1138 struct armv8_common
*armv8
= target_to_armv8(target
);
1140 LOG_DEBUG("dscr = 0x%08" PRIx32
, aarch64
->cpudbg_dscr
);
1142 /* REVISIT see A8 TRM 12.11.4 steps 2..3 -- make sure that any
1143 * imprecise data aborts get discarded by issuing a Data
1144 * Synchronization Barrier: ARMV4_5_MCR(15, 0, 0, 7, 10, 4).
1147 /* make sure to clear all sticky errors */
1148 retval
= mem_ap_write_atomic_u32(armv8
->debug_ap
,
1149 armv8
->debug_base
+ CPUV8_DBG_DRCR
, DRCR_CSE
);
1150 if (retval
!= ERROR_OK
)
1153 /* Examine debug reason */
1154 armv8_dpm_report_dscr(&armv8
->dpm
, aarch64
->cpudbg_dscr
);
1156 /* save address of instruction that triggered the watchpoint? */
1157 if (target
->debug_reason
== DBG_REASON_WATCHPOINT
) {
1161 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
1162 armv8
->debug_base
+ CPUV8_DBG_WFAR1
,
1164 if (retval
!= ERROR_OK
)
1167 wfar
= (wfar
<< 32);
1168 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
1169 armv8
->debug_base
+ CPUV8_DBG_WFAR0
,
1171 if (retval
!= ERROR_OK
)
1174 armv8_dpm_report_wfar(&armv8
->dpm
, wfar
);
1177 retval
= armv8_dpm_read_current_registers(&armv8
->dpm
);
1179 if (armv8
->post_debug_entry
) {
1180 retval
= armv8
->post_debug_entry(target
);
1181 if (retval
!= ERROR_OK
)
1188 static int aarch64_post_debug_entry(struct target
*target
)
1190 struct aarch64_common
*aarch64
= target_to_aarch64(target
);
1191 struct armv8_common
*armv8
= &aarch64
->armv8_common
;
1194 mem_ap_write_atomic_u32(armv8
->debug_ap
,
1195 armv8
->debug_base
+ CPUV8_DBG_DRCR
, 1<<2);
1196 switch (armv8
->arm
.core_mode
) {
1200 retval
= armv8
->arm
.mrs(target
, 3, /*op 0*/
1201 0, 0, /* op1, op2 */
1202 1, 0, /* CRn, CRm */
1203 &aarch64
->system_control_reg
);
1204 if (retval
!= ERROR_OK
)
1209 retval
= armv8
->arm
.mrs(target
, 3, /*op 0*/
1210 4, 0, /* op1, op2 */
1211 1, 0, /* CRn, CRm */
1212 &aarch64
->system_control_reg
);
1213 if (retval
!= ERROR_OK
)
1218 retval
= armv8
->arm
.mrs(target
, 3, /*op 0*/
1219 6, 0, /* op1, op2 */
1220 1, 0, /* CRn, CRm */
1221 &aarch64
->system_control_reg
);
1222 if (retval
!= ERROR_OK
)
1226 LOG_DEBUG("unknow cpu state 0x%x" PRIx32
, armv8
->arm
.core_state
);
1228 LOG_DEBUG("System_register: %8.8" PRIx32
, aarch64
->system_control_reg
);
1229 aarch64
->system_control_reg_curr
= aarch64
->system_control_reg
;
1231 if (armv8
->armv8_mmu
.armv8_cache
.ctype
== -1)
1232 armv8_identify_cache(target
);
1234 armv8
->armv8_mmu
.mmu_enabled
=
1235 (aarch64
->system_control_reg
& 0x1U
) ? 1 : 0;
1236 armv8
->armv8_mmu
.armv8_cache
.d_u_cache_enabled
=
1237 (aarch64
->system_control_reg
& 0x4U
) ? 1 : 0;
1238 armv8
->armv8_mmu
.armv8_cache
.i_cache_enabled
=
1239 (aarch64
->system_control_reg
& 0x1000U
) ? 1 : 0;
1240 aarch64
->curr_mode
= armv8
->arm
.core_mode
;
1244 static int aarch64_set_dscr_bits(struct target
*target
, unsigned long bit_mask
, unsigned long value
)
1246 struct armv8_common
*armv8
= target_to_armv8(target
);
1250 int retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
1251 armv8
->debug_base
+ CPUV8_DBG_DSCR
, &dscr
);
1252 if (ERROR_OK
!= retval
)
1255 /* clear bitfield */
1258 dscr
|= value
& bit_mask
;
1260 /* write new DSCR */
1261 retval
= mem_ap_write_atomic_u32(armv8
->debug_ap
,
1262 armv8
->debug_base
+ CPUV8_DBG_DSCR
, dscr
);
1266 static int aarch64_step(struct target
*target
, int current
, target_addr_t address
,
1267 int handle_breakpoints
)
1269 struct armv8_common
*armv8
= target_to_armv8(target
);
1273 if (target
->state
!= TARGET_HALTED
) {
1274 LOG_WARNING("target not halted");
1275 return ERROR_TARGET_NOT_HALTED
;
1278 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
1279 armv8
->debug_base
+ CPUV8_DBG_EDECR
, &edecr
);
1280 if (retval
!= ERROR_OK
)
1283 /* make sure EDECR.SS is not set when restoring the register */
1286 /* set EDECR.SS to enter hardware step mode */
1287 retval
= mem_ap_write_atomic_u32(armv8
->debug_ap
,
1288 armv8
->debug_base
+ CPUV8_DBG_EDECR
, (edecr
|0x4));
1289 if (retval
!= ERROR_OK
)
1292 /* disable interrupts while stepping */
1293 retval
= aarch64_set_dscr_bits(target
, 0x3 << 22, 0x3 << 22);
1294 if (retval
!= ERROR_OK
)
1297 /* resume the target */
1298 retval
= aarch64_resume(target
, current
, address
, 0, 0);
1299 if (retval
!= ERROR_OK
)
1302 long long then
= timeval_ms();
1303 while (target
->state
!= TARGET_HALTED
) {
1304 retval
= aarch64_poll(target
);
1305 if (retval
!= ERROR_OK
)
1307 if (timeval_ms() > then
+ 1000) {
1308 LOG_ERROR("timeout waiting for target halt");
1314 retval
= mem_ap_write_atomic_u32(armv8
->debug_ap
,
1315 armv8
->debug_base
+ CPUV8_DBG_EDECR
, edecr
);
1316 if (retval
!= ERROR_OK
)
1319 /* restore interrupts */
1320 retval
= aarch64_set_dscr_bits(target
, 0x3 << 22, 0);
1321 if (retval
!= ERROR_OK
)
1327 static int aarch64_restore_context(struct target
*target
, bool bpwp
)
1329 struct armv8_common
*armv8
= target_to_armv8(target
);
1333 if (armv8
->pre_restore_context
)
1334 armv8
->pre_restore_context(target
);
1336 return armv8_dpm_write_dirty_registers(&armv8
->dpm
, bpwp
);
1341 * Cortex-A8 Breakpoint and watchpoint functions
1344 /* Setup hardware Breakpoint Register Pair */
1345 static int aarch64_set_breakpoint(struct target
*target
,
1346 struct breakpoint
*breakpoint
, uint8_t matchmode
)
1351 uint8_t byte_addr_select
= 0x0F;
1352 struct aarch64_common
*aarch64
= target_to_aarch64(target
);
1353 struct armv8_common
*armv8
= &aarch64
->armv8_common
;
1354 struct aarch64_brp
*brp_list
= aarch64
->brp_list
;
1357 if (breakpoint
->set
) {
1358 LOG_WARNING("breakpoint already set");
1362 if (breakpoint
->type
== BKPT_HARD
) {
1364 while (brp_list
[brp_i
].used
&& (brp_i
< aarch64
->brp_num
))
1366 if (brp_i
>= aarch64
->brp_num
) {
1367 LOG_ERROR("ERROR Can not find free Breakpoint Register Pair");
1368 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
1370 breakpoint
->set
= brp_i
+ 1;
1371 if (breakpoint
->length
== 2)
1372 byte_addr_select
= (3 << (breakpoint
->address
& 0x02));
1373 control
= ((matchmode
& 0x7) << 20)
1375 | (byte_addr_select
<< 5)
1377 brp_list
[brp_i
].used
= 1;
1378 brp_list
[brp_i
].value
= breakpoint
->address
& 0xFFFFFFFFFFFFFFFC;
1379 brp_list
[brp_i
].control
= control
;
1380 bpt_value
= brp_list
[brp_i
].value
;
1382 retval
= aarch64_dap_write_memap_register_u32(target
, armv8
->debug_base
1383 + CPUV8_DBG_BVR_BASE
+ 16 * brp_list
[brp_i
].BRPn
,
1384 (uint32_t)(bpt_value
& 0xFFFFFFFF));
1385 if (retval
!= ERROR_OK
)
1387 retval
= aarch64_dap_write_memap_register_u32(target
, armv8
->debug_base
1388 + CPUV8_DBG_BVR_BASE
+ 4 + 16 * brp_list
[brp_i
].BRPn
,
1389 (uint32_t)(bpt_value
>> 32));
1390 if (retval
!= ERROR_OK
)
1393 retval
= aarch64_dap_write_memap_register_u32(target
, armv8
->debug_base
1394 + CPUV8_DBG_BCR_BASE
+ 16 * brp_list
[brp_i
].BRPn
,
1395 brp_list
[brp_i
].control
);
1396 if (retval
!= ERROR_OK
)
1398 LOG_DEBUG("brp %i control 0x%0" PRIx32
" value 0x%" TARGET_PRIxADDR
, brp_i
,
1399 brp_list
[brp_i
].control
,
1400 brp_list
[brp_i
].value
);
1402 } else if (breakpoint
->type
== BKPT_SOFT
) {
1404 buf_set_u32(code
, 0, 32, ARMV8_HLT(0x11));
1405 retval
= target_read_memory(target
,
1406 breakpoint
->address
& 0xFFFFFFFFFFFFFFFE,
1407 breakpoint
->length
, 1,
1408 breakpoint
->orig_instr
);
1409 if (retval
!= ERROR_OK
)
1411 retval
= target_write_memory(target
,
1412 breakpoint
->address
& 0xFFFFFFFFFFFFFFFE,
1413 breakpoint
->length
, 1, code
);
1414 if (retval
!= ERROR_OK
)
1416 breakpoint
->set
= 0x11; /* Any nice value but 0 */
1419 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
1420 armv8
->debug_base
+ CPUV8_DBG_DSCR
, &dscr
);
1421 /* Ensure that halting debug mode is enable */
1422 dscr
= dscr
| DSCR_HDE
;
1423 retval
= mem_ap_write_atomic_u32(armv8
->debug_ap
,
1424 armv8
->debug_base
+ CPUV8_DBG_DSCR
, dscr
);
1425 if (retval
!= ERROR_OK
) {
1426 LOG_DEBUG("Failed to set DSCR.HDE");
1433 static int aarch64_set_context_breakpoint(struct target
*target
,
1434 struct breakpoint
*breakpoint
, uint8_t matchmode
)
1436 int retval
= ERROR_FAIL
;
1439 uint8_t byte_addr_select
= 0x0F;
1440 struct aarch64_common
*aarch64
= target_to_aarch64(target
);
1441 struct armv8_common
*armv8
= &aarch64
->armv8_common
;
1442 struct aarch64_brp
*brp_list
= aarch64
->brp_list
;
1444 if (breakpoint
->set
) {
1445 LOG_WARNING("breakpoint already set");
1448 /*check available context BRPs*/
1449 while ((brp_list
[brp_i
].used
||
1450 (brp_list
[brp_i
].type
!= BRP_CONTEXT
)) && (brp_i
< aarch64
->brp_num
))
1453 if (brp_i
>= aarch64
->brp_num
) {
1454 LOG_ERROR("ERROR Can not find free Breakpoint Register Pair");
1458 breakpoint
->set
= brp_i
+ 1;
1459 control
= ((matchmode
& 0x7) << 20)
1461 | (byte_addr_select
<< 5)
1463 brp_list
[brp_i
].used
= 1;
1464 brp_list
[brp_i
].value
= (breakpoint
->asid
);
1465 brp_list
[brp_i
].control
= control
;
1466 retval
= aarch64_dap_write_memap_register_u32(target
, armv8
->debug_base
1467 + CPUV8_DBG_BVR_BASE
+ 16 * brp_list
[brp_i
].BRPn
,
1468 brp_list
[brp_i
].value
);
1469 if (retval
!= ERROR_OK
)
1471 retval
= aarch64_dap_write_memap_register_u32(target
, armv8
->debug_base
1472 + CPUV8_DBG_BCR_BASE
+ 16 * brp_list
[brp_i
].BRPn
,
1473 brp_list
[brp_i
].control
);
1474 if (retval
!= ERROR_OK
)
1476 LOG_DEBUG("brp %i control 0x%0" PRIx32
" value 0x%" TARGET_PRIxADDR
, brp_i
,
1477 brp_list
[brp_i
].control
,
1478 brp_list
[brp_i
].value
);
1483 static int aarch64_set_hybrid_breakpoint(struct target
*target
, struct breakpoint
*breakpoint
)
1485 int retval
= ERROR_FAIL
;
1486 int brp_1
= 0; /* holds the contextID pair */
1487 int brp_2
= 0; /* holds the IVA pair */
1488 uint32_t control_CTX
, control_IVA
;
1489 uint8_t CTX_byte_addr_select
= 0x0F;
1490 uint8_t IVA_byte_addr_select
= 0x0F;
1491 uint8_t CTX_machmode
= 0x03;
1492 uint8_t IVA_machmode
= 0x01;
1493 struct aarch64_common
*aarch64
= target_to_aarch64(target
);
1494 struct armv8_common
*armv8
= &aarch64
->armv8_common
;
1495 struct aarch64_brp
*brp_list
= aarch64
->brp_list
;
1497 if (breakpoint
->set
) {
1498 LOG_WARNING("breakpoint already set");
1501 /*check available context BRPs*/
1502 while ((brp_list
[brp_1
].used
||
1503 (brp_list
[brp_1
].type
!= BRP_CONTEXT
)) && (brp_1
< aarch64
->brp_num
))
1506 printf("brp(CTX) found num: %d\n", brp_1
);
1507 if (brp_1
>= aarch64
->brp_num
) {
1508 LOG_ERROR("ERROR Can not find free Breakpoint Register Pair");
1512 while ((brp_list
[brp_2
].used
||
1513 (brp_list
[brp_2
].type
!= BRP_NORMAL
)) && (brp_2
< aarch64
->brp_num
))
1516 printf("brp(IVA) found num: %d\n", brp_2
);
1517 if (brp_2
>= aarch64
->brp_num
) {
1518 LOG_ERROR("ERROR Can not find free Breakpoint Register Pair");
1522 breakpoint
->set
= brp_1
+ 1;
1523 breakpoint
->linked_BRP
= brp_2
;
1524 control_CTX
= ((CTX_machmode
& 0x7) << 20)
1527 | (CTX_byte_addr_select
<< 5)
1529 brp_list
[brp_1
].used
= 1;
1530 brp_list
[brp_1
].value
= (breakpoint
->asid
);
1531 brp_list
[brp_1
].control
= control_CTX
;
1532 retval
= aarch64_dap_write_memap_register_u32(target
, armv8
->debug_base
1533 + CPUV8_DBG_BVR_BASE
+ 16 * brp_list
[brp_1
].BRPn
,
1534 brp_list
[brp_1
].value
);
1535 if (retval
!= ERROR_OK
)
1537 retval
= aarch64_dap_write_memap_register_u32(target
, armv8
->debug_base
1538 + CPUV8_DBG_BCR_BASE
+ 16 * brp_list
[brp_1
].BRPn
,
1539 brp_list
[brp_1
].control
);
1540 if (retval
!= ERROR_OK
)
1543 control_IVA
= ((IVA_machmode
& 0x7) << 20)
1546 | (IVA_byte_addr_select
<< 5)
1548 brp_list
[brp_2
].used
= 1;
1549 brp_list
[brp_2
].value
= breakpoint
->address
& 0xFFFFFFFFFFFFFFFC;
1550 brp_list
[brp_2
].control
= control_IVA
;
1551 retval
= aarch64_dap_write_memap_register_u32(target
, armv8
->debug_base
1552 + CPUV8_DBG_BVR_BASE
+ 16 * brp_list
[brp_2
].BRPn
,
1553 brp_list
[brp_2
].value
& 0xFFFFFFFF);
1554 if (retval
!= ERROR_OK
)
1556 retval
= aarch64_dap_write_memap_register_u32(target
, armv8
->debug_base
1557 + CPUV8_DBG_BVR_BASE
+ 4 + 16 * brp_list
[brp_2
].BRPn
,
1558 brp_list
[brp_2
].value
>> 32);
1559 if (retval
!= ERROR_OK
)
1561 retval
= aarch64_dap_write_memap_register_u32(target
, armv8
->debug_base
1562 + CPUV8_DBG_BCR_BASE
+ 16 * brp_list
[brp_2
].BRPn
,
1563 brp_list
[brp_2
].control
);
1564 if (retval
!= ERROR_OK
)
1570 static int aarch64_unset_breakpoint(struct target
*target
, struct breakpoint
*breakpoint
)
1573 struct aarch64_common
*aarch64
= target_to_aarch64(target
);
1574 struct armv8_common
*armv8
= &aarch64
->armv8_common
;
1575 struct aarch64_brp
*brp_list
= aarch64
->brp_list
;
1577 if (!breakpoint
->set
) {
1578 LOG_WARNING("breakpoint not set");
1582 if (breakpoint
->type
== BKPT_HARD
) {
1583 if ((breakpoint
->address
!= 0) && (breakpoint
->asid
!= 0)) {
1584 int brp_i
= breakpoint
->set
- 1;
1585 int brp_j
= breakpoint
->linked_BRP
;
1586 if ((brp_i
< 0) || (brp_i
>= aarch64
->brp_num
)) {
1587 LOG_DEBUG("Invalid BRP number in breakpoint");
1590 LOG_DEBUG("rbp %i control 0x%0" PRIx32
" value 0x%" TARGET_PRIxADDR
, brp_i
,
1591 brp_list
[brp_i
].control
, brp_list
[brp_i
].value
);
1592 brp_list
[brp_i
].used
= 0;
1593 brp_list
[brp_i
].value
= 0;
1594 brp_list
[brp_i
].control
= 0;
1595 retval
= aarch64_dap_write_memap_register_u32(target
, armv8
->debug_base
1596 + CPUV8_DBG_BCR_BASE
+ 16 * brp_list
[brp_i
].BRPn
,
1597 brp_list
[brp_i
].control
);
1598 if (retval
!= ERROR_OK
)
1600 retval
= aarch64_dap_write_memap_register_u32(target
, armv8
->debug_base
1601 + CPUV8_DBG_BVR_BASE
+ 16 * brp_list
[brp_i
].BRPn
,
1602 (uint32_t)brp_list
[brp_i
].value
);
1603 if (retval
!= ERROR_OK
)
1605 retval
= aarch64_dap_write_memap_register_u32(target
, armv8
->debug_base
1606 + CPUV8_DBG_BVR_BASE
+ 4 + 16 * brp_list
[brp_i
].BRPn
,
1607 (uint32_t)brp_list
[brp_i
].value
);
1608 if (retval
!= ERROR_OK
)
1610 if ((brp_j
< 0) || (brp_j
>= aarch64
->brp_num
)) {
1611 LOG_DEBUG("Invalid BRP number in breakpoint");
1614 LOG_DEBUG("rbp %i control 0x%0" PRIx32
" value 0x%0" PRIx64
, brp_j
,
1615 brp_list
[brp_j
].control
, brp_list
[brp_j
].value
);
1616 brp_list
[brp_j
].used
= 0;
1617 brp_list
[brp_j
].value
= 0;
1618 brp_list
[brp_j
].control
= 0;
1619 retval
= aarch64_dap_write_memap_register_u32(target
, armv8
->debug_base
1620 + CPUV8_DBG_BCR_BASE
+ 16 * brp_list
[brp_j
].BRPn
,
1621 brp_list
[brp_j
].control
);
1622 if (retval
!= ERROR_OK
)
1624 retval
= aarch64_dap_write_memap_register_u32(target
, armv8
->debug_base
1625 + CPUV8_DBG_BVR_BASE
+ 16 * brp_list
[brp_j
].BRPn
,
1626 (uint32_t)brp_list
[brp_j
].value
);
1627 if (retval
!= ERROR_OK
)
1629 retval
= aarch64_dap_write_memap_register_u32(target
, armv8
->debug_base
1630 + CPUV8_DBG_BVR_BASE
+ 4 + 16 * brp_list
[brp_j
].BRPn
,
1631 (uint32_t)brp_list
[brp_j
].value
);
1632 if (retval
!= ERROR_OK
)
1635 breakpoint
->linked_BRP
= 0;
1636 breakpoint
->set
= 0;
1640 int brp_i
= breakpoint
->set
- 1;
1641 if ((brp_i
< 0) || (brp_i
>= aarch64
->brp_num
)) {
1642 LOG_DEBUG("Invalid BRP number in breakpoint");
1645 LOG_DEBUG("rbp %i control 0x%0" PRIx32
" value 0x%0" PRIx64
, brp_i
,
1646 brp_list
[brp_i
].control
, brp_list
[brp_i
].value
);
1647 brp_list
[brp_i
].used
= 0;
1648 brp_list
[brp_i
].value
= 0;
1649 brp_list
[brp_i
].control
= 0;
1650 retval
= aarch64_dap_write_memap_register_u32(target
, armv8
->debug_base
1651 + CPUV8_DBG_BCR_BASE
+ 16 * brp_list
[brp_i
].BRPn
,
1652 brp_list
[brp_i
].control
);
1653 if (retval
!= ERROR_OK
)
1655 retval
= aarch64_dap_write_memap_register_u32(target
, armv8
->debug_base
1656 + CPUV8_DBG_BVR_BASE
+ 16 * brp_list
[brp_i
].BRPn
,
1657 brp_list
[brp_i
].value
);
1658 if (retval
!= ERROR_OK
)
1661 retval
= aarch64_dap_write_memap_register_u32(target
, armv8
->debug_base
1662 + CPUV8_DBG_BVR_BASE
+ 4 + 16 * brp_list
[brp_i
].BRPn
,
1663 (uint32_t)brp_list
[brp_i
].value
);
1664 if (retval
!= ERROR_OK
)
1666 breakpoint
->set
= 0;
1670 /* restore original instruction (kept in target endianness) */
1671 if (breakpoint
->length
== 4) {
1672 retval
= target_write_memory(target
,
1673 breakpoint
->address
& 0xFFFFFFFFFFFFFFFE,
1674 4, 1, breakpoint
->orig_instr
);
1675 if (retval
!= ERROR_OK
)
1678 retval
= target_write_memory(target
,
1679 breakpoint
->address
& 0xFFFFFFFFFFFFFFFE,
1680 2, 1, breakpoint
->orig_instr
);
1681 if (retval
!= ERROR_OK
)
1685 breakpoint
->set
= 0;
1690 static int aarch64_add_breakpoint(struct target
*target
,
1691 struct breakpoint
*breakpoint
)
1693 struct aarch64_common
*aarch64
= target_to_aarch64(target
);
1695 if ((breakpoint
->type
== BKPT_HARD
) && (aarch64
->brp_num_available
< 1)) {
1696 LOG_INFO("no hardware breakpoint available");
1697 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
1700 if (breakpoint
->type
== BKPT_HARD
)
1701 aarch64
->brp_num_available
--;
1703 return aarch64_set_breakpoint(target
, breakpoint
, 0x00); /* Exact match */
1706 static int aarch64_add_context_breakpoint(struct target
*target
,
1707 struct breakpoint
*breakpoint
)
1709 struct aarch64_common
*aarch64
= target_to_aarch64(target
);
1711 if ((breakpoint
->type
== BKPT_HARD
) && (aarch64
->brp_num_available
< 1)) {
1712 LOG_INFO("no hardware breakpoint available");
1713 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
1716 if (breakpoint
->type
== BKPT_HARD
)
1717 aarch64
->brp_num_available
--;
1719 return aarch64_set_context_breakpoint(target
, breakpoint
, 0x02); /* asid match */
1722 static int aarch64_add_hybrid_breakpoint(struct target
*target
,
1723 struct breakpoint
*breakpoint
)
1725 struct aarch64_common
*aarch64
= target_to_aarch64(target
);
1727 if ((breakpoint
->type
== BKPT_HARD
) && (aarch64
->brp_num_available
< 1)) {
1728 LOG_INFO("no hardware breakpoint available");
1729 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
1732 if (breakpoint
->type
== BKPT_HARD
)
1733 aarch64
->brp_num_available
--;
1735 return aarch64_set_hybrid_breakpoint(target
, breakpoint
); /* ??? */
1739 static int aarch64_remove_breakpoint(struct target
*target
, struct breakpoint
*breakpoint
)
1741 struct aarch64_common
*aarch64
= target_to_aarch64(target
);
1744 /* It is perfectly possible to remove breakpoints while the target is running */
1745 if (target
->state
!= TARGET_HALTED
) {
1746 LOG_WARNING("target not halted");
1747 return ERROR_TARGET_NOT_HALTED
;
1751 if (breakpoint
->set
) {
1752 aarch64_unset_breakpoint(target
, breakpoint
);
1753 if (breakpoint
->type
== BKPT_HARD
)
1754 aarch64
->brp_num_available
++;
1761 * Cortex-A8 Reset functions
1764 static int aarch64_assert_reset(struct target
*target
)
1766 struct armv8_common
*armv8
= target_to_armv8(target
);
1770 /* FIXME when halt is requested, make it work somehow... */
1772 /* Issue some kind of warm reset. */
1773 if (target_has_event_action(target
, TARGET_EVENT_RESET_ASSERT
))
1774 target_handle_event(target
, TARGET_EVENT_RESET_ASSERT
);
1775 else if (jtag_get_reset_config() & RESET_HAS_SRST
) {
1776 /* REVISIT handle "pulls" cases, if there's
1777 * hardware that needs them to work.
1779 jtag_add_reset(0, 1);
1781 LOG_ERROR("%s: how to reset?", target_name(target
));
1785 /* registers are now invalid */
1786 register_cache_invalidate(armv8
->arm
.core_cache
);
1788 target
->state
= TARGET_RESET
;
1793 static int aarch64_deassert_reset(struct target
*target
)
1799 /* be certain SRST is off */
1800 jtag_add_reset(0, 0);
1802 retval
= aarch64_poll(target
);
1803 if (retval
!= ERROR_OK
)
1806 if (target
->reset_halt
) {
1807 if (target
->state
!= TARGET_HALTED
) {
1808 LOG_WARNING("%s: ran after reset and before halt ...",
1809 target_name(target
));
1810 retval
= target_halt(target
);
1811 if (retval
!= ERROR_OK
)
1819 static int aarch64_write_apb_ap_memory(struct target
*target
,
1820 uint64_t address
, uint32_t size
,
1821 uint32_t count
, const uint8_t *buffer
)
1823 /* write memory through APB-AP */
1824 int retval
= ERROR_COMMAND_SYNTAX_ERROR
;
1825 struct armv8_common
*armv8
= target_to_armv8(target
);
1826 struct arm
*arm
= &armv8
->arm
;
1827 int total_bytes
= count
* size
;
1829 int start_byte
= address
& 0x3;
1830 int end_byte
= (address
+ total_bytes
) & 0x3;
1833 uint8_t *tmp_buff
= NULL
;
1835 LOG_DEBUG("Writing APB-AP memory address 0x%" PRIx64
" size %" PRIu32
" count%" PRIu32
,
1836 address
, size
, count
);
1837 if (target
->state
!= TARGET_HALTED
) {
1838 LOG_WARNING("target not halted");
1839 return ERROR_TARGET_NOT_HALTED
;
1842 total_u32
= DIV_ROUND_UP((address
& 3) + total_bytes
, 4);
1844 /* Mark register R0 as dirty, as it will be used
1845 * for transferring the data.
1846 * It will be restored automatically when exiting
1849 reg
= armv8_reg_current(arm
, 1);
1852 reg
= armv8_reg_current(arm
, 0);
1855 /* clear any abort */
1856 retval
= mem_ap_write_atomic_u32(armv8
->debug_ap
,
1857 armv8
->debug_base
+ CPUV8_DBG_DRCR
, DRCR_CSE
);
1858 if (retval
!= ERROR_OK
)
1862 /* This algorithm comes from DDI0487A.g, chapter J9.1 */
1864 /* The algorithm only copies 32 bit words, so the buffer
1865 * should be expanded to include the words at either end.
1866 * The first and last words will be read first to avoid
1867 * corruption if needed.
1869 tmp_buff
= malloc(total_u32
* 4);
1871 if ((start_byte
!= 0) && (total_u32
> 1)) {
1872 /* First bytes not aligned - read the 32 bit word to avoid corrupting
1873 * the other bytes in the word.
1875 retval
= aarch64_read_apb_ap_memory(target
, (address
& ~0x3), 4, 1, tmp_buff
);
1876 if (retval
!= ERROR_OK
)
1877 goto error_free_buff_w
;
1880 /* If end of write is not aligned, or the write is less than 4 bytes */
1881 if ((end_byte
!= 0) ||
1882 ((total_u32
== 1) && (total_bytes
!= 4))) {
1884 /* Read the last word to avoid corruption during 32 bit write */
1885 int mem_offset
= (total_u32
-1) * 4;
1886 retval
= aarch64_read_apb_ap_memory(target
, (address
& ~0x3) + mem_offset
, 4, 1, &tmp_buff
[mem_offset
]);
1887 if (retval
!= ERROR_OK
)
1888 goto error_free_buff_w
;
1891 /* Copy the write buffer over the top of the temporary buffer */
1892 memcpy(&tmp_buff
[start_byte
], buffer
, total_bytes
);
1894 /* We now have a 32 bit aligned buffer that can be written */
1897 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
1898 armv8
->debug_base
+ CPUV8_DBG_DSCR
, &dscr
);
1899 if (retval
!= ERROR_OK
)
1900 goto error_free_buff_w
;
1902 /* Set Normal access mode */
1903 dscr
= (dscr
& ~DSCR_MA
);
1904 retval
= mem_ap_write_atomic_u32(armv8
->debug_ap
,
1905 armv8
->debug_base
+ CPUV8_DBG_DSCR
, dscr
);
1907 if (arm
->core_state
== ARM_STATE_AARCH64
) {
1908 /* Write X0 with value 'address' using write procedure */
1909 /* Step 1.a+b - Write the address for read access into DBGDTR_EL0 */
1910 retval
+= aarch64_write_dcc_64(armv8
, address
& ~0x3ULL
);
1911 /* Step 1.c - Copy value from DTR to R0 using instruction mrs DBGDTR_EL0, x0 */
1912 retval
+= aarch64_exec_opcode(target
,
1913 ARMV8_MRS(SYSTEM_DBG_DBGDTR_EL0
, 0), &dscr
);
1915 /* Write R0 with value 'address' using write procedure */
1916 /* Step 1.a+b - Write the address for read access into DBGDTRRX */
1917 retval
+= aarch64_write_dcc(armv8
, address
& ~0x3ULL
);
1918 /* Step 1.c - Copy value from DTR to R0 using instruction mrc DBGDTRTXint, r0 */
1919 retval
+= aarch64_exec_opcode(target
,
1920 T32_FMTITR(ARMV4_5_MRC(14, 0, 0, 0, 5, 0)), &dscr
);
1923 /* Step 1.d - Change DCC to memory mode */
1924 dscr
= dscr
| DSCR_MA
;
1925 retval
+= mem_ap_write_atomic_u32(armv8
->debug_ap
,
1926 armv8
->debug_base
+ CPUV8_DBG_DSCR
, dscr
);
1927 if (retval
!= ERROR_OK
)
1928 goto error_unset_dtr_w
;
1931 /* Step 2.a - Do the write */
1932 retval
= mem_ap_write_buf_noincr(armv8
->debug_ap
,
1933 tmp_buff
, 4, total_u32
, armv8
->debug_base
+ CPUV8_DBG_DTRRX
);
1934 if (retval
!= ERROR_OK
)
1935 goto error_unset_dtr_w
;
1937 /* Step 3.a - Switch DTR mode back to Normal mode */
1938 dscr
= (dscr
& ~DSCR_MA
);
1939 retval
= mem_ap_write_atomic_u32(armv8
->debug_ap
,
1940 armv8
->debug_base
+ CPUV8_DBG_DSCR
, dscr
);
1941 if (retval
!= ERROR_OK
)
1942 goto error_unset_dtr_w
;
1944 /* Check for sticky abort flags in the DSCR */
1945 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
1946 armv8
->debug_base
+ CPUV8_DBG_DSCR
, &dscr
);
1947 if (retval
!= ERROR_OK
)
1948 goto error_free_buff_w
;
1949 if (dscr
& (DSCR_ERR
| DSCR_SYS_ERROR_PEND
)) {
1950 /* Abort occurred - clear it and exit */
1951 LOG_ERROR("abort occurred - dscr = 0x%08" PRIx32
, dscr
);
1952 mem_ap_write_atomic_u32(armv8
->debug_ap
,
1953 armv8
->debug_base
+ CPUV8_DBG_DRCR
, 1<<2);
1954 goto error_free_buff_w
;
1962 /* Unset DTR mode */
1963 mem_ap_read_atomic_u32(armv8
->debug_ap
,
1964 armv8
->debug_base
+ CPUV8_DBG_DSCR
, &dscr
);
1965 dscr
= (dscr
& ~DSCR_MA
);
1966 mem_ap_write_atomic_u32(armv8
->debug_ap
,
1967 armv8
->debug_base
+ CPUV8_DBG_DSCR
, dscr
);
1974 static int aarch64_read_apb_ap_memory(struct target
*target
,
1975 target_addr_t address
, uint32_t size
,
1976 uint32_t count
, uint8_t *buffer
)
1978 /* read memory through APB-AP */
1979 int retval
= ERROR_COMMAND_SYNTAX_ERROR
;
1980 struct armv8_common
*armv8
= target_to_armv8(target
);
1981 struct arm
*arm
= &armv8
->arm
;
1982 int total_bytes
= count
* size
;
1984 int start_byte
= address
& 0x3;
1985 int end_byte
= (address
+ total_bytes
) & 0x3;
1988 uint8_t *tmp_buff
= NULL
;
1992 LOG_DEBUG("Reading APB-AP memory address 0x%" TARGET_PRIxADDR
" size %" PRIu32
" count%" PRIu32
,
1993 address
, size
, count
);
1994 if (target
->state
!= TARGET_HALTED
) {
1995 LOG_WARNING("target not halted");
1996 return ERROR_TARGET_NOT_HALTED
;
1999 total_u32
= DIV_ROUND_UP((address
& 3) + total_bytes
, 4);
2000 /* Mark register X0, X1 as dirty, as it will be used
2001 * for transferring the data.
2002 * It will be restored automatically when exiting
2005 reg
= armv8_reg_current(arm
, 1);
2008 reg
= armv8_reg_current(arm
, 0);
2011 /* clear any abort */
2012 retval
= mem_ap_write_atomic_u32(armv8
->debug_ap
,
2013 armv8
->debug_base
+ CPUV8_DBG_DRCR
, DRCR_CSE
);
2014 if (retval
!= ERROR_OK
)
2015 goto error_free_buff_r
;
2018 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
2019 armv8
->debug_base
+ CPUV8_DBG_DSCR
, &dscr
);
2021 /* This algorithm comes from DDI0487A.g, chapter J9.1 */
2023 /* Set Normal access mode */
2024 dscr
= (dscr
& ~DSCR_MA
);
2025 retval
+= mem_ap_write_atomic_u32(armv8
->debug_ap
,
2026 armv8
->debug_base
+ CPUV8_DBG_DSCR
, dscr
);
2028 if (arm
->core_state
== ARM_STATE_AARCH64
) {
2029 /* Write X0 with value 'address' using write procedure */
2030 /* Step 1.a+b - Write the address for read access into DBGDTR_EL0 */
2031 retval
+= aarch64_write_dcc_64(armv8
, address
& ~0x3ULL
);
2032 /* Step 1.c - Copy value from DTR to R0 using instruction mrs DBGDTR_EL0, x0 */
2033 retval
+= aarch64_exec_opcode(target
, ARMV8_MRS(SYSTEM_DBG_DBGDTR_EL0
, 0), &dscr
);
2034 /* Step 1.d - Dummy operation to ensure EDSCR.Txfull == 1 */
2035 retval
+= aarch64_exec_opcode(target
, ARMV8_MSR_GP(SYSTEM_DBG_DBGDTR_EL0
, 0), &dscr
);
2036 /* Step 1.e - Change DCC to memory mode */
2037 dscr
= dscr
| DSCR_MA
;
2038 retval
+= mem_ap_write_atomic_u32(armv8
->debug_ap
,
2039 armv8
->debug_base
+ CPUV8_DBG_DSCR
, dscr
);
2040 /* Step 1.f - read DBGDTRTX and discard the value */
2041 retval
+= mem_ap_read_atomic_u32(armv8
->debug_ap
,
2042 armv8
->debug_base
+ CPUV8_DBG_DTRTX
, &value
);
2044 /* Write R0 with value 'address' using write procedure */
2045 /* Step 1.a+b - Write the address for read access into DBGDTRRXint */
2046 retval
+= aarch64_write_dcc(armv8
, address
& ~0x3ULL
);
2047 /* Step 1.c - Copy value from DTR to R0 using instruction mrc DBGDTRTXint, r0 */
2048 retval
+= aarch64_exec_opcode(target
,
2049 T32_FMTITR(ARMV4_5_MRC(14, 0, 0, 0, 5, 0)), &dscr
);
2050 /* Step 1.d - Dummy operation to ensure EDSCR.Txfull == 1 */
2051 retval
+= aarch64_exec_opcode(target
,
2052 T32_FMTITR(ARMV4_5_MCR(14, 0, 0, 0, 5, 0)), &dscr
);
2053 /* Step 1.e - Change DCC to memory mode */
2054 dscr
= dscr
| DSCR_MA
;
2055 retval
+= mem_ap_write_atomic_u32(armv8
->debug_ap
,
2056 armv8
->debug_base
+ CPUV8_DBG_DSCR
, dscr
);
2057 /* Step 1.f - read DBGDTRTX and discard the value */
2058 retval
+= mem_ap_read_atomic_u32(armv8
->debug_ap
,
2059 armv8
->debug_base
+ CPUV8_DBG_DTRTX
, &value
);
2062 if (retval
!= ERROR_OK
)
2063 goto error_unset_dtr_r
;
2065 /* Optimize the read as much as we can, either way we read in a single pass */
2066 if ((start_byte
) || (end_byte
)) {
2067 /* The algorithm only copies 32 bit words, so the buffer
2068 * should be expanded to include the words at either end.
2069 * The first and last words will be read into a temp buffer
2070 * to avoid corruption
2072 tmp_buff
= malloc(total_u32
* 4);
2074 goto error_unset_dtr_r
;
2076 /* use the tmp buffer to read the entire data */
2077 u8buf_ptr
= tmp_buff
;
2079 /* address and read length are aligned so read directly into the passed buffer */
2082 /* Read the data - Each read of the DTRTX register causes the instruction to be reissued
2083 * Abort flags are sticky, so can be read at end of transactions
2085 * This data is read in aligned to 32 bit boundary.
2088 /* Step 2.a - Loop n-1 times, each read of DBGDTRTX reads the data from [X0] and
2089 * increments X0 by 4. */
2090 retval
= mem_ap_read_buf_noincr(armv8
->debug_ap
, u8buf_ptr
, 4, total_u32
-1,
2091 armv8
->debug_base
+ CPUV8_DBG_DTRTX
);
2092 if (retval
!= ERROR_OK
)
2093 goto error_unset_dtr_r
;
2095 /* Step 3.a - set DTR access mode back to Normal mode */
2096 dscr
= (dscr
& ~DSCR_MA
);
2097 retval
= mem_ap_write_atomic_u32(armv8
->debug_ap
,
2098 armv8
->debug_base
+ CPUV8_DBG_DSCR
, dscr
);
2099 if (retval
!= ERROR_OK
)
2100 goto error_free_buff_r
;
2102 /* Step 3.b - read DBGDTRTX for the final value */
2103 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
2104 armv8
->debug_base
+ CPUV8_DBG_DTRTX
, &value
);
2105 memcpy(u8buf_ptr
+ (total_u32
-1) * 4, &value
, 4);
2107 /* Check for sticky abort flags in the DSCR */
2108 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
2109 armv8
->debug_base
+ CPUV8_DBG_DSCR
, &dscr
);
2110 if (retval
!= ERROR_OK
)
2111 goto error_free_buff_r
;
2112 if (dscr
& (DSCR_ERR
| DSCR_SYS_ERROR_PEND
)) {
2113 /* Abort occurred - clear it and exit */
2114 LOG_ERROR("abort occurred - dscr = 0x%08" PRIx32
, dscr
);
2115 mem_ap_write_atomic_u32(armv8
->debug_ap
,
2116 armv8
->debug_base
+ CPUV8_DBG_DRCR
, DRCR_CSE
);
2117 goto error_free_buff_r
;
2120 /* check if we need to copy aligned data by applying any shift necessary */
2122 memcpy(buffer
, tmp_buff
+ start_byte
, total_bytes
);
2130 /* Unset DTR mode */
2131 mem_ap_read_atomic_u32(armv8
->debug_ap
,
2132 armv8
->debug_base
+ CPUV8_DBG_DSCR
, &dscr
);
2133 dscr
= (dscr
& ~DSCR_MA
);
2134 mem_ap_write_atomic_u32(armv8
->debug_ap
,
2135 armv8
->debug_base
+ CPUV8_DBG_DSCR
, dscr
);
2142 static int aarch64_read_phys_memory(struct target
*target
,
2143 target_addr_t address
, uint32_t size
,
2144 uint32_t count
, uint8_t *buffer
)
2146 int retval
= ERROR_COMMAND_SYNTAX_ERROR
;
2147 LOG_DEBUG("Reading memory at real address 0x%" TARGET_PRIxADDR
"; size %" PRId32
"; count %" PRId32
,
2148 address
, size
, count
);
2150 if (count
&& buffer
) {
2151 /* read memory through APB-AP */
2152 retval
= aarch64_mmu_modify(target
, 0);
2153 if (retval
!= ERROR_OK
)
2155 retval
= aarch64_read_apb_ap_memory(target
, address
, size
, count
, buffer
);
2160 static int aarch64_read_memory(struct target
*target
, target_addr_t address
,
2161 uint32_t size
, uint32_t count
, uint8_t *buffer
)
2163 int mmu_enabled
= 0;
2166 /* aarch64 handles unaligned memory access */
2167 LOG_DEBUG("Reading memory at address 0x%" TARGET_PRIxADDR
"; size %" PRId32
"; count %" PRId32
, address
,
2170 /* determine if MMU was enabled on target stop */
2171 retval
= aarch64_mmu(target
, &mmu_enabled
);
2172 if (retval
!= ERROR_OK
)
2176 retval
= aarch64_check_address(target
, address
);
2177 if (retval
!= ERROR_OK
)
2179 /* enable MMU as we could have disabled it for phys access */
2180 retval
= aarch64_mmu_modify(target
, 1);
2181 if (retval
!= ERROR_OK
)
2184 return aarch64_read_apb_ap_memory(target
, address
, size
, count
, buffer
);
2187 static int aarch64_write_phys_memory(struct target
*target
,
2188 target_addr_t address
, uint32_t size
,
2189 uint32_t count
, const uint8_t *buffer
)
2191 int retval
= ERROR_COMMAND_SYNTAX_ERROR
;
2193 LOG_DEBUG("Writing memory to real address 0x%" TARGET_PRIxADDR
"; size %" PRId32
"; count %" PRId32
, address
,
2196 if (count
&& buffer
) {
2197 /* write memory through APB-AP */
2198 retval
= aarch64_mmu_modify(target
, 0);
2199 if (retval
!= ERROR_OK
)
2201 return aarch64_write_apb_ap_memory(target
, address
, size
, count
, buffer
);
2207 static int aarch64_write_memory(struct target
*target
, target_addr_t address
,
2208 uint32_t size
, uint32_t count
, const uint8_t *buffer
)
2210 int mmu_enabled
= 0;
2213 /* aarch64 handles unaligned memory access */
2214 LOG_DEBUG("Writing memory at address 0x%" TARGET_PRIxADDR
"; size %" PRId32
2215 "; count %" PRId32
, address
, size
, count
);
2217 /* determine if MMU was enabled on target stop */
2218 retval
= aarch64_mmu(target
, &mmu_enabled
);
2219 if (retval
!= ERROR_OK
)
2223 retval
= aarch64_check_address(target
, address
);
2224 if (retval
!= ERROR_OK
)
2226 /* enable MMU as we could have disabled it for phys access */
2227 retval
= aarch64_mmu_modify(target
, 1);
2228 if (retval
!= ERROR_OK
)
2231 return aarch64_write_apb_ap_memory(target
, address
, size
, count
, buffer
);
2234 static int aarch64_handle_target_request(void *priv
)
2236 struct target
*target
= priv
;
2237 struct armv8_common
*armv8
= target_to_armv8(target
);
2240 if (!target_was_examined(target
))
2242 if (!target
->dbg_msg_enabled
)
2245 if (target
->state
== TARGET_RUNNING
) {
2248 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
2249 armv8
->debug_base
+ CPUV8_DBG_DSCR
, &dscr
);
2251 /* check if we have data */
2252 while ((dscr
& DSCR_DTR_TX_FULL
) && (retval
== ERROR_OK
)) {
2253 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
2254 armv8
->debug_base
+ CPUV8_DBG_DTRTX
, &request
);
2255 if (retval
== ERROR_OK
) {
2256 target_request(target
, request
);
2257 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
2258 armv8
->debug_base
+ CPUV8_DBG_DSCR
, &dscr
);
2266 static int aarch64_examine_first(struct target
*target
)
2268 struct aarch64_common
*aarch64
= target_to_aarch64(target
);
2269 struct armv8_common
*armv8
= &aarch64
->armv8_common
;
2270 struct adiv5_dap
*swjdp
= armv8
->arm
.dap
;
2272 int retval
= ERROR_OK
;
2273 uint64_t debug
, ttypr
;
2275 uint32_t tmp0
, tmp1
;
2276 debug
= ttypr
= cpuid
= 0;
2278 /* We do one extra read to ensure DAP is configured,
2279 * we call ahbap_debugport_init(swjdp) instead
2281 retval
= dap_dp_init(swjdp
);
2282 if (retval
!= ERROR_OK
)
2285 /* Search for the APB-AB - it is needed for access to debug registers */
2286 retval
= dap_find_ap(swjdp
, AP_TYPE_APB_AP
, &armv8
->debug_ap
);
2287 if (retval
!= ERROR_OK
) {
2288 LOG_ERROR("Could not find APB-AP for debug access");
2292 retval
= mem_ap_init(armv8
->debug_ap
);
2293 if (retval
!= ERROR_OK
) {
2294 LOG_ERROR("Could not initialize the APB-AP");
2298 armv8
->debug_ap
->memaccess_tck
= 80;
2300 if (!target
->dbgbase_set
) {
2302 /* Get ROM Table base */
2304 int32_t coreidx
= target
->coreid
;
2305 retval
= dap_get_debugbase(armv8
->debug_ap
, &dbgbase
, &apid
);
2306 if (retval
!= ERROR_OK
)
2308 /* Lookup 0x15 -- Processor DAP */
2309 retval
= dap_lookup_cs_component(armv8
->debug_ap
, dbgbase
, 0x15,
2310 &armv8
->debug_base
, &coreidx
);
2311 if (retval
!= ERROR_OK
)
2313 LOG_DEBUG("Detected core %" PRId32
" dbgbase: %08" PRIx32
2314 " apid: %08" PRIx32
, coreidx
, armv8
->debug_base
, apid
);
2316 armv8
->debug_base
= target
->dbgbase
;
2318 retval
= mem_ap_write_atomic_u32(armv8
->debug_ap
,
2319 armv8
->debug_base
+ CPUV8_DBG_LOCKACCESS
, 0xC5ACCE55);
2320 if (retval
!= ERROR_OK
) {
2321 LOG_DEBUG("LOCK debug access fail");
2325 retval
= mem_ap_write_atomic_u32(armv8
->debug_ap
,
2326 armv8
->debug_base
+ CPUV8_DBG_OSLAR
, 0);
2327 if (retval
!= ERROR_OK
) {
2328 LOG_DEBUG("Examine %s failed", "oslock");
2332 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
2333 armv8
->debug_base
+ CPUV8_DBG_MAINID0
, &cpuid
);
2334 if (retval
!= ERROR_OK
) {
2335 LOG_DEBUG("Examine %s failed", "CPUID");
2339 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
2340 armv8
->debug_base
+ CPUV8_DBG_MEMFEATURE0
, &tmp0
);
2341 retval
+= mem_ap_read_atomic_u32(armv8
->debug_ap
,
2342 armv8
->debug_base
+ CPUV8_DBG_MEMFEATURE0
+ 4, &tmp1
);
2343 if (retval
!= ERROR_OK
) {
2344 LOG_DEBUG("Examine %s failed", "Memory Model Type");
2348 ttypr
= (ttypr
<< 32) | tmp0
;
2350 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
2351 armv8
->debug_base
+ CPUV8_DBG_DBGFEATURE0
, &tmp0
);
2352 retval
+= mem_ap_read_atomic_u32(armv8
->debug_ap
,
2353 armv8
->debug_base
+ CPUV8_DBG_DBGFEATURE0
+ 4, &tmp1
);
2354 if (retval
!= ERROR_OK
) {
2355 LOG_DEBUG("Examine %s failed", "ID_AA64DFR0_EL1");
2359 debug
= (debug
<< 32) | tmp0
;
2361 LOG_DEBUG("cpuid = 0x%08" PRIx32
, cpuid
);
2362 LOG_DEBUG("ttypr = 0x%08" PRIx64
, ttypr
);
2363 LOG_DEBUG("debug = 0x%08" PRIx64
, debug
);
2365 if (target
->ctibase
== 0) {
2366 /* assume a v8 rom table layout */
2367 armv8
->cti_base
= target
->ctibase
= armv8
->debug_base
+ 0x10000;
2368 LOG_INFO("Target ctibase is not set, assuming 0x%0" PRIx32
, target
->ctibase
);
2370 armv8
->cti_base
= target
->ctibase
;
2372 retval
= mem_ap_write_atomic_u32(armv8
->debug_ap
,
2373 armv8
->cti_base
+ CTI_UNLOCK
, 0xC5ACCE55);
2374 if (retval
!= ERROR_OK
)
2378 armv8
->arm
.core_type
= ARM_MODE_MON
;
2379 retval
= aarch64_dpm_setup(aarch64
, debug
);
2380 if (retval
!= ERROR_OK
)
2383 /* Setup Breakpoint Register Pairs */
2384 aarch64
->brp_num
= (uint32_t)((debug
>> 12) & 0x0F) + 1;
2385 aarch64
->brp_num_context
= (uint32_t)((debug
>> 28) & 0x0F) + 1;
2386 aarch64
->brp_num_available
= aarch64
->brp_num
;
2387 aarch64
->brp_list
= calloc(aarch64
->brp_num
, sizeof(struct aarch64_brp
));
2388 for (i
= 0; i
< aarch64
->brp_num
; i
++) {
2389 aarch64
->brp_list
[i
].used
= 0;
2390 if (i
< (aarch64
->brp_num
-aarch64
->brp_num_context
))
2391 aarch64
->brp_list
[i
].type
= BRP_NORMAL
;
2393 aarch64
->brp_list
[i
].type
= BRP_CONTEXT
;
2394 aarch64
->brp_list
[i
].value
= 0;
2395 aarch64
->brp_list
[i
].control
= 0;
2396 aarch64
->brp_list
[i
].BRPn
= i
;
2399 LOG_DEBUG("Configured %i hw breakpoints", aarch64
->brp_num
);
2401 target_set_examined(target
);
2405 static int aarch64_examine(struct target
*target
)
2407 int retval
= ERROR_OK
;
2409 /* don't re-probe hardware after each reset */
2410 if (!target_was_examined(target
))
2411 retval
= aarch64_examine_first(target
);
2413 /* Configure core debug access */
2414 if (retval
== ERROR_OK
)
2415 retval
= aarch64_init_debug_access(target
);
2421 * Cortex-A8 target creation and initialization
2424 static int aarch64_init_target(struct command_context
*cmd_ctx
,
2425 struct target
*target
)
2427 /* examine_first() does a bunch of this */
2431 static int aarch64_init_arch_info(struct target
*target
,
2432 struct aarch64_common
*aarch64
, struct jtag_tap
*tap
)
2434 struct armv8_common
*armv8
= &aarch64
->armv8_common
;
2435 struct adiv5_dap
*dap
= armv8
->arm
.dap
;
2437 armv8
->arm
.dap
= dap
;
2439 /* Setup struct aarch64_common */
2440 aarch64
->common_magic
= AARCH64_COMMON_MAGIC
;
2441 /* tap has no dap initialized */
2443 tap
->dap
= dap_init();
2445 /* Leave (only) generic DAP stuff for debugport_init() */
2446 tap
->dap
->tap
= tap
;
2449 armv8
->arm
.dap
= tap
->dap
;
2451 aarch64
->fast_reg_read
= 0;
2453 /* register arch-specific functions */
2454 armv8
->examine_debug_reason
= NULL
;
2456 armv8
->post_debug_entry
= aarch64_post_debug_entry
;
2458 armv8
->pre_restore_context
= NULL
;
2460 armv8
->armv8_mmu
.read_physical_memory
= aarch64_read_phys_memory
;
2462 /* REVISIT v7a setup should be in a v7a-specific routine */
2463 armv8_init_arch_info(target
, armv8
);
2464 target_register_timer_callback(aarch64_handle_target_request
, 1, 1, target
);
2469 static int aarch64_target_create(struct target
*target
, Jim_Interp
*interp
)
2471 struct aarch64_common
*aarch64
= calloc(1, sizeof(struct aarch64_common
));
2473 return aarch64_init_arch_info(target
, aarch64
, target
->tap
);
2476 static int aarch64_mmu(struct target
*target
, int *enabled
)
2478 if (target
->state
!= TARGET_HALTED
) {
2479 LOG_ERROR("%s: target not halted", __func__
);
2480 return ERROR_TARGET_INVALID
;
2483 *enabled
= target_to_aarch64(target
)->armv8_common
.armv8_mmu
.mmu_enabled
;
2487 static int aarch64_virt2phys(struct target
*target
, target_addr_t virt
,
2488 target_addr_t
*phys
)
2490 return armv8_mmu_translate_va(target
, virt
, phys
);
2493 COMMAND_HANDLER(aarch64_handle_cache_info_command
)
2495 struct target
*target
= get_current_target(CMD_CTX
);
2496 struct armv8_common
*armv8
= target_to_armv8(target
);
2498 return armv8_handle_cache_info_command(CMD_CTX
,
2499 &armv8
->armv8_mmu
.armv8_cache
);
2503 COMMAND_HANDLER(aarch64_handle_dbginit_command
)
2505 struct target
*target
= get_current_target(CMD_CTX
);
2506 if (!target_was_examined(target
)) {
2507 LOG_ERROR("target not examined yet");
2511 return aarch64_init_debug_access(target
);
2513 COMMAND_HANDLER(aarch64_handle_smp_off_command
)
2515 struct target
*target
= get_current_target(CMD_CTX
);
2516 /* check target is an smp target */
2517 struct target_list
*head
;
2518 struct target
*curr
;
2519 head
= target
->head
;
2521 if (head
!= (struct target_list
*)NULL
) {
2522 while (head
!= (struct target_list
*)NULL
) {
2523 curr
= head
->target
;
2527 /* fixes the target display to the debugger */
2528 target
->gdb_service
->target
= target
;
2533 COMMAND_HANDLER(aarch64_handle_smp_on_command
)
2535 struct target
*target
= get_current_target(CMD_CTX
);
2536 struct target_list
*head
;
2537 struct target
*curr
;
2538 head
= target
->head
;
2539 if (head
!= (struct target_list
*)NULL
) {
2541 while (head
!= (struct target_list
*)NULL
) {
2542 curr
= head
->target
;
2550 COMMAND_HANDLER(aarch64_handle_smp_gdb_command
)
2552 struct target
*target
= get_current_target(CMD_CTX
);
2553 int retval
= ERROR_OK
;
2554 struct target_list
*head
;
2555 head
= target
->head
;
2556 if (head
!= (struct target_list
*)NULL
) {
2557 if (CMD_ARGC
== 1) {
2559 COMMAND_PARSE_NUMBER(int, CMD_ARGV
[0], coreid
);
2560 if (ERROR_OK
!= retval
)
2562 target
->gdb_service
->core
[1] = coreid
;
2565 command_print(CMD_CTX
, "gdb coreid %" PRId32
" -> %" PRId32
, target
->gdb_service
->core
[0]
2566 , target
->gdb_service
->core
[1]);
2571 static const struct command_registration aarch64_exec_command_handlers
[] = {
2573 .name
= "cache_info",
2574 .handler
= aarch64_handle_cache_info_command
,
2575 .mode
= COMMAND_EXEC
,
2576 .help
= "display information about target caches",
2581 .handler
= aarch64_handle_dbginit_command
,
2582 .mode
= COMMAND_EXEC
,
2583 .help
= "Initialize core debug",
2586 { .name
= "smp_off",
2587 .handler
= aarch64_handle_smp_off_command
,
2588 .mode
= COMMAND_EXEC
,
2589 .help
= "Stop smp handling",
2594 .handler
= aarch64_handle_smp_on_command
,
2595 .mode
= COMMAND_EXEC
,
2596 .help
= "Restart smp handling",
2601 .handler
= aarch64_handle_smp_gdb_command
,
2602 .mode
= COMMAND_EXEC
,
2603 .help
= "display/fix current core played to gdb",
2608 COMMAND_REGISTRATION_DONE
2610 static const struct command_registration aarch64_command_handlers
[] = {
2612 .chain
= arm_command_handlers
,
2615 .chain
= armv8_command_handlers
,
2619 .mode
= COMMAND_ANY
,
2620 .help
= "Cortex-A command group",
2622 .chain
= aarch64_exec_command_handlers
,
2624 COMMAND_REGISTRATION_DONE
2627 struct target_type aarch64_target
= {
2630 .poll
= aarch64_poll
,
2631 .arch_state
= armv8_arch_state
,
2633 .halt
= aarch64_halt
,
2634 .resume
= aarch64_resume
,
2635 .step
= aarch64_step
,
2637 .assert_reset
= aarch64_assert_reset
,
2638 .deassert_reset
= aarch64_deassert_reset
,
2640 /* REVISIT allow exporting VFP3 registers ... */
2641 .get_gdb_reg_list
= armv8_get_gdb_reg_list
,
2643 .read_memory
= aarch64_read_memory
,
2644 .write_memory
= aarch64_write_memory
,
2646 .checksum_memory
= arm_checksum_memory
,
2647 .blank_check_memory
= arm_blank_check_memory
,
2649 .run_algorithm
= armv4_5_run_algorithm
,
2651 .add_breakpoint
= aarch64_add_breakpoint
,
2652 .add_context_breakpoint
= aarch64_add_context_breakpoint
,
2653 .add_hybrid_breakpoint
= aarch64_add_hybrid_breakpoint
,
2654 .remove_breakpoint
= aarch64_remove_breakpoint
,
2655 .add_watchpoint
= NULL
,
2656 .remove_watchpoint
= NULL
,
2658 .commands
= aarch64_command_handlers
,
2659 .target_create
= aarch64_target_create
,
2660 .init_target
= aarch64_init_target
,
2661 .examine
= aarch64_examine
,
2663 .read_phys_memory
= aarch64_read_phys_memory
,
2664 .write_phys_memory
= aarch64_write_phys_memory
,
2666 .virt2phys
= aarch64_virt2phys
,
Linking to existing account procedure
If you already have an account and want to add another login method
you
MUST first sign in with your existing account and
then change URL to read
https://review.openocd.org/login/?link
to get to this page again but this time it'll work for linking. Thank you.
SSH host keys fingerprints
1024 SHA256:YKx8b7u5ZWdcbp7/4AeXNaqElP49m6QrwfXaqQGJAOk gerrit-code-review@openocd.zylin.com (DSA)
384 SHA256:jHIbSQa4REvwCFG4cq5LBlBLxmxSqelQPem/EXIrxjk gerrit-code-review@openocd.org (ECDSA)
521 SHA256:UAOPYkU9Fjtcao0Ul/Rrlnj/OsQvt+pgdYSZ4jOYdgs gerrit-code-review@openocd.org (ECDSA)
256 SHA256:A13M5QlnozFOvTllybRZH6vm7iSt0XLxbA48yfc2yfY gerrit-code-review@openocd.org (ECDSA)
256 SHA256:spYMBqEYoAOtK7yZBrcwE8ZpYt6b68Cfh9yEVetvbXg gerrit-code-review@openocd.org (ED25519)
+--[ED25519 256]--+
|=.. |
|+o.. . |
|*.o . . |
|+B . . . |
|Bo. = o S |
|Oo.+ + = |
|oB=.* = . o |
| =+=.+ + E |
|. .=o . o |
+----[SHA256]-----+
2048 SHA256:0Onrb7/PHjpo6iVZ7xQX2riKN83FJ3KGU0TvI0TaFG4 gerrit-code-review@openocd.zylin.com (RSA)