1 /***************************************************************************
2 * Copyright (C) 2008 digenius technology GmbH. *
5 * Copyright (C) 2008,2009 Oyvind Harboe oyvind.harboe@zylin.com *
7 * Copyright (C) 2008 Georg Acher <acher@in.tum.de> *
9 * This program is free software; you can redistribute it and/or modify *
10 * it under the terms of the GNU General Public License as published by *
11 * the Free Software Foundation; either version 2 of the License, or *
12 * (at your option) any later version. *
14 * This program is distributed in the hope that it will be useful, *
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
17 * GNU General Public License for more details. *
19 * You should have received a copy of the GNU General Public License *
20 * along with this program; if not, write to the *
21 * Free Software Foundation, Inc., *
22 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
23 ***************************************************************************/
30 #include "breakpoints.h"
31 #include "arm11_dbgtap.h"
32 #include "arm_simulator.h"
33 #include <helper/time_support.h>
34 #include "target_type.h"
35 #include "algorithm.h"
40 #define _DEBUG_INSTRUCTION_EXECUTION_
44 /* FIXME none of these flags should be global to all ARM11 cores!
45 * Most of them shouldn't exist at all, once the code works...
47 static bool arm11_config_memwrite_burst
= true;
48 static bool arm11_config_memwrite_error_fatal
= true;
49 static uint32_t arm11_vcr
= 0;
50 static bool arm11_config_step_irq_enable
= false;
51 static bool arm11_config_hardware_step
= false;
53 static int arm11_step(struct target
*target
, int current
,
54 uint32_t address
, int handle_breakpoints
);
57 /** Check and if necessary take control of the system
59 * \param arm11 Target state variable.
61 static int arm11_check_init(struct arm11_common
*arm11
)
63 CHECK_RETVAL(arm11_read_DSCR(arm11
));
64 LOG_DEBUG("DSCR %08x", (unsigned) arm11
->dscr
);
66 if (!(arm11
->dscr
& DSCR_HALT_DBG_MODE
))
68 LOG_DEBUG("Bringing target into debug mode");
70 arm11
->dscr
|= DSCR_HALT_DBG_MODE
;
71 arm11_write_DSCR(arm11
, arm11
->dscr
);
73 /* add further reset initialization here */
75 arm11
->simulate_reset_on_next_halt
= true;
77 if (arm11
->dscr
& DSCR_CORE_HALTED
)
79 /** \todo TODO: this needs further scrutiny because
80 * arm11_debug_entry() never gets called. (WHY NOT?)
81 * As a result we don't read the actual register states from
85 arm11
->arm
.target
->state
= TARGET_HALTED
;
86 arm_dpm_report_dscr(arm11
->arm
.dpm
, arm11
->dscr
);
90 arm11
->arm
.target
->state
= TARGET_RUNNING
;
91 arm11
->arm
.target
->debug_reason
= DBG_REASON_NOTHALTED
;
94 arm11_sc7_clear_vbw(arm11
);
101 * Save processor state. This is called after a HALT instruction
102 * succeeds, and on other occasions the processor enters debug mode
103 * (breakpoint, watchpoint, etc). Caller has updated arm11->dscr.
105 static int arm11_debug_entry(struct arm11_common
*arm11
)
109 arm11
->arm
.target
->state
= TARGET_HALTED
;
110 arm_dpm_report_dscr(arm11
->arm
.dpm
, arm11
->dscr
);
112 /* REVISIT entire cache should already be invalid !!! */
113 register_cache_invalidate(arm11
->arm
.core_cache
);
115 /* See e.g. ARM1136 TRM, "14.8.4 Entering Debug state" */
117 /* maybe save wDTR (pending DCC write to debug SW, e.g. libdcc) */
118 arm11
->is_wdtr_saved
= !!(arm11
->dscr
& DSCR_DTR_TX_FULL
);
119 if (arm11
->is_wdtr_saved
)
121 arm11_add_debug_SCAN_N(arm11
, 0x05, ARM11_TAP_DEFAULT
);
123 arm11_add_IR(arm11
, ARM11_INTEST
, ARM11_TAP_DEFAULT
);
125 struct scan_field chain5_fields
[3];
127 arm11_setup_field(arm11
, 32, NULL
,
128 &arm11
->saved_wdtr
, chain5_fields
+ 0);
129 arm11_setup_field(arm11
, 1, NULL
, NULL
, chain5_fields
+ 1);
130 arm11_setup_field(arm11
, 1, NULL
, NULL
, chain5_fields
+ 2);
132 arm11_add_dr_scan_vc(ARRAY_SIZE(chain5_fields
), chain5_fields
, TAP_DRPAUSE
);
136 /* DSCR: set the Execute ARM instruction enable bit.
138 * ARM1176 spec says this is needed only for wDTR/rDTR's "ITR mode",
139 * but not to issue ITRs(?). The ARMv7 arch spec says it's required
140 * for executing instructions via ITR.
142 arm11_write_DSCR(arm11
, DSCR_ITR_EN
| arm11
->dscr
);
146 Before executing any instruction in debug state you have to drain the write buffer.
147 This ensures that no imprecise Data Aborts can return at a later point:*/
149 /** \todo TODO: Test drain write buffer. */
154 /* MRC p14,0,R0,c5,c10,0 */
155 // arm11_run_instr_no_data1(arm11, /*0xee150e1a*/0xe320f000);
157 /* mcr 15, 0, r0, cr7, cr10, {4} */
158 arm11_run_instr_no_data1(arm11
, 0xee070f9a);
160 uint32_t dscr
= arm11_read_DSCR(arm11
);
162 LOG_DEBUG("DRAIN, DSCR %08x", dscr
);
164 if (dscr
& ARM11_DSCR_STICKY_IMPRECISE_DATA_ABORT
)
166 arm11_run_instr_no_data1(arm11
, 0xe320f000);
168 dscr
= arm11_read_DSCR(arm11
);
170 LOG_DEBUG("DRAIN, DSCR %08x (DONE)", dscr
);
179 * NOTE: ARM1136 TRM suggests saving just R0 here now, then
180 * CPSR and PC after the rDTR stuff. We do it all at once.
182 retval
= arm_dpm_read_current_registers(&arm11
->dpm
);
183 if (retval
!= ERROR_OK
)
184 LOG_ERROR("DPM REG READ -- fail %d", retval
);
186 retval
= arm11_run_instr_data_prepare(arm11
);
187 if (retval
!= ERROR_OK
)
190 /* maybe save rDTR (pending DCC read from debug SW, e.g. libdcc) */
191 arm11
->is_rdtr_saved
= !!(arm11
->dscr
& DSCR_DTR_RX_FULL
);
192 if (arm11
->is_rdtr_saved
)
194 /* MRC p14,0,R0,c0,c5,0 (move rDTR -> r0 (-> wDTR -> local var)) */
195 retval
= arm11_run_instr_data_from_core_via_r0(arm11
,
196 0xEE100E15, &arm11
->saved_rdtr
);
197 if (retval
!= ERROR_OK
)
201 /* REVISIT Now that we've saved core state, there's may also
202 * be MMU and cache state to care about ...
205 if (arm11
->simulate_reset_on_next_halt
)
207 arm11
->simulate_reset_on_next_halt
= false;
209 LOG_DEBUG("Reset c1 Control Register");
211 /* Write 0 (reset value) to Control register 0 to disable MMU/Cache etc. */
213 /* MCR p15,0,R0,c1,c0,0 */
214 retval
= arm11_run_instr_data_to_core_via_r0(arm11
, 0xee010f10, 0);
215 if (retval
!= ERROR_OK
)
220 if (arm11
->arm
.target
->debug_reason
== DBG_REASON_WATCHPOINT
) {
223 /* MRC p15, 0, <Rd>, c6, c0, 1 ; Read WFAR */
224 retval
= arm11_run_instr_data_from_core_via_r0(arm11
,
225 ARMV4_5_MRC(15, 0, 0, 6, 0, 1),
227 if (retval
!= ERROR_OK
)
229 arm_dpm_report_wfar(arm11
->arm
.dpm
, wfar
);
233 retval
= arm11_run_instr_data_finish(arm11
);
234 if (retval
!= ERROR_OK
)
241 * Restore processor state. This is called in preparation for
242 * the RESTART function.
244 static int arm11_leave_debug_state(struct arm11_common
*arm11
, bool bpwp
)
248 /* See e.g. ARM1136 TRM, "14.8.5 Leaving Debug state" */
250 /* NOTE: the ARM1136 TRM suggests restoring all registers
251 * except R0/PC/CPSR right now. Instead, we do them all
252 * at once, just a bit later on.
255 /* REVISIT once we start caring about MMU and cache state,
256 * address it here ...
259 /* spec says clear wDTR and rDTR; we assume they are clear as
260 otherwise our programming would be sloppy */
262 CHECK_RETVAL(arm11_read_DSCR(arm11
));
264 if (arm11
->dscr
& (DSCR_DTR_RX_FULL
| DSCR_DTR_TX_FULL
))
267 The wDTR/rDTR two registers that are used to send/receive data to/from
268 the core in tandem with corresponding instruction codes that are
269 written into the core. The RDTR FULL/WDTR FULL flag indicates that the
270 registers hold data that was written by one side (CPU or JTAG) and not
271 read out by the other side.
273 LOG_ERROR("wDTR/rDTR inconsistent (DSCR %08x)",
274 (unsigned) arm11
->dscr
);
279 /* maybe restore original wDTR */
280 if (arm11
->is_wdtr_saved
)
282 retval
= arm11_run_instr_data_prepare(arm11
);
283 if (retval
!= ERROR_OK
)
286 /* MCR p14,0,R0,c0,c5,0 */
287 retval
= arm11_run_instr_data_to_core_via_r0(arm11
,
288 0xee000e15, arm11
->saved_wdtr
);
289 if (retval
!= ERROR_OK
)
292 retval
= arm11_run_instr_data_finish(arm11
);
293 if (retval
!= ERROR_OK
)
297 /* restore CPSR, PC, and R0 ... after flushing any modified
300 retval
= arm_dpm_write_dirty_registers(&arm11
->dpm
, bpwp
);
302 retval
= arm11_bpwp_flush(arm11
);
304 register_cache_invalidate(arm11
->arm
.core_cache
);
307 arm11_write_DSCR(arm11
, arm11
->dscr
);
309 /* maybe restore rDTR */
310 if (arm11
->is_rdtr_saved
)
312 arm11_add_debug_SCAN_N(arm11
, 0x05, ARM11_TAP_DEFAULT
);
314 arm11_add_IR(arm11
, ARM11_EXTEST
, ARM11_TAP_DEFAULT
);
316 struct scan_field chain5_fields
[3];
318 uint8_t Ready
= 0; /* ignored */
319 uint8_t Valid
= 0; /* ignored */
321 arm11_setup_field(arm11
, 32, &arm11
->saved_rdtr
,
322 NULL
, chain5_fields
+ 0);
323 arm11_setup_field(arm11
, 1, &Ready
, NULL
, chain5_fields
+ 1);
324 arm11_setup_field(arm11
, 1, &Valid
, NULL
, chain5_fields
+ 2);
326 arm11_add_dr_scan_vc(ARRAY_SIZE(chain5_fields
), chain5_fields
, TAP_DRPAUSE
);
329 /* now processor is ready to RESTART */
334 /* poll current target status */
335 static int arm11_poll(struct target
*target
)
338 struct arm11_common
*arm11
= target_to_arm11(target
);
340 CHECK_RETVAL(arm11_check_init(arm11
));
342 if (arm11
->dscr
& DSCR_CORE_HALTED
)
344 if (target
->state
!= TARGET_HALTED
)
346 enum target_state old_state
= target
->state
;
348 LOG_DEBUG("enter TARGET_HALTED");
349 retval
= arm11_debug_entry(arm11
);
350 if (retval
!= ERROR_OK
)
353 target_call_event_callbacks(target
,
354 old_state
== TARGET_DEBUG_RUNNING
? TARGET_EVENT_DEBUG_HALTED
: TARGET_EVENT_HALTED
);
359 if (target
->state
!= TARGET_RUNNING
&& target
->state
!= TARGET_DEBUG_RUNNING
)
361 LOG_DEBUG("enter TARGET_RUNNING");
362 target
->state
= TARGET_RUNNING
;
363 target
->debug_reason
= DBG_REASON_NOTHALTED
;
369 /* architecture specific status reply */
370 static int arm11_arch_state(struct target
*target
)
372 struct arm11_common
*arm11
= target_to_arm11(target
);
375 retval
= armv4_5_arch_state(target
);
377 /* REVISIT also display ARM11-specific MMU and cache status ... */
379 if (target
->debug_reason
== DBG_REASON_WATCHPOINT
)
380 LOG_USER("Watchpoint triggered at PC %#08x",
381 (unsigned) arm11
->dpm
.wp_pc
);
386 /* target request support */
387 static int arm11_target_request_data(struct target
*target
,
388 uint32_t size
, uint8_t *buffer
)
390 LOG_WARNING("Not implemented: %s", __func__
);
395 /* target execution control */
396 static int arm11_halt(struct target
*target
)
398 struct arm11_common
*arm11
= target_to_arm11(target
);
400 LOG_DEBUG("target->state: %s",
401 target_state_name(target
));
403 if (target
->state
== TARGET_UNKNOWN
)
405 arm11
->simulate_reset_on_next_halt
= true;
408 if (target
->state
== TARGET_HALTED
)
410 LOG_DEBUG("target was already halted");
414 arm11_add_IR(arm11
, ARM11_HALT
, TAP_IDLE
);
416 CHECK_RETVAL(jtag_execute_queue());
422 CHECK_RETVAL(arm11_read_DSCR(arm11
));
424 if (arm11
->dscr
& DSCR_CORE_HALTED
)
435 if ((timeval_ms()-then
) > 1000)
437 LOG_WARNING("Timeout (1000ms) waiting for instructions to complete");
444 enum target_state old_state
= target
->state
;
446 arm11_debug_entry(arm11
);
449 target_call_event_callbacks(target
,
450 old_state
== TARGET_DEBUG_RUNNING
? TARGET_EVENT_DEBUG_HALTED
: TARGET_EVENT_HALTED
));
456 arm11_nextpc(struct arm11_common
*arm11
, int current
, uint32_t address
)
458 void *value
= arm11
->arm
.core_cache
->reg_list
[15].value
;
461 buf_set_u32(value
, 0, 32, address
);
463 address
= buf_get_u32(value
, 0, 32);
468 static int arm11_resume(struct target
*target
, int current
,
469 uint32_t address
, int handle_breakpoints
, int debug_execution
)
471 // LOG_DEBUG("current %d address %08x handle_breakpoints %d debug_execution %d",
472 // current, address, handle_breakpoints, debug_execution);
474 struct arm11_common
*arm11
= target_to_arm11(target
);
476 LOG_DEBUG("target->state: %s",
477 target_state_name(target
));
480 if (target
->state
!= TARGET_HALTED
)
482 LOG_ERROR("Target not halted");
483 return ERROR_TARGET_NOT_HALTED
;
486 address
= arm11_nextpc(arm11
, current
, address
);
488 LOG_DEBUG("RESUME PC %08" PRIx32
"%s", address
, !current
? "!" : "");
490 /* clear breakpoints/watchpoints and VCR*/
491 arm11_sc7_clear_vbw(arm11
);
493 if (!debug_execution
)
494 target_free_all_working_areas(target
);
496 /* Set up breakpoints */
497 if (handle_breakpoints
)
499 /* check if one matches PC and step over it if necessary */
501 struct breakpoint
* bp
;
503 for (bp
= target
->breakpoints
; bp
; bp
= bp
->next
)
505 if (bp
->address
== address
)
507 LOG_DEBUG("must step over %08" PRIx32
"", bp
->address
);
508 arm11_step(target
, 1, 0, 0);
513 /* set all breakpoints */
515 unsigned brp_num
= 0;
517 for (bp
= target
->breakpoints
; bp
; bp
= bp
->next
)
519 struct arm11_sc7_action brp
[2];
522 brp
[0].address
= ARM11_SC7_BVR0
+ brp_num
;
523 brp
[0].value
= bp
->address
;
525 brp
[1].address
= ARM11_SC7_BCR0
+ brp_num
;
526 brp
[1].value
= 0x1 | (3 << 1) | (0x0F << 5) | (0 << 14) | (0 << 16) | (0 << 20) | (0 << 21);
528 arm11_sc7_run(arm11
, brp
, ARRAY_SIZE(brp
));
530 LOG_DEBUG("Add BP %d at %08" PRIx32
, brp_num
,
537 arm11_sc7_set_vcr(arm11
, arm11_vcr
);
540 arm11_leave_debug_state(arm11
, handle_breakpoints
);
542 arm11_add_IR(arm11
, ARM11_RESTART
, TAP_IDLE
);
544 CHECK_RETVAL(jtag_execute_queue());
549 CHECK_RETVAL(arm11_read_DSCR(arm11
));
551 LOG_DEBUG("DSCR %08x", (unsigned) arm11
->dscr
);
553 if (arm11
->dscr
& DSCR_CORE_RESTARTED
)
564 if ((timeval_ms()-then
) > 1000)
566 LOG_WARNING("Timeout (1000ms) waiting for instructions to complete");
573 target
->debug_reason
= DBG_REASON_NOTHALTED
;
574 if (!debug_execution
)
575 target
->state
= TARGET_RUNNING
;
577 target
->state
= TARGET_DEBUG_RUNNING
;
578 CHECK_RETVAL(target_call_event_callbacks(target
, TARGET_EVENT_RESUMED
));
583 static int arm11_step(struct target
*target
, int current
,
584 uint32_t address
, int handle_breakpoints
)
586 LOG_DEBUG("target->state: %s",
587 target_state_name(target
));
589 if (target
->state
!= TARGET_HALTED
)
591 LOG_WARNING("target was not halted");
592 return ERROR_TARGET_NOT_HALTED
;
595 struct arm11_common
*arm11
= target_to_arm11(target
);
597 address
= arm11_nextpc(arm11
, current
, address
);
599 LOG_DEBUG("STEP PC %08" PRIx32
"%s", address
, !current
? "!" : "");
602 /** \todo TODO: Thumb not supported here */
604 uint32_t next_instruction
;
606 CHECK_RETVAL(arm11_read_memory_word(arm11
, address
, &next_instruction
));
609 if ((next_instruction
& 0xFFF00070) == 0xe1200070)
611 address
= arm11_nextpc(arm11
, 0, address
+ 4);
612 LOG_DEBUG("Skipping BKPT");
614 /* skip over Wait for interrupt / Standby */
615 /* mcr 15, 0, r?, cr7, cr0, {4} */
616 else if ((next_instruction
& 0xFFFF0FFF) == 0xee070f90)
618 address
= arm11_nextpc(arm11
, 0, address
+ 4);
619 LOG_DEBUG("Skipping WFI");
621 /* ignore B to self */
622 else if ((next_instruction
& 0xFEFFFFFF) == 0xeafffffe)
624 LOG_DEBUG("Not stepping jump to self");
628 /** \todo TODO: check if break-/watchpoints make any sense at all in combination
631 /** \todo TODO: check if disabling IRQs might be a good idea here. Alternatively
632 * the VCR might be something worth looking into. */
635 /* Set up breakpoint for stepping */
637 struct arm11_sc7_action brp
[2];
640 brp
[0].address
= ARM11_SC7_BVR0
;
642 brp
[1].address
= ARM11_SC7_BCR0
;
644 if (arm11_config_hardware_step
)
646 /* Hardware single stepping ("instruction address
647 * mismatch") is used if enabled. It's not quite
648 * exactly "run one instruction"; "branch to here"
649 * loops won't break, neither will some other cases,
650 * but it's probably the best default.
652 * Hardware single stepping isn't supported on v6
653 * debug modules. ARM1176 and v7 can support it...
655 * FIXME Thumb stepping likely needs to use 0x03
656 * or 0xc0 byte masks, not 0x0f.
658 brp
[0].value
= address
;
659 brp
[1].value
= 0x1 | (3 << 1) | (0x0F << 5)
660 | (0 << 14) | (0 << 16) | (0 << 20)
664 /* Sets a breakpoint on the next PC, as calculated
665 * by instruction set simulation.
667 * REVISIT stepping Thumb on ARM1156 requires Thumb2
668 * support from the simulator.
673 retval
= arm_simulate_step(target
, &next_pc
);
674 if (retval
!= ERROR_OK
)
677 brp
[0].value
= next_pc
;
678 brp
[1].value
= 0x1 | (3 << 1) | (0x0F << 5)
679 | (0 << 14) | (0 << 16) | (0 << 20)
683 CHECK_RETVAL(arm11_sc7_run(arm11
, brp
, ARRAY_SIZE(brp
)));
688 if (arm11_config_step_irq_enable
)
689 /* this disable should be redundant ... */
690 arm11
->dscr
&= ~DSCR_INT_DIS
;
692 arm11
->dscr
|= DSCR_INT_DIS
;
695 CHECK_RETVAL(arm11_leave_debug_state(arm11
, handle_breakpoints
));
697 arm11_add_IR(arm11
, ARM11_RESTART
, TAP_IDLE
);
699 CHECK_RETVAL(jtag_execute_queue());
706 const uint32_t mask
= DSCR_CORE_RESTARTED
709 CHECK_RETVAL(arm11_read_DSCR(arm11
));
710 LOG_DEBUG("DSCR %08x e", (unsigned) arm11
->dscr
);
712 if ((arm11
->dscr
& mask
) == mask
)
722 if ((timeval_ms()-then
) > 1000)
724 LOG_WARNING("Timeout (1000ms) waiting for instructions to complete");
731 /* clear breakpoint */
732 arm11_sc7_clear_vbw(arm11
);
735 CHECK_RETVAL(arm11_debug_entry(arm11
));
737 /* restore default state */
738 arm11
->dscr
&= ~DSCR_INT_DIS
;
742 target
->debug_reason
= DBG_REASON_SINGLESTEP
;
744 CHECK_RETVAL(target_call_event_callbacks(target
, TARGET_EVENT_HALTED
));
749 static int arm11_assert_reset(struct target
*target
)
752 struct arm11_common
*arm11
= target_to_arm11(target
);
754 retval
= arm11_check_init(arm11
);
755 if (retval
!= ERROR_OK
)
758 target
->state
= TARGET_UNKNOWN
;
760 /* we would very much like to reset into the halted, state,
761 * but resetting and halting is second best... */
762 if (target
->reset_halt
)
764 CHECK_RETVAL(target_halt(target
));
768 /* srst is funny. We can not do *anything* else while it's asserted
769 * and it has unkonwn side effects. Make sure no other code runs
772 * Code below assumes srst:
774 * - Causes power-on-reset (but of what parts of the system?). Bug
777 * - Messes us TAP state without asserting trst.
779 * - There is another bug in the arm11 core. When you generate an access to
780 * external logic (for example ddr controller via AHB bus) and that block
781 * is not configured (perhaps it is still held in reset), that transaction
782 * will never complete. This will hang arm11 core but it will also hang
783 * JTAG controller. Nothing, short of srst assertion will bring it out of
788 * - What should the PC be after an srst reset when starting in the halted
792 jtag_add_reset(0, 1);
793 jtag_add_reset(0, 0);
795 /* How long do we have to wait? */
796 jtag_add_sleep(5000);
798 /* un-mess up TAP state */
801 retval
= jtag_execute_queue();
802 if (retval
!= ERROR_OK
)
810 static int arm11_deassert_reset(struct target
*target
)
815 static int arm11_soft_reset_halt(struct target
*target
)
817 LOG_WARNING("Not implemented: %s", __func__
);
822 /* target memory access
823 * size: 1 = byte (8bit), 2 = half-word (16bit), 4 = word (32bit)
824 * count: number of items of <size>
826 * arm11_config_memrw_no_increment - in the future we may want to be able
827 * to read/write a range of data to a "port". a "port" is an action on
828 * read memory address for some peripheral.
830 static int arm11_read_memory_inner(struct target
*target
,
831 uint32_t address
, uint32_t size
, uint32_t count
, uint8_t *buffer
,
832 bool arm11_config_memrw_no_increment
)
834 /** \todo TODO: check if buffer cast to uint32_t* and uint16_t* might cause alignment problems */
837 if (target
->state
!= TARGET_HALTED
)
839 LOG_WARNING("target was not halted");
840 return ERROR_TARGET_NOT_HALTED
;
843 LOG_DEBUG("ADDR %08" PRIx32
" SIZE %08" PRIx32
" COUNT %08" PRIx32
"", address
, size
, count
);
845 struct arm11_common
*arm11
= target_to_arm11(target
);
847 retval
= arm11_run_instr_data_prepare(arm11
);
848 if (retval
!= ERROR_OK
)
851 /* MRC p14,0,r0,c0,c5,0 */
852 retval
= arm11_run_instr_data_to_core1(arm11
, 0xee100e15, address
);
853 if (retval
!= ERROR_OK
)
859 arm11
->arm
.core_cache
->reg_list
[1].dirty
= true;
861 for (size_t i
= 0; i
< count
; i
++)
863 /* ldrb r1, [r0], #1 */
865 arm11_run_instr_no_data1(arm11
,
866 !arm11_config_memrw_no_increment
? 0xe4d01001 : 0xe5d01000);
869 /* MCR p14,0,R1,c0,c5,0 */
870 arm11_run_instr_data_from_core(arm11
, 0xEE001E15, &res
, 1);
879 arm11
->arm
.core_cache
->reg_list
[1].dirty
= true;
881 for (size_t i
= 0; i
< count
; i
++)
883 /* ldrh r1, [r0], #2 */
884 arm11_run_instr_no_data1(arm11
,
885 !arm11_config_memrw_no_increment
? 0xe0d010b2 : 0xe1d010b0);
889 /* MCR p14,0,R1,c0,c5,0 */
890 arm11_run_instr_data_from_core(arm11
, 0xEE001E15, &res
, 1);
892 uint16_t svalue
= res
;
893 memcpy(buffer
+ i
* sizeof(uint16_t), &svalue
, sizeof(uint16_t));
901 uint32_t instr
= !arm11_config_memrw_no_increment
? 0xecb05e01 : 0xed905e00;
902 /** \todo TODO: buffer cast to uint32_t* causes alignment warnings */
903 uint32_t *words
= (uint32_t *)buffer
;
905 /* LDC p14,c5,[R0],#4 */
906 /* LDC p14,c5,[R0] */
907 arm11_run_instr_data_from_core(arm11
, instr
, words
, count
);
912 return arm11_run_instr_data_finish(arm11
);
915 static int arm11_read_memory(struct target
*target
, uint32_t address
, uint32_t size
, uint32_t count
, uint8_t *buffer
)
917 return arm11_read_memory_inner(target
, address
, size
, count
, buffer
, false);
921 * no_increment - in the future we may want to be able
922 * to read/write a range of data to a "port". a "port" is an action on
923 * read memory address for some peripheral.
925 static int arm11_write_memory_inner(struct target
*target
,
926 uint32_t address
, uint32_t size
,
927 uint32_t count
, uint8_t *buffer
,
932 if (target
->state
!= TARGET_HALTED
)
934 LOG_WARNING("target was not halted");
935 return ERROR_TARGET_NOT_HALTED
;
938 LOG_DEBUG("ADDR %08" PRIx32
" SIZE %08" PRIx32
" COUNT %08" PRIx32
"", address
, size
, count
);
940 struct arm11_common
*arm11
= target_to_arm11(target
);
942 retval
= arm11_run_instr_data_prepare(arm11
);
943 if (retval
!= ERROR_OK
)
946 /* MRC p14,0,r0,c0,c5,0 */
947 retval
= arm11_run_instr_data_to_core1(arm11
, 0xee100e15, address
);
948 if (retval
!= ERROR_OK
)
951 /* burst writes are not used for single words as those may well be
952 * reset init script writes.
954 * The other advantage is that as burst writes are default, we'll
955 * now exercise both burst and non-burst code paths with the
956 * default settings, increasing code coverage.
958 bool burst
= arm11_config_memwrite_burst
&& (count
> 1);
964 arm11
->arm
.core_cache
->reg_list
[1].dirty
= true;
966 for (size_t i
= 0; i
< count
; i
++)
968 /* MRC p14,0,r1,c0,c5,0 */
969 retval
= arm11_run_instr_data_to_core1(arm11
, 0xee101e15, *buffer
++);
970 if (retval
!= ERROR_OK
)
973 /* strb r1, [r0], #1 */
975 retval
= arm11_run_instr_no_data1(arm11
,
979 if (retval
!= ERROR_OK
)
988 arm11
->arm
.core_cache
->reg_list
[1].dirty
= true;
990 for (size_t i
= 0; i
< count
; i
++)
993 memcpy(&value
, buffer
+ i
* sizeof(uint16_t), sizeof(uint16_t));
995 /* MRC p14,0,r1,c0,c5,0 */
996 retval
= arm11_run_instr_data_to_core1(arm11
, 0xee101e15, value
);
997 if (retval
!= ERROR_OK
)
1000 /* strh r1, [r0], #2 */
1002 retval
= arm11_run_instr_no_data1(arm11
,
1006 if (retval
!= ERROR_OK
)
1014 uint32_t instr
= !no_increment
? 0xeca05e01 : 0xed805e00;
1016 /** \todo TODO: buffer cast to uint32_t* causes alignment warnings */
1017 uint32_t *words
= (uint32_t*)buffer
;
1021 /* STC p14,c5,[R0],#4 */
1022 /* STC p14,c5,[R0]*/
1023 retval
= arm11_run_instr_data_to_core(arm11
, instr
, words
, count
);
1024 if (retval
!= ERROR_OK
)
1029 /* STC p14,c5,[R0],#4 */
1030 /* STC p14,c5,[R0]*/
1031 retval
= arm11_run_instr_data_to_core_noack(arm11
, instr
, words
, count
);
1032 if (retval
!= ERROR_OK
)
1040 /* r0 verification */
1045 /* MCR p14,0,R0,c0,c5,0 */
1046 retval
= arm11_run_instr_data_from_core(arm11
, 0xEE000E15, &r0
, 1);
1047 if (retval
!= ERROR_OK
)
1050 if (address
+ size
* count
!= r0
)
1052 LOG_ERROR("Data transfer failed. Expected end "
1053 "address 0x%08x, got 0x%08x",
1054 (unsigned) (address
+ size
* count
),
1058 LOG_ERROR("use 'arm11 memwrite burst disable' to disable fast burst mode");
1060 if (arm11_config_memwrite_error_fatal
)
1065 return arm11_run_instr_data_finish(arm11
);
1068 static int arm11_write_memory(struct target
*target
,
1069 uint32_t address
, uint32_t size
,
1070 uint32_t count
, uint8_t *buffer
)
1072 /* pointer increment matters only for multi-unit writes ...
1073 * not e.g. to a "reset the chip" controller.
1075 return arm11_write_memory_inner(target
, address
, size
,
1076 count
, buffer
, count
== 1);
1079 /* write target memory in multiples of 4 byte, optimized for writing large quantities of data */
1080 static int arm11_bulk_write_memory(struct target
*target
,
1081 uint32_t address
, uint32_t count
, uint8_t *buffer
)
1083 if (target
->state
!= TARGET_HALTED
)
1085 LOG_WARNING("target was not halted");
1086 return ERROR_TARGET_NOT_HALTED
;
1089 return arm11_write_memory(target
, address
, 4, count
, buffer
);
1092 /* target break-/watchpoint control
1093 * rw: 0 = write, 1 = read, 2 = access
1095 static int arm11_add_breakpoint(struct target
*target
,
1096 struct breakpoint
*breakpoint
)
1098 struct arm11_common
*arm11
= target_to_arm11(target
);
1101 if (breakpoint
->type
== BKPT_SOFT
)
1103 LOG_INFO("sw breakpoint requested, but software breakpoints not enabled");
1104 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
1108 if (!arm11
->free_brps
)
1110 LOG_DEBUG("no breakpoint unit available for hardware breakpoint");
1111 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
1114 if (breakpoint
->length
!= 4)
1116 LOG_DEBUG("only breakpoints of four bytes length supported");
1117 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
1125 static int arm11_remove_breakpoint(struct target
*target
,
1126 struct breakpoint
*breakpoint
)
1128 struct arm11_common
*arm11
= target_to_arm11(target
);
1135 static int arm11_target_create(struct target
*target
, Jim_Interp
*interp
)
1137 struct arm11_common
*arm11
;
1139 if (target
->tap
== NULL
)
1142 if (target
->tap
->ir_length
!= 5)
1144 LOG_ERROR("'target arm11' expects IR LENGTH = 5");
1145 return ERROR_COMMAND_SYNTAX_ERROR
;
1148 arm11
= calloc(1, sizeof *arm11
);
1152 armv4_5_init_arch_info(target
, &arm11
->arm
);
1154 arm11
->jtag_info
.tap
= target
->tap
;
1155 arm11
->jtag_info
.scann_size
= 5;
1156 arm11
->jtag_info
.scann_instr
= ARM11_SCAN_N
;
1157 arm11
->jtag_info
.cur_scan_chain
= ~0; /* invalid/unknown */
1158 arm11
->jtag_info
.intest_instr
= ARM11_INTEST
;
1163 static int arm11_init_target(struct command_context
*cmd_ctx
,
1164 struct target
*target
)
1166 /* Initialize anything we can set up without talking to the target */
1170 /* talk to the target and set things up */
1171 static int arm11_examine(struct target
*target
)
1175 struct arm11_common
*arm11
= target_to_arm11(target
);
1176 uint32_t didr
, device_id
;
1177 uint8_t implementor
;
1179 /* FIXME split into do-first-time and do-every-time logic ... */
1183 arm11_add_IR(arm11
, ARM11_IDCODE
, ARM11_TAP_DEFAULT
);
1185 struct scan_field idcode_field
;
1187 arm11_setup_field(arm11
, 32, NULL
, &device_id
, &idcode_field
);
1189 arm11_add_dr_scan_vc(1, &idcode_field
, TAP_DRPAUSE
);
1193 arm11_add_debug_SCAN_N(arm11
, 0x00, ARM11_TAP_DEFAULT
);
1195 arm11_add_IR(arm11
, ARM11_INTEST
, ARM11_TAP_DEFAULT
);
1197 struct scan_field chain0_fields
[2];
1199 arm11_setup_field(arm11
, 32, NULL
, &didr
, chain0_fields
+ 0);
1200 arm11_setup_field(arm11
, 8, NULL
, &implementor
, chain0_fields
+ 1);
1202 arm11_add_dr_scan_vc(ARRAY_SIZE(chain0_fields
), chain0_fields
, TAP_IDLE
);
1204 CHECK_RETVAL(jtag_execute_queue());
1206 switch (device_id
& 0x0FFFF000)
1215 arm11
->arm
.core_type
= ARM_MODE_MON
;
1219 LOG_ERROR("'target arm11' expects IDCODE 0x*7B*7****");
1222 LOG_INFO("found %s", type
);
1224 /* unlikely this could ever fail, but ... */
1225 switch ((didr
>> 16) & 0x0F) {
1226 case ARM11_DEBUG_V6
:
1227 case ARM11_DEBUG_V61
: /* supports security extensions */
1230 LOG_ERROR("Only ARM v6 and v6.1 debug supported.");
1234 arm11
->brp
= ((didr
>> 24) & 0x0F) + 1;
1236 /** \todo TODO: reserve one brp slot if we allow breakpoints during step */
1237 arm11
->free_brps
= arm11
->brp
;
1239 LOG_DEBUG("IDCODE %08" PRIx32
" IMPLEMENTOR %02x DIDR %08" PRIx32
,
1240 device_id
, implementor
, didr
);
1242 /* as a side-effect this reads DSCR and thus
1243 * clears the ARM11_DSCR_STICKY_PRECISE_DATA_ABORT / Sticky Precise Data Abort Flag
1244 * as suggested by the spec.
1247 retval
= arm11_check_init(arm11
);
1248 if (retval
!= ERROR_OK
)
1251 /* Build register cache "late", after target_init(), since we
1252 * want to know if this core supports Secure Monitor mode.
1254 if (!target_was_examined(target
))
1255 retval
= arm11_dpm_init(arm11
, didr
);
1257 /* ETM on ARM11 still uses original scanchain 6 access mode */
1258 if (arm11
->arm
.etm
&& !target_was_examined(target
)) {
1259 *register_get_last_cache_p(&target
->reg_cache
) =
1260 etm_build_reg_cache(target
, &arm11
->jtag_info
,
1262 retval
= etm_setup(target
);
1265 target_set_examined(target
);
1271 /* FIXME all these BOOL_WRAPPER things should be modifying
1272 * per-instance state, not shared state; ditto the vector
1273 * catch register support. Scan chains with multiple cores
1274 * should be able to say "work with this core like this,
1275 * that core like that". Example, ARM11 MPCore ...
1278 #define ARM11_BOOL_WRAPPER(name, print_name) \
1279 COMMAND_HANDLER(arm11_handle_bool_##name) \
1281 return CALL_COMMAND_HANDLER(handle_command_parse_bool, \
1282 &arm11_config_##name, print_name); \
1285 ARM11_BOOL_WRAPPER(memwrite_burst
, "memory write burst mode")
1286 ARM11_BOOL_WRAPPER(memwrite_error_fatal
, "fatal error mode for memory writes")
1287 ARM11_BOOL_WRAPPER(step_irq_enable
, "IRQs while stepping")
1288 ARM11_BOOL_WRAPPER(hardware_step
, "hardware single step")
1290 COMMAND_HANDLER(arm11_handle_vcr
)
1296 COMMAND_PARSE_NUMBER(u32
, CMD_ARGV
[0], arm11_vcr
);
1299 return ERROR_COMMAND_SYNTAX_ERROR
;
1302 LOG_INFO("VCR 0x%08" PRIx32
"", arm11_vcr
);
1306 static const struct command_registration arm11_mw_command_handlers
[] = {
1309 .handler
= &arm11_handle_bool_memwrite_burst
,
1310 .mode
= COMMAND_ANY
,
1311 .help
= "Enable/Disable non-standard but fast burst mode"
1312 " (default: enabled)",
1315 .name
= "error_fatal",
1316 .handler
= &arm11_handle_bool_memwrite_error_fatal
,
1317 .mode
= COMMAND_ANY
,
1318 .help
= "Terminate program if transfer error was found"
1319 " (default: enabled)",
1321 COMMAND_REGISTRATION_DONE
1323 static const struct command_registration arm11_any_command_handlers
[] = {
1325 /* "hardware_step" is only here to check if the default
1326 * simulate + breakpoint implementation is broken.
1327 * TEMPORARY! NOT DOCUMENTED! */
1328 .name
= "hardware_step",
1329 .handler
= &arm11_handle_bool_hardware_step
,
1330 .mode
= COMMAND_ANY
,
1331 .help
= "DEBUG ONLY - Hardware single stepping"
1332 " (default: disabled)",
1333 .usage
= "(enable|disable)",
1337 .mode
= COMMAND_ANY
,
1338 .help
= "memwrite command group",
1339 .chain
= arm11_mw_command_handlers
,
1342 .name
= "step_irq_enable",
1343 .handler
= &arm11_handle_bool_step_irq_enable
,
1344 .mode
= COMMAND_ANY
,
1345 .help
= "Enable interrupts while stepping"
1346 " (default: disabled)",
1350 .handler
= &arm11_handle_vcr
,
1351 .mode
= COMMAND_ANY
,
1352 .help
= "Control (Interrupt) Vector Catch Register",
1354 COMMAND_REGISTRATION_DONE
1356 static const struct command_registration arm11_command_handlers
[] = {
1358 .chain
= arm_command_handlers
,
1361 .chain
= etm_command_handlers
,
1365 .mode
= COMMAND_ANY
,
1366 .help
= "ARM11 command group",
1367 .chain
= arm11_any_command_handlers
,
1369 COMMAND_REGISTRATION_DONE
1372 /** Holds methods for ARM11xx targets. */
1373 struct target_type arm11_target
= {
1377 .arch_state
= arm11_arch_state
,
1379 .target_request_data
= arm11_target_request_data
,
1382 .resume
= arm11_resume
,
1385 .assert_reset
= arm11_assert_reset
,
1386 .deassert_reset
= arm11_deassert_reset
,
1387 .soft_reset_halt
= arm11_soft_reset_halt
,
1389 .get_gdb_reg_list
= armv4_5_get_gdb_reg_list
,
1391 .read_memory
= arm11_read_memory
,
1392 .write_memory
= arm11_write_memory
,
1394 .bulk_write_memory
= arm11_bulk_write_memory
,
1396 .checksum_memory
= arm_checksum_memory
,
1397 .blank_check_memory
= arm_blank_check_memory
,
1399 .add_breakpoint
= arm11_add_breakpoint
,
1400 .remove_breakpoint
= arm11_remove_breakpoint
,
1402 .run_algorithm
= armv4_5_run_algorithm
,
1404 .commands
= arm11_command_handlers
,
1405 .target_create
= arm11_target_create
,
1406 .init_target
= arm11_init_target
,
1407 .examine
= arm11_examine
,
Linking to existing account procedure
If you already have an account and want to add another login method
you
MUST first sign in with your existing account and
then change URL to read
https://review.openocd.org/login/?link
to get to this page again but this time it'll work for linking. Thank you.
SSH host keys fingerprints
1024 SHA256:YKx8b7u5ZWdcbp7/4AeXNaqElP49m6QrwfXaqQGJAOk gerrit-code-review@openocd.zylin.com (DSA)
384 SHA256:jHIbSQa4REvwCFG4cq5LBlBLxmxSqelQPem/EXIrxjk gerrit-code-review@openocd.org (ECDSA)
521 SHA256:UAOPYkU9Fjtcao0Ul/Rrlnj/OsQvt+pgdYSZ4jOYdgs gerrit-code-review@openocd.org (ECDSA)
256 SHA256:A13M5QlnozFOvTllybRZH6vm7iSt0XLxbA48yfc2yfY gerrit-code-review@openocd.org (ECDSA)
256 SHA256:spYMBqEYoAOtK7yZBrcwE8ZpYt6b68Cfh9yEVetvbXg gerrit-code-review@openocd.org (ED25519)
+--[ED25519 256]--+
|=.. |
|+o.. . |
|*.o . . |
|+B . . . |
|Bo. = o S |
|Oo.+ + = |
|oB=.* = . o |
| =+=.+ + E |
|. .=o . o |
+----[SHA256]-----+
2048 SHA256:0Onrb7/PHjpo6iVZ7xQX2riKN83FJ3KGU0TvI0TaFG4 gerrit-code-review@openocd.zylin.com (RSA)