1 /***************************************************************************
2 * Copyright (C) 2005 by Dominic Rath *
3 * Dominic.Rath@gmx.de *
5 * Copyright (C) 2008 by Spencer Oliver *
6 * spen@spen-soft.co.uk *
8 * Copyright (C) 2008 by Oyvind Harboe *
9 * oyvind.harboe@zylin.com *
11 * This program is free software; you can redistribute it and/or modify *
12 * it under the terms of the GNU General Public License as published by *
13 * the Free Software Foundation; either version 2 of the License, or *
14 * (at your option) any later version. *
16 * This program is distributed in the hope that it will be useful, *
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
19 * GNU General Public License for more details. *
21 * You should have received a copy of the GNU General Public License *
22 * along with this program; if not, write to the *
23 * Free Software Foundation, Inc., *
24 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
25 ***************************************************************************/
34 #include "breakpoints.h"
35 #include "arm_disassembler.h"
36 #include <helper/binarybuffer.h>
37 #include "algorithm.h"
40 /* offsets into armv4_5 core register cache */
42 /* ARMV4_5_CPSR = 31, */
43 ARMV4_5_SPSR_FIQ
= 32,
44 ARMV4_5_SPSR_IRQ
= 33,
45 ARMV4_5_SPSR_SVC
= 34,
46 ARMV4_5_SPSR_ABT
= 35,
47 ARMV4_5_SPSR_UND
= 36,
51 static const uint8_t arm_usr_indices
[17] = {
52 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, ARMV4_5_CPSR
,
55 static const uint8_t arm_fiq_indices
[8] = {
56 16, 17, 18, 19, 20, 21, 22, ARMV4_5_SPSR_FIQ
,
59 static const uint8_t arm_irq_indices
[3] = {
60 23, 24, ARMV4_5_SPSR_IRQ
,
63 static const uint8_t arm_svc_indices
[3] = {
64 25, 26, ARMV4_5_SPSR_SVC
,
67 static const uint8_t arm_abt_indices
[3] = {
68 27, 28, ARMV4_5_SPSR_ABT
,
71 static const uint8_t arm_und_indices
[3] = {
72 29, 30, ARMV4_5_SPSR_UND
,
75 static const uint8_t arm_mon_indices
[3] = {
82 /* For user and system modes, these list indices for all registers.
83 * otherwise they're just indices for the shadow registers and SPSR.
85 unsigned short n_indices
;
86 const uint8_t *indices
;
88 /* Seven modes are standard from ARM7 on. "System" and "User" share
89 * the same registers; other modes shadow from 3 to 8 registers.
94 .n_indices
= ARRAY_SIZE(arm_usr_indices
),
95 .indices
= arm_usr_indices
,
100 .n_indices
= ARRAY_SIZE(arm_fiq_indices
),
101 .indices
= arm_fiq_indices
,
104 .name
= "Supervisor",
106 .n_indices
= ARRAY_SIZE(arm_svc_indices
),
107 .indices
= arm_svc_indices
,
112 .n_indices
= ARRAY_SIZE(arm_abt_indices
),
113 .indices
= arm_abt_indices
,
118 .n_indices
= ARRAY_SIZE(arm_irq_indices
),
119 .indices
= arm_irq_indices
,
122 .name
= "Undefined instruction",
124 .n_indices
= ARRAY_SIZE(arm_und_indices
),
125 .indices
= arm_und_indices
,
130 .n_indices
= ARRAY_SIZE(arm_usr_indices
),
131 .indices
= arm_usr_indices
,
133 /* TrustZone "Security Extensions" add a secure monitor mode.
134 * This is distinct from a "debug monitor" which can support
135 * non-halting debug, in conjunction with some debuggers.
138 .name
= "Secure Monitor",
140 .n_indices
= ARRAY_SIZE(arm_mon_indices
),
141 .indices
= arm_mon_indices
,
144 /* These special modes are currently only supported
145 * by ARMv6M and ARMv7M profiles */
148 .psr
= ARM_MODE_THREAD
,
151 .name
= "Thread (User)",
152 .psr
= ARM_MODE_USER_THREAD
,
156 .psr
= ARM_MODE_HANDLER
,
160 /** Map PSR mode bits to the name of an ARM processor operating mode. */
161 const char *arm_mode_name(unsigned psr_mode
)
163 for (unsigned i
= 0; i
< ARRAY_SIZE(arm_mode_data
); i
++) {
164 if (arm_mode_data
[i
].psr
== psr_mode
)
165 return arm_mode_data
[i
].name
;
167 LOG_ERROR("unrecognized psr mode: %#02x", psr_mode
);
168 return "UNRECOGNIZED";
171 /** Return true iff the parameter denotes a valid ARM processor mode. */
172 bool is_arm_mode(unsigned psr_mode
)
174 for (unsigned i
= 0; i
< ARRAY_SIZE(arm_mode_data
); i
++) {
175 if (arm_mode_data
[i
].psr
== psr_mode
)
181 /** Map PSR mode bits to linear number indexing armv4_5_core_reg_map */
182 int arm_mode_to_number(enum arm_mode mode
)
186 /* map MODE_ANY to user mode */
204 LOG_ERROR("invalid mode value encountered %d", mode
);
209 /** Map linear number indexing armv4_5_core_reg_map to PSR mode bits. */
210 enum arm_mode
armv4_5_number_to_mode(int number
)
230 LOG_ERROR("mode index out of bounds %d", number
);
235 static const char *arm_state_strings
[] = {
236 "ARM", "Thumb", "Jazelle", "ThumbEE",
239 /* Templates for ARM core registers.
241 * NOTE: offsets in this table are coupled to the arm_mode_data
242 * table above, the armv4_5_core_reg_map array below, and also to
243 * the ARMV4_5_CPSR symbol (which should vanish after ARM11 updates).
245 static const struct {
246 /* The name is used for e.g. the "regs" command. */
249 /* The {cookie, mode} tuple uniquely identifies one register.
250 * In a given mode, cookies 0..15 map to registers R0..R15,
251 * with R13..R15 usually called SP, LR, PC.
253 * MODE_ANY is used as *input* to the mapping, and indicates
254 * various special cases (sigh) and errors.
256 * Cookie 16 is (currently) confusing, since it indicates
257 * CPSR -or- SPSR depending on whether 'mode' is MODE_ANY.
258 * (Exception modes have both CPSR and SPSR registers ...)
262 } arm_core_regs
[] = {
263 /* IMPORTANT: we guarantee that the first eight cached registers
264 * correspond to r0..r7, and the fifteenth to PC, so that callers
265 * don't need to map them.
267 { .name
= "r0", .cookie
= 0, .mode
= ARM_MODE_ANY
, },
268 { .name
= "r1", .cookie
= 1, .mode
= ARM_MODE_ANY
, },
269 { .name
= "r2", .cookie
= 2, .mode
= ARM_MODE_ANY
, },
270 { .name
= "r3", .cookie
= 3, .mode
= ARM_MODE_ANY
, },
271 { .name
= "r4", .cookie
= 4, .mode
= ARM_MODE_ANY
, },
272 { .name
= "r5", .cookie
= 5, .mode
= ARM_MODE_ANY
, },
273 { .name
= "r6", .cookie
= 6, .mode
= ARM_MODE_ANY
, },
274 { .name
= "r7", .cookie
= 7, .mode
= ARM_MODE_ANY
, },
276 /* NOTE: regs 8..12 might be shadowed by FIQ ... flagging
277 * them as MODE_ANY creates special cases. (ANY means
278 * "not mapped" elsewhere; here it's "everything but FIQ".)
280 { .name
= "r8", .cookie
= 8, .mode
= ARM_MODE_ANY
, },
281 { .name
= "r9", .cookie
= 9, .mode
= ARM_MODE_ANY
, },
282 { .name
= "r10", .cookie
= 10, .mode
= ARM_MODE_ANY
, },
283 { .name
= "r11", .cookie
= 11, .mode
= ARM_MODE_ANY
, },
284 { .name
= "r12", .cookie
= 12, .mode
= ARM_MODE_ANY
, },
286 /* NOTE all MODE_USR registers are equivalent to MODE_SYS ones */
287 { .name
= "sp_usr", .cookie
= 13, .mode
= ARM_MODE_USR
, },
288 { .name
= "lr_usr", .cookie
= 14, .mode
= ARM_MODE_USR
, },
290 /* guaranteed to be at index 15 */
291 { .name
= "pc", .cookie
= 15, .mode
= ARM_MODE_ANY
, },
293 { .name
= "r8_fiq", .cookie
= 8, .mode
= ARM_MODE_FIQ
, },
294 { .name
= "r9_fiq", .cookie
= 9, .mode
= ARM_MODE_FIQ
, },
295 { .name
= "r10_fiq", .cookie
= 10, .mode
= ARM_MODE_FIQ
, },
296 { .name
= "r11_fiq", .cookie
= 11, .mode
= ARM_MODE_FIQ
, },
297 { .name
= "r12_fiq", .cookie
= 12, .mode
= ARM_MODE_FIQ
, },
299 { .name
= "sp_fiq", .cookie
= 13, .mode
= ARM_MODE_FIQ
, },
300 { .name
= "lr_fiq", .cookie
= 14, .mode
= ARM_MODE_FIQ
, },
302 { .name
= "sp_irq", .cookie
= 13, .mode
= ARM_MODE_IRQ
, },
303 { .name
= "lr_irq", .cookie
= 14, .mode
= ARM_MODE_IRQ
, },
305 { .name
= "sp_svc", .cookie
= 13, .mode
= ARM_MODE_SVC
, },
306 { .name
= "lr_svc", .cookie
= 14, .mode
= ARM_MODE_SVC
, },
308 { .name
= "sp_abt", .cookie
= 13, .mode
= ARM_MODE_ABT
, },
309 { .name
= "lr_abt", .cookie
= 14, .mode
= ARM_MODE_ABT
, },
311 { .name
= "sp_und", .cookie
= 13, .mode
= ARM_MODE_UND
, },
312 { .name
= "lr_und", .cookie
= 14, .mode
= ARM_MODE_UND
, },
314 { .name
= "cpsr", .cookie
= 16, .mode
= ARM_MODE_ANY
, },
315 { .name
= "spsr_fiq", .cookie
= 16, .mode
= ARM_MODE_FIQ
, },
316 { .name
= "spsr_irq", .cookie
= 16, .mode
= ARM_MODE_IRQ
, },
317 { .name
= "spsr_svc", .cookie
= 16, .mode
= ARM_MODE_SVC
, },
318 { .name
= "spsr_abt", .cookie
= 16, .mode
= ARM_MODE_ABT
, },
319 { .name
= "spsr_und", .cookie
= 16, .mode
= ARM_MODE_UND
, },
321 { .name
= "sp_mon", .cookie
= 13, .mode
= ARM_MODE_MON
, },
322 { .name
= "lr_mon", .cookie
= 14, .mode
= ARM_MODE_MON
, },
323 { .name
= "spsr_mon", .cookie
= 16, .mode
= ARM_MODE_MON
, },
326 /* map core mode (USR, FIQ, ...) and register number to
327 * indices into the register cache
329 const int armv4_5_core_reg_map
[8][17] = {
331 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 31
333 { /* FIQ (8 shadows of USR, vs normal 3) */
334 0, 1, 2, 3, 4, 5, 6, 7, 16, 17, 18, 19, 20, 21, 22, 15, 32
337 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 23, 24, 15, 33
340 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 25, 26, 15, 34
343 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 27, 28, 15, 35
346 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 29, 30, 15, 36
348 { /* SYS (same registers as USR) */
349 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 31
352 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 37, 38, 15, 39,
357 * Configures host-side ARM records to reflect the specified CPSR.
358 * Later, code can use arm_reg_current() to map register numbers
359 * according to how they are exposed by this mode.
361 void arm_set_cpsr(struct arm
*arm
, uint32_t cpsr
)
363 enum arm_mode mode
= cpsr
& 0x1f;
366 /* NOTE: this may be called very early, before the register
367 * cache is set up. We can't defend against many errors, in
368 * particular against CPSRs that aren't valid *here* ...
371 buf_set_u32(arm
->cpsr
->value
, 0, 32, cpsr
);
372 arm
->cpsr
->valid
= 1;
373 arm
->cpsr
->dirty
= 0;
376 arm
->core_mode
= mode
;
378 /* mode_to_number() warned; set up a somewhat-sane mapping */
379 num
= arm_mode_to_number(mode
);
385 arm
->map
= &armv4_5_core_reg_map
[num
][0];
386 arm
->spsr
= (mode
== ARM_MODE_USR
|| mode
== ARM_MODE_SYS
)
388 : arm
->core_cache
->reg_list
+ arm
->map
[16];
390 /* Older ARMs won't have the J bit */
391 enum arm_state state
;
393 if (cpsr
& (1 << 5)) { /* T */
394 if (cpsr
& (1 << 24)) { /* J */
395 LOG_WARNING("ThumbEE -- incomplete support");
396 state
= ARM_STATE_THUMB_EE
;
398 state
= ARM_STATE_THUMB
;
400 if (cpsr
& (1 << 24)) { /* J */
401 LOG_ERROR("Jazelle state handling is BROKEN!");
402 state
= ARM_STATE_JAZELLE
;
404 state
= ARM_STATE_ARM
;
406 arm
->core_state
= state
;
408 LOG_DEBUG("set CPSR %#8.8x: %s mode, %s state", (unsigned) cpsr
,
410 arm_state_strings
[arm
->core_state
]);
414 * Returns handle to the register currently mapped to a given number.
415 * Someone must have called arm_set_cpsr() before.
417 * \param arm This core's state and registers are used.
418 * \param regnum From 0..15 corresponding to R0..R14 and PC.
419 * Note that R0..R7 don't require mapping; you may access those
420 * as the first eight entries in the register cache. Likewise
421 * R15 (PC) doesn't need mapping; you may also access it directly.
422 * However, R8..R14, and SPSR (arm->spsr) *must* be mapped.
423 * CPSR (arm->cpsr) is also not mapped.
425 struct reg
*arm_reg_current(struct arm
*arm
, unsigned regnum
)
432 r
= arm
->core_cache
->reg_list
+ arm
->map
[regnum
];
434 /* e.g. invalid CPSR said "secure monitor" mode on a core
435 * that doesn't support it...
438 LOG_ERROR("Invalid CPSR mode");
439 r
= arm
->core_cache
->reg_list
+ regnum
;
445 static const uint8_t arm_gdb_dummy_fp_value
[12];
448 * Dummy FPA registers are required to support GDB on ARM.
449 * Register packets require eight obsolete FPA register values.
450 * Modern ARM cores use Vector Floating Point (VFP), if they
451 * have any floating point support. VFP is not FPA-compatible.
453 struct reg arm_gdb_dummy_fp_reg
= {
454 .name
= "GDB dummy FPA register",
455 .value
= (uint8_t *) arm_gdb_dummy_fp_value
,
460 static const uint8_t arm_gdb_dummy_fps_value
[4];
463 * Dummy FPA status registers are required to support GDB on ARM.
464 * Register packets require an obsolete FPA status register.
466 struct reg arm_gdb_dummy_fps_reg
= {
467 .name
= "GDB dummy FPA status register",
468 .value
= (uint8_t *) arm_gdb_dummy_fps_value
,
473 static void arm_gdb_dummy_init(void) __attribute__ ((constructor
));
475 static void arm_gdb_dummy_init(void)
477 register_init_dummy(&arm_gdb_dummy_fp_reg
);
478 register_init_dummy(&arm_gdb_dummy_fps_reg
);
481 static int armv4_5_get_core_reg(struct reg
*reg
)
484 struct arm_reg
*reg_arch_info
= reg
->arch_info
;
485 struct target
*target
= reg_arch_info
->target
;
487 if (target
->state
!= TARGET_HALTED
) {
488 LOG_ERROR("Target not halted");
489 return ERROR_TARGET_NOT_HALTED
;
492 retval
= reg_arch_info
->arm
->read_core_reg(target
, reg
,
493 reg_arch_info
->num
, reg_arch_info
->mode
);
494 if (retval
== ERROR_OK
) {
502 static int armv4_5_set_core_reg(struct reg
*reg
, uint8_t *buf
)
504 struct arm_reg
*reg_arch_info
= reg
->arch_info
;
505 struct target
*target
= reg_arch_info
->target
;
506 struct arm
*armv4_5_target
= target_to_arm(target
);
507 uint32_t value
= buf_get_u32(buf
, 0, 32);
509 if (target
->state
!= TARGET_HALTED
) {
510 LOG_ERROR("Target not halted");
511 return ERROR_TARGET_NOT_HALTED
;
514 /* Except for CPSR, the "reg" command exposes a writeback model
515 * for the register cache.
517 if (reg
== armv4_5_target
->cpsr
) {
518 arm_set_cpsr(armv4_5_target
, value
);
520 /* Older cores need help to be in ARM mode during halt
521 * mode debug, so we clear the J and T bits if we flush.
522 * For newer cores (v6/v7a/v7r) we don't need that, but
523 * it won't hurt since CPSR is always flushed anyway.
525 if (armv4_5_target
->core_mode
!=
526 (enum arm_mode
)(value
& 0x1f)) {
527 LOG_DEBUG("changing ARM core mode to '%s'",
528 arm_mode_name(value
& 0x1f));
529 value
&= ~((1 << 24) | (1 << 5));
530 armv4_5_target
->write_core_reg(target
, reg
,
531 16, ARM_MODE_ANY
, value
);
534 buf_set_u32(reg
->value
, 0, 32, value
);
542 static const struct reg_arch_type arm_reg_type
= {
543 .get
= armv4_5_get_core_reg
,
544 .set
= armv4_5_set_core_reg
,
547 struct reg_cache
*arm_build_reg_cache(struct target
*target
, struct arm
*arm
)
549 int num_regs
= ARRAY_SIZE(arm_core_regs
);
550 struct reg_cache
*cache
= malloc(sizeof(struct reg_cache
));
551 struct reg
*reg_list
= calloc(num_regs
, sizeof(struct reg
));
552 struct arm_reg
*reg_arch_info
= calloc(num_regs
, sizeof(struct arm_reg
));
555 if (!cache
|| !reg_list
|| !reg_arch_info
) {
562 cache
->name
= "ARM registers";
564 cache
->reg_list
= reg_list
;
567 for (i
= 0; i
< num_regs
; i
++) {
568 /* Skip registers this core doesn't expose */
569 if (arm_core_regs
[i
].mode
== ARM_MODE_MON
570 && arm
->core_type
!= ARM_MODE_MON
)
573 /* REVISIT handle Cortex-M, which only shadows R13/SP */
575 reg_arch_info
[i
].num
= arm_core_regs
[i
].cookie
;
576 reg_arch_info
[i
].mode
= arm_core_regs
[i
].mode
;
577 reg_arch_info
[i
].target
= target
;
578 reg_arch_info
[i
].arm
= arm
;
580 reg_list
[i
].name
= (char *) arm_core_regs
[i
].name
;
581 reg_list
[i
].size
= 32;
582 reg_list
[i
].value
= ®_arch_info
[i
].value
;
583 reg_list
[i
].type
= &arm_reg_type
;
584 reg_list
[i
].arch_info
= ®_arch_info
[i
];
589 arm
->pc
= reg_list
+ 15;
590 arm
->cpsr
= reg_list
+ ARMV4_5_CPSR
;
591 arm
->core_cache
= cache
;
595 int arm_arch_state(struct target
*target
)
597 struct arm
*arm
= target_to_arm(target
);
599 if (arm
->common_magic
!= ARM_COMMON_MAGIC
) {
600 LOG_ERROR("BUG: called for a non-ARM target");
604 LOG_USER("target halted in %s state due to %s, current mode: %s\n"
605 "cpsr: 0x%8.8" PRIx32
" pc: 0x%8.8" PRIx32
"%s",
606 arm_state_strings
[arm
->core_state
],
607 debug_reason_name(target
),
608 arm_mode_name(arm
->core_mode
),
609 buf_get_u32(arm
->cpsr
->value
, 0, 32),
610 buf_get_u32(arm
->pc
->value
, 0, 32),
611 arm
->is_semihosting
? ", semihosting" : "");
616 #define ARMV4_5_CORE_REG_MODENUM(cache, mode, num) \
617 (cache->reg_list[armv4_5_core_reg_map[mode][num]])
619 COMMAND_HANDLER(handle_armv4_5_reg_command
)
621 struct target
*target
= get_current_target(CMD_CTX
);
622 struct arm
*arm
= target_to_arm(target
);
626 command_print(CMD_CTX
, "current target isn't an ARM");
630 if (target
->state
!= TARGET_HALTED
) {
631 command_print(CMD_CTX
, "error: target must be halted for register accesses");
635 if (arm
->core_type
!= ARM_MODE_ANY
) {
636 command_print(CMD_CTX
,
637 "Microcontroller Profile not supported - use standard reg cmd");
641 if (!is_arm_mode(arm
->core_mode
)) {
642 LOG_ERROR("not a valid arm core mode - communication failure?");
646 if (!arm
->full_context
) {
647 command_print(CMD_CTX
, "error: target doesn't support %s",
652 regs
= arm
->core_cache
->reg_list
;
654 for (unsigned mode
= 0; mode
< ARRAY_SIZE(arm_mode_data
); mode
++) {
659 /* label this bank of registers (or shadows) */
660 switch (arm_mode_data
[mode
].psr
) {
664 name
= "System and User";
668 if (arm
->core_type
!= ARM_MODE_MON
)
672 name
= arm_mode_data
[mode
].name
;
676 command_print(CMD_CTX
, "%s%s mode %sregisters",
679 /* display N rows of up to 4 registers each */
680 for (unsigned i
= 0; i
< arm_mode_data
[mode
].n_indices
; ) {
684 for (unsigned j
= 0; j
< 4; j
++, i
++) {
686 struct reg
*reg
= regs
;
688 if (i
>= arm_mode_data
[mode
].n_indices
)
691 reg
+= arm_mode_data
[mode
].indices
[i
];
693 /* REVISIT be smarter about faults... */
695 arm
->full_context(target
);
697 value
= buf_get_u32(reg
->value
, 0, 32);
698 output_len
+= snprintf(output
+ output_len
,
699 sizeof(output
) - output_len
,
700 "%8s: %8.8" PRIx32
" ",
703 command_print(CMD_CTX
, "%s", output
);
710 COMMAND_HANDLER(handle_armv4_5_core_state_command
)
712 struct target
*target
= get_current_target(CMD_CTX
);
713 struct arm
*arm
= target_to_arm(target
);
716 command_print(CMD_CTX
, "current target isn't an ARM");
720 if (arm
->core_type
== ARM_MODE_THREAD
) {
721 /* armv7m not supported */
722 command_print(CMD_CTX
, "Unsupported Command");
727 if (strcmp(CMD_ARGV
[0], "arm") == 0)
728 arm
->core_state
= ARM_STATE_ARM
;
729 if (strcmp(CMD_ARGV
[0], "thumb") == 0)
730 arm
->core_state
= ARM_STATE_THUMB
;
733 command_print(CMD_CTX
, "core state: %s", arm_state_strings
[arm
->core_state
]);
738 COMMAND_HANDLER(handle_arm_disassemble_command
)
740 int retval
= ERROR_OK
;
741 struct target
*target
= get_current_target(CMD_CTX
);
743 if (target
== NULL
) {
744 LOG_ERROR("No target selected");
748 struct arm
*arm
= target_to_arm(target
);
754 command_print(CMD_CTX
, "current target isn't an ARM");
758 if (arm
->core_type
== ARM_MODE_THREAD
) {
759 /* armv7m is always thumb mode */
765 if (strcmp(CMD_ARGV
[2], "thumb") != 0)
770 COMMAND_PARSE_NUMBER(int, CMD_ARGV
[1], count
);
773 COMMAND_PARSE_NUMBER(u32
, CMD_ARGV
[0], address
);
774 if (address
& 0x01) {
776 command_print(CMD_CTX
, "Disassemble as Thumb");
785 retval
= ERROR_COMMAND_SYNTAX_ERROR
;
788 while (count
-- > 0) {
789 struct arm_instruction cur_instruction
;
792 /* Always use Thumb2 disassembly for best handling
793 * of 32-bit BL/BLX, and to work with newer cores
794 * (some ARMv6, all ARMv7) that use Thumb2.
796 retval
= thumb2_opcode(target
, address
,
798 if (retval
!= ERROR_OK
)
803 retval
= target_read_u32(target
, address
, &opcode
);
804 if (retval
!= ERROR_OK
)
806 retval
= arm_evaluate_opcode(opcode
, address
,
807 &cur_instruction
) != ERROR_OK
;
808 if (retval
!= ERROR_OK
)
811 command_print(CMD_CTX
, "%s", cur_instruction
.text
);
812 address
+= cur_instruction
.instruction_size
;
818 static int jim_mcrmrc(Jim_Interp
*interp
, int argc
, Jim_Obj
* const *argv
)
820 struct command_context
*context
;
821 struct target
*target
;
825 context
= current_command_context(interp
);
826 assert(context
!= NULL
);
828 target
= get_current_target(context
);
829 if (target
== NULL
) {
830 LOG_ERROR("%s: no current target", __func__
);
833 if (!target_was_examined(target
)) {
834 LOG_ERROR("%s: not yet examined", target_name(target
));
837 arm
= target_to_arm(target
);
839 LOG_ERROR("%s: not an ARM", target_name(target
));
843 if ((argc
< 6) || (argc
> 7)) {
844 /* FIXME use the command name to verify # params... */
845 LOG_ERROR("%s: wrong number of arguments", __func__
);
857 /* NOTE: parameter sequence matches ARM instruction set usage:
858 * MCR pNUM, op1, rX, CRn, CRm, op2 ; write CP from rX
859 * MRC pNUM, op1, rX, CRn, CRm, op2 ; read CP into rX
860 * The "rX" is necessarily omitted; it uses Tcl mechanisms.
862 retval
= Jim_GetLong(interp
, argv
[1], &l
);
863 if (retval
!= JIM_OK
)
866 LOG_ERROR("%s: %s %d out of range", __func__
,
867 "coprocessor", (int) l
);
872 retval
= Jim_GetLong(interp
, argv
[2], &l
);
873 if (retval
!= JIM_OK
)
876 LOG_ERROR("%s: %s %d out of range", __func__
,
882 retval
= Jim_GetLong(interp
, argv
[3], &l
);
883 if (retval
!= JIM_OK
)
886 LOG_ERROR("%s: %s %d out of range", __func__
,
892 retval
= Jim_GetLong(interp
, argv
[4], &l
);
893 if (retval
!= JIM_OK
)
896 LOG_ERROR("%s: %s %d out of range", __func__
,
902 retval
= Jim_GetLong(interp
, argv
[5], &l
);
903 if (retval
!= JIM_OK
)
906 LOG_ERROR("%s: %s %d out of range", __func__
,
914 /* FIXME don't assume "mrc" vs "mcr" from the number of params;
915 * that could easily be a typo! Check both...
917 * FIXME change the call syntax here ... simplest to just pass
918 * the MRC() or MCR() instruction to be executed. That will also
919 * let us support the "mrc2" and "mcr2" opcodes (toggling one bit)
920 * if that's ever needed.
923 retval
= Jim_GetLong(interp
, argv
[6], &l
);
924 if (retval
!= JIM_OK
)
928 /* NOTE: parameters reordered! */
929 /* ARMV4_5_MCR(cpnum, op1, 0, CRn, CRm, op2) */
930 retval
= arm
->mcr(target
, cpnum
, op1
, op2
, CRn
, CRm
, value
);
931 if (retval
!= ERROR_OK
)
934 /* NOTE: parameters reordered! */
935 /* ARMV4_5_MRC(cpnum, op1, 0, CRn, CRm, op2) */
936 retval
= arm
->mrc(target
, cpnum
, op1
, op2
, CRn
, CRm
, &value
);
937 if (retval
!= ERROR_OK
)
940 Jim_SetResult(interp
, Jim_NewIntObj(interp
, value
));
946 COMMAND_HANDLER(handle_arm_semihosting_command
)
948 struct target
*target
= get_current_target(CMD_CTX
);
950 if (target
== NULL
) {
951 LOG_ERROR("No target selected");
955 struct arm
*arm
= target_to_arm(target
);
958 command_print(CMD_CTX
, "current target isn't an ARM");
962 if (!arm
->setup_semihosting
) {
963 command_print(CMD_CTX
, "semihosting not supported for current target");
970 COMMAND_PARSE_ENABLE(CMD_ARGV
[0], semihosting
);
972 if (!target_was_examined(target
)) {
973 LOG_ERROR("Target not examined yet");
977 if (arm
->setup_semihosting(target
, semihosting
) != ERROR_OK
) {
978 LOG_ERROR("Failed to Configure semihosting");
982 /* FIXME never let that "catch" be dropped! */
983 arm
->is_semihosting
= semihosting
;
986 command_print(CMD_CTX
, "semihosting is %s",
988 ? "enabled" : "disabled");
993 static const struct command_registration arm_exec_command_handlers
[] = {
996 .handler
= handle_armv4_5_reg_command
,
997 .mode
= COMMAND_EXEC
,
998 .help
= "display ARM core registers",
1002 .name
= "core_state",
1003 .handler
= handle_armv4_5_core_state_command
,
1004 .mode
= COMMAND_EXEC
,
1005 .usage
= "['arm'|'thumb']",
1006 .help
= "display/change ARM core state",
1009 .name
= "disassemble",
1010 .handler
= handle_arm_disassemble_command
,
1011 .mode
= COMMAND_EXEC
,
1012 .usage
= "address [count ['thumb']]",
1013 .help
= "disassemble instructions ",
1017 .mode
= COMMAND_EXEC
,
1018 .jim_handler
= &jim_mcrmrc
,
1019 .help
= "write coprocessor register",
1020 .usage
= "cpnum op1 CRn CRm op2 value",
1024 .jim_handler
= &jim_mcrmrc
,
1025 .help
= "read coprocessor register",
1026 .usage
= "cpnum op1 CRn CRm op2",
1030 .handler
= handle_arm_semihosting_command
,
1031 .mode
= COMMAND_EXEC
,
1032 .usage
= "['enable'|'disable']",
1033 .help
= "activate support for semihosting operations",
1036 COMMAND_REGISTRATION_DONE
1038 const struct command_registration arm_command_handlers
[] = {
1041 .mode
= COMMAND_ANY
,
1042 .help
= "ARM command group",
1044 .chain
= arm_exec_command_handlers
,
1046 COMMAND_REGISTRATION_DONE
1049 int arm_get_gdb_reg_list(struct target
*target
,
1050 struct reg
**reg_list
[], int *reg_list_size
)
1052 struct arm
*arm
= target_to_arm(target
);
1055 if (!is_arm_mode(arm
->core_mode
)) {
1056 LOG_ERROR("not a valid arm core mode - communication failure?");
1060 *reg_list_size
= 26;
1061 *reg_list
= malloc(sizeof(struct reg
*) * (*reg_list_size
));
1063 for (i
= 0; i
< 16; i
++)
1064 (*reg_list
)[i
] = arm_reg_current(arm
, i
);
1066 for (i
= 16; i
< 24; i
++)
1067 (*reg_list
)[i
] = &arm_gdb_dummy_fp_reg
;
1069 (*reg_list
)[24] = &arm_gdb_dummy_fps_reg
;
1070 (*reg_list
)[25] = arm
->cpsr
;
1075 /* wait for execution to complete and check exit point */
1076 static int armv4_5_run_algorithm_completion(struct target
*target
,
1077 uint32_t exit_point
,
1082 struct arm
*arm
= target_to_arm(target
);
1084 retval
= target_wait_state(target
, TARGET_HALTED
, timeout_ms
);
1085 if (retval
!= ERROR_OK
)
1087 if (target
->state
!= TARGET_HALTED
) {
1088 retval
= target_halt(target
);
1089 if (retval
!= ERROR_OK
)
1091 retval
= target_wait_state(target
, TARGET_HALTED
, 500);
1092 if (retval
!= ERROR_OK
)
1094 return ERROR_TARGET_TIMEOUT
;
1097 /* fast exit: ARMv5+ code can use BKPT */
1098 if (exit_point
&& buf_get_u32(arm
->pc
->value
, 0, 32) != exit_point
) {
1100 "target reentered debug state, but not at the desired exit point: 0x%4.4" PRIx32
"",
1101 buf_get_u32(arm
->pc
->value
, 0, 32));
1102 return ERROR_TARGET_TIMEOUT
;
1108 int armv4_5_run_algorithm_inner(struct target
*target
,
1109 int num_mem_params
, struct mem_param
*mem_params
,
1110 int num_reg_params
, struct reg_param
*reg_params
,
1111 uint32_t entry_point
, uint32_t exit_point
,
1112 int timeout_ms
, void *arch_info
,
1113 int (*run_it
)(struct target
*target
, uint32_t exit_point
,
1114 int timeout_ms
, void *arch_info
))
1116 struct arm
*arm
= target_to_arm(target
);
1117 struct arm_algorithm
*arm_algorithm_info
= arch_info
;
1118 enum arm_state core_state
= arm
->core_state
;
1119 uint32_t context
[17];
1121 int exit_breakpoint_size
= 0;
1123 int retval
= ERROR_OK
;
1125 LOG_DEBUG("Running algorithm");
1127 if (arm_algorithm_info
->common_magic
!= ARM_COMMON_MAGIC
) {
1128 LOG_ERROR("current target isn't an ARMV4/5 target");
1129 return ERROR_TARGET_INVALID
;
1132 if (target
->state
!= TARGET_HALTED
) {
1133 LOG_WARNING("target not halted");
1134 return ERROR_TARGET_NOT_HALTED
;
1137 if (!is_arm_mode(arm
->core_mode
)) {
1138 LOG_ERROR("not a valid arm core mode - communication failure?");
1142 /* armv5 and later can terminate with BKPT instruction; less overhead */
1143 if (!exit_point
&& arm
->is_armv4
) {
1144 LOG_ERROR("ARMv4 target needs HW breakpoint location");
1148 /* save r0..pc, cpsr-or-spsr, and then cpsr-for-sure;
1149 * they'll be restored later.
1151 for (i
= 0; i
<= 16; i
++) {
1154 r
= &ARMV4_5_CORE_REG_MODE(arm
->core_cache
,
1155 arm_algorithm_info
->core_mode
, i
);
1157 arm
->read_core_reg(target
, r
, i
,
1158 arm_algorithm_info
->core_mode
);
1159 context
[i
] = buf_get_u32(r
->value
, 0, 32);
1161 cpsr
= buf_get_u32(arm
->cpsr
->value
, 0, 32);
1163 for (i
= 0; i
< num_mem_params
; i
++) {
1164 retval
= target_write_buffer(target
, mem_params
[i
].address
, mem_params
[i
].size
,
1165 mem_params
[i
].value
);
1166 if (retval
!= ERROR_OK
)
1170 for (i
= 0; i
< num_reg_params
; i
++) {
1171 struct reg
*reg
= register_get_by_name(arm
->core_cache
, reg_params
[i
].reg_name
, 0);
1173 LOG_ERROR("BUG: register '%s' not found", reg_params
[i
].reg_name
);
1174 return ERROR_COMMAND_SYNTAX_ERROR
;
1177 if (reg
->size
!= reg_params
[i
].size
) {
1178 LOG_ERROR("BUG: register '%s' size doesn't match reg_params[i].size",
1179 reg_params
[i
].reg_name
);
1180 return ERROR_COMMAND_SYNTAX_ERROR
;
1183 retval
= armv4_5_set_core_reg(reg
, reg_params
[i
].value
);
1184 if (retval
!= ERROR_OK
)
1188 arm
->core_state
= arm_algorithm_info
->core_state
;
1189 if (arm
->core_state
== ARM_STATE_ARM
)
1190 exit_breakpoint_size
= 4;
1191 else if (arm
->core_state
== ARM_STATE_THUMB
)
1192 exit_breakpoint_size
= 2;
1194 LOG_ERROR("BUG: can't execute algorithms when not in ARM or Thumb state");
1195 return ERROR_COMMAND_SYNTAX_ERROR
;
1198 if (arm_algorithm_info
->core_mode
!= ARM_MODE_ANY
) {
1199 LOG_DEBUG("setting core_mode: 0x%2.2x",
1200 arm_algorithm_info
->core_mode
);
1201 buf_set_u32(arm
->cpsr
->value
, 0, 5,
1202 arm_algorithm_info
->core_mode
);
1203 arm
->cpsr
->dirty
= 1;
1204 arm
->cpsr
->valid
= 1;
1207 /* terminate using a hardware or (ARMv5+) software breakpoint */
1209 retval
= breakpoint_add(target
, exit_point
,
1210 exit_breakpoint_size
, BKPT_HARD
);
1211 if (retval
!= ERROR_OK
) {
1212 LOG_ERROR("can't add HW breakpoint to terminate algorithm");
1213 return ERROR_TARGET_FAILURE
;
1217 retval
= target_resume(target
, 0, entry_point
, 1, 1);
1218 if (retval
!= ERROR_OK
)
1220 retval
= run_it(target
, exit_point
, timeout_ms
, arch_info
);
1223 breakpoint_remove(target
, exit_point
);
1225 if (retval
!= ERROR_OK
)
1228 for (i
= 0; i
< num_mem_params
; i
++) {
1229 if (mem_params
[i
].direction
!= PARAM_OUT
) {
1230 int retvaltemp
= target_read_buffer(target
, mem_params
[i
].address
,
1232 mem_params
[i
].value
);
1233 if (retvaltemp
!= ERROR_OK
)
1234 retval
= retvaltemp
;
1238 for (i
= 0; i
< num_reg_params
; i
++) {
1239 if (reg_params
[i
].direction
!= PARAM_OUT
) {
1241 struct reg
*reg
= register_get_by_name(arm
->core_cache
,
1242 reg_params
[i
].reg_name
,
1245 LOG_ERROR("BUG: register '%s' not found", reg_params
[i
].reg_name
);
1246 retval
= ERROR_COMMAND_SYNTAX_ERROR
;
1250 if (reg
->size
!= reg_params
[i
].size
) {
1252 "BUG: register '%s' size doesn't match reg_params[i].size",
1253 reg_params
[i
].reg_name
);
1254 retval
= ERROR_COMMAND_SYNTAX_ERROR
;
1258 buf_set_u32(reg_params
[i
].value
, 0, 32, buf_get_u32(reg
->value
, 0, 32));
1262 /* restore everything we saved before (17 or 18 registers) */
1263 for (i
= 0; i
<= 16; i
++) {
1265 regvalue
= buf_get_u32(ARMV4_5_CORE_REG_MODE(arm
->core_cache
,
1266 arm_algorithm_info
->core_mode
, i
).value
, 0, 32);
1267 if (regvalue
!= context
[i
]) {
1268 LOG_DEBUG("restoring register %s with value 0x%8.8" PRIx32
"",
1269 ARMV4_5_CORE_REG_MODE(arm
->core_cache
,
1270 arm_algorithm_info
->core_mode
, i
).name
, context
[i
]);
1271 buf_set_u32(ARMV4_5_CORE_REG_MODE(arm
->core_cache
,
1272 arm_algorithm_info
->core_mode
, i
).value
, 0, 32, context
[i
]);
1273 ARMV4_5_CORE_REG_MODE(arm
->core_cache
, arm_algorithm_info
->core_mode
,
1275 ARMV4_5_CORE_REG_MODE(arm
->core_cache
, arm_algorithm_info
->core_mode
,
1280 arm_set_cpsr(arm
, cpsr
);
1281 arm
->cpsr
->dirty
= 1;
1283 arm
->core_state
= core_state
;
1288 int armv4_5_run_algorithm(struct target
*target
,
1290 struct mem_param
*mem_params
,
1292 struct reg_param
*reg_params
,
1293 uint32_t entry_point
,
1294 uint32_t exit_point
,
1298 return armv4_5_run_algorithm_inner(target
,
1307 armv4_5_run_algorithm_completion
);
1311 * Runs ARM code in the target to calculate a CRC32 checksum.
1314 int arm_checksum_memory(struct target
*target
,
1315 uint32_t address
, uint32_t count
, uint32_t *checksum
)
1317 struct working_area
*crc_algorithm
;
1318 struct arm_algorithm arm_algo
;
1319 struct arm
*arm
= target_to_arm(target
);
1320 struct reg_param reg_params
[2];
1323 uint32_t exit_var
= 0;
1325 /* see contrib/loaders/checksum/armv4_5_crc.s for src */
1327 static const uint32_t arm_crc_code
[] = {
1328 0xE1A02000, /* mov r2, r0 */
1329 0xE3E00000, /* mov r0, #0xffffffff */
1330 0xE1A03001, /* mov r3, r1 */
1331 0xE3A04000, /* mov r4, #0 */
1332 0xEA00000B, /* b ncomp */
1334 0xE7D21004, /* ldrb r1, [r2, r4] */
1335 0xE59F7030, /* ldr r7, CRC32XOR */
1336 0xE0200C01, /* eor r0, r0, r1, asl 24 */
1337 0xE3A05000, /* mov r5, #0 */
1339 0xE3500000, /* cmp r0, #0 */
1340 0xE1A06080, /* mov r6, r0, asl #1 */
1341 0xE2855001, /* add r5, r5, #1 */
1342 0xE1A00006, /* mov r0, r6 */
1343 0xB0260007, /* eorlt r0, r6, r7 */
1344 0xE3550008, /* cmp r5, #8 */
1345 0x1AFFFFF8, /* bne loop */
1346 0xE2844001, /* add r4, r4, #1 */
1348 0xE1540003, /* cmp r4, r3 */
1349 0x1AFFFFF1, /* bne nbyte */
1351 0xe1200070, /* bkpt #0 */
1353 0x04C11DB7 /* .word 0x04C11DB7 */
1356 retval
= target_alloc_working_area(target
,
1357 sizeof(arm_crc_code
), &crc_algorithm
);
1358 if (retval
!= ERROR_OK
)
1361 /* convert code into a buffer in target endianness */
1362 for (i
= 0; i
< ARRAY_SIZE(arm_crc_code
); i
++) {
1363 retval
= target_write_u32(target
,
1364 crc_algorithm
->address
+ i
* sizeof(uint32_t),
1366 if (retval
!= ERROR_OK
)
1370 arm_algo
.common_magic
= ARM_COMMON_MAGIC
;
1371 arm_algo
.core_mode
= ARM_MODE_SVC
;
1372 arm_algo
.core_state
= ARM_STATE_ARM
;
1374 init_reg_param(®_params
[0], "r0", 32, PARAM_IN_OUT
);
1375 init_reg_param(®_params
[1], "r1", 32, PARAM_OUT
);
1377 buf_set_u32(reg_params
[0].value
, 0, 32, address
);
1378 buf_set_u32(reg_params
[1].value
, 0, 32, count
);
1380 /* 20 second timeout/megabyte */
1381 int timeout
= 20000 * (1 + (count
/ (1024 * 1024)));
1383 /* armv4 must exit using a hardware breakpoint */
1385 exit_var
= crc_algorithm
->address
+ sizeof(arm_crc_code
) - 8;
1387 retval
= target_run_algorithm(target
, 0, NULL
, 2, reg_params
,
1388 crc_algorithm
->address
,
1390 timeout
, &arm_algo
);
1391 if (retval
!= ERROR_OK
) {
1392 LOG_ERROR("error executing ARM crc algorithm");
1393 destroy_reg_param(®_params
[0]);
1394 destroy_reg_param(®_params
[1]);
1395 target_free_working_area(target
, crc_algorithm
);
1399 *checksum
= buf_get_u32(reg_params
[0].value
, 0, 32);
1401 destroy_reg_param(®_params
[0]);
1402 destroy_reg_param(®_params
[1]);
1404 target_free_working_area(target
, crc_algorithm
);
1410 * Runs ARM code in the target to check whether a memory block holds
1411 * all ones. NOR flash which has been erased, and thus may be written,
1415 int arm_blank_check_memory(struct target
*target
,
1416 uint32_t address
, uint32_t count
, uint32_t *blank
)
1418 struct working_area
*check_algorithm
;
1419 struct reg_param reg_params
[3];
1420 struct arm_algorithm arm_algo
;
1421 struct arm
*arm
= target_to_arm(target
);
1424 uint32_t exit_var
= 0;
1426 /* see contrib/loaders/erase_check/armv4_5_erase_check.s for src */
1428 static const uint32_t check_code
[] = {
1430 0xe4d03001, /* ldrb r3, [r0], #1 */
1431 0xe0022003, /* and r2, r2, r3 */
1432 0xe2511001, /* subs r1, r1, #1 */
1433 0x1afffffb, /* bne loop */
1435 0xe1200070, /* bkpt #0 */
1438 /* make sure we have a working area */
1439 retval
= target_alloc_working_area(target
,
1440 sizeof(check_code
), &check_algorithm
);
1441 if (retval
!= ERROR_OK
)
1444 /* convert code into a buffer in target endianness */
1445 for (i
= 0; i
< ARRAY_SIZE(check_code
); i
++) {
1446 retval
= target_write_u32(target
,
1447 check_algorithm
->address
1448 + i
* sizeof(uint32_t),
1450 if (retval
!= ERROR_OK
)
1454 arm_algo
.common_magic
= ARM_COMMON_MAGIC
;
1455 arm_algo
.core_mode
= ARM_MODE_SVC
;
1456 arm_algo
.core_state
= ARM_STATE_ARM
;
1458 init_reg_param(®_params
[0], "r0", 32, PARAM_OUT
);
1459 buf_set_u32(reg_params
[0].value
, 0, 32, address
);
1461 init_reg_param(®_params
[1], "r1", 32, PARAM_OUT
);
1462 buf_set_u32(reg_params
[1].value
, 0, 32, count
);
1464 init_reg_param(®_params
[2], "r2", 32, PARAM_IN_OUT
);
1465 buf_set_u32(reg_params
[2].value
, 0, 32, 0xff);
1467 /* armv4 must exit using a hardware breakpoint */
1469 exit_var
= check_algorithm
->address
+ sizeof(check_code
) - 4;
1471 retval
= target_run_algorithm(target
, 0, NULL
, 3, reg_params
,
1472 check_algorithm
->address
,
1475 if (retval
!= ERROR_OK
) {
1476 destroy_reg_param(®_params
[0]);
1477 destroy_reg_param(®_params
[1]);
1478 destroy_reg_param(®_params
[2]);
1479 target_free_working_area(target
, check_algorithm
);
1483 *blank
= buf_get_u32(reg_params
[2].value
, 0, 32);
1485 destroy_reg_param(®_params
[0]);
1486 destroy_reg_param(®_params
[1]);
1487 destroy_reg_param(®_params
[2]);
1489 target_free_working_area(target
, check_algorithm
);
1494 static int arm_full_context(struct target
*target
)
1496 struct arm
*arm
= target_to_arm(target
);
1497 unsigned num_regs
= arm
->core_cache
->num_regs
;
1498 struct reg
*reg
= arm
->core_cache
->reg_list
;
1499 int retval
= ERROR_OK
;
1501 for (; num_regs
&& retval
== ERROR_OK
; num_regs
--, reg
++) {
1504 retval
= armv4_5_get_core_reg(reg
);
1509 static int arm_default_mrc(struct target
*target
, int cpnum
,
1510 uint32_t op1
, uint32_t op2
,
1511 uint32_t CRn
, uint32_t CRm
,
1514 LOG_ERROR("%s doesn't implement MRC", target_type_name(target
));
1518 static int arm_default_mcr(struct target
*target
, int cpnum
,
1519 uint32_t op1
, uint32_t op2
,
1520 uint32_t CRn
, uint32_t CRm
,
1523 LOG_ERROR("%s doesn't implement MCR", target_type_name(target
));
1527 int arm_init_arch_info(struct target
*target
, struct arm
*arm
)
1529 target
->arch_info
= arm
;
1530 arm
->target
= target
;
1532 arm
->common_magic
= ARM_COMMON_MAGIC
;
1534 /* core_type may be overridden by subtype logic */
1535 if (arm
->core_type
!= ARM_MODE_THREAD
) {
1536 arm
->core_type
= ARM_MODE_ANY
;
1537 arm_set_cpsr(arm
, ARM_MODE_USR
);
1540 /* default full_context() has no core-specific optimizations */
1541 if (!arm
->full_context
&& arm
->read_core_reg
)
1542 arm
->full_context
= arm_full_context
;
1545 arm
->mrc
= arm_default_mrc
;
1547 arm
->mcr
= arm_default_mcr
;