1 /***************************************************************************
2 * Copyright (C) 2005 by Dominic Rath *
3 * Dominic.Rath@gmx.de *
5 * Copyright (C) 2007,2008 Øyvind Harboe *
6 * oyvind.harboe@zylin.com *
8 * Copyright (C) 2008 by Spencer Oliver *
9 * spen@spen-soft.co.uk *
11 * Copyright (C) 2008 by Hongtao Zheng *
14 * This program is free software; you can redistribute it and/or modify *
15 * it under the terms of the GNU General Public License as published by *
16 * the Free Software Foundation; either version 2 of the License, or *
17 * (at your option) any later version. *
19 * This program is distributed in the hope that it will be useful, *
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
22 * GNU General Public License for more details. *
24 * You should have received a copy of the GNU General Public License *
25 * along with this program; if not, write to the *
26 * Free Software Foundation, Inc., *
27 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
28 ***************************************************************************/
33 #include "breakpoints.h"
34 #include "embeddedice.h"
35 #include "target_request.h"
37 #include "time_support.h"
38 #include "arm_simulator.h"
39 #include "algorithm.h"
45 * Hold common code supporting the ARM7 and ARM9 core generations.
47 * While the ARM core implementations evolved substantially during these
48 * two generations, they look quite similar from the JTAG perspective.
49 * Both have similar debug facilities, based on the same two scan chains
50 * providing access to the core and to an EmbeddedICE module. Both can
51 * support similar ETM and ETB modules, for tracing. And both expose
52 * what could be viewed as "ARM Classic", with multiple processor modes,
53 * shadowed registers, and support for the Thumb instruction set.
55 * Processor differences include things like presence or absence of MMU
56 * and cache, pipeline sizes, use of a modified Harvard Architecure
57 * (with separate instruction and data busses from the CPU), support
58 * for cpu clock gating during idle, and more.
61 static int arm7_9_debug_entry(struct target
*target
);
64 * Clear watchpoints for an ARM7/9 target.
66 * @param arm7_9 Pointer to the common struct for an ARM7/9 target
67 * @return JTAG error status after executing queue
69 static int arm7_9_clear_watchpoints(struct arm7_9_common
*arm7_9
)
72 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], 0x0);
73 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
], 0x0);
74 arm7_9
->sw_breakpoint_count
= 0;
75 arm7_9
->sw_breakpoints_added
= 0;
77 arm7_9
->wp1_used
= arm7_9
->wp1_used_default
;
78 arm7_9
->wp_available
= arm7_9
->wp_available_max
;
80 return jtag_execute_queue();
84 * Assign a watchpoint to one of the two available hardware comparators in an
85 * ARM7 or ARM9 target.
87 * @param arm7_9 Pointer to the common struct for an ARM7/9 target
88 * @param breakpoint Pointer to the breakpoint to be used as a watchpoint
90 static void arm7_9_assign_wp(struct arm7_9_common
*arm7_9
, struct breakpoint
*breakpoint
)
92 if (!arm7_9
->wp0_used
)
96 arm7_9
->wp_available
--;
98 else if (!arm7_9
->wp1_used
)
100 arm7_9
->wp1_used
= 1;
102 arm7_9
->wp_available
--;
106 LOG_ERROR("BUG: no hardware comparator available");
108 LOG_DEBUG("BPID: %d (0x%08" PRIx32
") using hw wp: %d",
109 breakpoint
->unique_id
,
115 * Setup an ARM7/9 target's embedded ICE registers for software breakpoints.
117 * @param arm7_9 Pointer to common struct for ARM7/9 targets
118 * @return Error codes if there is a problem finding a watchpoint or the result
119 * of executing the JTAG queue
121 static int arm7_9_set_software_breakpoints(struct arm7_9_common
*arm7_9
)
123 if (arm7_9
->sw_breakpoints_added
)
127 if (arm7_9
->wp_available
< 1)
129 LOG_WARNING("can't enable sw breakpoints with no watchpoint unit available");
130 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
132 arm7_9
->wp_available
--;
134 /* pick a breakpoint unit */
135 if (!arm7_9
->wp0_used
)
137 arm7_9
->sw_breakpoints_added
= 1;
138 arm7_9
->wp0_used
= 3;
139 } else if (!arm7_9
->wp1_used
)
141 arm7_9
->sw_breakpoints_added
= 2;
142 arm7_9
->wp1_used
= 3;
146 LOG_ERROR("BUG: both watchpoints used, but wp_available >= 1");
150 if (arm7_9
->sw_breakpoints_added
== 1)
152 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_VALUE
], arm7_9
->arm_bkpt
);
153 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
], 0x0);
154 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
], 0xffffffffu
);
155 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
], ~EICE_W_CTRL_nOPC
& 0xff);
156 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], EICE_W_CTRL_ENABLE
);
158 else if (arm7_9
->sw_breakpoints_added
== 2)
160 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_DATA_VALUE
], arm7_9
->arm_bkpt
);
161 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_DATA_MASK
], 0x0);
162 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_MASK
], 0xffffffffu
);
163 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_MASK
], ~EICE_W_CTRL_nOPC
& 0xff);
164 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
], EICE_W_CTRL_ENABLE
);
168 LOG_ERROR("BUG: both watchpoints used, but wp_available >= 1");
171 LOG_DEBUG("SW BP using hw wp: %d",
172 arm7_9
->sw_breakpoints_added
);
174 return jtag_execute_queue();
178 * Setup the common pieces for an ARM7/9 target after reset or on startup.
180 * @param target Pointer to an ARM7/9 target to setup
181 * @return Result of clearing the watchpoints on the target
183 int arm7_9_setup(struct target
*target
)
185 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
187 return arm7_9_clear_watchpoints(arm7_9
);
191 * Set either a hardware or software breakpoint on an ARM7/9 target. The
192 * breakpoint is set up even if it is already set. Some actions, e.g. reset,
193 * might have erased the values in Embedded ICE.
195 * @param target Pointer to the target device to set the breakpoints on
196 * @param breakpoint Pointer to the breakpoint to be set
197 * @return For hardware breakpoints, this is the result of executing the JTAG
198 * queue. For software breakpoints, this will be the status of the
199 * required memory reads and writes
201 int arm7_9_set_breakpoint(struct target
*target
, struct breakpoint
*breakpoint
)
203 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
204 int retval
= ERROR_OK
;
206 LOG_DEBUG("BPID: %d, Address: 0x%08" PRIx32
", Type: %d" ,
207 breakpoint
->unique_id
,
211 if (target
->state
!= TARGET_HALTED
)
213 LOG_WARNING("target not halted");
214 return ERROR_TARGET_NOT_HALTED
;
217 if (breakpoint
->type
== BKPT_HARD
)
219 /* either an ARM (4 byte) or Thumb (2 byte) breakpoint */
220 uint32_t mask
= (breakpoint
->length
== 4) ? 0x3u
: 0x1u
;
222 /* reassign a hw breakpoint */
223 if (breakpoint
->set
== 0)
225 arm7_9_assign_wp(arm7_9
, breakpoint
);
228 if (breakpoint
->set
== 1)
230 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_VALUE
], breakpoint
->address
);
231 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
], mask
);
232 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
], 0xffffffffu
);
233 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
], ~EICE_W_CTRL_nOPC
& 0xff);
234 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], EICE_W_CTRL_ENABLE
);
236 else if (breakpoint
->set
== 2)
238 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_VALUE
], breakpoint
->address
);
239 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_MASK
], mask
);
240 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_DATA_MASK
], 0xffffffffu
);
241 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_MASK
], ~EICE_W_CTRL_nOPC
& 0xff);
242 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
], EICE_W_CTRL_ENABLE
);
246 LOG_ERROR("BUG: no hardware comparator available");
250 retval
= jtag_execute_queue();
252 else if (breakpoint
->type
== BKPT_SOFT
)
254 /* did we already set this breakpoint? */
258 if (breakpoint
->length
== 4)
260 uint32_t verify
= 0xffffffff;
261 /* keep the original instruction in target endianness */
262 if ((retval
= target_read_memory(target
, breakpoint
->address
, 4, 1, breakpoint
->orig_instr
)) != ERROR_OK
)
266 /* write the breakpoint instruction in target endianness (arm7_9->arm_bkpt is host endian) */
267 if ((retval
= target_write_u32(target
, breakpoint
->address
, arm7_9
->arm_bkpt
)) != ERROR_OK
)
272 if ((retval
= target_read_u32(target
, breakpoint
->address
, &verify
)) != ERROR_OK
)
276 if (verify
!= arm7_9
->arm_bkpt
)
278 LOG_ERROR("Unable to set 32 bit software breakpoint at address %08" PRIx32
" - check that memory is read/writable", breakpoint
->address
);
284 uint16_t verify
= 0xffff;
285 /* keep the original instruction in target endianness */
286 if ((retval
= target_read_memory(target
, breakpoint
->address
, 2, 1, breakpoint
->orig_instr
)) != ERROR_OK
)
290 /* write the breakpoint instruction in target endianness (arm7_9->thumb_bkpt is host endian) */
291 if ((retval
= target_write_u16(target
, breakpoint
->address
, arm7_9
->thumb_bkpt
)) != ERROR_OK
)
296 if ((retval
= target_read_u16(target
, breakpoint
->address
, &verify
)) != ERROR_OK
)
300 if (verify
!= arm7_9
->thumb_bkpt
)
302 LOG_ERROR("Unable to set thumb software breakpoint at address %08" PRIx32
" - check that memory is read/writable", breakpoint
->address
);
307 if ((retval
= arm7_9_set_software_breakpoints(arm7_9
)) != ERROR_OK
)
310 arm7_9
->sw_breakpoint_count
++;
319 * Unsets an existing breakpoint on an ARM7/9 target. If it is a hardware
320 * breakpoint, the watchpoint used will be freed and the Embedded ICE registers
321 * will be updated. Otherwise, the software breakpoint will be restored to its
322 * original instruction if it hasn't already been modified.
324 * @param target Pointer to ARM7/9 target to unset the breakpoint from
325 * @param breakpoint Pointer to breakpoint to be unset
326 * @return For hardware breakpoints, this is the result of executing the JTAG
327 * queue. For software breakpoints, this will be the status of the
328 * required memory reads and writes
330 int arm7_9_unset_breakpoint(struct target
*target
, struct breakpoint
*breakpoint
)
332 int retval
= ERROR_OK
;
333 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
335 LOG_DEBUG("BPID: %d, Address: 0x%08" PRIx32
,
336 breakpoint
->unique_id
,
337 breakpoint
->address
);
339 if (!breakpoint
->set
)
341 LOG_WARNING("breakpoint not set");
345 if (breakpoint
->type
== BKPT_HARD
)
347 LOG_DEBUG("BPID: %d Releasing hw wp: %d",
348 breakpoint
->unique_id
,
350 if (breakpoint
->set
== 1)
352 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], 0x0);
353 arm7_9
->wp0_used
= 0;
354 arm7_9
->wp_available
++;
356 else if (breakpoint
->set
== 2)
358 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
], 0x0);
359 arm7_9
->wp1_used
= 0;
360 arm7_9
->wp_available
++;
362 retval
= jtag_execute_queue();
367 /* restore original instruction (kept in target endianness) */
368 if (breakpoint
->length
== 4)
370 uint32_t current_instr
;
371 /* check that user program as not modified breakpoint instruction */
372 if ((retval
= target_read_memory(target
, breakpoint
->address
, 4, 1, (uint8_t*)¤t_instr
)) != ERROR_OK
)
376 if (current_instr
== arm7_9
->arm_bkpt
)
377 if ((retval
= target_write_memory(target
, breakpoint
->address
, 4, 1, breakpoint
->orig_instr
)) != ERROR_OK
)
384 uint16_t current_instr
;
385 /* check that user program as not modified breakpoint instruction */
386 if ((retval
= target_read_memory(target
, breakpoint
->address
, 2, 1, (uint8_t*)¤t_instr
)) != ERROR_OK
)
390 if (current_instr
== arm7_9
->thumb_bkpt
)
391 if ((retval
= target_write_memory(target
, breakpoint
->address
, 2, 1, breakpoint
->orig_instr
)) != ERROR_OK
)
397 if (--arm7_9
->sw_breakpoint_count
==0)
399 /* We have removed the last sw breakpoint, clear the hw breakpoint we used to implement it */
400 if (arm7_9
->sw_breakpoints_added
== 1)
402 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], 0);
404 else if (arm7_9
->sw_breakpoints_added
== 2)
406 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
], 0);
417 * Add a breakpoint to an ARM7/9 target. This makes sure that there are no
418 * dangling breakpoints and that the desired breakpoint can be added.
420 * @param target Pointer to the target ARM7/9 device to add a breakpoint to
421 * @param breakpoint Pointer to the breakpoint to be added
422 * @return An error status if there is a problem adding the breakpoint or the
423 * result of setting the breakpoint
425 int arm7_9_add_breakpoint(struct target
*target
, struct breakpoint
*breakpoint
)
427 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
429 if (target
->state
!= TARGET_HALTED
)
431 LOG_WARNING("target not halted");
432 return ERROR_TARGET_NOT_HALTED
;
435 if (arm7_9
->breakpoint_count
== 0)
437 /* make sure we don't have any dangling breakpoints. This is vital upon
438 * GDB connect/disconnect
440 arm7_9_clear_watchpoints(arm7_9
);
443 if ((breakpoint
->type
== BKPT_HARD
) && (arm7_9
->wp_available
< 1))
445 LOG_INFO("no watchpoint unit available for hardware breakpoint");
446 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
449 if ((breakpoint
->length
!= 2) && (breakpoint
->length
!= 4))
451 LOG_INFO("only breakpoints of two (Thumb) or four (ARM) bytes length supported");
452 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
455 if (breakpoint
->type
== BKPT_HARD
)
457 arm7_9_assign_wp(arm7_9
, breakpoint
);
460 arm7_9
->breakpoint_count
++;
462 return arm7_9_set_breakpoint(target
, breakpoint
);
466 * Removes a breakpoint from an ARM7/9 target. This will make sure there are no
467 * dangling breakpoints and updates available watchpoints if it is a hardware
470 * @param target Pointer to the target to have a breakpoint removed
471 * @param breakpoint Pointer to the breakpoint to be removed
472 * @return Error status if there was a problem unsetting the breakpoint or the
473 * watchpoints could not be cleared
475 int arm7_9_remove_breakpoint(struct target
*target
, struct breakpoint
*breakpoint
)
477 int retval
= ERROR_OK
;
478 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
480 if ((retval
= arm7_9_unset_breakpoint(target
, breakpoint
)) != ERROR_OK
)
485 if (breakpoint
->type
== BKPT_HARD
)
486 arm7_9
->wp_available
++;
488 arm7_9
->breakpoint_count
--;
489 if (arm7_9
->breakpoint_count
== 0)
491 /* make sure we don't have any dangling breakpoints */
492 if ((retval
= arm7_9_clear_watchpoints(arm7_9
)) != ERROR_OK
)
502 * Sets a watchpoint for an ARM7/9 target in one of the watchpoint units. It is
503 * considered a bug to call this function when there are no available watchpoint
506 * @param target Pointer to an ARM7/9 target to set a watchpoint on
507 * @param watchpoint Pointer to the watchpoint to be set
508 * @return Error status if watchpoint set fails or the result of executing the
511 int arm7_9_set_watchpoint(struct target
*target
, struct watchpoint
*watchpoint
)
513 int retval
= ERROR_OK
;
514 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
518 mask
= watchpoint
->length
- 1;
520 if (target
->state
!= TARGET_HALTED
)
522 LOG_WARNING("target not halted");
523 return ERROR_TARGET_NOT_HALTED
;
526 if (watchpoint
->rw
== WPT_ACCESS
)
531 if (!arm7_9
->wp0_used
)
533 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_VALUE
], watchpoint
->address
);
534 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
], mask
);
535 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
], watchpoint
->mask
);
536 if (watchpoint
->mask
!= 0xffffffffu
)
537 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_VALUE
], watchpoint
->value
);
538 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
], 0xff & ~EICE_W_CTRL_nOPC
& ~rw_mask
);
539 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], EICE_W_CTRL_ENABLE
| EICE_W_CTRL_nOPC
| (watchpoint
->rw
& 1));
541 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
546 arm7_9
->wp0_used
= 2;
548 else if (!arm7_9
->wp1_used
)
550 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_VALUE
], watchpoint
->address
);
551 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_MASK
], mask
);
552 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_DATA_MASK
], watchpoint
->mask
);
553 if (watchpoint
->mask
!= 0xffffffffu
)
554 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_DATA_VALUE
], watchpoint
->value
);
555 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_MASK
], 0xff & ~EICE_W_CTRL_nOPC
& ~rw_mask
);
556 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
], EICE_W_CTRL_ENABLE
| EICE_W_CTRL_nOPC
| (watchpoint
->rw
& 1));
558 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
563 arm7_9
->wp1_used
= 2;
567 LOG_ERROR("BUG: no hardware comparator available");
575 * Unset an existing watchpoint and clear the used watchpoint unit.
577 * @param target Pointer to the target to have the watchpoint removed
578 * @param watchpoint Pointer to the watchpoint to be removed
579 * @return Error status while trying to unset the watchpoint or the result of
580 * executing the JTAG queue
582 int arm7_9_unset_watchpoint(struct target
*target
, struct watchpoint
*watchpoint
)
584 int retval
= ERROR_OK
;
585 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
587 if (target
->state
!= TARGET_HALTED
)
589 LOG_WARNING("target not halted");
590 return ERROR_TARGET_NOT_HALTED
;
593 if (!watchpoint
->set
)
595 LOG_WARNING("breakpoint not set");
599 if (watchpoint
->set
== 1)
601 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], 0x0);
602 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
606 arm7_9
->wp0_used
= 0;
608 else if (watchpoint
->set
== 2)
610 embeddedice_set_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
], 0x0);
611 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
615 arm7_9
->wp1_used
= 0;
623 * Add a watchpoint to an ARM7/9 target. If there are no watchpoint units
624 * available, an error response is returned.
626 * @param target Pointer to the ARM7/9 target to add a watchpoint to
627 * @param watchpoint Pointer to the watchpoint to be added
628 * @return Error status while trying to add the watchpoint
630 int arm7_9_add_watchpoint(struct target
*target
, struct watchpoint
*watchpoint
)
632 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
634 if (target
->state
!= TARGET_HALTED
)
636 LOG_WARNING("target not halted");
637 return ERROR_TARGET_NOT_HALTED
;
640 if (arm7_9
->wp_available
< 1)
642 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
645 if ((watchpoint
->length
!= 1) && (watchpoint
->length
!= 2) && (watchpoint
->length
!= 4))
647 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
650 arm7_9
->wp_available
--;
656 * Remove a watchpoint from an ARM7/9 target. The watchpoint will be unset and
657 * the used watchpoint unit will be reopened.
659 * @param target Pointer to the target to remove a watchpoint from
660 * @param watchpoint Pointer to the watchpoint to be removed
661 * @return Result of trying to unset the watchpoint
663 int arm7_9_remove_watchpoint(struct target
*target
, struct watchpoint
*watchpoint
)
665 int retval
= ERROR_OK
;
666 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
670 if ((retval
= arm7_9_unset_watchpoint(target
, watchpoint
)) != ERROR_OK
)
676 arm7_9
->wp_available
++;
682 * Restarts the target by sending a RESTART instruction and moving the JTAG
683 * state to IDLE. This includes a timeout waiting for DBGACK and SYSCOMP to be
684 * asserted by the processor.
686 * @param target Pointer to target to issue commands to
687 * @return Error status if there is a timeout or a problem while executing the
690 int arm7_9_execute_sys_speed(struct target
*target
)
693 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
694 struct arm_jtag
*jtag_info
= &arm7_9
->jtag_info
;
695 struct reg
*dbg_stat
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_STAT
];
697 /* set RESTART instruction */
698 jtag_set_end_state(TAP_IDLE
);
699 if (arm7_9
->need_bypass_before_restart
) {
700 arm7_9
->need_bypass_before_restart
= 0;
701 arm_jtag_set_instr(jtag_info
, 0xf, NULL
);
703 arm_jtag_set_instr(jtag_info
, 0x4, NULL
);
705 long long then
= timeval_ms();
707 while (!(timeout
= ((timeval_ms()-then
) > 1000)))
709 /* read debug status register */
710 embeddedice_read_reg(dbg_stat
);
711 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
713 if ((buf_get_u32(dbg_stat
->value
, EICE_DBG_STATUS_DBGACK
, 1))
714 && (buf_get_u32(dbg_stat
->value
, EICE_DBG_STATUS_SYSCOMP
, 1)))
716 if (debug_level
>= 3)
726 LOG_ERROR("timeout waiting for SYSCOMP & DBGACK, last DBG_STATUS: %" PRIx32
"", buf_get_u32(dbg_stat
->value
, 0, dbg_stat
->size
));
727 return ERROR_TARGET_TIMEOUT
;
734 * Restarts the target by sending a RESTART instruction and moving the JTAG
735 * state to IDLE. This validates that DBGACK and SYSCOMP are set without
736 * waiting until they are.
738 * @param target Pointer to the target to issue commands to
739 * @return Always ERROR_OK
741 int arm7_9_execute_fast_sys_speed(struct target
*target
)
744 static uint8_t check_value
[4], check_mask
[4];
746 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
747 struct arm_jtag
*jtag_info
= &arm7_9
->jtag_info
;
748 struct reg
*dbg_stat
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_STAT
];
750 /* set RESTART instruction */
751 jtag_set_end_state(TAP_IDLE
);
752 if (arm7_9
->need_bypass_before_restart
) {
753 arm7_9
->need_bypass_before_restart
= 0;
754 arm_jtag_set_instr(jtag_info
, 0xf, NULL
);
756 arm_jtag_set_instr(jtag_info
, 0x4, NULL
);
760 /* check for DBGACK and SYSCOMP set (others don't care) */
762 /* NB! These are constants that must be available until after next jtag_execute() and
763 * we evaluate the values upon first execution in lieu of setting up these constants
764 * during early setup.
766 buf_set_u32(check_value
, 0, 32, 0x9);
767 buf_set_u32(check_mask
, 0, 32, 0x9);
771 /* read debug status register */
772 embeddedice_read_reg_w_check(dbg_stat
, check_value
, check_mask
);
778 * Get some data from the ARM7/9 target.
780 * @param target Pointer to the ARM7/9 target to read data from
781 * @param size The number of 32bit words to be read
782 * @param buffer Pointer to the buffer that will hold the data
783 * @return The result of receiving data from the Embedded ICE unit
785 int arm7_9_target_request_data(struct target
*target
, uint32_t size
, uint8_t *buffer
)
787 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
788 struct arm_jtag
*jtag_info
= &arm7_9
->jtag_info
;
790 int retval
= ERROR_OK
;
793 data
= malloc(size
* (sizeof(uint32_t)));
795 retval
= embeddedice_receive(jtag_info
, data
, size
);
797 /* return the 32-bit ints in the 8-bit array */
798 for (i
= 0; i
< size
; i
++)
800 h_u32_to_le(buffer
+ (i
* 4), data
[i
]);
809 * Handles requests to an ARM7/9 target. If debug messaging is enabled, the
810 * target is running and the DCC control register has the W bit high, this will
811 * execute the request on the target.
813 * @param priv Void pointer expected to be a struct target pointer
814 * @return ERROR_OK unless there are issues with the JTAG queue or when reading
815 * from the Embedded ICE unit
817 int arm7_9_handle_target_request(void *priv
)
819 int retval
= ERROR_OK
;
820 struct target
*target
= priv
;
821 if (!target_was_examined(target
))
823 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
824 struct arm_jtag
*jtag_info
= &arm7_9
->jtag_info
;
825 struct reg
*dcc_control
= &arm7_9
->eice_cache
->reg_list
[EICE_COMMS_CTRL
];
827 if (!target
->dbg_msg_enabled
)
830 if (target
->state
== TARGET_RUNNING
)
832 /* read DCC control register */
833 embeddedice_read_reg(dcc_control
);
834 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
840 if (buf_get_u32(dcc_control
->value
, 1, 1) == 1)
844 if ((retval
= embeddedice_receive(jtag_info
, &request
, 1)) != ERROR_OK
)
848 if ((retval
= target_request(target
, request
)) != ERROR_OK
)
859 * Polls an ARM7/9 target for its current status. If DBGACK is set, the target
860 * is manipulated to the right halted state based on its current state. This is
864 * <tr><th > State</th><th > Action</th></tr>
865 * <tr><td > TARGET_RUNNING | TARGET_RESET</td><td > Enters debug mode. If TARGET_RESET, pc may be checked</td></tr>
866 * <tr><td > TARGET_UNKNOWN</td><td > Warning is logged</td></tr>
867 * <tr><td > TARGET_DEBUG_RUNNING</td><td > Enters debug mode</td></tr>
868 * <tr><td > TARGET_HALTED</td><td > Nothing</td></tr>
871 * If the target does not end up in the halted state, a warning is produced. If
872 * DBGACK is cleared, then the target is expected to either be running or
875 * @param target Pointer to the ARM7/9 target to poll
876 * @return ERROR_OK or an error status if a command fails
878 int arm7_9_poll(struct target
*target
)
881 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
882 struct reg
*dbg_stat
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_STAT
];
884 /* read debug status register */
885 embeddedice_read_reg(dbg_stat
);
886 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
891 if (buf_get_u32(dbg_stat
->value
, EICE_DBG_STATUS_DBGACK
, 1))
893 /* LOG_DEBUG("DBGACK set, dbg_state->value: 0x%x", buf_get_u32(dbg_stat->value, 0, 32));*/
894 if (target
->state
== TARGET_UNKNOWN
)
896 /* Starting OpenOCD with target in debug-halt */
897 target
->state
= TARGET_RUNNING
;
898 LOG_DEBUG("DBGACK already set during server startup.");
900 if ((target
->state
== TARGET_RUNNING
) || (target
->state
== TARGET_RESET
))
903 if (target
->state
== TARGET_RESET
)
905 if (target
->reset_halt
)
907 enum reset_types jtag_reset_config
= jtag_get_reset_config();
908 if ((jtag_reset_config
& RESET_SRST_PULLS_TRST
) == 0)
915 target
->state
= TARGET_HALTED
;
917 if ((retval
= arm7_9_debug_entry(target
)) != ERROR_OK
)
922 struct reg
*reg
= register_get_by_name(target
->reg_cache
, "pc", 1);
923 uint32_t t
=*((uint32_t *)reg
->value
);
926 LOG_ERROR("PC was not 0. Does this target need srst_pulls_trst?");
930 if ((retval
= target_call_event_callbacks(target
, TARGET_EVENT_HALTED
)) != ERROR_OK
)
935 if (target
->state
== TARGET_DEBUG_RUNNING
)
937 target
->state
= TARGET_HALTED
;
938 if ((retval
= arm7_9_debug_entry(target
)) != ERROR_OK
)
941 if ((retval
= target_call_event_callbacks(target
, TARGET_EVENT_DEBUG_HALTED
)) != ERROR_OK
)
946 if (target
->state
!= TARGET_HALTED
)
948 LOG_WARNING("DBGACK set, but the target did not end up in the halted state %d", target
->state
);
953 if (target
->state
!= TARGET_DEBUG_RUNNING
)
954 target
->state
= TARGET_RUNNING
;
961 * Asserts the reset (SRST) on an ARM7/9 target. Some -S targets (ARM966E-S in
962 * the STR912 isn't affected, ARM926EJ-S in the LPC3180 and AT91SAM9260 is
963 * affected) completely stop the JTAG clock while the core is held in reset
964 * (SRST). It isn't possible to program the halt condition once reset is
965 * asserted, hence a hook that allows the target to set up its reset-halt
966 * condition is setup prior to asserting reset.
968 * @param target Pointer to an ARM7/9 target to assert reset on
969 * @return ERROR_FAIL if the JTAG device does not have SRST, otherwise ERROR_OK
971 int arm7_9_assert_reset(struct target
*target
)
973 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
975 LOG_DEBUG("target->state: %s",
976 target_state_name(target
));
978 enum reset_types jtag_reset_config
= jtag_get_reset_config();
979 if (!(jtag_reset_config
& RESET_HAS_SRST
))
981 LOG_ERROR("Can't assert SRST");
985 /* At this point trst has been asserted/deasserted once. We would
986 * like to program EmbeddedICE while SRST is asserted, instead of
987 * depending on SRST to leave that module alone. However, many CPUs
988 * gate the JTAG clock while SRST is asserted; or JTAG may need
989 * clock stability guarantees (adaptive clocking might help).
991 * So we assume JTAG access during SRST is off the menu unless it's
992 * been specifically enabled.
994 bool srst_asserted
= false;
996 if (((jtag_reset_config
& RESET_SRST_PULLS_TRST
) == 0)
997 && (jtag_reset_config
& RESET_SRST_NO_GATING
))
999 jtag_add_reset(0, 1);
1000 srst_asserted
= true;
1003 if (target
->reset_halt
)
1006 * Some targets do not support communication while SRST is asserted. We need to
1007 * set up the reset vector catch here.
1009 * If TRST is asserted, then these settings will be reset anyway, so setting them
1012 if (arm7_9
->has_vector_catch
)
1014 /* program vector catch register to catch reset vector */
1015 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_VEC_CATCH
], 0x1);
1017 /* extra runtest added as issues were found with certain ARM9 cores (maybe more) - AT91SAM9260 and STR9 */
1018 jtag_add_runtest(1, jtag_get_end_state());
1022 /* program watchpoint unit to match on reset vector address */
1023 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_VALUE
], 0x0);
1024 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
], 0x3);
1025 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
], 0xffffffff);
1026 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], EICE_W_CTRL_ENABLE
);
1027 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
], ~EICE_W_CTRL_nOPC
& 0xff);
1031 /* here we should issue an SRST only, but we may have to assert TRST as well */
1032 if (jtag_reset_config
& RESET_SRST_PULLS_TRST
)
1034 jtag_add_reset(1, 1);
1035 } else if (!srst_asserted
)
1037 jtag_add_reset(0, 1);
1040 target
->state
= TARGET_RESET
;
1041 jtag_add_sleep(50000);
1043 armv4_5_invalidate_core_regs(target
);
1045 if ((target
->reset_halt
) && ((jtag_reset_config
& RESET_SRST_PULLS_TRST
) == 0))
1047 /* debug entry was already prepared in arm7_9_assert_reset() */
1048 target
->debug_reason
= DBG_REASON_DBGRQ
;
1055 * Deassert the reset (SRST) signal on an ARM7/9 target. If SRST pulls TRST
1056 * and the target is being reset into a halt, a warning will be triggered
1057 * because it is not possible to reset into a halted mode in this case. The
1058 * target is halted using the target's functions.
1060 * @param target Pointer to the target to have the reset deasserted
1061 * @return ERROR_OK or an error from polling or halting the target
1063 int arm7_9_deassert_reset(struct target
*target
)
1065 int retval
= ERROR_OK
;
1066 LOG_DEBUG("target->state: %s",
1067 target_state_name(target
));
1069 /* deassert reset lines */
1070 jtag_add_reset(0, 0);
1072 enum reset_types jtag_reset_config
= jtag_get_reset_config();
1073 if (target
->reset_halt
&& (jtag_reset_config
& RESET_SRST_PULLS_TRST
) != 0)
1075 LOG_WARNING("srst pulls trst - can not reset into halted mode. Issuing halt after reset.");
1076 /* set up embedded ice registers again */
1077 if ((retval
= target_examine_one(target
)) != ERROR_OK
)
1080 if ((retval
= target_poll(target
)) != ERROR_OK
)
1085 if ((retval
= target_halt(target
)) != ERROR_OK
)
1095 * Clears the halt condition for an ARM7/9 target. If it isn't coming out of
1096 * reset and if DBGRQ is used, it is progammed to be deasserted. If the reset
1097 * vector catch was used, it is restored. Otherwise, the control value is
1098 * restored and the watchpoint unit is restored if it was in use.
1100 * @param target Pointer to the ARM7/9 target to have halt cleared
1101 * @return Always ERROR_OK
1103 int arm7_9_clear_halt(struct target
*target
)
1105 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1106 struct reg
*dbg_ctrl
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_CTRL
];
1108 /* we used DBGRQ only if we didn't come out of reset */
1109 if (!arm7_9
->debug_entry_from_reset
&& arm7_9
->use_dbgrq
)
1111 /* program EmbeddedICE Debug Control Register to deassert DBGRQ
1113 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGRQ
, 1, 0);
1114 embeddedice_store_reg(dbg_ctrl
);
1118 if (arm7_9
->debug_entry_from_reset
&& arm7_9
->has_vector_catch
)
1120 /* if we came out of reset, and vector catch is supported, we used
1121 * vector catch to enter debug state
1122 * restore the register in that case
1124 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_VEC_CATCH
]);
1128 /* restore registers if watchpoint unit 0 was in use
1130 if (arm7_9
->wp0_used
)
1132 if (arm7_9
->debug_entry_from_reset
)
1134 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_VALUE
]);
1136 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
]);
1137 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
]);
1138 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
]);
1140 /* control value always has to be restored, as it was either disabled,
1141 * or enabled with possibly different bits
1143 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
]);
1151 * Issue a software reset and halt to an ARM7/9 target. The target is halted
1152 * and then there is a wait until the processor shows the halt. This wait can
1153 * timeout and results in an error being returned. The software reset involves
1154 * clearing the halt, updating the debug control register, changing to ARM mode,
1155 * reset of the program counter, and reset of all of the registers.
1157 * @param target Pointer to the ARM7/9 target to be reset and halted by software
1158 * @return Error status if any of the commands fail, otherwise ERROR_OK
1160 int arm7_9_soft_reset_halt(struct target
*target
)
1162 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1163 struct armv4_5_common_s
*armv4_5
= &arm7_9
->armv4_5_common
;
1164 struct reg
*dbg_stat
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_STAT
];
1165 struct reg
*dbg_ctrl
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_CTRL
];
1169 /* FIX!!! replace some of this code with tcl commands
1171 * halt # the halt command is synchronous
1172 * armv4_5 core_state arm
1176 if ((retval
= target_halt(target
)) != ERROR_OK
)
1179 long long then
= timeval_ms();
1181 while (!(timeout
= ((timeval_ms()-then
) > 1000)))
1183 if (buf_get_u32(dbg_stat
->value
, EICE_DBG_STATUS_DBGACK
, 1) != 0)
1185 embeddedice_read_reg(dbg_stat
);
1186 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
1188 if (debug_level
>= 3)
1198 LOG_ERROR("Failed to halt CPU after 1 sec");
1199 return ERROR_TARGET_TIMEOUT
;
1201 target
->state
= TARGET_HALTED
;
1203 /* program EmbeddedICE Debug Control Register to assert DBGACK and INTDIS
1204 * ensure that DBGRQ is cleared
1206 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGACK
, 1, 1);
1207 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGRQ
, 1, 0);
1208 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_INTDIS
, 1, 1);
1209 embeddedice_store_reg(dbg_ctrl
);
1211 if ((retval
= arm7_9_clear_halt(target
)) != ERROR_OK
)
1216 /* if the target is in Thumb state, change to ARM state */
1217 if (buf_get_u32(dbg_stat
->value
, EICE_DBG_STATUS_ITBIT
, 1))
1219 uint32_t r0_thumb
, pc_thumb
;
1220 LOG_DEBUG("target entered debug from Thumb state, changing to ARM");
1221 /* Entered debug from Thumb mode */
1222 armv4_5
->core_state
= ARMV4_5_STATE_THUMB
;
1223 arm7_9
->change_to_arm(target
, &r0_thumb
, &pc_thumb
);
1226 /* all register content is now invalid */
1227 if ((retval
= armv4_5_invalidate_core_regs(target
)) != ERROR_OK
)
1232 /* SVC, ARM state, IRQ and FIQ disabled */
1233 buf_set_u32(armv4_5
->core_cache
->reg_list
[ARMV4_5_CPSR
].value
, 0, 8, 0xd3);
1234 armv4_5
->core_cache
->reg_list
[ARMV4_5_CPSR
].dirty
= 1;
1235 armv4_5
->core_cache
->reg_list
[ARMV4_5_CPSR
].valid
= 1;
1237 /* start fetching from 0x0 */
1238 buf_set_u32(armv4_5
->core_cache
->reg_list
[15].value
, 0, 32, 0x0);
1239 armv4_5
->core_cache
->reg_list
[15].dirty
= 1;
1240 armv4_5
->core_cache
->reg_list
[15].valid
= 1;
1242 armv4_5
->core_mode
= ARMV4_5_MODE_SVC
;
1243 armv4_5
->core_state
= ARMV4_5_STATE_ARM
;
1245 if (armv4_5_mode_to_number(armv4_5
->core_mode
)==-1)
1248 /* reset registers */
1249 for (i
= 0; i
<= 14; i
++)
1251 buf_set_u32(ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5
->core_mode
, i
).value
, 0, 32, 0xffffffff);
1252 ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5
->core_mode
, i
).dirty
= 1;
1253 ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5
->core_mode
, i
).valid
= 1;
1256 if ((retval
= target_call_event_callbacks(target
, TARGET_EVENT_HALTED
)) != ERROR_OK
)
1265 * Halt an ARM7/9 target. This is accomplished by either asserting the DBGRQ
1266 * line or by programming a watchpoint to trigger on any address. It is
1267 * considered a bug to call this function while the target is in the
1268 * TARGET_RESET state.
1270 * @param target Pointer to the ARM7/9 target to be halted
1271 * @return Always ERROR_OK
1273 int arm7_9_halt(struct target
*target
)
1275 if (target
->state
== TARGET_RESET
)
1277 LOG_ERROR("BUG: arm7/9 does not support halt during reset. This is handled in arm7_9_assert_reset()");
1281 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1282 struct reg
*dbg_ctrl
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_CTRL
];
1284 LOG_DEBUG("target->state: %s",
1285 target_state_name(target
));
1287 if (target
->state
== TARGET_HALTED
)
1289 LOG_DEBUG("target was already halted");
1293 if (target
->state
== TARGET_UNKNOWN
)
1295 LOG_WARNING("target was in unknown state when halt was requested");
1298 if (arm7_9
->use_dbgrq
)
1300 /* program EmbeddedICE Debug Control Register to assert DBGRQ
1302 if (arm7_9
->set_special_dbgrq
) {
1303 arm7_9
->set_special_dbgrq(target
);
1305 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGRQ
, 1, 1);
1306 embeddedice_store_reg(dbg_ctrl
);
1311 /* program watchpoint unit to match on any address
1313 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
], 0xffffffff);
1314 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
], 0xffffffff);
1315 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], EICE_W_CTRL_ENABLE
);
1316 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
], ~EICE_W_CTRL_nOPC
& 0xff);
1319 target
->debug_reason
= DBG_REASON_DBGRQ
;
1325 * Handle an ARM7/9 target's entry into debug mode. The halt is cleared on the
1326 * ARM. The JTAG queue is then executed and the reason for debug entry is
1327 * examined. Once done, the target is verified to be halted and the processor
1328 * is forced into ARM mode. The core registers are saved for the current core
1329 * mode and the program counter (register 15) is updated as needed. The core
1330 * registers and CPSR and SPSR are saved for restoration later.
1332 * @param target Pointer to target that is entering debug mode
1333 * @return Error code if anything fails, otherwise ERROR_OK
1335 static int arm7_9_debug_entry(struct target
*target
)
1338 uint32_t context
[16];
1339 uint32_t* context_p
[16];
1340 uint32_t r0_thumb
, pc_thumb
;
1343 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1344 struct armv4_5_common_s
*armv4_5
= &arm7_9
->armv4_5_common
;
1345 struct reg
*dbg_stat
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_STAT
];
1346 struct reg
*dbg_ctrl
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_CTRL
];
1348 #ifdef _DEBUG_ARM7_9_
1352 /* program EmbeddedICE Debug Control Register to assert DBGACK and INTDIS
1353 * ensure that DBGRQ is cleared
1355 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGACK
, 1, 1);
1356 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGRQ
, 1, 0);
1357 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_INTDIS
, 1, 1);
1358 embeddedice_store_reg(dbg_ctrl
);
1360 if ((retval
= arm7_9_clear_halt(target
)) != ERROR_OK
)
1365 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
1370 if ((retval
= arm7_9
->examine_debug_reason(target
)) != ERROR_OK
)
1374 if (target
->state
!= TARGET_HALTED
)
1376 LOG_WARNING("target not halted");
1377 return ERROR_TARGET_NOT_HALTED
;
1380 /* if the target is in Thumb state, change to ARM state */
1381 if (buf_get_u32(dbg_stat
->value
, EICE_DBG_STATUS_ITBIT
, 1))
1383 LOG_DEBUG("target entered debug from Thumb state");
1384 /* Entered debug from Thumb mode */
1385 armv4_5
->core_state
= ARMV4_5_STATE_THUMB
;
1386 arm7_9
->change_to_arm(target
, &r0_thumb
, &pc_thumb
);
1387 LOG_DEBUG("r0_thumb: 0x%8.8" PRIx32
", pc_thumb: 0x%8.8" PRIx32
"", r0_thumb
, pc_thumb
);
1391 LOG_DEBUG("target entered debug from ARM state");
1392 /* Entered debug from ARM mode */
1393 armv4_5
->core_state
= ARMV4_5_STATE_ARM
;
1396 for (i
= 0; i
< 16; i
++)
1397 context_p
[i
] = &context
[i
];
1398 /* save core registers (r0 - r15 of current core mode) */
1399 arm7_9
->read_core_regs(target
, 0xffff, context_p
);
1401 arm7_9
->read_xpsr(target
, &cpsr
, 0);
1403 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
1406 /* if the core has been executing in Thumb state, set the T bit */
1407 if (armv4_5
->core_state
== ARMV4_5_STATE_THUMB
)
1410 buf_set_u32(armv4_5
->core_cache
->reg_list
[ARMV4_5_CPSR
].value
, 0, 32, cpsr
);
1411 armv4_5
->core_cache
->reg_list
[ARMV4_5_CPSR
].dirty
= 0;
1412 armv4_5
->core_cache
->reg_list
[ARMV4_5_CPSR
].valid
= 1;
1414 armv4_5
->core_mode
= cpsr
& 0x1f;
1416 if (armv4_5_mode_to_number(armv4_5
->core_mode
) == -1)
1418 target
->state
= TARGET_UNKNOWN
;
1419 LOG_ERROR("cpsr contains invalid mode value - communication failure");
1420 return ERROR_TARGET_FAILURE
;
1423 LOG_DEBUG("target entered debug state in %s mode",
1424 arm_mode_name(armv4_5
->core_mode
));
1426 if (armv4_5
->core_state
== ARMV4_5_STATE_THUMB
)
1428 LOG_DEBUG("thumb state, applying fixups");
1429 context
[0] = r0_thumb
;
1430 context
[15] = pc_thumb
;
1431 } else if (armv4_5
->core_state
== ARMV4_5_STATE_ARM
)
1433 /* adjust value stored by STM */
1434 context
[15] -= 3 * 4;
1437 if ((target
->debug_reason
!= DBG_REASON_DBGRQ
) || (!arm7_9
->use_dbgrq
))
1438 context
[15] -= 3 * ((armv4_5
->core_state
== ARMV4_5_STATE_ARM
) ? 4 : 2);
1440 context
[15] -= arm7_9
->dbgreq_adjust_pc
* ((armv4_5
->core_state
== ARMV4_5_STATE_ARM
) ? 4 : 2);
1442 if (armv4_5_mode_to_number(armv4_5
->core_mode
)==-1)
1445 for (i
= 0; i
<= 15; i
++)
1447 LOG_DEBUG("r%i: 0x%8.8" PRIx32
"", i
, context
[i
]);
1448 buf_set_u32(ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5
->core_mode
, i
).value
, 0, 32, context
[i
]);
1449 ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5
->core_mode
, i
).dirty
= 0;
1450 ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5
->core_mode
, i
).valid
= 1;
1453 LOG_DEBUG("entered debug state at PC 0x%" PRIx32
"", context
[15]);
1455 if (armv4_5_mode_to_number(armv4_5
->core_mode
)==-1)
1458 /* exceptions other than USR & SYS have a saved program status register */
1459 if ((armv4_5
->core_mode
!= ARMV4_5_MODE_USR
) && (armv4_5
->core_mode
!= ARMV4_5_MODE_SYS
))
1462 arm7_9
->read_xpsr(target
, &spsr
, 1);
1463 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
1467 buf_set_u32(ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5
->core_mode
, 16).value
, 0, 32, spsr
);
1468 ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5
->core_mode
, 16).dirty
= 0;
1469 ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5
->core_mode
, 16).valid
= 1;
1472 /* r0 and r15 (pc) have to be restored later */
1473 ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5
->core_mode
, 0).dirty
= ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5
->core_mode
, 0).valid
;
1474 ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5
->core_mode
, 15).dirty
= ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5
->core_mode
, 15).valid
;
1476 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
1479 if (arm7_9
->post_debug_entry
)
1480 arm7_9
->post_debug_entry(target
);
1486 * Validate the full context for an ARM7/9 target in all processor modes. If
1487 * there are any invalid registers for the target, they will all be read. This
1490 * @param target Pointer to the ARM7/9 target to capture the full context from
1491 * @return Error if the target is not halted, has an invalid core mode, or if
1492 * the JTAG queue fails to execute
1494 int arm7_9_full_context(struct target
*target
)
1498 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1499 struct armv4_5_common_s
*armv4_5
= &arm7_9
->armv4_5_common
;
1503 if (target
->state
!= TARGET_HALTED
)
1505 LOG_WARNING("target not halted");
1506 return ERROR_TARGET_NOT_HALTED
;
1509 if (armv4_5_mode_to_number(armv4_5
->core_mode
)==-1)
1512 /* iterate through processor modes (User, FIQ, IRQ, SVC, ABT, UND)
1513 * SYS shares registers with User, so we don't touch SYS
1515 for (i
= 0; i
< 6; i
++)
1518 uint32_t* reg_p
[16];
1522 /* check if there are invalid registers in the current mode
1524 for (j
= 0; j
<= 16; j
++)
1526 if (ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5_number_to_mode(i
), j
).valid
== 0)
1534 /* change processor mode (and mask T bit) */
1535 tmp_cpsr
= buf_get_u32(armv4_5
->core_cache
->reg_list
[ARMV4_5_CPSR
].value
, 0, 8) & 0xE0;
1536 tmp_cpsr
|= armv4_5_number_to_mode(i
);
1538 arm7_9
->write_xpsr_im8(target
, tmp_cpsr
& 0xff, 0, 0);
1540 for (j
= 0; j
< 15; j
++)
1542 if (ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5_number_to_mode(i
), j
).valid
== 0)
1544 reg_p
[j
] = (uint32_t*)ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5_number_to_mode(i
), j
).value
;
1546 ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5_number_to_mode(i
), j
).valid
= 1;
1547 ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5_number_to_mode(i
), j
).dirty
= 0;
1551 /* if only the PSR is invalid, mask is all zeroes */
1553 arm7_9
->read_core_regs(target
, mask
, reg_p
);
1555 /* check if the PSR has to be read */
1556 if (ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5_number_to_mode(i
), 16).valid
== 0)
1558 arm7_9
->read_xpsr(target
, (uint32_t*)ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5_number_to_mode(i
), 16).value
, 1);
1559 ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5_number_to_mode(i
), 16).valid
= 1;
1560 ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5_number_to_mode(i
), 16).dirty
= 0;
1565 /* restore processor mode (mask T bit) */
1566 arm7_9
->write_xpsr_im8(target
, buf_get_u32(armv4_5
->core_cache
->reg_list
[ARMV4_5_CPSR
].value
, 0, 8) & ~0x20, 0, 0);
1568 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
1576 * Restore the processor context on an ARM7/9 target. The full processor
1577 * context is analyzed to see if any of the registers are dirty on this end, but
1578 * have a valid new value. If this is the case, the processor is changed to the
1579 * appropriate mode and the new register values are written out to the
1580 * processor. If there happens to be a dirty register with an invalid value, an
1581 * error will be logged.
1583 * @param target Pointer to the ARM7/9 target to have its context restored
1584 * @return Error status if the target is not halted or the core mode in the
1585 * armv4_5 struct is invalid.
1587 int arm7_9_restore_context(struct target
*target
)
1589 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1590 struct armv4_5_common_s
*armv4_5
= &arm7_9
->armv4_5_common
;
1592 struct armv4_5_core_reg
*reg_arch_info
;
1593 enum armv4_5_mode current_mode
= armv4_5
->core_mode
;
1600 if (target
->state
!= TARGET_HALTED
)
1602 LOG_WARNING("target not halted");
1603 return ERROR_TARGET_NOT_HALTED
;
1606 if (arm7_9
->pre_restore_context
)
1607 arm7_9
->pre_restore_context(target
);
1609 if (armv4_5_mode_to_number(armv4_5
->core_mode
)==-1)
1612 /* iterate through processor modes (User, FIQ, IRQ, SVC, ABT, UND)
1613 * SYS shares registers with User, so we don't touch SYS
1615 for (i
= 0; i
< 6; i
++)
1617 LOG_DEBUG("examining %s mode",
1618 arm_mode_name(armv4_5
->core_mode
));
1621 /* check if there are dirty registers in the current mode
1623 for (j
= 0; j
<= 16; j
++)
1625 reg
= &ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5_number_to_mode(i
), j
);
1626 reg_arch_info
= reg
->arch_info
;
1627 if (reg
->dirty
== 1)
1629 if (reg
->valid
== 1)
1632 LOG_DEBUG("examining dirty reg: %s", reg
->name
);
1633 if ((reg_arch_info
->mode
!= ARMV4_5_MODE_ANY
)
1634 && (reg_arch_info
->mode
!= current_mode
)
1635 && !((reg_arch_info
->mode
== ARMV4_5_MODE_USR
) && (armv4_5
->core_mode
== ARMV4_5_MODE_SYS
))
1636 && !((reg_arch_info
->mode
== ARMV4_5_MODE_SYS
) && (armv4_5
->core_mode
== ARMV4_5_MODE_USR
)))
1639 LOG_DEBUG("require mode change");
1644 LOG_ERROR("BUG: dirty register '%s', but no valid data", reg
->name
);
1651 uint32_t mask
= 0x0;
1659 /* change processor mode (mask T bit) */
1660 tmp_cpsr
= buf_get_u32(armv4_5
->core_cache
->reg_list
[ARMV4_5_CPSR
].value
, 0, 8) & 0xE0;
1661 tmp_cpsr
|= armv4_5_number_to_mode(i
);
1663 arm7_9
->write_xpsr_im8(target
, tmp_cpsr
& 0xff, 0, 0);
1664 current_mode
= armv4_5_number_to_mode(i
);
1667 for (j
= 0; j
<= 14; j
++)
1669 reg
= &ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5_number_to_mode(i
), j
);
1670 reg_arch_info
= reg
->arch_info
;
1673 if (reg
->dirty
== 1)
1675 regs
[j
] = buf_get_u32(reg
->value
, 0, 32);
1680 LOG_DEBUG("writing register %i mode %s "
1681 "with value 0x%8.8" PRIx32
, j
,
1682 arm_mode_name(armv4_5
->core_mode
),
1689 arm7_9
->write_core_regs(target
, mask
, regs
);
1692 reg
= &ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5_number_to_mode(i
), 16);
1693 reg_arch_info
= reg
->arch_info
;
1694 if ((reg
->dirty
) && (reg_arch_info
->mode
!= ARMV4_5_MODE_ANY
))
1696 LOG_DEBUG("writing SPSR of mode %i with value 0x%8.8" PRIx32
"", i
, buf_get_u32(reg
->value
, 0, 32));
1697 arm7_9
->write_xpsr(target
, buf_get_u32(reg
->value
, 0, 32), 1);
1702 if ((armv4_5
->core_cache
->reg_list
[ARMV4_5_CPSR
].dirty
== 0) && (armv4_5
->core_mode
!= current_mode
))
1704 /* restore processor mode (mask T bit) */
1707 tmp_cpsr
= buf_get_u32(armv4_5
->core_cache
->reg_list
[ARMV4_5_CPSR
].value
, 0, 8) & 0xE0;
1708 tmp_cpsr
|= armv4_5_number_to_mode(i
);
1710 LOG_DEBUG("writing lower 8 bit of cpsr with value 0x%2.2x", (unsigned)(tmp_cpsr
));
1711 arm7_9
->write_xpsr_im8(target
, tmp_cpsr
& 0xff, 0, 0);
1713 else if (armv4_5
->core_cache
->reg_list
[ARMV4_5_CPSR
].dirty
== 1)
1715 /* CPSR has been changed, full restore necessary (mask T bit) */
1716 LOG_DEBUG("writing cpsr with value 0x%8.8" PRIx32
"", buf_get_u32(armv4_5
->core_cache
->reg_list
[ARMV4_5_CPSR
].value
, 0, 32));
1717 arm7_9
->write_xpsr(target
, buf_get_u32(armv4_5
->core_cache
->reg_list
[ARMV4_5_CPSR
].value
, 0, 32) & ~0x20, 0);
1718 armv4_5
->core_cache
->reg_list
[ARMV4_5_CPSR
].dirty
= 0;
1719 armv4_5
->core_cache
->reg_list
[ARMV4_5_CPSR
].valid
= 1;
1723 LOG_DEBUG("writing PC with value 0x%8.8" PRIx32
"", buf_get_u32(armv4_5
->core_cache
->reg_list
[15].value
, 0, 32));
1724 arm7_9
->write_pc(target
, buf_get_u32(armv4_5
->core_cache
->reg_list
[15].value
, 0, 32));
1725 armv4_5
->core_cache
->reg_list
[15].dirty
= 0;
1727 if (arm7_9
->post_restore_context
)
1728 arm7_9
->post_restore_context(target
);
1734 * Restart the core of an ARM7/9 target. A RESTART command is sent to the
1735 * instruction register and the JTAG state is set to TAP_IDLE causing a core
1738 * @param target Pointer to the ARM7/9 target to be restarted
1739 * @return Result of executing the JTAG queue
1741 int arm7_9_restart_core(struct target
*target
)
1743 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1744 struct arm_jtag
*jtag_info
= &arm7_9
->jtag_info
;
1746 /* set RESTART instruction */
1747 jtag_set_end_state(TAP_IDLE
);
1748 if (arm7_9
->need_bypass_before_restart
) {
1749 arm7_9
->need_bypass_before_restart
= 0;
1750 arm_jtag_set_instr(jtag_info
, 0xf, NULL
);
1752 arm_jtag_set_instr(jtag_info
, 0x4, NULL
);
1754 jtag_add_runtest(1, jtag_set_end_state(TAP_IDLE
));
1755 return jtag_execute_queue();
1759 * Enable the watchpoints on an ARM7/9 target. The target's watchpoints are
1760 * iterated through and are set on the target if they aren't already set.
1762 * @param target Pointer to the ARM7/9 target to enable watchpoints on
1764 void arm7_9_enable_watchpoints(struct target
*target
)
1766 struct watchpoint
*watchpoint
= target
->watchpoints
;
1770 if (watchpoint
->set
== 0)
1771 arm7_9_set_watchpoint(target
, watchpoint
);
1772 watchpoint
= watchpoint
->next
;
1777 * Enable the breakpoints on an ARM7/9 target. The target's breakpoints are
1778 * iterated through and are set on the target.
1780 * @param target Pointer to the ARM7/9 target to enable breakpoints on
1782 void arm7_9_enable_breakpoints(struct target
*target
)
1784 struct breakpoint
*breakpoint
= target
->breakpoints
;
1786 /* set any pending breakpoints */
1789 arm7_9_set_breakpoint(target
, breakpoint
);
1790 breakpoint
= breakpoint
->next
;
1794 int arm7_9_resume(struct target
*target
, int current
, uint32_t address
, int handle_breakpoints
, int debug_execution
)
1796 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1797 struct armv4_5_common_s
*armv4_5
= &arm7_9
->armv4_5_common
;
1798 struct breakpoint
*breakpoint
= target
->breakpoints
;
1799 struct reg
*dbg_ctrl
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_CTRL
];
1800 int err
, retval
= ERROR_OK
;
1804 if (target
->state
!= TARGET_HALTED
)
1806 LOG_WARNING("target not halted");
1807 return ERROR_TARGET_NOT_HALTED
;
1810 if (!debug_execution
)
1812 target_free_all_working_areas(target
);
1815 /* current = 1: continue on current pc, otherwise continue at <address> */
1817 buf_set_u32(armv4_5
->core_cache
->reg_list
[15].value
, 0, 32, address
);
1819 uint32_t current_pc
;
1820 current_pc
= buf_get_u32(armv4_5
->core_cache
->reg_list
[15].value
, 0, 32);
1822 /* the front-end may request us not to handle breakpoints */
1823 if (handle_breakpoints
)
1825 if ((breakpoint
= breakpoint_find(target
, buf_get_u32(armv4_5
->core_cache
->reg_list
[15].value
, 0, 32))))
1827 LOG_DEBUG("unset breakpoint at 0x%8.8" PRIx32
" (id: %d)", breakpoint
->address
, breakpoint
->unique_id
);
1828 if ((retval
= arm7_9_unset_breakpoint(target
, breakpoint
)) != ERROR_OK
)
1833 /* calculate PC of next instruction */
1835 if ((retval
= arm_simulate_step(target
, &next_pc
)) != ERROR_OK
)
1837 uint32_t current_opcode
;
1838 target_read_u32(target
, current_pc
, ¤t_opcode
);
1839 LOG_ERROR("Couldn't calculate PC of next instruction, current opcode was 0x%8.8" PRIx32
"", current_opcode
);
1843 LOG_DEBUG("enable single-step");
1844 arm7_9
->enable_single_step(target
, next_pc
);
1846 target
->debug_reason
= DBG_REASON_SINGLESTEP
;
1848 if ((retval
= arm7_9_restore_context(target
)) != ERROR_OK
)
1853 if (armv4_5
->core_state
== ARMV4_5_STATE_ARM
)
1854 arm7_9
->branch_resume(target
);
1855 else if (armv4_5
->core_state
== ARMV4_5_STATE_THUMB
)
1857 arm7_9
->branch_resume_thumb(target
);
1861 LOG_ERROR("unhandled core state");
1865 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGACK
, 1, 0);
1866 embeddedice_write_reg(dbg_ctrl
, buf_get_u32(dbg_ctrl
->value
, 0, dbg_ctrl
->size
));
1867 err
= arm7_9_execute_sys_speed(target
);
1869 LOG_DEBUG("disable single-step");
1870 arm7_9
->disable_single_step(target
);
1872 if (err
!= ERROR_OK
)
1874 if ((retval
= arm7_9_set_breakpoint(target
, breakpoint
)) != ERROR_OK
)
1878 target
->state
= TARGET_UNKNOWN
;
1882 arm7_9_debug_entry(target
);
1883 LOG_DEBUG("new PC after step: 0x%8.8" PRIx32
"", buf_get_u32(armv4_5
->core_cache
->reg_list
[15].value
, 0, 32));
1885 LOG_DEBUG("set breakpoint at 0x%8.8" PRIx32
"", breakpoint
->address
);
1886 if ((retval
= arm7_9_set_breakpoint(target
, breakpoint
)) != ERROR_OK
)
1893 /* enable any pending breakpoints and watchpoints */
1894 arm7_9_enable_breakpoints(target
);
1895 arm7_9_enable_watchpoints(target
);
1897 if ((retval
= arm7_9_restore_context(target
)) != ERROR_OK
)
1902 if (armv4_5
->core_state
== ARMV4_5_STATE_ARM
)
1904 arm7_9
->branch_resume(target
);
1906 else if (armv4_5
->core_state
== ARMV4_5_STATE_THUMB
)
1908 arm7_9
->branch_resume_thumb(target
);
1912 LOG_ERROR("unhandled core state");
1916 /* deassert DBGACK and INTDIS */
1917 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGACK
, 1, 0);
1918 /* INTDIS only when we really resume, not during debug execution */
1919 if (!debug_execution
)
1920 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_INTDIS
, 1, 0);
1921 embeddedice_write_reg(dbg_ctrl
, buf_get_u32(dbg_ctrl
->value
, 0, dbg_ctrl
->size
));
1923 if ((retval
= arm7_9_restart_core(target
)) != ERROR_OK
)
1928 target
->debug_reason
= DBG_REASON_NOTHALTED
;
1930 if (!debug_execution
)
1932 /* registers are now invalid */
1933 armv4_5_invalidate_core_regs(target
);
1934 target
->state
= TARGET_RUNNING
;
1935 if ((retval
= target_call_event_callbacks(target
, TARGET_EVENT_RESUMED
)) != ERROR_OK
)
1942 target
->state
= TARGET_DEBUG_RUNNING
;
1943 if ((retval
= target_call_event_callbacks(target
, TARGET_EVENT_DEBUG_RESUMED
)) != ERROR_OK
)
1949 LOG_DEBUG("target resumed");
1954 void arm7_9_enable_eice_step(struct target
*target
, uint32_t next_pc
)
1956 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1957 struct armv4_5_common_s
*armv4_5
= &arm7_9
->armv4_5_common
;
1958 uint32_t current_pc
;
1959 current_pc
= buf_get_u32(armv4_5
->core_cache
->reg_list
[15].value
, 0, 32);
1961 if (next_pc
!= current_pc
)
1963 /* setup an inverse breakpoint on the current PC
1964 * - comparator 1 matches the current address
1965 * - rangeout from comparator 1 is connected to comparator 0 rangein
1966 * - comparator 0 matches any address, as long as rangein is low */
1967 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
], 0xffffffff);
1968 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
], 0xffffffff);
1969 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], EICE_W_CTRL_ENABLE
);
1970 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
], ~(EICE_W_CTRL_RANGE
| EICE_W_CTRL_nOPC
) & 0xff);
1971 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_VALUE
], current_pc
);
1972 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_MASK
], 0);
1973 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_DATA_MASK
], 0xffffffff);
1974 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
], 0x0);
1975 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_MASK
], ~EICE_W_CTRL_nOPC
& 0xff);
1979 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
], 0xffffffff);
1980 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
], 0xffffffff);
1981 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
], 0x0);
1982 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
], 0xff);
1983 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_VALUE
], next_pc
);
1984 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_MASK
], 0);
1985 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_DATA_MASK
], 0xffffffff);
1986 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
], EICE_W_CTRL_ENABLE
);
1987 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_MASK
], ~EICE_W_CTRL_nOPC
& 0xff);
1991 void arm7_9_disable_eice_step(struct target
*target
)
1993 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
1995 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_ADDR_MASK
]);
1996 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_DATA_MASK
]);
1997 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_VALUE
]);
1998 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W0_CONTROL_MASK
]);
1999 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_VALUE
]);
2000 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_ADDR_MASK
]);
2001 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_DATA_MASK
]);
2002 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_MASK
]);
2003 embeddedice_store_reg(&arm7_9
->eice_cache
->reg_list
[EICE_W1_CONTROL_VALUE
]);
2006 int arm7_9_step(struct target
*target
, int current
, uint32_t address
, int handle_breakpoints
)
2008 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2009 struct armv4_5_common_s
*armv4_5
= &arm7_9
->armv4_5_common
;
2010 struct breakpoint
*breakpoint
= NULL
;
2013 if (target
->state
!= TARGET_HALTED
)
2015 LOG_WARNING("target not halted");
2016 return ERROR_TARGET_NOT_HALTED
;
2019 /* current = 1: continue on current pc, otherwise continue at <address> */
2021 buf_set_u32(armv4_5
->core_cache
->reg_list
[15].value
, 0, 32, address
);
2023 uint32_t current_pc
;
2024 current_pc
= buf_get_u32(armv4_5
->core_cache
->reg_list
[15].value
, 0, 32);
2026 /* the front-end may request us not to handle breakpoints */
2027 if (handle_breakpoints
)
2028 if ((breakpoint
= breakpoint_find(target
, buf_get_u32(armv4_5
->core_cache
->reg_list
[15].value
, 0, 32))))
2029 if ((retval
= arm7_9_unset_breakpoint(target
, breakpoint
)) != ERROR_OK
)
2034 target
->debug_reason
= DBG_REASON_SINGLESTEP
;
2036 /* calculate PC of next instruction */
2038 if ((retval
= arm_simulate_step(target
, &next_pc
)) != ERROR_OK
)
2040 uint32_t current_opcode
;
2041 target_read_u32(target
, current_pc
, ¤t_opcode
);
2042 LOG_ERROR("Couldn't calculate PC of next instruction, current opcode was 0x%8.8" PRIx32
"", current_opcode
);
2046 if ((retval
= arm7_9_restore_context(target
)) != ERROR_OK
)
2051 arm7_9
->enable_single_step(target
, next_pc
);
2053 if (armv4_5
->core_state
== ARMV4_5_STATE_ARM
)
2055 arm7_9
->branch_resume(target
);
2057 else if (armv4_5
->core_state
== ARMV4_5_STATE_THUMB
)
2059 arm7_9
->branch_resume_thumb(target
);
2063 LOG_ERROR("unhandled core state");
2067 if ((retval
= target_call_event_callbacks(target
, TARGET_EVENT_RESUMED
)) != ERROR_OK
)
2072 err
= arm7_9_execute_sys_speed(target
);
2073 arm7_9
->disable_single_step(target
);
2075 /* registers are now invalid */
2076 armv4_5_invalidate_core_regs(target
);
2078 if (err
!= ERROR_OK
)
2080 target
->state
= TARGET_UNKNOWN
;
2082 arm7_9_debug_entry(target
);
2083 if ((retval
= target_call_event_callbacks(target
, TARGET_EVENT_HALTED
)) != ERROR_OK
)
2087 LOG_DEBUG("target stepped");
2091 if ((retval
= arm7_9_set_breakpoint(target
, breakpoint
)) != ERROR_OK
)
2099 int arm7_9_read_core_reg(struct target
*target
, int num
, enum armv4_5_mode mode
)
2101 uint32_t* reg_p
[16];
2104 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2105 struct armv4_5_common_s
*armv4_5
= &arm7_9
->armv4_5_common
;
2107 if (armv4_5_mode_to_number(armv4_5
->core_mode
)==-1)
2110 enum armv4_5_mode reg_mode
= ((struct armv4_5_core_reg
*)ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, mode
, num
).arch_info
)->mode
;
2112 if ((num
< 0) || (num
> 16))
2113 return ERROR_INVALID_ARGUMENTS
;
2115 if ((mode
!= ARMV4_5_MODE_ANY
)
2116 && (mode
!= armv4_5
->core_mode
)
2117 && (reg_mode
!= ARMV4_5_MODE_ANY
))
2121 /* change processor mode (mask T bit) */
2122 tmp_cpsr
= buf_get_u32(armv4_5
->core_cache
->reg_list
[ARMV4_5_CPSR
].value
, 0, 8) & 0xE0;
2125 arm7_9
->write_xpsr_im8(target
, tmp_cpsr
& 0xff, 0, 0);
2128 if ((num
>= 0) && (num
<= 15))
2130 /* read a normal core register */
2131 reg_p
[num
] = &value
;
2133 arm7_9
->read_core_regs(target
, 1 << num
, reg_p
);
2137 /* read a program status register
2138 * if the register mode is MODE_ANY, we read the cpsr, otherwise a spsr
2140 struct armv4_5_core_reg
*arch_info
= ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, mode
, num
).arch_info
;
2141 int spsr
= (arch_info
->mode
== ARMV4_5_MODE_ANY
) ? 0 : 1;
2143 arm7_9
->read_xpsr(target
, &value
, spsr
);
2146 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
2151 ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, mode
, num
).valid
= 1;
2152 ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, mode
, num
).dirty
= 0;
2153 buf_set_u32(ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, mode
, num
).value
, 0, 32, value
);
2155 if ((mode
!= ARMV4_5_MODE_ANY
)
2156 && (mode
!= armv4_5
->core_mode
)
2157 && (reg_mode
!= ARMV4_5_MODE_ANY
)) {
2158 /* restore processor mode (mask T bit) */
2159 arm7_9
->write_xpsr_im8(target
, buf_get_u32(armv4_5
->core_cache
->reg_list
[ARMV4_5_CPSR
].value
, 0, 8) & ~0x20, 0, 0);
2165 int arm7_9_write_core_reg(struct target
*target
, int num
, enum armv4_5_mode mode
, uint32_t value
)
2168 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2169 struct armv4_5_common_s
*armv4_5
= &arm7_9
->armv4_5_common
;
2171 if (armv4_5_mode_to_number(armv4_5
->core_mode
)==-1)
2174 enum armv4_5_mode reg_mode
= ((struct armv4_5_core_reg
*)ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, mode
, num
).arch_info
)->mode
;
2176 if ((num
< 0) || (num
> 16))
2177 return ERROR_INVALID_ARGUMENTS
;
2179 if ((mode
!= ARMV4_5_MODE_ANY
)
2180 && (mode
!= armv4_5
->core_mode
)
2181 && (reg_mode
!= ARMV4_5_MODE_ANY
)) {
2184 /* change processor mode (mask T bit) */
2185 tmp_cpsr
= buf_get_u32(armv4_5
->core_cache
->reg_list
[ARMV4_5_CPSR
].value
, 0, 8) & 0xE0;
2188 arm7_9
->write_xpsr_im8(target
, tmp_cpsr
& 0xff, 0, 0);
2191 if ((num
>= 0) && (num
<= 15))
2193 /* write a normal core register */
2196 arm7_9
->write_core_regs(target
, 1 << num
, reg
);
2200 /* write a program status register
2201 * if the register mode is MODE_ANY, we write the cpsr, otherwise a spsr
2203 struct armv4_5_core_reg
*arch_info
= ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, mode
, num
).arch_info
;
2204 int spsr
= (arch_info
->mode
== ARMV4_5_MODE_ANY
) ? 0 : 1;
2206 /* if we're writing the CPSR, mask the T bit */
2210 arm7_9
->write_xpsr(target
, value
, spsr
);
2213 ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, mode
, num
).valid
= 1;
2214 ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, mode
, num
).dirty
= 0;
2216 if ((mode
!= ARMV4_5_MODE_ANY
)
2217 && (mode
!= armv4_5
->core_mode
)
2218 && (reg_mode
!= ARMV4_5_MODE_ANY
)) {
2219 /* restore processor mode (mask T bit) */
2220 arm7_9
->write_xpsr_im8(target
, buf_get_u32(armv4_5
->core_cache
->reg_list
[ARMV4_5_CPSR
].value
, 0, 8) & ~0x20, 0, 0);
2223 return jtag_execute_queue();
2226 int arm7_9_read_memory(struct target
*target
, uint32_t address
, uint32_t size
, uint32_t count
, uint8_t *buffer
)
2228 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2229 struct armv4_5_common_s
*armv4_5
= &arm7_9
->armv4_5_common
;
2231 uint32_t num_accesses
= 0;
2232 int thisrun_accesses
;
2238 LOG_DEBUG("address: 0x%8.8" PRIx32
", size: 0x%8.8" PRIx32
", count: 0x%8.8" PRIx32
"", address
, size
, count
);
2240 if (target
->state
!= TARGET_HALTED
)
2242 LOG_WARNING("target not halted");
2243 return ERROR_TARGET_NOT_HALTED
;
2246 /* sanitize arguments */
2247 if (((size
!= 4) && (size
!= 2) && (size
!= 1)) || (count
== 0) || !(buffer
))
2248 return ERROR_INVALID_ARGUMENTS
;
2250 if (((size
== 4) && (address
& 0x3u
)) || ((size
== 2) && (address
& 0x1u
)))
2251 return ERROR_TARGET_UNALIGNED_ACCESS
;
2253 /* load the base register with the address of the first word */
2255 arm7_9
->write_core_regs(target
, 0x1, reg
);
2262 while (num_accesses
< count
)
2265 thisrun_accesses
= ((count
- num_accesses
) >= 14) ? 14 : (count
- num_accesses
);
2266 reg_list
= (0xffff >> (15 - thisrun_accesses
)) & 0xfffe;
2268 if (last_reg
<= thisrun_accesses
)
2269 last_reg
= thisrun_accesses
;
2271 arm7_9
->load_word_regs(target
, reg_list
);
2273 /* fast memory reads are only safe when the target is running
2274 * from a sufficiently high clock (32 kHz is usually too slow)
2276 if (arm7_9
->fast_memory_access
)
2277 retval
= arm7_9_execute_fast_sys_speed(target
);
2279 retval
= arm7_9_execute_sys_speed(target
);
2280 if (retval
!= ERROR_OK
)
2283 arm7_9
->read_core_regs_target_buffer(target
, reg_list
, buffer
, 4);
2285 /* advance buffer, count number of accesses */
2286 buffer
+= thisrun_accesses
* 4;
2287 num_accesses
+= thisrun_accesses
;
2289 if ((j
++%1024) == 0)
2296 while (num_accesses
< count
)
2299 thisrun_accesses
= ((count
- num_accesses
) >= 14) ? 14 : (count
- num_accesses
);
2300 reg_list
= (0xffff >> (15 - thisrun_accesses
)) & 0xfffe;
2302 for (i
= 1; i
<= thisrun_accesses
; i
++)
2306 arm7_9
->load_hword_reg(target
, i
);
2307 /* fast memory reads are only safe when the target is running
2308 * from a sufficiently high clock (32 kHz is usually too slow)
2310 if (arm7_9
->fast_memory_access
)
2311 retval
= arm7_9_execute_fast_sys_speed(target
);
2313 retval
= arm7_9_execute_sys_speed(target
);
2314 if (retval
!= ERROR_OK
)
2321 arm7_9
->read_core_regs_target_buffer(target
, reg_list
, buffer
, 2);
2323 /* advance buffer, count number of accesses */
2324 buffer
+= thisrun_accesses
* 2;
2325 num_accesses
+= thisrun_accesses
;
2327 if ((j
++%1024) == 0)
2334 while (num_accesses
< count
)
2337 thisrun_accesses
= ((count
- num_accesses
) >= 14) ? 14 : (count
- num_accesses
);
2338 reg_list
= (0xffff >> (15 - thisrun_accesses
)) & 0xfffe;
2340 for (i
= 1; i
<= thisrun_accesses
; i
++)
2344 arm7_9
->load_byte_reg(target
, i
);
2345 /* fast memory reads are only safe when the target is running
2346 * from a sufficiently high clock (32 kHz is usually too slow)
2348 if (arm7_9
->fast_memory_access
)
2349 retval
= arm7_9_execute_fast_sys_speed(target
);
2351 retval
= arm7_9_execute_sys_speed(target
);
2352 if (retval
!= ERROR_OK
)
2358 arm7_9
->read_core_regs_target_buffer(target
, reg_list
, buffer
, 1);
2360 /* advance buffer, count number of accesses */
2361 buffer
+= thisrun_accesses
* 1;
2362 num_accesses
+= thisrun_accesses
;
2364 if ((j
++%1024) == 0)
2371 LOG_ERROR("BUG: we shouldn't get here");
2376 if (armv4_5_mode_to_number(armv4_5
->core_mode
)==-1)
2379 for (i
= 0; i
<= last_reg
; i
++)
2380 ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5
->core_mode
, i
).dirty
= ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5
->core_mode
, i
).valid
;
2382 arm7_9
->read_xpsr(target
, &cpsr
, 0);
2383 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
2385 LOG_ERROR("JTAG error while reading cpsr");
2386 return ERROR_TARGET_DATA_ABORT
;
2389 if (((cpsr
& 0x1f) == ARMV4_5_MODE_ABT
) && (armv4_5
->core_mode
!= ARMV4_5_MODE_ABT
))
2391 LOG_WARNING("memory read caused data abort (address: 0x%8.8" PRIx32
", size: 0x%" PRIx32
", count: 0x%" PRIx32
")", address
, size
, count
);
2393 arm7_9
->write_xpsr_im8(target
, buf_get_u32(armv4_5
->core_cache
->reg_list
[ARMV4_5_CPSR
].value
, 0, 8) & ~0x20, 0, 0);
2395 return ERROR_TARGET_DATA_ABORT
;
2401 int arm7_9_write_memory(struct target
*target
, uint32_t address
, uint32_t size
, uint32_t count
, uint8_t *buffer
)
2403 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2404 struct armv4_5_common_s
*armv4_5
= &arm7_9
->armv4_5_common
;
2405 struct reg
*dbg_ctrl
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_CTRL
];
2408 uint32_t num_accesses
= 0;
2409 int thisrun_accesses
;
2415 #ifdef _DEBUG_ARM7_9_
2416 LOG_DEBUG("address: 0x%8.8x, size: 0x%8.8x, count: 0x%8.8x", address
, size
, count
);
2419 if (target
->state
!= TARGET_HALTED
)
2421 LOG_WARNING("target not halted");
2422 return ERROR_TARGET_NOT_HALTED
;
2425 /* sanitize arguments */
2426 if (((size
!= 4) && (size
!= 2) && (size
!= 1)) || (count
== 0) || !(buffer
))
2427 return ERROR_INVALID_ARGUMENTS
;
2429 if (((size
== 4) && (address
& 0x3u
)) || ((size
== 2) && (address
& 0x1u
)))
2430 return ERROR_TARGET_UNALIGNED_ACCESS
;
2432 /* load the base register with the address of the first word */
2434 arm7_9
->write_core_regs(target
, 0x1, reg
);
2436 /* Clear DBGACK, to make sure memory fetches work as expected */
2437 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGACK
, 1, 0);
2438 embeddedice_store_reg(dbg_ctrl
);
2443 while (num_accesses
< count
)
2446 thisrun_accesses
= ((count
- num_accesses
) >= 14) ? 14 : (count
- num_accesses
);
2447 reg_list
= (0xffff >> (15 - thisrun_accesses
)) & 0xfffe;
2449 for (i
= 1; i
<= thisrun_accesses
; i
++)
2453 reg
[i
] = target_buffer_get_u32(target
, buffer
);
2457 arm7_9
->write_core_regs(target
, reg_list
, reg
);
2459 arm7_9
->store_word_regs(target
, reg_list
);
2461 /* fast memory writes are only safe when the target is running
2462 * from a sufficiently high clock (32 kHz is usually too slow)
2464 if (arm7_9
->fast_memory_access
)
2465 retval
= arm7_9_execute_fast_sys_speed(target
);
2467 retval
= arm7_9_execute_sys_speed(target
);
2468 if (retval
!= ERROR_OK
)
2473 num_accesses
+= thisrun_accesses
;
2477 while (num_accesses
< count
)
2480 thisrun_accesses
= ((count
- num_accesses
) >= 14) ? 14 : (count
- num_accesses
);
2481 reg_list
= (0xffff >> (15 - thisrun_accesses
)) & 0xfffe;
2483 for (i
= 1; i
<= thisrun_accesses
; i
++)
2487 reg
[i
] = target_buffer_get_u16(target
, buffer
) & 0xffff;
2491 arm7_9
->write_core_regs(target
, reg_list
, reg
);
2493 for (i
= 1; i
<= thisrun_accesses
; i
++)
2495 arm7_9
->store_hword_reg(target
, i
);
2497 /* fast memory writes are only safe when the target is running
2498 * from a sufficiently high clock (32 kHz is usually too slow)
2500 if (arm7_9
->fast_memory_access
)
2501 retval
= arm7_9_execute_fast_sys_speed(target
);
2503 retval
= arm7_9_execute_sys_speed(target
);
2504 if (retval
!= ERROR_OK
)
2510 num_accesses
+= thisrun_accesses
;
2514 while (num_accesses
< count
)
2517 thisrun_accesses
= ((count
- num_accesses
) >= 14) ? 14 : (count
- num_accesses
);
2518 reg_list
= (0xffff >> (15 - thisrun_accesses
)) & 0xfffe;
2520 for (i
= 1; i
<= thisrun_accesses
; i
++)
2524 reg
[i
] = *buffer
++ & 0xff;
2527 arm7_9
->write_core_regs(target
, reg_list
, reg
);
2529 for (i
= 1; i
<= thisrun_accesses
; i
++)
2531 arm7_9
->store_byte_reg(target
, i
);
2532 /* fast memory writes are only safe when the target is running
2533 * from a sufficiently high clock (32 kHz is usually too slow)
2535 if (arm7_9
->fast_memory_access
)
2536 retval
= arm7_9_execute_fast_sys_speed(target
);
2538 retval
= arm7_9_execute_sys_speed(target
);
2539 if (retval
!= ERROR_OK
)
2546 num_accesses
+= thisrun_accesses
;
2550 LOG_ERROR("BUG: we shouldn't get here");
2556 buf_set_u32(dbg_ctrl
->value
, EICE_DBG_CONTROL_DBGACK
, 1, 1);
2557 embeddedice_store_reg(dbg_ctrl
);
2559 if (armv4_5_mode_to_number(armv4_5
->core_mode
)==-1)
2562 for (i
= 0; i
<= last_reg
; i
++)
2563 ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5
->core_mode
, i
).dirty
= ARMV4_5_CORE_REG_MODE(armv4_5
->core_cache
, armv4_5
->core_mode
, i
).valid
;
2565 arm7_9
->read_xpsr(target
, &cpsr
, 0);
2566 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
2568 LOG_ERROR("JTAG error while reading cpsr");
2569 return ERROR_TARGET_DATA_ABORT
;
2572 if (((cpsr
& 0x1f) == ARMV4_5_MODE_ABT
) && (armv4_5
->core_mode
!= ARMV4_5_MODE_ABT
))
2574 LOG_WARNING("memory write caused data abort (address: 0x%8.8" PRIx32
", size: 0x%" PRIx32
", count: 0x%" PRIx32
")", address
, size
, count
);
2576 arm7_9
->write_xpsr_im8(target
, buf_get_u32(armv4_5
->core_cache
->reg_list
[ARMV4_5_CPSR
].value
, 0, 8) & ~0x20, 0, 0);
2578 return ERROR_TARGET_DATA_ABORT
;
2584 static int dcc_count
;
2585 static uint8_t *dcc_buffer
;
2587 static int arm7_9_dcc_completion(struct target
*target
, uint32_t exit_point
, int timeout_ms
, void *arch_info
)
2589 int retval
= ERROR_OK
;
2590 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2592 if ((retval
= target_wait_state(target
, TARGET_DEBUG_RUNNING
, 500)) != ERROR_OK
)
2595 int little
= target
->endianness
== TARGET_LITTLE_ENDIAN
;
2596 int count
= dcc_count
;
2597 uint8_t *buffer
= dcc_buffer
;
2600 /* Handle first & last using standard embeddedice_write_reg and the middle ones w/the
2601 * core function repeated. */
2602 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_COMMS_DATA
], fast_target_buffer_get_u32(buffer
, little
));
2605 struct embeddedice_reg
*ice_reg
= arm7_9
->eice_cache
->reg_list
[EICE_COMMS_DATA
].arch_info
;
2606 uint8_t reg_addr
= ice_reg
->addr
& 0x1f;
2607 struct jtag_tap
*tap
;
2608 tap
= ice_reg
->jtag_info
->tap
;
2610 embeddedice_write_dcc(tap
, reg_addr
, buffer
, little
, count
-2);
2611 buffer
+= (count
-2)*4;
2613 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_COMMS_DATA
], fast_target_buffer_get_u32(buffer
, little
));
2617 for (i
= 0; i
< count
; i
++)
2619 embeddedice_write_reg(&arm7_9
->eice_cache
->reg_list
[EICE_COMMS_DATA
], fast_target_buffer_get_u32(buffer
, little
));
2624 if ((retval
= target_halt(target
))!= ERROR_OK
)
2628 return target_wait_state(target
, TARGET_HALTED
, 500);
2631 static const uint32_t dcc_code
[] =
2633 /* r0 == input, points to memory buffer
2637 /* spin until DCC control (c0) reports data arrived */
2638 0xee101e10, /* w: mrc p14, #0, r1, c0, c0 */
2639 0xe3110001, /* tst r1, #1 */
2640 0x0afffffc, /* bne w */
2642 /* read word from DCC (c1), write to memory */
2643 0xee111e10, /* mrc p14, #0, r1, c1, c0 */
2644 0xe4801004, /* str r1, [r0], #4 */
2647 0xeafffff9 /* b w */
2650 int armv4_5_run_algorithm_inner(struct target
*target
, int num_mem_params
, struct mem_param
*mem_params
, int num_reg_params
, struct reg_param
*reg_params
, uint32_t entry_point
, uint32_t exit_point
, int timeout_ms
, void *arch_info
, int (*run_it
)(struct target
*target
, uint32_t exit_point
, int timeout_ms
, void *arch_info
));
2652 int arm7_9_bulk_write_memory(struct target
*target
, uint32_t address
, uint32_t count
, uint8_t *buffer
)
2655 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2658 if (!arm7_9
->dcc_downloads
)
2659 return target_write_memory(target
, address
, 4, count
, buffer
);
2661 /* regrab previously allocated working_area, or allocate a new one */
2662 if (!arm7_9
->dcc_working_area
)
2664 uint8_t dcc_code_buf
[6 * 4];
2666 /* make sure we have a working area */
2667 if (target_alloc_working_area(target
, 24, &arm7_9
->dcc_working_area
) != ERROR_OK
)
2669 LOG_INFO("no working area available, falling back to memory writes");
2670 return target_write_memory(target
, address
, 4, count
, buffer
);
2673 /* copy target instructions to target endianness */
2674 for (i
= 0; i
< 6; i
++)
2676 target_buffer_set_u32(target
, dcc_code_buf
+ i
*4, dcc_code
[i
]);
2679 /* write DCC code to working area */
2680 if ((retval
= target_write_memory(target
, arm7_9
->dcc_working_area
->address
, 4, 6, dcc_code_buf
)) != ERROR_OK
)
2686 struct armv4_5_algorithm armv4_5_info
;
2687 struct reg_param reg_params
[1];
2689 armv4_5_info
.common_magic
= ARMV4_5_COMMON_MAGIC
;
2690 armv4_5_info
.core_mode
= ARMV4_5_MODE_SVC
;
2691 armv4_5_info
.core_state
= ARMV4_5_STATE_ARM
;
2693 init_reg_param(®_params
[0], "r0", 32, PARAM_IN_OUT
);
2695 buf_set_u32(reg_params
[0].value
, 0, 32, address
);
2698 dcc_buffer
= buffer
;
2699 retval
= armv4_5_run_algorithm_inner(target
, 0, NULL
, 1, reg_params
,
2700 arm7_9
->dcc_working_area
->address
, arm7_9
->dcc_working_area
->address
+ 6*4, 20*1000, &armv4_5_info
, arm7_9_dcc_completion
);
2702 if (retval
== ERROR_OK
)
2704 uint32_t endaddress
= buf_get_u32(reg_params
[0].value
, 0, 32);
2705 if (endaddress
!= (address
+ count
*4))
2707 LOG_ERROR("DCC write failed, expected end address 0x%08" PRIx32
" got 0x%0" PRIx32
"", (address
+ count
*4), endaddress
);
2708 retval
= ERROR_FAIL
;
2712 destroy_reg_param(®_params
[0]);
2718 * Perform per-target setup that requires JTAG access.
2720 int arm7_9_examine(struct target
*target
)
2722 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2725 if (!target_was_examined(target
)) {
2726 struct reg_cache
*t
, **cache_p
;
2728 t
= embeddedice_build_reg_cache(target
, arm7_9
);
2732 cache_p
= register_get_last_cache_p(&target
->reg_cache
);
2734 arm7_9
->eice_cache
= (*cache_p
);
2736 if (arm7_9
->armv4_5_common
.etm
)
2737 (*cache_p
)->next
= etm_build_reg_cache(target
,
2739 arm7_9
->armv4_5_common
.etm
);
2741 target_set_examined(target
);
2744 retval
= embeddedice_setup(target
);
2745 if (retval
== ERROR_OK
)
2746 retval
= arm7_9_setup(target
);
2747 if (retval
== ERROR_OK
&& arm7_9
->armv4_5_common
.etm
)
2748 retval
= etm_setup(target
);
2753 COMMAND_HANDLER(handle_arm7_9_write_xpsr_command
)
2758 struct target
*target
= get_current_target(CMD_CTX
);
2759 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2761 if (!is_arm7_9(arm7_9
))
2763 command_print(CMD_CTX
, "current target isn't an ARM7/ARM9 target");
2764 return ERROR_TARGET_INVALID
;
2767 if (target
->state
!= TARGET_HALTED
)
2769 command_print(CMD_CTX
, "can't write registers while running");
2775 command_print(CMD_CTX
, "usage: write_xpsr <value> <not cpsr | spsr>");
2779 COMMAND_PARSE_NUMBER(u32
, CMD_ARGV
[0], value
);
2780 COMMAND_PARSE_NUMBER(int, CMD_ARGV
[1], spsr
);
2782 /* if we're writing the CPSR, mask the T bit */
2786 arm7_9
->write_xpsr(target
, value
, spsr
);
2787 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
2789 LOG_ERROR("JTAG error while writing to xpsr");
2796 COMMAND_HANDLER(handle_arm7_9_write_xpsr_im8_command
)
2802 struct target
*target
= get_current_target(CMD_CTX
);
2803 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2805 if (!is_arm7_9(arm7_9
))
2807 command_print(CMD_CTX
, "current target isn't an ARM7/ARM9 target");
2808 return ERROR_TARGET_INVALID
;
2811 if (target
->state
!= TARGET_HALTED
)
2813 command_print(CMD_CTX
, "can't write registers while running");
2819 command_print(CMD_CTX
, "usage: write_xpsr_im8 <im8> <rotate> <not cpsr | spsr>");
2823 COMMAND_PARSE_NUMBER(u32
, CMD_ARGV
[0], value
);
2824 COMMAND_PARSE_NUMBER(int, CMD_ARGV
[1], rotate
);
2825 COMMAND_PARSE_NUMBER(int, CMD_ARGV
[2], spsr
);
2827 arm7_9
->write_xpsr_im8(target
, value
, rotate
, spsr
);
2828 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
2830 LOG_ERROR("JTAG error while writing 8-bit immediate to xpsr");
2837 COMMAND_HANDLER(handle_arm7_9_write_core_reg_command
)
2842 struct target
*target
= get_current_target(CMD_CTX
);
2843 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2845 if (!is_arm7_9(arm7_9
))
2847 command_print(CMD_CTX
, "current target isn't an ARM7/ARM9 target");
2848 return ERROR_TARGET_INVALID
;
2851 if (target
->state
!= TARGET_HALTED
)
2853 command_print(CMD_CTX
, "can't write registers while running");
2859 command_print(CMD_CTX
, "usage: write_core_reg <num> <mode> <value>");
2863 COMMAND_PARSE_NUMBER(int, CMD_ARGV
[0], num
);
2864 COMMAND_PARSE_NUMBER(u32
, CMD_ARGV
[1], mode
);
2865 COMMAND_PARSE_NUMBER(u32
, CMD_ARGV
[2], value
);
2867 return arm7_9_write_core_reg(target
, num
, mode
, value
);
2870 COMMAND_HANDLER(handle_arm7_9_dbgrq_command
)
2872 struct target
*target
= get_current_target(CMD_CTX
);
2873 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2875 if (!is_arm7_9(arm7_9
))
2877 command_print(CMD_CTX
, "current target isn't an ARM7/ARM9 target");
2878 return ERROR_TARGET_INVALID
;
2883 if (strcmp("enable", CMD_ARGV
[0]) == 0)
2885 arm7_9
->use_dbgrq
= 1;
2887 else if (strcmp("disable", CMD_ARGV
[0]) == 0)
2889 arm7_9
->use_dbgrq
= 0;
2893 command_print(CMD_CTX
, "usage: arm7_9 dbgrq <enable | disable>");
2897 command_print(CMD_CTX
, "use of EmbeddedICE dbgrq instead of breakpoint for target halt %s", (arm7_9
->use_dbgrq
) ? "enabled" : "disabled");
2902 COMMAND_HANDLER(handle_arm7_9_fast_memory_access_command
)
2904 struct target
*target
= get_current_target(CMD_CTX
);
2905 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2907 if (!is_arm7_9(arm7_9
))
2909 command_print(CMD_CTX
, "current target isn't an ARM7/ARM9 target");
2910 return ERROR_TARGET_INVALID
;
2915 if (strcmp("enable", CMD_ARGV
[0]) == 0)
2917 arm7_9
->fast_memory_access
= 1;
2919 else if (strcmp("disable", CMD_ARGV
[0]) == 0)
2921 arm7_9
->fast_memory_access
= 0;
2925 command_print(CMD_CTX
, "usage: arm7_9 fast_memory_access <enable | disable>");
2929 command_print(CMD_CTX
, "fast memory access is %s", (arm7_9
->fast_memory_access
) ? "enabled" : "disabled");
2934 COMMAND_HANDLER(handle_arm7_9_dcc_downloads_command
)
2936 struct target
*target
= get_current_target(CMD_CTX
);
2937 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
2939 if (!is_arm7_9(arm7_9
))
2941 command_print(CMD_CTX
, "current target isn't an ARM7/ARM9 target");
2942 return ERROR_TARGET_INVALID
;
2947 if (strcmp("enable", CMD_ARGV
[0]) == 0)
2949 arm7_9
->dcc_downloads
= 1;
2951 else if (strcmp("disable", CMD_ARGV
[0]) == 0)
2953 arm7_9
->dcc_downloads
= 0;
2957 command_print(CMD_CTX
, "usage: arm7_9 dcc_downloads <enable | disable>");
2961 command_print(CMD_CTX
, "dcc downloads are %s", (arm7_9
->dcc_downloads
) ? "enabled" : "disabled");
2966 int arm7_9_init_arch_info(struct target
*target
, struct arm7_9_common
*arm7_9
)
2968 int retval
= ERROR_OK
;
2969 struct arm
*armv4_5
= &arm7_9
->armv4_5_common
;
2971 arm7_9
->common_magic
= ARM7_9_COMMON_MAGIC
;
2973 if ((retval
= arm_jtag_setup_connection(&arm7_9
->jtag_info
)) != ERROR_OK
)
2976 /* caller must have allocated via calloc(), so everything's zeroed */
2978 arm7_9
->wp_available_max
= 2;
2980 arm7_9
->fast_memory_access
= fast_and_dangerous
;
2981 arm7_9
->dcc_downloads
= fast_and_dangerous
;
2983 armv4_5
->arch_info
= arm7_9
;
2984 armv4_5
->read_core_reg
= arm7_9_read_core_reg
;
2985 armv4_5
->write_core_reg
= arm7_9_write_core_reg
;
2986 armv4_5
->full_context
= arm7_9_full_context
;
2988 if ((retval
= armv4_5_init_arch_info(target
, armv4_5
)) != ERROR_OK
)
2991 return target_register_timer_callback(arm7_9_handle_target_request
,
2995 int arm7_9_register_commands(struct command_context
*cmd_ctx
)
2997 struct command
*arm7_9_cmd
;
2999 arm7_9_cmd
= register_command(cmd_ctx
, NULL
, "arm7_9",
3000 NULL
, COMMAND_ANY
, "arm7/9 specific commands");
3002 register_command(cmd_ctx
, arm7_9_cmd
, "write_xpsr",
3003 handle_arm7_9_write_xpsr_command
, COMMAND_EXEC
,
3004 "write program status register <value> <not cpsr | spsr>");
3005 register_command(cmd_ctx
, arm7_9_cmd
, "write_xpsr_im8",
3006 handle_arm7_9_write_xpsr_im8_command
, COMMAND_EXEC
,
3007 "write program status register "
3008 "<8bit immediate> <rotate> <not cpsr | spsr>");
3010 register_command(cmd_ctx
, arm7_9_cmd
, "write_core_reg",
3011 handle_arm7_9_write_core_reg_command
, COMMAND_EXEC
,
3012 "write core register <num> <mode> <value>");
3014 register_command(cmd_ctx
, arm7_9_cmd
, "dbgrq",
3015 handle_arm7_9_dbgrq_command
, COMMAND_ANY
,
3016 "use EmbeddedICE dbgrq instead of breakpoint "
3017 "for target halt requests <enable | disable>");
3018 register_command(cmd_ctx
, arm7_9_cmd
, "fast_memory_access",
3019 handle_arm7_9_fast_memory_access_command
, COMMAND_ANY
,
3020 "use fast memory accesses instead of slower "
3021 "but potentially safer accesses <enable | disable>");
3022 register_command(cmd_ctx
, arm7_9_cmd
, "dcc_downloads",
3023 handle_arm7_9_dcc_downloads_command
, COMMAND_ANY
,
3024 "use DCC downloads for larger memory writes <enable | disable>");
3026 armv4_5_register_commands(cmd_ctx
);
3028 etm_register_commands(cmd_ctx
);
Linking to existing account procedure
If you already have an account and want to add another login method
you
MUST first sign in with your existing account and
then change URL to read
https://review.openocd.org/login/?link
to get to this page again but this time it'll work for linking. Thank you.
SSH host keys fingerprints
1024 SHA256:YKx8b7u5ZWdcbp7/4AeXNaqElP49m6QrwfXaqQGJAOk gerrit-code-review@openocd.zylin.com (DSA)
384 SHA256:jHIbSQa4REvwCFG4cq5LBlBLxmxSqelQPem/EXIrxjk gerrit-code-review@openocd.org (ECDSA)
521 SHA256:UAOPYkU9Fjtcao0Ul/Rrlnj/OsQvt+pgdYSZ4jOYdgs gerrit-code-review@openocd.org (ECDSA)
256 SHA256:A13M5QlnozFOvTllybRZH6vm7iSt0XLxbA48yfc2yfY gerrit-code-review@openocd.org (ECDSA)
256 SHA256:spYMBqEYoAOtK7yZBrcwE8ZpYt6b68Cfh9yEVetvbXg gerrit-code-review@openocd.org (ED25519)
+--[ED25519 256]--+
|=.. |
|+o.. . |
|*.o . . |
|+B . . . |
|Bo. = o S |
|Oo.+ + = |
|oB=.* = . o |
| =+=.+ + E |
|. .=o . o |
+----[SHA256]-----+
2048 SHA256:0Onrb7/PHjpo6iVZ7xQX2riKN83FJ3KGU0TvI0TaFG4 gerrit-code-review@openocd.zylin.com (RSA)