1 /***************************************************************************
2 * Copyright (C) 2005 by Dominic Rath *
3 * Dominic.Rath@gmx.de *
5 * Copyright (C) 2008 by Spencer Oliver *
6 * spen@spen-soft.co.uk *
8 * Copyright (C) 2008 by Oyvind Harboe *
9 * oyvind.harboe@zylin.com *
11 * This program is free software; you can redistribute it and/or modify *
12 * it under the terms of the GNU General Public License as published by *
13 * the Free Software Foundation; either version 2 of the License, or *
14 * (at your option) any later version. *
16 * This program is distributed in the hope that it will be useful, *
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
19 * GNU General Public License for more details. *
21 * You should have received a copy of the GNU General Public License *
22 * along with this program; if not, write to the *
23 * Free Software Foundation, Inc., *
24 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
25 ***************************************************************************/
34 #include "breakpoints.h"
35 #include "arm_disassembler.h"
36 #include <helper/binarybuffer.h>
37 #include "algorithm.h"
40 /* offsets into armv4_5 core register cache */
42 /* ARMV4_5_CPSR = 31, */
43 ARMV4_5_SPSR_FIQ
= 32,
44 ARMV4_5_SPSR_IRQ
= 33,
45 ARMV4_5_SPSR_SVC
= 34,
46 ARMV4_5_SPSR_ABT
= 35,
47 ARMV4_5_SPSR_UND
= 36,
51 static const uint8_t arm_usr_indices
[17] = {
52 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, ARMV4_5_CPSR
,
55 static const uint8_t arm_fiq_indices
[8] = {
56 16, 17, 18, 19, 20, 21, 22, ARMV4_5_SPSR_FIQ
,
59 static const uint8_t arm_irq_indices
[3] = {
60 23, 24, ARMV4_5_SPSR_IRQ
,
63 static const uint8_t arm_svc_indices
[3] = {
64 25, 26, ARMV4_5_SPSR_SVC
,
67 static const uint8_t arm_abt_indices
[3] = {
68 27, 28, ARMV4_5_SPSR_ABT
,
71 static const uint8_t arm_und_indices
[3] = {
72 29, 30, ARMV4_5_SPSR_UND
,
75 static const uint8_t arm_mon_indices
[3] = {
82 /* For user and system modes, these list indices for all registers.
83 * otherwise they're just indices for the shadow registers and SPSR.
85 unsigned short n_indices
;
86 const uint8_t *indices
;
88 /* Seven modes are standard from ARM7 on. "System" and "User" share
89 * the same registers; other modes shadow from 3 to 8 registers.
94 .n_indices
= ARRAY_SIZE(arm_usr_indices
),
95 .indices
= arm_usr_indices
,
100 .n_indices
= ARRAY_SIZE(arm_fiq_indices
),
101 .indices
= arm_fiq_indices
,
104 .name
= "Supervisor",
106 .n_indices
= ARRAY_SIZE(arm_svc_indices
),
107 .indices
= arm_svc_indices
,
112 .n_indices
= ARRAY_SIZE(arm_abt_indices
),
113 .indices
= arm_abt_indices
,
118 .n_indices
= ARRAY_SIZE(arm_irq_indices
),
119 .indices
= arm_irq_indices
,
122 .name
= "Undefined instruction",
124 .n_indices
= ARRAY_SIZE(arm_und_indices
),
125 .indices
= arm_und_indices
,
130 .n_indices
= ARRAY_SIZE(arm_usr_indices
),
131 .indices
= arm_usr_indices
,
133 /* TrustZone "Security Extensions" add a secure monitor mode.
134 * This is distinct from a "debug monitor" which can support
135 * non-halting debug, in conjunction with some debuggers.
138 .name
= "Secure Monitor",
140 .n_indices
= ARRAY_SIZE(arm_mon_indices
),
141 .indices
= arm_mon_indices
,
145 /** Map PSR mode bits to the name of an ARM processor operating mode. */
146 const char *arm_mode_name(unsigned psr_mode
)
148 for (unsigned i
= 0; i
< ARRAY_SIZE(arm_mode_data
); i
++) {
149 if (arm_mode_data
[i
].psr
== psr_mode
)
150 return arm_mode_data
[i
].name
;
152 LOG_ERROR("unrecognized psr mode: %#02x", psr_mode
);
153 return "UNRECOGNIZED";
156 /** Return true iff the parameter denotes a valid ARM processor mode. */
157 bool is_arm_mode(unsigned psr_mode
)
159 for (unsigned i
= 0; i
< ARRAY_SIZE(arm_mode_data
); i
++) {
160 if (arm_mode_data
[i
].psr
== psr_mode
)
166 /** Map PSR mode bits to linear number indexing armv4_5_core_reg_map */
167 int arm_mode_to_number(enum arm_mode mode
)
171 /* map MODE_ANY to user mode */
189 LOG_ERROR("invalid mode value encountered %d", mode
);
194 /** Map linear number indexing armv4_5_core_reg_map to PSR mode bits. */
195 enum arm_mode
armv4_5_number_to_mode(int number
)
215 LOG_ERROR("mode index out of bounds %d", number
);
220 static const char *arm_state_strings
[] = {
221 "ARM", "Thumb", "Jazelle", "ThumbEE",
224 /* Templates for ARM core registers.
226 * NOTE: offsets in this table are coupled to the arm_mode_data
227 * table above, the armv4_5_core_reg_map array below, and also to
228 * the ARMV4_5_CPSR symbol (which should vanish after ARM11 updates).
230 static const struct {
231 /* The name is used for e.g. the "regs" command. */
234 /* The {cookie, mode} tuple uniquely identifies one register.
235 * In a given mode, cookies 0..15 map to registers R0..R15,
236 * with R13..R15 usually called SP, LR, PC.
238 * MODE_ANY is used as *input* to the mapping, and indicates
239 * various special cases (sigh) and errors.
241 * Cookie 16 is (currently) confusing, since it indicates
242 * CPSR -or- SPSR depending on whether 'mode' is MODE_ANY.
243 * (Exception modes have both CPSR and SPSR registers ...)
247 } arm_core_regs
[] = {
248 /* IMPORTANT: we guarantee that the first eight cached registers
249 * correspond to r0..r7, and the fifteenth to PC, so that callers
250 * don't need to map them.
252 { .name
= "r0", .cookie
= 0, .mode
= ARM_MODE_ANY
, },
253 { .name
= "r1", .cookie
= 1, .mode
= ARM_MODE_ANY
, },
254 { .name
= "r2", .cookie
= 2, .mode
= ARM_MODE_ANY
, },
255 { .name
= "r3", .cookie
= 3, .mode
= ARM_MODE_ANY
, },
256 { .name
= "r4", .cookie
= 4, .mode
= ARM_MODE_ANY
, },
257 { .name
= "r5", .cookie
= 5, .mode
= ARM_MODE_ANY
, },
258 { .name
= "r6", .cookie
= 6, .mode
= ARM_MODE_ANY
, },
259 { .name
= "r7", .cookie
= 7, .mode
= ARM_MODE_ANY
, },
261 /* NOTE: regs 8..12 might be shadowed by FIQ ... flagging
262 * them as MODE_ANY creates special cases. (ANY means
263 * "not mapped" elsewhere; here it's "everything but FIQ".)
265 { .name
= "r8", .cookie
= 8, .mode
= ARM_MODE_ANY
, },
266 { .name
= "r9", .cookie
= 9, .mode
= ARM_MODE_ANY
, },
267 { .name
= "r10", .cookie
= 10, .mode
= ARM_MODE_ANY
, },
268 { .name
= "r11", .cookie
= 11, .mode
= ARM_MODE_ANY
, },
269 { .name
= "r12", .cookie
= 12, .mode
= ARM_MODE_ANY
, },
271 /* NOTE all MODE_USR registers are equivalent to MODE_SYS ones */
272 { .name
= "sp_usr", .cookie
= 13, .mode
= ARM_MODE_USR
, },
273 { .name
= "lr_usr", .cookie
= 14, .mode
= ARM_MODE_USR
, },
275 /* guaranteed to be at index 15 */
276 { .name
= "pc", .cookie
= 15, .mode
= ARM_MODE_ANY
, },
278 { .name
= "r8_fiq", .cookie
= 8, .mode
= ARM_MODE_FIQ
, },
279 { .name
= "r9_fiq", .cookie
= 9, .mode
= ARM_MODE_FIQ
, },
280 { .name
= "r10_fiq", .cookie
= 10, .mode
= ARM_MODE_FIQ
, },
281 { .name
= "r11_fiq", .cookie
= 11, .mode
= ARM_MODE_FIQ
, },
282 { .name
= "r12_fiq", .cookie
= 12, .mode
= ARM_MODE_FIQ
, },
284 { .name
= "sp_fiq", .cookie
= 13, .mode
= ARM_MODE_FIQ
, },
285 { .name
= "lr_fiq", .cookie
= 14, .mode
= ARM_MODE_FIQ
, },
287 { .name
= "sp_irq", .cookie
= 13, .mode
= ARM_MODE_IRQ
, },
288 { .name
= "lr_irq", .cookie
= 14, .mode
= ARM_MODE_IRQ
, },
290 { .name
= "sp_svc", .cookie
= 13, .mode
= ARM_MODE_SVC
, },
291 { .name
= "lr_svc", .cookie
= 14, .mode
= ARM_MODE_SVC
, },
293 { .name
= "sp_abt", .cookie
= 13, .mode
= ARM_MODE_ABT
, },
294 { .name
= "lr_abt", .cookie
= 14, .mode
= ARM_MODE_ABT
, },
296 { .name
= "sp_und", .cookie
= 13, .mode
= ARM_MODE_UND
, },
297 { .name
= "lr_und", .cookie
= 14, .mode
= ARM_MODE_UND
, },
299 { .name
= "cpsr", .cookie
= 16, .mode
= ARM_MODE_ANY
, },
300 { .name
= "spsr_fiq", .cookie
= 16, .mode
= ARM_MODE_FIQ
, },
301 { .name
= "spsr_irq", .cookie
= 16, .mode
= ARM_MODE_IRQ
, },
302 { .name
= "spsr_svc", .cookie
= 16, .mode
= ARM_MODE_SVC
, },
303 { .name
= "spsr_abt", .cookie
= 16, .mode
= ARM_MODE_ABT
, },
304 { .name
= "spsr_und", .cookie
= 16, .mode
= ARM_MODE_UND
, },
306 { .name
= "sp_mon", .cookie
= 13, .mode
= ARM_MODE_MON
, },
307 { .name
= "lr_mon", .cookie
= 14, .mode
= ARM_MODE_MON
, },
308 { .name
= "spsr_mon", .cookie
= 16, .mode
= ARM_MODE_MON
, },
311 /* map core mode (USR, FIQ, ...) and register number to
312 * indices into the register cache
314 const int armv4_5_core_reg_map
[8][17] = {
316 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 31
318 { /* FIQ (8 shadows of USR, vs normal 3) */
319 0, 1, 2, 3, 4, 5, 6, 7, 16, 17, 18, 19, 20, 21, 22, 15, 32
322 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 23, 24, 15, 33
325 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 25, 26, 15, 34
328 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 27, 28, 15, 35
331 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 29, 30, 15, 36
333 { /* SYS (same registers as USR) */
334 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 31
337 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 37, 38, 15, 39,
342 * Configures host-side ARM records to reflect the specified CPSR.
343 * Later, code can use arm_reg_current() to map register numbers
344 * according to how they are exposed by this mode.
346 void arm_set_cpsr(struct arm
*arm
, uint32_t cpsr
)
348 enum arm_mode mode
= cpsr
& 0x1f;
351 /* NOTE: this may be called very early, before the register
352 * cache is set up. We can't defend against many errors, in
353 * particular against CPSRs that aren't valid *here* ...
356 buf_set_u32(arm
->cpsr
->value
, 0, 32, cpsr
);
357 arm
->cpsr
->valid
= 1;
358 arm
->cpsr
->dirty
= 0;
361 arm
->core_mode
= mode
;
363 /* mode_to_number() warned; set up a somewhat-sane mapping */
364 num
= arm_mode_to_number(mode
);
370 arm
->map
= &armv4_5_core_reg_map
[num
][0];
371 arm
->spsr
= (mode
== ARM_MODE_USR
|| mode
== ARM_MODE_SYS
)
373 : arm
->core_cache
->reg_list
+ arm
->map
[16];
375 /* Older ARMs won't have the J bit */
376 enum arm_state state
;
378 if (cpsr
& (1 << 5)) { /* T */
379 if (cpsr
& (1 << 24)) { /* J */
380 LOG_WARNING("ThumbEE -- incomplete support");
381 state
= ARM_STATE_THUMB_EE
;
383 state
= ARM_STATE_THUMB
;
385 if (cpsr
& (1 << 24)) { /* J */
386 LOG_ERROR("Jazelle state handling is BROKEN!");
387 state
= ARM_STATE_JAZELLE
;
389 state
= ARM_STATE_ARM
;
391 arm
->core_state
= state
;
393 LOG_DEBUG("set CPSR %#8.8x: %s mode, %s state", (unsigned) cpsr
,
395 arm_state_strings
[arm
->core_state
]);
399 * Returns handle to the register currently mapped to a given number.
400 * Someone must have called arm_set_cpsr() before.
402 * \param arm This core's state and registers are used.
403 * \param regnum From 0..15 corresponding to R0..R14 and PC.
404 * Note that R0..R7 don't require mapping; you may access those
405 * as the first eight entries in the register cache. Likewise
406 * R15 (PC) doesn't need mapping; you may also access it directly.
407 * However, R8..R14, and SPSR (arm->spsr) *must* be mapped.
408 * CPSR (arm->cpsr) is also not mapped.
410 struct reg
*arm_reg_current(struct arm
*arm
, unsigned regnum
)
417 r
= arm
->core_cache
->reg_list
+ arm
->map
[regnum
];
419 /* e.g. invalid CPSR said "secure monitor" mode on a core
420 * that doesn't support it...
423 LOG_ERROR("Invalid CPSR mode");
424 r
= arm
->core_cache
->reg_list
+ regnum
;
430 static const uint8_t arm_gdb_dummy_fp_value
[12];
433 * Dummy FPA registers are required to support GDB on ARM.
434 * Register packets require eight obsolete FPA register values.
435 * Modern ARM cores use Vector Floating Point (VFP), if they
436 * have any floating point support. VFP is not FPA-compatible.
438 struct reg arm_gdb_dummy_fp_reg
= {
439 .name
= "GDB dummy FPA register",
440 .value
= (uint8_t *) arm_gdb_dummy_fp_value
,
445 static const uint8_t arm_gdb_dummy_fps_value
[4];
448 * Dummy FPA status registers are required to support GDB on ARM.
449 * Register packets require an obsolete FPA status register.
451 struct reg arm_gdb_dummy_fps_reg
= {
452 .name
= "GDB dummy FPA status register",
453 .value
= (uint8_t *) arm_gdb_dummy_fps_value
,
458 static void arm_gdb_dummy_init(void) __attribute__ ((constructor
));
460 static void arm_gdb_dummy_init(void)
462 register_init_dummy(&arm_gdb_dummy_fp_reg
);
463 register_init_dummy(&arm_gdb_dummy_fps_reg
);
466 static int armv4_5_get_core_reg(struct reg
*reg
)
469 struct arm_reg
*reg_arch_info
= reg
->arch_info
;
470 struct target
*target
= reg_arch_info
->target
;
472 if (target
->state
!= TARGET_HALTED
) {
473 LOG_ERROR("Target not halted");
474 return ERROR_TARGET_NOT_HALTED
;
477 retval
= reg_arch_info
->arm
->read_core_reg(target
, reg
,
478 reg_arch_info
->num
, reg_arch_info
->mode
);
479 if (retval
== ERROR_OK
) {
487 static int armv4_5_set_core_reg(struct reg
*reg
, uint8_t *buf
)
489 struct arm_reg
*reg_arch_info
= reg
->arch_info
;
490 struct target
*target
= reg_arch_info
->target
;
491 struct arm
*armv4_5_target
= target_to_arm(target
);
492 uint32_t value
= buf_get_u32(buf
, 0, 32);
494 if (target
->state
!= TARGET_HALTED
) {
495 LOG_ERROR("Target not halted");
496 return ERROR_TARGET_NOT_HALTED
;
499 /* Except for CPSR, the "reg" command exposes a writeback model
500 * for the register cache.
502 if (reg
== armv4_5_target
->cpsr
) {
503 arm_set_cpsr(armv4_5_target
, value
);
505 /* Older cores need help to be in ARM mode during halt
506 * mode debug, so we clear the J and T bits if we flush.
507 * For newer cores (v6/v7a/v7r) we don't need that, but
508 * it won't hurt since CPSR is always flushed anyway.
510 if (armv4_5_target
->core_mode
!=
511 (enum arm_mode
)(value
& 0x1f)) {
512 LOG_DEBUG("changing ARM core mode to '%s'",
513 arm_mode_name(value
& 0x1f));
514 value
&= ~((1 << 24) | (1 << 5));
515 armv4_5_target
->write_core_reg(target
, reg
,
516 16, ARM_MODE_ANY
, value
);
519 buf_set_u32(reg
->value
, 0, 32, value
);
527 static const struct reg_arch_type arm_reg_type
= {
528 .get
= armv4_5_get_core_reg
,
529 .set
= armv4_5_set_core_reg
,
532 struct reg_cache
*arm_build_reg_cache(struct target
*target
, struct arm
*arm
)
534 int num_regs
= ARRAY_SIZE(arm_core_regs
);
535 struct reg_cache
*cache
= malloc(sizeof(struct reg_cache
));
536 struct reg
*reg_list
= calloc(num_regs
, sizeof(struct reg
));
537 struct arm_reg
*reg_arch_info
= calloc(num_regs
, sizeof(struct arm_reg
));
540 if (!cache
|| !reg_list
|| !reg_arch_info
) {
547 cache
->name
= "ARM registers";
549 cache
->reg_list
= reg_list
;
552 for (i
= 0; i
< num_regs
; i
++) {
553 /* Skip registers this core doesn't expose */
554 if (arm_core_regs
[i
].mode
== ARM_MODE_MON
555 && arm
->core_type
!= ARM_MODE_MON
)
558 /* REVISIT handle Cortex-M, which only shadows R13/SP */
560 reg_arch_info
[i
].num
= arm_core_regs
[i
].cookie
;
561 reg_arch_info
[i
].mode
= arm_core_regs
[i
].mode
;
562 reg_arch_info
[i
].target
= target
;
563 reg_arch_info
[i
].arm
= arm
;
565 reg_list
[i
].name
= (char *) arm_core_regs
[i
].name
;
566 reg_list
[i
].size
= 32;
567 reg_list
[i
].value
= ®_arch_info
[i
].value
;
568 reg_list
[i
].type
= &arm_reg_type
;
569 reg_list
[i
].arch_info
= ®_arch_info
[i
];
574 arm
->pc
= reg_list
+ 15;
575 arm
->cpsr
= reg_list
+ ARMV4_5_CPSR
;
576 arm
->core_cache
= cache
;
580 int arm_arch_state(struct target
*target
)
582 struct arm
*arm
= target_to_arm(target
);
584 if (arm
->common_magic
!= ARM_COMMON_MAGIC
) {
585 LOG_ERROR("BUG: called for a non-ARM target");
589 LOG_USER("target halted in %s state due to %s, current mode: %s\n"
590 "cpsr: 0x%8.8" PRIx32
" pc: 0x%8.8" PRIx32
"%s",
591 arm_state_strings
[arm
->core_state
],
592 debug_reason_name(target
),
593 arm_mode_name(arm
->core_mode
),
594 buf_get_u32(arm
->cpsr
->value
, 0, 32),
595 buf_get_u32(arm
->pc
->value
, 0, 32),
596 arm
->is_semihosting
? ", semihosting" : "");
601 #define ARMV4_5_CORE_REG_MODENUM(cache, mode, num) \
602 (cache->reg_list[armv4_5_core_reg_map[mode][num]])
604 COMMAND_HANDLER(handle_armv4_5_reg_command
)
606 struct target
*target
= get_current_target(CMD_CTX
);
607 struct arm
*arm
= target_to_arm(target
);
611 command_print(CMD_CTX
, "current target isn't an ARM");
615 if (target
->state
!= TARGET_HALTED
) {
616 command_print(CMD_CTX
, "error: target must be halted for register accesses");
620 if (arm
->core_type
!= ARM_MODE_ANY
) {
621 command_print(CMD_CTX
,
622 "Microcontroller Profile not supported - use standard reg cmd");
626 if (!is_arm_mode(arm
->core_mode
)) {
627 LOG_ERROR("not a valid arm core mode - communication failure?");
631 if (!arm
->full_context
) {
632 command_print(CMD_CTX
, "error: target doesn't support %s",
637 regs
= arm
->core_cache
->reg_list
;
639 for (unsigned mode
= 0; mode
< ARRAY_SIZE(arm_mode_data
); mode
++) {
644 /* label this bank of registers (or shadows) */
645 switch (arm_mode_data
[mode
].psr
) {
649 name
= "System and User";
653 if (arm
->core_type
!= ARM_MODE_MON
)
657 name
= arm_mode_data
[mode
].name
;
661 command_print(CMD_CTX
, "%s%s mode %sregisters",
664 /* display N rows of up to 4 registers each */
665 for (unsigned i
= 0; i
< arm_mode_data
[mode
].n_indices
; ) {
669 for (unsigned j
= 0; j
< 4; j
++, i
++) {
671 struct reg
*reg
= regs
;
673 if (i
>= arm_mode_data
[mode
].n_indices
)
676 reg
+= arm_mode_data
[mode
].indices
[i
];
678 /* REVISIT be smarter about faults... */
680 arm
->full_context(target
);
682 value
= buf_get_u32(reg
->value
, 0, 32);
683 output_len
+= snprintf(output
+ output_len
,
684 sizeof(output
) - output_len
,
685 "%8s: %8.8" PRIx32
" ",
688 command_print(CMD_CTX
, "%s", output
);
695 COMMAND_HANDLER(handle_armv4_5_core_state_command
)
697 struct target
*target
= get_current_target(CMD_CTX
);
698 struct arm
*arm
= target_to_arm(target
);
701 command_print(CMD_CTX
, "current target isn't an ARM");
705 if (arm
->core_type
== ARM_MODE_THREAD
) {
706 /* armv7m not supported */
707 command_print(CMD_CTX
, "Unsupported Command");
712 if (strcmp(CMD_ARGV
[0], "arm") == 0)
713 arm
->core_state
= ARM_STATE_ARM
;
714 if (strcmp(CMD_ARGV
[0], "thumb") == 0)
715 arm
->core_state
= ARM_STATE_THUMB
;
718 command_print(CMD_CTX
, "core state: %s", arm_state_strings
[arm
->core_state
]);
723 COMMAND_HANDLER(handle_arm_disassemble_command
)
725 int retval
= ERROR_OK
;
726 struct target
*target
= get_current_target(CMD_CTX
);
728 if (target
== NULL
) {
729 LOG_ERROR("No target selected");
733 struct arm
*arm
= target_to_arm(target
);
739 command_print(CMD_CTX
, "current target isn't an ARM");
743 if (arm
->core_type
== ARM_MODE_THREAD
) {
744 /* armv7m is always thumb mode */
750 if (strcmp(CMD_ARGV
[2], "thumb") != 0)
755 COMMAND_PARSE_NUMBER(int, CMD_ARGV
[1], count
);
758 COMMAND_PARSE_NUMBER(u32
, CMD_ARGV
[0], address
);
759 if (address
& 0x01) {
761 command_print(CMD_CTX
, "Disassemble as Thumb");
770 retval
= ERROR_COMMAND_SYNTAX_ERROR
;
773 while (count
-- > 0) {
774 struct arm_instruction cur_instruction
;
777 /* Always use Thumb2 disassembly for best handling
778 * of 32-bit BL/BLX, and to work with newer cores
779 * (some ARMv6, all ARMv7) that use Thumb2.
781 retval
= thumb2_opcode(target
, address
,
783 if (retval
!= ERROR_OK
)
788 retval
= target_read_u32(target
, address
, &opcode
);
789 if (retval
!= ERROR_OK
)
791 retval
= arm_evaluate_opcode(opcode
, address
,
792 &cur_instruction
) != ERROR_OK
;
793 if (retval
!= ERROR_OK
)
796 command_print(CMD_CTX
, "%s", cur_instruction
.text
);
797 address
+= cur_instruction
.instruction_size
;
803 static int jim_mcrmrc(Jim_Interp
*interp
, int argc
, Jim_Obj
* const *argv
)
805 struct command_context
*context
;
806 struct target
*target
;
810 context
= current_command_context(interp
);
811 assert(context
!= NULL
);
813 target
= get_current_target(context
);
814 if (target
== NULL
) {
815 LOG_ERROR("%s: no current target", __func__
);
818 if (!target_was_examined(target
)) {
819 LOG_ERROR("%s: not yet examined", target_name(target
));
822 arm
= target_to_arm(target
);
824 LOG_ERROR("%s: not an ARM", target_name(target
));
828 if ((argc
< 6) || (argc
> 7)) {
829 /* FIXME use the command name to verify # params... */
830 LOG_ERROR("%s: wrong number of arguments", __func__
);
842 /* NOTE: parameter sequence matches ARM instruction set usage:
843 * MCR pNUM, op1, rX, CRn, CRm, op2 ; write CP from rX
844 * MRC pNUM, op1, rX, CRn, CRm, op2 ; read CP into rX
845 * The "rX" is necessarily omitted; it uses Tcl mechanisms.
847 retval
= Jim_GetLong(interp
, argv
[1], &l
);
848 if (retval
!= JIM_OK
)
851 LOG_ERROR("%s: %s %d out of range", __func__
,
852 "coprocessor", (int) l
);
857 retval
= Jim_GetLong(interp
, argv
[2], &l
);
858 if (retval
!= JIM_OK
)
861 LOG_ERROR("%s: %s %d out of range", __func__
,
867 retval
= Jim_GetLong(interp
, argv
[3], &l
);
868 if (retval
!= JIM_OK
)
871 LOG_ERROR("%s: %s %d out of range", __func__
,
877 retval
= Jim_GetLong(interp
, argv
[4], &l
);
878 if (retval
!= JIM_OK
)
881 LOG_ERROR("%s: %s %d out of range", __func__
,
887 retval
= Jim_GetLong(interp
, argv
[5], &l
);
888 if (retval
!= JIM_OK
)
891 LOG_ERROR("%s: %s %d out of range", __func__
,
899 /* FIXME don't assume "mrc" vs "mcr" from the number of params;
900 * that could easily be a typo! Check both...
902 * FIXME change the call syntax here ... simplest to just pass
903 * the MRC() or MCR() instruction to be executed. That will also
904 * let us support the "mrc2" and "mcr2" opcodes (toggling one bit)
905 * if that's ever needed.
908 retval
= Jim_GetLong(interp
, argv
[6], &l
);
909 if (retval
!= JIM_OK
)
913 /* NOTE: parameters reordered! */
914 /* ARMV4_5_MCR(cpnum, op1, 0, CRn, CRm, op2) */
915 retval
= arm
->mcr(target
, cpnum
, op1
, op2
, CRn
, CRm
, value
);
916 if (retval
!= ERROR_OK
)
919 /* NOTE: parameters reordered! */
920 /* ARMV4_5_MRC(cpnum, op1, 0, CRn, CRm, op2) */
921 retval
= arm
->mrc(target
, cpnum
, op1
, op2
, CRn
, CRm
, &value
);
922 if (retval
!= ERROR_OK
)
925 Jim_SetResult(interp
, Jim_NewIntObj(interp
, value
));
931 COMMAND_HANDLER(handle_arm_semihosting_command
)
933 struct target
*target
= get_current_target(CMD_CTX
);
935 if (target
== NULL
) {
936 LOG_ERROR("No target selected");
940 struct arm
*arm
= target_to_arm(target
);
943 command_print(CMD_CTX
, "current target isn't an ARM");
947 if (!arm
->setup_semihosting
) {
948 command_print(CMD_CTX
, "semihosting not supported for current target");
955 COMMAND_PARSE_ENABLE(CMD_ARGV
[0], semihosting
);
957 if (!target_was_examined(target
)) {
958 LOG_ERROR("Target not examined yet");
962 if (arm
->setup_semihosting(target
, semihosting
) != ERROR_OK
) {
963 LOG_ERROR("Failed to Configure semihosting");
967 /* FIXME never let that "catch" be dropped! */
968 arm
->is_semihosting
= semihosting
;
971 command_print(CMD_CTX
, "semihosting is %s",
973 ? "enabled" : "disabled");
978 static const struct command_registration arm_exec_command_handlers
[] = {
981 .handler
= handle_armv4_5_reg_command
,
982 .mode
= COMMAND_EXEC
,
983 .help
= "display ARM core registers",
987 .name
= "core_state",
988 .handler
= handle_armv4_5_core_state_command
,
989 .mode
= COMMAND_EXEC
,
990 .usage
= "['arm'|'thumb']",
991 .help
= "display/change ARM core state",
994 .name
= "disassemble",
995 .handler
= handle_arm_disassemble_command
,
996 .mode
= COMMAND_EXEC
,
997 .usage
= "address [count ['thumb']]",
998 .help
= "disassemble instructions ",
1002 .mode
= COMMAND_EXEC
,
1003 .jim_handler
= &jim_mcrmrc
,
1004 .help
= "write coprocessor register",
1005 .usage
= "cpnum op1 CRn op2 CRm value",
1009 .jim_handler
= &jim_mcrmrc
,
1010 .help
= "read coprocessor register",
1011 .usage
= "cpnum op1 CRn op2 CRm",
1015 .handler
= handle_arm_semihosting_command
,
1016 .mode
= COMMAND_EXEC
,
1017 .usage
= "['enable'|'disable']",
1018 .help
= "activate support for semihosting operations",
1021 COMMAND_REGISTRATION_DONE
1023 const struct command_registration arm_command_handlers
[] = {
1026 .mode
= COMMAND_ANY
,
1027 .help
= "ARM command group",
1029 .chain
= arm_exec_command_handlers
,
1031 COMMAND_REGISTRATION_DONE
1034 int arm_get_gdb_reg_list(struct target
*target
,
1035 struct reg
**reg_list
[], int *reg_list_size
)
1037 struct arm
*arm
= target_to_arm(target
);
1040 if (!is_arm_mode(arm
->core_mode
)) {
1041 LOG_ERROR("not a valid arm core mode - communication failure?");
1045 *reg_list_size
= 26;
1046 *reg_list
= malloc(sizeof(struct reg
*) * (*reg_list_size
));
1048 for (i
= 0; i
< 16; i
++)
1049 (*reg_list
)[i
] = arm_reg_current(arm
, i
);
1051 for (i
= 16; i
< 24; i
++)
1052 (*reg_list
)[i
] = &arm_gdb_dummy_fp_reg
;
1054 (*reg_list
)[24] = &arm_gdb_dummy_fps_reg
;
1055 (*reg_list
)[25] = arm
->cpsr
;
1060 /* wait for execution to complete and check exit point */
1061 static int armv4_5_run_algorithm_completion(struct target
*target
,
1062 uint32_t exit_point
,
1067 struct arm
*arm
= target_to_arm(target
);
1069 retval
= target_wait_state(target
, TARGET_HALTED
, timeout_ms
);
1070 if (retval
!= ERROR_OK
)
1072 if (target
->state
!= TARGET_HALTED
) {
1073 retval
= target_halt(target
);
1074 if (retval
!= ERROR_OK
)
1076 retval
= target_wait_state(target
, TARGET_HALTED
, 500);
1077 if (retval
!= ERROR_OK
)
1079 return ERROR_TARGET_TIMEOUT
;
1082 /* fast exit: ARMv5+ code can use BKPT */
1083 if (exit_point
&& buf_get_u32(arm
->pc
->value
, 0, 32) != exit_point
) {
1085 "target reentered debug state, but not at the desired exit point: 0x%4.4" PRIx32
"",
1086 buf_get_u32(arm
->pc
->value
, 0, 32));
1087 return ERROR_TARGET_TIMEOUT
;
1093 int armv4_5_run_algorithm_inner(struct target
*target
,
1094 int num_mem_params
, struct mem_param
*mem_params
,
1095 int num_reg_params
, struct reg_param
*reg_params
,
1096 uint32_t entry_point
, uint32_t exit_point
,
1097 int timeout_ms
, void *arch_info
,
1098 int (*run_it
)(struct target
*target
, uint32_t exit_point
,
1099 int timeout_ms
, void *arch_info
))
1101 struct arm
*arm
= target_to_arm(target
);
1102 struct arm_algorithm
*arm_algorithm_info
= arch_info
;
1103 enum arm_state core_state
= arm
->core_state
;
1104 uint32_t context
[17];
1106 int exit_breakpoint_size
= 0;
1108 int retval
= ERROR_OK
;
1110 LOG_DEBUG("Running algorithm");
1112 if (arm_algorithm_info
->common_magic
!= ARM_COMMON_MAGIC
) {
1113 LOG_ERROR("current target isn't an ARMV4/5 target");
1114 return ERROR_TARGET_INVALID
;
1117 if (target
->state
!= TARGET_HALTED
) {
1118 LOG_WARNING("target not halted");
1119 return ERROR_TARGET_NOT_HALTED
;
1122 if (!is_arm_mode(arm
->core_mode
)) {
1123 LOG_ERROR("not a valid arm core mode - communication failure?");
1127 /* armv5 and later can terminate with BKPT instruction; less overhead */
1128 if (!exit_point
&& arm
->is_armv4
) {
1129 LOG_ERROR("ARMv4 target needs HW breakpoint location");
1133 /* save r0..pc, cpsr-or-spsr, and then cpsr-for-sure;
1134 * they'll be restored later.
1136 for (i
= 0; i
<= 16; i
++) {
1139 r
= &ARMV4_5_CORE_REG_MODE(arm
->core_cache
,
1140 arm_algorithm_info
->core_mode
, i
);
1142 arm
->read_core_reg(target
, r
, i
,
1143 arm_algorithm_info
->core_mode
);
1144 context
[i
] = buf_get_u32(r
->value
, 0, 32);
1146 cpsr
= buf_get_u32(arm
->cpsr
->value
, 0, 32);
1148 for (i
= 0; i
< num_mem_params
; i
++) {
1149 retval
= target_write_buffer(target
, mem_params
[i
].address
, mem_params
[i
].size
,
1150 mem_params
[i
].value
);
1151 if (retval
!= ERROR_OK
)
1155 for (i
= 0; i
< num_reg_params
; i
++) {
1156 struct reg
*reg
= register_get_by_name(arm
->core_cache
, reg_params
[i
].reg_name
, 0);
1158 LOG_ERROR("BUG: register '%s' not found", reg_params
[i
].reg_name
);
1159 return ERROR_COMMAND_SYNTAX_ERROR
;
1162 if (reg
->size
!= reg_params
[i
].size
) {
1163 LOG_ERROR("BUG: register '%s' size doesn't match reg_params[i].size",
1164 reg_params
[i
].reg_name
);
1165 return ERROR_COMMAND_SYNTAX_ERROR
;
1168 retval
= armv4_5_set_core_reg(reg
, reg_params
[i
].value
);
1169 if (retval
!= ERROR_OK
)
1173 arm
->core_state
= arm_algorithm_info
->core_state
;
1174 if (arm
->core_state
== ARM_STATE_ARM
)
1175 exit_breakpoint_size
= 4;
1176 else if (arm
->core_state
== ARM_STATE_THUMB
)
1177 exit_breakpoint_size
= 2;
1179 LOG_ERROR("BUG: can't execute algorithms when not in ARM or Thumb state");
1180 return ERROR_COMMAND_SYNTAX_ERROR
;
1183 if (arm_algorithm_info
->core_mode
!= ARM_MODE_ANY
) {
1184 LOG_DEBUG("setting core_mode: 0x%2.2x",
1185 arm_algorithm_info
->core_mode
);
1186 buf_set_u32(arm
->cpsr
->value
, 0, 5,
1187 arm_algorithm_info
->core_mode
);
1188 arm
->cpsr
->dirty
= 1;
1189 arm
->cpsr
->valid
= 1;
1192 /* terminate using a hardware or (ARMv5+) software breakpoint */
1194 retval
= breakpoint_add(target
, exit_point
,
1195 exit_breakpoint_size
, BKPT_HARD
);
1196 if (retval
!= ERROR_OK
) {
1197 LOG_ERROR("can't add HW breakpoint to terminate algorithm");
1198 return ERROR_TARGET_FAILURE
;
1202 retval
= target_resume(target
, 0, entry_point
, 1, 1);
1203 if (retval
!= ERROR_OK
)
1205 retval
= run_it(target
, exit_point
, timeout_ms
, arch_info
);
1208 breakpoint_remove(target
, exit_point
);
1210 if (retval
!= ERROR_OK
)
1213 for (i
= 0; i
< num_mem_params
; i
++) {
1214 if (mem_params
[i
].direction
!= PARAM_OUT
) {
1215 int retvaltemp
= target_read_buffer(target
, mem_params
[i
].address
,
1217 mem_params
[i
].value
);
1218 if (retvaltemp
!= ERROR_OK
)
1219 retval
= retvaltemp
;
1223 for (i
= 0; i
< num_reg_params
; i
++) {
1224 if (reg_params
[i
].direction
!= PARAM_OUT
) {
1226 struct reg
*reg
= register_get_by_name(arm
->core_cache
,
1227 reg_params
[i
].reg_name
,
1230 LOG_ERROR("BUG: register '%s' not found", reg_params
[i
].reg_name
);
1231 retval
= ERROR_COMMAND_SYNTAX_ERROR
;
1235 if (reg
->size
!= reg_params
[i
].size
) {
1237 "BUG: register '%s' size doesn't match reg_params[i].size",
1238 reg_params
[i
].reg_name
);
1239 retval
= ERROR_COMMAND_SYNTAX_ERROR
;
1243 buf_set_u32(reg_params
[i
].value
, 0, 32, buf_get_u32(reg
->value
, 0, 32));
1247 /* restore everything we saved before (17 or 18 registers) */
1248 for (i
= 0; i
<= 16; i
++) {
1250 regvalue
= buf_get_u32(ARMV4_5_CORE_REG_MODE(arm
->core_cache
,
1251 arm_algorithm_info
->core_mode
, i
).value
, 0, 32);
1252 if (regvalue
!= context
[i
]) {
1253 LOG_DEBUG("restoring register %s with value 0x%8.8" PRIx32
"",
1254 ARMV4_5_CORE_REG_MODE(arm
->core_cache
,
1255 arm_algorithm_info
->core_mode
, i
).name
, context
[i
]);
1256 buf_set_u32(ARMV4_5_CORE_REG_MODE(arm
->core_cache
,
1257 arm_algorithm_info
->core_mode
, i
).value
, 0, 32, context
[i
]);
1258 ARMV4_5_CORE_REG_MODE(arm
->core_cache
, arm_algorithm_info
->core_mode
,
1260 ARMV4_5_CORE_REG_MODE(arm
->core_cache
, arm_algorithm_info
->core_mode
,
1265 arm_set_cpsr(arm
, cpsr
);
1266 arm
->cpsr
->dirty
= 1;
1268 arm
->core_state
= core_state
;
1273 int armv4_5_run_algorithm(struct target
*target
,
1275 struct mem_param
*mem_params
,
1277 struct reg_param
*reg_params
,
1278 uint32_t entry_point
,
1279 uint32_t exit_point
,
1283 return armv4_5_run_algorithm_inner(target
,
1292 armv4_5_run_algorithm_completion
);
1296 * Runs ARM code in the target to calculate a CRC32 checksum.
1299 int arm_checksum_memory(struct target
*target
,
1300 uint32_t address
, uint32_t count
, uint32_t *checksum
)
1302 struct working_area
*crc_algorithm
;
1303 struct arm_algorithm armv4_5_info
;
1304 struct arm
*arm
= target_to_arm(target
);
1305 struct reg_param reg_params
[2];
1308 uint32_t exit_var
= 0;
1310 /* see contib/loaders/checksum/armv4_5_crc.s for src */
1312 static const uint32_t arm_crc_code
[] = {
1313 0xE1A02000, /* mov r2, r0 */
1314 0xE3E00000, /* mov r0, #0xffffffff */
1315 0xE1A03001, /* mov r3, r1 */
1316 0xE3A04000, /* mov r4, #0 */
1317 0xEA00000B, /* b ncomp */
1319 0xE7D21004, /* ldrb r1, [r2, r4] */
1320 0xE59F7030, /* ldr r7, CRC32XOR */
1321 0xE0200C01, /* eor r0, r0, r1, asl 24 */
1322 0xE3A05000, /* mov r5, #0 */
1324 0xE3500000, /* cmp r0, #0 */
1325 0xE1A06080, /* mov r6, r0, asl #1 */
1326 0xE2855001, /* add r5, r5, #1 */
1327 0xE1A00006, /* mov r0, r6 */
1328 0xB0260007, /* eorlt r0, r6, r7 */
1329 0xE3550008, /* cmp r5, #8 */
1330 0x1AFFFFF8, /* bne loop */
1331 0xE2844001, /* add r4, r4, #1 */
1333 0xE1540003, /* cmp r4, r3 */
1334 0x1AFFFFF1, /* bne nbyte */
1336 0xe1200070, /* bkpt #0 */
1338 0x04C11DB7 /* .word 0x04C11DB7 */
1341 retval
= target_alloc_working_area(target
,
1342 sizeof(arm_crc_code
), &crc_algorithm
);
1343 if (retval
!= ERROR_OK
)
1346 /* convert code into a buffer in target endianness */
1347 for (i
= 0; i
< ARRAY_SIZE(arm_crc_code
); i
++) {
1348 retval
= target_write_u32(target
,
1349 crc_algorithm
->address
+ i
* sizeof(uint32_t),
1351 if (retval
!= ERROR_OK
)
1355 armv4_5_info
.common_magic
= ARM_COMMON_MAGIC
;
1356 armv4_5_info
.core_mode
= ARM_MODE_SVC
;
1357 armv4_5_info
.core_state
= ARM_STATE_ARM
;
1359 init_reg_param(®_params
[0], "r0", 32, PARAM_IN_OUT
);
1360 init_reg_param(®_params
[1], "r1", 32, PARAM_OUT
);
1362 buf_set_u32(reg_params
[0].value
, 0, 32, address
);
1363 buf_set_u32(reg_params
[1].value
, 0, 32, count
);
1365 /* 20 second timeout/megabyte */
1366 int timeout
= 20000 * (1 + (count
/ (1024 * 1024)));
1368 /* armv4 must exit using a hardware breakpoint */
1370 exit_var
= crc_algorithm
->address
+ sizeof(arm_crc_code
) - 8;
1372 retval
= target_run_algorithm(target
, 0, NULL
, 2, reg_params
,
1373 crc_algorithm
->address
,
1375 timeout
, &armv4_5_info
);
1376 if (retval
!= ERROR_OK
) {
1377 LOG_ERROR("error executing ARM crc algorithm");
1378 destroy_reg_param(®_params
[0]);
1379 destroy_reg_param(®_params
[1]);
1380 target_free_working_area(target
, crc_algorithm
);
1384 *checksum
= buf_get_u32(reg_params
[0].value
, 0, 32);
1386 destroy_reg_param(®_params
[0]);
1387 destroy_reg_param(®_params
[1]);
1389 target_free_working_area(target
, crc_algorithm
);
1395 * Runs ARM code in the target to check whether a memory block holds
1396 * all ones. NOR flash which has been erased, and thus may be written,
1400 int arm_blank_check_memory(struct target
*target
,
1401 uint32_t address
, uint32_t count
, uint32_t *blank
)
1403 struct working_area
*check_algorithm
;
1404 struct reg_param reg_params
[3];
1405 struct arm_algorithm armv4_5_info
;
1406 struct arm
*arm
= target_to_arm(target
);
1409 uint32_t exit_var
= 0;
1411 static const uint32_t check_code
[] = {
1413 0xe4d03001, /* ldrb r3, [r0], #1 */
1414 0xe0022003, /* and r2, r2, r3 */
1415 0xe2511001, /* subs r1, r1, #1 */
1416 0x1afffffb, /* bne loop */
1418 0xe1200070, /* bkpt #0 */
1421 /* make sure we have a working area */
1422 retval
= target_alloc_working_area(target
,
1423 sizeof(check_code
), &check_algorithm
);
1424 if (retval
!= ERROR_OK
)
1427 /* convert code into a buffer in target endianness */
1428 for (i
= 0; i
< ARRAY_SIZE(check_code
); i
++) {
1429 retval
= target_write_u32(target
,
1430 check_algorithm
->address
1431 + i
* sizeof(uint32_t),
1433 if (retval
!= ERROR_OK
)
1437 armv4_5_info
.common_magic
= ARM_COMMON_MAGIC
;
1438 armv4_5_info
.core_mode
= ARM_MODE_SVC
;
1439 armv4_5_info
.core_state
= ARM_STATE_ARM
;
1441 init_reg_param(®_params
[0], "r0", 32, PARAM_OUT
);
1442 buf_set_u32(reg_params
[0].value
, 0, 32, address
);
1444 init_reg_param(®_params
[1], "r1", 32, PARAM_OUT
);
1445 buf_set_u32(reg_params
[1].value
, 0, 32, count
);
1447 init_reg_param(®_params
[2], "r2", 32, PARAM_IN_OUT
);
1448 buf_set_u32(reg_params
[2].value
, 0, 32, 0xff);
1450 /* armv4 must exit using a hardware breakpoint */
1452 exit_var
= check_algorithm
->address
+ sizeof(check_code
) - 4;
1454 retval
= target_run_algorithm(target
, 0, NULL
, 3, reg_params
,
1455 check_algorithm
->address
,
1457 10000, &armv4_5_info
);
1458 if (retval
!= ERROR_OK
) {
1459 destroy_reg_param(®_params
[0]);
1460 destroy_reg_param(®_params
[1]);
1461 destroy_reg_param(®_params
[2]);
1462 target_free_working_area(target
, check_algorithm
);
1466 *blank
= buf_get_u32(reg_params
[2].value
, 0, 32);
1468 destroy_reg_param(®_params
[0]);
1469 destroy_reg_param(®_params
[1]);
1470 destroy_reg_param(®_params
[2]);
1472 target_free_working_area(target
, check_algorithm
);
1477 static int arm_full_context(struct target
*target
)
1479 struct arm
*arm
= target_to_arm(target
);
1480 unsigned num_regs
= arm
->core_cache
->num_regs
;
1481 struct reg
*reg
= arm
->core_cache
->reg_list
;
1482 int retval
= ERROR_OK
;
1484 for (; num_regs
&& retval
== ERROR_OK
; num_regs
--, reg
++) {
1487 retval
= armv4_5_get_core_reg(reg
);
1492 static int arm_default_mrc(struct target
*target
, int cpnum
,
1493 uint32_t op1
, uint32_t op2
,
1494 uint32_t CRn
, uint32_t CRm
,
1497 LOG_ERROR("%s doesn't implement MRC", target_type_name(target
));
1501 static int arm_default_mcr(struct target
*target
, int cpnum
,
1502 uint32_t op1
, uint32_t op2
,
1503 uint32_t CRn
, uint32_t CRm
,
1506 LOG_ERROR("%s doesn't implement MCR", target_type_name(target
));
1510 int arm_init_arch_info(struct target
*target
, struct arm
*arm
)
1512 target
->arch_info
= arm
;
1513 arm
->target
= target
;
1515 arm
->common_magic
= ARM_COMMON_MAGIC
;
1517 /* core_type may be overridden by subtype logic */
1518 if (arm
->core_type
!= ARM_MODE_THREAD
) {
1519 arm
->core_type
= ARM_MODE_ANY
;
1520 arm_set_cpsr(arm
, ARM_MODE_USR
);
1523 /* default full_context() has no core-specific optimizations */
1524 if (!arm
->full_context
&& arm
->read_core_reg
)
1525 arm
->full_context
= arm_full_context
;
1528 arm
->mrc
= arm_default_mrc
;
1530 arm
->mcr
= arm_default_mcr
;