8788ba98db8c85af11290520570f0ae7ec6ba884
[openocd.git] / src / target / arm11_dbgtap.c
1 /***************************************************************************
2 * Copyright (C) 2008 digenius technology GmbH. *
3 * Michael Bruck *
4 * *
5 * Copyright (C) 2008 Oyvind Harboe oyvind.harboe@zylin.com *
6 * *
7 * This program is free software; you can redistribute it and/or modify *
8 * it under the terms of the GNU General Public License as published by *
9 * the Free Software Foundation; either version 2 of the License, or *
10 * (at your option) any later version. *
11 * *
12 * This program is distributed in the hope that it will be useful, *
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
15 * GNU General Public License for more details. *
16 * *
17 * You should have received a copy of the GNU General Public License *
18 * along with this program; if not, write to the *
19 * Free Software Foundation, Inc., *
20 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
21 ***************************************************************************/
22
23 #ifdef HAVE_CONFIG_H
24 #include "config.h"
25 #endif
26
27 #include "arm11.h"
28
29
30 #if 0
31 #define JTAG_DEBUG(expr ...) DEBUG(expr)
32 #else
33 #define JTAG_DEBUG(expr ...) do {} while(0)
34 #endif
35
36 /*
37 This pathmove goes from Pause-IR to Shift-IR while avoiding RTI. The
38 behavior of the FTDI driver IIRC was to go via RTI.
39
40 Conversely there may be other places in this code where the ARM11 code relies
41 on the driver to hit through RTI when coming from Update-?R.
42 */
43 tap_state_t arm11_move_pi_to_si_via_ci[] =
44 {
45 TAP_IREXIT2, TAP_IRUPDATE, TAP_DRSELECT, TAP_IRSELECT, TAP_IRCAPTURE, TAP_IRSHIFT
46 };
47
48
49 int arm11_add_ir_scan_vc(int num_fields, scan_field_t *fields, tap_state_t state)
50 {
51 if (cmd_queue_cur_state == TAP_IRPAUSE)
52 jtag_add_pathmove(asizeof(arm11_move_pi_to_si_via_ci), arm11_move_pi_to_si_via_ci);
53
54 jtag_add_ir_scan(num_fields, fields, state);
55 return ERROR_OK;
56 }
57
58 tap_state_t arm11_move_pd_to_sd_via_cd[] =
59 {
60 TAP_DREXIT2, TAP_DRUPDATE, TAP_DRSELECT, TAP_DRCAPTURE, TAP_DRSHIFT
61 };
62
63 int arm11_add_dr_scan_vc(int num_fields, scan_field_t *fields, tap_state_t state)
64 {
65 if (cmd_queue_cur_state == TAP_DRPAUSE)
66 jtag_add_pathmove(asizeof(arm11_move_pd_to_sd_via_cd), arm11_move_pd_to_sd_via_cd);
67
68 jtag_add_dr_scan(num_fields, fields, state);
69 return ERROR_OK;
70 }
71
72
73 /** Code de-clutter: Construct scan_field_t to write out a value
74 *
75 * \param arm11 Target state variable.
76 * \param num_bits Length of the data field
77 * \param out_data pointer to the data that will be sent out
78 * <em>(data is read when it is added to the JTAG queue)</em>
79 * \param in_data pointer to the memory that will receive data that was clocked in
80 * <em>(data is written when the JTAG queue is executed)</em>
81 * \param field target data structure that will be initialized
82 */
83 void arm11_setup_field(arm11_common_t * arm11, int num_bits, void * out_data, void * in_data, scan_field_t * field)
84 {
85 field->tap = arm11->target->tap;
86 field->num_bits = num_bits;
87 field->out_value = out_data;
88 field->in_value = in_data;
89 }
90
91
92 /** Write JTAG instruction register
93 *
94 * \param arm11 Target state variable.
95 * \param instr An ARM11 DBGTAP instruction. Use enum #arm11_instructions.
96 * \param state Pass the final TAP state or ARM11_TAP_DEFAULT for the default value (Pause-IR).
97 *
98 * \remarks This adds to the JTAG command queue but does \em not execute it.
99 */
100 void arm11_add_IR(arm11_common_t * arm11, uint8_t instr, tap_state_t state)
101 {
102 jtag_tap_t *tap;
103 tap = arm11->target->tap;
104
105 if (buf_get_u32(tap->cur_instr, 0, 5) == instr)
106 {
107 JTAG_DEBUG("IR <= 0x%02x SKIPPED", instr);
108 return;
109 }
110
111 JTAG_DEBUG("IR <= 0x%02x", instr);
112
113 scan_field_t field;
114
115 arm11_setup_field(arm11, 5, &instr, NULL, &field);
116
117 arm11_add_ir_scan_vc(1, &field, state == ARM11_TAP_DEFAULT ? TAP_IRPAUSE : state);
118 }
119
120 /** Verify shifted out data from Scan Chain Register (SCREG)
121 * Used as parameter to scan_field_t::in_handler in
122 * arm11_add_debug_SCAN_N().
123 *
124 */
125 static void arm11_in_handler_SCAN_N(uint8_t *in_value)
126 {
127 /** \todo TODO: clarify why this isnt properly masked in core.c jtag_read_buffer() */
128 uint8_t v = *in_value & 0x1F;
129
130 if (v != 0x10)
131 {
132 LOG_ERROR("'arm11 target' JTAG communication error SCREG SCAN OUT 0x%02x (expected 0x10)", v);
133 jtag_set_error(ERROR_FAIL);
134 }
135
136 JTAG_DEBUG("SCREG SCAN OUT 0x%02x", v);
137 }
138
139 /** Select and write to Scan Chain Register (SCREG)
140 *
141 * This function sets the instruction register to SCAN_N and writes
142 * the data register with the selected chain number.
143 *
144 * http://infocenter.arm.com/help/topic/com.arm.doc.ddi0301f/Cacbjhfg.html
145 *
146 * \param arm11 Target state variable.
147 * \param chain Scan chain that will be selected.
148 * \param state Pass the final TAP state or ARM11_TAP_DEFAULT for the default
149 * value (Pause-DR).
150 *
151 * The chain takes effect when Update-DR is passed (usually when subsequently
152 * the INTEXT/EXTEST instructions are written).
153 *
154 * \warning (Obsolete) Using this twice in a row will \em fail. The first
155 * call will end in Pause-DR. The second call, due to the IR
156 * caching, will not go through Capture-DR when shifting in the
157 * new scan chain number. As a result the verification in
158 * arm11_in_handler_SCAN_N() must fail.
159 *
160 * \remarks This adds to the JTAG command queue but does \em not execute it.
161 */
162
163 void arm11_add_debug_SCAN_N(arm11_common_t * arm11, uint8_t chain, tap_state_t state)
164 {
165 JTAG_DEBUG("SCREG <= 0x%02x", chain);
166
167 arm11_add_IR(arm11, ARM11_SCAN_N, ARM11_TAP_DEFAULT);
168
169 scan_field_t field;
170
171 uint8_t tmp[1];
172 arm11_setup_field(arm11, 5, &chain, &tmp, &field);
173
174 arm11_add_dr_scan_vc(1, &field, state == ARM11_TAP_DEFAULT ? TAP_DRPAUSE : state);
175
176 jtag_execute_queue_noclear();
177
178 arm11_in_handler_SCAN_N(tmp);
179 }
180
181 /** Write an instruction into the ITR register
182 *
183 * \param arm11 Target state variable.
184 * \param inst An ARM11 processor instruction/opcode.
185 * \param flag Optional parameter to retrieve the InstCompl flag
186 * (this will be written when the JTAG chain is executed).
187 * \param state Pass the final TAP state or ARM11_TAP_DEFAULT for the default
188 * value (Run-Test/Idle).
189 *
190 * \remarks By default this ends with Run-Test/Idle state
191 * and causes the instruction to be executed. If
192 * a subsequent write to DTR is needed before
193 * executing the instruction then TAP_DRPAUSE should be
194 * passed to \p state.
195 *
196 * \remarks This adds to the JTAG command queue but does \em not execute it.
197 */
198 void arm11_add_debug_INST(arm11_common_t * arm11, uint32_t inst, uint8_t * flag, tap_state_t state)
199 {
200 JTAG_DEBUG("INST <= 0x%08x", inst);
201
202 scan_field_t itr[2];
203
204 arm11_setup_field(arm11, 32, &inst, NULL, itr + 0);
205 arm11_setup_field(arm11, 1, NULL, flag, itr + 1);
206
207 arm11_add_dr_scan_vc(asizeof(itr), itr, state == ARM11_TAP_DEFAULT ? TAP_IDLE : state);
208 }
209
210 /** Read the Debug Status and Control Register (DSCR)
211 *
212 * same as CP14 c1
213 *
214 * \param arm11 Target state variable.
215 * \param value DSCR content
216 * \return Error status
217 *
218 * \remarks This is a stand-alone function that executes the JTAG command queue.
219 */
220 int arm11_read_DSCR(arm11_common_t * arm11, uint32_t *value)
221 {
222 arm11_add_debug_SCAN_N(arm11, 0x01, ARM11_TAP_DEFAULT);
223
224 arm11_add_IR(arm11, ARM11_INTEST, ARM11_TAP_DEFAULT);
225
226 uint32_t dscr;
227 scan_field_t chain1_field;
228
229 arm11_setup_field(arm11, 32, NULL, &dscr, &chain1_field);
230
231 arm11_add_dr_scan_vc(1, &chain1_field, TAP_DRPAUSE);
232
233 CHECK_RETVAL(jtag_execute_queue());
234
235 if (arm11->last_dscr != dscr)
236 JTAG_DEBUG("DSCR = %08x (OLD %08x)", dscr, arm11->last_dscr);
237
238 arm11->last_dscr = dscr;
239
240 *value=dscr;
241
242 return ERROR_OK;
243 }
244
245 /** Write the Debug Status and Control Register (DSCR)
246 *
247 * same as CP14 c1
248 *
249 * \param arm11 Target state variable.
250 * \param dscr DSCR content
251 *
252 * \remarks This is a stand-alone function that executes the JTAG command queue.
253 */
254 int arm11_write_DSCR(arm11_common_t * arm11, uint32_t dscr)
255 {
256 arm11_add_debug_SCAN_N(arm11, 0x01, ARM11_TAP_DEFAULT);
257
258 arm11_add_IR(arm11, ARM11_EXTEST, ARM11_TAP_DEFAULT);
259
260 scan_field_t chain1_field;
261
262 arm11_setup_field(arm11, 32, &dscr, NULL, &chain1_field);
263
264 arm11_add_dr_scan_vc(1, &chain1_field, TAP_DRPAUSE);
265
266 CHECK_RETVAL(jtag_execute_queue());
267
268 JTAG_DEBUG("DSCR <= %08x (OLD %08x)", dscr, arm11->last_dscr);
269
270 arm11->last_dscr = dscr;
271
272 return ERROR_OK;
273 }
274
275
276
277 /** Get the debug reason from Debug Status and Control Register (DSCR)
278 *
279 * \param dscr DSCR value to analyze
280 * \return Debug reason
281 *
282 */
283 enum target_debug_reason arm11_get_DSCR_debug_reason(uint32_t dscr)
284 {
285 switch (dscr & ARM11_DSCR_METHOD_OF_DEBUG_ENTRY_MASK)
286 {
287 case ARM11_DSCR_METHOD_OF_DEBUG_ENTRY_HALT:
288 LOG_INFO("Debug entry: JTAG HALT");
289 return DBG_REASON_DBGRQ;
290
291 case ARM11_DSCR_METHOD_OF_DEBUG_ENTRY_BREAKPOINT:
292 LOG_INFO("Debug entry: breakpoint");
293 return DBG_REASON_BREAKPOINT;
294
295 case ARM11_DSCR_METHOD_OF_DEBUG_ENTRY_WATCHPOINT:
296 LOG_INFO("Debug entry: watchpoint");
297 return DBG_REASON_WATCHPOINT;
298
299 case ARM11_DSCR_METHOD_OF_DEBUG_ENTRY_BKPT_INSTRUCTION:
300 LOG_INFO("Debug entry: BKPT instruction");
301 return DBG_REASON_BREAKPOINT;
302
303 case ARM11_DSCR_METHOD_OF_DEBUG_ENTRY_EDBGRQ:
304 LOG_INFO("Debug entry: EDBGRQ signal");
305 return DBG_REASON_DBGRQ;
306
307 case ARM11_DSCR_METHOD_OF_DEBUG_ENTRY_VECTOR_CATCH:
308 LOG_INFO("Debug entry: VCR vector catch");
309 return DBG_REASON_BREAKPOINT;
310
311 default:
312 LOG_INFO("Debug entry: unknown");
313 return DBG_REASON_DBGRQ;
314 }
315 };
316
317
318
319 /** Prepare the stage for ITR/DTR operations
320 * from the arm11_run_instr... group of functions.
321 *
322 * Put arm11_run_instr_data_prepare() and arm11_run_instr_data_finish()
323 * around a block of arm11_run_instr_... calls.
324 *
325 * Select scan chain 5 to allow quick access to DTR. When scan
326 * chain 4 is needed to put in a register the ITRSel instruction
327 * shortcut is used instead of actually changing the Scan_N
328 * register.
329 *
330 * \param arm11 Target state variable.
331 *
332 */
333 void arm11_run_instr_data_prepare(arm11_common_t * arm11)
334 {
335 arm11_add_debug_SCAN_N(arm11, 0x05, ARM11_TAP_DEFAULT);
336 }
337
338 /** Cleanup after ITR/DTR operations
339 * from the arm11_run_instr... group of functions
340 *
341 * Put arm11_run_instr_data_prepare() and arm11_run_instr_data_finish()
342 * around a block of arm11_run_instr_... calls.
343 *
344 * Any IDLE can lead to an instruction execution when
345 * scan chains 4 or 5 are selected and the IR holds
346 * INTEST or EXTEST. So we must disable that before
347 * any following activities lead to an IDLE.
348 *
349 * \param arm11 Target state variable.
350 *
351 */
352 void arm11_run_instr_data_finish(arm11_common_t * arm11)
353 {
354 arm11_add_debug_SCAN_N(arm11, 0x00, ARM11_TAP_DEFAULT);
355 }
356
357
358 /** Execute one or multiple instructions via ITR
359 *
360 * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block
361 *
362 * \param arm11 Target state variable.
363 * \param opcode Pointer to sequence of ARM opcodes
364 * \param count Number of opcodes to execute
365 *
366 */
367 int arm11_run_instr_no_data(arm11_common_t * arm11, uint32_t * opcode, size_t count)
368 {
369 arm11_add_IR(arm11, ARM11_ITRSEL, ARM11_TAP_DEFAULT);
370
371 while (count--)
372 {
373 arm11_add_debug_INST(arm11, *opcode++, NULL, TAP_IDLE);
374
375 while (1)
376 {
377 uint8_t flag;
378
379 arm11_add_debug_INST(arm11, 0, &flag, count ? TAP_IDLE : TAP_DRPAUSE);
380
381 CHECK_RETVAL(jtag_execute_queue());
382
383 if (flag)
384 break;
385 }
386 }
387
388 return ERROR_OK;
389 }
390
391 /** Execute one instruction via ITR
392 *
393 * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block
394 *
395 * \param arm11 Target state variable.
396 * \param opcode ARM opcode
397 *
398 */
399 void arm11_run_instr_no_data1(arm11_common_t * arm11, uint32_t opcode)
400 {
401 arm11_run_instr_no_data(arm11, &opcode, 1);
402 }
403
404
405 /** Execute one instruction via ITR repeatedly while
406 * passing data to the core via DTR on each execution.
407 *
408 * The executed instruction \em must read data from DTR.
409 *
410 * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block
411 *
412 * \param arm11 Target state variable.
413 * \param opcode ARM opcode
414 * \param data Pointer to the data words to be passed to the core
415 * \param count Number of data words and instruction repetitions
416 *
417 */
418 int arm11_run_instr_data_to_core(arm11_common_t * arm11, uint32_t opcode, uint32_t * data, size_t count)
419 {
420 arm11_add_IR(arm11, ARM11_ITRSEL, ARM11_TAP_DEFAULT);
421
422 arm11_add_debug_INST(arm11, opcode, NULL, TAP_DRPAUSE);
423
424 arm11_add_IR(arm11, ARM11_EXTEST, ARM11_TAP_DEFAULT);
425
426 scan_field_t chain5_fields[3];
427
428 uint32_t Data;
429 uint8_t Ready;
430 uint8_t nRetry;
431
432 arm11_setup_field(arm11, 32, &Data, NULL, chain5_fields + 0);
433 arm11_setup_field(arm11, 1, NULL, &Ready, chain5_fields + 1);
434 arm11_setup_field(arm11, 1, NULL, &nRetry, chain5_fields + 2);
435
436 while (count--)
437 {
438 do
439 {
440 Data = *data;
441
442 arm11_add_dr_scan_vc(asizeof(chain5_fields), chain5_fields, jtag_set_end_state(TAP_IDLE));
443
444 CHECK_RETVAL(jtag_execute_queue());
445
446 JTAG_DEBUG("DTR Ready %d nRetry %d", Ready, nRetry);
447 }
448 while (!Ready);
449
450 data++;
451 }
452
453 arm11_add_IR(arm11, ARM11_INTEST, ARM11_TAP_DEFAULT);
454
455 do
456 {
457 Data = 0;
458
459 arm11_add_dr_scan_vc(asizeof(chain5_fields), chain5_fields, TAP_DRPAUSE);
460
461 CHECK_RETVAL(jtag_execute_queue());
462
463 JTAG_DEBUG("DTR Data %08x Ready %d nRetry %d", Data, Ready, nRetry);
464 }
465 while (!Ready);
466
467 return ERROR_OK;
468 }
469
470 /** JTAG path for arm11_run_instr_data_to_core_noack
471 *
472 * The repeated TAP_IDLE's do not cause a repeated execution
473 * if passed without leaving the state.
474 *
475 * Since this is more than 7 bits (adjustable via adding more
476 * TAP_IDLE's) it produces an artificial delay in the lower
477 * layer (FT2232) that is long enough to finish execution on
478 * the core but still shorter than any manually inducible delays.
479 *
480 * To disable this code, try "memwrite burst false"
481 *
482 */
483 tap_state_t arm11_MOVE_DRPAUSE_IDLE_DRPAUSE_with_delay[] =
484 {
485 TAP_DREXIT2, TAP_DRUPDATE, TAP_IDLE, TAP_IDLE, TAP_IDLE, TAP_DRSELECT, TAP_DRCAPTURE, TAP_DRSHIFT
486 };
487
488
489
490 /** Execute one instruction via ITR repeatedly while
491 * passing data to the core via DTR on each execution.
492 *
493 * No Ready check during transmission.
494 *
495 * The executed instruction \em must read data from DTR.
496 *
497 * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block
498 *
499 * \param arm11 Target state variable.
500 * \param opcode ARM opcode
501 * \param data Pointer to the data words to be passed to the core
502 * \param count Number of data words and instruction repetitions
503 *
504 */
505 int arm11_run_instr_data_to_core_noack(arm11_common_t * arm11, uint32_t opcode, uint32_t * data, size_t count)
506 {
507 arm11_add_IR(arm11, ARM11_ITRSEL, ARM11_TAP_DEFAULT);
508
509 arm11_add_debug_INST(arm11, opcode, NULL, TAP_DRPAUSE);
510
511 arm11_add_IR(arm11, ARM11_EXTEST, ARM11_TAP_DEFAULT);
512
513 scan_field_t chain5_fields[3];
514
515 arm11_setup_field(arm11, 32, NULL/*&Data*/, NULL, chain5_fields + 0);
516 arm11_setup_field(arm11, 1, NULL, NULL /*&Ready*/, chain5_fields + 1);
517 arm11_setup_field(arm11, 1, NULL, NULL, chain5_fields + 2);
518
519 uint8_t Readies[count + 1];
520 uint8_t * ReadyPos = Readies;
521
522 while (count--)
523 {
524 chain5_fields[0].out_value = (void *)(data++);
525 chain5_fields[1].in_value = ReadyPos++;
526
527 if (count)
528 {
529 jtag_add_dr_scan(asizeof(chain5_fields), chain5_fields, jtag_set_end_state(TAP_DRPAUSE));
530 jtag_add_pathmove(asizeof(arm11_MOVE_DRPAUSE_IDLE_DRPAUSE_with_delay),
531 arm11_MOVE_DRPAUSE_IDLE_DRPAUSE_with_delay);
532 }
533 else
534 {
535 jtag_add_dr_scan(asizeof(chain5_fields), chain5_fields, jtag_set_end_state(TAP_IDLE));
536 }
537 }
538
539 arm11_add_IR(arm11, ARM11_INTEST, ARM11_TAP_DEFAULT);
540
541 chain5_fields[0].out_value = 0;
542 chain5_fields[1].in_value = ReadyPos++;
543
544 arm11_add_dr_scan_vc(asizeof(chain5_fields), chain5_fields, TAP_DRPAUSE);
545
546 CHECK_RETVAL(jtag_execute_queue());
547
548 size_t error_count = 0;
549
550 for (size_t i = 0; i < asizeof(Readies); i++)
551 {
552 if (Readies[i] != 1)
553 {
554 error_count++;
555 }
556 }
557
558 if (error_count)
559 LOG_ERROR("Transfer errors " ZU, error_count);
560
561 return ERROR_OK;
562 }
563
564
565 /** Execute an instruction via ITR while handing data into the core via DTR.
566 *
567 * The executed instruction \em must read data from DTR.
568 *
569 * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block
570 *
571 * \param arm11 Target state variable.
572 * \param opcode ARM opcode
573 * \param data Data word to be passed to the core via DTR
574 *
575 */
576 int arm11_run_instr_data_to_core1(arm11_common_t * arm11, uint32_t opcode, uint32_t data)
577 {
578 return arm11_run_instr_data_to_core(arm11, opcode, &data, 1);
579 }
580
581
582 /** Execute one instruction via ITR repeatedly while
583 * reading data from the core via DTR on each execution.
584 *
585 * The executed instruction \em must write data to DTR.
586 *
587 * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block
588 *
589 * \param arm11 Target state variable.
590 * \param opcode ARM opcode
591 * \param data Pointer to an array that receives the data words from the core
592 * \param count Number of data words and instruction repetitions
593 *
594 */
595 int arm11_run_instr_data_from_core(arm11_common_t * arm11, uint32_t opcode, uint32_t * data, size_t count)
596 {
597 arm11_add_IR(arm11, ARM11_ITRSEL, ARM11_TAP_DEFAULT);
598
599 arm11_add_debug_INST(arm11, opcode, NULL, TAP_IDLE);
600
601 arm11_add_IR(arm11, ARM11_INTEST, ARM11_TAP_DEFAULT);
602
603 scan_field_t chain5_fields[3];
604
605 uint32_t Data;
606 uint8_t Ready;
607 uint8_t nRetry;
608
609 arm11_setup_field(arm11, 32, NULL, &Data, chain5_fields + 0);
610 arm11_setup_field(arm11, 1, NULL, &Ready, chain5_fields + 1);
611 arm11_setup_field(arm11, 1, NULL, &nRetry, chain5_fields + 2);
612
613 while (count--)
614 {
615 do
616 {
617 arm11_add_dr_scan_vc(asizeof(chain5_fields), chain5_fields, count ? TAP_IDLE : TAP_DRPAUSE);
618
619 CHECK_RETVAL(jtag_execute_queue());
620
621 JTAG_DEBUG("DTR Data %08x Ready %d nRetry %d", Data, Ready, nRetry);
622 }
623 while (!Ready);
624
625 *data++ = Data;
626 }
627
628 return ERROR_OK;
629 }
630
631 /** Execute one instruction via ITR
632 * then load r0 into DTR and read DTR from core.
633 *
634 * The first executed instruction (\p opcode) should write data to r0.
635 *
636 * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block
637 *
638 * \param arm11 Target state variable.
639 * \param opcode ARM opcode to write r0 with the value of interest
640 * \param data Pointer to a data word that receives the value from r0 after \p opcode was executed.
641 *
642 */
643 void arm11_run_instr_data_from_core_via_r0(arm11_common_t * arm11, uint32_t opcode, uint32_t * data)
644 {
645 arm11_run_instr_no_data1(arm11, opcode);
646
647 /* MCR p14,0,R0,c0,c5,0 (move r0 -> wDTR -> local var) */
648 arm11_run_instr_data_from_core(arm11, 0xEE000E15, data, 1);
649 }
650
651 /** Load data into core via DTR then move it to r0 then
652 * execute one instruction via ITR
653 *
654 * The final executed instruction (\p opcode) should read data from r0.
655 *
656 * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block
657 *
658 * \param arm11 Target state variable.
659 * \param opcode ARM opcode to read r0 act upon it
660 * \param data Data word that will be written to r0 before \p opcode is executed
661 *
662 */
663 void arm11_run_instr_data_to_core_via_r0(arm11_common_t * arm11, uint32_t opcode, uint32_t data)
664 {
665 /* MRC p14,0,r0,c0,c5,0 */
666 arm11_run_instr_data_to_core1(arm11, 0xEE100E15, data);
667
668 arm11_run_instr_no_data1(arm11, opcode);
669 }
670
671 /** Apply reads and writes to scan chain 7
672 *
673 * \see arm11_sc7_action_t
674 *
675 * \param arm11 Target state variable.
676 * \param actions A list of read and/or write instructions
677 * \param count Number of instructions in the list.
678 *
679 */
680 int arm11_sc7_run(arm11_common_t * arm11, arm11_sc7_action_t * actions, size_t count)
681 {
682 arm11_add_debug_SCAN_N(arm11, 0x07, ARM11_TAP_DEFAULT);
683
684 arm11_add_IR(arm11, ARM11_EXTEST, ARM11_TAP_DEFAULT);
685
686 scan_field_t chain7_fields[3];
687
688 uint8_t nRW;
689 uint32_t DataOut;
690 uint8_t AddressOut;
691 uint8_t Ready;
692 uint32_t DataIn;
693 uint8_t AddressIn;
694
695 arm11_setup_field(arm11, 1, &nRW, &Ready, chain7_fields + 0);
696 arm11_setup_field(arm11, 32, &DataOut, &DataIn, chain7_fields + 1);
697 arm11_setup_field(arm11, 7, &AddressOut, &AddressIn, chain7_fields + 2);
698
699 for (size_t i = 0; i < count + 1; i++)
700 {
701 if (i < count)
702 {
703 nRW = actions[i].write ? 1 : 0;
704 DataOut = actions[i].value;
705 AddressOut = actions[i].address;
706 }
707 else
708 {
709 nRW = 0;
710 DataOut = 0;
711 AddressOut = 0;
712 }
713
714 do
715 {
716 JTAG_DEBUG("SC7 <= Address %02x Data %08x nRW %d", AddressOut, DataOut, nRW);
717
718 arm11_add_dr_scan_vc(asizeof(chain7_fields), chain7_fields, TAP_DRPAUSE);
719
720 CHECK_RETVAL(jtag_execute_queue());
721
722 JTAG_DEBUG("SC7 => Address %02x Data %08x Ready %d", AddressIn, DataIn, Ready);
723 }
724 while (!Ready); /* 'nRW' is 'Ready' on read out */
725
726 if (i > 0)
727 {
728 if (actions[i - 1].address != AddressIn)
729 {
730 LOG_WARNING("Scan chain 7 shifted out unexpected address");
731 }
732
733 if (!actions[i - 1].write)
734 {
735 actions[i - 1].value = DataIn;
736 }
737 else
738 {
739 if (actions[i - 1].value != DataIn)
740 {
741 LOG_WARNING("Scan chain 7 shifted out unexpected data");
742 }
743 }
744 }
745 }
746
747 for (size_t i = 0; i < count; i++)
748 {
749 JTAG_DEBUG("SC7 %02d: %02x %s %08x", i, actions[i].address, actions[i].write ? "<=" : "=>", actions[i].value);
750 }
751
752 return ERROR_OK;
753 }
754
755 /** Clear VCR and all breakpoints and watchpoints via scan chain 7
756 *
757 * \param arm11 Target state variable.
758 *
759 */
760 void arm11_sc7_clear_vbw(arm11_common_t * arm11)
761 {
762 arm11_sc7_action_t clear_bw[arm11->brp + arm11->wrp + 1];
763 arm11_sc7_action_t * pos = clear_bw;
764
765 for (size_t i = 0; i < asizeof(clear_bw); i++)
766 {
767 clear_bw[i].write = true;
768 clear_bw[i].value = 0;
769 }
770
771 for (size_t i = 0; i < arm11->brp; i++)
772 (pos++)->address = ARM11_SC7_BCR0 + i;
773
774
775 for (size_t i = 0; i < arm11->wrp; i++)
776 (pos++)->address = ARM11_SC7_WCR0 + i;
777
778
779 (pos++)->address = ARM11_SC7_VCR;
780
781 arm11_sc7_run(arm11, clear_bw, asizeof(clear_bw));
782 }
783
784 /** Write VCR register
785 *
786 * \param arm11 Target state variable.
787 * \param value Value to be written
788 */
789 void arm11_sc7_set_vcr(arm11_common_t * arm11, uint32_t value)
790 {
791 arm11_sc7_action_t set_vcr;
792
793 set_vcr.write = true;
794 set_vcr.address = ARM11_SC7_VCR;
795 set_vcr.value = value;
796
797
798 arm11_sc7_run(arm11, &set_vcr, 1);
799 }
800
801
802
803 /** Read word from address
804 *
805 * \param arm11 Target state variable.
806 * \param address Memory address to be read
807 * \param result Pointer where to store result
808 *
809 */
810 int arm11_read_memory_word(arm11_common_t * arm11, uint32_t address, uint32_t * result)
811 {
812 arm11_run_instr_data_prepare(arm11);
813
814 /* MRC p14,0,r0,c0,c5,0 (r0 = address) */
815 CHECK_RETVAL(arm11_run_instr_data_to_core1(arm11, 0xee100e15, address));
816
817 /* LDC p14,c5,[R0],#4 (DTR = [r0]) */
818 CHECK_RETVAL(arm11_run_instr_data_from_core(arm11, 0xecb05e01, result, 1));
819
820 arm11_run_instr_data_finish(arm11);
821
822 return ERROR_OK;
823 }
824
825