?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
arm: add error propagation to generic get_ttb fn
[openocd/cortex.git] / src / target / arm920t.c
blob9c11d124f45970930febaa599caaf295142f5ff4
1
2 /***************************************************************************
3 * Copyright (C) 2005 by Dominic Rath *
4 * Dominic.Rath@gmx.de *
5 * *
6 * This program is free software; you can redistribute it and/or modify *
7 * it under the terms of the GNU General Public License as published by *
8 * the Free Software Foundation; either version 2 of the License, or *
9 * (at your option) any later version. *
10 * *
11 * This program is distributed in the hope that it will be useful, *
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
14 * GNU General Public License for more details. *
15 * *
16 * You should have received a copy of the GNU General Public License *
17 * along with this program; if not, write to the *
18 * Free Software Foundation, Inc., *
19 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
20 ***************************************************************************/
21 #ifdef HAVE_CONFIG_H
22 #include "config.h"
23 #endif
24
25 #include "arm920t.h"
26 #include <helper/time_support.h>
27 #include "target_type.h"
28 #include "register.h"
29 #include "arm_opcodes.h"
30
31
32 /*
33 * For information about the ARM920T, see ARM DDI 0151C especially
34 * Chapter 9 about debug support, which shows how to manipulate each
35 * of the different scan chains:
36 *
37 * 0 ... ARM920 signals, e.g. to rest of SOC (unused here)
38 * 1 ... debugging; watchpoint and breakpoint status, etc; also
39 * MMU and cache access in conjunction with scan chain 15
40 * 2 ... EmbeddedICE
41 * 3 ... external boundary scan (SoC-specific, unused here)
42 * 4 ... access to cache tag RAM
43 * 6 ... ETM9
44 * 15 ... access coprocessor 15, "physical" or "interpreted" modes
45 * "interpreted" works with a few actual MRC/MCR instructions
46 * "physical" provides register-like behaviors. Section 9.6.7
47 * covers these details.
48 *
49 * The ARM922T is similar, but with smaller caches (8K each, vs 16K).
50 */
51
52 #if 0
53 #define _DEBUG_INSTRUCTION_EXECUTION_
54 #endif
55
56 /* Table 9-8 shows scan chain 15 format during physical access mode, using a
57 * dedicated 6-bit address space (encoded in bits 33:38). Writes use one
58 * JTAG scan, while reads use two.
59 *
60 * Table 9-9 lists the thirteen registers which support physical access.
61 * ARM920T_CP15_PHYS_ADDR() constructs the 6-bit reg_addr parameter passed
62 * to arm920t_read_cp15_physical() and arm920t_write_cp15_physical().
63 *
64 * x == bit[38]
65 * y == bits[37:34]
66 * z == bit[33]
67 */
68 #define ARM920T_CP15_PHYS_ADDR(x, y, z) ((x << 5) | (y << 1) << (z))
69
70 /* Registers supporting physical Read access (from table 9-9) */
71 #define CP15PHYS_CACHETYPE ARM920T_CP15_PHYS_ADDR(0, 0x0, 1)
72 #define CP15PHYS_ICACHE_IDX ARM920T_CP15_PHYS_ADDR(1, 0xd, 1)
73 #define CP15PHYS_DCACHE_IDX ARM920T_CP15_PHYS_ADDR(1, 0xe, 1)
74 /* NOTE: several more registers support only physical read access */
75
76 /* Registers supporting physical Read/Write access (from table 9-9) */
77 #define CP15PHYS_CTRL ARM920T_CP15_PHYS_ADDR(0, 0x1, 0)
78 #define CP15PHYS_PID ARM920T_CP15_PHYS_ADDR(0, 0xd, 0)
79 #define CP15PHYS_TESTSTATE ARM920T_CP15_PHYS_ADDR(0, 0xf, 0)
80 #define CP15PHYS_ICACHE ARM920T_CP15_PHYS_ADDR(1, 0x1, 1)
81 #define CP15PHYS_DCACHE ARM920T_CP15_PHYS_ADDR(1, 0x2, 1)
82
83 static int arm920t_read_cp15_physical(struct target *target,
84 int reg_addr, uint32_t *value)
85 {
86 struct arm920t_common *arm920t = target_to_arm920(target);
87 struct arm_jtag *jtag_info;
88 struct scan_field fields[4];
89 uint8_t access_type_buf = 1;
90 uint8_t reg_addr_buf = reg_addr & 0x3f;
91 uint8_t nr_w_buf = 0;
92
93 jtag_info = &arm920t->arm7_9_common.jtag_info;
94
95 arm_jtag_scann(jtag_info, 0xf, TAP_IDLE);
96 arm_jtag_set_instr(jtag_info, jtag_info->intest_instr, NULL, TAP_IDLE);
97
98 fields[0].num_bits = 1;
99 fields[0].out_value = &access_type_buf;
100 fields[0].in_value = NULL;
101
102 fields[1].num_bits = 32;
103 fields[1].out_value = NULL;
104 fields[1].in_value = NULL;
105
106 fields[2].num_bits = 6;
107 fields[2].out_value = &reg_addr_buf;
108 fields[2].in_value = NULL;
109
110 fields[3].num_bits = 1;
111 fields[3].out_value = &nr_w_buf;
112 fields[3].in_value = NULL;
113
114 jtag_add_dr_scan(jtag_info->tap, 4, fields, TAP_IDLE);
115
116 fields[1].in_value = (uint8_t *)value;
117
118 jtag_add_dr_scan(jtag_info->tap, 4, fields, TAP_IDLE);
119
120 jtag_add_callback(arm_le_to_h_u32, (jtag_callback_data_t)value);
121
122 #ifdef _DEBUG_INSTRUCTION_EXECUTION_
123 jtag_execute_queue();
124 LOG_DEBUG("addr: 0x%x value: %8.8x", reg_addr, *value);
125 #endif
126
127 return ERROR_OK;
128 }
129
130 static int arm920t_write_cp15_physical(struct target *target,
131 int reg_addr, uint32_t value)
132 {
133 struct arm920t_common *arm920t = target_to_arm920(target);
134 struct arm_jtag *jtag_info;
135 struct scan_field fields[4];
136 uint8_t access_type_buf = 1;
137 uint8_t reg_addr_buf = reg_addr & 0x3f;
138 uint8_t nr_w_buf = 1;
139 uint8_t value_buf[4];
140
141 jtag_info = &arm920t->arm7_9_common.jtag_info;
142
143 buf_set_u32(value_buf, 0, 32, value);
144
145 arm_jtag_scann(jtag_info, 0xf, TAP_IDLE);
146 arm_jtag_set_instr(jtag_info, jtag_info->intest_instr, NULL, TAP_IDLE);
147
148 fields[0].num_bits = 1;
149 fields[0].out_value = &access_type_buf;
150 fields[0].in_value = NULL;
151
152 fields[1].num_bits = 32;
153 fields[1].out_value = value_buf;
154 fields[1].in_value = NULL;
155
156 fields[2].num_bits = 6;
157 fields[2].out_value = &reg_addr_buf;
158 fields[2].in_value = NULL;
159
160 fields[3].num_bits = 1;
161 fields[3].out_value = &nr_w_buf;
162 fields[3].in_value = NULL;
163
164 jtag_add_dr_scan(jtag_info->tap, 4, fields, TAP_IDLE);
165
166 #ifdef _DEBUG_INSTRUCTION_EXECUTION_
167 LOG_DEBUG("addr: 0x%x value: %8.8x", reg_addr, value);
168 #endif
169
170 return ERROR_OK;
171 }
172
173 /* See table 9-10 for scan chain 15 format during interpreted access mode.
174 * If the TESTSTATE register is set for interpreted access, certain CP15
175 * MRC and MCR instructions may be executed through scan chain 15.
176 *
177 * Tables 9-11, 9-12, and 9-13 show which MRC and MCR instructions can be
178 * executed using scan chain 15 interpreted mode.
179 */
180 static int arm920t_execute_cp15(struct target *target, uint32_t cp15_opcode,
181 uint32_t arm_opcode)
182 {
183 int retval;
184 struct arm920t_common *arm920t = target_to_arm920(target);
185 struct arm_jtag *jtag_info;
186 struct scan_field fields[4];
187 uint8_t access_type_buf = 0; /* interpreted access */
188 uint8_t reg_addr_buf = 0x0;
189 uint8_t nr_w_buf = 0;
190 uint8_t cp15_opcode_buf[4];
191
192 jtag_info = &arm920t->arm7_9_common.jtag_info;
193
194 arm_jtag_scann(jtag_info, 0xf, TAP_IDLE);
195 arm_jtag_set_instr(jtag_info, jtag_info->intest_instr, NULL, TAP_IDLE);
196
197 buf_set_u32(cp15_opcode_buf, 0, 32, cp15_opcode);
198
199 fields[0].num_bits = 1;
200 fields[0].out_value = &access_type_buf;
201 fields[0].in_value = NULL;
202
203 fields[1].num_bits = 32;
204 fields[1].out_value = cp15_opcode_buf;
205 fields[1].in_value = NULL;
206
207 fields[2].num_bits = 6;
208 fields[2].out_value = &reg_addr_buf;
209 fields[2].in_value = NULL;
210
211 fields[3].num_bits = 1;
212 fields[3].out_value = &nr_w_buf;
213 fields[3].in_value = NULL;
214
215 jtag_add_dr_scan(jtag_info->tap, 4, fields, TAP_IDLE);
216
217 arm9tdmi_clock_out(jtag_info, arm_opcode, 0, NULL, 0);
218 arm9tdmi_clock_out(jtag_info, ARMV4_5_NOP, 0, NULL, 1);
219 retval = arm7_9_execute_sys_speed(target);
220 if (retval != ERROR_OK)
221 return retval;
222
223 if ((retval = jtag_execute_queue()) != ERROR_OK)
224 {
225 LOG_ERROR("failed executing JTAG queue");
226 return retval;
227 }
228
229 return ERROR_OK;
230 }
231
232 static int arm920t_read_cp15_interpreted(struct target *target,
233 uint32_t cp15_opcode, uint32_t address, uint32_t *value)
234 {
235 struct arm *armv4_5 = target_to_arm(target);
236 uint32_t* regs_p[1];
237 uint32_t regs[2];
238 uint32_t cp15c15 = 0x0;
239 struct reg *r = armv4_5->core_cache->reg_list;
240
241 /* load address into R1 */
242 regs[1] = address;
243 arm9tdmi_write_core_regs(target, 0x2, regs);
244
245 /* read-modify-write CP15 test state register
246 * to enable interpreted access mode */
247 arm920t_read_cp15_physical(target, CP15PHYS_TESTSTATE, &cp15c15);
248 jtag_execute_queue();
249 cp15c15 |= 1; /* set interpret mode */
250 arm920t_write_cp15_physical(target, CP15PHYS_TESTSTATE, cp15c15);
251
252 /* execute CP15 instruction and ARM load (reading from coprocessor) */
253 arm920t_execute_cp15(target, cp15_opcode, ARMV4_5_LDR(0, 1));
254
255 /* disable interpreted access mode */
256 cp15c15 &= ~1U; /* clear interpret mode */
257 arm920t_write_cp15_physical(target, CP15PHYS_TESTSTATE, cp15c15);
258
259 /* retrieve value from R0 */
260 regs_p[0] = value;
261 arm9tdmi_read_core_regs(target, 0x1, regs_p);
262 jtag_execute_queue();
263
264 #ifdef _DEBUG_INSTRUCTION_EXECUTION_
265 LOG_DEBUG("cp15_opcode: %8.8x, address: %8.8x, value: %8.8x",
266 cp15_opcode, address, *value);
267 #endif
268
269 if (!is_arm_mode(armv4_5->core_mode))
270 return ERROR_FAIL;
271
272 r[0].dirty = 1;
273 r[1].dirty = 1;
274
275 return ERROR_OK;
276 }
277
278 static
279 int arm920t_write_cp15_interpreted(struct target *target,
280 uint32_t cp15_opcode, uint32_t value, uint32_t address)
281 {
282 uint32_t cp15c15 = 0x0;
283 struct arm *armv4_5 = target_to_arm(target);
284 uint32_t regs[2];
285 struct reg *r = armv4_5->core_cache->reg_list;
286
287 /* load value, address into R0, R1 */
288 regs[0] = value;
289 regs[1] = address;
290 arm9tdmi_write_core_regs(target, 0x3, regs);
291
292 /* read-modify-write CP15 test state register
293 * to enable interpreted access mode */
294 arm920t_read_cp15_physical(target, CP15PHYS_TESTSTATE, &cp15c15);
295 jtag_execute_queue();
296 cp15c15 |= 1; /* set interpret mode */
297 arm920t_write_cp15_physical(target, CP15PHYS_TESTSTATE, cp15c15);
298
299 /* execute CP15 instruction and ARM store (writing to coprocessor) */
300 arm920t_execute_cp15(target, cp15_opcode, ARMV4_5_STR(0, 1));
301
302 /* disable interpreted access mode */
303 cp15c15 &= ~1U; /* set interpret mode */
304 arm920t_write_cp15_physical(target, CP15PHYS_TESTSTATE, cp15c15);
305
306 #ifdef _DEBUG_INSTRUCTION_EXECUTION_
307 LOG_DEBUG("cp15_opcode: %8.8x, value: %8.8x, address: %8.8x",
308 cp15_opcode, value, address);
309 #endif
310
311 if (!is_arm_mode(armv4_5->core_mode))
312 return ERROR_FAIL;
313
314 r[0].dirty = 1;
315 r[1].dirty = 1;
316
317 return ERROR_OK;
318 }
319
320 // EXPORTED to FA256
321 int arm920t_get_ttb(struct target *target, uint32_t *result)
322 {
323 int retval;
324 uint32_t ttb = 0x0;
325
326 if ((retval = arm920t_read_cp15_interpreted(target,
327 /* FIXME use opcode macro */
328 0xeebf0f51, 0x0, &ttb)) != ERROR_OK)
329 return retval;
330
331 *result = ttb;
332 return ERROR_OK;
333 }
334
335 // EXPORTED to FA256
336 void arm920t_disable_mmu_caches(struct target *target, int mmu,
337 int d_u_cache, int i_cache)
338 {
339 uint32_t cp15_control;
340
341 /* read cp15 control register */
342 arm920t_read_cp15_physical(target, CP15PHYS_CTRL, &cp15_control);
343 jtag_execute_queue();
344
345 if (mmu)
346 cp15_control &= ~0x1U;
347
348 if (d_u_cache)
349 cp15_control &= ~0x4U;
350
351 if (i_cache)
352 cp15_control &= ~0x1000U;
353
354 arm920t_write_cp15_physical(target, CP15PHYS_CTRL, cp15_control);
355 }
356
357 // EXPORTED to FA256
358 void arm920t_enable_mmu_caches(struct target *target, int mmu,
359 int d_u_cache, int i_cache)
360 {
361 uint32_t cp15_control;
362
363 /* read cp15 control register */
364 arm920t_read_cp15_physical(target, CP15PHYS_CTRL, &cp15_control);
365 jtag_execute_queue();
366
367 if (mmu)
368 cp15_control |= 0x1U;
369
370 if (d_u_cache)
371 cp15_control |= 0x4U;
372
373 if (i_cache)
374 cp15_control |= 0x1000U;
375
376 arm920t_write_cp15_physical(target, CP15PHYS_CTRL, cp15_control);
377 }
378
379 // EXPORTED to FA256
380 void arm920t_post_debug_entry(struct target *target)
381 {
382 uint32_t cp15c15;
383 struct arm920t_common *arm920t = target_to_arm920(target);
384
385 /* examine cp15 control reg */
386 arm920t_read_cp15_physical(target,
387 CP15PHYS_CTRL, &arm920t->cp15_control_reg);
388 jtag_execute_queue();
389 LOG_DEBUG("cp15_control_reg: %8.8" PRIx32, arm920t->cp15_control_reg);
390
391 if (arm920t->armv4_5_mmu.armv4_5_cache.ctype == -1)
392 {
393 uint32_t cache_type_reg;
394 /* identify caches */
395 arm920t_read_cp15_physical(target,
396 CP15PHYS_CACHETYPE, &cache_type_reg);
397 jtag_execute_queue();
398 armv4_5_identify_cache(cache_type_reg,
399 &arm920t->armv4_5_mmu.armv4_5_cache);
400 }
401
402 arm920t->armv4_5_mmu.mmu_enabled =
403 (arm920t->cp15_control_reg & 0x1U) ? 1 : 0;
404 arm920t->armv4_5_mmu.armv4_5_cache.d_u_cache_enabled =
405 (arm920t->cp15_control_reg & 0x4U) ? 1 : 0;
406 arm920t->armv4_5_mmu.armv4_5_cache.i_cache_enabled =
407 (arm920t->cp15_control_reg & 0x1000U) ? 1 : 0;
408
409 /* save i/d fault status and address register */
410 /* FIXME use opcode macros */
411 arm920t_read_cp15_interpreted(target, 0xee150f10, 0x0, &arm920t->d_fsr);
412 arm920t_read_cp15_interpreted(target, 0xee150f30, 0x0, &arm920t->i_fsr);
413 arm920t_read_cp15_interpreted(target, 0xee160f10, 0x0, &arm920t->d_far);
414 arm920t_read_cp15_interpreted(target, 0xee160f30, 0x0, &arm920t->i_far);
415
416 LOG_DEBUG("D FSR: 0x%8.8" PRIx32 ", D FAR: 0x%8.8" PRIx32
417 ", I FSR: 0x%8.8" PRIx32 ", I FAR: 0x%8.8" PRIx32,
418 arm920t->d_fsr, arm920t->d_far, arm920t->i_fsr, arm920t->i_far);
419
420 if (arm920t->preserve_cache)
421 {
422 /* read-modify-write CP15 test state register
423 * to disable I/D-cache linefills */
424 arm920t_read_cp15_physical(target,
425 CP15PHYS_TESTSTATE, &cp15c15);
426 jtag_execute_queue();
427 cp15c15 |= 0x600;
428 arm920t_write_cp15_physical(target,
429 CP15PHYS_TESTSTATE, cp15c15);
430 }
431 }
432
433 // EXPORTED to FA256
434 void arm920t_pre_restore_context(struct target *target)
435 {
436 uint32_t cp15c15;
437 struct arm920t_common *arm920t = target_to_arm920(target);
438
439 /* restore i/d fault status and address register */
440 arm920t_write_cp15_interpreted(target, 0xee050f10, arm920t->d_fsr, 0x0);
441 arm920t_write_cp15_interpreted(target, 0xee050f30, arm920t->i_fsr, 0x0);
442 arm920t_write_cp15_interpreted(target, 0xee060f10, arm920t->d_far, 0x0);
443 arm920t_write_cp15_interpreted(target, 0xee060f30, arm920t->i_far, 0x0);
444
445 /* read-modify-write CP15 test state register
446 * to reenable I/D-cache linefills */
447 if (arm920t->preserve_cache)
448 {
449 arm920t_read_cp15_physical(target,
450 CP15PHYS_TESTSTATE, &cp15c15);
451 jtag_execute_queue();
452 cp15c15 &= ~0x600U;
453 arm920t_write_cp15_physical(target,
454 CP15PHYS_TESTSTATE, cp15c15);
455 }
456 }
457
458 static const char arm920_not[] = "target is not an ARM920";
459
460 static int arm920t_verify_pointer(struct command_context *cmd_ctx,
461 struct arm920t_common *arm920t)
462 {
463 if (arm920t->common_magic != ARM920T_COMMON_MAGIC) {
464 command_print(cmd_ctx, arm920_not);
465 return ERROR_TARGET_INVALID;
466 }
467
468 return ERROR_OK;
469 }
470
471 /** Logs summary of ARM920 state for a halted target. */
472 int arm920t_arch_state(struct target *target)
473 {
474 static const char *state[] =
475 {
476 "disabled", "enabled"
477 };
478
479 struct arm920t_common *arm920t = target_to_arm920(target);
480 struct arm *armv4_5;
481
482 if (arm920t->common_magic != ARM920T_COMMON_MAGIC)
483 {
484 LOG_ERROR("BUG: %s", arm920_not);
485 return ERROR_TARGET_INVALID;
486 }
487
488 armv4_5 = &arm920t->arm7_9_common.armv4_5_common;
489
490 arm_arch_state(target);
491 LOG_USER("MMU: %s, D-Cache: %s, I-Cache: %s",
492 state[arm920t->armv4_5_mmu.mmu_enabled],
493 state[arm920t->armv4_5_mmu.armv4_5_cache.d_u_cache_enabled],
494 state[arm920t->armv4_5_mmu.armv4_5_cache.i_cache_enabled]);
495
496 return ERROR_OK;
497 }
498
499 static int arm920_mmu(struct target *target, int *enabled)
500 {
501 if (target->state != TARGET_HALTED) {
502 LOG_ERROR("%s: target not halted", __func__);
503 return ERROR_TARGET_INVALID;
504 }
505
506 *enabled = target_to_arm920(target)->armv4_5_mmu.mmu_enabled;
507 return ERROR_OK;
508 }
509
510 static int arm920_virt2phys(struct target *target,
511 uint32_t virt, uint32_t *phys)
512 {
513 uint32_t cb;
514 struct arm920t_common *arm920t = target_to_arm920(target);
515
516 uint32_t ret;
517 int retval = armv4_5_mmu_translate_va(target,
518 &arm920t->armv4_5_mmu, virt, &cb, &ret);
519 if (retval != ERROR_OK)
520 return retval;
521 *phys = ret;
522 return ERROR_OK;
523 }
524
525 /** Reads a buffer, in the specified word size, with current MMU settings. */
526 int arm920t_read_memory(struct target *target, uint32_t address,
527 uint32_t size, uint32_t count, uint8_t *buffer)
528 {
529 int retval;
530
531 retval = arm7_9_read_memory(target, address, size, count, buffer);
532
533 return retval;
534 }
535
536
537 static int arm920t_read_phys_memory(struct target *target,
538 uint32_t address, uint32_t size,
539 uint32_t count, uint8_t *buffer)
540 {
541 struct arm920t_common *arm920t = target_to_arm920(target);
542
543 return armv4_5_mmu_read_physical(target, &arm920t->armv4_5_mmu,
544 address, size, count, buffer);
545 }
546
547 static int arm920t_write_phys_memory(struct target *target,
548 uint32_t address, uint32_t size,
549 uint32_t count, uint8_t *buffer)
550 {
551 struct arm920t_common *arm920t = target_to_arm920(target);
552
553 return armv4_5_mmu_write_physical(target, &arm920t->armv4_5_mmu,
554 address, size, count, buffer);
555 }
556
557
558 /** Writes a buffer, in the specified word size, with current MMU settings. */
559 int arm920t_write_memory(struct target *target, uint32_t address,
560 uint32_t size, uint32_t count, uint8_t *buffer)
561 {
562 int retval;
563 const uint32_t cache_mask = ~0x1f; /* cache line size : 32 byte */
564 struct arm920t_common *arm920t = target_to_arm920(target);
565
566 /* FIX!!!! this should be cleaned up and made much more general. The
567 * plan is to write up and test on arm920t specifically and
568 * then generalize and clean up afterwards.
569 *
570 * Also it should be moved to the callbacks that handle breakpoints
571 * specifically and not the generic memory write fn's. See XScale code.
572 */
573 if (arm920t->armv4_5_mmu.mmu_enabled && (count == 1) &&
574 ((size==2) || (size==4)))
575 {
576 /* special case the handling of single word writes to
577 * bypass MMU, to allow implementation of breakpoints
578 * in memory marked read only
579 * by MMU
580 */
581 uint32_t cb;
582 uint32_t pa;
583
584 /*
585 * We need physical address and cb
586 */
587 retval = armv4_5_mmu_translate_va(target, &arm920t->armv4_5_mmu,
588 address, &cb, &pa);
589 if (retval != ERROR_OK)
590 return retval;
591
592 if (arm920t->armv4_5_mmu.armv4_5_cache.d_u_cache_enabled)
593 {
594 if (cb & 0x1)
595 {
596 LOG_DEBUG("D-Cache buffered, "
597 "drain write buffer");
598 /*
599 * Buffered ?
600 * Drain write buffer - MCR p15,0,Rd,c7,c10,4
601 */
602
603 retval = arm920t_write_cp15_interpreted(target,
604 ARMV4_5_MCR(15, 0, 0, 7, 10, 4),
605 0x0, 0);
606 if (retval != ERROR_OK)
607 return retval;
608 }
609
610 if (cb == 0x3)
611 {
612 /*
613 * Write back memory ? -> clean cache
614 *
615 * There is no way to clean cache lines using
616 * cp15 scan chain, so copy the full cache
617 * line from cache to physical memory.
618 */
619 uint8_t data[32];
620
621 LOG_DEBUG("D-Cache in 'write back' mode, "
622 "flush cache line");
623
624 retval = target_read_memory(target,
625 address & cache_mask, 1,
626 sizeof(data), &data[0]);
627 if (retval != ERROR_OK)
628 return retval;
629
630 retval = armv4_5_mmu_write_physical(target,
631 &arm920t->armv4_5_mmu,
632 pa & cache_mask, 1,
633 sizeof(data), &data[0]);
634 if (retval != ERROR_OK)
635 return retval;
636 }
637
638 /* Cached ? */
639 if (cb & 0x2)
640 {
641 /*
642 * Cached ? -> Invalidate data cache using MVA
643 *
644 * MCR p15,0,Rd,c7,c6,1
645 */
646 LOG_DEBUG("D-Cache enabled, "
647 "invalidate cache line");
648
649 retval = arm920t_write_cp15_interpreted(target,
650 ARMV4_5_MCR(15, 0, 0, 7, 6, 1), 0x0,
651 address & cache_mask);
652 if (retval != ERROR_OK)
653 return retval;
654 }
655 }
656
657 /* write directly to physical memory,
658 * bypassing any read only MMU bits, etc.
659 */
660 retval = armv4_5_mmu_write_physical(target,
661 &arm920t->armv4_5_mmu, pa, size,
662 count, buffer);
663 if (retval != ERROR_OK)
664 return retval;
665 } else
666 {
667 if ((retval = arm7_9_write_memory(target, address,
668 size, count, buffer)) != ERROR_OK)
669 return retval;
670 }
671
672 /* If ICache is enabled, we have to invalidate affected ICache lines
673 * the DCache is forced to write-through,
674 * so we don't have to clean it here
675 */
676 if (arm920t->armv4_5_mmu.armv4_5_cache.i_cache_enabled)
677 {
678 if (count <= 1)
679 {
680 /* invalidate ICache single entry with MVA
681 * mcr 15, 0, r0, cr7, cr5, {1}
682 */
683 LOG_DEBUG("I-Cache enabled, "
684 "invalidating affected I-Cache line");
685 retval = arm920t_write_cp15_interpreted(target,
686 ARMV4_5_MCR(15, 0, 0, 7, 5, 1),
687 0x0, address & cache_mask);
688 if (retval != ERROR_OK)
689 return retval;
690 }
691 else
692 {
693 /* invalidate ICache
694 * mcr 15, 0, r0, cr7, cr5, {0}
695 */
696 retval = arm920t_write_cp15_interpreted(target,
697 ARMV4_5_MCR(15, 0, 0, 7, 5, 0),
698 0x0, 0x0);
699 if (retval != ERROR_OK)
700 return retval;
701 }
702 }
703
704 return ERROR_OK;
705 }
706
707 // EXPORTED to FA256
708 int arm920t_soft_reset_halt(struct target *target)
709 {
710 int retval = ERROR_OK;
711 struct arm920t_common *arm920t = target_to_arm920(target);
712 struct arm7_9_common *arm7_9 = target_to_arm7_9(target);
713 struct arm *armv4_5 = &arm7_9->armv4_5_common;
714 struct reg *dbg_stat = &arm7_9->eice_cache->reg_list[EICE_DBG_STAT];
715
716 if ((retval = target_halt(target)) != ERROR_OK)
717 {
718 return retval;
719 }
720
721 long long then = timeval_ms();
722 int timeout;
723 while (!(timeout = ((timeval_ms()-then) > 1000)))
724 {
725 if (buf_get_u32(dbg_stat->value, EICE_DBG_STATUS_DBGACK, 1)
726 == 0)
727 {
728 embeddedice_read_reg(dbg_stat);
729 if ((retval = jtag_execute_queue()) != ERROR_OK)
730 {
731 return retval;
732 }
733 } else
734 {
735 break;
736 }
737 if (debug_level >= 3)
738 {
739 /* do not eat all CPU, time out after 1 se*/
740 alive_sleep(100);
741 } else
742 {
743 keep_alive();
744 }
745 }
746 if (timeout)
747 {
748 LOG_ERROR("Failed to halt CPU after 1 sec");
749 return ERROR_TARGET_TIMEOUT;
750 }
751
752 target->state = TARGET_HALTED;
753
754 /* SVC, ARM state, IRQ and FIQ disabled */
755 uint32_t cpsr;
756
757 cpsr = buf_get_u32(armv4_5->cpsr->value, 0, 32);
758 cpsr &= ~0xff;
759 cpsr |= 0xd3;
760 arm_set_cpsr(armv4_5, cpsr);
761 armv4_5->cpsr->dirty = 1;
762
763 /* start fetching from 0x0 */
764 buf_set_u32(armv4_5->pc->value, 0, 32, 0x0);
765 armv4_5->pc->dirty = 1;
766 armv4_5->pc->valid = 1;
767
768 arm920t_disable_mmu_caches(target, 1, 1, 1);
769 arm920t->armv4_5_mmu.mmu_enabled = 0;
770 arm920t->armv4_5_mmu.armv4_5_cache.d_u_cache_enabled = 0;
771 arm920t->armv4_5_mmu.armv4_5_cache.i_cache_enabled = 0;
772
773 return target_call_event_callbacks(target, TARGET_EVENT_HALTED);
774 }
775
776 /* FIXME remove forward decls */
777 static int arm920t_mrc(struct target *target, int cpnum,
778 uint32_t op1, uint32_t op2,
779 uint32_t CRn, uint32_t CRm,
780 uint32_t *value);
781 static int arm920t_mcr(struct target *target, int cpnum,
782 uint32_t op1, uint32_t op2,
783 uint32_t CRn, uint32_t CRm,
784 uint32_t value);
785
786 static int arm920t_init_arch_info(struct target *target,
787 struct arm920t_common *arm920t, struct jtag_tap *tap)
788 {
789 struct arm7_9_common *arm7_9 = &arm920t->arm7_9_common;
790
791 arm7_9->armv4_5_common.mrc = arm920t_mrc;
792 arm7_9->armv4_5_common.mcr = arm920t_mcr;
793
794 /* initialize arm7/arm9 specific info (including armv4_5) */
795 arm9tdmi_init_arch_info(target, arm7_9, tap);
796
797 arm920t->common_magic = ARM920T_COMMON_MAGIC;
798
799 arm7_9->post_debug_entry = arm920t_post_debug_entry;
800 arm7_9->pre_restore_context = arm920t_pre_restore_context;
801
802 arm920t->armv4_5_mmu.armv4_5_cache.ctype = -1;
803 arm920t->armv4_5_mmu.get_ttb = arm920t_get_ttb;
804 arm920t->armv4_5_mmu.read_memory = arm7_9_read_memory;
805 arm920t->armv4_5_mmu.write_memory = arm7_9_write_memory;
806 arm920t->armv4_5_mmu.disable_mmu_caches = arm920t_disable_mmu_caches;
807 arm920t->armv4_5_mmu.enable_mmu_caches = arm920t_enable_mmu_caches;
808 arm920t->armv4_5_mmu.has_tiny_pages = 1;
809 arm920t->armv4_5_mmu.mmu_enabled = 0;
810
811 /* disabling linefills leads to lockups, so keep them enabled for now
812 * this doesn't affect correctness, but might affect timing issues, if
813 * important data is evicted from the cache during the debug session
814 * */
815 arm920t->preserve_cache = 0;
816
817 /* override hw single-step capability from ARM9TDMI */
818 arm7_9->has_single_step = 1;
819
820 return ERROR_OK;
821 }
822
823 static int arm920t_target_create(struct target *target, Jim_Interp *interp)
824 {
825 struct arm920t_common *arm920t;
826
827 arm920t = calloc(1,sizeof(struct arm920t_common));
828 return arm920t_init_arch_info(target, arm920t, target->tap);
829 }
830
831 COMMAND_HANDLER(arm920t_handle_read_cache_command)
832 {
833 int retval = ERROR_OK;
834 struct target *target = get_current_target(CMD_CTX);
835 struct arm920t_common *arm920t = target_to_arm920(target);
836 struct arm7_9_common *arm7_9 = target_to_arm7_9(target);
837 struct arm *armv4_5 = &arm7_9->armv4_5_common;
838 uint32_t cp15c15;
839 uint32_t cp15_ctrl, cp15_ctrl_saved;
840 uint32_t regs[16];
841 uint32_t *regs_p[16];
842 uint32_t C15_C_D_Ind, C15_C_I_Ind;
843 int i;
844 FILE *output;
845 struct arm920t_cache_line d_cache[8][64], i_cache[8][64];
846 int segment, index_t;
847 struct reg *r;
848
849 retval = arm920t_verify_pointer(CMD_CTX, arm920t);
850 if (retval != ERROR_OK)
851 return retval;
852
853 if (CMD_ARGC != 1)
854 {
855 command_print(CMD_CTX, "usage: arm920t read_cache <filename>");
856 return ERROR_OK;
857 }
858
859 if ((output = fopen(CMD_ARGV[0], "w")) == NULL)
860 {
861 LOG_DEBUG("error opening cache content file");
862 return ERROR_OK;
863 }
864
865 for (i = 0; i < 16; i++)
866 regs_p[i] = &regs[i];
867
868 /* disable MMU and Caches */
869 arm920t_read_cp15_physical(target, CP15PHYS_CTRL, &cp15_ctrl);
870 if ((retval = jtag_execute_queue()) != ERROR_OK)
871 {
872 return retval;
873 }
874 cp15_ctrl_saved = cp15_ctrl;
875 cp15_ctrl &= ~(ARMV4_5_MMU_ENABLED
876 | ARMV4_5_D_U_CACHE_ENABLED | ARMV4_5_I_CACHE_ENABLED);
877 arm920t_write_cp15_physical(target, CP15PHYS_CTRL, cp15_ctrl);
878
879 /* read CP15 test state register */
880 arm920t_read_cp15_physical(target, CP15PHYS_TESTSTATE, &cp15c15);
881 jtag_execute_queue();
882
883 /* read DCache content */
884 fprintf(output, "DCache:\n");
885
886 /* go through segments 0 to nsets (8 on ARM920T, 4 on ARM922T) */
887 for (segment = 0;
888 segment < arm920t->armv4_5_mmu.armv4_5_cache.d_u_size.nsets;
889 segment++)
890 {
891 fprintf(output, "\nsegment: %i\n----------", segment);
892
893 /* Ra: r0 = SBZ(31:8):segment(7:5):SBZ(4:0) */
894 regs[0] = 0x0 | (segment << 5);
895 arm9tdmi_write_core_regs(target, 0x1, regs);
896
897 /* set interpret mode */
898 cp15c15 |= 0x1;
899 arm920t_write_cp15_physical(target,
900 CP15PHYS_TESTSTATE, cp15c15);
901
902 /* D CAM Read, loads current victim into C15.C.D.Ind */
903 arm920t_execute_cp15(target,
904 ARMV4_5_MCR(15,2,0,15,6,2), ARMV4_5_LDR(1, 0));
905
906 /* read current victim */
907 arm920t_read_cp15_physical(target,
908 CP15PHYS_DCACHE_IDX, &C15_C_D_Ind);
909
910 /* clear interpret mode */
911 cp15c15 &= ~0x1;
912 arm920t_write_cp15_physical(target,
913 CP15PHYS_TESTSTATE, cp15c15);
914
915 for (index_t = 0; index_t < 64; index_t++)
916 {
917 /* Ra:
918 * r0 = index(31:26):SBZ(25:8):segment(7:5):SBZ(4:0)
919 */
920 regs[0] = 0x0 | (segment << 5) | (index_t << 26);
921 arm9tdmi_write_core_regs(target, 0x1, regs);
922
923 /* set interpret mode */
924 cp15c15 |= 0x1;
925 arm920t_write_cp15_physical(target,
926 CP15PHYS_TESTSTATE, cp15c15);
927
928 /* Write DCache victim */
929 arm920t_execute_cp15(target,
930 ARMV4_5_MCR(15,0,0,9,1,0), ARMV4_5_LDR(1, 0));
931
932 /* Read D RAM */
933 arm920t_execute_cp15(target,
934 ARMV4_5_MCR(15,2,0,15,10,2),
935 ARMV4_5_LDMIA(0, 0x1fe, 0, 0));
936
937 /* Read D CAM */
938 arm920t_execute_cp15(target,
939 ARMV4_5_MCR(15,2,0,15,6,2),
940 ARMV4_5_LDR(9, 0));
941
942 /* clear interpret mode */
943 cp15c15 &= ~0x1;
944 arm920t_write_cp15_physical(target,
945 CP15PHYS_TESTSTATE, cp15c15);
946
947 /* read D RAM and CAM content */
948 arm9tdmi_read_core_regs(target, 0x3fe, regs_p);
949 if ((retval = jtag_execute_queue()) != ERROR_OK)
950 {
951 return retval;
952 }
953
954 d_cache[segment][index_t].cam = regs[9];
955
956 /* mask LFSR[6] */
957 regs[9] &= 0xfffffffe;
958 fprintf(output, "\nsegment: %i, index: %i, CAM: 0x%8.8"
959 PRIx32 ", content (%s):\n",
960 segment, index_t, regs[9],
961 (regs[9] & 0x10) ? "valid" : "invalid");
962
963 for (i = 1; i < 9; i++)
964 {
965 d_cache[segment][index_t].data[i] = regs[i];
966 fprintf(output, "%i: 0x%8.8" PRIx32 "\n",
967 i-1, regs[i]);
968 }
969
970 }
971
972 /* Ra: r0 = index(31:26):SBZ(25:8):segment(7:5):SBZ(4:0) */
973 regs[0] = 0x0 | (segment << 5) | (C15_C_D_Ind << 26);
974 arm9tdmi_write_core_regs(target, 0x1, regs);
975
976 /* set interpret mode */
977 cp15c15 |= 0x1;
978 arm920t_write_cp15_physical(target,
979 CP15PHYS_TESTSTATE, cp15c15);
980
981 /* Write DCache victim */
982 arm920t_execute_cp15(target,
983 ARMV4_5_MCR(15,0,0,9,1,0), ARMV4_5_LDR(1, 0));
984
985 /* clear interpret mode */
986 cp15c15 &= ~0x1;
987 arm920t_write_cp15_physical(target,
988 CP15PHYS_TESTSTATE, cp15c15);
989 }
990
991 /* read ICache content */
992 fprintf(output, "ICache:\n");
993
994 /* go through segments 0 to nsets (8 on ARM920T, 4 on ARM922T) */
995 for (segment = 0;
996 segment < arm920t->armv4_5_mmu.armv4_5_cache.d_u_size.nsets;
997 segment++)
998 {
999 fprintf(output, "segment: %i\n----------", segment);
1000
1001 /* Ra: r0 = SBZ(31:8):segment(7:5):SBZ(4:0) */
1002 regs[0] = 0x0 | (segment << 5);
1003 arm9tdmi_write_core_regs(target, 0x1, regs);
1004
1005 /* set interpret mode */
1006 cp15c15 |= 0x1;
1007 arm920t_write_cp15_physical(target,
1008 CP15PHYS_TESTSTATE, cp15c15);
1009
1010 /* I CAM Read, loads current victim into C15.C.I.Ind */
1011 arm920t_execute_cp15(target,
1012 ARMV4_5_MCR(15,2,0,15,5,2), ARMV4_5_LDR(1, 0));
1013
1014 /* read current victim */
1015 arm920t_read_cp15_physical(target, CP15PHYS_ICACHE_IDX,
1016 &C15_C_I_Ind);
1017
1018 /* clear interpret mode */
1019 cp15c15 &= ~0x1;
1020 arm920t_write_cp15_physical(target,
1021 CP15PHYS_TESTSTATE, cp15c15);
1022
1023 for (index_t = 0; index_t < 64; index_t++)
1024 {
1025 /* Ra:
1026 * r0 = index(31:26):SBZ(25:8):segment(7:5):SBZ(4:0)
1027 */
1028 regs[0] = 0x0 | (segment << 5) | (index_t << 26);
1029 arm9tdmi_write_core_regs(target, 0x1, regs);
1030
1031 /* set interpret mode */
1032 cp15c15 |= 0x1;
1033 arm920t_write_cp15_physical(target,
1034 CP15PHYS_TESTSTATE, cp15c15);
1035
1036 /* Write ICache victim */
1037 arm920t_execute_cp15(target,
1038 ARMV4_5_MCR(15,0,0,9,1,1), ARMV4_5_LDR(1, 0));
1039
1040 /* Read I RAM */
1041 arm920t_execute_cp15(target,
1042 ARMV4_5_MCR(15,2,0,15,9,2),
1043 ARMV4_5_LDMIA(0, 0x1fe, 0, 0));
1044
1045 /* Read I CAM */
1046 arm920t_execute_cp15(target,
1047 ARMV4_5_MCR(15,2,0,15,5,2),
1048 ARMV4_5_LDR(9, 0));
1049
1050 /* clear interpret mode */
1051 cp15c15 &= ~0x1;
1052 arm920t_write_cp15_physical(target,
1053 CP15PHYS_TESTSTATE, cp15c15);
1054
1055 /* read I RAM and CAM content */
1056 arm9tdmi_read_core_regs(target, 0x3fe, regs_p);
1057 if ((retval = jtag_execute_queue()) != ERROR_OK)
1058 {
1059 return retval;
1060 }
1061
1062 i_cache[segment][index_t].cam = regs[9];
1063
1064 /* mask LFSR[6] */
1065 regs[9] &= 0xfffffffe;
1066 fprintf(output, "\nsegment: %i, index: %i, "
1067 "CAM: 0x%8.8" PRIx32 ", content (%s):\n",
1068 segment, index_t, regs[9],
1069 (regs[9] & 0x10) ? "valid" : "invalid");
1070
1071 for (i = 1; i < 9; i++)
1072 {
1073 i_cache[segment][index_t].data[i] = regs[i];
1074 fprintf(output, "%i: 0x%8.8" PRIx32 "\n",
1075 i-1, regs[i]);
1076 }
1077 }
1078
1079 /* Ra: r0 = index(31:26):SBZ(25:8):segment(7:5):SBZ(4:0) */
1080 regs[0] = 0x0 | (segment << 5) | (C15_C_D_Ind << 26);
1081 arm9tdmi_write_core_regs(target, 0x1, regs);
1082
1083 /* set interpret mode */
1084 cp15c15 |= 0x1;
1085 arm920t_write_cp15_physical(target,
1086 CP15PHYS_TESTSTATE, cp15c15);
1087
1088 /* Write ICache victim */
1089 arm920t_execute_cp15(target,
1090 ARMV4_5_MCR(15,0,0,9,1,1), ARMV4_5_LDR(1, 0));
1091
1092 /* clear interpret mode */
1093 cp15c15 &= ~0x1;
1094 arm920t_write_cp15_physical(target,
1095 CP15PHYS_TESTSTATE, cp15c15);
1096 }
1097
1098 /* restore CP15 MMU and Cache settings */
1099 arm920t_write_cp15_physical(target, CP15PHYS_CTRL, cp15_ctrl_saved);
1100
1101 command_print(CMD_CTX, "cache content successfully output to %s",
1102 CMD_ARGV[0]);
1103
1104 fclose(output);
1105
1106 if (!is_arm_mode(armv4_5->core_mode))
1107 return ERROR_FAIL;
1108
1109 /* force writeback of the valid data */
1110 r = armv4_5->core_cache->reg_list;
1111 r[0].dirty = r[0].valid;
1112 r[1].dirty = r[1].valid;
1113 r[2].dirty = r[2].valid;
1114 r[3].dirty = r[3].valid;
1115 r[4].dirty = r[4].valid;
1116 r[5].dirty = r[5].valid;
1117 r[6].dirty = r[6].valid;
1118 r[7].dirty = r[7].valid;
1119
1120 r = arm_reg_current(armv4_5, 8);
1121 r->dirty = r->valid;
1122
1123 r = arm_reg_current(armv4_5, 9);
1124 r->dirty = r->valid;
1125
1126 return ERROR_OK;
1127 }
1128
1129 COMMAND_HANDLER(arm920t_handle_read_mmu_command)
1130 {
1131 int retval = ERROR_OK;
1132 struct target *target = get_current_target(CMD_CTX);
1133 struct arm920t_common *arm920t = target_to_arm920(target);
1134 struct arm7_9_common *arm7_9 = target_to_arm7_9(target);
1135 struct arm *armv4_5 = &arm7_9->armv4_5_common;
1136 uint32_t cp15c15;
1137 uint32_t cp15_ctrl, cp15_ctrl_saved;
1138 uint32_t regs[16];
1139 uint32_t *regs_p[16];
1140 int i;
1141 FILE *output;
1142 uint32_t Dlockdown, Ilockdown;
1143 struct arm920t_tlb_entry d_tlb[64], i_tlb[64];
1144 int victim;
1145 struct reg *r;
1146
1147 retval = arm920t_verify_pointer(CMD_CTX, arm920t);
1148 if (retval != ERROR_OK)
1149 return retval;
1150
1151 if (CMD_ARGC != 1)
1152 {
1153 command_print(CMD_CTX, "usage: arm920t read_mmu <filename>");
1154 return ERROR_OK;
1155 }
1156
1157 if ((output = fopen(CMD_ARGV[0], "w")) == NULL)
1158 {
1159 LOG_DEBUG("error opening mmu content file");
1160 return ERROR_OK;
1161 }
1162
1163 for (i = 0; i < 16; i++)
1164 regs_p[i] = &regs[i];
1165
1166 /* disable MMU and Caches */
1167 arm920t_read_cp15_physical(target, CP15PHYS_CTRL, &cp15_ctrl);
1168 if ((retval = jtag_execute_queue()) != ERROR_OK)
1169 {
1170 return retval;
1171 }
1172 cp15_ctrl_saved = cp15_ctrl;
1173 cp15_ctrl &= ~(ARMV4_5_MMU_ENABLED
1174 | ARMV4_5_D_U_CACHE_ENABLED | ARMV4_5_I_CACHE_ENABLED);
1175 arm920t_write_cp15_physical(target, CP15PHYS_CTRL, cp15_ctrl);
1176
1177 /* read CP15 test state register */
1178 arm920t_read_cp15_physical(target, CP15PHYS_TESTSTATE, &cp15c15);
1179 if ((retval = jtag_execute_queue()) != ERROR_OK)
1180 {
1181 return retval;
1182 }
1183
1184 /* prepare reading D TLB content
1185 * */
1186
1187 /* set interpret mode */
1188 cp15c15 |= 0x1;
1189 arm920t_write_cp15_physical(target, CP15PHYS_TESTSTATE, cp15c15);
1190
1191 /* Read D TLB lockdown */
1192 arm920t_execute_cp15(target,
1193 ARMV4_5_MRC(15,0,0,10,0,0), ARMV4_5_LDR(1, 0));
1194
1195 /* clear interpret mode */
1196 cp15c15 &= ~0x1;
1197 arm920t_write_cp15_physical(target, CP15PHYS_TESTSTATE, cp15c15);
1198
1199 /* read D TLB lockdown stored to r1 */
1200 arm9tdmi_read_core_regs(target, 0x2, regs_p);
1201 if ((retval = jtag_execute_queue()) != ERROR_OK)
1202 {
1203 return retval;
1204 }
1205 Dlockdown = regs[1];
1206
1207 for (victim = 0; victim < 64; victim += 8)
1208 {
1209 /* new lockdown value: base[31:26]:victim[25:20]:SBZ[19:1]:p[0]
1210 * base remains unchanged, victim goes through entries 0 to 63
1211 */
1212 regs[1] = (Dlockdown & 0xfc000000) | (victim << 20);
1213 arm9tdmi_write_core_regs(target, 0x2, regs);
1214
1215 /* set interpret mode */
1216 cp15c15 |= 0x1;
1217 arm920t_write_cp15_physical(target,
1218 CP15PHYS_TESTSTATE, cp15c15);
1219
1220 /* Write D TLB lockdown */
1221 arm920t_execute_cp15(target,
1222 ARMV4_5_MCR(15,0,0,10,0,0),
1223 ARMV4_5_STR(1, 0));
1224
1225 /* Read D TLB CAM */
1226 arm920t_execute_cp15(target,
1227 ARMV4_5_MCR(15,4,0,15,6,4),
1228 ARMV4_5_LDMIA(0, 0x3fc, 0, 0));
1229
1230 /* clear interpret mode */
1231 cp15c15 &= ~0x1;
1232 arm920t_write_cp15_physical(target,
1233 CP15PHYS_TESTSTATE, cp15c15);
1234
1235 /* read D TLB CAM content stored to r2-r9 */
1236 arm9tdmi_read_core_regs(target, 0x3fc, regs_p);
1237 if ((retval = jtag_execute_queue()) != ERROR_OK)
1238 {
1239 return retval;
1240 }
1241
1242 for (i = 0; i < 8; i++)
1243 d_tlb[victim + i].cam = regs[i + 2];
1244 }
1245
1246 for (victim = 0; victim < 64; victim++)
1247 {
1248 /* new lockdown value: base[31:26]:victim[25:20]:SBZ[19:1]:p[0]
1249 * base remains unchanged, victim goes through entries 0 to 63
1250 */
1251 regs[1] = (Dlockdown & 0xfc000000) | (victim << 20);
1252 arm9tdmi_write_core_regs(target, 0x2, regs);
1253
1254 /* set interpret mode */
1255 cp15c15 |= 0x1;
1256 arm920t_write_cp15_physical(target,
1257 CP15PHYS_TESTSTATE, cp15c15);
1258
1259 /* Write D TLB lockdown */
1260 arm920t_execute_cp15(target,
1261 ARMV4_5_MCR(15,0,0,10,0,0), ARMV4_5_STR(1, 0));
1262
1263 /* Read D TLB RAM1 */
1264 arm920t_execute_cp15(target,
1265 ARMV4_5_MCR(15,4,0,15,10,4), ARMV4_5_LDR(2,0));
1266
1267 /* Read D TLB RAM2 */
1268 arm920t_execute_cp15(target,
1269 ARMV4_5_MCR(15,4,0,15,2,5), ARMV4_5_LDR(3,0));
1270
1271 /* clear interpret mode */
1272 cp15c15 &= ~0x1;
1273 arm920t_write_cp15_physical(target,
1274 CP15PHYS_TESTSTATE, cp15c15);
1275
1276 /* read D TLB RAM content stored to r2 and r3 */
1277 arm9tdmi_read_core_regs(target, 0xc, regs_p);
1278 if ((retval = jtag_execute_queue()) != ERROR_OK)
1279 {
1280 return retval;
1281 }
1282
1283 d_tlb[victim].ram1 = regs[2];
1284 d_tlb[victim].ram2 = regs[3];
1285 }
1286
1287 /* restore D TLB lockdown */
1288 regs[1] = Dlockdown;
1289 arm9tdmi_write_core_regs(target, 0x2, regs);
1290
1291 /* Write D TLB lockdown */
1292 arm920t_execute_cp15(target,
1293 ARMV4_5_MCR(15,0,0,10,0,0), ARMV4_5_STR(1, 0));
1294
1295 /* prepare reading I TLB content
1296 * */
1297
1298 /* set interpret mode */
1299 cp15c15 |= 0x1;
1300 arm920t_write_cp15_physical(target, CP15PHYS_TESTSTATE, cp15c15);
1301
1302 /* Read I TLB lockdown */
1303 arm920t_execute_cp15(target,
1304 ARMV4_5_MRC(15,0,0,10,0,1), ARMV4_5_LDR(1, 0));
1305
1306 /* clear interpret mode */
1307 cp15c15 &= ~0x1;
1308 arm920t_write_cp15_physical(target, CP15PHYS_TESTSTATE, cp15c15);
1309
1310 /* read I TLB lockdown stored to r1 */
1311 arm9tdmi_read_core_regs(target, 0x2, regs_p);
1312 if ((retval = jtag_execute_queue()) != ERROR_OK)
1313 {
1314 return retval;
1315 }
1316 Ilockdown = regs[1];
1317
1318 for (victim = 0; victim < 64; victim += 8)
1319 {
1320 /* new lockdown value: base[31:26]:victim[25:20]:SBZ[19:1]:p[0]
1321 * base remains unchanged, victim goes through entries 0 to 63
1322 */
1323 regs[1] = (Ilockdown & 0xfc000000) | (victim << 20);
1324 arm9tdmi_write_core_regs(target, 0x2, regs);
1325
1326 /* set interpret mode */
1327 cp15c15 |= 0x1;
1328 arm920t_write_cp15_physical(target,
1329 CP15PHYS_TESTSTATE, cp15c15);
1330
1331 /* Write I TLB lockdown */
1332 arm920t_execute_cp15(target,
1333 ARMV4_5_MCR(15,0,0,10,0,1),
1334 ARMV4_5_STR(1, 0));
1335
1336 /* Read I TLB CAM */
1337 arm920t_execute_cp15(target,
1338 ARMV4_5_MCR(15,4,0,15,5,4),
1339 ARMV4_5_LDMIA(0, 0x3fc, 0, 0));
1340
1341 /* clear interpret mode */
1342 cp15c15 &= ~0x1;
1343 arm920t_write_cp15_physical(target,
1344 CP15PHYS_TESTSTATE, cp15c15);
1345
1346 /* read I TLB CAM content stored to r2-r9 */
1347 arm9tdmi_read_core_regs(target, 0x3fc, regs_p);
1348 if ((retval = jtag_execute_queue()) != ERROR_OK)
1349 {
1350 return retval;
1351 }
1352
1353 for (i = 0; i < 8; i++)
1354 i_tlb[i + victim].cam = regs[i + 2];
1355 }
1356
1357 for (victim = 0; victim < 64; victim++)
1358 {
1359 /* new lockdown value: base[31:26]:victim[25:20]:SBZ[19:1]:p[0]
1360 * base remains unchanged, victim goes through entries 0 to 63
1361 */
1362 regs[1] = (Dlockdown & 0xfc000000) | (victim << 20);
1363 arm9tdmi_write_core_regs(target, 0x2, regs);
1364
1365 /* set interpret mode */
1366 cp15c15 |= 0x1;
1367 arm920t_write_cp15_physical(target,
1368 CP15PHYS_TESTSTATE, cp15c15);
1369
1370 /* Write I TLB lockdown */
1371 arm920t_execute_cp15(target,
1372 ARMV4_5_MCR(15,0,0,10,0,1), ARMV4_5_STR(1, 0));
1373
1374 /* Read I TLB RAM1 */
1375 arm920t_execute_cp15(target,
1376 ARMV4_5_MCR(15,4,0,15,9,4), ARMV4_5_LDR(2,0));
1377
1378 /* Read I TLB RAM2 */
1379 arm920t_execute_cp15(target,
1380 ARMV4_5_MCR(15,4,0,15,1,5), ARMV4_5_LDR(3,0));
1381
1382 /* clear interpret mode */
1383 cp15c15 &= ~0x1;
1384 arm920t_write_cp15_physical(target,
1385 CP15PHYS_TESTSTATE, cp15c15);
1386
1387 /* read I TLB RAM content stored to r2 and r3 */
1388 arm9tdmi_read_core_regs(target, 0xc, regs_p);
1389 if ((retval = jtag_execute_queue()) != ERROR_OK)
1390 {
1391 return retval;
1392 }
1393
1394 i_tlb[victim].ram1 = regs[2];
1395 i_tlb[victim].ram2 = regs[3];
1396 }
1397
1398 /* restore I TLB lockdown */
1399 regs[1] = Ilockdown;
1400 arm9tdmi_write_core_regs(target, 0x2, regs);
1401
1402 /* Write I TLB lockdown */
1403 arm920t_execute_cp15(target,
1404 ARMV4_5_MCR(15,0,0,10,0,1), ARMV4_5_STR(1, 0));
1405
1406 /* restore CP15 MMU and Cache settings */
1407 arm920t_write_cp15_physical(target, CP15PHYS_CTRL, cp15_ctrl_saved);
1408
1409 /* output data to file */
1410 fprintf(output, "D TLB content:\n");
1411 for (i = 0; i < 64; i++)
1412 {
1413 fprintf(output, "%i: 0x%8.8" PRIx32 " 0x%8.8" PRIx32
1414 " 0x%8.8" PRIx32 " %s\n",
1415 i, d_tlb[i].cam, d_tlb[i].ram1, d_tlb[i].ram2,
1416 (d_tlb[i].cam & 0x20) ? "(valid)" : "(invalid)");
1417 }
1418
1419 fprintf(output, "\n\nI TLB content:\n");
1420 for (i = 0; i < 64; i++)
1421 {
1422 fprintf(output, "%i: 0x%8.8" PRIx32 " 0x%8.8" PRIx32
1423 " 0x%8.8" PRIx32 " %s\n",
1424 i, i_tlb[i].cam, i_tlb[i].ram1, i_tlb[i].ram2,
1425 (i_tlb[i].cam & 0x20) ? "(valid)" : "(invalid)");
1426 }
1427
1428 command_print(CMD_CTX, "mmu content successfully output to %s",
1429 CMD_ARGV[0]);
1430
1431 fclose(output);
1432
1433 if (!is_arm_mode(armv4_5->core_mode))
1434 return ERROR_FAIL;
1435
1436 /* force writeback of the valid data */
1437 r = armv4_5->core_cache->reg_list;
1438 r[0].dirty = r[0].valid;
1439 r[1].dirty = r[1].valid;
1440 r[2].dirty = r[2].valid;
1441 r[3].dirty = r[3].valid;
1442 r[4].dirty = r[4].valid;
1443 r[5].dirty = r[5].valid;
1444 r[6].dirty = r[6].valid;
1445 r[7].dirty = r[7].valid;
1446
1447 r = arm_reg_current(armv4_5, 8);
1448 r->dirty = r->valid;
1449
1450 r = arm_reg_current(armv4_5, 9);
1451 r->dirty = r->valid;
1452
1453 return ERROR_OK;
1454 }
1455
1456 COMMAND_HANDLER(arm920t_handle_cp15_command)
1457 {
1458 int retval;
1459 struct target *target = get_current_target(CMD_CTX);
1460 struct arm920t_common *arm920t = target_to_arm920(target);
1461
1462 retval = arm920t_verify_pointer(CMD_CTX, arm920t);
1463 if (retval != ERROR_OK)
1464 return retval;
1465
1466 if (target->state != TARGET_HALTED)
1467 {
1468 command_print(CMD_CTX, "target must be stopped for "
1469 "\"%s\" command", CMD_NAME);
1470 return ERROR_OK;
1471 }
1472
1473 /* one argument, read a register.
1474 * two arguments, write it.
1475 */
1476 if (CMD_ARGC >= 1)
1477 {
1478 int address;
1479 COMMAND_PARSE_NUMBER(int, CMD_ARGV[0], address);
1480
1481 if (CMD_ARGC == 1)
1482 {
1483 uint32_t value;
1484 if ((retval = arm920t_read_cp15_physical(target,
1485 address, &value)) != ERROR_OK)
1486 {
1487 command_print(CMD_CTX,
1488 "couldn't access reg %i", address);
1489 return ERROR_OK;
1490 }
1491 if ((retval = jtag_execute_queue()) != ERROR_OK)
1492 {
1493 return retval;
1494 }
1495
1496 command_print(CMD_CTX, "%i: %8.8" PRIx32,
1497 address, value);
1498 }
1499 else if (CMD_ARGC == 2)
1500 {
1501 uint32_t value;
1502 COMMAND_PARSE_NUMBER(u32, CMD_ARGV[1], value);
1503 retval = arm920t_write_cp15_physical(target,
1504 address, value);
1505 if (retval != ERROR_OK)
1506 {
1507 command_print(CMD_CTX,
1508 "couldn't access reg %i", address);
1509 /* REVISIT why lie? "return retval"? */
1510 return ERROR_OK;
1511 }
1512 command_print(CMD_CTX, "%i: %8.8" PRIx32,
1513 address, value);
1514 }
1515 }
1516
1517 return ERROR_OK;
1518 }
1519
1520 COMMAND_HANDLER(arm920t_handle_cp15i_command)
1521 {
1522 int retval;
1523 struct target *target = get_current_target(CMD_CTX);
1524 struct arm920t_common *arm920t = target_to_arm920(target);
1525
1526 retval = arm920t_verify_pointer(CMD_CTX, arm920t);
1527 if (retval != ERROR_OK)
1528 return retval;
1529
1530
1531 if (target->state != TARGET_HALTED)
1532 {
1533 command_print(CMD_CTX, "target must be stopped for "
1534 "\"%s\" command", CMD_NAME);
1535 return ERROR_OK;
1536 }
1537
1538 /* one argument, read a register.
1539 * two arguments, write it.
1540 */
1541 if (CMD_ARGC >= 1)
1542 {
1543 uint32_t opcode;
1544 COMMAND_PARSE_NUMBER(u32, CMD_ARGV[0], opcode);
1545
1546 if (CMD_ARGC == 1)
1547 {
1548 uint32_t value;
1549 retval = arm920t_read_cp15_interpreted(target,
1550 opcode, 0x0, &value);
1551 if (retval != ERROR_OK)
1552 {
1553 command_print(CMD_CTX,
1554 "couldn't execute %8.8" PRIx32,
1555 opcode);
1556 /* REVISIT why lie? "return retval"? */
1557 return ERROR_OK;
1558 }
1559
1560 command_print(CMD_CTX, "%8.8" PRIx32 ": %8.8" PRIx32,
1561 opcode, value);
1562 }
1563 else if (CMD_ARGC == 2)
1564 {
1565 uint32_t value;
1566 COMMAND_PARSE_NUMBER(u32, CMD_ARGV[1], value);
1567 retval = arm920t_write_cp15_interpreted(target,
1568 opcode, value, 0);
1569 if (retval != ERROR_OK)
1570 {
1571 command_print(CMD_CTX,
1572 "couldn't execute %8.8" PRIx32,
1573 opcode);
1574 /* REVISIT why lie? "return retval"? */
1575 return ERROR_OK;
1576 }
1577 command_print(CMD_CTX, "%8.8" PRIx32 ": %8.8" PRIx32,
1578 opcode, value);
1579 }
1580 else if (CMD_ARGC == 3)
1581 {
1582 uint32_t value;
1583 COMMAND_PARSE_NUMBER(u32, CMD_ARGV[1], value);
1584 uint32_t address;
1585 COMMAND_PARSE_NUMBER(u32, CMD_ARGV[2], address);
1586 retval = arm920t_write_cp15_interpreted(target,
1587 opcode, value, address);
1588 if (retval != ERROR_OK)
1589 {
1590 command_print(CMD_CTX,
1591 "couldn't execute %8.8" PRIx32, opcode);
1592 /* REVISIT why lie? "return retval"? */
1593 return ERROR_OK;
1594 }
1595 command_print(CMD_CTX, "%8.8" PRIx32 ": %8.8" PRIx32
1596 " %8.8" PRIx32, opcode, value, address);
1597 }
1598 }
1599 else
1600 {
1601 command_print(CMD_CTX,
1602 "usage: arm920t cp15i <opcode> [value] [address]");
1603 }
1604
1605 return ERROR_OK;
1606 }
1607
1608 COMMAND_HANDLER(arm920t_handle_cache_info_command)
1609 {
1610 int retval;
1611 struct target *target = get_current_target(CMD_CTX);
1612 struct arm920t_common *arm920t = target_to_arm920(target);
1613
1614 retval = arm920t_verify_pointer(CMD_CTX, arm920t);
1615 if (retval != ERROR_OK)
1616 return retval;
1617
1618 return armv4_5_handle_cache_info_command(CMD_CTX,
1619 &arm920t->armv4_5_mmu.armv4_5_cache);
1620 }
1621
1622
1623 static int arm920t_mrc(struct target *target, int cpnum,
1624 uint32_t op1, uint32_t op2,
1625 uint32_t CRn, uint32_t CRm,
1626 uint32_t *value)
1627 {
1628 if (cpnum!=15)
1629 {
1630 LOG_ERROR("Only cp15 is supported");
1631 return ERROR_FAIL;
1632 }
1633
1634 /* read "to" r0 */
1635 return arm920t_read_cp15_interpreted(target,
1636 ARMV4_5_MRC(cpnum, op1, 0, CRn, CRm, op2),
1637 0, value);
1638 }
1639
1640 static int arm920t_mcr(struct target *target, int cpnum,
1641 uint32_t op1, uint32_t op2,
1642 uint32_t CRn, uint32_t CRm,
1643 uint32_t value)
1644 {
1645 if (cpnum!=15)
1646 {
1647 LOG_ERROR("Only cp15 is supported");
1648 return ERROR_FAIL;
1649 }
1650
1651 /* write "from" r0 */
1652 return arm920t_write_cp15_interpreted(target,
1653 ARMV4_5_MCR(cpnum, op1, 0, CRn, CRm, op2),
1654 0, value);
1655 }
1656
1657 static const struct command_registration arm920t_exec_command_handlers[] = {
1658 {
1659 .name = "cp15",
1660 .handler = arm920t_handle_cp15_command,
1661 .mode = COMMAND_EXEC,
1662 .help = "display/modify cp15 register",
1663 .usage = "regnum [value]",
1664 },
1665 {
1666 .name = "cp15i",
1667 .handler = arm920t_handle_cp15i_command,
1668 .mode = COMMAND_EXEC,
1669 /* prefer using less error-prone "arm mcr" or "arm mrc" */
1670 .help = "display/modify cp15 register using ARM opcode"
1671 " (DEPRECATED)",
1672 .usage = "instruction [value [address]]",
1673 },
1674 {
1675 .name = "cache_info",
1676 .handler = arm920t_handle_cache_info_command,
1677 .mode = COMMAND_EXEC,
1678 .help = "display information about target caches",
1679 },
1680 {
1681 .name = "read_cache",
1682 .handler = arm920t_handle_read_cache_command,
1683 .mode = COMMAND_EXEC,
1684 .help = "dump I/D cache content to file",
1685 .usage = "filename",
1686 },
1687 {
1688 .name = "read_mmu",
1689 .handler = arm920t_handle_read_mmu_command,
1690 .mode = COMMAND_EXEC,
1691 .help = "dump I/D mmu content to file",
1692 .usage = "filename",
1693 },
1694 COMMAND_REGISTRATION_DONE
1695 };
1696 const struct command_registration arm920t_command_handlers[] = {
1697 {
1698 .chain = arm9tdmi_command_handlers,
1699 },
1700 {
1701 .name = "arm920t",
1702 .mode = COMMAND_ANY,
1703 .help = "arm920t command group",
1704 .chain = arm920t_exec_command_handlers,
1705 },
1706 COMMAND_REGISTRATION_DONE
1707 };
1708
1709 /** Holds methods for ARM920 targets. */
1710 struct target_type arm920t_target =
1711 {
1712 .name = "arm920t",
1713
1714 .poll = arm7_9_poll,
1715 .arch_state = arm920t_arch_state,
1716
1717 .target_request_data = arm7_9_target_request_data,
1718
1719 .halt = arm7_9_halt,
1720 .resume = arm7_9_resume,
1721 .step = arm7_9_step,
1722
1723 .assert_reset = arm7_9_assert_reset,
1724 .deassert_reset = arm7_9_deassert_reset,
1725 .soft_reset_halt = arm920t_soft_reset_halt,
1726
1727 .get_gdb_reg_list = arm_get_gdb_reg_list,
1728
1729 .read_memory = arm920t_read_memory,
1730 .write_memory = arm920t_write_memory,
1731 .read_phys_memory = arm920t_read_phys_memory,
1732 .write_phys_memory = arm920t_write_phys_memory,
1733 .mmu = arm920_mmu,
1734 .virt2phys = arm920_virt2phys,
1735
1736 .bulk_write_memory = arm7_9_bulk_write_memory,
1737
1738 .checksum_memory = arm_checksum_memory,
1739 .blank_check_memory = arm_blank_check_memory,
1740
1741 .run_algorithm = armv4_5_run_algorithm,
1742
1743 .add_breakpoint = arm7_9_add_breakpoint,
1744 .remove_breakpoint = arm7_9_remove_breakpoint,
1745 .add_watchpoint = arm7_9_add_watchpoint,
1746 .remove_watchpoint = arm7_9_remove_watchpoint,
1747
1748 .commands = arm920t_command_handlers,
1749 .target_create = arm920t_target_create,
1750 .init_target = arm9tdmi_init_target,
1751 .examine = arm7_9_examine,
1752 .check_reset = arm7_9_check_reset,
1753 };
Marex's Cortex A8 development branch