1 /***************************************************************************
2 * Copyright (C) 2008 digenius technology GmbH. *
5 * Copyright (C) 2008,2009 Oyvind Harboe oyvind.harboe@zylin.com *
7 * This program is free software; you can redistribute it and/or modify *
8 * it under the terms of the GNU General Public License as published by *
9 * the Free Software Foundation; either version 2 of the License, or *
10 * (at your option) any later version. *
12 * This program is distributed in the hope that it will be useful, *
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
15 * GNU General Public License for more details. *
17 * You should have received a copy of the GNU General Public License *
18 * along with this program; if not, write to the *
19 * Free Software Foundation, Inc., *
20 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
21 ***************************************************************************/
28 #include "arm11_dbgtap.h"
30 #include <helper/time_support.h>
33 #define JTAG_DEBUG(expr ...) do { if (1) LOG_DEBUG(expr); } while (0)
35 #define JTAG_DEBUG(expr ...) do { if (0) LOG_DEBUG(expr); } while (0)
39 This pathmove goes from Pause-IR to Shift-IR while avoiding RTI. The
40 behavior of the FTDI driver IIRC was to go via RTI.
42 Conversely there may be other places in this code where the ARM11 code relies
43 on the driver to hit through RTI when coming from Update-?R.
45 static const tap_state_t arm11_move_pi_to_si_via_ci
[] =
47 TAP_IREXIT2
, TAP_IRUPDATE
, TAP_DRSELECT
, TAP_IRSELECT
, TAP_IRCAPTURE
, TAP_IRSHIFT
51 /* REVISIT no error handling here! */
52 static void arm11_add_ir_scan_vc(int num_fields
, struct scan_field
*fields
,
55 if (cmd_queue_cur_state
== TAP_IRPAUSE
)
56 jtag_add_pathmove(ARRAY_SIZE(arm11_move_pi_to_si_via_ci
), arm11_move_pi_to_si_via_ci
);
58 jtag_add_ir_scan(num_fields
, fields
, state
);
61 static const tap_state_t arm11_move_pd_to_sd_via_cd
[] =
63 TAP_DREXIT2
, TAP_DRUPDATE
, TAP_DRSELECT
, TAP_DRCAPTURE
, TAP_DRSHIFT
66 /* REVISIT no error handling here! */
67 void arm11_add_dr_scan_vc(int num_fields
, struct scan_field
*fields
,
70 if (cmd_queue_cur_state
== TAP_DRPAUSE
)
71 jtag_add_pathmove(ARRAY_SIZE(arm11_move_pd_to_sd_via_cd
), arm11_move_pd_to_sd_via_cd
);
73 jtag_add_dr_scan(num_fields
, fields
, state
);
77 /** Code de-clutter: Construct struct scan_field to write out a value
79 * \param arm11 Target state variable.
80 * \param num_bits Length of the data field
81 * \param out_data pointer to the data that will be sent out
82 * <em > (data is read when it is added to the JTAG queue)</em>
83 * \param in_data pointer to the memory that will receive data that was clocked in
84 * <em > (data is written when the JTAG queue is executed)</em>
85 * \param field target data structure that will be initialized
87 void arm11_setup_field(struct arm11_common
*arm11
, int num_bits
,
88 void *out_data
, void *in_data
, struct scan_field
*field
)
90 field
->tap
= arm11
->arm
.target
->tap
;
91 field
->num_bits
= num_bits
;
92 field
->out_value
= out_data
;
93 field
->in_value
= in_data
;
96 static const char *arm11_ir_to_string(uint8_t ir
)
98 const char *s
= "unknown";
129 /** Write JTAG instruction register
131 * \param arm11 Target state variable.
132 * \param instr An ARM11 DBGTAP instruction. Use enum #arm11_instructions.
133 * \param state Pass the final TAP state or ARM11_TAP_DEFAULT for the default value (Pause-IR).
135 * \remarks This adds to the JTAG command queue but does \em not execute it.
137 void arm11_add_IR(struct arm11_common
* arm11
, uint8_t instr
, tap_state_t state
)
139 struct jtag_tap
*tap
= arm11
->arm
.target
->tap
;
141 if (buf_get_u32(tap
->cur_instr
, 0, 5) == instr
)
143 JTAG_DEBUG("IR <= 0x%02x SKIPPED", instr
);
147 JTAG_DEBUG("IR <= %s (0x%02x)", arm11_ir_to_string(instr
), instr
);
149 struct scan_field field
;
151 arm11_setup_field(arm11
, 5, &instr
, NULL
, &field
);
153 arm11_add_ir_scan_vc(1, &field
, state
== ARM11_TAP_DEFAULT
? TAP_IRPAUSE
: state
);
156 /** Verify data shifted out from Scan Chain Register (SCREG). */
157 static void arm11_in_handler_SCAN_N(uint8_t *in_value
)
159 /* Don't expect JTAG layer to modify bits we didn't ask it to read */
160 uint8_t v
= *in_value
& 0x1F;
164 LOG_ERROR("'arm11 target' JTAG error SCREG OUT 0x%02x", v
);
165 jtag_set_error(ERROR_FAIL
);
169 /** Select and write to Scan Chain Register (SCREG)
171 * This function sets the instruction register to SCAN_N and writes
172 * the data register with the selected chain number.
174 * http://infocenter.arm.com/help/topic/com.arm.doc.ddi0301f/Cacbjhfg.html
176 * \param arm11 Target state variable.
177 * \param chain Scan chain that will be selected.
178 * \param state Pass the final TAP state or ARM11_TAP_DEFAULT for the default
181 * Changes the current scan chain if needed, transitions to the specified
182 * TAP state, and leaves the IR undefined.
184 * The chain takes effect when Update-DR is passed (usually when subsequently
185 * the INTEXT/EXTEST instructions are written).
187 * \warning (Obsolete) Using this twice in a row will \em fail. The first
188 * call will end in Pause-DR. The second call, due to the IR
189 * caching, will not go through Capture-DR when shifting in the
190 * new scan chain number. As a result the verification in
191 * arm11_in_handler_SCAN_N() must fail.
193 * \remarks This adds to the JTAG command queue but does \em not execute it.
196 int arm11_add_debug_SCAN_N(struct arm11_common
*arm11
,
197 uint8_t chain
, tap_state_t state
)
199 /* Don't needlessly switch the scan chain.
200 * NOTE: the ITRSEL instruction fakes SCREG changing;
201 * but leaves its actual value unchanged.
203 if (arm11
->jtag_info
.cur_scan_chain
== chain
) {
204 JTAG_DEBUG("SCREG <= %d SKIPPED", chain
);
205 return jtag_add_statemove((state
== ARM11_TAP_DEFAULT
)
206 ? TAP_DRPAUSE
: state
);
208 JTAG_DEBUG("SCREG <= %d", chain
);
210 arm11_add_IR(arm11
, ARM11_SCAN_N
, ARM11_TAP_DEFAULT
);
212 struct scan_field field
;
215 arm11_setup_field(arm11
, 5, &chain
, &tmp
, &field
);
217 arm11_add_dr_scan_vc(1, &field
, state
== ARM11_TAP_DEFAULT
? TAP_DRPAUSE
: state
);
219 jtag_execute_queue_noclear();
221 arm11_in_handler_SCAN_N(tmp
);
223 arm11
->jtag_info
.cur_scan_chain
= chain
;
225 return jtag_execute_queue();
229 * Queue a DR scan of the ITR register. Caller must have selected
230 * scan chain 4 (ITR), possibly using ITRSEL.
232 * \param arm11 Target state variable.
233 * \param inst An ARM11 processor instruction/opcode.
234 * \param flag Optional parameter to retrieve the Ready flag;
235 * this address will be written when the JTAG chain is scanned.
236 * \param state The TAP state to enter after the DR scan.
238 * Going through the TAP_DRUPDATE state writes ITR only if Ready was
239 * previously set. Only the Ready flag is readable by the scan.
241 * An instruction loaded into ITR is executed when going through the
242 * TAP_IDLE state only if Ready was previously set and the debug state
243 * is properly set up. Depending on the instruction, you may also need
244 * to ensure that the rDTR is ready before that Run-Test/Idle state.
246 static void arm11_add_debug_INST(struct arm11_common
* arm11
,
247 uint32_t inst
, uint8_t * flag
, tap_state_t state
)
249 JTAG_DEBUG("INST <= 0x%08x", (unsigned) inst
);
251 struct scan_field itr
[2];
253 arm11_setup_field(arm11
, 32, &inst
, NULL
, itr
+ 0);
254 arm11_setup_field(arm11
, 1, NULL
, flag
, itr
+ 1);
256 arm11_add_dr_scan_vc(ARRAY_SIZE(itr
), itr
, state
);
260 * Read and save the Debug Status and Control Register (DSCR).
262 * \param arm11 Target state variable.
263 * \return Error status; arm11->dscr is updated on success.
265 * \remarks This is a stand-alone function that executes the JTAG
266 * command queue. It does not require the ARM11 debug TAP to be
267 * in any particular state.
269 int arm11_read_DSCR(struct arm11_common
*arm11
)
273 retval
= arm11_add_debug_SCAN_N(arm11
, 0x01, ARM11_TAP_DEFAULT
);
274 if (retval
!= ERROR_OK
)
277 arm11_add_IR(arm11
, ARM11_INTEST
, ARM11_TAP_DEFAULT
);
280 struct scan_field chain1_field
;
282 arm11_setup_field(arm11
, 32, NULL
, &dscr
, &chain1_field
);
284 arm11_add_dr_scan_vc(1, &chain1_field
, TAP_DRPAUSE
);
286 CHECK_RETVAL(jtag_execute_queue());
288 if (arm11
->dscr
!= dscr
)
289 JTAG_DEBUG("DSCR = %08x (OLD %08x)",
291 (unsigned) arm11
->dscr
);
298 /** Write the Debug Status and Control Register (DSCR)
302 * \param arm11 Target state variable.
303 * \param dscr DSCR content
305 * \remarks This is a stand-alone function that executes the JTAG command queue.
307 int arm11_write_DSCR(struct arm11_common
* arm11
, uint32_t dscr
)
310 retval
= arm11_add_debug_SCAN_N(arm11
, 0x01, ARM11_TAP_DEFAULT
);
311 if (retval
!= ERROR_OK
)
314 arm11_add_IR(arm11
, ARM11_EXTEST
, ARM11_TAP_DEFAULT
);
316 struct scan_field chain1_field
;
318 arm11_setup_field(arm11
, 32, &dscr
, NULL
, &chain1_field
);
320 arm11_add_dr_scan_vc(1, &chain1_field
, TAP_DRPAUSE
);
322 CHECK_RETVAL(jtag_execute_queue());
324 JTAG_DEBUG("DSCR <= %08x (OLD %08x)",
326 (unsigned) arm11
->dscr
);
333 /** Prepare the stage for ITR/DTR operations
334 * from the arm11_run_instr... group of functions.
336 * Put arm11_run_instr_data_prepare() and arm11_run_instr_data_finish()
337 * around a block of arm11_run_instr_... calls.
339 * Select scan chain 5 to allow quick access to DTR. When scan
340 * chain 4 is needed to put in a register the ITRSel instruction
341 * shortcut is used instead of actually changing the Scan_N
344 * \param arm11 Target state variable.
347 int arm11_run_instr_data_prepare(struct arm11_common
* arm11
)
349 return arm11_add_debug_SCAN_N(arm11
, 0x05, ARM11_TAP_DEFAULT
);
352 /** Cleanup after ITR/DTR operations
353 * from the arm11_run_instr... group of functions
355 * Put arm11_run_instr_data_prepare() and arm11_run_instr_data_finish()
356 * around a block of arm11_run_instr_... calls.
358 * Any IDLE can lead to an instruction execution when
359 * scan chains 4 or 5 are selected and the IR holds
360 * INTEST or EXTEST. So we must disable that before
361 * any following activities lead to an IDLE.
363 * \param arm11 Target state variable.
366 int arm11_run_instr_data_finish(struct arm11_common
* arm11
)
368 return arm11_add_debug_SCAN_N(arm11
, 0x00, ARM11_TAP_DEFAULT
);
374 * Execute one or more instructions via ITR.
375 * Caller guarantees that processor is in debug state, that DSCR_ITR_EN
376 * is set, the ITR Ready flag is set (as seen on the previous entry to
377 * TAP_DRCAPTURE), and the DSCR sticky abort flag is clear.
379 * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block
381 * \param arm11 Target state variable.
382 * \param opcode Pointer to sequence of ARM opcodes
383 * \param count Number of opcodes to execute
387 int arm11_run_instr_no_data(struct arm11_common
* arm11
,
388 uint32_t * opcode
, size_t count
)
390 arm11_add_IR(arm11
, ARM11_ITRSEL
, ARM11_TAP_DEFAULT
);
394 arm11_add_debug_INST(arm11
, *opcode
++, NULL
, TAP_IDLE
);
401 arm11_add_debug_INST(arm11
, 0, &flag
, count
? TAP_IDLE
: TAP_DRPAUSE
);
403 CHECK_RETVAL(jtag_execute_queue());
416 if ((timeval_ms()-then
) > 1000)
418 LOG_WARNING("Timeout (1000ms) waiting for instructions to complete");
430 /** Execute one instruction via ITR
432 * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block
434 * \param arm11 Target state variable.
435 * \param opcode ARM opcode
438 int arm11_run_instr_no_data1(struct arm11_common
* arm11
, uint32_t opcode
)
440 return arm11_run_instr_no_data(arm11
, &opcode
, 1);
444 /** Execute one instruction via ITR repeatedly while
445 * passing data to the core via DTR on each execution.
447 * Caller guarantees that processor is in debug state, that DSCR_ITR_EN
448 * is set, the ITR Ready flag is set (as seen on the previous entry to
449 * TAP_DRCAPTURE), and the DSCR sticky abort flag is clear.
451 * The executed instruction \em must read data from DTR.
453 * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block
455 * \param arm11 Target state variable.
456 * \param opcode ARM opcode
457 * \param data Pointer to the data words to be passed to the core
458 * \param count Number of data words and instruction repetitions
461 int arm11_run_instr_data_to_core(struct arm11_common
* arm11
, uint32_t opcode
, uint32_t * data
, size_t count
)
463 arm11_add_IR(arm11
, ARM11_ITRSEL
, ARM11_TAP_DEFAULT
);
465 arm11_add_debug_INST(arm11
, opcode
, NULL
, TAP_DRPAUSE
);
467 arm11_add_IR(arm11
, ARM11_EXTEST
, ARM11_TAP_DEFAULT
);
469 struct scan_field chain5_fields
[3];
475 arm11_setup_field(arm11
, 32, &Data
, NULL
, chain5_fields
+ 0);
476 arm11_setup_field(arm11
, 1, NULL
, &Ready
, chain5_fields
+ 1);
477 arm11_setup_field(arm11
, 1, NULL
, &nRetry
, chain5_fields
+ 2);
486 arm11_add_dr_scan_vc(ARRAY_SIZE(chain5_fields
), chain5_fields
, jtag_set_end_state(TAP_IDLE
));
488 CHECK_RETVAL(jtag_execute_queue());
490 JTAG_DEBUG("DTR Ready %d nRetry %d", Ready
, nRetry
);
500 if ((timeval_ms()-then
) > 1000)
502 LOG_WARNING("Timeout (1000ms) waiting for instructions to complete");
514 arm11_add_IR(arm11
, ARM11_INTEST
, ARM11_TAP_DEFAULT
);
521 arm11_add_dr_scan_vc(ARRAY_SIZE(chain5_fields
), chain5_fields
, TAP_DRPAUSE
);
523 CHECK_RETVAL(jtag_execute_queue());
525 JTAG_DEBUG("DTR Data %08x Ready %d nRetry %d",
526 (unsigned) Data
, Ready
, nRetry
);
536 if ((timeval_ms()-then
) > 1000)
538 LOG_WARNING("Timeout (1000ms) waiting for instructions to complete");
550 /** JTAG path for arm11_run_instr_data_to_core_noack
552 * The repeated TAP_IDLE's do not cause a repeated execution
553 * if passed without leaving the state.
555 * Since this is more than 7 bits (adjustable via adding more
556 * TAP_IDLE's) it produces an artificial delay in the lower
557 * layer (FT2232) that is long enough to finish execution on
558 * the core but still shorter than any manually inducible delays.
560 * To disable this code, try "memwrite burst false"
562 * FIX!!! should we use multiple TAP_IDLE here or not???
564 * https://lists.berlios.de/pipermail/openocd-development/2009-July/009698.html
565 * https://lists.berlios.de/pipermail/openocd-development/2009-August/009865.html
567 static const tap_state_t arm11_MOVE_DRPAUSE_IDLE_DRPAUSE_with_delay
[] =
569 TAP_DREXIT2
, TAP_DRUPDATE
, TAP_IDLE
, TAP_IDLE
, TAP_IDLE
, TAP_DRSELECT
, TAP_DRCAPTURE
, TAP_DRSHIFT
572 /* This inner loop can be implemented by the minidriver, oftentimes in hardware... The
573 * minidriver can call the default implementation as a fallback or implement it
576 int arm11_run_instr_data_to_core_noack_inner_default(struct jtag_tap
* tap
, uint32_t opcode
, uint32_t * data
, size_t count
)
578 struct scan_field chain5_fields
[3];
580 chain5_fields
[0].tap
= tap
;
581 chain5_fields
[0].num_bits
= 32;
582 chain5_fields
[0].out_value
= NULL
; /*&Data*/
583 chain5_fields
[0].in_value
= NULL
;
585 chain5_fields
[1].tap
= tap
;
586 chain5_fields
[1].num_bits
= 1;
587 chain5_fields
[1].out_value
= NULL
;
588 chain5_fields
[1].in_value
= NULL
; /*&Ready*/
590 chain5_fields
[2].tap
= tap
;
591 chain5_fields
[2].num_bits
= 1;
592 chain5_fields
[2].out_value
= NULL
;
593 chain5_fields
[2].in_value
= NULL
;
596 unsigned readiesNum
= count
;
597 unsigned bytes
= sizeof(*Readies
)*readiesNum
;
599 Readies
= (uint8_t *) malloc(bytes
);
602 LOG_ERROR("Out of memory allocating %u bytes", bytes
);
606 uint8_t * ReadyPos
= Readies
;
609 chain5_fields
[0].out_value
= (void *)(data
++);
610 chain5_fields
[1].in_value
= ReadyPos
++;
614 jtag_add_dr_scan(ARRAY_SIZE(chain5_fields
), chain5_fields
, TAP_DRPAUSE
);
615 jtag_add_pathmove(ARRAY_SIZE(arm11_MOVE_DRPAUSE_IDLE_DRPAUSE_with_delay
),
616 arm11_MOVE_DRPAUSE_IDLE_DRPAUSE_with_delay
);
619 jtag_add_dr_scan(ARRAY_SIZE(chain5_fields
), chain5_fields
, TAP_IDLE
);
623 int retval
= jtag_execute_queue();
624 if (retval
== ERROR_OK
)
626 unsigned error_count
= 0;
628 for (size_t i
= 0; i
< readiesNum
; i
++)
636 if (error_count
> 0 )
638 LOG_ERROR("%u words out of %u not transferred",
639 error_count
, readiesNum
);
648 int arm11_run_instr_data_to_core_noack_inner(struct jtag_tap
* tap
, uint32_t opcode
, uint32_t * data
, size_t count
);
650 #ifndef HAVE_JTAG_MINIDRIVER_H
651 int arm11_run_instr_data_to_core_noack_inner(struct jtag_tap
* tap
, uint32_t opcode
, uint32_t * data
, size_t count
)
653 return arm11_run_instr_data_to_core_noack_inner_default(tap
, opcode
, data
, count
);
657 /** Execute one instruction via ITR repeatedly while
658 * passing data to the core via DTR on each execution.
660 * Caller guarantees that processor is in debug state, that DSCR_ITR_EN
661 * is set, the ITR Ready flag is set (as seen on the previous entry to
662 * TAP_DRCAPTURE), and the DSCR sticky abort flag is clear.
664 * No Ready check during transmission.
666 * The executed instruction \em must read data from DTR.
668 * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block
670 * \param arm11 Target state variable.
671 * \param opcode ARM opcode
672 * \param data Pointer to the data words to be passed to the core
673 * \param count Number of data words and instruction repetitions
676 int arm11_run_instr_data_to_core_noack(struct arm11_common
* arm11
, uint32_t opcode
, uint32_t * data
, size_t count
)
678 arm11_add_IR(arm11
, ARM11_ITRSEL
, ARM11_TAP_DEFAULT
);
680 arm11_add_debug_INST(arm11
, opcode
, NULL
, TAP_DRPAUSE
);
682 arm11_add_IR(arm11
, ARM11_EXTEST
, ARM11_TAP_DEFAULT
);
684 int retval
= arm11_run_instr_data_to_core_noack_inner(arm11
->arm
.target
->tap
, opcode
, data
, count
);
686 if (retval
!= ERROR_FAIL
)
689 arm11_add_IR(arm11
, ARM11_INTEST
, ARM11_TAP_DEFAULT
);
691 struct scan_field chain5_fields
[3];
693 arm11_setup_field(arm11
, 32, NULL
/*&Data*/, NULL
, chain5_fields
+ 0);
694 arm11_setup_field(arm11
, 1, NULL
, NULL
/*&Ready*/, chain5_fields
+ 1);
695 arm11_setup_field(arm11
, 1, NULL
, NULL
, chain5_fields
+ 2);
698 chain5_fields
[1].in_value
= &ready_flag
;
700 arm11_add_dr_scan_vc(ARRAY_SIZE(chain5_fields
), chain5_fields
, TAP_DRPAUSE
);
702 retval
= jtag_execute_queue();
703 if (retval
== ERROR_OK
)
707 LOG_ERROR("last word not transferred");
716 /** Execute an instruction via ITR while handing data into the core via DTR.
718 * The executed instruction \em must read data from DTR.
720 * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block
722 * \param arm11 Target state variable.
723 * \param opcode ARM opcode
724 * \param data Data word to be passed to the core via DTR
727 int arm11_run_instr_data_to_core1(struct arm11_common
* arm11
, uint32_t opcode
, uint32_t data
)
729 return arm11_run_instr_data_to_core(arm11
, opcode
, &data
, 1);
733 /** Execute one instruction via ITR repeatedly while
734 * reading data from the core via DTR on each execution.
736 * Caller guarantees that processor is in debug state, that DSCR_ITR_EN
737 * is set, the ITR Ready flag is set (as seen on the previous entry to
738 * TAP_DRCAPTURE), and the DSCR sticky abort flag is clear.
740 * The executed instruction \em must write data to DTR.
742 * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block
744 * \param arm11 Target state variable.
745 * \param opcode ARM opcode
746 * \param data Pointer to an array that receives the data words from the core
747 * \param count Number of data words and instruction repetitions
750 int arm11_run_instr_data_from_core(struct arm11_common
* arm11
, uint32_t opcode
, uint32_t * data
, size_t count
)
752 arm11_add_IR(arm11
, ARM11_ITRSEL
, ARM11_TAP_DEFAULT
);
754 arm11_add_debug_INST(arm11
, opcode
, NULL
, TAP_IDLE
);
756 arm11_add_IR(arm11
, ARM11_INTEST
, ARM11_TAP_DEFAULT
);
758 struct scan_field chain5_fields
[3];
764 arm11_setup_field(arm11
, 32, NULL
, &Data
, chain5_fields
+ 0);
765 arm11_setup_field(arm11
, 1, NULL
, &Ready
, chain5_fields
+ 1);
766 arm11_setup_field(arm11
, 1, NULL
, &nRetry
, chain5_fields
+ 2);
773 arm11_add_dr_scan_vc(ARRAY_SIZE(chain5_fields
), chain5_fields
, count
? TAP_IDLE
: TAP_DRPAUSE
);
775 CHECK_RETVAL(jtag_execute_queue());
777 JTAG_DEBUG("DTR Data %08x Ready %d nRetry %d",
778 (unsigned) Data
, Ready
, nRetry
);
788 if ((timeval_ms()-then
) > 1000)
790 LOG_WARNING("Timeout (1000ms) waiting for instructions to complete");
805 /** Execute one instruction via ITR
806 * then load r0 into DTR and read DTR from core.
808 * The first executed instruction (\p opcode) should write data to r0.
810 * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block
812 * \param arm11 Target state variable.
813 * \param opcode ARM opcode to write r0 with the value of interest
814 * \param data Pointer to a data word that receives the value from r0 after \p opcode was executed.
817 int arm11_run_instr_data_from_core_via_r0(struct arm11_common
* arm11
, uint32_t opcode
, uint32_t * data
)
820 retval
= arm11_run_instr_no_data1(arm11
, opcode
);
821 if (retval
!= ERROR_OK
)
824 /* MCR p14,0,R0,c0,c5,0 (move r0 -> wDTR -> local var) */
825 arm11_run_instr_data_from_core(arm11
, 0xEE000E15, data
, 1);
830 /** Load data into core via DTR then move it to r0 then
831 * execute one instruction via ITR
833 * The final executed instruction (\p opcode) should read data from r0.
835 * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block
837 * \param arm11 Target state variable.
838 * \param opcode ARM opcode to read r0 act upon it
839 * \param data Data word that will be written to r0 before \p opcode is executed
842 int arm11_run_instr_data_to_core_via_r0(struct arm11_common
* arm11
, uint32_t opcode
, uint32_t data
)
845 /* MRC p14,0,r0,c0,c5,0 */
846 retval
= arm11_run_instr_data_to_core1(arm11
, 0xEE100E15, data
);
847 if (retval
!= ERROR_OK
)
850 retval
= arm11_run_instr_no_data1(arm11
, opcode
);
851 if (retval
!= ERROR_OK
)
857 /** Apply reads and writes to scan chain 7
859 * \see struct arm11_sc7_action
861 * \param arm11 Target state variable.
862 * \param actions A list of read and/or write instructions
863 * \param count Number of instructions in the list.
866 int arm11_sc7_run(struct arm11_common
* arm11
, struct arm11_sc7_action
* actions
, size_t count
)
870 retval
= arm11_add_debug_SCAN_N(arm11
, 0x07, ARM11_TAP_DEFAULT
);
871 if (retval
!= ERROR_OK
)
874 arm11_add_IR(arm11
, ARM11_EXTEST
, ARM11_TAP_DEFAULT
);
876 struct scan_field chain7_fields
[3];
885 arm11_setup_field(arm11
, 1, &nRW
, &Ready
, chain7_fields
+ 0);
886 arm11_setup_field(arm11
, 32, &DataOut
, &DataIn
, chain7_fields
+ 1);
887 arm11_setup_field(arm11
, 7, &AddressOut
, &AddressIn
, chain7_fields
+ 2);
889 for (size_t i
= 0; i
< count
+ 1; i
++)
893 nRW
= actions
[i
].write
? 1 : 0;
894 DataOut
= actions
[i
].value
;
895 AddressOut
= actions
[i
].address
;
904 /* Timeout here so we don't get stuck. */
908 JTAG_DEBUG("SC7 <= c%-3d Data %08x %s",
909 (unsigned) AddressOut
,
911 nRW
? "write" : "read");
913 arm11_add_dr_scan_vc(ARRAY_SIZE(chain7_fields
),
914 chain7_fields
, TAP_DRPAUSE
);
916 CHECK_RETVAL(jtag_execute_queue());
918 /* 'nRW' is 'Ready' on read out */
930 if ((timeval_ms()-then
) > 1000)
932 LOG_WARNING("Timeout (1000ms) waiting for instructions to complete");
941 JTAG_DEBUG("SC7 => Data %08x", (unsigned) DataIn
);
945 if (actions
[i
- 1].address
!= AddressIn
)
947 LOG_WARNING("Scan chain 7 shifted out unexpected address");
950 if (!actions
[i
- 1].write
)
952 actions
[i
- 1].value
= DataIn
;
956 if (actions
[i
- 1].value
!= DataIn
)
958 LOG_WARNING("Scan chain 7 shifted out unexpected data");
966 /** Clear VCR and all breakpoints and watchpoints via scan chain 7
968 * \param arm11 Target state variable.
971 void arm11_sc7_clear_vbw(struct arm11_common
* arm11
)
973 size_t clear_bw_size
= arm11
->brp
+ 1;
974 struct arm11_sc7_action
*clear_bw
= malloc(sizeof(struct arm11_sc7_action
) * clear_bw_size
);
975 struct arm11_sc7_action
* pos
= clear_bw
;
977 for (size_t i
= 0; i
< clear_bw_size
; i
++)
979 clear_bw
[i
].write
= true;
980 clear_bw
[i
].value
= 0;
983 for (size_t i
= 0; i
< arm11
->brp
; i
++)
984 (pos
++)->address
= ARM11_SC7_BCR0
+ i
;
986 (pos
++)->address
= ARM11_SC7_VCR
;
988 arm11_sc7_run(arm11
, clear_bw
, clear_bw_size
);
993 /** Write VCR register
995 * \param arm11 Target state variable.
996 * \param value Value to be written
998 void arm11_sc7_set_vcr(struct arm11_common
* arm11
, uint32_t value
)
1000 struct arm11_sc7_action set_vcr
;
1002 set_vcr
.write
= true;
1003 set_vcr
.address
= ARM11_SC7_VCR
;
1004 set_vcr
.value
= value
;
1006 arm11_sc7_run(arm11
, &set_vcr
, 1);
1011 /** Read word from address
1013 * \param arm11 Target state variable.
1014 * \param address Memory address to be read
1015 * \param result Pointer where to store result
1018 int arm11_read_memory_word(struct arm11_common
* arm11
, uint32_t address
, uint32_t * result
)
1021 retval
= arm11_run_instr_data_prepare(arm11
);
1022 if (retval
!= ERROR_OK
)
1025 /* MRC p14,0,r0,c0,c5,0 (r0 = address) */
1026 CHECK_RETVAL(arm11_run_instr_data_to_core1(arm11
, 0xee100e15, address
));
1028 /* LDC p14,c5,[R0],#4 (DTR = [r0]) */
1029 CHECK_RETVAL(arm11_run_instr_data_from_core(arm11
, 0xecb05e01, result
, 1));
1031 return arm11_run_instr_data_finish(arm11
);
1035 /************************************************************************/
1038 * ARM11 provider for the OpenOCD implementation of the standard
1039 * architectural ARM v6/v7 "Debug Programmer's Model" (DPM).
1042 static inline struct arm11_common
*dpm_to_arm11(struct arm_dpm
*dpm
)
1044 return container_of(dpm
, struct arm11_common
, dpm
);
1047 static int arm11_dpm_prepare(struct arm_dpm
*dpm
)
1049 struct arm11_common
*arm11
= dpm_to_arm11(dpm
);
1051 arm11
= container_of(dpm
->arm
, struct arm11_common
, arm
);
1053 return arm11_run_instr_data_prepare(dpm_to_arm11(dpm
));
1056 static int arm11_dpm_finish(struct arm_dpm
*dpm
)
1058 return arm11_run_instr_data_finish(dpm_to_arm11(dpm
));
1061 static int arm11_dpm_instr_write_data_dcc(struct arm_dpm
*dpm
,
1062 uint32_t opcode
, uint32_t data
)
1064 return arm11_run_instr_data_to_core(dpm_to_arm11(dpm
),
1068 static int arm11_dpm_instr_write_data_r0(struct arm_dpm
*dpm
,
1069 uint32_t opcode
, uint32_t data
)
1071 return arm11_run_instr_data_to_core_via_r0(dpm_to_arm11(dpm
),
1075 static int arm11_dpm_instr_read_data_dcc(struct arm_dpm
*dpm
,
1076 uint32_t opcode
, uint32_t *data
)
1078 return arm11_run_instr_data_from_core(dpm_to_arm11(dpm
),
1082 static int arm11_dpm_instr_read_data_r0(struct arm_dpm
*dpm
,
1083 uint32_t opcode
, uint32_t *data
)
1085 return arm11_run_instr_data_from_core_via_r0(dpm_to_arm11(dpm
),
1089 /* Because arm11_sc7_run() takes a vector of actions, we batch breakpoint
1090 * and watchpoint operations instead of running them right away. Since we
1091 * pre-allocated our vector, we don't need to worry about space.
1093 static int arm11_bpwp_enable(struct arm_dpm
*dpm
, unsigned index
,
1094 uint32_t addr
, uint32_t control
)
1096 struct arm11_common
*arm11
= dpm_to_arm11(dpm
);
1097 struct arm11_sc7_action
*action
;
1099 action
= arm11
->bpwp_actions
+ arm11
->bpwp_n
;
1101 /* Invariant: this bp/wp is disabled.
1102 * It also happens that the core is halted here, but for
1103 * DPM-based cores we don't actually care about that.
1106 action
[0].write
= action
[1].write
= true;
1108 action
[0].value
= addr
;
1109 action
[1].value
= control
;
1113 action
[0].address
= ARM11_SC7_BVR0
+ index
;
1114 action
[1].address
= ARM11_SC7_BCR0
+ index
;
1118 action
[0].address
= ARM11_SC7_WVR0
+ index
;
1119 action
[1].address
= ARM11_SC7_WCR0
+ index
;
1130 static int arm11_bpwp_disable(struct arm_dpm
*dpm
, unsigned index
)
1132 struct arm11_common
*arm11
= dpm_to_arm11(dpm
);
1133 struct arm11_sc7_action
*action
;
1135 action
= arm11
->bpwp_actions
+ arm11
->bpwp_n
;
1137 action
[0].write
= true;
1138 action
[0].value
= 0;
1142 action
[0].address
= ARM11_SC7_BCR0
+ index
;
1146 action
[0].address
= ARM11_SC7_WCR0
+ index
;
1157 /** Flush any pending breakpoint and watchpoint updates. */
1158 int arm11_bpwp_flush(struct arm11_common
*arm11
)
1165 retval
= arm11_sc7_run(arm11
, arm11
->bpwp_actions
, arm11
->bpwp_n
);
1171 /** Set up high-level debug module utilities */
1172 int arm11_dpm_init(struct arm11_common
*arm11
, uint32_t didr
)
1174 struct arm_dpm
*dpm
= &arm11
->dpm
;
1177 dpm
->arm
= &arm11
->arm
;
1181 dpm
->prepare
= arm11_dpm_prepare
;
1182 dpm
->finish
= arm11_dpm_finish
;
1184 dpm
->instr_write_data_dcc
= arm11_dpm_instr_write_data_dcc
;
1185 dpm
->instr_write_data_r0
= arm11_dpm_instr_write_data_r0
;
1187 dpm
->instr_read_data_dcc
= arm11_dpm_instr_read_data_dcc
;
1188 dpm
->instr_read_data_r0
= arm11_dpm_instr_read_data_r0
;
1190 dpm
->bpwp_enable
= arm11_bpwp_enable
;
1191 dpm
->bpwp_disable
= arm11_bpwp_disable
;
1193 retval
= arm_dpm_setup(dpm
);
1194 if (retval
!= ERROR_OK
)
1197 /* alloc enough to enable all breakpoints and watchpoints at once */
1198 arm11
->bpwp_actions
= calloc(2 * (dpm
->nbp
+ dpm
->nwp
),
1199 sizeof *arm11
->bpwp_actions
);
1200 if (!arm11
->bpwp_actions
)
1203 retval
= arm_dpm_initialize(dpm
);
1204 if (retval
!= ERROR_OK
)
1207 return arm11_bpwp_flush(arm11
);