2 * Copyright (C) 2009 by David Brownell
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License as published by
6 * the Free Software Foundation; either version 2 of the License, or
7 * (at your option) any later version.
9 * This program is distributed in the hope that it will be useful
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
22 #include "armv8_dpm.h"
23 #include <jtag/jtag.h>
25 #include "breakpoints.h"
26 #include "target_type.h"
27 #include "armv8_opcodes.h"
29 #include "helper/time_support.h"
32 #define T32_FMTITR(instr) (((instr & 0x0000FFFF) << 16) | ((instr & 0xFFFF0000) >> 16))
36 * Implements various ARM DPM operations using architectural debug registers.
37 * These routines layer over core-specific communication methods to cope with
38 * implementation differences between cores like ARM1136 and Cortex-A8.
40 * The "Debug Programmers' Model" (DPM) for ARMv6 and ARMv7 is defined by
41 * Part C (Debug Architecture) of the ARM Architecture Reference Manual,
42 * ARMv7-A and ARMv7-R edition (ARM DDI 0406B). In OpenOCD, DPM operations
43 * are abstracted through internal programming interfaces to share code and
44 * to minimize needless differences in debug behavior between cores.
48 * Get core state from EDSCR, without necessity to retrieve CPSR
50 enum arm_state
armv8_dpm_get_core_state(struct arm_dpm
*dpm
)
52 int el
= (dpm
->dscr
>> 8) & 0x3;
53 int rw
= (dpm
->dscr
>> 10) & 0xF;
57 /* In Debug state, each bit gives the current Execution state of each EL */
59 return ARM_STATE_AARCH64
;
64 /*----------------------------------------------------------------------*/
66 static int dpmv8_write_dcc(struct armv8_common
*armv8
, uint32_t data
)
68 return mem_ap_write_u32(armv8
->debug_ap
,
69 armv8
->debug_base
+ CPUV8_DBG_DTRRX
, data
);
72 static int dpmv8_write_dcc_64(struct armv8_common
*armv8
, uint64_t data
)
75 ret
= mem_ap_write_u32(armv8
->debug_ap
,
76 armv8
->debug_base
+ CPUV8_DBG_DTRRX
, data
);
78 ret
= mem_ap_write_u32(armv8
->debug_ap
,
79 armv8
->debug_base
+ CPUV8_DBG_DTRTX
, data
>> 32);
83 static int dpmv8_read_dcc(struct armv8_common
*armv8
, uint32_t *data
,
86 uint32_t dscr
= DSCR_ITE
;
92 /* Wait for DTRRXfull */
93 long long then
= timeval_ms();
94 while ((dscr
& DSCR_DTR_TX_FULL
) == 0) {
95 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
96 armv8
->debug_base
+ CPUV8_DBG_DSCR
,
98 if (retval
!= ERROR_OK
)
100 if (timeval_ms() > then
+ 1000) {
101 LOG_ERROR("Timeout waiting for read dcc");
106 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
107 armv8
->debug_base
+ CPUV8_DBG_DTRTX
,
109 if (retval
!= ERROR_OK
)
118 static int dpmv8_read_dcc_64(struct armv8_common
*armv8
, uint64_t *data
,
121 uint32_t dscr
= DSCR_ITE
;
128 /* Wait for DTRRXfull */
129 long long then
= timeval_ms();
130 while ((dscr
& DSCR_DTR_TX_FULL
) == 0) {
131 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
132 armv8
->debug_base
+ CPUV8_DBG_DSCR
,
134 if (retval
!= ERROR_OK
)
136 if (timeval_ms() > then
+ 1000) {
137 LOG_ERROR("Timeout waiting for DTR_TX_FULL, dscr = 0x%08" PRIx32
, dscr
);
142 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
143 armv8
->debug_base
+ CPUV8_DBG_DTRTX
,
145 if (retval
!= ERROR_OK
)
148 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
149 armv8
->debug_base
+ CPUV8_DBG_DTRRX
,
151 if (retval
!= ERROR_OK
)
154 *data
= *(uint32_t *)data
| (uint64_t)higher
<< 32;
162 static int dpmv8_dpm_prepare(struct arm_dpm
*dpm
)
164 struct armv8_common
*armv8
= dpm
->arm
->arch_info
;
168 /* set up invariant: ITE is set after ever DPM operation */
169 long long then
= timeval_ms();
171 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
172 armv8
->debug_base
+ CPUV8_DBG_DSCR
,
174 if (retval
!= ERROR_OK
)
176 if ((dscr
& DSCR_ITE
) != 0)
178 if (timeval_ms() > then
+ 1000) {
179 LOG_ERROR("Timeout waiting for dpm prepare");
184 /* update the stored copy of dscr */
187 /* this "should never happen" ... */
188 if (dscr
& DSCR_DTR_RX_FULL
) {
189 LOG_ERROR("DSCR_DTR_RX_FULL, dscr 0x%08" PRIx32
, dscr
);
191 retval
= mem_ap_read_u32(armv8
->debug_ap
,
192 armv8
->debug_base
+ CPUV8_DBG_DTRRX
, &dscr
);
193 if (retval
!= ERROR_OK
)
200 static int dpmv8_dpm_finish(struct arm_dpm
*dpm
)
202 /* REVISIT what could be done here? */
206 static int dpmv8_exec_opcode(struct arm_dpm
*dpm
,
207 uint32_t opcode
, uint32_t *p_dscr
)
209 struct armv8_common
*armv8
= dpm
->arm
->arch_info
;
210 uint32_t dscr
= dpm
->dscr
;
216 /* Wait for InstrCompl bit to be set */
217 long long then
= timeval_ms();
218 while ((dscr
& DSCR_ITE
) == 0) {
219 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
220 armv8
->debug_base
+ CPUV8_DBG_DSCR
, &dscr
);
221 if (retval
!= ERROR_OK
) {
222 LOG_ERROR("Could not read DSCR register, opcode = 0x%08" PRIx32
, opcode
);
225 if (timeval_ms() > then
+ 1000) {
226 LOG_ERROR("Timeout waiting for aarch64_exec_opcode");
231 if (armv8_dpm_get_core_state(dpm
) != ARM_STATE_AARCH64
)
232 opcode
= T32_FMTITR(opcode
);
234 retval
= mem_ap_write_u32(armv8
->debug_ap
,
235 armv8
->debug_base
+ CPUV8_DBG_ITR
, opcode
);
236 if (retval
!= ERROR_OK
)
241 retval
= mem_ap_read_atomic_u32(armv8
->debug_ap
,
242 armv8
->debug_base
+ CPUV8_DBG_DSCR
, &dscr
);
243 if (retval
!= ERROR_OK
) {
244 LOG_ERROR("Could not read DSCR register");
247 if (timeval_ms() > then
+ 1000) {
248 LOG_ERROR("Timeout waiting for aarch64_exec_opcode");
251 } while ((dscr
& DSCR_ITE
) == 0); /* Wait for InstrCompl bit to be set */
253 /* update dscr and el after each command execution */
255 if (dpm
->last_el
!= ((dscr
>> 8) & 3))
256 LOG_DEBUG("EL %i -> %i", dpm
->last_el
, (dscr
>> 8) & 3);
257 dpm
->last_el
= (dscr
>> 8) & 3;
259 if (dscr
& DSCR_ERR
) {
260 LOG_ERROR("Opcode 0x%08"PRIx32
", DSCR.ERR=1, DSCR.EL=%i", opcode
, dpm
->last_el
);
261 armv8_dpm_handle_exception(dpm
);
271 static int dpmv8_instr_execute(struct arm_dpm
*dpm
, uint32_t opcode
)
273 return dpmv8_exec_opcode(dpm
, opcode
, NULL
);
276 static int dpmv8_instr_write_data_dcc(struct arm_dpm
*dpm
,
277 uint32_t opcode
, uint32_t data
)
279 struct armv8_common
*armv8
= dpm
->arm
->arch_info
;
282 retval
= dpmv8_write_dcc(armv8
, data
);
283 if (retval
!= ERROR_OK
)
286 return dpmv8_exec_opcode(dpm
, opcode
, 0);
289 static int dpmv8_instr_write_data_dcc_64(struct arm_dpm
*dpm
,
290 uint32_t opcode
, uint64_t data
)
292 struct armv8_common
*armv8
= dpm
->arm
->arch_info
;
295 retval
= dpmv8_write_dcc_64(armv8
, data
);
296 if (retval
!= ERROR_OK
)
299 return dpmv8_exec_opcode(dpm
, opcode
, 0);
302 static int dpmv8_instr_write_data_r0(struct arm_dpm
*dpm
,
303 uint32_t opcode
, uint32_t data
)
305 struct armv8_common
*armv8
= dpm
->arm
->arch_info
;
306 uint32_t dscr
= DSCR_ITE
;
309 retval
= dpmv8_write_dcc(armv8
, data
);
310 if (retval
!= ERROR_OK
)
313 retval
= dpmv8_exec_opcode(dpm
, armv8_opcode(armv8
, READ_REG_DTRRX
), &dscr
);
314 if (retval
!= ERROR_OK
)
317 /* then the opcode, taking data from R0 */
318 return dpmv8_exec_opcode(dpm
, opcode
, &dscr
);
321 static int dpmv8_instr_write_data_r0_64(struct arm_dpm
*dpm
,
322 uint32_t opcode
, uint64_t data
)
324 struct armv8_common
*armv8
= dpm
->arm
->arch_info
;
327 if (dpm
->arm
->core_state
!= ARM_STATE_AARCH64
)
328 return dpmv8_instr_write_data_r0(dpm
, opcode
, data
);
330 /* transfer data from DCC to R0 */
331 retval
= dpmv8_write_dcc_64(armv8
, data
);
332 if (retval
== ERROR_OK
)
333 retval
= dpmv8_exec_opcode(dpm
, ARMV8_MRS(SYSTEM_DBG_DBGDTR_EL0
, 0), &dpm
->dscr
);
335 /* then the opcode, taking data from R0 */
336 if (retval
== ERROR_OK
)
337 retval
= dpmv8_exec_opcode(dpm
, opcode
, &dpm
->dscr
);
342 static int dpmv8_instr_cpsr_sync(struct arm_dpm
*dpm
)
345 struct armv8_common
*armv8
= dpm
->arm
->arch_info
;
347 /* "Prefetch flush" after modifying execution status in CPSR */
348 retval
= dpmv8_exec_opcode(dpm
, armv8_opcode(armv8
, ARMV8_OPC_DSB_SY
), &dpm
->dscr
);
349 if (retval
== ERROR_OK
)
350 dpmv8_exec_opcode(dpm
, armv8_opcode(armv8
, ARMV8_OPC_ISB_SY
), &dpm
->dscr
);
354 static int dpmv8_instr_read_data_dcc(struct arm_dpm
*dpm
,
355 uint32_t opcode
, uint32_t *data
)
357 struct armv8_common
*armv8
= dpm
->arm
->arch_info
;
360 /* the opcode, writing data to DCC */
361 retval
= dpmv8_exec_opcode(dpm
, opcode
, &dpm
->dscr
);
362 if (retval
!= ERROR_OK
)
365 return dpmv8_read_dcc(armv8
, data
, &dpm
->dscr
);
368 static int dpmv8_instr_read_data_dcc_64(struct arm_dpm
*dpm
,
369 uint32_t opcode
, uint64_t *data
)
371 struct armv8_common
*armv8
= dpm
->arm
->arch_info
;
374 /* the opcode, writing data to DCC */
375 retval
= dpmv8_exec_opcode(dpm
, opcode
, &dpm
->dscr
);
376 if (retval
!= ERROR_OK
)
379 return dpmv8_read_dcc_64(armv8
, data
, &dpm
->dscr
);
382 static int dpmv8_instr_read_data_r0(struct arm_dpm
*dpm
,
383 uint32_t opcode
, uint32_t *data
)
385 struct armv8_common
*armv8
= dpm
->arm
->arch_info
;
388 /* the opcode, writing data to R0 */
389 retval
= dpmv8_exec_opcode(dpm
, opcode
, &dpm
->dscr
);
390 if (retval
!= ERROR_OK
)
393 /* write R0 to DCC */
394 retval
= dpmv8_exec_opcode(dpm
, armv8_opcode(armv8
, WRITE_REG_DTRTX
), &dpm
->dscr
);
395 if (retval
!= ERROR_OK
)
398 return dpmv8_read_dcc(armv8
, data
, &dpm
->dscr
);
401 static int dpmv8_instr_read_data_r0_64(struct arm_dpm
*dpm
,
402 uint32_t opcode
, uint64_t *data
)
404 struct armv8_common
*armv8
= dpm
->arm
->arch_info
;
407 if (dpm
->arm
->core_state
!= ARM_STATE_AARCH64
) {
409 retval
= dpmv8_instr_read_data_r0(dpm
, opcode
, &tmp
);
410 if (retval
== ERROR_OK
)
415 /* the opcode, writing data to R0 */
416 retval
= dpmv8_exec_opcode(dpm
, opcode
, &dpm
->dscr
);
417 if (retval
!= ERROR_OK
)
420 /* write R0 to DCC */
421 retval
= dpmv8_exec_opcode(dpm
, ARMV8_MSR_GP(SYSTEM_DBG_DBGDTR_EL0
, 0), &dpm
->dscr
);
422 if (retval
!= ERROR_OK
)
425 return dpmv8_read_dcc_64(armv8
, data
, &dpm
->dscr
);
429 static int dpmv8_bpwp_enable(struct arm_dpm
*dpm
, unsigned index_t
,
430 target_addr_t addr
, uint32_t control
)
432 struct armv8_common
*armv8
= dpm
->arm
->arch_info
;
433 uint32_t vr
= armv8
->debug_base
;
434 uint32_t cr
= armv8
->debug_base
;
438 case 0 ... 15: /* breakpoints */
439 vr
+= CPUV8_DBG_BVR_BASE
;
440 cr
+= CPUV8_DBG_BCR_BASE
;
442 case 16 ... 31: /* watchpoints */
443 vr
+= CPUV8_DBG_WVR_BASE
;
444 cr
+= CPUV8_DBG_WCR_BASE
;
453 LOG_DEBUG("A8: bpwp enable, vr %08x cr %08x",
454 (unsigned) vr
, (unsigned) cr
);
456 retval
= mem_ap_write_atomic_u32(armv8
->debug_ap
, vr
, addr
);
457 if (retval
!= ERROR_OK
)
459 return mem_ap_write_atomic_u32(armv8
->debug_ap
, cr
, control
);
463 static int dpmv8_bpwp_disable(struct arm_dpm
*dpm
, unsigned index_t
)
465 struct armv8_common
*armv8
= dpm
->arm
->arch_info
;
470 cr
= armv8
->debug_base
+ CPUV8_DBG_BCR_BASE
;
473 cr
= armv8
->debug_base
+ CPUV8_DBG_WCR_BASE
;
481 LOG_DEBUG("A: bpwp disable, cr %08x", (unsigned) cr
);
483 /* clear control register */
484 return mem_ap_write_atomic_u32(armv8
->debug_ap
, cr
, 0);
488 * Coprocessor support
491 /* Read coprocessor */
492 static int dpmv8_mrc(struct target
*target
, int cpnum
,
493 uint32_t op1
, uint32_t op2
, uint32_t CRn
, uint32_t CRm
,
496 struct arm
*arm
= target_to_arm(target
);
497 struct arm_dpm
*dpm
= arm
->dpm
;
500 retval
= dpm
->prepare(dpm
);
501 if (retval
!= ERROR_OK
)
504 LOG_DEBUG("MRC p%d, %d, r0, c%d, c%d, %d", cpnum
,
505 (int) op1
, (int) CRn
,
506 (int) CRm
, (int) op2
);
508 /* read coprocessor register into R0; return via DCC */
509 retval
= dpm
->instr_read_data_r0(dpm
,
510 ARMV4_5_MRC(cpnum
, op1
, 0, CRn
, CRm
, op2
),
513 /* (void) */ dpm
->finish(dpm
);
517 static int dpmv8_mcr(struct target
*target
, int cpnum
,
518 uint32_t op1
, uint32_t op2
, uint32_t CRn
, uint32_t CRm
,
521 struct arm
*arm
= target_to_arm(target
);
522 struct arm_dpm
*dpm
= arm
->dpm
;
525 retval
= dpm
->prepare(dpm
);
526 if (retval
!= ERROR_OK
)
529 LOG_DEBUG("MCR p%d, %d, r0, c%d, c%d, %d", cpnum
,
530 (int) op1
, (int) CRn
,
531 (int) CRm
, (int) op2
);
533 /* read DCC into r0; then write coprocessor register from R0 */
534 retval
= dpm
->instr_write_data_r0(dpm
,
535 ARMV4_5_MCR(cpnum
, op1
, 0, CRn
, CRm
, op2
),
538 /* (void) */ dpm
->finish(dpm
);
542 /*----------------------------------------------------------------------*/
545 * Register access utilities
548 int armv8_dpm_modeswitch(struct arm_dpm
*dpm
, enum arm_mode mode
)
550 struct armv8_common
*armv8
= (struct armv8_common
*)dpm
->arm
->arch_info
;
551 int retval
= ERROR_OK
;
552 unsigned int target_el
;
553 enum arm_state core_state
;
556 /* restore previous mode */
557 if (mode
== ARM_MODE_ANY
) {
558 cpsr
= buf_get_u32(dpm
->arm
->cpsr
->value
, 0, 32);
560 LOG_DEBUG("restoring mode, cpsr = 0x%08"PRIx32
, cpsr
);
563 LOG_DEBUG("setting mode 0x%"PRIx32
, mode
);
567 switch (cpsr
& 0x1f) {
579 * TODO: handle ARM_MODE_HYP
589 target_el
= (cpsr
>> 2) & 3;
592 if (target_el
> SYSTEM_CUREL_EL3
) {
593 LOG_ERROR("%s: Invalid target exception level %i", __func__
, target_el
);
597 LOG_DEBUG("target_el = %i, last_el = %i", target_el
, dpm
->last_el
);
598 if (target_el
> dpm
->last_el
) {
599 retval
= dpm
->instr_execute(dpm
,
600 armv8_opcode(armv8
, ARMV8_OPC_DCPS
) | target_el
);
602 /* DCPS clobbers registers just like an exception taken */
603 armv8_dpm_handle_exception(dpm
);
605 core_state
= armv8_dpm_get_core_state(dpm
);
606 if (core_state
!= ARM_STATE_AARCH64
) {
607 /* cannot do DRPS/ERET when already in EL0 */
608 if (dpm
->last_el
!= 0) {
609 /* load SPSR with the desired mode and execute DRPS */
610 LOG_DEBUG("SPSR = 0x%08"PRIx32
, cpsr
);
611 retval
= dpm
->instr_write_data_r0(dpm
,
612 ARMV8_MSR_GP_xPSR_T1(1, 0, 15), cpsr
);
613 if (retval
== ERROR_OK
)
614 retval
= dpm
->instr_execute(dpm
, armv8_opcode(armv8
, ARMV8_OPC_DRPS
));
618 * need to execute multiple DRPS instructions until target_el
621 while (retval
== ERROR_OK
&& dpm
->last_el
!= target_el
) {
622 unsigned int cur_el
= dpm
->last_el
;
623 retval
= dpm
->instr_execute(dpm
, armv8_opcode(armv8
, ARMV8_OPC_DRPS
));
624 if (cur_el
== dpm
->last_el
) {
625 LOG_INFO("Cannot reach EL %i, SPSR corrupted?", target_el
);
631 /* On executing DRPS, DSPSR and DLR become UNKNOWN, mark them as dirty */
632 dpm
->arm
->cpsr
->dirty
= true;
633 dpm
->arm
->pc
->dirty
= true;
636 * re-evaluate the core state, we might be in Aarch32 state now
637 * we rely on dpm->dscr being up-to-date
639 core_state
= armv8_dpm_get_core_state(dpm
);
640 armv8_select_opcodes(armv8
, core_state
== ARM_STATE_AARCH64
);
641 armv8_select_reg_access(armv8
, core_state
== ARM_STATE_AARCH64
);
648 * Common register read, relies on armv8_select_reg_access() having been called.
650 static int dpmv8_read_reg(struct arm_dpm
*dpm
, struct reg
*r
, unsigned regnum
)
652 struct armv8_common
*armv8
= dpm
->arm
->arch_info
;
656 retval
= armv8
->read_reg_u64(armv8
, regnum
, &value_64
);
658 if (retval
== ERROR_OK
) {
661 buf_set_u64(r
->value
, 0, r
->size
, value_64
);
663 LOG_DEBUG("READ: %s, %16.8llx", r
->name
, (unsigned long long) value_64
);
665 LOG_DEBUG("READ: %s, %8.8x", r
->name
, (unsigned int) value_64
);
671 * Common register write, relies on armv8_select_reg_access() having been called.
673 static int dpmv8_write_reg(struct arm_dpm
*dpm
, struct reg
*r
, unsigned regnum
)
675 struct armv8_common
*armv8
= dpm
->arm
->arch_info
;
676 int retval
= ERROR_FAIL
;
679 value_64
= buf_get_u64(r
->value
, 0, r
->size
);
681 retval
= armv8
->write_reg_u64(armv8
, regnum
, value_64
);
682 if (retval
== ERROR_OK
) {
685 LOG_DEBUG("WRITE: %s, %16.8llx", r
->name
, (unsigned long long)value_64
);
687 LOG_DEBUG("WRITE: %s, %8.8x", r
->name
, (unsigned int)value_64
);
694 * Read basic registers of the the current context: R0 to R15, and CPSR;
695 * sets the core mode (such as USR or IRQ) and state (such as ARM or Thumb).
696 * In normal operation this is called on entry to halting debug state,
697 * possibly after some other operations supporting restore of debug state
698 * or making sure the CPU is fully idle (drain write buffer, etc).
700 int armv8_dpm_read_current_registers(struct arm_dpm
*dpm
)
702 struct arm
*arm
= dpm
->arm
;
703 struct armv8_common
*armv8
= (struct armv8_common
*)arm
->arch_info
;
704 struct reg_cache
*cache
;
709 retval
= dpm
->prepare(dpm
);
710 if (retval
!= ERROR_OK
)
713 cache
= arm
->core_cache
;
715 /* read R0 first (it's used for scratch), then CPSR */
716 r
= cache
->reg_list
+ ARMV8_R0
;
718 retval
= dpmv8_read_reg(dpm
, r
, ARMV8_R0
);
719 if (retval
!= ERROR_OK
)
724 /* read R1, too, it will be clobbered during memory access */
725 r
= cache
->reg_list
+ ARMV8_R1
;
727 retval
= dpmv8_read_reg(dpm
, r
, ARMV8_R1
);
728 if (retval
!= ERROR_OK
)
732 /* read cpsr to r0 and get it back */
733 retval
= dpm
->instr_read_data_r0(dpm
,
734 armv8_opcode(armv8
, READ_REG_DSPSR
), &cpsr
);
735 if (retval
!= ERROR_OK
)
738 /* update core mode and state */
739 armv8_set_cpsr(arm
, cpsr
);
741 for (unsigned int i
= ARMV8_PC
; i
< cache
->num_regs
; i
++) {
742 struct arm_reg
*arm_reg
;
744 r
= armv8_reg_current(arm
, i
);
749 * Only read registers that are available from the
750 * current EL (or core mode).
752 arm_reg
= r
->arch_info
;
753 if (arm_reg
->mode
!= ARM_MODE_ANY
&&
754 dpm
->last_el
!= armv8_curel_from_core_mode(arm_reg
->mode
))
757 retval
= dpmv8_read_reg(dpm
, r
, i
);
758 if (retval
!= ERROR_OK
)
768 /* Avoid needless I/O ... leave breakpoints and watchpoints alone
769 * unless they're removed, or need updating because of single-stepping
770 * or running debugger code.
772 static int dpmv8_maybe_update_bpwp(struct arm_dpm
*dpm
, bool bpwp
,
773 struct dpm_bpwp
*xp
, int *set_p
)
775 int retval
= ERROR_OK
;
782 /* removed or startup; we must disable it */
787 /* disabled, but we must set it */
788 xp
->dirty
= disable
= false;
793 /* set, but we must temporarily disable it */
794 xp
->dirty
= disable
= true;
799 retval
= dpm
->bpwp_disable(dpm
, xp
->number
);
801 retval
= dpm
->bpwp_enable(dpm
, xp
->number
,
802 xp
->address
, xp
->control
);
804 if (retval
!= ERROR_OK
)
805 LOG_ERROR("%s: can't %s HW %spoint %d",
806 disable
? "disable" : "enable",
807 target_name(dpm
->arm
->target
),
808 (xp
->number
< 16) ? "break" : "watch",
814 static int dpmv8_add_breakpoint(struct target
*target
, struct breakpoint
*bp
);
817 * Writes all modified core registers for all processor modes. In normal
818 * operation this is called on exit from halting debug state.
820 * @param dpm: represents the processor
821 * @param bpwp: true ensures breakpoints and watchpoints are set,
822 * false ensures they are cleared
824 int armv8_dpm_write_dirty_registers(struct arm_dpm
*dpm
, bool bpwp
)
826 struct arm
*arm
= dpm
->arm
;
827 struct reg_cache
*cache
= arm
->core_cache
;
830 retval
= dpm
->prepare(dpm
);
831 if (retval
!= ERROR_OK
)
834 /* If we're managing hardware breakpoints for this core, enable
835 * or disable them as requested.
837 * REVISIT We don't yet manage them for ANY cores. Eventually
838 * we should be able to assume we handle them; but until then,
839 * cope with the hand-crafted breakpoint code.
841 if (arm
->target
->type
->add_breakpoint
== dpmv8_add_breakpoint
) {
842 for (unsigned i
= 0; i
< dpm
->nbp
; i
++) {
843 struct dpm_bp
*dbp
= dpm
->dbp
+ i
;
844 struct breakpoint
*bp
= dbp
->bp
;
846 retval
= dpmv8_maybe_update_bpwp(dpm
, bpwp
, &dbp
->bpwp
,
847 bp
? &bp
->set
: NULL
);
848 if (retval
!= ERROR_OK
)
853 /* enable/disable watchpoints */
854 for (unsigned i
= 0; i
< dpm
->nwp
; i
++) {
855 struct dpm_wp
*dwp
= dpm
->dwp
+ i
;
856 struct watchpoint
*wp
= dwp
->wp
;
858 retval
= dpmv8_maybe_update_bpwp(dpm
, bpwp
, &dwp
->bpwp
,
859 wp
? &wp
->set
: NULL
);
860 if (retval
!= ERROR_OK
)
864 /* NOTE: writes to breakpoint and watchpoint registers might
865 * be queued, and need (efficient/batched) flushing later.
868 /* Restore original core mode and state */
869 retval
= armv8_dpm_modeswitch(dpm
, ARM_MODE_ANY
);
870 if (retval
!= ERROR_OK
)
873 /* check everything except our scratch register R0 */
874 for (unsigned i
= 1; i
< cache
->num_regs
; i
++) {
877 /* skip PC and CPSR */
878 if (i
== ARMV8_PC
|| i
== ARMV8_xPSR
)
881 if (!cache
->reg_list
[i
].valid
)
884 if (!cache
->reg_list
[i
].dirty
)
887 /* skip all registers not on the current EL */
888 r
= cache
->reg_list
[i
].arch_info
;
889 if (r
->mode
!= ARM_MODE_ANY
&&
890 dpm
->last_el
!= armv8_curel_from_core_mode(r
->mode
))
893 retval
= dpmv8_write_reg(dpm
, &cache
->reg_list
[i
], i
);
894 if (retval
!= ERROR_OK
)
898 /* flush CPSR and PC */
899 if (retval
== ERROR_OK
)
900 retval
= dpmv8_write_reg(dpm
, &cache
->reg_list
[ARMV8_xPSR
], ARMV8_xPSR
);
901 if (retval
== ERROR_OK
)
902 retval
= dpmv8_write_reg(dpm
, &cache
->reg_list
[ARMV8_PC
], ARMV8_PC
);
903 /* flush R0 -- it's *very* dirty by now */
904 if (retval
== ERROR_OK
)
905 retval
= dpmv8_write_reg(dpm
, &cache
->reg_list
[0], 0);
906 if (retval
== ERROR_OK
)
907 dpm
->instr_cpsr_sync(dpm
);
914 * Standard ARM register accessors ... there are three methods
915 * in "struct arm", to support individual read/write and bulk read
919 static int armv8_dpm_read_core_reg(struct target
*target
, struct reg
*r
,
920 int regnum
, enum arm_mode mode
)
922 struct arm
*arm
= target_to_arm(target
);
923 struct arm_dpm
*dpm
= target_to_arm(target
)->dpm
;
925 int max
= arm
->core_cache
->num_regs
;
927 if (regnum
< 0 || regnum
>= max
)
928 return ERROR_COMMAND_SYNTAX_ERROR
;
931 * REVISIT what happens if we try to read SPSR in a core mode
932 * which has no such register?
934 retval
= dpm
->prepare(dpm
);
935 if (retval
!= ERROR_OK
)
938 retval
= dpmv8_read_reg(dpm
, r
, regnum
);
939 if (retval
!= ERROR_OK
)
943 /* (void) */ dpm
->finish(dpm
);
947 static int armv8_dpm_write_core_reg(struct target
*target
, struct reg
*r
,
948 int regnum
, enum arm_mode mode
, uint8_t *value
)
950 struct arm
*arm
= target_to_arm(target
);
951 struct arm_dpm
*dpm
= target_to_arm(target
)->dpm
;
953 int max
= arm
->core_cache
->num_regs
;
955 if (regnum
< 0 || regnum
> max
)
956 return ERROR_COMMAND_SYNTAX_ERROR
;
958 /* REVISIT what happens if we try to write SPSR in a core mode
959 * which has no such register?
962 retval
= dpm
->prepare(dpm
);
963 if (retval
!= ERROR_OK
)
966 retval
= dpmv8_write_reg(dpm
, r
, regnum
);
968 /* always clean up, regardless of error */
974 static int armv8_dpm_full_context(struct target
*target
)
976 struct arm
*arm
= target_to_arm(target
);
977 struct arm_dpm
*dpm
= arm
->dpm
;
978 struct reg_cache
*cache
= arm
->core_cache
;
982 retval
= dpm
->prepare(dpm
);
983 if (retval
!= ERROR_OK
)
987 enum arm_mode mode
= ARM_MODE_ANY
;
991 /* We "know" arm_dpm_read_current_registers() was called so
992 * the unmapped registers (R0..R7, PC, AND CPSR) and some
993 * view of R8..R14 are current. We also "know" oddities of
994 * register mapping: special cases for R8..R12 and SPSR.
996 * Pick some mode with unread registers and read them all.
999 for (unsigned i
= 0; i
< cache
->num_regs
; i
++) {
1002 if (cache
->reg_list
[i
].valid
)
1004 r
= cache
->reg_list
[i
].arch_info
;
1006 /* may need to pick a mode and set CPSR */
1011 /* For regular (ARM_MODE_ANY) R8..R12
1012 * in case we've entered debug state
1013 * in FIQ mode we need to patch mode.
1015 if (mode
!= ARM_MODE_ANY
)
1016 retval
= armv8_dpm_modeswitch(dpm
, mode
);
1018 retval
= armv8_dpm_modeswitch(dpm
, ARM_MODE_USR
);
1020 if (retval
!= ERROR_OK
)
1023 if (r
->mode
!= mode
)
1026 /* CPSR was read, so "R16" must mean SPSR */
1027 retval
= dpmv8_read_reg(dpm
,
1028 &cache
->reg_list
[i
],
1029 (r
->num
== 16) ? 17 : r
->num
);
1030 if (retval
!= ERROR_OK
)
1036 retval
= armv8_dpm_modeswitch(dpm
, ARM_MODE_ANY
);
1037 /* (void) */ dpm
->finish(dpm
);
1043 /*----------------------------------------------------------------------*/
1046 * Breakpoint and Watchpoint support.
1048 * Hardware {break,watch}points are usually left active, to minimize
1049 * debug entry/exit costs. When they are set or cleared, it's done in
1050 * batches. Also, DPM-conformant hardware can update debug registers
1051 * regardless of whether the CPU is running or halted ... though that
1052 * fact isn't currently leveraged.
1055 static int dpmv8_bpwp_setup(struct arm_dpm
*dpm
, struct dpm_bpwp
*xp
,
1056 uint32_t addr
, uint32_t length
)
1060 control
= (1 << 0) /* enable */
1061 | (3 << 1); /* both user and privileged access */
1063 /* Match 1, 2, or all 4 byte addresses in this word.
1065 * FIXME: v7 hardware allows lengths up to 2 GB for BP and WP.
1066 * Support larger length, when addr is suitably aligned. In
1067 * particular, allow watchpoints on 8 byte "double" values.
1069 * REVISIT allow watchpoints on unaligned 2-bit values; and on
1070 * v7 hardware, unaligned 4-byte ones too.
1074 control
|= (1 << (addr
& 3)) << 5;
1077 /* require 2-byte alignment */
1079 control
|= (3 << (addr
& 2)) << 5;
1084 /* require 4-byte alignment */
1086 control
|= 0xf << 5;
1091 LOG_ERROR("unsupported {break,watch}point length/alignment");
1092 return ERROR_COMMAND_SYNTAX_ERROR
;
1095 /* other shared control bits:
1096 * bits 15:14 == 0 ... both secure and nonsecure states (v6.1+ only)
1097 * bit 20 == 0 ... not linked to a context ID
1098 * bit 28:24 == 0 ... not ignoring N LSBs (v7 only)
1101 xp
->address
= addr
& ~3;
1102 xp
->control
= control
;
1105 LOG_DEBUG("BPWP: addr %8.8" PRIx32
", control %" PRIx32
", number %d",
1106 xp
->address
, control
, xp
->number
);
1108 /* hardware is updated in write_dirty_registers() */
1112 static int dpmv8_add_breakpoint(struct target
*target
, struct breakpoint
*bp
)
1114 struct arm
*arm
= target_to_arm(target
);
1115 struct arm_dpm
*dpm
= arm
->dpm
;
1116 int retval
= ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
1119 return ERROR_COMMAND_SYNTAX_ERROR
;
1120 if (!dpm
->bpwp_enable
)
1123 /* FIXME we need a generic solution for software breakpoints. */
1124 if (bp
->type
== BKPT_SOFT
)
1125 LOG_DEBUG("using HW bkpt, not SW...");
1127 for (unsigned i
= 0; i
< dpm
->nbp
; i
++) {
1128 if (!dpm
->dbp
[i
].bp
) {
1129 retval
= dpmv8_bpwp_setup(dpm
, &dpm
->dbp
[i
].bpwp
,
1130 bp
->address
, bp
->length
);
1131 if (retval
== ERROR_OK
)
1132 dpm
->dbp
[i
].bp
= bp
;
1140 static int dpmv8_remove_breakpoint(struct target
*target
, struct breakpoint
*bp
)
1142 struct arm
*arm
= target_to_arm(target
);
1143 struct arm_dpm
*dpm
= arm
->dpm
;
1144 int retval
= ERROR_COMMAND_SYNTAX_ERROR
;
1146 for (unsigned i
= 0; i
< dpm
->nbp
; i
++) {
1147 if (dpm
->dbp
[i
].bp
== bp
) {
1148 dpm
->dbp
[i
].bp
= NULL
;
1149 dpm
->dbp
[i
].bpwp
.dirty
= true;
1151 /* hardware is updated in write_dirty_registers() */
1160 static int dpmv8_watchpoint_setup(struct arm_dpm
*dpm
, unsigned index_t
,
1161 struct watchpoint
*wp
)
1164 struct dpm_wp
*dwp
= dpm
->dwp
+ index_t
;
1167 /* this hardware doesn't support data value matching or masking */
1168 if (wp
->value
|| wp
->mask
!= ~(uint32_t)0) {
1169 LOG_DEBUG("watchpoint values and masking not supported");
1170 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
1173 retval
= dpmv8_bpwp_setup(dpm
, &dwp
->bpwp
, wp
->address
, wp
->length
);
1174 if (retval
!= ERROR_OK
)
1177 control
= dwp
->bpwp
.control
;
1189 dwp
->bpwp
.control
= control
;
1191 dpm
->dwp
[index_t
].wp
= wp
;
1196 static int dpmv8_add_watchpoint(struct target
*target
, struct watchpoint
*wp
)
1198 struct arm
*arm
= target_to_arm(target
);
1199 struct arm_dpm
*dpm
= arm
->dpm
;
1200 int retval
= ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
1202 if (dpm
->bpwp_enable
) {
1203 for (unsigned i
= 0; i
< dpm
->nwp
; i
++) {
1204 if (!dpm
->dwp
[i
].wp
) {
1205 retval
= dpmv8_watchpoint_setup(dpm
, i
, wp
);
1214 static int dpmv8_remove_watchpoint(struct target
*target
, struct watchpoint
*wp
)
1216 struct arm
*arm
= target_to_arm(target
);
1217 struct arm_dpm
*dpm
= arm
->dpm
;
1218 int retval
= ERROR_COMMAND_SYNTAX_ERROR
;
1220 for (unsigned i
= 0; i
< dpm
->nwp
; i
++) {
1221 if (dpm
->dwp
[i
].wp
== wp
) {
1222 dpm
->dwp
[i
].wp
= NULL
;
1223 dpm
->dwp
[i
].bpwp
.dirty
= true;
1225 /* hardware is updated in write_dirty_registers() */
1234 void armv8_dpm_report_wfar(struct arm_dpm
*dpm
, uint64_t addr
)
1236 switch (dpm
->arm
->core_state
) {
1238 case ARM_STATE_AARCH64
:
1241 case ARM_STATE_THUMB
:
1242 case ARM_STATE_THUMB_EE
:
1245 case ARM_STATE_JAZELLE
:
1249 LOG_DEBUG("Unknown core_state");
1256 * Handle exceptions taken in debug state. This happens mostly for memory
1257 * accesses that violated a MMU policy. Taking an exception while in debug
1258 * state clobbers certain state registers on the target exception level.
1259 * Just mark those registers dirty so that they get restored on resume.
1260 * This works both for Aarch32 and Aarch64 states.
1262 * This function must not perform any actions that trigger another exception
1263 * or a recursion will happen.
1265 void armv8_dpm_handle_exception(struct arm_dpm
*dpm
)
1267 struct armv8_common
*armv8
= dpm
->arm
->arch_info
;
1268 struct reg_cache
*cache
= dpm
->arm
->core_cache
;
1269 enum arm_state core_state
;
1274 static const int clobbered_regs_by_el
[3][5] = {
1275 { ARMV8_PC
, ARMV8_xPSR
, ARMV8_ELR_EL1
, ARMV8_ESR_EL1
, ARMV8_SPSR_EL1
},
1276 { ARMV8_PC
, ARMV8_xPSR
, ARMV8_ELR_EL2
, ARMV8_ESR_EL2
, ARMV8_SPSR_EL2
},
1277 { ARMV8_PC
, ARMV8_xPSR
, ARMV8_ELR_EL3
, ARMV8_ESR_EL3
, ARMV8_SPSR_EL3
},
1280 el
= (dpm
->dscr
>> 8) & 3;
1282 /* safety check, must not happen since EL0 cannot be a target for an exception */
1283 if (el
< SYSTEM_CUREL_EL1
|| el
> SYSTEM_CUREL_EL3
) {
1284 LOG_ERROR("%s: EL %i is invalid, DSCR corrupted?", __func__
, el
);
1288 /* Clear sticky error */
1289 mem_ap_write_u32(armv8
->debug_ap
,
1290 armv8
->debug_base
+ CPUV8_DBG_DRCR
, DRCR_CSE
);
1292 armv8
->read_reg_u64(armv8
, ARMV8_xPSR
, &dlr
);
1294 armv8
->read_reg_u64(armv8
, ARMV8_PC
, &dlr
);
1296 LOG_DEBUG("Exception taken to EL %i, DLR=0x%016"PRIx64
" DSPSR=0x%08"PRIx32
,
1299 /* mark all clobbered registers as dirty */
1300 for (int i
= 0; i
< 5; i
++)
1301 cache
->reg_list
[clobbered_regs_by_el
[el
-1][i
]].dirty
= true;
1304 * re-evaluate the core state, we might be in Aarch64 state now
1305 * we rely on dpm->dscr being up-to-date
1307 core_state
= armv8_dpm_get_core_state(dpm
);
1308 armv8_select_opcodes(armv8
, core_state
== ARM_STATE_AARCH64
);
1309 armv8_select_reg_access(armv8
, core_state
== ARM_STATE_AARCH64
);
1311 armv8_dpm_modeswitch(dpm
, ARM_MODE_ANY
);
1314 /*----------------------------------------------------------------------*/
1317 * Other debug and support utilities
1320 void armv8_dpm_report_dscr(struct arm_dpm
*dpm
, uint32_t dscr
)
1322 struct target
*target
= dpm
->arm
->target
;
1325 dpm
->last_el
= (dscr
>> 8) & 3;
1327 /* Examine debug reason */
1328 switch (DSCR_ENTRY(dscr
)) {
1329 /* FALL THROUGH -- assume a v6 core in abort mode */
1330 case DSCRV8_ENTRY_EXT_DEBUG
: /* EDBGRQ */
1331 target
->debug_reason
= DBG_REASON_DBGRQ
;
1333 case DSCRV8_ENTRY_HALT_STEP_EXECLU
: /* HALT step */
1334 case DSCRV8_ENTRY_HALT_STEP_NORMAL
: /* Halt step*/
1335 case DSCRV8_ENTRY_HALT_STEP
:
1336 target
->debug_reason
= DBG_REASON_SINGLESTEP
;
1338 case DSCRV8_ENTRY_HLT
: /* HLT instruction (software breakpoint) */
1339 case DSCRV8_ENTRY_BKPT
: /* SW BKPT (?) */
1340 case DSCRV8_ENTRY_RESET_CATCH
: /* Reset catch */
1341 case DSCRV8_ENTRY_OS_UNLOCK
: /*OS unlock catch*/
1342 case DSCRV8_ENTRY_EXCEPTION_CATCH
: /*exception catch*/
1343 case DSCRV8_ENTRY_SW_ACCESS_DBG
: /*SW access dbg register*/
1344 target
->debug_reason
= DBG_REASON_BREAKPOINT
;
1346 case DSCRV8_ENTRY_WATCHPOINT
: /* asynch watchpoint */
1347 target
->debug_reason
= DBG_REASON_WATCHPOINT
;
1350 target
->debug_reason
= DBG_REASON_UNDEFINED
;
1356 /*----------------------------------------------------------------------*/
1359 * Setup and management support.
1363 * Hooks up this DPM to its associated target; call only once.
1364 * Initially this only covers the register cache.
1366 * Oh, and watchpoints. Yeah.
1368 int armv8_dpm_setup(struct arm_dpm
*dpm
)
1370 struct arm
*arm
= dpm
->arm
;
1371 struct target
*target
= arm
->target
;
1372 struct reg_cache
*cache
;
1375 /* register access setup */
1376 arm
->full_context
= armv8_dpm_full_context
;
1377 arm
->read_core_reg
= armv8_dpm_read_core_reg
;
1378 arm
->write_core_reg
= armv8_dpm_write_core_reg
;
1380 if (arm
->core_cache
== NULL
) {
1381 cache
= armv8_build_reg_cache(target
);
1386 /* coprocessor access setup */
1387 arm
->mrc
= dpmv8_mrc
;
1388 arm
->mcr
= dpmv8_mcr
;
1390 dpm
->prepare
= dpmv8_dpm_prepare
;
1391 dpm
->finish
= dpmv8_dpm_finish
;
1393 dpm
->instr_execute
= dpmv8_instr_execute
;
1394 dpm
->instr_write_data_dcc
= dpmv8_instr_write_data_dcc
;
1395 dpm
->instr_write_data_dcc_64
= dpmv8_instr_write_data_dcc_64
;
1396 dpm
->instr_write_data_r0
= dpmv8_instr_write_data_r0
;
1397 dpm
->instr_write_data_r0_64
= dpmv8_instr_write_data_r0_64
;
1398 dpm
->instr_cpsr_sync
= dpmv8_instr_cpsr_sync
;
1400 dpm
->instr_read_data_dcc
= dpmv8_instr_read_data_dcc
;
1401 dpm
->instr_read_data_dcc_64
= dpmv8_instr_read_data_dcc_64
;
1402 dpm
->instr_read_data_r0
= dpmv8_instr_read_data_r0
;
1403 dpm
->instr_read_data_r0_64
= dpmv8_instr_read_data_r0_64
;
1405 dpm
->arm_reg_current
= armv8_reg_current
;
1407 /* dpm->bpwp_enable = dpmv8_bpwp_enable; */
1408 dpm
->bpwp_disable
= dpmv8_bpwp_disable
;
1410 /* breakpoint setup -- optional until it works everywhere */
1411 if (!target
->type
->add_breakpoint
) {
1412 target
->type
->add_breakpoint
= dpmv8_add_breakpoint
;
1413 target
->type
->remove_breakpoint
= dpmv8_remove_breakpoint
;
1416 /* watchpoint setup */
1417 target
->type
->add_watchpoint
= dpmv8_add_watchpoint
;
1418 target
->type
->remove_watchpoint
= dpmv8_remove_watchpoint
;
1420 /* FIXME add vector catch support */
1422 dpm
->nbp
= 1 + ((dpm
->didr
>> 12) & 0xf);
1423 dpm
->dbp
= calloc(dpm
->nbp
, sizeof *dpm
->dbp
);
1425 dpm
->nwp
= 1 + ((dpm
->didr
>> 20) & 0xf);
1426 dpm
->dwp
= calloc(dpm
->nwp
, sizeof *dpm
->dwp
);
1428 if (!dpm
->dbp
|| !dpm
->dwp
) {
1434 LOG_INFO("%s: hardware has %d breakpoints, %d watchpoints",
1435 target_name(target
), dpm
->nbp
, dpm
->nwp
);
1437 /* REVISIT ... and some of those breakpoints could match
1438 * execution context IDs...
1445 * Reinitializes DPM state at the beginning of a new debug session
1446 * or after a reset which may have affected the debug module.
1448 int armv8_dpm_initialize(struct arm_dpm
*dpm
)
1450 /* Disable all breakpoints and watchpoints at startup. */
1451 if (dpm
->bpwp_disable
) {
1454 for (i
= 0; i
< dpm
->nbp
; i
++) {
1455 dpm
->dbp
[i
].bpwp
.number
= i
;
1456 (void) dpm
->bpwp_disable(dpm
, i
);
1458 for (i
= 0; i
< dpm
->nwp
; i
++) {
1459 dpm
->dwp
[i
].bpwp
.number
= 16 + i
;
1460 (void) dpm
->bpwp_disable(dpm
, 16 + i
);
1463 LOG_WARNING("%s: can't disable breakpoints and watchpoints",
1464 target_name(dpm
->arm
->target
));