src/target/arm920t.c

   1 /***************************************************************************
   2  *   Copyright (C) 2005 by Dominic Rath                                    *
   3  *   Dominic.Rath@gmx.de                                                   *
   4  *                                                                         *
   5  *   This program is free software; you can redistribute it and/or modify  *
   6  *   it under the terms of the GNU General Public License as published by  *
   7  *   the Free Software Foundation; either version 2 of the License, or     *
   8  *   (at your option) any later version.                                   *
   9  *                                                                         *
  10  *   This program is distributed in the hope that it will be useful,       *
  11  *   but WITHOUT ANY WARRANTY; without even the implied warranty of        *
  12  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
  13  *   GNU General Public License for more details.                          *
  14  *                                                                         *
  15  *   You should have received a copy of the GNU General Public License     *
  16  *   along with this program; if not, write to the                         *
  17  *   Free Software Foundation, Inc.,                                       *
  18  *   59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
  19  ***************************************************************************/
  20 #ifdef HAVE_CONFIG_H
  21 #include "config.h"
  22 #endif
  23
  24 #include "arm920t.h"
  25 #include "time_support.h"
  26 #include "target_type.h"
  27
  28
  29 #if 0
  30 #define _DEBUG_INSTRUCTION_EXECUTION_
  31 #endif
  32
  33 /* cli handling */
  34 int arm920t_handle_cp15_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc);
  35 int arm920t_handle_cp15i_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc);
  36 int arm920t_handle_virt2phys_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc);
  37 int arm920t_handle_cache_info_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc);
  38 int arm920t_handle_md_phys_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc);
  39 int arm920t_handle_mw_phys_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc);
  40
  41 int arm920t_handle_read_cache_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc);
  42 int arm920t_handle_read_mmu_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc);
  43
  44 /* forward declarations */
  45 int arm920t_target_create(struct target_s *target, Jim_Interp *interp);
  46 int arm920t_init_target(struct command_context_s *cmd_ctx, struct target_s *target);
  47 int arm920t_quit(void);
  48
  49 #define ARM920T_CP15_PHYS_ADDR(x, y, z) ((x << 5) | (y << 1) << (z))
  50
  51 target_type_t arm920t_target =
  52 {
  53         .name = "arm920t",
  54
  55         .poll = arm7_9_poll,
  56         .arch_state = arm920t_arch_state,
  57
  58         .target_request_data = arm7_9_target_request_data,
  59
  60         .halt = arm7_9_halt,
  61         .resume = arm7_9_resume,
  62         .step = arm7_9_step,
  63
  64         .assert_reset = arm7_9_assert_reset,
  65         .deassert_reset = arm7_9_deassert_reset,
  66         .soft_reset_halt = arm920t_soft_reset_halt,
  67
  68         .get_gdb_reg_list = armv4_5_get_gdb_reg_list,
  69
  70         .read_memory = arm920t_read_memory,
  71         .write_memory = arm920t_write_memory,
  72         .bulk_write_memory = arm7_9_bulk_write_memory,
  73         .checksum_memory = arm7_9_checksum_memory,
  74         .blank_check_memory = arm7_9_blank_check_memory,
  75
  76         .run_algorithm = armv4_5_run_algorithm,
  77
  78         .add_breakpoint = arm7_9_add_breakpoint,
  79         .remove_breakpoint = arm7_9_remove_breakpoint,
  80         .add_watchpoint = arm7_9_add_watchpoint,
  81         .remove_watchpoint = arm7_9_remove_watchpoint,
  82
  83         .register_commands = arm920t_register_commands,
  84         .target_create = arm920t_target_create,
  85         .init_target = arm920t_init_target,
  86         .examine = arm9tdmi_examine,
  87         .quit = arm920t_quit
  88 };
  89
  90 int arm920t_read_cp15_physical(target_t *target, int reg_addr, uint32_t *value)
  91 {
  92         armv4_5_common_t *armv4_5 = target->arch_info;
  93         arm7_9_common_t *arm7_9 = armv4_5->arch_info;
  94         arm_jtag_t *jtag_info = &arm7_9->jtag_info;
  95         scan_field_t fields[4];
  96         uint8_t access_type_buf = 1;
  97         uint8_t reg_addr_buf = reg_addr & 0x3f;
  98         uint8_t nr_w_buf = 0;
  99
 100         jtag_set_end_state(TAP_IDLE);
 101         arm_jtag_scann(jtag_info, 0xf);
 102         arm_jtag_set_instr(jtag_info, jtag_info->intest_instr, NULL);
 103
 104         fields[0].tap = jtag_info->tap;
 105         fields[0].num_bits = 1;
 106         fields[0].out_value = &access_type_buf;
 107         fields[0].in_value = NULL;
 108
 109         fields[1].tap = jtag_info->tap;
 110         fields[1].num_bits = 32;
 111         fields[1].out_value = NULL;
 112         fields[1].in_value = NULL;
 113
 114         fields[2].tap = jtag_info->tap;
 115         fields[2].num_bits = 6;
 116         fields[2].out_value = &reg_addr_buf;
 117         fields[2].in_value = NULL;
 118
 119         fields[3].tap = jtag_info->tap;
 120         fields[3].num_bits = 1;
 121         fields[3].out_value = &nr_w_buf;
 122         fields[3].in_value = NULL;
 123
 124         jtag_add_dr_scan(4, fields, jtag_get_end_state());
 125
 126         fields[1].in_value = (uint8_t *)value;
 127
 128         jtag_add_dr_scan(4, fields, jtag_get_end_state());
 129
 130         jtag_add_callback(arm_le_to_h_u32, (jtag_callback_data_t)value);
 131
 132         #ifdef _DEBUG_INSTRUCTION_EXECUTION_
 133         jtag_execute_queue();
 134         LOG_DEBUG("addr: 0x%x value: %8.8x", reg_addr, *value);
 135 #endif
 136
 137         return ERROR_OK;
 138 }
 139
 140 int arm920t_write_cp15_physical(target_t *target, int reg_addr, uint32_t value)
 141 {
 142         armv4_5_common_t *armv4_5 = target->arch_info;
 143         arm7_9_common_t *arm7_9 = armv4_5->arch_info;
 144         arm_jtag_t *jtag_info = &arm7_9->jtag_info;
 145         scan_field_t fields[4];
 146         uint8_t access_type_buf = 1;
 147         uint8_t reg_addr_buf = reg_addr & 0x3f;
 148         uint8_t nr_w_buf = 1;
 149         uint8_t value_buf[4];
 150
 151         buf_set_u32(value_buf, 0, 32, value);
 152
 153         jtag_set_end_state(TAP_IDLE);
 154         arm_jtag_scann(jtag_info, 0xf);
 155         arm_jtag_set_instr(jtag_info, jtag_info->intest_instr, NULL);
 156
 157         fields[0].tap = jtag_info->tap;
 158         fields[0].num_bits = 1;
 159         fields[0].out_value = &access_type_buf;
 160         fields[0].in_value = NULL;
 161
 162         fields[1].tap = jtag_info->tap;
 163         fields[1].num_bits = 32;
 164         fields[1].out_value = value_buf;
 165         fields[1].in_value = NULL;
 166
 167         fields[2].tap = jtag_info->tap;
 168         fields[2].num_bits = 6;
 169         fields[2].out_value = &reg_addr_buf;
 170         fields[2].in_value = NULL;
 171
 172         fields[3].tap = jtag_info->tap;
 173         fields[3].num_bits = 1;
 174         fields[3].out_value = &nr_w_buf;
 175         fields[3].in_value = NULL;
 176
 177         jtag_add_dr_scan(4, fields, jtag_get_end_state());
 178
 179 #ifdef _DEBUG_INSTRUCTION_EXECUTION_
 180         LOG_DEBUG("addr: 0x%x value: %8.8x", reg_addr, value);
 181 #endif
 182
 183         return ERROR_OK;
 184 }
 185
 186 int arm920t_execute_cp15(target_t *target, uint32_t cp15_opcode, uint32_t arm_opcode)
 187 {
 188         int retval;
 189         armv4_5_common_t *armv4_5 = target->arch_info;
 190         arm7_9_common_t *arm7_9 = armv4_5->arch_info;
 191         arm_jtag_t *jtag_info = &arm7_9->jtag_info;
 192         scan_field_t fields[4];
 193         uint8_t access_type_buf = 0;            /* interpreted access */
 194         uint8_t reg_addr_buf = 0x0;
 195         uint8_t nr_w_buf = 0;
 196         uint8_t cp15_opcode_buf[4];
 197
 198         jtag_set_end_state(TAP_IDLE);
 199         arm_jtag_scann(jtag_info, 0xf);
 200         arm_jtag_set_instr(jtag_info, jtag_info->intest_instr, NULL);
 201
 202         buf_set_u32(cp15_opcode_buf, 0, 32, cp15_opcode);
 203
 204         fields[0].tap = jtag_info->tap;
 205         fields[0].num_bits = 1;
 206         fields[0].out_value = &access_type_buf;
 207         fields[0].in_value = NULL;
 208
 209         fields[1].tap = jtag_info->tap;
 210         fields[1].num_bits = 32;
 211         fields[1].out_value = cp15_opcode_buf;
 212         fields[1].in_value = NULL;
 213
 214         fields[2].tap = jtag_info->tap;
 215         fields[2].num_bits = 6;
 216         fields[2].out_value = &reg_addr_buf;
 217         fields[2].in_value = NULL;
 218
 219         fields[3].tap = jtag_info->tap;
 220         fields[3].num_bits = 1;
 221         fields[3].out_value = &nr_w_buf;
 222         fields[3].in_value = NULL;
 223
 224         jtag_add_dr_scan(4, fields, jtag_get_end_state());
 225
 226         arm9tdmi_clock_out(jtag_info, arm_opcode, 0, NULL, 0);
 227         arm9tdmi_clock_out(jtag_info, ARMV4_5_NOP, 0, NULL, 1);
 228         retval = arm7_9_execute_sys_speed(target);
 229         if (retval != ERROR_OK)
 230                 return retval;
 231
 232         if ((retval = jtag_execute_queue()) != ERROR_OK)
 233         {
 234                 LOG_ERROR("failed executing JTAG queue, exiting");
 235                 return retval;
 236         }
 237
 238         return ERROR_OK;
 239 }
 240
 241 int arm920t_read_cp15_interpreted(target_t *target, uint32_t cp15_opcode, uint32_t address, uint32_t *value)
 242 {
 243         armv4_5_common_t *armv4_5 = target->arch_info;
 244         uint32_t* regs_p[1];
 245         uint32_t regs[2];
 246         uint32_t cp15c15 = 0x0;
 247
 248         /* load address into R1 */
 249         regs[1] = address;
 250         arm9tdmi_write_core_regs(target, 0x2, regs);
 251
 252         /* read-modify-write CP15 test state register
 253         * to enable interpreted access mode */
 254         arm920t_read_cp15_physical(target, 0x1e, &cp15c15);
 255         jtag_execute_queue();
 256         cp15c15 |= 1;   /* set interpret mode */
 257         arm920t_write_cp15_physical(target, 0x1e, cp15c15);
 258
 259         /* execute CP15 instruction and ARM load (reading from coprocessor) */
 260         arm920t_execute_cp15(target, cp15_opcode, ARMV4_5_LDR(0, 1));
 261
 262         /* disable interpreted access mode */
 263         cp15c15 &= ~1U; /* clear interpret mode */
 264         arm920t_write_cp15_physical(target, 0x1e, cp15c15);
 265
 266         /* retrieve value from R0 */
 267         regs_p[0] = value;
 268         arm9tdmi_read_core_regs(target, 0x1, regs_p);
 269         jtag_execute_queue();
 270
 271 #ifdef _DEBUG_INSTRUCTION_EXECUTION_
 272         LOG_DEBUG("cp15_opcode: %8.8x, address: %8.8x, value: %8.8x", cp15_opcode, address, *value);
 273 #endif
 274
 275         if (armv4_5_mode_to_number(armv4_5->core_mode)==-1)
 276                 return ERROR_FAIL;
 277
 278         ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 0).dirty = 1;
 279         ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 1).dirty = 1;
 280
 281         return ERROR_OK;
 282 }
 283
 284 int arm920t_write_cp15_interpreted(target_t *target, uint32_t cp15_opcode, uint32_t value, uint32_t address)
 285 {
 286         uint32_t cp15c15 = 0x0;
 287         armv4_5_common_t *armv4_5 = target->arch_info;
 288         uint32_t regs[2];
 289
 290         /* load value, address into R0, R1 */
 291         regs[0] = value;
 292         regs[1] = address;
 293         arm9tdmi_write_core_regs(target, 0x3, regs);
 294
 295         /* read-modify-write CP15 test state register
 296         * to enable interpreted access mode */
 297         arm920t_read_cp15_physical(target, 0x1e, &cp15c15);
 298         jtag_execute_queue();
 299         cp15c15 |= 1;   /* set interpret mode */
 300         arm920t_write_cp15_physical(target, 0x1e, cp15c15);
 301
 302         /* execute CP15 instruction and ARM store (writing to coprocessor) */
 303         arm920t_execute_cp15(target, cp15_opcode, ARMV4_5_STR(0, 1));
 304
 305         /* disable interpreted access mode */
 306         cp15c15 &= ~1U; /* set interpret mode */
 307         arm920t_write_cp15_physical(target, 0x1e, cp15c15);
 308
 309 #ifdef _DEBUG_INSTRUCTION_EXECUTION_
 310         LOG_DEBUG("cp15_opcode: %8.8x, value: %8.8x, address: %8.8x", cp15_opcode, value, address);
 311 #endif
 312
 313         if (armv4_5_mode_to_number(armv4_5->core_mode)==-1)
 314                 return ERROR_FAIL;
 315
 316         ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 0).dirty = 1;
 317         ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 1).dirty = 1;
 318
 319         return ERROR_OK;
 320 }
 321
 322 uint32_t arm920t_get_ttb(target_t *target)
 323 {
 324         int retval;
 325         uint32_t ttb = 0x0;
 326
 327         if ((retval = arm920t_read_cp15_interpreted(target, 0xeebf0f51, 0x0, &ttb)) != ERROR_OK)
 328                 return retval;
 329
 330         return ttb;
 331 }
 332
 333 void arm920t_disable_mmu_caches(target_t *target, int mmu, int d_u_cache, int i_cache)
 334 {
 335         uint32_t cp15_control;
 336
 337         /* read cp15 control register */
 338         arm920t_read_cp15_physical(target, 0x2, &cp15_control);
 339         jtag_execute_queue();
 340
 341         if (mmu)
 342                 cp15_control &= ~0x1U;
 343
 344         if (d_u_cache)
 345                 cp15_control &= ~0x4U;
 346
 347         if (i_cache)
 348                 cp15_control &= ~0x1000U;
 349
 350         arm920t_write_cp15_physical(target, 0x2, cp15_control);
 351 }
 352
 353 void arm920t_enable_mmu_caches(target_t *target, int mmu, int d_u_cache, int i_cache)
 354 {
 355         uint32_t cp15_control;
 356
 357         /* read cp15 control register */
 358         arm920t_read_cp15_physical(target, 0x2, &cp15_control);
 359         jtag_execute_queue();
 360
 361         if (mmu)
 362                 cp15_control |= 0x1U;
 363
 364         if (d_u_cache)
 365                 cp15_control |= 0x4U;
 366
 367         if (i_cache)
 368                 cp15_control |= 0x1000U;
 369
 370         arm920t_write_cp15_physical(target, 0x2, cp15_control);
 371 }
 372
 373 void arm920t_post_debug_entry(target_t *target)
 374 {
 375         uint32_t cp15c15;
 376         armv4_5_common_t *armv4_5 = target->arch_info;
 377         arm7_9_common_t *arm7_9 = armv4_5->arch_info;
 378         arm9tdmi_common_t *arm9tdmi = arm7_9->arch_info;
 379         arm920t_common_t *arm920t = arm9tdmi->arch_info;
 380
 381         /* examine cp15 control reg */
 382         arm920t_read_cp15_physical(target, 0x2, &arm920t->cp15_control_reg);
 383         jtag_execute_queue();
 384         LOG_DEBUG("cp15_control_reg: %8.8" PRIx32 "", arm920t->cp15_control_reg);
 385
 386         if (arm920t->armv4_5_mmu.armv4_5_cache.ctype == -1)
 387         {
 388                 uint32_t cache_type_reg;
 389                 /* identify caches */
 390                 arm920t_read_cp15_physical(target, 0x1, &cache_type_reg);
 391                 jtag_execute_queue();
 392                 armv4_5_identify_cache(cache_type_reg, &arm920t->armv4_5_mmu.armv4_5_cache);
 393         }
 394
 395         arm920t->armv4_5_mmu.mmu_enabled = (arm920t->cp15_control_reg & 0x1U) ? 1 : 0;
 396         arm920t->armv4_5_mmu.armv4_5_cache.d_u_cache_enabled = (arm920t->cp15_control_reg & 0x4U) ? 1 : 0;
 397         arm920t->armv4_5_mmu.armv4_5_cache.i_cache_enabled = (arm920t->cp15_control_reg & 0x1000U) ? 1 : 0;
 398
 399         /* save i/d fault status and address register */
 400         arm920t_read_cp15_interpreted(target, 0xee150f10, 0x0, &arm920t->d_fsr);
 401         arm920t_read_cp15_interpreted(target, 0xee150f30, 0x0, &arm920t->i_fsr);
 402         arm920t_read_cp15_interpreted(target, 0xee160f10, 0x0, &arm920t->d_far);
 403         arm920t_read_cp15_interpreted(target, 0xee160f30, 0x0, &arm920t->i_far);
 404
 405         LOG_DEBUG("D FSR: 0x%8.8" PRIx32 ", D FAR: 0x%8.8" PRIx32 ", I FSR: 0x%8.8" PRIx32 ", I FAR: 0x%8.8" PRIx32 "",
 406                 arm920t->d_fsr, arm920t->d_far, arm920t->i_fsr, arm920t->i_far);
 407
 408         if (arm920t->preserve_cache)
 409         {
 410                 /* read-modify-write CP15 test state register
 411                  * to disable I/D-cache linefills */
 412                 arm920t_read_cp15_physical(target, 0x1e, &cp15c15);
 413                 jtag_execute_queue();
 414                 cp15c15 |= 0x600;
 415                 arm920t_write_cp15_physical(target, 0x1e, cp15c15);
 416         }
 417 }
 418
 419 void arm920t_pre_restore_context(target_t *target)
 420 {
 421         uint32_t cp15c15;
 422         armv4_5_common_t *armv4_5 = target->arch_info;
 423         arm7_9_common_t *arm7_9 = armv4_5->arch_info;
 424         arm9tdmi_common_t *arm9tdmi = arm7_9->arch_info;
 425         arm920t_common_t *arm920t = arm9tdmi->arch_info;
 426
 427         /* restore i/d fault status and address register */
 428         arm920t_write_cp15_interpreted(target, 0xee050f10, arm920t->d_fsr, 0x0);
 429         arm920t_write_cp15_interpreted(target, 0xee050f30, arm920t->i_fsr, 0x0);
 430         arm920t_write_cp15_interpreted(target, 0xee060f10, arm920t->d_far, 0x0);
 431         arm920t_write_cp15_interpreted(target, 0xee060f30, arm920t->i_far, 0x0);
 432
 433         /* read-modify-write CP15 test state register
 434         * to reenable I/D-cache linefills */
 435         if (arm920t->preserve_cache)
 436         {
 437                 arm920t_read_cp15_physical(target, 0x1e, &cp15c15);
 438                 jtag_execute_queue();
 439                 cp15c15 &= ~0x600U;
 440                 arm920t_write_cp15_physical(target, 0x1e, cp15c15);
 441         }
 442 }
 443
 444 int arm920t_get_arch_pointers(target_t *target, armv4_5_common_t **armv4_5_p, arm7_9_common_t **arm7_9_p, arm9tdmi_common_t **arm9tdmi_p, arm920t_common_t **arm920t_p)
 445 {
 446         armv4_5_common_t *armv4_5 = target->arch_info;
 447         arm7_9_common_t *arm7_9;
 448         arm9tdmi_common_t *arm9tdmi;
 449         arm920t_common_t *arm920t;
 450
 451         if (armv4_5->common_magic != ARMV4_5_COMMON_MAGIC)
 452         {
 453                 return -1;
 454         }
 455
 456         arm7_9 = armv4_5->arch_info;
 457         if (arm7_9->common_magic != ARM7_9_COMMON_MAGIC)
 458         {
 459                 return -1;
 460         }
 461
 462         arm9tdmi = arm7_9->arch_info;
 463         if (arm9tdmi->common_magic != ARM9TDMI_COMMON_MAGIC)
 464         {
 465                 return -1;
 466         }
 467
 468         arm920t = arm9tdmi->arch_info;
 469         if (arm920t->common_magic != ARM920T_COMMON_MAGIC)
 470         {
 471                 return -1;
 472         }
 473
 474         *armv4_5_p = armv4_5;
 475         *arm7_9_p = arm7_9;
 476         *arm9tdmi_p = arm9tdmi;
 477         *arm920t_p = arm920t;
 478
 479         return ERROR_OK;
 480 }
 481
 482 int arm920t_arch_state(struct target_s *target)
 483 {
 484         armv4_5_common_t *armv4_5 = target->arch_info;
 485         arm7_9_common_t *arm7_9 = armv4_5->arch_info;
 486         arm9tdmi_common_t *arm9tdmi = arm7_9->arch_info;
 487         arm920t_common_t *arm920t = arm9tdmi->arch_info;
 488
 489         char *state[] =
 490         {
 491                 "disabled", "enabled"
 492         };
 493
 494         if (armv4_5->common_magic != ARMV4_5_COMMON_MAGIC)
 495         {
 496                 LOG_ERROR("BUG: called for a non-ARMv4/5 target");
 497                 exit(-1);
 498         }
 499
 500         LOG_USER("target halted in %s state due to %s, current mode: %s\n"
 501                         "cpsr: 0x%8.8" PRIx32 " pc: 0x%8.8" PRIx32 "\n"
 502                         "MMU: %s, D-Cache: %s, I-Cache: %s",
 503                          armv4_5_state_strings[armv4_5->core_state],
 504                          Jim_Nvp_value2name_simple(nvp_target_debug_reason, target->debug_reason)->name,
 505                          armv4_5_mode_strings[armv4_5_mode_to_number(armv4_5->core_mode)],
 506                          buf_get_u32(armv4_5->core_cache->reg_list[ARMV4_5_CPSR].value, 0, 32),
 507                          buf_get_u32(armv4_5->core_cache->reg_list[15].value, 0, 32),
 508                          state[arm920t->armv4_5_mmu.mmu_enabled],
 509                          state[arm920t->armv4_5_mmu.armv4_5_cache.d_u_cache_enabled],
 510                          state[arm920t->armv4_5_mmu.armv4_5_cache.i_cache_enabled]);
 511
 512         return ERROR_OK;
 513 }
 514
 515 int arm920t_read_memory(struct target_s *target, uint32_t address, uint32_t size, uint32_t count, uint8_t *buffer)
 516 {
 517         int retval;
 518
 519         retval = arm7_9_read_memory(target, address, size, count, buffer);
 520
 521         return retval;
 522 }
 523
 524 int arm920t_write_memory(struct target_s *target, uint32_t address, uint32_t size, uint32_t count, uint8_t *buffer)
 525 {
 526         int retval;
 527         armv4_5_common_t *armv4_5 = target->arch_info;
 528         arm7_9_common_t *arm7_9 = armv4_5->arch_info;
 529         arm9tdmi_common_t *arm9tdmi = arm7_9->arch_info;
 530         arm920t_common_t *arm920t = arm9tdmi->arch_info;
 531
 532         if ((retval = arm7_9_write_memory(target, address, size, count, buffer)) != ERROR_OK)
 533                 return retval;
 534
 535         if (((size == 4) || (size == 2)) && (count == 1))
 536         {
 537                 if (arm920t->armv4_5_mmu.armv4_5_cache.d_u_cache_enabled)
 538                 {
 539                         LOG_DEBUG("D-Cache enabled, writing through to main memory");
 540                         uint32_t pa, cb, ap;
 541                         int type, domain;
 542
 543                         pa = armv4_5_mmu_translate_va(target, &arm920t->armv4_5_mmu, address, &type, &cb, &domain, &ap);
 544                         if (type == -1)
 545                                 return ERROR_OK;
 546                         /* cacheable & bufferable means write-back region */
 547                         if (cb == 3)
 548                                 armv4_5_mmu_write_physical(target, &arm920t->armv4_5_mmu, pa, size, count, buffer);
 549                 }
 550
 551                 if (arm920t->armv4_5_mmu.armv4_5_cache.i_cache_enabled)
 552                 {
 553                         LOG_DEBUG("I-Cache enabled, invalidating affected I-Cache line");
 554                         arm920t_write_cp15_interpreted(target, 0xee070f35, 0x0, address);
 555                 }
 556         }
 557
 558         return retval;
 559 }
 560
 561 int arm920t_soft_reset_halt(struct target_s *target)
 562 {
 563         int retval = ERROR_OK;
 564         armv4_5_common_t *armv4_5 = target->arch_info;
 565         arm7_9_common_t *arm7_9 = armv4_5->arch_info;
 566         arm9tdmi_common_t *arm9tdmi = arm7_9->arch_info;
 567         arm920t_common_t *arm920t = arm9tdmi->arch_info;
 568         reg_t *dbg_stat = &arm7_9->eice_cache->reg_list[EICE_DBG_STAT];
 569
 570         if ((retval = target_halt(target)) != ERROR_OK)
 571         {
 572                 return retval;
 573         }
 574
 575         long long then = timeval_ms();
 576         int timeout;
 577         while (!(timeout = ((timeval_ms()-then) > 1000)))
 578         {
 579                 if (buf_get_u32(dbg_stat->value, EICE_DBG_STATUS_DBGACK, 1) == 0)
 580                 {
 581                         embeddedice_read_reg(dbg_stat);
 582                         if ((retval = jtag_execute_queue()) != ERROR_OK)
 583                         {
 584                                 return retval;
 585                         }
 586                 } else
 587                 {
 588                         break;
 589                 }
 590                 if (debug_level >= 3)
 591                 {
 592                         /* do not eat all CPU, time out after 1 se*/
 593                         alive_sleep(100);
 594                 } else
 595                 {
 596                         keep_alive();
 597                 }
 598         }
 599         if (timeout)
 600         {
 601                 LOG_ERROR("Failed to halt CPU after 1 sec");
 602                 return ERROR_TARGET_TIMEOUT;
 603         }
 604
 605         target->state = TARGET_HALTED;
 606
 607         /* SVC, ARM state, IRQ and FIQ disabled */
 608         buf_set_u32(armv4_5->core_cache->reg_list[ARMV4_5_CPSR].value, 0, 8, 0xd3);
 609         armv4_5->core_cache->reg_list[ARMV4_5_CPSR].dirty = 1;
 610         armv4_5->core_cache->reg_list[ARMV4_5_CPSR].valid = 1;
 611
 612         /* start fetching from 0x0 */
 613         buf_set_u32(armv4_5->core_cache->reg_list[15].value, 0, 32, 0x0);
 614         armv4_5->core_cache->reg_list[15].dirty = 1;
 615         armv4_5->core_cache->reg_list[15].valid = 1;
 616
 617         armv4_5->core_mode = ARMV4_5_MODE_SVC;
 618         armv4_5->core_state = ARMV4_5_STATE_ARM;
 619
 620         arm920t_disable_mmu_caches(target, 1, 1, 1);
 621         arm920t->armv4_5_mmu.mmu_enabled = 0;
 622         arm920t->armv4_5_mmu.armv4_5_cache.d_u_cache_enabled = 0;
 623         arm920t->armv4_5_mmu.armv4_5_cache.i_cache_enabled = 0;
 624
 625         if ((retval = target_call_event_callbacks(target, TARGET_EVENT_HALTED)) != ERROR_OK)
 626         {
 627                 return retval;
 628         }
 629
 630         return ERROR_OK;
 631 }
 632
 633 int arm920t_init_target(struct command_context_s *cmd_ctx, struct target_s *target)
 634 {
 635         arm9tdmi_init_target(cmd_ctx, target);
 636
 637         return ERROR_OK;
 638 }
 639
 640 int arm920t_quit(void)
 641 {
 642         return ERROR_OK;
 643 }
 644
 645 int arm920t_init_arch_info(target_t *target, arm920t_common_t *arm920t, jtag_tap_t *tap)
 646 {
 647         arm9tdmi_common_t *arm9tdmi = &arm920t->arm9tdmi_common;
 648         arm7_9_common_t *arm7_9 = &arm9tdmi->arm7_9_common;
 649
 650         /* initialize arm9tdmi specific info (including arm7_9 and armv4_5)
 651          */
 652         arm9tdmi_init_arch_info(target, arm9tdmi, tap);
 653
 654         arm9tdmi->arch_info = arm920t;
 655         arm920t->common_magic = ARM920T_COMMON_MAGIC;
 656
 657         arm7_9->post_debug_entry = arm920t_post_debug_entry;
 658         arm7_9->pre_restore_context = arm920t_pre_restore_context;
 659
 660         arm920t->armv4_5_mmu.armv4_5_cache.ctype = -1;
 661         arm920t->armv4_5_mmu.get_ttb = arm920t_get_ttb;
 662         arm920t->armv4_5_mmu.read_memory = arm7_9_read_memory;
 663         arm920t->armv4_5_mmu.write_memory = arm7_9_write_memory;
 664         arm920t->armv4_5_mmu.disable_mmu_caches = arm920t_disable_mmu_caches;
 665         arm920t->armv4_5_mmu.enable_mmu_caches = arm920t_enable_mmu_caches;
 666         arm920t->armv4_5_mmu.has_tiny_pages = 1;
 667         arm920t->armv4_5_mmu.mmu_enabled = 0;
 668
 669         /* disabling linefills leads to lockups, so keep them enabled for now
 670          * this doesn't affect correctness, but might affect timing issues, if
 671          * important data is evicted from the cache during the debug session
 672          * */
 673         arm920t->preserve_cache = 0;
 674
 675         /* override hw single-step capability from ARM9TDMI */
 676         arm7_9->has_single_step = 1;
 677
 678         return ERROR_OK;
 679 }
 680
 681 int arm920t_target_create(struct target_s *target, Jim_Interp *interp)
 682 {
 683         arm920t_common_t *arm920t = calloc(1,sizeof(arm920t_common_t));
 684
 685         arm920t_init_arch_info(target, arm920t, target->tap);
 686
 687         return ERROR_OK;
 688 }
 689
 690 int arm920t_register_commands(struct command_context_s *cmd_ctx)
 691 {
 692         int retval;
 693         command_t *arm920t_cmd;
 694
 695
 696         retval = arm9tdmi_register_commands(cmd_ctx);
 697
 698         arm920t_cmd = register_command(cmd_ctx, NULL, "arm920t", NULL, COMMAND_ANY, "arm920t specific commands");
 699
 700         register_command(cmd_ctx, arm920t_cmd, "cp15", arm920t_handle_cp15_command, COMMAND_EXEC, "display/modify cp15 register <num> [value]");
 701         register_command(cmd_ctx, arm920t_cmd, "cp15i", arm920t_handle_cp15i_command, COMMAND_EXEC, "display/modify cp15 (interpreted access) <opcode> [value] [address]");
 702         register_command(cmd_ctx, arm920t_cmd, "cache_info", arm920t_handle_cache_info_command, COMMAND_EXEC, "display information about target caches");
 703         register_command(cmd_ctx, arm920t_cmd, "virt2phys", arm920t_handle_virt2phys_command, COMMAND_EXEC, "translate va to pa <va>");
 704
 705         register_command(cmd_ctx, arm920t_cmd, "mdw_phys", arm920t_handle_md_phys_command, COMMAND_EXEC, "display memory words <physical addr> [count]");
 706         register_command(cmd_ctx, arm920t_cmd, "mdh_phys", arm920t_handle_md_phys_command, COMMAND_EXEC, "display memory half-words <physical addr> [count]");
 707         register_command(cmd_ctx, arm920t_cmd, "mdb_phys", arm920t_handle_md_phys_command, COMMAND_EXEC, "display memory bytes <physical addr> [count]");
 708
 709         register_command(cmd_ctx, arm920t_cmd, "mww_phys", arm920t_handle_mw_phys_command, COMMAND_EXEC, "write memory word <physical addr> <value>");
 710         register_command(cmd_ctx, arm920t_cmd, "mwh_phys", arm920t_handle_mw_phys_command, COMMAND_EXEC, "write memory half-word <physical addr> <value>");
 711         register_command(cmd_ctx, arm920t_cmd, "mwb_phys", arm920t_handle_mw_phys_command, COMMAND_EXEC, "write memory byte <physical addr> <value>");
 712
 713         register_command(cmd_ctx, arm920t_cmd, "read_cache", arm920t_handle_read_cache_command, COMMAND_EXEC, "display I/D cache content");
 714         register_command(cmd_ctx, arm920t_cmd, "read_mmu", arm920t_handle_read_mmu_command, COMMAND_EXEC, "display I/D mmu content");
 715
 716         return retval;
 717 }
 718
 719 int arm920t_handle_read_cache_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc)
 720 {
 721         int retval = ERROR_OK;
 722         target_t *target = get_current_target(cmd_ctx);
 723         armv4_5_common_t *armv4_5;
 724         arm7_9_common_t *arm7_9;
 725         arm9tdmi_common_t *arm9tdmi;
 726         arm920t_common_t *arm920t;
 727         arm_jtag_t *jtag_info;
 728         uint32_t cp15c15;
 729         uint32_t cp15_ctrl, cp15_ctrl_saved;
 730         uint32_t regs[16];
 731         uint32_t *regs_p[16];
 732         uint32_t C15_C_D_Ind, C15_C_I_Ind;
 733         int i;
 734         FILE *output;
 735         arm920t_cache_line_t d_cache[8][64], i_cache[8][64];
 736         int segment, index;
 737
 738         if (argc != 1)
 739         {
 740                 command_print(cmd_ctx, "usage: arm920t read_cache <filename>");
 741                 return ERROR_OK;
 742         }
 743
 744         if ((output = fopen(args[0], "w")) == NULL)
 745         {
 746                 LOG_DEBUG("error opening cache content file");
 747                 return ERROR_OK;
 748         }
 749
 750         for (i = 0; i < 16; i++)
 751                 regs_p[i] = &regs[i];
 752
 753         if (arm920t_get_arch_pointers(target, &armv4_5, &arm7_9, &arm9tdmi, &arm920t) != ERROR_OK)
 754         {
 755                 command_print(cmd_ctx, "current target isn't an ARM920t target");
 756                 return ERROR_OK;
 757         }
 758
 759         jtag_info = &arm7_9->jtag_info;
 760
 761         /* disable MMU and Caches */
 762         arm920t_read_cp15_physical(target, ARM920T_CP15_PHYS_ADDR(0, 0x1, 0), &cp15_ctrl);
 763         if ((retval = jtag_execute_queue()) != ERROR_OK)
 764         {
 765                 return retval;
 766         }
 767         cp15_ctrl_saved = cp15_ctrl;
 768         cp15_ctrl &= ~(ARMV4_5_MMU_ENABLED | ARMV4_5_D_U_CACHE_ENABLED | ARMV4_5_I_CACHE_ENABLED);
 769         arm920t_write_cp15_physical(target, ARM920T_CP15_PHYS_ADDR(0, 0x1, 0), cp15_ctrl);
 770
 771         /* read CP15 test state register */
 772         arm920t_read_cp15_physical(target, ARM920T_CP15_PHYS_ADDR(0, 0xf, 0), &cp15c15);
 773         jtag_execute_queue();
 774
 775         /* read DCache content */
 776         fprintf(output, "DCache:\n");
 777
 778         /* go through segments 0 to nsets (8 on ARM920T, 4 on ARM922T) */
 779         for (segment = 0; segment < arm920t->armv4_5_mmu.armv4_5_cache.d_u_size.nsets; segment++)
 780         {
 781                 fprintf(output, "\nsegment: %i\n----------", segment);
 782
 783                 /* Ra: r0 = SBZ(31:8):segment(7:5):SBZ(4:0) */
 784                 regs[0] = 0x0 | (segment << 5);
 785                 arm9tdmi_write_core_regs(target, 0x1, regs);
 786
 787                 /* set interpret mode */
 788                 cp15c15 |= 0x1;
 789                 arm920t_write_cp15_physical(target, ARM920T_CP15_PHYS_ADDR(0, 0xf, 0), cp15c15);
 790
 791                 /* D CAM Read, loads current victim into C15.C.D.Ind */
 792                 arm920t_execute_cp15(target, ARMV4_5_MCR(15,2,0,15,6,2), ARMV4_5_LDR(1, 0));
 793
 794                 /* read current victim */
 795                 arm920t_read_cp15_physical(target, 0x3d, &C15_C_D_Ind);
 796
 797                 /* clear interpret mode */
 798                 cp15c15 &= ~0x1;
 799                 arm920t_write_cp15_physical(target, 0x1e, cp15c15);
 800
 801                 for (index = 0; index < 64; index++)
 802                 {
 803                         /* Ra: r0 = index(31:26):SBZ(25:8):segment(7:5):SBZ(4:0) */
 804                         regs[0] = 0x0 | (segment << 5) | (index << 26);
 805                         arm9tdmi_write_core_regs(target, 0x1, regs);
 806
 807                         /* set interpret mode */
 808                         cp15c15 |= 0x1;
 809                         arm920t_write_cp15_physical(target, ARM920T_CP15_PHYS_ADDR(0, 0xf, 0), cp15c15);
 810
 811                         /* Write DCache victim */
 812                         arm920t_execute_cp15(target, ARMV4_5_MCR(15,0,0,9,1,0), ARMV4_5_LDR(1, 0));
 813
 814                         /* Read D RAM */
 815                         arm920t_execute_cp15(target, ARMV4_5_MCR(15,2,0,15,10,2), ARMV4_5_LDMIA(0, 0x1fe, 0, 0));
 816
 817                         /* Read D CAM */
 818                         arm920t_execute_cp15(target, ARMV4_5_MCR(15,2,0,15,6,2), ARMV4_5_LDR(9, 0));
 819
 820                         /* clear interpret mode */
 821                         cp15c15 &= ~0x1;
 822                         arm920t_write_cp15_physical(target, 0x1e, cp15c15);
 823
 824                         /* read D RAM and CAM content */
 825                         arm9tdmi_read_core_regs(target, 0x3fe, regs_p);
 826                         if ((retval = jtag_execute_queue()) != ERROR_OK)
 827                         {
 828                                 return retval;
 829                         }
 830
 831                         d_cache[segment][index].cam = regs[9];
 832
 833                         /* mask LFSR[6] */
 834                         regs[9] &= 0xfffffffe;
 835                         fprintf(output, "\nsegment: %i, index: %i, CAM: 0x%8.8" PRIx32 ", content (%s):\n", segment, index, regs[9], (regs[9] & 0x10) ? "valid" : "invalid");
 836
 837                         for (i = 1; i < 9; i++)
 838                         {
 839                                  d_cache[segment][index].data[i] = regs[i];
 840                                  fprintf(output, "%i: 0x%8.8" PRIx32 "\n", i-1, regs[i]);
 841                         }
 842
 843                 }
 844
 845                 /* Ra: r0 = index(31:26):SBZ(25:8):segment(7:5):SBZ(4:0) */
 846                 regs[0] = 0x0 | (segment << 5) | (C15_C_D_Ind << 26);
 847                 arm9tdmi_write_core_regs(target, 0x1, regs);
 848
 849                 /* set interpret mode */
 850                 cp15c15 |= 0x1;
 851                 arm920t_write_cp15_physical(target, ARM920T_CP15_PHYS_ADDR(0, 0xf, 0), cp15c15);
 852
 853                 /* Write DCache victim */
 854                 arm920t_execute_cp15(target, ARMV4_5_MCR(15,0,0,9,1,0), ARMV4_5_LDR(1, 0));
 855
 856                 /* clear interpret mode */
 857                 cp15c15 &= ~0x1;
 858                 arm920t_write_cp15_physical(target, 0x1e, cp15c15);
 859         }
 860
 861         /* read ICache content */
 862         fprintf(output, "ICache:\n");
 863
 864         /* go through segments 0 to nsets (8 on ARM920T, 4 on ARM922T) */
 865         for (segment = 0; segment < arm920t->armv4_5_mmu.armv4_5_cache.d_u_size.nsets; segment++)
 866         {
 867                 fprintf(output, "segment: %i\n----------", segment);
 868
 869                 /* Ra: r0 = SBZ(31:8):segment(7:5):SBZ(4:0) */
 870                 regs[0] = 0x0 | (segment << 5);
 871                 arm9tdmi_write_core_regs(target, 0x1, regs);
 872
 873                 /* set interpret mode */
 874                 cp15c15 |= 0x1;
 875                 arm920t_write_cp15_physical(target, ARM920T_CP15_PHYS_ADDR(0, 0xf, 0), cp15c15);
 876
 877                 /* I CAM Read, loads current victim into C15.C.I.Ind */
 878                 arm920t_execute_cp15(target, ARMV4_5_MCR(15,2,0,15,5,2), ARMV4_5_LDR(1, 0));
 879
 880                 /* read current victim */
 881                 arm920t_read_cp15_physical(target, 0x3b, &C15_C_I_Ind);
 882
 883                 /* clear interpret mode */
 884                 cp15c15 &= ~0x1;
 885                 arm920t_write_cp15_physical(target, 0x1e, cp15c15);
 886
 887                 for (index = 0; index < 64; index++)
 888                 {
 889                         /* Ra: r0 = index(31:26):SBZ(25:8):segment(7:5):SBZ(4:0) */
 890                         regs[0] = 0x0 | (segment << 5) | (index << 26);
 891                         arm9tdmi_write_core_regs(target, 0x1, regs);
 892
 893                         /* set interpret mode */
 894                         cp15c15 |= 0x1;
 895                         arm920t_write_cp15_physical(target, ARM920T_CP15_PHYS_ADDR(0, 0xf, 0), cp15c15);
 896
 897                         /* Write ICache victim */
 898                         arm920t_execute_cp15(target, ARMV4_5_MCR(15,0,0,9,1,1), ARMV4_5_LDR(1, 0));
 899
 900                         /* Read I RAM */
 901                         arm920t_execute_cp15(target, ARMV4_5_MCR(15,2,0,15,9,2), ARMV4_5_LDMIA(0, 0x1fe, 0, 0));
 902
 903                         /* Read I CAM */
 904                         arm920t_execute_cp15(target, ARMV4_5_MCR(15,2,0,15,5,2), ARMV4_5_LDR(9, 0));
 905
 906                         /* clear interpret mode */
 907                         cp15c15 &= ~0x1;
 908                         arm920t_write_cp15_physical(target, 0x1e, cp15c15);
 909
 910                         /* read I RAM and CAM content */
 911                         arm9tdmi_read_core_regs(target, 0x3fe, regs_p);
 912                         if ((retval = jtag_execute_queue()) != ERROR_OK)
 913                         {
 914                                 return retval;
 915                         }
 916
 917                         i_cache[segment][index].cam = regs[9];
 918
 919                         /* mask LFSR[6] */
 920                         regs[9] &= 0xfffffffe;
 921                         fprintf(output, "\nsegment: %i, index: %i, CAM: 0x%8.8" PRIx32 ", content (%s):\n", segment, index, regs[9], (regs[9] & 0x10) ? "valid" : "invalid");
 922
 923                         for (i = 1; i < 9; i++)
 924                         {
 925                                  i_cache[segment][index].data[i] = regs[i];
 926                                  fprintf(output, "%i: 0x%8.8" PRIx32 "\n", i-1, regs[i]);
 927                         }
 928                 }
 929
 930                 /* Ra: r0 = index(31:26):SBZ(25:8):segment(7:5):SBZ(4:0) */
 931                 regs[0] = 0x0 | (segment << 5) | (C15_C_D_Ind << 26);
 932                 arm9tdmi_write_core_regs(target, 0x1, regs);
 933
 934                 /* set interpret mode */
 935                 cp15c15 |= 0x1;
 936                 arm920t_write_cp15_physical(target, ARM920T_CP15_PHYS_ADDR(0, 0xf, 0), cp15c15);
 937
 938                 /* Write ICache victim */
 939                 arm920t_execute_cp15(target, ARMV4_5_MCR(15,0,0,9,1,1), ARMV4_5_LDR(1, 0));
 940
 941                 /* clear interpret mode */
 942                 cp15c15 &= ~0x1;
 943                 arm920t_write_cp15_physical(target, 0x1e, cp15c15);
 944         }
 945
 946         /* restore CP15 MMU and Cache settings */
 947         arm920t_write_cp15_physical(target, ARM920T_CP15_PHYS_ADDR(0, 0x1, 0), cp15_ctrl_saved);
 948
 949         command_print(cmd_ctx, "cache content successfully output to %s", args[0]);
 950
 951         fclose(output);
 952
 953         if (armv4_5_mode_to_number(armv4_5->core_mode)==-1)
 954                 return ERROR_FAIL;
 955
 956         /* mark registers dirty. */
 957         ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 0).dirty = ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 0).valid;
 958         ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 1).dirty = ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 1).valid;
 959         ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 2).dirty = ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 2).valid;
 960         ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 3).dirty = ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 3).valid;
 961         ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 4).dirty = ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 4).valid;
 962         ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 5).dirty = ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 5).valid;
 963         ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 6).dirty = ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 6).valid;
 964         ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 7).dirty = ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 7).valid;
 965         ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 8).dirty = ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 8).valid;
 966         ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 9).dirty = ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 9).valid;
 967
 968         return ERROR_OK;
 969 }
 970
 971 int arm920t_handle_read_mmu_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc)
 972 {
 973         int retval = ERROR_OK;
 974         target_t *target = get_current_target(cmd_ctx);
 975         armv4_5_common_t *armv4_5;
 976         arm7_9_common_t *arm7_9;
 977         arm9tdmi_common_t *arm9tdmi;
 978         arm920t_common_t *arm920t;
 979         arm_jtag_t *jtag_info;
 980         uint32_t cp15c15;
 981         uint32_t cp15_ctrl, cp15_ctrl_saved;
 982         uint32_t regs[16];
 983         uint32_t *regs_p[16];
 984         int i;
 985         FILE *output;
 986         uint32_t Dlockdown, Ilockdown;
 987         arm920t_tlb_entry_t d_tlb[64], i_tlb[64];
 988         int victim;
 989
 990         if (argc != 1)
 991         {
 992                 command_print(cmd_ctx, "usage: arm920t read_mmu <filename>");
 993                 return ERROR_OK;
 994         }
 995
 996         if ((output = fopen(args[0], "w")) == NULL)
 997         {
 998                 LOG_DEBUG("error opening mmu content file");
 999                 return ERROR_OK;
1000         }
1001
1002         for (i = 0; i < 16; i++)
1003                 regs_p[i] = &regs[i];
1004
1005         if (arm920t_get_arch_pointers(target, &armv4_5, &arm7_9, &arm9tdmi, &arm920t) != ERROR_OK)
1006         {
1007                 command_print(cmd_ctx, "current target isn't an ARM920t target");
1008                 return ERROR_OK;
1009         }
1010
1011         jtag_info = &arm7_9->jtag_info;
1012
1013         /* disable MMU and Caches */
1014         arm920t_read_cp15_physical(target, ARM920T_CP15_PHYS_ADDR(0, 0x1, 0), &cp15_ctrl);
1015         if ((retval = jtag_execute_queue()) != ERROR_OK)
1016         {
1017                 return retval;
1018         }
1019         cp15_ctrl_saved = cp15_ctrl;
1020         cp15_ctrl &= ~(ARMV4_5_MMU_ENABLED | ARMV4_5_D_U_CACHE_ENABLED | ARMV4_5_I_CACHE_ENABLED);
1021         arm920t_write_cp15_physical(target, ARM920T_CP15_PHYS_ADDR(0, 0x1, 0), cp15_ctrl);
1022
1023         /* read CP15 test state register */
1024         arm920t_read_cp15_physical(target, ARM920T_CP15_PHYS_ADDR(0, 0xf, 0), &cp15c15);
1025         if ((retval = jtag_execute_queue()) != ERROR_OK)
1026         {
1027                 return retval;
1028         }
1029
1030         /* prepare reading D TLB content
1031          * */
1032
1033         /* set interpret mode */
1034         cp15c15 |= 0x1;
1035         arm920t_write_cp15_physical(target, ARM920T_CP15_PHYS_ADDR(0, 0xf, 0), cp15c15);
1036
1037         /* Read D TLB lockdown */
1038         arm920t_execute_cp15(target, ARMV4_5_MRC(15,0,0,10,0,0), ARMV4_5_LDR(1, 0));
1039
1040         /* clear interpret mode */
1041         cp15c15 &= ~0x1;
1042         arm920t_write_cp15_physical(target, 0x1e, cp15c15);
1043
1044         /* read D TLB lockdown stored to r1 */
1045         arm9tdmi_read_core_regs(target, 0x2, regs_p);
1046         if ((retval = jtag_execute_queue()) != ERROR_OK)
1047         {
1048                 return retval;
1049         }
1050         Dlockdown = regs[1];
1051
1052         for (victim = 0; victim < 64; victim += 8)
1053         {
1054                 /* new lockdown value: base[31:26]:victim[25:20]:SBZ[19:1]:p[0]
1055                  * base remains unchanged, victim goes through entries 0 to 63 */
1056                 regs[1] = (Dlockdown & 0xfc000000) | (victim << 20);
1057                 arm9tdmi_write_core_regs(target, 0x2, regs);
1058
1059                 /* set interpret mode */
1060                 cp15c15 |= 0x1;
1061                 arm920t_write_cp15_physical(target, ARM920T_CP15_PHYS_ADDR(0, 0xf, 0), cp15c15);
1062
1063                 /* Write D TLB lockdown */
1064                 arm920t_execute_cp15(target, ARMV4_5_MCR(15,0,0,10,0,0), ARMV4_5_STR(1, 0));
1065
1066                 /* Read D TLB CAM */
1067                 arm920t_execute_cp15(target, ARMV4_5_MCR(15,4,0,15,6,4), ARMV4_5_LDMIA(0, 0x3fc, 0, 0));
1068
1069                 /* clear interpret mode */
1070                 cp15c15 &= ~0x1;
1071                 arm920t_write_cp15_physical(target, 0x1e, cp15c15);
1072
1073                 /* read D TLB CAM content stored to r2-r9 */
1074                 arm9tdmi_read_core_regs(target, 0x3fc, regs_p);
1075                 if ((retval = jtag_execute_queue()) != ERROR_OK)
1076                 {
1077                         return retval;
1078                 }
1079
1080                 for (i = 0; i < 8; i++)
1081                         d_tlb[victim + i].cam = regs[i + 2];
1082         }
1083
1084         for (victim = 0; victim < 64; victim++)
1085         {
1086                 /* new lockdown value: base[31:26]:victim[25:20]:SBZ[19:1]:p[0]
1087                  * base remains unchanged, victim goes through entries 0 to 63 */
1088                 regs[1] = (Dlockdown & 0xfc000000) | (victim << 20);
1089                 arm9tdmi_write_core_regs(target, 0x2, regs);
1090
1091                 /* set interpret mode */
1092                 cp15c15 |= 0x1;
1093                 arm920t_write_cp15_physical(target, ARM920T_CP15_PHYS_ADDR(0, 0xf, 0), cp15c15);
1094
1095                 /* Write D TLB lockdown */
1096                 arm920t_execute_cp15(target, ARMV4_5_MCR(15,0,0,10,0,0), ARMV4_5_STR(1, 0));
1097
1098                 /* Read D TLB RAM1 */
1099                 arm920t_execute_cp15(target, ARMV4_5_MCR(15,4,0,15,10,4), ARMV4_5_LDR(2,0));
1100
1101                 /* Read D TLB RAM2 */
1102                 arm920t_execute_cp15(target, ARMV4_5_MCR(15,4,0,15,2,5), ARMV4_5_LDR(3,0));
1103
1104                 /* clear interpret mode */
1105                 cp15c15 &= ~0x1;
1106                 arm920t_write_cp15_physical(target, 0x1e, cp15c15);
1107
1108                 /* read D TLB RAM content stored to r2 and r3 */
1109                 arm9tdmi_read_core_regs(target, 0xc, regs_p);
1110                 if ((retval = jtag_execute_queue()) != ERROR_OK)
1111                 {
1112                         return retval;
1113                 }
1114
1115                 d_tlb[victim].ram1 = regs[2];
1116                 d_tlb[victim].ram2 = regs[3];
1117         }
1118
1119         /* restore D TLB lockdown */
1120         regs[1] = Dlockdown;
1121         arm9tdmi_write_core_regs(target, 0x2, regs);
1122
1123         /* Write D TLB lockdown */
1124         arm920t_execute_cp15(target, ARMV4_5_MCR(15,0,0,10,0,0), ARMV4_5_STR(1, 0));
1125
1126         /* prepare reading I TLB content
1127          * */
1128
1129         /* set interpret mode */
1130         cp15c15 |= 0x1;
1131         arm920t_write_cp15_physical(target, ARM920T_CP15_PHYS_ADDR(0, 0xf, 0), cp15c15);
1132
1133         /* Read I TLB lockdown */
1134         arm920t_execute_cp15(target, ARMV4_5_MRC(15,0,0,10,0,1), ARMV4_5_LDR(1, 0));
1135
1136         /* clear interpret mode */
1137         cp15c15 &= ~0x1;
1138         arm920t_write_cp15_physical(target, 0x1e, cp15c15);
1139
1140         /* read I TLB lockdown stored to r1 */
1141         arm9tdmi_read_core_regs(target, 0x2, regs_p);
1142         if ((retval = jtag_execute_queue()) != ERROR_OK)
1143         {
1144                 return retval;
1145         }
1146         Ilockdown = regs[1];
1147
1148         for (victim = 0; victim < 64; victim += 8)
1149         {
1150                 /* new lockdown value: base[31:26]:victim[25:20]:SBZ[19:1]:p[0]
1151                  * base remains unchanged, victim goes through entries 0 to 63 */
1152                 regs[1] = (Ilockdown & 0xfc000000) | (victim << 20);
1153                 arm9tdmi_write_core_regs(target, 0x2, regs);
1154
1155                 /* set interpret mode */
1156                 cp15c15 |= 0x1;
1157                 arm920t_write_cp15_physical(target, ARM920T_CP15_PHYS_ADDR(0, 0xf, 0), cp15c15);
1158
1159                 /* Write I TLB lockdown */
1160                 arm920t_execute_cp15(target, ARMV4_5_MCR(15,0,0,10,0,1), ARMV4_5_STR(1, 0));
1161
1162                 /* Read I TLB CAM */
1163                 arm920t_execute_cp15(target, ARMV4_5_MCR(15,4,0,15,5,4), ARMV4_5_LDMIA(0, 0x3fc, 0, 0));
1164
1165                 /* clear interpret mode */
1166                 cp15c15 &= ~0x1;
1167                 arm920t_write_cp15_physical(target, 0x1e, cp15c15);
1168
1169                 /* read I TLB CAM content stored to r2-r9 */
1170                 arm9tdmi_read_core_regs(target, 0x3fc, regs_p);
1171                 if ((retval = jtag_execute_queue()) != ERROR_OK)
1172                 {
1173                         return retval;
1174                 }
1175
1176                 for (i = 0; i < 8; i++)
1177                         i_tlb[i + victim].cam = regs[i + 2];
1178         }
1179
1180         for (victim = 0; victim < 64; victim++)
1181         {
1182                 /* new lockdown value: base[31:26]:victim[25:20]:SBZ[19:1]:p[0]
1183                  * base remains unchanged, victim goes through entries 0 to 63 */
1184                 regs[1] = (Dlockdown & 0xfc000000) | (victim << 20);
1185                 arm9tdmi_write_core_regs(target, 0x2, regs);
1186
1187                 /* set interpret mode */
1188                 cp15c15 |= 0x1;
1189                 arm920t_write_cp15_physical(target, ARM920T_CP15_PHYS_ADDR(0, 0xf, 0), cp15c15);
1190
1191                 /* Write I TLB lockdown */
1192                 arm920t_execute_cp15(target, ARMV4_5_MCR(15,0,0,10,0,1), ARMV4_5_STR(1, 0));
1193
1194                 /* Read I TLB RAM1 */
1195                 arm920t_execute_cp15(target, ARMV4_5_MCR(15,4,0,15,9,4), ARMV4_5_LDR(2,0));
1196
1197                 /* Read I TLB RAM2 */
1198                 arm920t_execute_cp15(target, ARMV4_5_MCR(15,4,0,15,1,5), ARMV4_5_LDR(3,0));
1199
1200                 /* clear interpret mode */
1201                 cp15c15 &= ~0x1;
1202                 arm920t_write_cp15_physical(target, 0x1e, cp15c15);
1203
1204                 /* read I TLB RAM content stored to r2 and r3 */
1205                 arm9tdmi_read_core_regs(target, 0xc, regs_p);
1206                 if ((retval = jtag_execute_queue()) != ERROR_OK)
1207                 {
1208                         return retval;
1209                 }
1210
1211                 i_tlb[victim].ram1 = regs[2];
1212                 i_tlb[victim].ram2 = regs[3];
1213         }
1214
1215         /* restore I TLB lockdown */
1216         regs[1] = Ilockdown;
1217         arm9tdmi_write_core_regs(target, 0x2, regs);
1218
1219         /* Write I TLB lockdown */
1220         arm920t_execute_cp15(target, ARMV4_5_MCR(15,0,0,10,0,1), ARMV4_5_STR(1, 0));
1221
1222         /* restore CP15 MMU and Cache settings */
1223         arm920t_write_cp15_physical(target, ARM920T_CP15_PHYS_ADDR(0, 0x1, 0), cp15_ctrl_saved);
1224
1225         /* output data to file */
1226         fprintf(output, "D TLB content:\n");
1227         for (i = 0; i < 64; i++)
1228         {
1229                 fprintf(output, "%i: 0x%8.8" PRIx32 " 0x%8.8" PRIx32 " 0x%8.8" PRIx32 " %s\n", i, d_tlb[i].cam, d_tlb[i].ram1, d_tlb[i].ram2, (d_tlb[i].cam & 0x20) ? "(valid)" : "(invalid)");
1230         }
1231
1232         fprintf(output, "\n\nI TLB content:\n");
1233         for (i = 0; i < 64; i++)
1234         {
1235                 fprintf(output, "%i: 0x%8.8" PRIx32 " 0x%8.8" PRIx32 " 0x%8.8" PRIx32 " %s\n", i, i_tlb[i].cam, i_tlb[i].ram1, i_tlb[i].ram2, (i_tlb[i].cam & 0x20) ? "(valid)" : "(invalid)");
1236         }
1237
1238         command_print(cmd_ctx, "mmu content successfully output to %s", args[0]);
1239
1240         fclose(output);
1241
1242         if (armv4_5_mode_to_number(armv4_5->core_mode)==-1)
1243                 return ERROR_FAIL;
1244
1245         /* mark registers dirty */
1246         ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 0).dirty = ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 0).valid;
1247         ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 1).dirty = ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 1).valid;
1248         ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 2).dirty = ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 2).valid;
1249         ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 3).dirty = ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 3).valid;
1250         ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 4).dirty = ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 4).valid;
1251         ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 5).dirty = ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 5).valid;
1252         ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 6).dirty = ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 6).valid;
1253         ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 7).dirty = ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 7).valid;
1254         ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 8).dirty = ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 8).valid;
1255         ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 9).dirty = ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 9).valid;
1256
1257         return ERROR_OK;
1258 }
1259 int arm920t_handle_cp15_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc)
1260 {
1261         int retval;
1262         target_t *target = get_current_target(cmd_ctx);
1263         armv4_5_common_t *armv4_5;
1264         arm7_9_common_t *arm7_9;
1265         arm9tdmi_common_t *arm9tdmi;
1266         arm920t_common_t *arm920t;
1267         arm_jtag_t *jtag_info;
1268
1269         if (arm920t_get_arch_pointers(target, &armv4_5, &arm7_9, &arm9tdmi, &arm920t) != ERROR_OK)
1270         {
1271                 command_print(cmd_ctx, "current target isn't an ARM920t target");
1272                 return ERROR_OK;
1273         }
1274
1275         jtag_info = &arm7_9->jtag_info;
1276
1277         if (target->state != TARGET_HALTED)
1278         {
1279                 command_print(cmd_ctx, "target must be stopped for \"%s\" command", cmd);
1280                 return ERROR_OK;
1281         }
1282
1283         /* one or more argument, access a single register (write if second argument is given */
1284         if (argc >= 1)
1285         {
1286                 int address = strtoul(args[0], NULL, 0);
1287
1288                 if (argc == 1)
1289                 {
1290                         uint32_t value;
1291                         if ((retval = arm920t_read_cp15_physical(target, address, &value)) != ERROR_OK)
1292                         {
1293                                 command_print(cmd_ctx, "couldn't access reg %i", address);
1294                                 return ERROR_OK;
1295                         }
1296                         if ((retval = jtag_execute_queue()) != ERROR_OK)
1297                         {
1298                                 return retval;
1299                         }
1300
1301                         command_print(cmd_ctx, "%i: %8.8" PRIx32 "", address, value);
1302                 }
1303                 else if (argc == 2)
1304                 {
1305                         uint32_t value = strtoul(args[1], NULL, 0);
1306                         if ((retval = arm920t_write_cp15_physical(target, address, value)) != ERROR_OK)
1307                         {
1308                                 command_print(cmd_ctx, "couldn't access reg %i", address);
1309                                 return ERROR_OK;
1310                         }
1311                         command_print(cmd_ctx, "%i: %8.8" PRIx32 "", address, value);
1312                 }
1313         }
1314
1315         return ERROR_OK;
1316 }
1317
1318 int arm920t_handle_cp15i_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc)
1319 {
1320         int retval;
1321         target_t *target = get_current_target(cmd_ctx);
1322         armv4_5_common_t *armv4_5;
1323         arm7_9_common_t *arm7_9;
1324         arm9tdmi_common_t *arm9tdmi;
1325         arm920t_common_t *arm920t;
1326         arm_jtag_t *jtag_info;
1327
1328         if (arm920t_get_arch_pointers(target, &armv4_5, &arm7_9, &arm9tdmi, &arm920t) != ERROR_OK)
1329         {
1330                 command_print(cmd_ctx, "current target isn't an ARM920t target");
1331                 return ERROR_OK;
1332         }
1333
1334         jtag_info = &arm7_9->jtag_info;
1335
1336         if (target->state != TARGET_HALTED)
1337         {
1338                 command_print(cmd_ctx, "target must be stopped for \"%s\" command", cmd);
1339                 return ERROR_OK;
1340         }
1341
1342         /* one or more argument, access a single register (write if second argument is given */
1343         if (argc >= 1)
1344         {
1345                 uint32_t opcode = strtoul(args[0], NULL, 0);
1346
1347                 if (argc == 1)
1348                 {
1349                         uint32_t value;
1350                         if ((retval = arm920t_read_cp15_interpreted(target, opcode, 0x0, &value)) != ERROR_OK)
1351                         {
1352                                 command_print(cmd_ctx, "couldn't execute %8.8" PRIx32 "", opcode);
1353                                 return ERROR_OK;
1354                         }
1355
1356                         command_print(cmd_ctx, "%8.8" PRIx32 ": %8.8" PRIx32 "", opcode, value);
1357                 }
1358                 else if (argc == 2)
1359                 {
1360                         uint32_t value = strtoul(args[1], NULL, 0);
1361                         if ((retval = arm920t_write_cp15_interpreted(target, opcode, value, 0)) != ERROR_OK)
1362                         {
1363                                 command_print(cmd_ctx, "couldn't execute %8.8" PRIx32 "", opcode);
1364                                 return ERROR_OK;
1365                         }
1366                         command_print(cmd_ctx, "%8.8" PRIx32 ": %8.8" PRIx32 "", opcode, value);
1367                 }
1368                 else if (argc == 3)
1369                 {
1370                         uint32_t value = strtoul(args[1], NULL, 0);
1371                         uint32_t address = strtoul(args[2], NULL, 0);
1372                         if ((retval = arm920t_write_cp15_interpreted(target, opcode, value, address)) != ERROR_OK)
1373                         {
1374                                 command_print(cmd_ctx, "couldn't execute %8.8" PRIx32 "", opcode);
1375                                 return ERROR_OK;
1376                         }
1377                         command_print(cmd_ctx, "%8.8" PRIx32 ": %8.8" PRIx32 " %8.8" PRIx32 "", opcode, value, address);
1378                 }
1379         }
1380         else
1381         {
1382                 command_print(cmd_ctx, "usage: arm920t cp15i <opcode> [value] [address]");
1383         }
1384
1385         return ERROR_OK;
1386 }
1387
1388 int arm920t_handle_cache_info_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc)
1389 {
1390         target_t *target = get_current_target(cmd_ctx);
1391         armv4_5_common_t *armv4_5;
1392         arm7_9_common_t *arm7_9;
1393         arm9tdmi_common_t *arm9tdmi;
1394         arm920t_common_t *arm920t;
1395
1396         if (arm920t_get_arch_pointers(target, &armv4_5, &arm7_9, &arm9tdmi, &arm920t) != ERROR_OK)
1397         {
1398                 command_print(cmd_ctx, "current target isn't an ARM920t target");
1399                 return ERROR_OK;
1400         }
1401
1402         return armv4_5_handle_cache_info_command(cmd_ctx, &arm920t->armv4_5_mmu.armv4_5_cache);
1403 }
1404
1405 int arm920t_handle_virt2phys_command(command_context_t *cmd_ctx, char *cmd, char **args, int argc)
1406 {
1407         target_t *target = get_current_target(cmd_ctx);
1408         armv4_5_common_t *armv4_5;
1409         arm7_9_common_t *arm7_9;
1410         arm9tdmi_common_t *arm9tdmi;
1411         arm920t_common_t *arm920t;
1412         arm_jtag_t *jtag_info;
1413
1414         if (arm920t_get_arch_pointers(target, &armv4_5, &arm7_9, &arm9tdmi, &arm920t) != ERROR_OK)
1415         {
1416                 command_print(cmd_ctx, "current target isn't an ARM920t target");
1417                 return ERROR_OK;
1418         }
1419
1420         jtag_info = &arm7_9->jtag_info;
1421
1422         if (target->state != TARGET_HALTED)
1423         {
1424                 command_print(cmd_ctx, "target must be stopped for \"%s\" command", cmd);
1425                 return ERROR_OK;
1426         }
1427
1428         return armv4_5_mmu_handle_virt2phys_command(cmd_ctx, cmd, args, argc, target, &arm920t->armv4_5_mmu);
1429 }
1430
1431 int arm920t_handle_md_phys_command(command_context_t *cmd_ctx, char *cmd, char **args, int argc)
1432 {
1433         target_t *target = get_current_target(cmd_ctx);
1434         armv4_5_common_t *armv4_5;
1435         arm7_9_common_t *arm7_9;
1436         arm9tdmi_common_t *arm9tdmi;
1437         arm920t_common_t *arm920t;
1438         arm_jtag_t *jtag_info;
1439
1440         if (arm920t_get_arch_pointers(target, &armv4_5, &arm7_9, &arm9tdmi, &arm920t) != ERROR_OK)
1441         {
1442                 command_print(cmd_ctx, "current target isn't an ARM920t target");
1443                 return ERROR_OK;
1444         }
1445
1446         jtag_info = &arm7_9->jtag_info;
1447
1448         if (target->state != TARGET_HALTED)
1449         {
1450                 command_print(cmd_ctx, "target must be stopped for \"%s\" command", cmd);
1451                 return ERROR_OK;
1452         }
1453
1454         return armv4_5_mmu_handle_md_phys_command(cmd_ctx, cmd, args, argc, target, &arm920t->armv4_5_mmu);
1455 }
1456
1457 int arm920t_handle_mw_phys_command(command_context_t *cmd_ctx, char *cmd, char **args, int argc)
1458 {
1459         target_t *target = get_current_target(cmd_ctx);
1460         armv4_5_common_t *armv4_5;
1461         arm7_9_common_t *arm7_9;
1462         arm9tdmi_common_t *arm9tdmi;
1463         arm920t_common_t *arm920t;
1464         arm_jtag_t *jtag_info;
1465
1466         if (arm920t_get_arch_pointers(target, &armv4_5, &arm7_9, &arm9tdmi, &arm920t) != ERROR_OK)
1467         {
1468                 command_print(cmd_ctx, "current target isn't an ARM920t target");
1469                 return ERROR_OK;
1470         }
1471
1472         jtag_info = &arm7_9->jtag_info;
1473
1474         if (target->state != TARGET_HALTED)
1475         {
1476                 command_print(cmd_ctx, "target must be stopped for \"%s\" command", cmd);
1477                 return ERROR_OK;
1478         }
1479
1480         return armv4_5_mmu_handle_mw_phys_command(cmd_ctx, cmd, args, argc, target, &arm920t->armv4_5_mmu);
1481 }