1 // SPDX-License-Identifier: GPL-2.0-or-later
3 /***************************************************************************
4 * Copyright (C) 2005 by Dominic Rath *
5 * Dominic.Rath@gmx.de *
7 * Copyright (C) 2007-2010 Øyvind Harboe *
8 * oyvind.harboe@zylin.com *
10 * Copyright (C) 2008 by Spencer Oliver *
11 * spen@spen-soft.co.uk *
13 * Copyright (C) 2008 by Hongtao Zheng *
16 * Copyright (C) 2009 by David Brownell *
17 ***************************************************************************/
23 #include "breakpoints.h"
24 #include "embeddedice.h"
25 #include "target_request.h"
27 #include <helper/time_support.h>
28 #include "arm_simulator.h"
29 #include "arm_semihosting.h"
30 #include "algorithm.h"
36 * Hold common code supporting the ARM7 and ARM9 core generations.
38 * While the ARM core implementations evolved substantially during these
39 * two generations, they look quite similar from the JTAG perspective.
40 * Both have similar debug facilities, based on the same two scan chains
41 * providing access to the core and to an EmbeddedICE module. Both can
42 * support similar ETM and ETB modules, for tracing. And both expose
43 * what could be viewed as "ARM Classic", with multiple processor modes,
44 * shadowed registers, and support for the Thumb instruction set.
46 * Processor differences include things like presence or absence of MMU
47 * and cache, pipeline sizes, use of a modified Harvard Architecture
48 * (with separate instruction and data buses from the CPU), support
49 * for cpu clock gating during idle, and more.
52 static int arm7_9_debug_entry(struct target
*target
);
55 * Clear watchpoints for an ARM7/9 target.
57 * @param arm7_9 Pointer to the common struct for an ARM7/9 target
58 * @return JTAG error status after executing queue
60 static int arm7_9_clear_watchpoints(struct arm7_9_common
*arm7_9
)
63 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], 0x0);
64 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
], 0x0);
65 arm7_9
->sw_breakpoint_count
= 0;
66 arm7_9
->sw_breakpoints_added
= 0;
68 arm7_9
->wp1_used
= arm7_9
->wp1_used_default
;
69 arm7_9
->wp_available
= arm7_9
->wp_available_max
;
71 return jtag_execute_queue();
75 * Assign a watchpoint to one of the two available hardware comparators in an
76 * ARM7 or ARM9 target.
78 * @param arm7_9 Pointer to the common struct for an ARM7/9 target
79 * @param breakpoint Pointer to the breakpoint to be used as a watchpoint
81 static void arm7_9_assign_wp(struct arm7_9_common
*arm7_9
, struct breakpoint
*breakpoint
)
83 if (!arm7_9
->wp0_used
) {
85 breakpoint_hw_set(breakpoint
, 0);
86 arm7_9
->wp_available
--;
87 } else if (!arm7_9
->wp1_used
) {
89 breakpoint_hw_set(breakpoint
, 1);
90 arm7_9
->wp_available
--;
92 LOG_ERROR("BUG: no hardware comparator available");
95 LOG_DEBUG("BPID: %" PRIu32
" (0x%08" TARGET_PRIxADDR
") using hw wp: %u",
96 breakpoint
->unique_id
,
102 * Setup an ARM7/9 target's embedded ICE registers for software breakpoints.
104 * @param arm7_9 Pointer to common struct for ARM7/9 targets
105 * @return Error codes if there is a problem finding a watchpoint or the result
106 * of executing the JTAG queue
108 static int arm7_9_set_software_breakpoints(struct arm7_9_common
*arm7_9
)
110 if (arm7_9
->sw_breakpoints_added
)
112 if (arm7_9
->wp_available
< 1) {
113 LOG_WARNING("can't enable sw breakpoints with no watchpoint unit available");
114 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
116 arm7_9
->wp_available
--;
118 /* pick a breakpoint unit */
119 if (!arm7_9
->wp0_used
) {
120 arm7_9
->sw_breakpoints_added
= 1;
121 arm7_9
->wp0_used
= 3;
122 } else if (!arm7_9
->wp1_used
) {
123 arm7_9
->sw_breakpoints_added
= 2;
124 arm7_9
->wp1_used
= 3;
126 LOG_ERROR("BUG: both watchpoints used, but wp_available >= 1");
130 if (arm7_9
->sw_breakpoints_added
== 1) {
131 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_VALUE
], arm7_9
->arm_bkpt
);
132 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
], 0x0);
133 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
], 0xffffffffu
);
134 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
], ~EICE_W_CTRL_NOPC
& 0xff);
135 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], EICE_W_CTRL_ENABLE
);
136 } else if (arm7_9
->sw_breakpoints_added
== 2) {
137 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_DATA_VALUE
], arm7_9
->arm_bkpt
);
138 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_DATA_MASK
], 0x0);
139 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_MASK
], 0xffffffffu
);
140 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_MASK
], ~EICE_W_CTRL_NOPC
& 0xff);
141 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
], EICE_W_CTRL_ENABLE
);
143 LOG_ERROR("BUG: both watchpoints used, but wp_available >= 1");
146 LOG_DEBUG("SW BP using hw wp: %d",
147 arm7_9
->sw_breakpoints_added
);
149 return jtag_execute_queue();
153 * Setup the common pieces for an ARM7/9 target after reset or on startup.
155 * @param target Pointer to an ARM7/9 target to setup
156 * @return Result of clearing the watchpoints on the target
158 static int arm7_9_setup(struct target
*target
)
160 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
162 return arm7_9_clear_watchpoints(arm7_9
);
166 * Set either a hardware or software breakpoint on an ARM7/9 target. The
167 * breakpoint is set up even if it is already set. Some actions, e.g. reset,
168 * might have erased the values in Embedded ICE.
170 * @param target Pointer to the target device to set the breakpoints on
171 * @param breakpoint Pointer to the breakpoint to be set
172 * @return For hardware breakpoints, this is the result of executing the JTAG
173 * queue. For software breakpoints, this will be the status of the
174 * required memory reads and writes
176 static int arm7_9_set_breakpoint(struct target
*target
, struct breakpoint
*breakpoint
)
178 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
179 int retval
= ERROR_OK
;
181 LOG_DEBUG("BPID: %" PRIu32
", Address: 0x%08" TARGET_PRIxADDR
", Type: %d",
182 breakpoint
->unique_id
,
186 if (target
->state
!= TARGET_HALTED
) {
187 LOG_WARNING("target not halted");
188 return ERROR_TARGET_NOT_HALTED
;
191 if (breakpoint
->type
== BKPT_HARD
) {
192 /* either an ARM (4 byte) or Thumb (2 byte) breakpoint */
193 uint32_t mask
= (breakpoint
->length
== 4) ? 0x3u
: 0x1u
;
195 /* reassign a hw breakpoint */
196 if (!breakpoint
->is_set
)
197 arm7_9_assign_wp(arm7_9
, breakpoint
);
199 if (breakpoint
->number
== 0) {
200 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_VALUE
], breakpoint
->address
);
201 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
], mask
);
202 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
], 0xffffffffu
);
203 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
], ~EICE_W_CTRL_NOPC
& 0xff);
204 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], EICE_W_CTRL_ENABLE
);
205 } else if (breakpoint
->number
== 1) {
206 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_VALUE
], breakpoint
->address
);
207 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_MASK
], mask
);
208 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_DATA_MASK
], 0xffffffffu
);
209 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_MASK
], ~EICE_W_CTRL_NOPC
& 0xff);
210 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
], EICE_W_CTRL_ENABLE
);
212 LOG_ERROR("BUG: no hardware comparator available");
216 retval
= jtag_execute_queue();
217 } else if (breakpoint
->type
== BKPT_SOFT
) {
218 /* did we already set this breakpoint? */
219 if (breakpoint
->is_set
)
222 if (breakpoint
->length
== 4) {
223 uint32_t verify
= 0xffffffff;
224 /* keep the original instruction in target endianness */
225 retval
= target_read_memory(target
, breakpoint
->address
, 4, 1, breakpoint
->orig_instr
);
226 if (retval
!= ERROR_OK
)
228 /* write the breakpoint instruction in target
229 * endianness (arm7_9->arm_bkpt is host endian) */
230 retval
= target_write_u32(target
, breakpoint
->address
, arm7_9
->arm_bkpt
);
231 if (retval
!= ERROR_OK
)
234 retval
= target_read_u32(target
, breakpoint
->address
, &verify
);
235 if (retval
!= ERROR_OK
)
237 if (verify
!= arm7_9
->arm_bkpt
) {
238 LOG_ERROR("Unable to set 32 bit software breakpoint at address %08" TARGET_PRIxADDR
239 " - check that memory is read/writable", breakpoint
->address
);
243 uint16_t verify
= 0xffff;
244 /* keep the original instruction in target endianness */
245 retval
= target_read_memory(target
, breakpoint
->address
, 2, 1, breakpoint
->orig_instr
);
246 if (retval
!= ERROR_OK
)
248 /* write the breakpoint instruction in target
249 * endianness (arm7_9->thumb_bkpt is host endian) */
250 retval
= target_write_u16(target
, breakpoint
->address
, arm7_9
->thumb_bkpt
);
251 if (retval
!= ERROR_OK
)
254 retval
= target_read_u16(target
, breakpoint
->address
, &verify
);
255 if (retval
!= ERROR_OK
)
257 if (verify
!= arm7_9
->thumb_bkpt
) {
258 LOG_ERROR("Unable to set thumb software breakpoint at address %08" TARGET_PRIxADDR
259 " - check that memory is read/writable", breakpoint
->address
);
264 retval
= arm7_9_set_software_breakpoints(arm7_9
);
265 if (retval
!= ERROR_OK
)
268 arm7_9
->sw_breakpoint_count
++;
270 breakpoint
->is_set
= true;
277 * Unsets an existing breakpoint on an ARM7/9 target. If it is a hardware
278 * breakpoint, the watchpoint used will be freed and the Embedded ICE registers
279 * will be updated. Otherwise, the software breakpoint will be restored to its
280 * original instruction if it hasn't already been modified.
282 * @param target Pointer to ARM7/9 target to unset the breakpoint from
283 * @param breakpoint Pointer to breakpoint to be unset
284 * @return For hardware breakpoints, this is the result of executing the JTAG
285 * queue. For software breakpoints, this will be the status of the
286 * required memory reads and writes
288 static int arm7_9_unset_breakpoint(struct target
*target
, struct breakpoint
*breakpoint
)
290 int retval
= ERROR_OK
;
291 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
293 LOG_DEBUG("BPID: %" PRIu32
", Address: 0x%08" TARGET_PRIxADDR
,
294 breakpoint
->unique_id
,
295 breakpoint
->address
);
297 if (!breakpoint
->is_set
) {
298 LOG_WARNING("breakpoint not set");
302 if (breakpoint
->type
== BKPT_HARD
) {
303 LOG_DEBUG("BPID: %" PRIu32
" Releasing hw wp: %d",
304 breakpoint
->unique_id
,
306 if (breakpoint
->number
== 0) {
307 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], 0x0);
308 arm7_9
->wp0_used
= 0;
309 arm7_9
->wp_available
++;
310 } else if (breakpoint
->number
== 1) {
311 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
], 0x0);
312 arm7_9
->wp1_used
= 0;
313 arm7_9
->wp_available
++;
315 retval
= jtag_execute_queue();
316 breakpoint
->is_set
= false;
318 /* restore original instruction (kept in target endianness) */
319 if (breakpoint
->length
== 4) {
320 uint32_t current_instr
;
321 /* check that user program as not modified breakpoint instruction */
322 retval
= target_read_memory(target
,
323 breakpoint
->address
, 4, 1, (uint8_t *)¤t_instr
);
324 if (retval
!= ERROR_OK
)
326 current_instr
= target_buffer_get_u32(target
, (uint8_t *)¤t_instr
);
327 if (current_instr
== arm7_9
->arm_bkpt
) {
328 retval
= target_write_memory(target
,
329 breakpoint
->address
, 4, 1, breakpoint
->orig_instr
);
330 if (retval
!= ERROR_OK
)
335 uint16_t current_instr
;
336 /* check that user program as not modified breakpoint instruction */
337 retval
= target_read_memory(target
,
338 breakpoint
->address
, 2, 1, (uint8_t *)¤t_instr
);
339 if (retval
!= ERROR_OK
)
341 current_instr
= target_buffer_get_u16(target
, (uint8_t *)¤t_instr
);
342 if (current_instr
== arm7_9
->thumb_bkpt
) {
343 retval
= target_write_memory(target
,
344 breakpoint
->address
, 2, 1, breakpoint
->orig_instr
);
345 if (retval
!= ERROR_OK
)
350 if (--arm7_9
->sw_breakpoint_count
== 0) {
351 /* We have removed the last sw breakpoint, clear the hw breakpoint we used
353 if (arm7_9
->sw_breakpoints_added
== 1)
354 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[
355 EICE_W0_CONTROL_VALUE
], 0);
356 else if (arm7_9
->sw_breakpoints_added
== 2)
357 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[
358 EICE_W1_CONTROL_VALUE
], 0);
361 breakpoint
->is_set
= false;
368 * Add a breakpoint to an ARM7/9 target. This makes sure that there are no
369 * dangling breakpoints and that the desired breakpoint can be added.
371 * @param target Pointer to the target ARM7/9 device to add a breakpoint to
372 * @param breakpoint Pointer to the breakpoint to be added
373 * @return An error status if there is a problem adding the breakpoint or the
374 * result of setting the breakpoint
376 int arm7_9_add_breakpoint(struct target
*target
, struct breakpoint
*breakpoint
)
378 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
380 if (arm7_9
->breakpoint_count
== 0) {
381 /* make sure we don't have any dangling breakpoints. This is vital upon
382 * GDB connect/disconnect
384 arm7_9_clear_watchpoints(arm7_9
);
387 if ((breakpoint
->type
== BKPT_HARD
) && (arm7_9
->wp_available
< 1)) {
388 LOG_INFO("no watchpoint unit available for hardware breakpoint");
389 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
392 if ((breakpoint
->length
!= 2) && (breakpoint
->length
!= 4)) {
393 LOG_INFO("only breakpoints of two (Thumb) or four (ARM) bytes length supported");
394 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
397 if (breakpoint
->type
== BKPT_HARD
)
398 arm7_9_assign_wp(arm7_9
, breakpoint
);
400 arm7_9
->breakpoint_count
++;
402 return arm7_9_set_breakpoint(target
, breakpoint
);
406 * Removes a breakpoint from an ARM7/9 target. This will make sure there are no
407 * dangling breakpoints and updates available watchpoints if it is a hardware
410 * @param target Pointer to the target to have a breakpoint removed
411 * @param breakpoint Pointer to the breakpoint to be removed
412 * @return Error status if there was a problem unsetting the breakpoint or the
413 * watchpoints could not be cleared
415 int arm7_9_remove_breakpoint(struct target
*target
, struct breakpoint
*breakpoint
)
417 int retval
= ERROR_OK
;
418 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
420 retval
= arm7_9_unset_breakpoint(target
, breakpoint
);
421 if (retval
!= ERROR_OK
)
424 if (breakpoint
->type
== BKPT_HARD
)
425 arm7_9
->wp_available
++;
427 arm7_9
->breakpoint_count
--;
428 if (arm7_9
->breakpoint_count
== 0) {
429 /* make sure we don't have any dangling breakpoints */
430 retval
= arm7_9_clear_watchpoints(arm7_9
);
431 if (retval
!= ERROR_OK
)
439 * Sets a watchpoint for an ARM7/9 target in one of the watchpoint units. It is
440 * considered a bug to call this function when there are no available watchpoint
443 * @param target Pointer to an ARM7/9 target to set a watchpoint on
444 * @param watchpoint Pointer to the watchpoint to be set
445 * @return Error status if watchpoint set fails or the result of executing the
448 static int arm7_9_set_watchpoint(struct target
*target
, struct watchpoint
*watchpoint
)
450 int retval
= ERROR_OK
;
451 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
455 mask
= watchpoint
->length
- 1;
457 if (target
->state
!= TARGET_HALTED
) {
458 LOG_WARNING("target not halted");
459 return ERROR_TARGET_NOT_HALTED
;
462 if (watchpoint
->rw
== WPT_ACCESS
)
467 if (!arm7_9
->wp0_used
) {
468 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_VALUE
],
469 watchpoint
->address
);
470 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
], mask
);
471 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
],
473 if (watchpoint
->mask
!= 0xffffffffu
)
474 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_VALUE
],
476 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
],
477 0xff & ~EICE_W_CTRL_NOPC
& ~rw_mask
);
478 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
],
479 EICE_W_CTRL_ENABLE
| EICE_W_CTRL_NOPC
| (watchpoint
->rw
& 1));
481 retval
= jtag_execute_queue();
482 if (retval
!= ERROR_OK
)
484 watchpoint_set(watchpoint
, 1);
485 arm7_9
->wp0_used
= 2;
486 } else if (!arm7_9
->wp1_used
) {
487 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_VALUE
],
488 watchpoint
->address
);
489 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_MASK
], mask
);
490 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_DATA_MASK
],
492 if (watchpoint
->mask
!= 0xffffffffu
)
493 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_DATA_VALUE
],
495 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_MASK
],
496 0xff & ~EICE_W_CTRL_NOPC
& ~rw_mask
);
497 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
],
498 EICE_W_CTRL_ENABLE
| EICE_W_CTRL_NOPC
| (watchpoint
->rw
& 1));
500 retval
= jtag_execute_queue();
501 if (retval
!= ERROR_OK
)
503 watchpoint_set(watchpoint
, 2);
504 arm7_9
->wp1_used
= 2;
506 LOG_ERROR("BUG: no hardware comparator available");
514 * Unset an existing watchpoint and clear the used watchpoint unit.
516 * @param target Pointer to the target to have the watchpoint removed
517 * @param watchpoint Pointer to the watchpoint to be removed
518 * @return Error status while trying to unset the watchpoint or the result of
519 * executing the JTAG queue
521 static int arm7_9_unset_watchpoint(struct target
*target
, struct watchpoint
*watchpoint
)
523 int retval
= ERROR_OK
;
524 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
526 if (target
->state
!= TARGET_HALTED
) {
527 LOG_WARNING("target not halted");
528 return ERROR_TARGET_NOT_HALTED
;
531 if (!watchpoint
->is_set
) {
532 LOG_WARNING("breakpoint not set");
536 if (watchpoint
->number
== 1) {
537 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], 0x0);
538 retval
= jtag_execute_queue();
539 if (retval
!= ERROR_OK
)
541 arm7_9
->wp0_used
= 0;
542 } else if (watchpoint
->number
== 2) {
543 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
], 0x0);
544 retval
= jtag_execute_queue();
545 if (retval
!= ERROR_OK
)
547 arm7_9
->wp1_used
= 0;
549 watchpoint
->is_set
= false;
555 * Add a watchpoint to an ARM7/9 target. If there are no watchpoint units
556 * available, an error response is returned.
558 * @param target Pointer to the ARM7/9 target to add a watchpoint to
559 * @param watchpoint Pointer to the watchpoint to be added
560 * @return Error status while trying to add the watchpoint
562 int arm7_9_add_watchpoint(struct target
*target
, struct watchpoint
*watchpoint
)
564 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
566 if (arm7_9
->wp_available
< 1)
567 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
569 if ((watchpoint
->length
!= 1) && (watchpoint
->length
!= 2) && (watchpoint
->length
!= 4))
570 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
572 arm7_9
->wp_available
--;
578 * Remove a watchpoint from an ARM7/9 target. The watchpoint will be unset and
579 * the used watchpoint unit will be reopened.
581 * @param target Pointer to the target to remove a watchpoint from
582 * @param watchpoint Pointer to the watchpoint to be removed
583 * @return Result of trying to unset the watchpoint
585 int arm7_9_remove_watchpoint(struct target
*target
, struct watchpoint
*watchpoint
)
587 int retval
= ERROR_OK
;
588 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
590 if (watchpoint
->is_set
) {
591 retval
= arm7_9_unset_watchpoint(target
, watchpoint
);
592 if (retval
!= ERROR_OK
)
596 arm7_9
->wp_available
++;
602 * Restarts the target by sending a RESTART instruction and moving the JTAG
603 * state to IDLE. This includes a timeout waiting for DBGACK and SYSCOMP to be
604 * asserted by the processor.
606 * @param target Pointer to target to issue commands to
607 * @return Error status if there is a timeout or a problem while executing the
610 int arm7_9_execute_sys_speed(struct target
*target
)
613 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
614 struct arm_jtag
*jtag_info
= &arm7_9
->jtag_info
;
615 struct reg
*dbg_stat
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_STAT
];
617 /* set RESTART instruction */
618 if (arm7_9
->need_bypass_before_restart
) {
619 arm7_9
->need_bypass_before_restart
= 0;
620 retval
= arm_jtag_set_instr(jtag_info
->tap
, 0xf, NULL
, TAP_IDLE
);
621 if (retval
!= ERROR_OK
)
624 retval
= arm_jtag_set_instr(jtag_info
->tap
, 0x4, NULL
, TAP_IDLE
);
625 if (retval
!= ERROR_OK
)
628 int64_t then
= timeval_ms();
630 while (!(timeout
= ((timeval_ms()-then
) > 1000))) {
631 /* read debug status register */
632 embeddedice_read_reg(dbg_stat
);
633 retval
= jtag_execute_queue();
634 if (retval
!= ERROR_OK
)
636 if ((buf_get_u32(dbg_stat
->value
, EICE_DBG_STATUS_DBGACK
, 1))
637 && (buf_get_u32(dbg_stat
->value
, EICE_DBG_STATUS_SYSCOMP
, 1)))
639 if (debug_level
>= 3)
645 LOG_ERROR("timeout waiting for SYSCOMP & DBGACK, last DBG_STATUS: %" PRIx32
"",
646 buf_get_u32(dbg_stat
->value
, 0, dbg_stat
->size
));
647 return ERROR_TARGET_TIMEOUT
;
654 * Restarts the target by sending a RESTART instruction and moving the JTAG
655 * state to IDLE. This validates that DBGACK and SYSCOMP are set without
656 * waiting until they are.
658 * @param target Pointer to the target to issue commands to
659 * @return Always ERROR_OK
661 static int arm7_9_execute_fast_sys_speed(struct target
*target
)
664 static uint8_t check_value
[4], check_mask
[4];
666 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
667 struct arm_jtag
*jtag_info
= &arm7_9
->jtag_info
;
668 struct reg
*dbg_stat
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_STAT
];
671 /* set RESTART instruction */
672 if (arm7_9
->need_bypass_before_restart
) {
673 arm7_9
->need_bypass_before_restart
= 0;
674 retval
= arm_jtag_set_instr(jtag_info
->tap
, 0xf, NULL
, TAP_IDLE
);
675 if (retval
!= ERROR_OK
)
678 retval
= arm_jtag_set_instr(jtag_info
->tap
, 0x4, NULL
, TAP_IDLE
);
679 if (retval
!= ERROR_OK
)
683 /* check for DBGACK and SYSCOMP set (others don't care) */
685 /* NB! These are constants that must be available until after next jtag_execute() and
686 * we evaluate the values upon first execution in lieu of setting up these constants
687 * during early setup.
689 buf_set_u32(check_value
, 0, 32, 0x9);
690 buf_set_u32(check_mask
, 0, 32, 0x9);
694 /* read debug status register */
695 embeddedice_read_reg_w_check(dbg_stat
, check_value
, check_mask
);
701 * Get some data from the ARM7/9 target.
703 * @param target Pointer to the ARM7/9 target to read data from
704 * @param size The number of 32bit words to be read
705 * @param buffer Pointer to the buffer that will hold the data
706 * @return The result of receiving data from the Embedded ICE unit
708 int arm7_9_target_request_data(struct target
*target
, uint32_t size
, uint8_t *buffer
)
710 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
711 struct arm_jtag
*jtag_info
= &arm7_9
->jtag_info
;
713 int retval
= ERROR_OK
;
716 data
= malloc(size
* (sizeof(uint32_t)));
718 retval
= embeddedice_receive(jtag_info
, data
, size
);
720 /* return the 32-bit ints in the 8-bit array */
721 for (i
= 0; i
< size
; i
++)
722 h_u32_to_le(buffer
+ (i
* 4), data
[i
]);
730 * Handles requests to an ARM7/9 target. If debug messaging is enabled, the
731 * target is running and the DCC control register has the W bit high, this will
732 * execute the request on the target.
734 * @param priv Void pointer expected to be a struct target pointer
735 * @return ERROR_OK unless there are issues with the JTAG queue or when reading
736 * from the Embedded ICE unit
738 static int arm7_9_handle_target_request(void *priv
)
740 int retval
= ERROR_OK
;
741 struct target
*target
= priv
;
742 if (!target_was_examined(target
))
744 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
745 struct arm_jtag
*jtag_info
= &arm7_9
->jtag_info
;
746 struct reg
*dcc_control
= &arm7_9
->eice_cache
->reg_list
[EICE_COMMS_CTRL
];
748 if (!target
->dbg_msg_enabled
)
751 if (target
->state
== TARGET_RUNNING
) {
752 /* read DCC control register */
753 embeddedice_read_reg(dcc_control
);
754 retval
= jtag_execute_queue();
755 if (retval
!= ERROR_OK
)
759 if (buf_get_u32(dcc_control
->value
, 1, 1) == 1) {
762 retval
= embeddedice_receive(jtag_info
, &request
, 1);
763 if (retval
!= ERROR_OK
)
765 retval
= target_request(target
, request
);
766 if (retval
!= ERROR_OK
)
775 * Polls an ARM7/9 target for its current status. If DBGACK is set, the target
776 * is manipulated to the right halted state based on its current state. This is
780 * <tr><th > State</th><th > Action</th></tr>
781 * <tr><td > TARGET_RUNNING | TARGET_RESET</td>
782 * <td > Enters debug mode. If TARGET_RESET, pc may be checked</td></tr>
783 * <tr><td > TARGET_UNKNOWN</td><td > Warning is logged</td></tr>
784 * <tr><td > TARGET_DEBUG_RUNNING</td><td > Enters debug mode</td></tr>
785 * <tr><td > TARGET_HALTED</td><td > Nothing</td></tr>
788 * If the target does not end up in the halted state, a warning is produced. If
789 * DBGACK is cleared, then the target is expected to either be running or
792 * @param target Pointer to the ARM7/9 target to poll
793 * @return ERROR_OK or an error status if a command fails
795 int arm7_9_poll(struct target
*target
)
798 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
799 struct reg
*dbg_stat
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_STAT
];
801 /* read debug status register */
802 embeddedice_read_reg(dbg_stat
);
803 retval
= jtag_execute_queue();
804 if (retval
!= ERROR_OK
)
807 if (buf_get_u32(dbg_stat
->value
, EICE_DBG_STATUS_DBGACK
, 1)) {
808 /* LOG_DEBUG("DBGACK set, dbg_state->value: 0x%x", buf_get_u32(dbg_stat->value, 0, *32));*/
809 if (target
->state
== TARGET_UNKNOWN
) {
810 /* Starting OpenOCD with target in debug-halt */
811 target
->state
= TARGET_RUNNING
;
812 LOG_DEBUG("DBGACK already set during server startup.");
814 if ((target
->state
== TARGET_RUNNING
) || (target
->state
== TARGET_RESET
)) {
815 target
->state
= TARGET_HALTED
;
817 retval
= arm7_9_debug_entry(target
);
818 if (retval
!= ERROR_OK
)
821 if (arm_semihosting(target
, &retval
) != 0)
824 retval
= target_call_event_callbacks(target
, TARGET_EVENT_HALTED
);
825 if (retval
!= ERROR_OK
)
828 if (target
->state
== TARGET_DEBUG_RUNNING
) {
829 target
->state
= TARGET_HALTED
;
830 retval
= arm7_9_debug_entry(target
);
831 if (retval
!= ERROR_OK
)
834 retval
= target_call_event_callbacks(target
, TARGET_EVENT_DEBUG_HALTED
);
835 if (retval
!= ERROR_OK
)
838 if (target
->state
!= TARGET_HALTED
)
840 "DBGACK set, but the target did not end up in the halted state %d",
843 if (target
->state
!= TARGET_DEBUG_RUNNING
)
844 target
->state
= TARGET_RUNNING
;
851 * Asserts the reset (SRST) on an ARM7/9 target. Some -S targets (ARM966E-S in
852 * the STR912 isn't affected, ARM926EJ-S in the LPC3180 and AT91SAM9260 is
853 * affected) completely stop the JTAG clock while the core is held in reset
854 * (SRST). It isn't possible to program the halt condition once reset is
855 * asserted, hence a hook that allows the target to set up its reset-halt
856 * condition is setup prior to asserting reset.
858 * @param target Pointer to an ARM7/9 target to assert reset on
859 * @return ERROR_FAIL if the JTAG device does not have SRST, otherwise ERROR_OK
861 int arm7_9_assert_reset(struct target
*target
)
863 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
864 enum reset_types jtag_reset_config
= jtag_get_reset_config();
865 bool use_event
= false;
867 /* TODO: apply hw reset signal in not examined state */
868 if (!(target_was_examined(target
))) {
869 LOG_WARNING("Reset is not asserted because the target is not examined.");
870 LOG_WARNING("Use a reset button or power cycle the target.");
871 return ERROR_TARGET_NOT_EXAMINED
;
874 LOG_DEBUG("target->state: %s", target_state_name(target
));
876 if (target_has_event_action(target
, TARGET_EVENT_RESET_ASSERT
))
878 else if (!(jtag_reset_config
& RESET_HAS_SRST
)) {
879 LOG_ERROR("%s: how to reset?", target_name(target
));
883 /* At this point trst has been asserted/deasserted once. We would
884 * like to program EmbeddedICE while SRST is asserted, instead of
885 * depending on SRST to leave that module alone. However, many CPUs
886 * gate the JTAG clock while SRST is asserted; or JTAG may need
887 * clock stability guarantees (adaptive clocking might help).
889 * So we assume JTAG access during SRST is off the menu unless it's
890 * been specifically enabled.
892 bool srst_asserted
= false;
894 if (!use_event
&& !(jtag_reset_config
& RESET_SRST_PULLS_TRST
)
895 && (jtag_reset_config
& RESET_SRST_NO_GATING
)) {
896 jtag_add_reset(0, 1);
897 srst_asserted
= true;
900 if (target
->reset_halt
) {
902 * For targets that don't support communication while SRST is
903 * asserted, we need to set up the reset vector catch first.
905 * When we use TRST+SRST and that's equivalent to a power-up
906 * reset, these settings may well be reset anyway; so setting
907 * them here won't matter.
909 if (arm7_9
->has_vector_catch
) {
910 /* program vector catch register to catch reset */
911 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_VEC_CATCH
], 0x1);
913 /* extra runtest added as issues were found with
914 * certain ARM9 cores (maybe more) - AT91SAM9260
917 jtag_add_runtest(1, TAP_IDLE
);
919 /* program watchpoint unit to match on reset vector
922 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_VALUE
], 0x0);
923 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
], 0x3);
924 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
], 0xffffffff);
925 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], EICE_W_CTRL_ENABLE
);
926 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
], ~EICE_W_CTRL_NOPC
& 0xff);
931 target_handle_event(target
, TARGET_EVENT_RESET_ASSERT
);
933 /* If we use SRST ... we'd like to issue just SRST, but the
934 * board or chip may be set up so we have to assert TRST as
935 * well. On some chips that combination is equivalent to a
936 * power-up reset, and generally clobbers EICE state.
938 if (jtag_reset_config
& RESET_SRST_PULLS_TRST
)
939 jtag_add_reset(1, 1);
940 else if (!srst_asserted
)
941 jtag_add_reset(0, 1);
942 jtag_add_sleep(50000);
945 target
->state
= TARGET_RESET
;
946 register_cache_invalidate(arm7_9
->arm
.core_cache
);
948 /* REVISIT why isn't standard debug entry logic sufficient?? */
949 if (target
->reset_halt
&& (!(jtag_reset_config
& RESET_SRST_PULLS_TRST
) || use_event
)) {
950 /* debug entry was prepared above */
951 target
->debug_reason
= DBG_REASON_DBGRQ
;
958 * Deassert the reset (SRST) signal on an ARM7/9 target. If SRST pulls TRST
959 * and the target is being reset into a halt, a warning will be triggered
960 * because it is not possible to reset into a halted mode in this case. The
961 * target is halted using the target's functions.
963 * @param target Pointer to the target to have the reset deasserted
964 * @return ERROR_OK or an error from polling or halting the target
966 int arm7_9_deassert_reset(struct target
*target
)
968 int retval
= ERROR_OK
;
969 LOG_DEBUG("target->state: %s", target_state_name(target
));
971 /* deassert reset lines */
972 jtag_add_reset(0, 0);
974 /* In case polling is disabled, we need to examine the
975 * target and poll here for this target to work correctly.
977 * Otherwise, e.g. halt will fail afterwards with bogus
978 * error messages as halt will believe that reset is
981 retval
= target_examine_one(target
);
982 if (retval
!= ERROR_OK
)
985 retval
= target_poll(target
);
986 if (retval
!= ERROR_OK
)
989 enum reset_types jtag_reset_config
= jtag_get_reset_config();
990 if (target
->reset_halt
&& (jtag_reset_config
& RESET_SRST_PULLS_TRST
) != 0) {
992 "srst pulls trst - can not reset into halted mode. Issuing halt after reset.");
993 retval
= target_halt(target
);
994 if (retval
!= ERROR_OK
)
1001 * Clears the halt condition for an ARM7/9 target. If it isn't coming out of
1002 * reset and if DBGRQ is used, it is programmed to be deasserted. If the reset
1003 * vector catch was used, it is restored. Otherwise, the control value is
1004 * restored and the watchpoint unit is restored if it was in use.
1006 * @param target Pointer to the ARM7/9 target to have halt cleared
1007 * @return Always ERROR_OK
1009 static int arm7_9_clear_halt(struct target
*target
)
1011 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1012 struct reg
*dbg_ctrl
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_CTRL
];
1014 /* we used DBGRQ only if we didn't come out of reset */
1015 if (!arm7_9
->debug_entry_from_reset
&& arm7_9
->use_dbgrq
) {
1016 /* program EmbeddedICE Debug Control Register to deassert DBGRQ
1018 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGRQ
, 1, 0);
1019 embeddedice_store_reg(dbg_ctrl
);
1021 if (arm7_9
->debug_entry_from_reset
&& arm7_9
->has_vector_catch
) {
1022 /* if we came out of reset, and vector catch is supported, we used
1023 * vector catch to enter debug state
1024 * restore the register in that case
1026 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_VEC_CATCH
]);
1028 /* restore registers if watchpoint unit 0 was in use
1030 if (arm7_9
->wp0_used
) {
1031 if (arm7_9
->debug_entry_from_reset
)
1032 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[
1033 EICE_W0_ADDR_VALUE
]);
1034 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[
1035 EICE_W0_ADDR_MASK
]);
1036 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[
1037 EICE_W0_DATA_MASK
]);
1038 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[
1039 EICE_W0_CONTROL_MASK
]);
1041 /* control value always has to be restored, as it was either disabled,
1042 * or enabled with possibly different bits
1044 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
]);
1052 * Issue a software reset and halt to an ARM7/9 target. The target is halted
1053 * and then there is a wait until the processor shows the halt. This wait can
1054 * timeout and results in an error being returned. The software reset involves
1055 * clearing the halt, updating the debug control register, changing to ARM mode,
1056 * reset of the program counter, and reset of all of the registers.
1058 * @param target Pointer to the ARM7/9 target to be reset and halted by software
1059 * @return Error status if any of the commands fail, otherwise ERROR_OK
1061 int arm7_9_soft_reset_halt(struct target
*target
)
1063 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1064 struct arm
*arm
= &arm7_9
->arm
;
1065 struct reg
*dbg_stat
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_STAT
];
1066 struct reg
*dbg_ctrl
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_CTRL
];
1070 /* FIX!!! replace some of this code with tcl commands
1072 * halt # the halt command is synchronous
1073 * armv4_5 core_state arm
1077 retval
= target_halt(target
);
1078 if (retval
!= ERROR_OK
)
1081 long long then
= timeval_ms();
1083 while (!(timeout
= ((timeval_ms()-then
) > 1000))) {
1084 if (buf_get_u32(dbg_stat
->value
, EICE_DBG_STATUS_DBGACK
, 1) != 0)
1086 embeddedice_read_reg(dbg_stat
);
1087 retval
= jtag_execute_queue();
1088 if (retval
!= ERROR_OK
)
1090 if (debug_level
>= 3)
1096 LOG_ERROR("Failed to halt CPU after 1 sec");
1097 return ERROR_TARGET_TIMEOUT
;
1099 target
->state
= TARGET_HALTED
;
1101 /* program EmbeddedICE Debug Control Register to assert DBGACK and INTDIS
1102 * ensure that DBGRQ is cleared
1104 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGACK
, 1, 1);
1105 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGRQ
, 1, 0);
1106 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_INTDIS
, 1, 1);
1107 embeddedice_store_reg(dbg_ctrl
);
1109 retval
= arm7_9_clear_halt(target
);
1110 if (retval
!= ERROR_OK
)
1113 /* if the target is in Thumb state, change to ARM state */
1114 if (buf_get_u32(dbg_stat
->value
, EICE_DBG_STATUS_ITBIT
, 1)) {
1115 uint32_t r0_thumb
, pc_thumb
;
1116 LOG_DEBUG("target entered debug from Thumb state, changing to ARM");
1117 /* Entered debug from Thumb mode */
1118 arm
->core_state
= ARM_STATE_THUMB
;
1119 arm7_9
->change_to_arm(target
, &r0_thumb
, &pc_thumb
);
1122 /* REVISIT likewise for bit 5 -- switch Jazelle-to-ARM */
1124 /* all register content is now invalid */
1125 register_cache_invalidate(arm
->core_cache
);
1127 /* SVC, ARM state, IRQ and FIQ disabled */
1130 cpsr
= buf_get_u32(arm
->cpsr
->value
, 0, 32);
1133 arm_set_cpsr(arm
, cpsr
);
1134 arm
->cpsr
->dirty
= true;
1136 /* start fetching from 0x0 */
1137 buf_set_u32(arm
->pc
->value
, 0, 32, 0x0);
1138 arm
->pc
->dirty
= true;
1139 arm
->pc
->valid
= true;
1141 /* reset registers */
1142 for (i
= 0; i
<= 14; i
++) {
1143 struct reg
*r
= arm_reg_current(arm
, i
);
1145 buf_set_u32(r
->value
, 0, 32, 0xffffffff);
1150 retval
= target_call_event_callbacks(target
, TARGET_EVENT_HALTED
);
1151 if (retval
!= ERROR_OK
)
1158 * Halt an ARM7/9 target. This is accomplished by either asserting the DBGRQ
1159 * line or by programming a watchpoint to trigger on any address. It is
1160 * considered a bug to call this function while the target is in the
1161 * TARGET_RESET state.
1163 * @param target Pointer to the ARM7/9 target to be halted
1164 * @return Always ERROR_OK
1166 int arm7_9_halt(struct target
*target
)
1168 if (target
->state
== TARGET_RESET
) {
1170 "BUG: arm7/9 does not support halt during reset. This is handled in arm7_9_assert_reset()");
1174 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1175 struct reg
*dbg_ctrl
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_CTRL
];
1177 LOG_DEBUG("target->state: %s",
1178 target_state_name(target
));
1180 if (target
->state
== TARGET_HALTED
) {
1181 LOG_DEBUG("target was already halted");
1185 if (target
->state
== TARGET_UNKNOWN
)
1186 LOG_WARNING("target was in unknown state when halt was requested");
1188 if (arm7_9
->use_dbgrq
) {
1189 /* program EmbeddedICE Debug Control Register to assert DBGRQ
1191 if (arm7_9
->set_special_dbgrq
)
1192 arm7_9
->set_special_dbgrq(target
);
1194 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGRQ
, 1, 1);
1195 embeddedice_store_reg(dbg_ctrl
);
1198 /* program watchpoint unit to match on any address
1200 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
], 0xffffffff);
1201 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
], 0xffffffff);
1202 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
],
1203 EICE_W_CTRL_ENABLE
);
1204 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
],
1205 ~EICE_W_CTRL_NOPC
& 0xff);
1208 target
->debug_reason
= DBG_REASON_DBGRQ
;
1214 * Handle an ARM7/9 target's entry into debug mode. The halt is cleared on the
1215 * ARM. The JTAG queue is then executed and the reason for debug entry is
1216 * examined. Once done, the target is verified to be halted and the processor
1217 * is forced into ARM mode. The core registers are saved for the current core
1218 * mode and the program counter (register 15) is updated as needed. The core
1219 * registers and CPSR and SPSR are saved for restoration later.
1221 * @param target Pointer to target that is entering debug mode
1222 * @return Error code if anything fails, otherwise ERROR_OK
1224 static int arm7_9_debug_entry(struct target
*target
)
1227 uint32_t context
[16];
1228 uint32_t *context_p
[16];
1229 uint32_t r0_thumb
, pc_thumb
;
1230 uint32_t cpsr
, cpsr_mask
= 0;
1232 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1233 struct arm
*arm
= &arm7_9
->arm
;
1234 struct reg
*dbg_stat
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_STAT
];
1235 struct reg
*dbg_ctrl
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_CTRL
];
1237 #ifdef _DEBUG_ARM7_9_
1241 /* program EmbeddedICE Debug Control Register to assert DBGACK and INTDIS
1242 * ensure that DBGRQ is cleared
1244 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGACK
, 1, 1);
1245 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGRQ
, 1, 0);
1246 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_INTDIS
, 1, 1);
1247 embeddedice_store_reg(dbg_ctrl
);
1249 retval
= arm7_9_clear_halt(target
);
1250 if (retval
!= ERROR_OK
)
1253 retval
= jtag_execute_queue();
1254 if (retval
!= ERROR_OK
)
1257 retval
= arm7_9
->examine_debug_reason(target
);
1258 if (retval
!= ERROR_OK
)
1261 if (target
->state
!= TARGET_HALTED
) {
1262 LOG_WARNING("target not halted");
1263 return ERROR_TARGET_NOT_HALTED
;
1266 /* if the target is in Thumb state, change to ARM state */
1267 if (buf_get_u32(dbg_stat
->value
, EICE_DBG_STATUS_ITBIT
, 1)) {
1268 LOG_DEBUG("target entered debug from Thumb state");
1269 /* Entered debug from Thumb mode */
1270 arm
->core_state
= ARM_STATE_THUMB
;
1272 arm7_9
->change_to_arm(target
, &r0_thumb
, &pc_thumb
);
1273 LOG_DEBUG("r0_thumb: 0x%8.8" PRIx32
1274 ", pc_thumb: 0x%8.8" PRIx32
, r0_thumb
, pc_thumb
);
1275 } else if (buf_get_u32(dbg_stat
->value
, 5, 1)) {
1276 /* \todo Get some vaguely correct handling of Jazelle, if
1277 * anyone ever uses it and full info becomes available.
1278 * See ARM9EJS TRM B.7.1 for how to switch J->ARM; and
1279 * B.7.3 for the reverse. That'd be the bare minimum...
1281 LOG_DEBUG("target entered debug from Jazelle state");
1282 arm
->core_state
= ARM_STATE_JAZELLE
;
1283 cpsr_mask
= 1 << 24;
1284 LOG_ERROR("Jazelle debug entry -- BROKEN!");
1286 LOG_DEBUG("target entered debug from ARM state");
1287 /* Entered debug from ARM mode */
1288 arm
->core_state
= ARM_STATE_ARM
;
1291 for (i
= 0; i
< 16; i
++)
1292 context_p
[i
] = &context
[i
];
1293 /* save core registers (r0 - r15 of current core mode) */
1294 arm7_9
->read_core_regs(target
, 0xffff, context_p
);
1296 arm7_9
->read_xpsr(target
, &cpsr
, 0);
1298 retval
= jtag_execute_queue();
1299 if (retval
!= ERROR_OK
)
1302 /* Sync our CPSR copy with J or T bits EICE reported, but
1303 * which we then erased by putting the core into ARM mode.
1305 arm_set_cpsr(arm
, cpsr
| cpsr_mask
);
1307 if (!is_arm_mode(arm
->core_mode
)) {
1308 target
->state
= TARGET_UNKNOWN
;
1309 LOG_ERROR("cpsr contains invalid mode value - communication failure");
1310 return ERROR_TARGET_FAILURE
;
1313 LOG_DEBUG("target entered debug state in %s mode",
1314 arm_mode_name(arm
->core_mode
));
1316 if (arm
->core_state
== ARM_STATE_THUMB
) {
1317 LOG_DEBUG("thumb state, applying fixups");
1318 context
[0] = r0_thumb
;
1319 context
[15] = pc_thumb
;
1320 } else if (arm
->core_state
== ARM_STATE_ARM
) {
1321 /* adjust value stored by STM */
1322 context
[15] -= 3 * 4;
1325 if ((target
->debug_reason
!= DBG_REASON_DBGRQ
) || (!arm7_9
->use_dbgrq
))
1326 context
[15] -= 3 * ((arm
->core_state
== ARM_STATE_ARM
) ? 4 : 2);
1328 context
[15] -= arm7_9
->dbgreq_adjust_pc
*
1329 ((arm
->core_state
== ARM_STATE_ARM
) ? 4 : 2);
1331 for (i
= 0; i
<= 15; i
++) {
1332 struct reg
*r
= arm_reg_current(arm
, i
);
1334 LOG_DEBUG("r%i: 0x%8.8" PRIx32
"", i
, context
[i
]);
1336 buf_set_u32(r
->value
, 0, 32, context
[i
]);
1337 /* r0 and r15 (pc) have to be restored later */
1338 r
->dirty
= (i
== 0) || (i
== 15);
1342 LOG_DEBUG("entered debug state at PC 0x%" PRIx32
"", context
[15]);
1344 /* exceptions other than USR & SYS have a saved program status register */
1347 arm7_9
->read_xpsr(target
, &spsr
, 1);
1348 retval
= jtag_execute_queue();
1349 if (retval
!= ERROR_OK
)
1351 buf_set_u32(arm
->spsr
->value
, 0, 32, spsr
);
1352 arm
->spsr
->dirty
= false;
1353 arm
->spsr
->valid
= true;
1356 retval
= jtag_execute_queue();
1357 if (retval
!= ERROR_OK
)
1360 if (arm7_9
->post_debug_entry
) {
1361 retval
= arm7_9
->post_debug_entry(target
);
1362 if (retval
!= ERROR_OK
)
1370 * Validate the full context for an ARM7/9 target in all processor modes. If
1371 * there are any invalid registers for the target, they will all be read. This
1374 * @param target Pointer to the ARM7/9 target to capture the full context from
1375 * @return Error if the target is not halted, has an invalid core mode, or if
1376 * the JTAG queue fails to execute
1378 static int arm7_9_full_context(struct target
*target
)
1382 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1383 struct arm
*arm
= &arm7_9
->arm
;
1387 } read_cache
[6 * (16 + 1)];
1388 int read_cache_idx
= 0;
1392 if (target
->state
!= TARGET_HALTED
) {
1393 LOG_WARNING("target not halted");
1394 return ERROR_TARGET_NOT_HALTED
;
1397 if (!is_arm_mode(arm
->core_mode
)) {
1398 LOG_ERROR("not a valid arm core mode - communication failure?");
1402 /* iterate through processor modes (User, FIQ, IRQ, SVC, ABT, UND)
1403 * SYS shares registers with User, so we don't touch SYS
1405 for (i
= 0; i
< 6; i
++) {
1407 uint32_t *reg_p
[16];
1411 /* check if there are invalid registers in the current mode
1413 for (j
= 0; j
<= 16; j
++) {
1414 if (!ARMV4_5_CORE_REG_MODE(arm
->core_cache
, armv4_5_number_to_mode(i
), j
).valid
)
1421 /* change processor mode (and mask T bit) */
1422 tmp_cpsr
= buf_get_u32(arm
->cpsr
->value
, 0, 8)
1424 tmp_cpsr
|= armv4_5_number_to_mode(i
);
1426 arm7_9
->write_xpsr_im8(target
, tmp_cpsr
& 0xff, 0, 0);
1428 for (j
= 0; j
< 15; j
++) {
1429 if (!ARMV4_5_CORE_REG_MODE(arm
->core_cache
,
1430 armv4_5_number_to_mode(i
), j
).valid
) {
1431 read_cache
[read_cache_idx
].reg_p
= ARMV4_5_CORE_REG_MODE(
1433 armv4_5_number_to_mode(i
),
1435 reg_p
[j
] = &read_cache
[read_cache_idx
].value
;
1438 ARMV4_5_CORE_REG_MODE(arm
->core_cache
,
1439 armv4_5_number_to_mode(i
),
1441 ARMV4_5_CORE_REG_MODE(arm
->core_cache
,
1442 armv4_5_number_to_mode(i
),
1447 /* if only the PSR is invalid, mask is all zeroes */
1449 arm7_9
->read_core_regs(target
, mask
, reg_p
);
1451 /* check if the PSR has to be read */
1452 if (!ARMV4_5_CORE_REG_MODE(arm
->core_cache
, armv4_5_number_to_mode(i
),
1454 read_cache
[read_cache_idx
].reg_p
= ARMV4_5_CORE_REG_MODE(arm
->core_cache
,
1455 armv4_5_number_to_mode(i
), 16).value
;
1456 arm7_9
->read_xpsr(target
, &read_cache
[read_cache_idx
].value
, 1);
1458 ARMV4_5_CORE_REG_MODE(arm
->core_cache
, armv4_5_number_to_mode(i
),
1460 ARMV4_5_CORE_REG_MODE(arm
->core_cache
, armv4_5_number_to_mode(i
),
1466 /* restore processor mode (mask T bit) */
1467 arm7_9
->write_xpsr_im8(target
,
1468 buf_get_u32(arm
->cpsr
->value
, 0, 8) & ~0x20, 0, 0);
1470 retval
= jtag_execute_queue();
1471 if (retval
!= ERROR_OK
)
1474 * FIXME: regs in cache should be tagged as 'valid' only now,
1475 * not before the jtag_execute_queue()
1477 while (read_cache_idx
) {
1479 buf_set_u32(read_cache
[read_cache_idx
].reg_p
, 0, 32, read_cache
[read_cache_idx
].value
);
1485 * Restore the processor context on an ARM7/9 target. The full processor
1486 * context is analyzed to see if any of the registers are dirty on this end, but
1487 * have a valid new value. If this is the case, the processor is changed to the
1488 * appropriate mode and the new register values are written out to the
1489 * processor. If there happens to be a dirty register with an invalid value, an
1490 * error will be logged.
1492 * @param target Pointer to the ARM7/9 target to have its context restored
1493 * @return Error status if the target is not halted or the core mode in the
1494 * armv4_5 struct is invalid.
1496 static int arm7_9_restore_context(struct target
*target
)
1498 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1499 struct arm
*arm
= &arm7_9
->arm
;
1501 enum arm_mode current_mode
= arm
->core_mode
;
1508 if (target
->state
!= TARGET_HALTED
) {
1509 LOG_WARNING("target not halted");
1510 return ERROR_TARGET_NOT_HALTED
;
1513 if (arm7_9
->pre_restore_context
)
1514 arm7_9
->pre_restore_context(target
);
1516 if (!is_arm_mode(arm
->core_mode
)) {
1517 LOG_ERROR("not a valid arm core mode - communication failure?");
1521 /* iterate through processor modes (User, FIQ, IRQ, SVC, ABT, UND)
1522 * SYS shares registers with User, so we don't touch SYS
1524 for (i
= 0; i
< 6; i
++) {
1525 LOG_DEBUG("examining %s mode",
1526 arm_mode_name(arm
->core_mode
));
1529 /* check if there are dirty registers in the current mode
1531 for (j
= 0; j
<= 16; j
++) {
1532 reg
= &ARMV4_5_CORE_REG_MODE(arm
->core_cache
, armv4_5_number_to_mode(i
), j
);
1536 LOG_DEBUG("examining dirty reg: %s", reg
->name
);
1537 struct arm_reg
*reg_arch_info
;
1538 reg_arch_info
= reg
->arch_info
;
1539 if ((reg_arch_info
->mode
!= ARM_MODE_ANY
)
1540 && (reg_arch_info
->mode
!= current_mode
)
1541 && !((reg_arch_info
->mode
== ARM_MODE_USR
)
1542 && (arm
->core_mode
== ARM_MODE_SYS
))
1543 && !((reg_arch_info
->mode
== ARM_MODE_SYS
)
1544 && (arm
->core_mode
== ARM_MODE_USR
))) {
1546 LOG_DEBUG("require mode change");
1549 LOG_ERROR("BUG: dirty register '%s', but no valid data",
1555 uint32_t mask
= 0x0;
1561 /* change processor mode (mask T bit) */
1562 tmp_cpsr
= buf_get_u32(arm
->cpsr
->value
,
1564 tmp_cpsr
|= armv4_5_number_to_mode(i
);
1566 arm7_9
->write_xpsr_im8(target
, tmp_cpsr
& 0xff, 0, 0);
1567 current_mode
= armv4_5_number_to_mode(i
);
1570 for (j
= 0; j
<= 14; j
++) {
1571 reg
= &ARMV4_5_CORE_REG_MODE(arm
->core_cache
,
1572 armv4_5_number_to_mode(i
),
1576 regs
[j
] = buf_get_u32(reg
->value
, 0, 32);
1580 LOG_DEBUG("writing register %i mode %s "
1581 "with value 0x%8.8" PRIx32
, j
,
1582 arm_mode_name(arm
->core_mode
),
1588 arm7_9
->write_core_regs(target
, mask
, regs
);
1591 &ARMV4_5_CORE_REG_MODE(arm
->core_cache
, armv4_5_number_to_mode(
1593 struct arm_reg
*reg_arch_info
;
1594 reg_arch_info
= reg
->arch_info
;
1595 if ((reg
->dirty
) && (reg_arch_info
->mode
!= ARM_MODE_ANY
)) {
1596 LOG_DEBUG("writing SPSR of mode %i with value 0x%8.8" PRIx32
"",
1598 buf_get_u32(reg
->value
, 0, 32));
1599 arm7_9
->write_xpsr(target
, buf_get_u32(reg
->value
, 0, 32), 1);
1604 if (!arm
->cpsr
->dirty
&& (arm
->core_mode
!= current_mode
)) {
1605 /* restore processor mode (mask T bit) */
1608 tmp_cpsr
= buf_get_u32(arm
->cpsr
->value
, 0, 8) & 0xE0;
1609 tmp_cpsr
|= armv4_5_number_to_mode(i
);
1611 LOG_DEBUG("writing lower 8 bit of cpsr with value 0x%2.2x", (unsigned)(tmp_cpsr
));
1612 arm7_9
->write_xpsr_im8(target
, tmp_cpsr
& 0xff, 0, 0);
1614 } else if (arm
->cpsr
->dirty
) {
1615 /* CPSR has been changed, full restore necessary (mask T bit) */
1616 LOG_DEBUG("writing cpsr with value 0x%8.8" PRIx32
,
1617 buf_get_u32(arm
->cpsr
->value
, 0, 32));
1618 arm7_9
->write_xpsr(target
,
1619 buf_get_u32(arm
->cpsr
->value
, 0, 32)
1621 arm
->cpsr
->dirty
= false;
1622 arm
->cpsr
->valid
= true;
1626 LOG_DEBUG("writing PC with value 0x%8.8" PRIx32
,
1627 buf_get_u32(arm
->pc
->value
, 0, 32));
1628 arm7_9
->write_pc(target
, buf_get_u32(arm
->pc
->value
, 0, 32));
1629 arm
->pc
->dirty
= false;
1635 * Restart the core of an ARM7/9 target. A RESTART command is sent to the
1636 * instruction register and the JTAG state is set to TAP_IDLE causing a core
1639 * @param target Pointer to the ARM7/9 target to be restarted
1640 * @return Result of executing the JTAG queue
1642 static int arm7_9_restart_core(struct target
*target
)
1644 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1645 struct arm_jtag
*jtag_info
= &arm7_9
->jtag_info
;
1648 /* set RESTART instruction */
1649 if (arm7_9
->need_bypass_before_restart
) {
1650 arm7_9
->need_bypass_before_restart
= 0;
1652 retval
= arm_jtag_set_instr(jtag_info
->tap
, 0xf, NULL
, TAP_IDLE
);
1653 if (retval
!= ERROR_OK
)
1656 retval
= arm_jtag_set_instr(jtag_info
->tap
, 0x4, NULL
, TAP_IDLE
);
1657 if (retval
!= ERROR_OK
)
1660 jtag_add_runtest(1, TAP_IDLE
);
1661 return jtag_execute_queue();
1665 * Enable the watchpoints on an ARM7/9 target. The target's watchpoints are
1666 * iterated through and are set on the target if they aren't already set.
1668 * @param target Pointer to the ARM7/9 target to enable watchpoints on
1670 static void arm7_9_enable_watchpoints(struct target
*target
)
1672 struct watchpoint
*watchpoint
= target
->watchpoints
;
1674 while (watchpoint
) {
1675 if (!watchpoint
->is_set
)
1676 arm7_9_set_watchpoint(target
, watchpoint
);
1677 watchpoint
= watchpoint
->next
;
1682 * Enable the breakpoints on an ARM7/9 target. The target's breakpoints are
1683 * iterated through and are set on the target.
1685 * @param target Pointer to the ARM7/9 target to enable breakpoints on
1687 static void arm7_9_enable_breakpoints(struct target
*target
)
1689 struct breakpoint
*breakpoint
= target
->breakpoints
;
1691 /* set any pending breakpoints */
1692 while (breakpoint
) {
1693 arm7_9_set_breakpoint(target
, breakpoint
);
1694 breakpoint
= breakpoint
->next
;
1698 int arm7_9_resume(struct target
*target
,
1700 target_addr_t address
,
1701 int handle_breakpoints
,
1702 int debug_execution
)
1704 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1705 struct arm
*arm
= &arm7_9
->arm
;
1706 struct reg
*dbg_ctrl
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_CTRL
];
1707 int err
, retval
= ERROR_OK
;
1711 if (target
->state
!= TARGET_HALTED
) {
1712 LOG_WARNING("target not halted");
1713 return ERROR_TARGET_NOT_HALTED
;
1716 if (!debug_execution
)
1717 target_free_all_working_areas(target
);
1719 /* current = 1: continue on current pc, otherwise continue at <address> */
1721 buf_set_u32(arm
->pc
->value
, 0, 32, address
);
1723 uint32_t current_pc
;
1724 current_pc
= buf_get_u32(arm
->pc
->value
, 0, 32);
1726 /* the front-end may request us not to handle breakpoints */
1727 if (handle_breakpoints
) {
1728 struct breakpoint
*breakpoint
;
1729 breakpoint
= breakpoint_find(target
,
1730 buf_get_u32(arm
->pc
->value
, 0, 32));
1732 LOG_DEBUG("unset breakpoint at 0x%8.8" TARGET_PRIxADDR
" (id: %" PRIu32
,
1733 breakpoint
->address
,
1734 breakpoint
->unique_id
);
1735 retval
= arm7_9_unset_breakpoint(target
, breakpoint
);
1736 if (retval
!= ERROR_OK
)
1739 /* calculate PC of next instruction */
1741 retval
= arm_simulate_step(target
, &next_pc
);
1742 if (retval
!= ERROR_OK
) {
1743 uint32_t current_opcode
;
1744 target_read_u32(target
, current_pc
, ¤t_opcode
);
1746 "Couldn't calculate PC of next instruction, current opcode was 0x%8.8" PRIx32
"",
1751 LOG_DEBUG("enable single-step");
1752 arm7_9
->enable_single_step(target
, next_pc
);
1754 target
->debug_reason
= DBG_REASON_SINGLESTEP
;
1756 retval
= arm7_9_restore_context(target
);
1757 if (retval
!= ERROR_OK
)
1760 if (arm
->core_state
== ARM_STATE_ARM
)
1761 arm7_9
->branch_resume(target
);
1762 else if (arm
->core_state
== ARM_STATE_THUMB
)
1763 arm7_9
->branch_resume_thumb(target
);
1765 LOG_ERROR("unhandled core state");
1769 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGACK
, 1, 0);
1770 embeddedice_write_reg(dbg_ctrl
,
1771 buf_get_u32(dbg_ctrl
->value
, 0, dbg_ctrl
->size
));
1772 err
= arm7_9_execute_sys_speed(target
);
1774 LOG_DEBUG("disable single-step");
1775 arm7_9
->disable_single_step(target
);
1777 if (err
!= ERROR_OK
) {
1778 retval
= arm7_9_set_breakpoint(target
, breakpoint
);
1779 if (retval
!= ERROR_OK
)
1781 target
->state
= TARGET_UNKNOWN
;
1785 retval
= arm7_9_debug_entry(target
);
1786 if (retval
!= ERROR_OK
)
1788 LOG_DEBUG("new PC after step: 0x%8.8" PRIx32
,
1789 buf_get_u32(arm
->pc
->value
, 0, 32));
1791 LOG_DEBUG("set breakpoint at 0x%8.8" TARGET_PRIxADDR
"", breakpoint
->address
);
1792 retval
= arm7_9_set_breakpoint(target
, breakpoint
);
1793 if (retval
!= ERROR_OK
)
1798 /* enable any pending breakpoints and watchpoints */
1799 arm7_9_enable_breakpoints(target
);
1800 arm7_9_enable_watchpoints(target
);
1802 retval
= arm7_9_restore_context(target
);
1803 if (retval
!= ERROR_OK
)
1806 if (arm
->core_state
== ARM_STATE_ARM
)
1807 arm7_9
->branch_resume(target
);
1808 else if (arm
->core_state
== ARM_STATE_THUMB
)
1809 arm7_9
->branch_resume_thumb(target
);
1811 LOG_ERROR("unhandled core state");
1815 /* deassert DBGACK and INTDIS */
1816 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGACK
, 1, 0);
1817 /* INTDIS only when we really resume, not during debug execution */
1818 if (!debug_execution
)
1819 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_INTDIS
, 1, 0);
1820 embeddedice_write_reg(dbg_ctrl
, buf_get_u32(dbg_ctrl
->value
, 0, dbg_ctrl
->size
));
1822 retval
= arm7_9_restart_core(target
);
1823 if (retval
!= ERROR_OK
)
1826 target
->debug_reason
= DBG_REASON_NOTHALTED
;
1828 if (!debug_execution
) {
1829 /* registers are now invalid */
1830 register_cache_invalidate(arm
->core_cache
);
1831 target
->state
= TARGET_RUNNING
;
1832 retval
= target_call_event_callbacks(target
, TARGET_EVENT_RESUMED
);
1833 if (retval
!= ERROR_OK
)
1836 target
->state
= TARGET_DEBUG_RUNNING
;
1837 retval
= target_call_event_callbacks(target
, TARGET_EVENT_DEBUG_RESUMED
);
1838 if (retval
!= ERROR_OK
)
1842 LOG_DEBUG("target resumed");
1847 void arm7_9_enable_eice_step(struct target
*target
, uint32_t next_pc
)
1849 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1850 struct arm
*arm
= &arm7_9
->arm
;
1851 uint32_t current_pc
;
1852 current_pc
= buf_get_u32(arm
->pc
->value
, 0, 32);
1854 if (next_pc
!= current_pc
) {
1855 /* setup an inverse breakpoint on the current PC
1856 * - comparator 1 matches the current address
1857 * - rangeout from comparator 1 is connected to comparator 0 rangein
1858 * - comparator 0 matches any address, as long as rangein is low */
1859 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
], 0xffffffff);
1860 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
], 0xffffffff);
1861 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
],
1862 EICE_W_CTRL_ENABLE
);
1863 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
],
1864 ~(EICE_W_CTRL_RANGE
| EICE_W_CTRL_NOPC
) & 0xff);
1865 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_VALUE
],
1867 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_MASK
], 0);
1868 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_DATA_MASK
], 0xffffffff);
1869 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
], 0x0);
1870 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_MASK
],
1871 ~EICE_W_CTRL_NOPC
& 0xff);
1873 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
], 0xffffffff);
1874 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
], 0xffffffff);
1875 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], 0x0);
1876 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
], 0xff);
1877 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_VALUE
], next_pc
);
1878 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_MASK
], 0);
1879 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_DATA_MASK
], 0xffffffff);
1880 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
],
1881 EICE_W_CTRL_ENABLE
);
1882 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_MASK
],
1883 ~EICE_W_CTRL_NOPC
& 0xff);
1887 void arm7_9_disable_eice_step(struct target
*target
)
1889 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1891 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
]);
1892 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
]);
1893 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
]);
1894 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
]);
1895 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_VALUE
]);
1896 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_MASK
]);
1897 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_DATA_MASK
]);
1898 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_MASK
]);
1899 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
]);
1902 int arm7_9_step(struct target
*target
, int current
, target_addr_t address
, int handle_breakpoints
)
1904 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1905 struct arm
*arm
= &arm7_9
->arm
;
1906 struct breakpoint
*breakpoint
= NULL
;
1909 if (target
->state
!= TARGET_HALTED
) {
1910 LOG_WARNING("target not halted");
1911 return ERROR_TARGET_NOT_HALTED
;
1914 /* current = 1: continue on current pc, otherwise continue at <address> */
1916 buf_set_u32(arm
->pc
->value
, 0, 32, address
);
1918 uint32_t current_pc
= buf_get_u32(arm
->pc
->value
, 0, 32);
1920 /* the front-end may request us not to handle breakpoints */
1921 if (handle_breakpoints
)
1922 breakpoint
= breakpoint_find(target
, current_pc
);
1924 retval
= arm7_9_unset_breakpoint(target
, breakpoint
);
1925 if (retval
!= ERROR_OK
)
1929 target
->debug_reason
= DBG_REASON_SINGLESTEP
;
1931 /* calculate PC of next instruction */
1933 retval
= arm_simulate_step(target
, &next_pc
);
1934 if (retval
!= ERROR_OK
) {
1935 uint32_t current_opcode
;
1936 target_read_u32(target
, current_pc
, ¤t_opcode
);
1938 "Couldn't calculate PC of next instruction, current opcode was 0x%8.8" PRIx32
"",
1943 retval
= arm7_9_restore_context(target
);
1944 if (retval
!= ERROR_OK
)
1947 arm7_9
->enable_single_step(target
, next_pc
);
1949 if (arm
->core_state
== ARM_STATE_ARM
)
1950 arm7_9
->branch_resume(target
);
1951 else if (arm
->core_state
== ARM_STATE_THUMB
)
1952 arm7_9
->branch_resume_thumb(target
);
1954 LOG_ERROR("unhandled core state");
1958 retval
= target_call_event_callbacks(target
, TARGET_EVENT_RESUMED
);
1959 if (retval
!= ERROR_OK
)
1962 err
= arm7_9_execute_sys_speed(target
);
1963 arm7_9
->disable_single_step(target
);
1965 /* registers are now invalid */
1966 register_cache_invalidate(arm
->core_cache
);
1968 if (err
!= ERROR_OK
)
1969 target
->state
= TARGET_UNKNOWN
;
1971 retval
= arm7_9_debug_entry(target
);
1972 if (retval
!= ERROR_OK
)
1974 retval
= target_call_event_callbacks(target
, TARGET_EVENT_HALTED
);
1975 if (retval
!= ERROR_OK
)
1977 LOG_DEBUG("target stepped");
1981 retval
= arm7_9_set_breakpoint(target
, breakpoint
);
1982 if (retval
!= ERROR_OK
)
1989 static int arm7_9_read_core_reg(struct target
*target
, struct reg
*r
,
1990 int num
, enum arm_mode mode
)
1992 uint32_t *reg_p
[16];
1994 struct arm_reg
*areg
= r
->arch_info
;
1995 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1996 struct arm
*arm
= &arm7_9
->arm
;
1998 if (!is_arm_mode(arm
->core_mode
))
2000 if ((num
< 0) || (num
> 16))
2001 return ERROR_COMMAND_SYNTAX_ERROR
;
2003 if ((mode
!= ARM_MODE_ANY
) && (mode
!= arm
->core_mode
)
2004 && (areg
->mode
!= ARM_MODE_ANY
)) {
2007 /* change processor mode (mask T bit) */
2008 tmp_cpsr
= buf_get_u32(arm
->cpsr
->value
, 0, 8) & 0xE0;
2011 arm7_9
->write_xpsr_im8(target
, tmp_cpsr
& 0xff, 0, 0);
2015 if ((num
>= 0) && (num
<= 15)) {
2016 /* read a normal core register */
2017 reg_p
[num
] = &value
;
2019 arm7_9
->read_core_regs(target
, 1 << num
, reg_p
);
2021 /* read a program status register
2022 * if the register mode is MODE_ANY, we read the cpsr, otherwise a spsr
2024 arm7_9
->read_xpsr(target
, &value
, areg
->mode
!= ARM_MODE_ANY
);
2027 retval
= jtag_execute_queue();
2028 if (retval
!= ERROR_OK
)
2033 buf_set_u32(r
->value
, 0, 32, value
);
2035 if ((mode
!= ARM_MODE_ANY
) && (mode
!= arm
->core_mode
)
2036 && (areg
->mode
!= ARM_MODE_ANY
)) {
2037 /* restore processor mode (mask T bit) */
2038 arm7_9
->write_xpsr_im8(target
,
2039 buf_get_u32(arm
->cpsr
->value
, 0, 8) & ~0x20, 0, 0);
2045 static int arm7_9_write_core_reg(struct target
*target
, struct reg
*r
,
2046 int num
, enum arm_mode mode
, uint8_t *value
)
2049 struct arm_reg
*areg
= r
->arch_info
;
2050 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2051 struct arm
*arm
= &arm7_9
->arm
;
2053 if (!is_arm_mode(arm
->core_mode
))
2055 if ((num
< 0) || (num
> 16))
2056 return ERROR_COMMAND_SYNTAX_ERROR
;
2058 if ((mode
!= ARM_MODE_ANY
) && (mode
!= arm
->core_mode
)
2059 && (areg
->mode
!= ARM_MODE_ANY
)) {
2062 /* change processor mode (mask T bit) */
2063 tmp_cpsr
= buf_get_u32(arm
->cpsr
->value
, 0, 8) & 0xE0;
2066 arm7_9
->write_xpsr_im8(target
, tmp_cpsr
& 0xff, 0, 0);
2069 if ((num
>= 0) && (num
<= 15)) {
2070 /* write a normal core register */
2071 reg
[num
] = buf_get_u32(value
, 0, 32);
2073 arm7_9
->write_core_regs(target
, 1 << num
, reg
);
2075 /* write a program status register
2076 * if the register mode is MODE_ANY, we write the cpsr, otherwise a spsr
2078 int spsr
= (areg
->mode
!= ARM_MODE_ANY
);
2080 uint32_t t
= buf_get_u32(value
, 0, 32);
2081 /* if we're writing the CPSR, mask the T bit */
2085 arm7_9
->write_xpsr(target
, t
, spsr
);
2091 if ((mode
!= ARM_MODE_ANY
) && (mode
!= arm
->core_mode
)
2092 && (areg
->mode
!= ARM_MODE_ANY
)) {
2093 /* restore processor mode (mask T bit) */
2094 arm7_9
->write_xpsr_im8(target
,
2095 buf_get_u32(arm
->cpsr
->value
, 0, 8) & ~0x20, 0, 0);
2098 return jtag_execute_queue();
2101 int arm7_9_read_memory(struct target
*target
,
2102 target_addr_t address
,
2107 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2108 struct arm
*arm
= &arm7_9
->arm
;
2110 uint32_t num_accesses
= 0;
2111 int thisrun_accesses
;
2117 LOG_DEBUG("address: 0x%8.8" TARGET_PRIxADDR
", size: 0x%8.8" PRIx32
", count: 0x%8.8" PRIx32
"",
2118 address
, size
, count
);
2120 if (target
->state
!= TARGET_HALTED
) {
2121 LOG_WARNING("target not halted");
2122 return ERROR_TARGET_NOT_HALTED
;
2125 /* sanitize arguments */
2126 if (((size
!= 4) && (size
!= 2) && (size
!= 1)) || (count
== 0) || !(buffer
))
2127 return ERROR_COMMAND_SYNTAX_ERROR
;
2129 if (((size
== 4) && (address
& 0x3u
)) || ((size
== 2) && (address
& 0x1u
)))
2130 return ERROR_TARGET_UNALIGNED_ACCESS
;
2132 /* load the base register with the address of the first word */
2134 arm7_9
->write_core_regs(target
, 0x1, reg
);
2140 while (num_accesses
< count
) {
2143 ((count
- num_accesses
) >= 14) ? 14 : (count
- num_accesses
);
2144 reg_list
= (0xffff >> (15 - thisrun_accesses
)) & 0xfffe;
2146 if (last_reg
<= thisrun_accesses
)
2147 last_reg
= thisrun_accesses
;
2149 arm7_9
->load_word_regs(target
, reg_list
);
2151 /* fast memory reads are only safe when the target is running
2152 * from a sufficiently high clock (32 kHz is usually too slow)
2154 if (arm7_9
->fast_memory_access
)
2155 retval
= arm7_9_execute_fast_sys_speed(target
);
2157 retval
= arm7_9_execute_sys_speed(target
);
2158 if (retval
!= ERROR_OK
)
2161 arm7_9
->read_core_regs_target_buffer(target
, reg_list
, buffer
, 4);
2163 /* advance buffer, count number of accesses */
2164 buffer
+= thisrun_accesses
* 4;
2165 num_accesses
+= thisrun_accesses
;
2167 if ((j
++%1024) == 0)
2172 while (num_accesses
< count
) {
2175 ((count
- num_accesses
) >= 14) ? 14 : (count
- num_accesses
);
2176 reg_list
= (0xffff >> (15 - thisrun_accesses
)) & 0xfffe;
2178 for (i
= 1; i
<= thisrun_accesses
; i
++) {
2181 arm7_9
->load_hword_reg(target
, i
);
2182 /* fast memory reads are only safe when the target is running
2183 * from a sufficiently high clock (32 kHz is usually too slow)
2185 if (arm7_9
->fast_memory_access
)
2186 retval
= arm7_9_execute_fast_sys_speed(target
);
2188 retval
= arm7_9_execute_sys_speed(target
);
2189 if (retval
!= ERROR_OK
)
2194 arm7_9
->read_core_regs_target_buffer(target
, reg_list
, buffer
, 2);
2196 /* advance buffer, count number of accesses */
2197 buffer
+= thisrun_accesses
* 2;
2198 num_accesses
+= thisrun_accesses
;
2200 if ((j
++%1024) == 0)
2205 while (num_accesses
< count
) {
2208 ((count
- num_accesses
) >= 14) ? 14 : (count
- num_accesses
);
2209 reg_list
= (0xffff >> (15 - thisrun_accesses
)) & 0xfffe;
2211 for (i
= 1; i
<= thisrun_accesses
; i
++) {
2214 arm7_9
->load_byte_reg(target
, i
);
2215 /* fast memory reads are only safe when the target is running
2216 * from a sufficiently high clock (32 kHz is usually too slow)
2218 if (arm7_9
->fast_memory_access
)
2219 retval
= arm7_9_execute_fast_sys_speed(target
);
2221 retval
= arm7_9_execute_sys_speed(target
);
2222 if (retval
!= ERROR_OK
)
2226 arm7_9
->read_core_regs_target_buffer(target
, reg_list
, buffer
, 1);
2228 /* advance buffer, count number of accesses */
2229 buffer
+= thisrun_accesses
* 1;
2230 num_accesses
+= thisrun_accesses
;
2232 if ((j
++%1024) == 0)
2238 if (!is_arm_mode(arm
->core_mode
))
2241 for (i
= 0; i
<= last_reg
; i
++) {
2242 struct reg
*r
= arm_reg_current(arm
, i
);
2243 r
->dirty
= r
->valid
;
2246 arm7_9
->read_xpsr(target
, &cpsr
, 0);
2247 retval
= jtag_execute_queue();
2248 if (retval
!= ERROR_OK
) {
2249 LOG_ERROR("JTAG error while reading cpsr");
2250 return ERROR_TARGET_DATA_ABORT
;
2253 if (((cpsr
& 0x1f) == ARM_MODE_ABT
) && (arm
->core_mode
!= ARM_MODE_ABT
)) {
2255 "memory read caused data abort "
2256 "(address: 0x%8.8" TARGET_PRIxADDR
", size: 0x%" PRIx32
", count: 0x%" PRIx32
")",
2261 arm7_9
->write_xpsr_im8(target
,
2262 buf_get_u32(arm
->cpsr
->value
, 0, 8)
2265 return ERROR_TARGET_DATA_ABORT
;
2271 int arm7_9_write_memory(struct target
*target
,
2272 target_addr_t address
,
2275 const uint8_t *buffer
)
2277 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2278 struct arm
*arm
= &arm7_9
->arm
;
2279 struct reg
*dbg_ctrl
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_CTRL
];
2282 uint32_t num_accesses
= 0;
2283 int thisrun_accesses
;
2289 #ifdef _DEBUG_ARM7_9_
2290 LOG_DEBUG("address: 0x%8.8x, size: 0x%8.8x, count: 0x%8.8x", address
, size
, count
);
2293 if (target
->state
!= TARGET_HALTED
) {
2294 LOG_WARNING("target not halted");
2295 return ERROR_TARGET_NOT_HALTED
;
2298 /* sanitize arguments */
2299 if (((size
!= 4) && (size
!= 2) && (size
!= 1)) || (count
== 0) || !(buffer
))
2300 return ERROR_COMMAND_SYNTAX_ERROR
;
2302 if (((size
== 4) && (address
& 0x3u
)) || ((size
== 2) && (address
& 0x1u
)))
2303 return ERROR_TARGET_UNALIGNED_ACCESS
;
2305 /* load the base register with the address of the first word */
2307 arm7_9
->write_core_regs(target
, 0x1, reg
);
2309 /* Clear DBGACK, to make sure memory fetches work as expected */
2310 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGACK
, 1, 0);
2311 embeddedice_store_reg(dbg_ctrl
);
2315 while (num_accesses
< count
) {
2318 ((count
- num_accesses
) >= 14) ? 14 : (count
- num_accesses
);
2319 reg_list
= (0xffff >> (15 - thisrun_accesses
)) & 0xfffe;
2321 for (i
= 1; i
<= thisrun_accesses
; i
++) {
2324 reg
[i
] = target_buffer_get_u32(target
, buffer
);
2328 arm7_9
->write_core_regs(target
, reg_list
, reg
);
2330 arm7_9
->store_word_regs(target
, reg_list
);
2332 /* fast memory writes are only safe when the target is running
2333 * from a sufficiently high clock (32 kHz is usually too slow)
2335 if (arm7_9
->fast_memory_access
)
2336 retval
= arm7_9_execute_fast_sys_speed(target
);
2338 retval
= arm7_9_execute_sys_speed(target
);
2341 * if memory writes are made when the clock is running slow
2342 * (i.e. 32 kHz) which is necessary in some scripts to reconfigure
2343 * processor operations after a "reset halt" or "reset init",
2344 * need to immediately stroke the keep alive or will end up with
2345 * gdb "keep alive not sent error message" problem.
2351 if (retval
!= ERROR_OK
)
2354 num_accesses
+= thisrun_accesses
;
2358 while (num_accesses
< count
) {
2361 ((count
- num_accesses
) >= 14) ? 14 : (count
- num_accesses
);
2362 reg_list
= (0xffff >> (15 - thisrun_accesses
)) & 0xfffe;
2364 for (i
= 1; i
<= thisrun_accesses
; i
++) {
2367 reg
[i
] = target_buffer_get_u16(target
, buffer
) & 0xffff;
2371 arm7_9
->write_core_regs(target
, reg_list
, reg
);
2373 for (i
= 1; i
<= thisrun_accesses
; i
++) {
2374 arm7_9
->store_hword_reg(target
, i
);
2376 /* fast memory writes are only safe when the target is running
2377 * from a sufficiently high clock (32 kHz is usually too slow)
2379 if (arm7_9
->fast_memory_access
)
2380 retval
= arm7_9_execute_fast_sys_speed(target
);
2382 retval
= arm7_9_execute_sys_speed(target
);
2385 * if memory writes are made when the clock is running slow
2386 * (i.e. 32 kHz) which is necessary in some scripts to reconfigure
2387 * processor operations after a "reset halt" or "reset init",
2388 * need to immediately stroke the keep alive or will end up with
2389 * gdb "keep alive not sent error message" problem.
2395 if (retval
!= ERROR_OK
)
2399 num_accesses
+= thisrun_accesses
;
2403 while (num_accesses
< count
) {
2406 ((count
- num_accesses
) >= 14) ? 14 : (count
- num_accesses
);
2407 reg_list
= (0xffff >> (15 - thisrun_accesses
)) & 0xfffe;
2409 for (i
= 1; i
<= thisrun_accesses
; i
++) {
2412 reg
[i
] = *buffer
++ & 0xff;
2415 arm7_9
->write_core_regs(target
, reg_list
, reg
);
2417 for (i
= 1; i
<= thisrun_accesses
; i
++) {
2418 arm7_9
->store_byte_reg(target
, i
);
2419 /* fast memory writes are only safe when the target is running
2420 * from a sufficiently high clock (32 kHz is usually too slow)
2422 if (arm7_9
->fast_memory_access
)
2423 retval
= arm7_9_execute_fast_sys_speed(target
);
2425 retval
= arm7_9_execute_sys_speed(target
);
2428 * if memory writes are made when the clock is running slow
2429 * (i.e. 32 kHz) which is necessary in some scripts to reconfigure
2430 * processor operations after a "reset halt" or "reset init",
2431 * need to immediately stroke the keep alive or will end up with
2432 * gdb "keep alive not sent error message" problem.
2438 if (retval
!= ERROR_OK
)
2443 num_accesses
+= thisrun_accesses
;
2449 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGACK
, 1, 1);
2450 embeddedice_store_reg(dbg_ctrl
);
2452 if (!is_arm_mode(arm
->core_mode
))
2455 for (i
= 0; i
<= last_reg
; i
++) {
2456 struct reg
*r
= arm_reg_current(arm
, i
);
2457 r
->dirty
= r
->valid
;
2460 arm7_9
->read_xpsr(target
, &cpsr
, 0);
2461 retval
= jtag_execute_queue();
2462 if (retval
!= ERROR_OK
) {
2463 LOG_ERROR("JTAG error while reading cpsr");
2464 return ERROR_TARGET_DATA_ABORT
;
2467 if (((cpsr
& 0x1f) == ARM_MODE_ABT
) && (arm
->core_mode
!= ARM_MODE_ABT
)) {
2469 "memory write caused data abort "
2470 "(address: 0x%8.8" TARGET_PRIxADDR
", size: 0x%" PRIx32
", count: 0x%" PRIx32
")",
2475 arm7_9
->write_xpsr_im8(target
,
2476 buf_get_u32(arm
->cpsr
->value
, 0, 8)
2479 return ERROR_TARGET_DATA_ABORT
;
2485 int arm7_9_write_memory_opt(struct target
*target
,
2486 target_addr_t address
,
2489 const uint8_t *buffer
)
2491 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2494 if (size
== 4 && count
> 32 && arm7_9
->bulk_write_memory
) {
2495 /* Attempt to do a bulk write */
2496 retval
= arm7_9
->bulk_write_memory(target
, address
, count
, buffer
);
2498 if (retval
== ERROR_OK
)
2502 return arm7_9
->write_memory(target
, address
, size
, count
, buffer
);
2505 int arm7_9_write_memory_no_opt(struct target
*target
,
2509 const uint8_t *buffer
)
2511 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2513 return arm7_9
->write_memory(target
, address
, size
, count
, buffer
);
2516 static int dcc_count
;
2517 static const uint8_t *dcc_buffer
;
2519 static int arm7_9_dcc_completion(struct target
*target
,
2520 uint32_t exit_point
,
2521 unsigned int timeout_ms
,
2524 int retval
= ERROR_OK
;
2525 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2527 retval
= target_wait_state(target
, TARGET_DEBUG_RUNNING
, 500);
2528 if (retval
!= ERROR_OK
)
2531 int little
= target
->endianness
== TARGET_LITTLE_ENDIAN
;
2532 int count
= dcc_count
;
2533 const uint8_t *buffer
= dcc_buffer
;
2535 /* Handle first & last using standard embeddedice_write_reg and the middle ones w/the
2536 * core function repeated. */
2537 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_COMMS_DATA
],
2538 fast_target_buffer_get_u32(buffer
, little
));
2541 struct embeddedice_reg
*ice_reg
=
2542 arm7_9
->eice_cache
->reg_list
[EICE_COMMS_DATA
].arch_info
;
2543 uint8_t reg_addr
= ice_reg
->addr
& 0x1f;
2544 struct jtag_tap
*tap
;
2545 tap
= ice_reg
->jtag_info
->tap
;
2547 embeddedice_write_dcc(tap
, reg_addr
, buffer
, little
, count
-2);
2548 buffer
+= (count
-2)*4;
2550 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_COMMS_DATA
],
2551 fast_target_buffer_get_u32(buffer
, little
));
2554 for (i
= 0; i
< count
; i
++) {
2555 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_COMMS_DATA
],
2556 fast_target_buffer_get_u32(buffer
, little
));
2561 retval
= target_halt(target
);
2562 if (retval
!= ERROR_OK
)
2564 return target_wait_state(target
, TARGET_HALTED
, 500);
2567 static const uint32_t dcc_code
[] = {
2568 /* r0 == input, points to memory buffer
2572 /* spin until DCC control (c0) reports data arrived */
2573 0xee101e10, /* w: mrc p14, #0, r1, c0, c0 */
2574 0xe3110001, /* tst r1, #1 */
2575 0x0afffffc, /* bne w */
2577 /* read word from DCC (c1), write to memory */
2578 0xee111e10, /* mrc p14, #0, r1, c1, c0 */
2579 0xe4801004, /* str r1, [r0], #4 */
2582 0xeafffff9 /* b w */
2585 int arm7_9_bulk_write_memory(struct target
*target
,
2586 target_addr_t address
,
2588 const uint8_t *buffer
)
2591 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2593 if (address
% 4 != 0)
2594 return ERROR_TARGET_UNALIGNED_ACCESS
;
2596 if (!arm7_9
->dcc_downloads
)
2597 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
2599 /* regrab previously allocated working_area, or allocate a new one */
2600 if (!arm7_9
->dcc_working_area
) {
2601 uint8_t dcc_code_buf
[6 * 4];
2603 /* make sure we have a working area */
2604 if (target_alloc_working_area(target
, 24, &arm7_9
->dcc_working_area
) != ERROR_OK
) {
2605 LOG_INFO("no working area available, falling back to memory writes");
2606 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
2609 /* copy target instructions to target endianness */
2610 target_buffer_set_u32_array(target
, dcc_code_buf
, ARRAY_SIZE(dcc_code
), dcc_code
);
2612 /* write DCC code to working area, using the non-optimized
2613 * memory write to avoid ending up here again */
2614 retval
= arm7_9_write_memory_no_opt(target
,
2615 arm7_9
->dcc_working_area
->address
, 4, 6, dcc_code_buf
);
2616 if (retval
!= ERROR_OK
)
2620 struct arm_algorithm arm_algo
;
2621 struct reg_param reg_params
[1];
2623 arm_algo
.common_magic
= ARM_COMMON_MAGIC
;
2624 arm_algo
.core_mode
= ARM_MODE_SVC
;
2625 arm_algo
.core_state
= ARM_STATE_ARM
;
2627 init_reg_param(®_params
[0], "r0", 32, PARAM_IN_OUT
);
2629 buf_set_u32(reg_params
[0].value
, 0, 32, address
);
2632 dcc_buffer
= buffer
;
2633 retval
= armv4_5_run_algorithm_inner(target
, 0, NULL
, 1, reg_params
,
2634 arm7_9
->dcc_working_area
->address
,
2635 arm7_9
->dcc_working_area
->address
+ 6*4,
2636 20*1000, &arm_algo
, arm7_9_dcc_completion
);
2638 if (retval
== ERROR_OK
) {
2639 uint32_t endaddress
= buf_get_u32(reg_params
[0].value
, 0, 32);
2640 if (endaddress
!= (address
+ count
*4)) {
2642 "DCC write failed, expected end address 0x%08" TARGET_PRIxADDR
" got 0x%0" PRIx32
"",
2643 (address
+ count
*4),
2645 retval
= ERROR_FAIL
;
2649 destroy_reg_param(®_params
[0]);
2655 * Perform per-target setup that requires JTAG access.
2657 int arm7_9_examine(struct target
*target
)
2659 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2662 if (!target_was_examined(target
)) {
2663 struct reg_cache
*t
, **cache_p
;
2665 t
= embeddedice_build_reg_cache(target
, arm7_9
);
2669 cache_p
= register_get_last_cache_p(&target
->reg_cache
);
2671 arm7_9
->eice_cache
= (*cache_p
);
2673 if (arm7_9
->arm
.etm
)
2674 (*cache_p
)->next
= etm_build_reg_cache(target
,
2678 target_set_examined(target
);
2681 retval
= embeddedice_setup(target
);
2682 if (retval
== ERROR_OK
)
2683 retval
= arm7_9_setup(target
);
2684 if (retval
== ERROR_OK
&& arm7_9
->arm
.etm
)
2685 retval
= etm_setup(target
);
2689 void arm7_9_deinit(struct target
*target
)
2691 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2693 if (target_was_examined(target
))
2694 embeddedice_free_reg_cache(arm7_9
->eice_cache
);
2696 arm_jtag_close_connection(&arm7_9
->jtag_info
);
2699 int arm7_9_check_reset(struct target
*target
)
2701 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2703 if (get_target_reset_nag() && !arm7_9
->dcc_downloads
)
2705 "NOTE! DCC downloads have not been enabled, defaulting to slow memory writes. Type 'help dcc'.");
2707 if (get_target_reset_nag() && (target
->working_area_size
== 0))
2708 LOG_WARNING("NOTE! Severe performance degradation without working memory enabled.");
2710 if (get_target_reset_nag() && !arm7_9
->fast_memory_access
)
2712 "NOTE! Severe performance degradation without fast memory access enabled. Type 'help fast'.");
2717 int arm7_9_endianness_callback(jtag_callback_data_t pu8_in
,
2718 jtag_callback_data_t i_size
, jtag_callback_data_t i_be
,
2719 jtag_callback_data_t i_flip
)
2721 uint8_t *in
= (uint8_t *)pu8_in
;
2722 int size
= (int)i_size
;
2724 int flip
= (int)i_flip
;
2729 readback
= le_to_h_u32(in
);
2731 readback
= flip_u32(readback
, 32);
2733 h_u32_to_be(in
, readback
);
2735 h_u32_to_le(in
, readback
);
2738 readback
= le_to_h_u16(in
);
2740 readback
= flip_u32(readback
, 16);
2742 h_u16_to_be(in
, readback
& 0xffff);
2744 h_u16_to_le(in
, readback
& 0xffff);
2749 readback
= flip_u32(readback
, 8);
2750 *in
= readback
& 0xff;
2757 COMMAND_HANDLER(handle_arm7_9_dbgrq_command
)
2759 struct target
*target
= get_current_target(CMD_CTX
);
2760 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2762 if (!is_arm7_9(arm7_9
)) {
2763 command_print(CMD
, "current target isn't an ARM7/ARM9 target");
2764 return ERROR_TARGET_INVALID
;
2768 COMMAND_PARSE_ENABLE(CMD_ARGV
[0], arm7_9
->use_dbgrq
);
2771 "use of EmbeddedICE dbgrq instead of breakpoint for target halt %s",
2772 (arm7_9
->use_dbgrq
) ? "enabled" : "disabled");
2777 COMMAND_HANDLER(handle_arm7_9_fast_memory_access_command
)
2779 struct target
*target
= get_current_target(CMD_CTX
);
2780 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2782 if (!is_arm7_9(arm7_9
)) {
2783 command_print(CMD
, "current target isn't an ARM7/ARM9 target");
2784 return ERROR_TARGET_INVALID
;
2788 COMMAND_PARSE_ENABLE(CMD_ARGV
[0], arm7_9
->fast_memory_access
);
2791 "fast memory access is %s",
2792 (arm7_9
->fast_memory_access
) ? "enabled" : "disabled");
2797 COMMAND_HANDLER(handle_arm7_9_dcc_downloads_command
)
2799 struct target
*target
= get_current_target(CMD_CTX
);
2800 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2802 if (!is_arm7_9(arm7_9
)) {
2803 command_print(CMD
, "current target isn't an ARM7/ARM9 target");
2804 return ERROR_TARGET_INVALID
;
2808 COMMAND_PARSE_ENABLE(CMD_ARGV
[0], arm7_9
->dcc_downloads
);
2811 "dcc downloads are %s",
2812 (arm7_9
->dcc_downloads
) ? "enabled" : "disabled");
2817 static int arm7_9_setup_semihosting(struct target
*target
, int enable
)
2819 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2821 if (!is_arm7_9(arm7_9
)) {
2822 LOG_USER("current target isn't an ARM7/ARM9 target");
2823 return ERROR_TARGET_INVALID
;
2826 if (arm7_9
->has_vector_catch
) {
2827 struct reg
*vector_catch
= &arm7_9
->eice_cache
2828 ->reg_list
[EICE_VEC_CATCH
];
2830 if (!vector_catch
->valid
)
2831 embeddedice_read_reg(vector_catch
);
2832 buf_set_u32(vector_catch
->value
, 2, 1, enable
);
2833 embeddedice_store_reg(vector_catch
);
2835 /* TODO: allow optional high vectors and/or BKPT_HARD */
2837 breakpoint_add(target
, 8, 4, BKPT_SOFT
);
2839 breakpoint_remove(target
, 8);
2845 int arm7_9_init_arch_info(struct target
*target
, struct arm7_9_common
*arm7_9
)
2847 int retval
= ERROR_OK
;
2848 struct arm
*arm
= &arm7_9
->arm
;
2850 arm7_9
->common_magic
= ARM7_9_COMMON_MAGIC
;
2852 retval
= arm_jtag_setup_connection(&arm7_9
->jtag_info
);
2853 if (retval
!= ERROR_OK
)
2856 /* caller must have allocated via calloc(), so everything's zeroed */
2858 arm7_9
->wp_available_max
= 2;
2860 arm7_9
->fast_memory_access
= false;
2861 arm7_9
->dcc_downloads
= false;
2863 arm
->arch_info
= arm7_9
;
2864 arm
->core_type
= ARM_CORE_TYPE_STD
;
2865 arm
->read_core_reg
= arm7_9_read_core_reg
;
2866 arm
->write_core_reg
= arm7_9_write_core_reg
;
2867 arm
->full_context
= arm7_9_full_context
;
2868 arm
->setup_semihosting
= arm7_9_setup_semihosting
;
2870 retval
= arm_init_arch_info(target
, arm
);
2871 if (retval
!= ERROR_OK
)
2874 return target_register_timer_callback(arm7_9_handle_target_request
,
2875 1, TARGET_TIMER_TYPE_PERIODIC
, target
);
2878 static const struct command_registration arm7_9_any_command_handlers
[] = {
2881 .handler
= handle_arm7_9_dbgrq_command
,
2882 .mode
= COMMAND_ANY
,
2883 .usage
= "['enable'|'disable']",
2884 .help
= "use EmbeddedICE dbgrq instead of breakpoint "
2885 "for target halt requests",
2888 .name
= "fast_memory_access",
2889 .handler
= handle_arm7_9_fast_memory_access_command
,
2890 .mode
= COMMAND_ANY
,
2891 .usage
= "['enable'|'disable']",
2892 .help
= "use fast memory accesses instead of slower "
2893 "but potentially safer accesses",
2896 .name
= "dcc_downloads",
2897 .handler
= handle_arm7_9_dcc_downloads_command
,
2898 .mode
= COMMAND_ANY
,
2899 .usage
= "['enable'|'disable']",
2900 .help
= "use DCC downloads for larger memory writes",
2902 COMMAND_REGISTRATION_DONE
2904 const struct command_registration arm7_9_command_handlers
[] = {
2906 .chain
= arm_command_handlers
,
2909 .chain
= etm_command_handlers
,
2913 .mode
= COMMAND_ANY
,
2914 .help
= "arm7/9 specific commands",
2916 .chain
= arm7_9_any_command_handlers
,
2918 COMMAND_REGISTRATION_DONE
Linking to existing account procedure
If you already have an account and want to add another login method
you
MUST first sign in with your existing account and
then change URL to read
https://review.openocd.org/login/?link
to get to this page again but this time it'll work for linking. Thank you.
SSH host keys fingerprints
1024 SHA256:YKx8b7u5ZWdcbp7/4AeXNaqElP49m6QrwfXaqQGJAOk gerrit-code-review@openocd.zylin.com (DSA)
384 SHA256:jHIbSQa4REvwCFG4cq5LBlBLxmxSqelQPem/EXIrxjk gerrit-code-review@openocd.org (ECDSA)
521 SHA256:UAOPYkU9Fjtcao0Ul/Rrlnj/OsQvt+pgdYSZ4jOYdgs gerrit-code-review@openocd.org (ECDSA)
256 SHA256:A13M5QlnozFOvTllybRZH6vm7iSt0XLxbA48yfc2yfY gerrit-code-review@openocd.org (ECDSA)
256 SHA256:spYMBqEYoAOtK7yZBrcwE8ZpYt6b68Cfh9yEVetvbXg gerrit-code-review@openocd.org (ED25519)
+--[ED25519 256]--+
|=.. |
|+o.. . |
|*.o . . |
|+B . . . |
|Bo. = o S |
|Oo.+ + = |
|oB=.* = . o |
| =+=.+ + E |
|. .=o . o |
+----[SHA256]-----+
2048 SHA256:0Onrb7/PHjpo6iVZ7xQX2riKN83FJ3KGU0TvI0TaFG4 gerrit-code-review@openocd.zylin.com (RSA)