1 /***************************************************************************
2 * Copyright (C) 2008 digenius technology GmbH. *
5 * Copyright (C) 2008,2009 Oyvind Harboe oyvind.harboe@zylin.com *
7 * Copyright (C) 2008 Georg Acher <acher@in.tum.de> *
9 * This program is free software; you can redistribute it and/or modify *
10 * it under the terms of the GNU General Public License as published by *
11 * the Free Software Foundation; either version 2 of the License, or *
12 * (at your option) any later version. *
14 * This program is distributed in the hope that it will be useful, *
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
17 * GNU General Public License for more details. *
19 * You should have received a copy of the GNU General Public License *
20 * along with this program; if not, write to the *
21 * Free Software Foundation, Inc., *
22 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
23 ***************************************************************************/
30 #include "breakpoints.h"
31 #include "arm11_dbgtap.h"
32 #include "arm_simulator.h"
33 #include "time_support.h"
34 #include "target_type.h"
35 #include "algorithm.h"
40 #define _DEBUG_INSTRUCTION_EXECUTION_
43 static bool arm11_config_memwrite_burst
= true;
44 static bool arm11_config_memwrite_error_fatal
= true;
45 static uint32_t arm11_vcr
= 0;
46 static bool arm11_config_step_irq_enable
= false;
47 static bool arm11_config_hardware_step
= false;
62 enum arm11_regtype type
;
65 /* update arm11_regcache_ids when changing this */
66 static const struct arm11_reg_defs arm11_reg_defs
[] =
69 {"dscr", 0, -1, ARM11_REGISTER_DSCR
},
70 {"wdtr", 0, -1, ARM11_REGISTER_WDTR
},
73 enum arm11_regcache_ids
81 static int arm11_step(struct target
*target
, int current
,
82 uint32_t address
, int handle_breakpoints
);
84 static int arm11_build_reg_cache(struct target
*target
);
85 static int arm11_set_reg(struct reg
*reg
, uint8_t *buf
);
86 static int arm11_get_reg(struct reg
*reg
);
89 /** Check and if necessary take control of the system
91 * \param arm11 Target state variable.
92 * \param dscr If the current DSCR content is
93 * available a pointer to a word holding the
94 * DSCR can be passed. Otherwise use NULL.
96 static int arm11_check_init(struct arm11_common
*arm11
, uint32_t *dscr
)
98 uint32_t dscr_local_tmp_copy
;
102 dscr
= &dscr_local_tmp_copy
;
104 CHECK_RETVAL(arm11_read_DSCR(arm11
, dscr
));
107 if (!(*dscr
& ARM11_DSCR_MODE_SELECT
))
109 LOG_DEBUG("Bringing target into debug mode");
111 *dscr
|= ARM11_DSCR_MODE_SELECT
; /* Halt debug-mode */
112 arm11_write_DSCR(arm11
, *dscr
);
114 /* add further reset initialization here */
116 arm11
->simulate_reset_on_next_halt
= true;
118 if (*dscr
& ARM11_DSCR_CORE_HALTED
)
120 /** \todo TODO: this needs further scrutiny because
121 * arm11_debug_entry() never gets called. (WHY NOT?)
122 * As a result we don't read the actual register states from
126 arm11
->arm
.target
->state
= TARGET_HALTED
;
127 arm11
->arm
.target
->debug_reason
=
128 arm11_get_DSCR_debug_reason(*dscr
);
132 arm11
->arm
.target
->state
= TARGET_RUNNING
;
133 arm11
->arm
.target
->debug_reason
= DBG_REASON_NOTHALTED
;
136 arm11_sc7_clear_vbw(arm11
);
145 (arm11->reg_values[ARM11_RC_##x])
148 * Save processor state. This is called after a HALT instruction
149 * succeeds, and on other occasions the processor enters debug mode
150 * (breakpoint, watchpoint, etc).
152 static int arm11_debug_entry(struct arm11_common
*arm11
, uint32_t dscr
)
156 arm11
->arm
.target
->state
= TARGET_HALTED
;
157 arm11
->arm
.target
->debug_reason
= arm11_get_DSCR_debug_reason(dscr
);
159 /* REVISIT entire cache should already be invalid !!! */
160 register_cache_invalidate(arm11
->arm
.core_cache
);
162 for (size_t i
= 0; i
< ARRAY_SIZE(arm11
->reg_values
); i
++)
164 arm11
->reg_list
[i
].valid
= 1;
165 arm11
->reg_list
[i
].dirty
= 0;
168 /* See e.g. ARM1136 TRM, "14.8.4 Entering Debug state" */
175 if (dscr
& ARM11_DSCR_WDTR_FULL
)
177 arm11_add_debug_SCAN_N(arm11
, 0x05, ARM11_TAP_DEFAULT
);
179 arm11_add_IR(arm11
, ARM11_INTEST
, ARM11_TAP_DEFAULT
);
181 struct scan_field chain5_fields
[3];
183 arm11_setup_field(arm11
, 32, NULL
, &R(WDTR
), chain5_fields
+ 0);
184 arm11_setup_field(arm11
, 1, NULL
, NULL
, chain5_fields
+ 1);
185 arm11_setup_field(arm11
, 1, NULL
, NULL
, chain5_fields
+ 2);
187 arm11_add_dr_scan_vc(ARRAY_SIZE(chain5_fields
), chain5_fields
, TAP_DRPAUSE
);
191 arm11
->reg_list
[ARM11_RC_WDTR
].valid
= 0;
195 /* DSCR: set ARM11_DSCR_EXECUTE_ARM_INSTRUCTION_ENABLE
197 * ARM1176 spec says this is needed only for wDTR/rDTR's "ITR mode",
198 * but not to issue ITRs. ARM1136 seems to require this to issue
201 uint32_t new_dscr
= dscr
| ARM11_DSCR_EXECUTE_ARM_INSTRUCTION_ENABLE
;
203 /* this executes JTAG queue: */
205 arm11_write_DSCR(arm11
, new_dscr
);
209 Before executing any instruction in debug state you have to drain the write buffer.
210 This ensures that no imprecise Data Aborts can return at a later point:*/
212 /** \todo TODO: Test drain write buffer. */
217 /* MRC p14,0,R0,c5,c10,0 */
218 // arm11_run_instr_no_data1(arm11, /*0xee150e1a*/0xe320f000);
220 /* mcr 15, 0, r0, cr7, cr10, {4} */
221 arm11_run_instr_no_data1(arm11
, 0xee070f9a);
223 uint32_t dscr
= arm11_read_DSCR(arm11
);
225 LOG_DEBUG("DRAIN, DSCR %08x", dscr
);
227 if (dscr
& ARM11_DSCR_STICKY_IMPRECISE_DATA_ABORT
)
229 arm11_run_instr_no_data1(arm11
, 0xe320f000);
231 dscr
= arm11_read_DSCR(arm11
);
233 LOG_DEBUG("DRAIN, DSCR %08x (DONE)", dscr
);
242 * NOTE: ARM1136 TRM suggests saving just R0 here now, then
243 * CPSR and PC after the rDTR stuff. We do it all at once.
245 retval
= arm_dpm_read_current_registers(&arm11
->dpm
);
246 if (retval
!= ERROR_OK
)
247 LOG_ERROR("DPM REG READ -- fail %d", retval
);
249 retval
= arm11_run_instr_data_prepare(arm11
);
250 if (retval
!= ERROR_OK
)
253 /* maybe save rDTR */
254 arm11
->is_rdtr_saved
= !!(dscr
& ARM11_DSCR_RDTR_FULL
);
255 if (arm11
->is_rdtr_saved
)
257 /* MRC p14,0,R0,c0,c5,0 (move rDTR -> r0 (-> wDTR -> local var)) */
258 retval
= arm11_run_instr_data_from_core_via_r0(arm11
,
259 0xEE100E15, &arm11
->saved_rdtr
);
260 if (retval
!= ERROR_OK
)
264 /* REVISIT Now that we've saved core state, there's may also
265 * be MMU and cache state to care about ...
268 if (arm11
->simulate_reset_on_next_halt
)
270 arm11
->simulate_reset_on_next_halt
= false;
272 LOG_DEBUG("Reset c1 Control Register");
274 /* Write 0 (reset value) to Control register 0 to disable MMU/Cache etc. */
276 /* MCR p15,0,R0,c1,c0,0 */
277 retval
= arm11_run_instr_data_to_core_via_r0(arm11
, 0xee010f10, 0);
278 if (retval
!= ERROR_OK
)
283 retval
= arm11_run_instr_data_finish(arm11
);
284 if (retval
!= ERROR_OK
)
291 * Restore processor state. This is called in preparation for
292 * the RESTART function.
294 static int arm11_leave_debug_state(struct arm11_common
*arm11
, bool bpwp
)
298 /* See e.g. ARM1136 TRM, "14.8.5 Leaving Debug state" */
300 /* NOTE: the ARM1136 TRM suggests restoring all registers
301 * except R0/PC/CPSR right now. Instead, we do them all
302 * at once, just a bit later on.
305 /* REVISIT once we start caring about MMU and cache state,
306 * address it here ...
309 /* spec says clear wDTR and rDTR; we assume they are clear as
310 otherwise our programming would be sloppy */
314 CHECK_RETVAL(arm11_read_DSCR(arm11
, &DSCR
));
316 if (DSCR
& (ARM11_DSCR_RDTR_FULL
| ARM11_DSCR_WDTR_FULL
))
319 The wDTR/rDTR two registers that are used to send/receive data to/from
320 the core in tandem with corresponding instruction codes that are
321 written into the core. The RDTR FULL/WDTR FULL flag indicates that the
322 registers hold data that was written by one side (CPU or JTAG) and not
323 read out by the other side.
325 LOG_ERROR("wDTR/rDTR inconsistent (DSCR %08" PRIx32
")", DSCR
);
330 /* maybe restore original wDTR */
331 if ((R(DSCR
) & ARM11_DSCR_WDTR_FULL
) || arm11
->reg_list
[ARM11_RC_WDTR
].dirty
)
333 retval
= arm11_run_instr_data_prepare(arm11
);
334 if (retval
!= ERROR_OK
)
337 /* MCR p14,0,R0,c0,c5,0 */
338 retval
= arm11_run_instr_data_to_core_via_r0(arm11
, 0xee000e15, R(WDTR
));
339 if (retval
!= ERROR_OK
)
342 retval
= arm11_run_instr_data_finish(arm11
);
343 if (retval
!= ERROR_OK
)
347 /* restore CPSR, PC, and R0 ... after flushing any modified
350 retval
= arm_dpm_write_dirty_registers(&arm11
->dpm
, bpwp
);
352 register_cache_invalidate(arm11
->arm
.core_cache
);
356 arm11_write_DSCR(arm11
, R(DSCR
));
358 /* maybe restore rDTR */
360 if (arm11
->is_rdtr_saved
)
362 arm11_add_debug_SCAN_N(arm11
, 0x05, ARM11_TAP_DEFAULT
);
364 arm11_add_IR(arm11
, ARM11_EXTEST
, ARM11_TAP_DEFAULT
);
366 struct scan_field chain5_fields
[3];
368 uint8_t Ready
= 0; /* ignored */
369 uint8_t Valid
= 0; /* ignored */
371 arm11_setup_field(arm11
, 32, &arm11
->saved_rdtr
,
372 NULL
, chain5_fields
+ 0);
373 arm11_setup_field(arm11
, 1, &Ready
, NULL
, chain5_fields
+ 1);
374 arm11_setup_field(arm11
, 1, &Valid
, NULL
, chain5_fields
+ 2);
376 arm11_add_dr_scan_vc(ARRAY_SIZE(chain5_fields
), chain5_fields
, TAP_DRPAUSE
);
379 /* now processor is ready to RESTART */
384 /* poll current target status */
385 static int arm11_poll(struct target
*target
)
388 struct arm11_common
*arm11
= target_to_arm11(target
);
391 CHECK_RETVAL(arm11_read_DSCR(arm11
, &dscr
));
393 LOG_DEBUG("DSCR %08" PRIx32
"", dscr
);
395 CHECK_RETVAL(arm11_check_init(arm11
, &dscr
));
397 if (dscr
& ARM11_DSCR_CORE_HALTED
)
399 if (target
->state
!= TARGET_HALTED
)
401 enum target_state old_state
= target
->state
;
403 LOG_DEBUG("enter TARGET_HALTED");
404 retval
= arm11_debug_entry(arm11
, dscr
);
405 if (retval
!= ERROR_OK
)
408 target_call_event_callbacks(target
,
409 old_state
== TARGET_DEBUG_RUNNING
? TARGET_EVENT_DEBUG_HALTED
: TARGET_EVENT_HALTED
);
414 if (target
->state
!= TARGET_RUNNING
&& target
->state
!= TARGET_DEBUG_RUNNING
)
416 LOG_DEBUG("enter TARGET_RUNNING");
417 target
->state
= TARGET_RUNNING
;
418 target
->debug_reason
= DBG_REASON_NOTHALTED
;
424 /* architecture specific status reply */
425 static int arm11_arch_state(struct target
*target
)
429 retval
= armv4_5_arch_state(target
);
431 /* REVISIT also display ARM11-specific MMU and cache status ... */
436 /* target request support */
437 static int arm11_target_request_data(struct target
*target
,
438 uint32_t size
, uint8_t *buffer
)
440 LOG_WARNING("Not implemented: %s", __func__
);
445 /* target execution control */
446 static int arm11_halt(struct target
*target
)
448 struct arm11_common
*arm11
= target_to_arm11(target
);
450 LOG_DEBUG("target->state: %s",
451 target_state_name(target
));
453 if (target
->state
== TARGET_UNKNOWN
)
455 arm11
->simulate_reset_on_next_halt
= true;
458 if (target
->state
== TARGET_HALTED
)
460 LOG_DEBUG("target was already halted");
464 arm11_add_IR(arm11
, ARM11_HALT
, TAP_IDLE
);
466 CHECK_RETVAL(jtag_execute_queue());
473 CHECK_RETVAL(arm11_read_DSCR(arm11
, &dscr
));
475 if (dscr
& ARM11_DSCR_CORE_HALTED
)
486 if ((timeval_ms()-then
) > 1000)
488 LOG_WARNING("Timeout (1000ms) waiting for instructions to complete");
495 enum target_state old_state
= target
->state
;
497 arm11_debug_entry(arm11
, dscr
);
500 target_call_event_callbacks(target
,
501 old_state
== TARGET_DEBUG_RUNNING
? TARGET_EVENT_DEBUG_HALTED
: TARGET_EVENT_HALTED
));
507 arm11_nextpc(struct arm11_common
*arm11
, int current
, uint32_t address
)
509 void *value
= arm11
->arm
.core_cache
->reg_list
[15].value
;
512 buf_set_u32(value
, 0, 32, address
);
514 address
= buf_get_u32(value
, 0, 32);
519 static int arm11_resume(struct target
*target
, int current
,
520 uint32_t address
, int handle_breakpoints
, int debug_execution
)
522 // LOG_DEBUG("current %d address %08x handle_breakpoints %d debug_execution %d",
523 // current, address, handle_breakpoints, debug_execution);
525 struct arm11_common
*arm11
= target_to_arm11(target
);
527 LOG_DEBUG("target->state: %s",
528 target_state_name(target
));
531 if (target
->state
!= TARGET_HALTED
)
533 LOG_ERROR("Target not halted");
534 return ERROR_TARGET_NOT_HALTED
;
537 address
= arm11_nextpc(arm11
, current
, address
);
539 LOG_DEBUG("RESUME PC %08" PRIx32
"%s", address
, !current
? "!" : "");
541 /* clear breakpoints/watchpoints and VCR*/
542 arm11_sc7_clear_vbw(arm11
);
544 if (!debug_execution
)
545 target_free_all_working_areas(target
);
547 /* Set up breakpoints */
548 if (handle_breakpoints
)
550 /* check if one matches PC and step over it if necessary */
552 struct breakpoint
* bp
;
554 for (bp
= target
->breakpoints
; bp
; bp
= bp
->next
)
556 if (bp
->address
== address
)
558 LOG_DEBUG("must step over %08" PRIx32
"", bp
->address
);
559 arm11_step(target
, 1, 0, 0);
564 /* set all breakpoints */
566 unsigned brp_num
= 0;
568 for (bp
= target
->breakpoints
; bp
; bp
= bp
->next
)
570 struct arm11_sc7_action brp
[2];
573 brp
[0].address
= ARM11_SC7_BVR0
+ brp_num
;
574 brp
[0].value
= bp
->address
;
576 brp
[1].address
= ARM11_SC7_BCR0
+ brp_num
;
577 brp
[1].value
= 0x1 | (3 << 1) | (0x0F << 5) | (0 << 14) | (0 << 16) | (0 << 20) | (0 << 21);
579 arm11_sc7_run(arm11
, brp
, ARRAY_SIZE(brp
));
581 LOG_DEBUG("Add BP %d at %08" PRIx32
, brp_num
,
587 arm11_sc7_set_vcr(arm11
, arm11_vcr
);
590 arm11_leave_debug_state(arm11
, handle_breakpoints
);
592 arm11_add_IR(arm11
, ARM11_RESTART
, TAP_IDLE
);
594 CHECK_RETVAL(jtag_execute_queue());
601 CHECK_RETVAL(arm11_read_DSCR(arm11
, &dscr
));
603 LOG_DEBUG("DSCR %08" PRIx32
"", dscr
);
605 if (dscr
& ARM11_DSCR_CORE_RESTARTED
)
616 if ((timeval_ms()-then
) > 1000)
618 LOG_WARNING("Timeout (1000ms) waiting for instructions to complete");
625 if (!debug_execution
)
627 target
->state
= TARGET_RUNNING
;
628 target
->debug_reason
= DBG_REASON_NOTHALTED
;
630 CHECK_RETVAL(target_call_event_callbacks(target
, TARGET_EVENT_RESUMED
));
634 target
->state
= TARGET_DEBUG_RUNNING
;
635 target
->debug_reason
= DBG_REASON_NOTHALTED
;
637 CHECK_RETVAL(target_call_event_callbacks(target
, TARGET_EVENT_RESUMED
));
643 static int arm11_step(struct target
*target
, int current
,
644 uint32_t address
, int handle_breakpoints
)
646 LOG_DEBUG("target->state: %s",
647 target_state_name(target
));
649 if (target
->state
!= TARGET_HALTED
)
651 LOG_WARNING("target was not halted");
652 return ERROR_TARGET_NOT_HALTED
;
655 struct arm11_common
*arm11
= target_to_arm11(target
);
657 address
= arm11_nextpc(arm11
, current
, address
);
659 LOG_DEBUG("STEP PC %08" PRIx32
"%s", address
, !current
? "!" : "");
662 /** \todo TODO: Thumb not supported here */
664 uint32_t next_instruction
;
666 CHECK_RETVAL(arm11_read_memory_word(arm11
, address
, &next_instruction
));
669 if ((next_instruction
& 0xFFF00070) == 0xe1200070)
671 address
= arm11_nextpc(arm11
, 0, address
+ 4);
672 LOG_DEBUG("Skipping BKPT");
674 /* skip over Wait for interrupt / Standby */
675 /* mcr 15, 0, r?, cr7, cr0, {4} */
676 else if ((next_instruction
& 0xFFFF0FFF) == 0xee070f90)
678 address
= arm11_nextpc(arm11
, 0, address
+ 4);
679 LOG_DEBUG("Skipping WFI");
681 /* ignore B to self */
682 else if ((next_instruction
& 0xFEFFFFFF) == 0xeafffffe)
684 LOG_DEBUG("Not stepping jump to self");
688 /** \todo TODO: check if break-/watchpoints make any sense at all in combination
691 /** \todo TODO: check if disabling IRQs might be a good idea here. Alternatively
692 * the VCR might be something worth looking into. */
695 /* Set up breakpoint for stepping */
697 struct arm11_sc7_action brp
[2];
700 brp
[0].address
= ARM11_SC7_BVR0
;
702 brp
[1].address
= ARM11_SC7_BCR0
;
704 if (arm11_config_hardware_step
)
706 /* Hardware single stepping ("instruction address
707 * mismatch") is used if enabled. It's not quite
708 * exactly "run one instruction"; "branch to here"
709 * loops won't break, neither will some other cases,
710 * but it's probably the best default.
712 * Hardware single stepping isn't supported on v6
713 * debug modules. ARM1176 and v7 can support it...
715 * FIXME Thumb stepping likely needs to use 0x03
716 * or 0xc0 byte masks, not 0x0f.
718 brp
[0].value
= address
;
719 brp
[1].value
= 0x1 | (3 << 1) | (0x0F << 5)
720 | (0 << 14) | (0 << 16) | (0 << 20)
724 /* Sets a breakpoint on the next PC, as calculated
725 * by instruction set simulation.
727 * REVISIT stepping Thumb on ARM1156 requires Thumb2
728 * support from the simulator.
733 retval
= arm_simulate_step(target
, &next_pc
);
734 if (retval
!= ERROR_OK
)
737 brp
[0].value
= next_pc
;
738 brp
[1].value
= 0x1 | (3 << 1) | (0x0F << 5)
739 | (0 << 14) | (0 << 16) | (0 << 20)
743 CHECK_RETVAL(arm11_sc7_run(arm11
, brp
, ARRAY_SIZE(brp
)));
748 if (arm11_config_step_irq_enable
)
749 R(DSCR
) &= ~ARM11_DSCR_INTERRUPTS_DISABLE
; /* should be redundant */
751 R(DSCR
) |= ARM11_DSCR_INTERRUPTS_DISABLE
;
754 CHECK_RETVAL(arm11_leave_debug_state(arm11
, handle_breakpoints
));
756 arm11_add_IR(arm11
, ARM11_RESTART
, TAP_IDLE
);
758 CHECK_RETVAL(jtag_execute_queue());
766 CHECK_RETVAL(arm11_read_DSCR(arm11
, &dscr
));
768 LOG_DEBUG("DSCR %08" PRIx32
"e", dscr
);
770 if ((dscr
& (ARM11_DSCR_CORE_RESTARTED
| ARM11_DSCR_CORE_HALTED
)) ==
771 (ARM11_DSCR_CORE_RESTARTED
| ARM11_DSCR_CORE_HALTED
))
781 if ((timeval_ms()-then
) > 1000)
783 LOG_WARNING("Timeout (1000ms) waiting for instructions to complete");
790 /* clear breakpoint */
791 arm11_sc7_clear_vbw(arm11
);
794 CHECK_RETVAL(arm11_debug_entry(arm11
, dscr
));
796 /* restore default state */
797 R(DSCR
) &= ~ARM11_DSCR_INTERRUPTS_DISABLE
;
801 target
->debug_reason
= DBG_REASON_SINGLESTEP
;
803 CHECK_RETVAL(target_call_event_callbacks(target
, TARGET_EVENT_HALTED
));
808 static int arm11_assert_reset(struct target
*target
)
811 struct arm11_common
*arm11
= target_to_arm11(target
);
813 retval
= arm11_check_init(arm11
, NULL
);
814 if (retval
!= ERROR_OK
)
817 target
->state
= TARGET_UNKNOWN
;
819 /* we would very much like to reset into the halted, state,
820 * but resetting and halting is second best... */
821 if (target
->reset_halt
)
823 CHECK_RETVAL(target_halt(target
));
827 /* srst is funny. We can not do *anything* else while it's asserted
828 * and it has unkonwn side effects. Make sure no other code runs
831 * Code below assumes srst:
833 * - Causes power-on-reset (but of what parts of the system?). Bug
836 * - Messes us TAP state without asserting trst.
838 * - There is another bug in the arm11 core. When you generate an access to
839 * external logic (for example ddr controller via AHB bus) and that block
840 * is not configured (perhaps it is still held in reset), that transaction
841 * will never complete. This will hang arm11 core but it will also hang
842 * JTAG controller. Nothing, short of srst assertion will bring it out of
847 * - What should the PC be after an srst reset when starting in the halted
851 jtag_add_reset(0, 1);
852 jtag_add_reset(0, 0);
854 /* How long do we have to wait? */
855 jtag_add_sleep(5000);
857 /* un-mess up TAP state */
860 retval
= jtag_execute_queue();
861 if (retval
!= ERROR_OK
)
869 static int arm11_deassert_reset(struct target
*target
)
874 static int arm11_soft_reset_halt(struct target
*target
)
876 LOG_WARNING("Not implemented: %s", __func__
);
881 /* target memory access
882 * size: 1 = byte (8bit), 2 = half-word (16bit), 4 = word (32bit)
883 * count: number of items of <size>
885 * arm11_config_memrw_no_increment - in the future we may want to be able
886 * to read/write a range of data to a "port". a "port" is an action on
887 * read memory address for some peripheral.
889 static int arm11_read_memory_inner(struct target
*target
,
890 uint32_t address
, uint32_t size
, uint32_t count
, uint8_t *buffer
,
891 bool arm11_config_memrw_no_increment
)
893 /** \todo TODO: check if buffer cast to uint32_t* and uint16_t* might cause alignment problems */
896 if (target
->state
!= TARGET_HALTED
)
898 LOG_WARNING("target was not halted");
899 return ERROR_TARGET_NOT_HALTED
;
902 LOG_DEBUG("ADDR %08" PRIx32
" SIZE %08" PRIx32
" COUNT %08" PRIx32
"", address
, size
, count
);
904 struct arm11_common
*arm11
= target_to_arm11(target
);
906 retval
= arm11_run_instr_data_prepare(arm11
);
907 if (retval
!= ERROR_OK
)
910 /* MRC p14,0,r0,c0,c5,0 */
911 retval
= arm11_run_instr_data_to_core1(arm11
, 0xee100e15, address
);
912 if (retval
!= ERROR_OK
)
918 arm11
->arm
.core_cache
->reg_list
[1].dirty
= true;
920 for (size_t i
= 0; i
< count
; i
++)
922 /* ldrb r1, [r0], #1 */
924 arm11_run_instr_no_data1(arm11
,
925 !arm11_config_memrw_no_increment
? 0xe4d01001 : 0xe5d01000);
928 /* MCR p14,0,R1,c0,c5,0 */
929 arm11_run_instr_data_from_core(arm11
, 0xEE001E15, &res
, 1);
938 arm11
->arm
.core_cache
->reg_list
[1].dirty
= true;
940 for (size_t i
= 0; i
< count
; i
++)
942 /* ldrh r1, [r0], #2 */
943 arm11_run_instr_no_data1(arm11
,
944 !arm11_config_memrw_no_increment
? 0xe0d010b2 : 0xe1d010b0);
948 /* MCR p14,0,R1,c0,c5,0 */
949 arm11_run_instr_data_from_core(arm11
, 0xEE001E15, &res
, 1);
951 uint16_t svalue
= res
;
952 memcpy(buffer
+ i
* sizeof(uint16_t), &svalue
, sizeof(uint16_t));
960 uint32_t instr
= !arm11_config_memrw_no_increment
? 0xecb05e01 : 0xed905e00;
961 /** \todo TODO: buffer cast to uint32_t* causes alignment warnings */
962 uint32_t *words
= (uint32_t *)buffer
;
964 /* LDC p14,c5,[R0],#4 */
965 /* LDC p14,c5,[R0] */
966 arm11_run_instr_data_from_core(arm11
, instr
, words
, count
);
971 return arm11_run_instr_data_finish(arm11
);
974 static int arm11_read_memory(struct target
*target
, uint32_t address
, uint32_t size
, uint32_t count
, uint8_t *buffer
)
976 return arm11_read_memory_inner(target
, address
, size
, count
, buffer
, false);
980 * no_increment - in the future we may want to be able
981 * to read/write a range of data to a "port". a "port" is an action on
982 * read memory address for some peripheral.
984 static int arm11_write_memory_inner(struct target
*target
,
985 uint32_t address
, uint32_t size
,
986 uint32_t count
, uint8_t *buffer
,
991 if (target
->state
!= TARGET_HALTED
)
993 LOG_WARNING("target was not halted");
994 return ERROR_TARGET_NOT_HALTED
;
997 LOG_DEBUG("ADDR %08" PRIx32
" SIZE %08" PRIx32
" COUNT %08" PRIx32
"", address
, size
, count
);
999 struct arm11_common
*arm11
= target_to_arm11(target
);
1001 retval
= arm11_run_instr_data_prepare(arm11
);
1002 if (retval
!= ERROR_OK
)
1005 /* MRC p14,0,r0,c0,c5,0 */
1006 retval
= arm11_run_instr_data_to_core1(arm11
, 0xee100e15, address
);
1007 if (retval
!= ERROR_OK
)
1010 /* burst writes are not used for single words as those may well be
1011 * reset init script writes.
1013 * The other advantage is that as burst writes are default, we'll
1014 * now exercise both burst and non-burst code paths with the
1015 * default settings, increasing code coverage.
1017 bool burst
= arm11_config_memwrite_burst
&& (count
> 1);
1023 arm11
->arm
.core_cache
->reg_list
[1].dirty
= true;
1025 for (size_t i
= 0; i
< count
; i
++)
1027 /* MRC p14,0,r1,c0,c5,0 */
1028 retval
= arm11_run_instr_data_to_core1(arm11
, 0xee101e15, *buffer
++);
1029 if (retval
!= ERROR_OK
)
1032 /* strb r1, [r0], #1 */
1034 retval
= arm11_run_instr_no_data1(arm11
,
1038 if (retval
!= ERROR_OK
)
1047 arm11
->arm
.core_cache
->reg_list
[1].dirty
= true;
1049 for (size_t i
= 0; i
< count
; i
++)
1052 memcpy(&value
, buffer
+ i
* sizeof(uint16_t), sizeof(uint16_t));
1054 /* MRC p14,0,r1,c0,c5,0 */
1055 retval
= arm11_run_instr_data_to_core1(arm11
, 0xee101e15, value
);
1056 if (retval
!= ERROR_OK
)
1059 /* strh r1, [r0], #2 */
1061 retval
= arm11_run_instr_no_data1(arm11
,
1065 if (retval
!= ERROR_OK
)
1073 uint32_t instr
= !no_increment
? 0xeca05e01 : 0xed805e00;
1075 /** \todo TODO: buffer cast to uint32_t* causes alignment warnings */
1076 uint32_t *words
= (uint32_t*)buffer
;
1080 /* STC p14,c5,[R0],#4 */
1081 /* STC p14,c5,[R0]*/
1082 retval
= arm11_run_instr_data_to_core(arm11
, instr
, words
, count
);
1083 if (retval
!= ERROR_OK
)
1088 /* STC p14,c5,[R0],#4 */
1089 /* STC p14,c5,[R0]*/
1090 retval
= arm11_run_instr_data_to_core_noack(arm11
, instr
, words
, count
);
1091 if (retval
!= ERROR_OK
)
1099 /* r0 verification */
1104 /* MCR p14,0,R0,c0,c5,0 */
1105 retval
= arm11_run_instr_data_from_core(arm11
, 0xEE000E15, &r0
, 1);
1106 if (retval
!= ERROR_OK
)
1109 if (address
+ size
* count
!= r0
)
1111 LOG_ERROR("Data transfer failed. Expected end "
1112 "address 0x%08x, got 0x%08x",
1113 (unsigned) (address
+ size
* count
),
1117 LOG_ERROR("use 'arm11 memwrite burst disable' to disable fast burst mode");
1119 if (arm11_config_memwrite_error_fatal
)
1124 return arm11_run_instr_data_finish(arm11
);
1127 static int arm11_write_memory(struct target
*target
,
1128 uint32_t address
, uint32_t size
,
1129 uint32_t count
, uint8_t *buffer
)
1131 /* pointer increment matters only for multi-unit writes ...
1132 * not e.g. to a "reset the chip" controller.
1134 return arm11_write_memory_inner(target
, address
, size
,
1135 count
, buffer
, count
== 1);
1138 /* write target memory in multiples of 4 byte, optimized for writing large quantities of data */
1139 static int arm11_bulk_write_memory(struct target
*target
,
1140 uint32_t address
, uint32_t count
, uint8_t *buffer
)
1142 if (target
->state
!= TARGET_HALTED
)
1144 LOG_WARNING("target was not halted");
1145 return ERROR_TARGET_NOT_HALTED
;
1148 return arm11_write_memory(target
, address
, 4, count
, buffer
);
1151 /* target break-/watchpoint control
1152 * rw: 0 = write, 1 = read, 2 = access
1154 static int arm11_add_breakpoint(struct target
*target
,
1155 struct breakpoint
*breakpoint
)
1157 struct arm11_common
*arm11
= target_to_arm11(target
);
1160 if (breakpoint
->type
== BKPT_SOFT
)
1162 LOG_INFO("sw breakpoint requested, but software breakpoints not enabled");
1163 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
1167 if (!arm11
->free_brps
)
1169 LOG_DEBUG("no breakpoint unit available for hardware breakpoint");
1170 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
1173 if (breakpoint
->length
!= 4)
1175 LOG_DEBUG("only breakpoints of four bytes length supported");
1176 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
1184 static int arm11_remove_breakpoint(struct target
*target
,
1185 struct breakpoint
*breakpoint
)
1187 struct arm11_common
*arm11
= target_to_arm11(target
);
1194 static int arm11_target_create(struct target
*target
, Jim_Interp
*interp
)
1196 struct arm11_common
*arm11
;
1198 if (target
->tap
== NULL
)
1201 if (target
->tap
->ir_length
!= 5)
1203 LOG_ERROR("'target arm11' expects IR LENGTH = 5");
1204 return ERROR_COMMAND_SYNTAX_ERROR
;
1207 arm11
= calloc(1, sizeof *arm11
);
1211 armv4_5_init_arch_info(target
, &arm11
->arm
);
1213 arm11
->jtag_info
.tap
= target
->tap
;
1214 arm11
->jtag_info
.scann_size
= 5;
1215 arm11
->jtag_info
.scann_instr
= ARM11_SCAN_N
;
1216 /* cur_scan_chain == 0 */
1217 arm11
->jtag_info
.intest_instr
= ARM11_INTEST
;
1222 static int arm11_init_target(struct command_context
*cmd_ctx
,
1223 struct target
*target
)
1225 /* Initialize anything we can set up without talking to the target */
1227 /* REVISIT do we really want such a debug-registers-only cache?
1228 * If we do, it should probably be handled purely by the DPM code,
1229 * so it works identically on the v7a/v7r cores.
1231 return arm11_build_reg_cache(target
);
1234 /* talk to the target and set things up */
1235 static int arm11_examine(struct target
*target
)
1239 struct arm11_common
*arm11
= target_to_arm11(target
);
1240 uint32_t didr
, device_id
;
1241 uint8_t implementor
;
1243 /* FIXME split into do-first-time and do-every-time logic ... */
1247 arm11_add_IR(arm11
, ARM11_IDCODE
, ARM11_TAP_DEFAULT
);
1249 struct scan_field idcode_field
;
1251 arm11_setup_field(arm11
, 32, NULL
, &device_id
, &idcode_field
);
1253 arm11_add_dr_scan_vc(1, &idcode_field
, TAP_DRPAUSE
);
1257 arm11_add_debug_SCAN_N(arm11
, 0x00, ARM11_TAP_DEFAULT
);
1259 arm11_add_IR(arm11
, ARM11_INTEST
, ARM11_TAP_DEFAULT
);
1261 struct scan_field chain0_fields
[2];
1263 arm11_setup_field(arm11
, 32, NULL
, &didr
, chain0_fields
+ 0);
1264 arm11_setup_field(arm11
, 8, NULL
, &implementor
, chain0_fields
+ 1);
1266 arm11_add_dr_scan_vc(ARRAY_SIZE(chain0_fields
), chain0_fields
, TAP_IDLE
);
1268 CHECK_RETVAL(jtag_execute_queue());
1270 switch (device_id
& 0x0FFFF000)
1279 arm11
->arm
.core_type
= ARM_MODE_MON
;
1283 LOG_ERROR("'target arm11' expects IDCODE 0x*7B*7****");
1286 LOG_INFO("found %s", type
);
1288 /* unlikely this could ever fail, but ... */
1289 switch ((didr
>> 16) & 0x0F) {
1290 case ARM11_DEBUG_V6
:
1291 case ARM11_DEBUG_V61
: /* supports security extensions */
1294 LOG_ERROR("Only ARM v6 and v6.1 debug supported.");
1298 arm11
->brp
= ((didr
>> 24) & 0x0F) + 1;
1299 arm11
->wrp
= ((didr
>> 28) & 0x0F) + 1;
1301 /** \todo TODO: reserve one brp slot if we allow breakpoints during step */
1302 arm11
->free_brps
= arm11
->brp
;
1304 LOG_DEBUG("IDCODE %08" PRIx32
" IMPLEMENTOR %02x DIDR %08" PRIx32
,
1305 device_id
, implementor
, didr
);
1307 /* as a side-effect this reads DSCR and thus
1308 * clears the ARM11_DSCR_STICKY_PRECISE_DATA_ABORT / Sticky Precise Data Abort Flag
1309 * as suggested by the spec.
1312 retval
= arm11_check_init(arm11
, NULL
);
1313 if (retval
!= ERROR_OK
)
1316 /* Build register cache "late", after target_init(), since we
1317 * want to know if this core supports Secure Monitor mode.
1319 if (!target_was_examined(target
))
1320 retval
= arm11_dpm_init(arm11
, didr
);
1322 /* ETM on ARM11 still uses original scanchain 6 access mode */
1323 if (arm11
->arm
.etm
&& !target_was_examined(target
)) {
1324 *register_get_last_cache_p(&target
->reg_cache
) =
1325 etm_build_reg_cache(target
, &arm11
->jtag_info
,
1327 retval
= etm_setup(target
);
1330 target_set_examined(target
);
1336 /** Load a register that is marked !valid in the register cache */
1337 static int arm11_get_reg(struct reg
*reg
)
1339 struct arm11_reg_state
*r
= reg
->arch_info
;
1340 struct target
*target
= r
->target
;
1342 if (target
->state
!= TARGET_HALTED
)
1344 LOG_WARNING("target was not halted");
1345 return ERROR_TARGET_NOT_HALTED
;
1348 /** \todo TODO: Check this. We assume that all registers are fetched at debug entry. */
1351 struct arm11_common
*arm11
= target_to_arm11(target
);
1352 const struct arm11_reg_defs
*arm11_reg_info
= arm11_reg_defs
+ ((struct arm11_reg_state
*)reg
->arch_info
)->def_index
;
1358 /** Change a value in the register cache */
1359 static int arm11_set_reg(struct reg
*reg
, uint8_t *buf
)
1361 struct arm11_reg_state
*r
= reg
->arch_info
;
1362 struct target
*target
= r
->target
;
1363 struct arm11_common
*arm11
= target_to_arm11(target
);
1364 // const struct arm11_reg_defs *arm11_reg_info = arm11_reg_defs + ((struct arm11_reg_state *)reg->arch_info)->def_index;
1366 arm11
->reg_values
[((struct arm11_reg_state
*)reg
->arch_info
)->def_index
] = buf_get_u32(buf
, 0, 32);
1373 static const struct reg_arch_type arm11_reg_type
= {
1374 .get
= arm11_get_reg
,
1375 .set
= arm11_set_reg
,
1378 static int arm11_build_reg_cache(struct target
*target
)
1380 struct arm11_common
*arm11
= target_to_arm11(target
);
1381 struct reg_cache
*cache
;
1382 struct reg
*reg_list
;
1383 struct arm11_reg_state
*arm11_reg_states
;
1385 cache
= calloc(1, sizeof *cache
);
1386 reg_list
= calloc(ARM11_REGCACHE_COUNT
, sizeof *reg_list
);
1387 arm11_reg_states
= calloc(ARM11_REGCACHE_COUNT
,
1388 sizeof *arm11_reg_states
);
1389 if (!cache
|| !reg_list
|| !arm11_reg_states
) {
1392 free(arm11_reg_states
);
1396 arm11
->reg_list
= reg_list
;
1398 /* build cache for some of the debug registers */
1399 cache
->name
= "arm11 debug registers";
1400 cache
->reg_list
= reg_list
;
1401 cache
->num_regs
= ARM11_REGCACHE_COUNT
;
1403 struct reg_cache
**cache_p
= register_get_last_cache_p(&target
->reg_cache
);
1406 arm11
->core_cache
= cache
;
1410 /* Not very elegant assertion */
1411 if (ARM11_REGCACHE_COUNT
!= ARRAY_SIZE(arm11
->reg_values
) ||
1412 ARM11_REGCACHE_COUNT
!= ARRAY_SIZE(arm11_reg_defs
) ||
1413 ARM11_REGCACHE_COUNT
!= ARM11_RC_MAX
)
1415 LOG_ERROR("BUG: arm11->reg_values inconsistent (%d %u %u %d)",
1416 ARM11_REGCACHE_COUNT
,
1417 (unsigned) ARRAY_SIZE(arm11
->reg_values
),
1418 (unsigned) ARRAY_SIZE(arm11_reg_defs
),
1420 /* FIXME minimally, use a build_bug_on(X) mechanism;
1421 * runtime exit() here is bad!
1426 for (i
= 0; i
< ARM11_REGCACHE_COUNT
; i
++)
1428 struct reg
* r
= reg_list
+ i
;
1429 const struct arm11_reg_defs
* rd
= arm11_reg_defs
+ i
;
1430 struct arm11_reg_state
* rs
= arm11_reg_states
+ i
;
1434 r
->value
= (uint8_t *)(arm11
->reg_values
+ i
);
1437 r
->type
= &arm11_reg_type
;
1441 rs
->target
= target
;
1447 /* FIXME all these BOOL_WRAPPER things should be modifying
1448 * per-instance state, not shared state; ditto the vector
1449 * catch register support. Scan chains with multiple cores
1450 * should be able to say "work with this core like this,
1451 * that core like that". Example, ARM11 MPCore ...
1454 #define ARM11_BOOL_WRAPPER(name, print_name) \
1455 COMMAND_HANDLER(arm11_handle_bool_##name) \
1457 return CALL_COMMAND_HANDLER(handle_command_parse_bool, \
1458 &arm11_config_##name, print_name); \
1461 ARM11_BOOL_WRAPPER(memwrite_burst
, "memory write burst mode")
1462 ARM11_BOOL_WRAPPER(memwrite_error_fatal
, "fatal error mode for memory writes")
1463 ARM11_BOOL_WRAPPER(step_irq_enable
, "IRQs while stepping")
1464 ARM11_BOOL_WRAPPER(hardware_step
, "hardware single step")
1466 COMMAND_HANDLER(arm11_handle_vcr
)
1472 COMMAND_PARSE_NUMBER(u32
, CMD_ARGV
[0], arm11_vcr
);
1475 return ERROR_COMMAND_SYNTAX_ERROR
;
1478 LOG_INFO("VCR 0x%08" PRIx32
"", arm11_vcr
);
1482 static const struct command_registration arm11_mw_command_handlers
[] = {
1485 .handler
= &arm11_handle_bool_memwrite_burst
,
1486 .mode
= COMMAND_ANY
,
1487 .help
= "Enable/Disable non-standard but fast burst mode"
1488 " (default: enabled)",
1491 .name
= "error_fatal",
1492 .handler
= &arm11_handle_bool_memwrite_error_fatal
,
1493 .mode
= COMMAND_ANY
,
1494 .help
= "Terminate program if transfer error was found"
1495 " (default: enabled)",
1497 COMMAND_REGISTRATION_DONE
1499 static const struct command_registration arm11_any_command_handlers
[] = {
1501 /* "hardware_step" is only here to check if the default
1502 * simulate + breakpoint implementation is broken.
1503 * TEMPORARY! NOT DOCUMENTED! */
1504 .name
= "hardware_step",
1505 .handler
= &arm11_handle_bool_hardware_step
,
1506 .mode
= COMMAND_ANY
,
1507 .help
= "DEBUG ONLY - Hardware single stepping"
1508 " (default: disabled)",
1509 .usage
= "(enable|disable)",
1513 .mode
= COMMAND_ANY
,
1514 .help
= "memwrite command group",
1515 .chain
= arm11_mw_command_handlers
,
1518 .name
= "step_irq_enable",
1519 .handler
= &arm11_handle_bool_step_irq_enable
,
1520 .mode
= COMMAND_ANY
,
1521 .help
= "Enable interrupts while stepping"
1522 " (default: disabled)",
1526 .handler
= &arm11_handle_vcr
,
1527 .mode
= COMMAND_ANY
,
1528 .help
= "Control (Interrupt) Vector Catch Register",
1530 COMMAND_REGISTRATION_DONE
1532 static const struct command_registration arm11_command_handlers
[] = {
1534 .chain
= arm_command_handlers
,
1537 .chain
= etm_command_handlers
,
1541 .mode
= COMMAND_ANY
,
1542 .help
= "ARM11 command group",
1543 .chain
= arm11_any_command_handlers
,
1545 COMMAND_REGISTRATION_DONE
1548 /** Holds methods for ARM11xx targets. */
1549 struct target_type arm11_target
= {
1553 .arch_state
= arm11_arch_state
,
1555 .target_request_data
= arm11_target_request_data
,
1558 .resume
= arm11_resume
,
1561 .assert_reset
= arm11_assert_reset
,
1562 .deassert_reset
= arm11_deassert_reset
,
1563 .soft_reset_halt
= arm11_soft_reset_halt
,
1565 .get_gdb_reg_list
= armv4_5_get_gdb_reg_list
,
1567 .read_memory
= arm11_read_memory
,
1568 .write_memory
= arm11_write_memory
,
1570 .bulk_write_memory
= arm11_bulk_write_memory
,
1572 .checksum_memory
= arm_checksum_memory
,
1573 .blank_check_memory
= arm_blank_check_memory
,
1575 .add_breakpoint
= arm11_add_breakpoint
,
1576 .remove_breakpoint
= arm11_remove_breakpoint
,
1578 .run_algorithm
= armv4_5_run_algorithm
,
1580 .commands
= arm11_command_handlers
,
1581 .target_create
= arm11_target_create
,
1582 .init_target
= arm11_init_target
,
1583 .examine
= arm11_examine
,
Linking to existing account procedure
If you already have an account and want to add another login method
you
MUST first sign in with your existing account and
then change URL to read
https://review.openocd.org/login/?link
to get to this page again but this time it'll work for linking. Thank you.
SSH host keys fingerprints
1024 SHA256:YKx8b7u5ZWdcbp7/4AeXNaqElP49m6QrwfXaqQGJAOk gerrit-code-review@openocd.zylin.com (DSA)
384 SHA256:jHIbSQa4REvwCFG4cq5LBlBLxmxSqelQPem/EXIrxjk gerrit-code-review@openocd.org (ECDSA)
521 SHA256:UAOPYkU9Fjtcao0Ul/Rrlnj/OsQvt+pgdYSZ4jOYdgs gerrit-code-review@openocd.org (ECDSA)
256 SHA256:A13M5QlnozFOvTllybRZH6vm7iSt0XLxbA48yfc2yfY gerrit-code-review@openocd.org (ECDSA)
256 SHA256:spYMBqEYoAOtK7yZBrcwE8ZpYt6b68Cfh9yEVetvbXg gerrit-code-review@openocd.org (ED25519)
+--[ED25519 256]--+
|=.. |
|+o.. . |
|*.o . . |
|+B . . . |
|Bo. = o S |
|Oo.+ + = |
|oB=.* = . o |
| =+=.+ + E |
|. .=o . o |
+----[SHA256]-----+
2048 SHA256:0Onrb7/PHjpo6iVZ7xQX2riKN83FJ3KGU0TvI0TaFG4 gerrit-code-review@openocd.zylin.com (RSA)