?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
flash: erase_address now has an unlock option
[openocd/cortex.git] / src / target / arm7_9_common.c
blob9f1bb2e64722145d7c17a7b730e568df3835cc60
1 /***************************************************************************
2 * Copyright (C) 2005 by Dominic Rath *
3 * Dominic.Rath@gmx.de *
4 * *
5 * Copyright (C) 2007-2009 Øyvind Harboe *
6 * oyvind.harboe@zylin.com *
7 * *
8 * Copyright (C) 2008 by Spencer Oliver *
9 * spen@spen-soft.co.uk *
10 * *
11 * Copyright (C) 2008 by Hongtao Zheng *
12 * hontor@126.com *
13 * *
14 * Copyright (C) 2009 by David Brownell *
15 * *
16 * This program is free software; you can redistribute it and/or modify *
17 * it under the terms of the GNU General Public License as published by *
18 * the Free Software Foundation; either version 2 of the License, or *
19 * (at your option) any later version. *
20 * *
21 * This program is distributed in the hope that it will be useful, *
22 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
23 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
24 * GNU General Public License for more details. *
25 * *
26 * You should have received a copy of the GNU General Public License *
27 * along with this program; if not, write to the *
28 * Free Software Foundation, Inc., *
29 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
30 ***************************************************************************/
31 #ifdef HAVE_CONFIG_H
32 #include "config.h"
33 #endif
34
35 #include "breakpoints.h"
36 #include "embeddedice.h"
37 #include "target_request.h"
38 #include "etm.h"
39 #include <helper/time_support.h>
40 #include "arm_simulator.h"
41 #include "arm_semihosting.h"
42 #include "algorithm.h"
43 #include "register.h"
44 #include "armv4_5.h"
45
46
47 /**
48 * @file
49 * Hold common code supporting the ARM7 and ARM9 core generations.
50 *
51 * While the ARM core implementations evolved substantially during these
52 * two generations, they look quite similar from the JTAG perspective.
53 * Both have similar debug facilities, based on the same two scan chains
54 * providing access to the core and to an EmbeddedICE module. Both can
55 * support similar ETM and ETB modules, for tracing. And both expose
56 * what could be viewed as "ARM Classic", with multiple processor modes,
57 * shadowed registers, and support for the Thumb instruction set.
58 *
59 * Processor differences include things like presence or absence of MMU
60 * and cache, pipeline sizes, use of a modified Harvard Architecure
61 * (with separate instruction and data busses from the CPU), support
62 * for cpu clock gating during idle, and more.
63 */
64
65 static int arm7_9_debug_entry(struct target *target);
66
67 /**
68 * Clear watchpoints for an ARM7/9 target.
69 *
70 * @param arm7_9 Pointer to the common struct for an ARM7/9 target
71 * @return JTAG error status after executing queue
72 */
73 static int arm7_9_clear_watchpoints(struct arm7_9_common *arm7_9)
74 {
75 LOG_DEBUG("-");
76 embeddedice_write_reg(&arm7_9->eice_cache->reg_list[EICE_W0_CONTROL_VALUE], 0x0);
77 embeddedice_write_reg(&arm7_9->eice_cache->reg_list[EICE_W1_CONTROL_VALUE], 0x0);
78 arm7_9->sw_breakpoint_count = 0;
79 arm7_9->sw_breakpoints_added = 0;
80 arm7_9->wp0_used = 0;
81 arm7_9->wp1_used = arm7_9->wp1_used_default;
82 arm7_9->wp_available = arm7_9->wp_available_max;
83
84 return jtag_execute_queue();
85 }
86
87 /**
88 * Assign a watchpoint to one of the two available hardware comparators in an
89 * ARM7 or ARM9 target.
90 *
91 * @param arm7_9 Pointer to the common struct for an ARM7/9 target
92 * @param breakpoint Pointer to the breakpoint to be used as a watchpoint
93 */
94 static void arm7_9_assign_wp(struct arm7_9_common *arm7_9, struct breakpoint *breakpoint)
95 {
96 if (!arm7_9->wp0_used)
97 {
98 arm7_9->wp0_used = 1;
99 breakpoint->set = 1;
100 arm7_9->wp_available--;
101 }
102 else if (!arm7_9->wp1_used)
103 {
104 arm7_9->wp1_used = 1;
105 breakpoint->set = 2;
106 arm7_9->wp_available--;
107 }
108 else
109 {
110 LOG_ERROR("BUG: no hardware comparator available");
111 }
112 LOG_DEBUG("BPID: %d (0x%08" PRIx32 ") using hw wp: %d",
113 breakpoint->unique_id,
114 breakpoint->address,
115 breakpoint->set );
116 }
117
118 /**
119 * Setup an ARM7/9 target's embedded ICE registers for software breakpoints.
120 *
121 * @param arm7_9 Pointer to common struct for ARM7/9 targets
122 * @return Error codes if there is a problem finding a watchpoint or the result
123 * of executing the JTAG queue
124 */
125 static int arm7_9_set_software_breakpoints(struct arm7_9_common *arm7_9)
126 {
127 if (arm7_9->sw_breakpoints_added)
128 {
129 return ERROR_OK;
130 }
131 if (arm7_9->wp_available < 1)
132 {
133 LOG_WARNING("can't enable sw breakpoints with no watchpoint unit available");
134 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
135 }
136 arm7_9->wp_available--;
137
138 /* pick a breakpoint unit */
139 if (!arm7_9->wp0_used)
140 {
141 arm7_9->sw_breakpoints_added = 1;
142 arm7_9->wp0_used = 3;
143 } else if (!arm7_9->wp1_used)
144 {
145 arm7_9->sw_breakpoints_added = 2;
146 arm7_9->wp1_used = 3;
147 }
148 else
149 {
150 LOG_ERROR("BUG: both watchpoints used, but wp_available >= 1");
151 return ERROR_FAIL;
152 }
153
154 if (arm7_9->sw_breakpoints_added == 1)
155 {
156 embeddedice_set_reg(&arm7_9->eice_cache->reg_list[EICE_W0_DATA_VALUE], arm7_9->arm_bkpt);
157 embeddedice_set_reg(&arm7_9->eice_cache->reg_list[EICE_W0_DATA_MASK], 0x0);
158 embeddedice_set_reg(&arm7_9->eice_cache->reg_list[EICE_W0_ADDR_MASK], 0xffffffffu);
159 embeddedice_set_reg(&arm7_9->eice_cache->reg_list[EICE_W0_CONTROL_MASK], ~EICE_W_CTRL_nOPC & 0xff);
160 embeddedice_set_reg(&arm7_9->eice_cache->reg_list[EICE_W0_CONTROL_VALUE], EICE_W_CTRL_ENABLE);
161 }
162 else if (arm7_9->sw_breakpoints_added == 2)
163 {
164 embeddedice_set_reg(&arm7_9->eice_cache->reg_list[EICE_W1_DATA_VALUE], arm7_9->arm_bkpt);
165 embeddedice_set_reg(&arm7_9->eice_cache->reg_list[EICE_W1_DATA_MASK], 0x0);
166 embeddedice_set_reg(&arm7_9->eice_cache->reg_list[EICE_W1_ADDR_MASK], 0xffffffffu);
167 embeddedice_set_reg(&arm7_9->eice_cache->reg_list[EICE_W1_CONTROL_MASK], ~EICE_W_CTRL_nOPC & 0xff);
168 embeddedice_set_reg(&arm7_9->eice_cache->reg_list[EICE_W1_CONTROL_VALUE], EICE_W_CTRL_ENABLE);
169 }
170 else
171 {
172 LOG_ERROR("BUG: both watchpoints used, but wp_available >= 1");
173 return ERROR_FAIL;
174 }
175 LOG_DEBUG("SW BP using hw wp: %d",
176 arm7_9->sw_breakpoints_added );
177
178 return jtag_execute_queue();
179 }
180
181 /**
182 * Setup the common pieces for an ARM7/9 target after reset or on startup.
183 *
184 * @param target Pointer to an ARM7/9 target to setup
185 * @return Result of clearing the watchpoints on the target
186 */
187 static int arm7_9_setup(struct target *target)
188 {
189 struct arm7_9_common *arm7_9 = target_to_arm7_9(target);
190
191 return arm7_9_clear_watchpoints(arm7_9);
192 }
193
194 /**
195 * Set either a hardware or software breakpoint on an ARM7/9 target. The
196 * breakpoint is set up even if it is already set. Some actions, e.g. reset,
197 * might have erased the values in Embedded ICE.
198 *
199 * @param target Pointer to the target device to set the breakpoints on
200 * @param breakpoint Pointer to the breakpoint to be set
201 * @return For hardware breakpoints, this is the result of executing the JTAG
202 * queue. For software breakpoints, this will be the status of the
203 * required memory reads and writes
204 */
205 static int arm7_9_set_breakpoint(struct target *target, struct breakpoint *breakpoint)
206 {
207 struct arm7_9_common *arm7_9 = target_to_arm7_9(target);
208 int retval = ERROR_OK;
209
210 LOG_DEBUG("BPID: %d, Address: 0x%08" PRIx32 ", Type: %d" ,
211 breakpoint->unique_id,
212 breakpoint->address,
213 breakpoint->type);
214
215 if (target->state != TARGET_HALTED)
216 {
217 LOG_WARNING("target not halted");
218 return ERROR_TARGET_NOT_HALTED;
219 }
220
221 if (breakpoint->type == BKPT_HARD)
222 {
223 /* either an ARM (4 byte) or Thumb (2 byte) breakpoint */
224 uint32_t mask = (breakpoint->length == 4) ? 0x3u : 0x1u;
225
226 /* reassign a hw breakpoint */
227 if (breakpoint->set == 0)
228 {
229 arm7_9_assign_wp(arm7_9, breakpoint);
230 }
231
232 if (breakpoint->set == 1)
233 {
234 embeddedice_set_reg(&arm7_9->eice_cache->reg_list[EICE_W0_ADDR_VALUE], breakpoint->address);
235 embeddedice_set_reg(&arm7_9->eice_cache->reg_list[EICE_W0_ADDR_MASK], mask);
236 embeddedice_set_reg(&arm7_9->eice_cache->reg_list[EICE_W0_DATA_MASK], 0xffffffffu);
237 embeddedice_set_reg(&arm7_9->eice_cache->reg_list[EICE_W0_CONTROL_MASK], ~EICE_W_CTRL_nOPC & 0xff);
238 embeddedice_set_reg(&arm7_9->eice_cache->reg_list[EICE_W0_CONTROL_VALUE], EICE_W_CTRL_ENABLE);
239 }
240 else if (breakpoint->set == 2)
241 {
242 embeddedice_set_reg(&arm7_9->eice_cache->reg_list[EICE_W1_ADDR_VALUE], breakpoint->address);
243 embeddedice_set_reg(&arm7_9->eice_cache->reg_list[EICE_W1_ADDR_MASK], mask);
244 embeddedice_set_reg(&arm7_9->eice_cache->reg_list[EICE_W1_DATA_MASK], 0xffffffffu);
245 embeddedice_set_reg(&arm7_9->eice_cache->reg_list[EICE_W1_CONTROL_MASK], ~EICE_W_CTRL_nOPC & 0xff);
246 embeddedice_set_reg(&arm7_9->eice_cache->reg_list[EICE_W1_CONTROL_VALUE], EICE_W_CTRL_ENABLE);
247 }
248 else
249 {
250 LOG_ERROR("BUG: no hardware comparator available");
251 return ERROR_OK;
252 }
253
254 retval = jtag_execute_queue();
255 }
256 else if (breakpoint->type == BKPT_SOFT)
257 {
258 /* did we already set this breakpoint? */
259 if (breakpoint->set)
260 return ERROR_OK;
261
262 if (breakpoint->length == 4)
263 {
264 uint32_t verify = 0xffffffff;
265 /* keep the original instruction in target endianness */
266 if ((retval = target_read_memory(target, breakpoint->address, 4, 1, breakpoint->orig_instr)) != ERROR_OK)
267 {
268 return retval;
269 }
270 /* write the breakpoint instruction in target endianness (arm7_9->arm_bkpt is host endian) */
271 if ((retval = target_write_u32(target, breakpoint->address, arm7_9->arm_bkpt)) != ERROR_OK)
272 {
273 return retval;
274 }
275
276 if ((retval = target_read_u32(target, breakpoint->address, &verify)) != ERROR_OK)
277 {
278 return retval;
279 }
280 if (verify != arm7_9->arm_bkpt)
281 {
282 LOG_ERROR("Unable to set 32 bit software breakpoint at address %08" PRIx32 " - check that memory is read/writable", breakpoint->address);
283 return ERROR_OK;
284 }
285 }
286 else
287 {
288 uint16_t verify = 0xffff;
289 /* keep the original instruction in target endianness */
290 if ((retval = target_read_memory(target, breakpoint->address, 2, 1, breakpoint->orig_instr)) != ERROR_OK)
291 {
292 return retval;
293 }
294 /* write the breakpoint instruction in target endianness (arm7_9->thumb_bkpt is host endian) */
295 if ((retval = target_write_u16(target, breakpoint->address, arm7_9->thumb_bkpt)) != ERROR_OK)
296 {
297 return retval;
298 }
299
300 if ((retval = target_read_u16(target, breakpoint->address, &verify)) != ERROR_OK)
301 {
302 return retval;
303 }
304 if (verify != arm7_9->thumb_bkpt)
305 {
306 LOG_ERROR("Unable to set thumb software breakpoint at address %08" PRIx32 " - check that memory is read/writable", breakpoint->address);
307 return ERROR_OK;
308 }
309 }
310
311 if ((retval = arm7_9_set_software_breakpoints(arm7_9)) != ERROR_OK)
312 return retval;
313
314 arm7_9->sw_breakpoint_count++;
315
316 breakpoint->set = 1;
317 }
318
319 return retval;
320 }
321
322 /**
323 * Unsets an existing breakpoint on an ARM7/9 target. If it is a hardware
324 * breakpoint, the watchpoint used will be freed and the Embedded ICE registers
325 * will be updated. Otherwise, the software breakpoint will be restored to its
326 * original instruction if it hasn't already been modified.
327 *
328 * @param target Pointer to ARM7/9 target to unset the breakpoint from
329 * @param breakpoint Pointer to breakpoint to be unset
330 * @return For hardware breakpoints, this is the result of executing the JTAG
331 * queue. For software breakpoints, this will be the status of the
332 * required memory reads and writes
333 */
334 static int arm7_9_unset_breakpoint(struct target *target, struct breakpoint *breakpoint)
335 {
336 int retval = ERROR_OK;
337 struct arm7_9_common *arm7_9 = target_to_arm7_9(target);
338
339 LOG_DEBUG("BPID: %d, Address: 0x%08" PRIx32,
340 breakpoint->unique_id,
341 breakpoint->address );
342
343 if (!breakpoint->set)
344 {
345 LOG_WARNING("breakpoint not set");
346 return ERROR_OK;
347 }
348
349 if (breakpoint->type == BKPT_HARD)
350 {
351 LOG_DEBUG("BPID: %d Releasing hw wp: %d",
352 breakpoint->unique_id,
353 breakpoint->set );
354 if (breakpoint->set == 1)
355 {
356 embeddedice_set_reg(&arm7_9->eice_cache->reg_list[EICE_W0_CONTROL_VALUE], 0x0);
357 arm7_9->wp0_used = 0;
358 arm7_9->wp_available++;
359 }
360 else if (breakpoint->set == 2)
361 {
362 embeddedice_set_reg(&arm7_9->eice_cache->reg_list[EICE_W1_CONTROL_VALUE], 0x0);
363 arm7_9->wp1_used = 0;
364 arm7_9->wp_available++;
365 }
366 retval = jtag_execute_queue();
367 breakpoint->set = 0;
368 }
369 else
370 {
371 /* restore original instruction (kept in target endianness) */
372 if (breakpoint->length == 4)
373 {
374 uint32_t current_instr;
375 /* check that user program as not modified breakpoint instruction */
376 if ((retval = target_read_memory(target, breakpoint->address, 4, 1, (uint8_t*)&current_instr)) != ERROR_OK)
377 {
378 return retval;
379 }
380 if (current_instr == arm7_9->arm_bkpt)
381 if ((retval = target_write_memory(target, breakpoint->address, 4, 1, breakpoint->orig_instr)) != ERROR_OK)
382 {
383 return retval;
384 }
385 }
386 else
387 {
388 uint16_t current_instr;
389 /* check that user program as not modified breakpoint instruction */
390 if ((retval = target_read_memory(target, breakpoint->address, 2, 1, (uint8_t*)&current_instr)) != ERROR_OK)
391 {
392 return retval;
393 }
394 if (current_instr == arm7_9->thumb_bkpt)
395 if ((retval = target_write_memory(target, breakpoint->address, 2, 1, breakpoint->orig_instr)) != ERROR_OK)
396 {
397 return retval;
398 }
399 }
400
401 if (--arm7_9->sw_breakpoint_count==0)
402 {
403 /* We have removed the last sw breakpoint, clear the hw breakpoint we used to implement it */
404 if (arm7_9->sw_breakpoints_added == 1)
405 {
406 embeddedice_set_reg(&arm7_9->eice_cache->reg_list[EICE_W0_CONTROL_VALUE], 0);
407 }
408 else if (arm7_9->sw_breakpoints_added == 2)
409 {
410 embeddedice_set_reg(&arm7_9->eice_cache->reg_list[EICE_W1_CONTROL_VALUE], 0);
411 }
412 }
413
414 breakpoint->set = 0;
415 }
416
417 return retval;
418 }
419
420 /**
421 * Add a breakpoint to an ARM7/9 target. This makes sure that there are no
422 * dangling breakpoints and that the desired breakpoint can be added.
423 *
424 * @param target Pointer to the target ARM7/9 device to add a breakpoint to
425 * @param breakpoint Pointer to the breakpoint to be added
426 * @return An error status if there is a problem adding the breakpoint or the
427 * result of setting the breakpoint
428 */
429 int arm7_9_add_breakpoint(struct target *target, struct breakpoint *breakpoint)
430 {
431 struct arm7_9_common *arm7_9 = target_to_arm7_9(target);
432
433 if (arm7_9->breakpoint_count == 0)
434 {
435 /* make sure we don't have any dangling breakpoints. This is vital upon
436 * GDB connect/disconnect
437 */
438 arm7_9_clear_watchpoints(arm7_9);
439 }
440
441 if ((breakpoint->type == BKPT_HARD) && (arm7_9->wp_available < 1))
442 {
443 LOG_INFO("no watchpoint unit available for hardware breakpoint");
444 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
445 }
446
447 if ((breakpoint->length != 2) && (breakpoint->length != 4))
448 {
449 LOG_INFO("only breakpoints of two (Thumb) or four (ARM) bytes length supported");
450 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
451 }
452
453 if (breakpoint->type == BKPT_HARD)
454 {
455 arm7_9_assign_wp(arm7_9, breakpoint);
456 }
457
458 arm7_9->breakpoint_count++;
459
460 return arm7_9_set_breakpoint(target, breakpoint);
461 }
462
463 /**
464 * Removes a breakpoint from an ARM7/9 target. This will make sure there are no
465 * dangling breakpoints and updates available watchpoints if it is a hardware
466 * breakpoint.
467 *
468 * @param target Pointer to the target to have a breakpoint removed
469 * @param breakpoint Pointer to the breakpoint to be removed
470 * @return Error status if there was a problem unsetting the breakpoint or the
471 * watchpoints could not be cleared
472 */
473 int arm7_9_remove_breakpoint(struct target *target, struct breakpoint *breakpoint)
474 {
475 int retval = ERROR_OK;
476 struct arm7_9_common *arm7_9 = target_to_arm7_9(target);
477
478 if ((retval = arm7_9_unset_breakpoint(target, breakpoint)) != ERROR_OK)
479 {
480 return retval;
481 }
482
483 if (breakpoint->type == BKPT_HARD)
484 arm7_9->wp_available++;
485
486 arm7_9->breakpoint_count--;
487 if (arm7_9->breakpoint_count == 0)
488 {
489 /* make sure we don't have any dangling breakpoints */
490 if ((retval = arm7_9_clear_watchpoints(arm7_9)) != ERROR_OK)
491 {
492 return retval;
493 }
494 }
495
496 return ERROR_OK;
497 }
498
499 /**
500 * Sets a watchpoint for an ARM7/9 target in one of the watchpoint units. It is
501 * considered a bug to call this function when there are no available watchpoint
502 * units.
503 *
504 * @param target Pointer to an ARM7/9 target to set a watchpoint on
505 * @param watchpoint Pointer to the watchpoint to be set
506 * @return Error status if watchpoint set fails or the result of executing the
507 * JTAG queue
508 */
509 static int arm7_9_set_watchpoint(struct target *target, struct watchpoint *watchpoint)
510 {
511 int retval = ERROR_OK;
512 struct arm7_9_common *arm7_9 = target_to_arm7_9(target);
513 int rw_mask = 1;
514 uint32_t mask;
515
516 mask = watchpoint->length - 1;
517
518 if (target->state != TARGET_HALTED)
519 {
520 LOG_WARNING("target not halted");
521 return ERROR_TARGET_NOT_HALTED;
522 }
523
524 if (watchpoint->rw == WPT_ACCESS)
525 rw_mask = 0;
526 else
527 rw_mask = 1;
528
529 if (!arm7_9->wp0_used)
530 {
531 embeddedice_set_reg(&arm7_9->eice_cache->reg_list[EICE_W0_ADDR_VALUE], watchpoint->address);
532 embeddedice_set_reg(&arm7_9->eice_cache->reg_list[EICE_W0_ADDR_MASK], mask);
533 embeddedice_set_reg(&arm7_9->eice_cache->reg_list[EICE_W0_DATA_MASK], watchpoint->mask);
534 if (watchpoint->mask != 0xffffffffu)
535 embeddedice_set_reg(&arm7_9->eice_cache->reg_list[EICE_W0_DATA_VALUE], watchpoint->value);
536 embeddedice_set_reg(&arm7_9->eice_cache->reg_list[EICE_W0_CONTROL_MASK], 0xff & ~EICE_W_CTRL_nOPC & ~rw_mask);
537 embeddedice_set_reg(&arm7_9->eice_cache->reg_list[EICE_W0_CONTROL_VALUE], EICE_W_CTRL_ENABLE | EICE_W_CTRL_nOPC | (watchpoint->rw & 1));
538
539 if ((retval = jtag_execute_queue()) != ERROR_OK)
540 {
541 return retval;
542 }
543 watchpoint->set = 1;
544 arm7_9->wp0_used = 2;
545 }
546 else if (!arm7_9->wp1_used)
547 {
548 embeddedice_set_reg(&arm7_9->eice_cache->reg_list[EICE_W1_ADDR_VALUE], watchpoint->address);
549 embeddedice_set_reg(&arm7_9->eice_cache->reg_list[EICE_W1_ADDR_MASK], mask);
550 embeddedice_set_reg(&arm7_9->eice_cache->reg_list[EICE_W1_DATA_MASK], watchpoint->mask);
551 if (watchpoint->mask != 0xffffffffu)
552 embeddedice_set_reg(&arm7_9->eice_cache->reg_list[EICE_W1_DATA_VALUE], watchpoint->value);
553 embeddedice_set_reg(&arm7_9->eice_cache->reg_list[EICE_W1_CONTROL_MASK], 0xff & ~EICE_W_CTRL_nOPC & ~rw_mask);
554 embeddedice_set_reg(&arm7_9->eice_cache->reg_list[EICE_W1_CONTROL_VALUE], EICE_W_CTRL_ENABLE | EICE_W_CTRL_nOPC | (watchpoint->rw & 1));
555
556 if ((retval = jtag_execute_queue()) != ERROR_OK)
557 {
558 return retval;
559 }
560 watchpoint->set = 2;
561 arm7_9->wp1_used = 2;
562 }
563 else
564 {
565 LOG_ERROR("BUG: no hardware comparator available");
566 return ERROR_OK;
567 }
568
569 return ERROR_OK;
570 }
571
572 /**
573 * Unset an existing watchpoint and clear the used watchpoint unit.
574 *
575 * @param target Pointer to the target to have the watchpoint removed
576 * @param watchpoint Pointer to the watchpoint to be removed
577 * @return Error status while trying to unset the watchpoint or the result of
578 * executing the JTAG queue
579 */
580 static int arm7_9_unset_watchpoint(struct target *target, struct watchpoint *watchpoint)
581 {
582 int retval = ERROR_OK;
583 struct arm7_9_common *arm7_9 = target_to_arm7_9(target);
584
585 if (target->state != TARGET_HALTED)
586 {
587 LOG_WARNING("target not halted");
588 return ERROR_TARGET_NOT_HALTED;
589 }
590
591 if (!watchpoint->set)
592 {
593 LOG_WARNING("breakpoint not set");
594 return ERROR_OK;
595 }
596
597 if (watchpoint->set == 1)
598 {
599 embeddedice_set_reg(&arm7_9->eice_cache->reg_list[EICE_W0_CONTROL_VALUE], 0x0);
600 if ((retval = jtag_execute_queue()) != ERROR_OK)
601 {
602 return retval;
603 }
604 arm7_9->wp0_used = 0;
605 }
606 else if (watchpoint->set == 2)
607 {
608 embeddedice_set_reg(&arm7_9->eice_cache->reg_list[EICE_W1_CONTROL_VALUE], 0x0);
609 if ((retval = jtag_execute_queue()) != ERROR_OK)
610 {
611 return retval;
612 }
613 arm7_9->wp1_used = 0;
614 }
615 watchpoint->set = 0;
616
617 return ERROR_OK;
618 }
619
620 /**
621 * Add a watchpoint to an ARM7/9 target. If there are no watchpoint units
622 * available, an error response is returned.
623 *
624 * @param target Pointer to the ARM7/9 target to add a watchpoint to
625 * @param watchpoint Pointer to the watchpoint to be added
626 * @return Error status while trying to add the watchpoint
627 */
628 int arm7_9_add_watchpoint(struct target *target, struct watchpoint *watchpoint)
629 {
630 struct arm7_9_common *arm7_9 = target_to_arm7_9(target);
631
632 if (arm7_9->wp_available < 1)
633 {
634 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
635 }
636
637 if ((watchpoint->length != 1) && (watchpoint->length != 2) && (watchpoint->length != 4))
638 {
639 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
640 }
641
642 arm7_9->wp_available--;
643
644 return ERROR_OK;
645 }
646
647 /**
648 * Remove a watchpoint from an ARM7/9 target. The watchpoint will be unset and
649 * the used watchpoint unit will be reopened.
650 *
651 * @param target Pointer to the target to remove a watchpoint from
652 * @param watchpoint Pointer to the watchpoint to be removed
653 * @return Result of trying to unset the watchpoint
654 */
655 int arm7_9_remove_watchpoint(struct target *target, struct watchpoint *watchpoint)
656 {
657 int retval = ERROR_OK;
658 struct arm7_9_common *arm7_9 = target_to_arm7_9(target);
659
660 if (watchpoint->set)
661 {
662 if ((retval = arm7_9_unset_watchpoint(target, watchpoint)) != ERROR_OK)
663 {
664 return retval;
665 }
666 }
667
668 arm7_9->wp_available++;
669
670 return ERROR_OK;
671 }
672
673 /**
674 * Restarts the target by sending a RESTART instruction and moving the JTAG
675 * state to IDLE. This includes a timeout waiting for DBGACK and SYSCOMP to be
676 * asserted by the processor.
677 *
678 * @param target Pointer to target to issue commands to
679 * @return Error status if there is a timeout or a problem while executing the
680 * JTAG queue
681 */
682 int arm7_9_execute_sys_speed(struct target *target)
683 {
684 int retval;
685 struct arm7_9_common *arm7_9 = target_to_arm7_9(target);
686 struct arm_jtag *jtag_info = &arm7_9->jtag_info;
687 struct reg *dbg_stat = &arm7_9->eice_cache->reg_list[EICE_DBG_STAT];
688
689 /* set RESTART instruction */
690 if (arm7_9->need_bypass_before_restart) {
691 arm7_9->need_bypass_before_restart = 0;
692 arm_jtag_set_instr(jtag_info, 0xf, NULL, TAP_IDLE);
693 }
694 arm_jtag_set_instr(jtag_info, 0x4, NULL, TAP_IDLE);
695
696 long long then = timeval_ms();
697 int timeout;
698 while (!(timeout = ((timeval_ms()-then) > 1000)))
699 {
700 /* read debug status register */
701 embeddedice_read_reg(dbg_stat);
702 if ((retval = jtag_execute_queue()) != ERROR_OK)
703 return retval;
704 if ((buf_get_u32(dbg_stat->value, EICE_DBG_STATUS_DBGACK, 1))
705 && (buf_get_u32(dbg_stat->value, EICE_DBG_STATUS_SYSCOMP, 1)))
706 break;
707 if (debug_level >= 3)
708 {
709 alive_sleep(100);
710 } else
711 {
712 keep_alive();
713 }
714 }
715 if (timeout)
716 {
717 LOG_ERROR("timeout waiting for SYSCOMP & DBGACK, last DBG_STATUS: %" PRIx32 "", buf_get_u32(dbg_stat->value, 0, dbg_stat->size));
718 return ERROR_TARGET_TIMEOUT;
719 }
720
721 return ERROR_OK;
722 }
723
724 /**
725 * Restarts the target by sending a RESTART instruction and moving the JTAG
726 * state to IDLE. This validates that DBGACK and SYSCOMP are set without
727 * waiting until they are.
728 *
729 * @param target Pointer to the target to issue commands to
730 * @return Always ERROR_OK
731 */
732 static int arm7_9_execute_fast_sys_speed(struct target *target)
733 {
734 static int set = 0;
735 static uint8_t check_value[4], check_mask[4];
736
737 struct arm7_9_common *arm7_9 = target_to_arm7_9(target);
738 struct arm_jtag *jtag_info = &arm7_9->jtag_info;
739 struct reg *dbg_stat = &arm7_9->eice_cache->reg_list[EICE_DBG_STAT];
740
741 /* set RESTART instruction */
742 if (arm7_9->need_bypass_before_restart) {
743 arm7_9->need_bypass_before_restart = 0;
744 arm_jtag_set_instr(jtag_info, 0xf, NULL, TAP_IDLE);
745 }
746 arm_jtag_set_instr(jtag_info, 0x4, NULL, TAP_IDLE);
747
748 if (!set)
749 {
750 /* check for DBGACK and SYSCOMP set (others don't care) */
751
752 /* NB! These are constants that must be available until after next jtag_execute() and
753 * we evaluate the values upon first execution in lieu of setting up these constants
754 * during early setup.
755 * */
756 buf_set_u32(check_value, 0, 32, 0x9);
757 buf_set_u32(check_mask, 0, 32, 0x9);
758 set = 1;
759 }
760
761 /* read debug status register */
762 embeddedice_read_reg_w_check(dbg_stat, check_value, check_mask);
763
764 return ERROR_OK;
765 }
766
767 /**
768 * Get some data from the ARM7/9 target.
769 *
770 * @param target Pointer to the ARM7/9 target to read data from
771 * @param size The number of 32bit words to be read
772 * @param buffer Pointer to the buffer that will hold the data
773 * @return The result of receiving data from the Embedded ICE unit
774 */
775 int arm7_9_target_request_data(struct target *target, uint32_t size, uint8_t *buffer)
776 {
777 struct arm7_9_common *arm7_9 = target_to_arm7_9(target);
778 struct arm_jtag *jtag_info = &arm7_9->jtag_info;
779 uint32_t *data;
780 int retval = ERROR_OK;
781 uint32_t i;
782
783 data = malloc(size * (sizeof(uint32_t)));
784
785 retval = embeddedice_receive(jtag_info, data, size);
786
787 /* return the 32-bit ints in the 8-bit array */
788 for (i = 0; i < size; i++)
789 {
790 h_u32_to_le(buffer + (i * 4), data[i]);
791 }
792
793 free(data);
794
795 return retval;
796 }
797
798 /**
799 * Handles requests to an ARM7/9 target. If debug messaging is enabled, the
800 * target is running and the DCC control register has the W bit high, this will
801 * execute the request on the target.
802 *
803 * @param priv Void pointer expected to be a struct target pointer
804 * @return ERROR_OK unless there are issues with the JTAG queue or when reading
805 * from the Embedded ICE unit
806 */
807 static int arm7_9_handle_target_request(void *priv)
808 {
809 int retval = ERROR_OK;
810 struct target *target = priv;
811 if (!target_was_examined(target))
812 return ERROR_OK;
813 struct arm7_9_common *arm7_9 = target_to_arm7_9(target);
814 struct arm_jtag *jtag_info = &arm7_9->jtag_info;
815 struct reg *dcc_control = &arm7_9->eice_cache->reg_list[EICE_COMMS_CTRL];
816
817 if (!target->dbg_msg_enabled)
818 return ERROR_OK;
819
820 if (target->state == TARGET_RUNNING)
821 {
822 /* read DCC control register */
823 embeddedice_read_reg(dcc_control);
824 if ((retval = jtag_execute_queue()) != ERROR_OK)
825 {
826 return retval;
827 }
828
829 /* check W bit */
830 if (buf_get_u32(dcc_control->value, 1, 1) == 1)
831 {
832 uint32_t request;
833
834 if ((retval = embeddedice_receive(jtag_info, &request, 1)) != ERROR_OK)
835 {
836 return retval;
837 }
838 if ((retval = target_request(target, request)) != ERROR_OK)
839 {
840 return retval;
841 }
842 }
843 }
844
845 return ERROR_OK;
846 }
847
848 /**
849 * Polls an ARM7/9 target for its current status. If DBGACK is set, the target
850 * is manipulated to the right halted state based on its current state. This is
851 * what happens:
852 *
853 * <table>
854 * <tr><th > State</th><th > Action</th></tr>
855 * <tr><td > TARGET_RUNNING | TARGET_RESET</td><td > Enters debug mode. If TARGET_RESET, pc may be checked</td></tr>
856 * <tr><td > TARGET_UNKNOWN</td><td > Warning is logged</td></tr>
857 * <tr><td > TARGET_DEBUG_RUNNING</td><td > Enters debug mode</td></tr>
858 * <tr><td > TARGET_HALTED</td><td > Nothing</td></tr>
859 * </table>
860 *
861 * If the target does not end up in the halted state, a warning is produced. If
862 * DBGACK is cleared, then the target is expected to either be running or
863 * running in debug.
864 *
865 * @param target Pointer to the ARM7/9 target to poll
866 * @return ERROR_OK or an error status if a command fails
867 */
868 int arm7_9_poll(struct target *target)
869 {
870 int retval;
871 struct arm7_9_common *arm7_9 = target_to_arm7_9(target);
872 struct reg *dbg_stat = &arm7_9->eice_cache->reg_list[EICE_DBG_STAT];
873
874 /* read debug status register */
875 embeddedice_read_reg(dbg_stat);
876 if ((retval = jtag_execute_queue()) != ERROR_OK)
877 {
878 return retval;
879 }
880
881 if (buf_get_u32(dbg_stat->value, EICE_DBG_STATUS_DBGACK, 1))
882 {
883 /* LOG_DEBUG("DBGACK set, dbg_state->value: 0x%x", buf_get_u32(dbg_stat->value, 0, 32));*/
884 if (target->state == TARGET_UNKNOWN)
885 {
886 /* Starting OpenOCD with target in debug-halt */
887 target->state = TARGET_RUNNING;
888 LOG_DEBUG("DBGACK already set during server startup.");
889 }
890 if ((target->state == TARGET_RUNNING) || (target->state == TARGET_RESET))
891 {
892 target->state = TARGET_HALTED;
893
894 if ((retval = arm7_9_debug_entry(target)) != ERROR_OK)
895 return retval;
896
897 if (arm_semihosting(target, &retval) != 0)
898 return retval;
899
900 if ((retval = target_call_event_callbacks(target, TARGET_EVENT_HALTED)) != ERROR_OK)
901 {
902 return retval;
903 }
904 }
905 if (target->state == TARGET_DEBUG_RUNNING)
906 {
907 target->state = TARGET_HALTED;
908 if ((retval = arm7_9_debug_entry(target)) != ERROR_OK)
909 return retval;
910
911 if ((retval = target_call_event_callbacks(target, TARGET_EVENT_DEBUG_HALTED)) != ERROR_OK)
912 {
913 return retval;
914 }
915 }
916 if (target->state != TARGET_HALTED)
917 {
918 LOG_WARNING("DBGACK set, but the target did not end up in the halted state %d", target->state);
919 }
920 }
921 else
922 {
923 if (target->state != TARGET_DEBUG_RUNNING)
924 target->state = TARGET_RUNNING;
925 }
926
927 return ERROR_OK;
928 }
929
930 /**
931 * Asserts the reset (SRST) on an ARM7/9 target. Some -S targets (ARM966E-S in
932 * the STR912 isn't affected, ARM926EJ-S in the LPC3180 and AT91SAM9260 is
933 * affected) completely stop the JTAG clock while the core is held in reset
934 * (SRST). It isn't possible to program the halt condition once reset is
935 * asserted, hence a hook that allows the target to set up its reset-halt
936 * condition is setup prior to asserting reset.
937 *
938 * @param target Pointer to an ARM7/9 target to assert reset on
939 * @return ERROR_FAIL if the JTAG device does not have SRST, otherwise ERROR_OK
940 */
941 int arm7_9_assert_reset(struct target *target)
942 {
943 struct arm7_9_common *arm7_9 = target_to_arm7_9(target);
944 enum reset_types jtag_reset_config = jtag_get_reset_config();
945 bool use_event = false;
946
947 LOG_DEBUG("target->state: %s",
948 target_state_name(target));
949
950 if (target_has_event_action(target, TARGET_EVENT_RESET_ASSERT))
951 use_event = true;
952 else if (!(jtag_reset_config & RESET_HAS_SRST)) {
953 LOG_ERROR("%s: how to reset?", target_name(target));
954 return ERROR_FAIL;
955 }
956
957 /* At this point trst has been asserted/deasserted once. We would
958 * like to program EmbeddedICE while SRST is asserted, instead of
959 * depending on SRST to leave that module alone. However, many CPUs
960 * gate the JTAG clock while SRST is asserted; or JTAG may need
961 * clock stability guarantees (adaptive clocking might help).
962 *
963 * So we assume JTAG access during SRST is off the menu unless it's
964 * been specifically enabled.
965 */
966 bool srst_asserted = false;
967
968 if (!use_event
969 && !(jtag_reset_config & RESET_SRST_PULLS_TRST)
970 && (jtag_reset_config & RESET_SRST_NO_GATING))
971 {
972 jtag_add_reset(0, 1);
973 srst_asserted = true;
974 }
975
976 if (target->reset_halt)
977 {
978 /*
979 * For targets that don't support communication while SRST is
980 * asserted, we need to set up the reset vector catch first.
981 *
982 * When we use TRST+SRST and that's equivalent to a power-up
983 * reset, these settings may well be reset anyway; so setting
984 * them here won't matter.
985 */
986 if (arm7_9->has_vector_catch)
987 {
988 /* program vector catch register to catch reset */
989 embeddedice_write_reg(&arm7_9->eice_cache
990 ->reg_list[EICE_VEC_CATCH], 0x1);
991
992 /* extra runtest added as issues were found with
993 * certain ARM9 cores (maybe more) - AT91SAM9260
994 * and STR9
995 */
996 jtag_add_runtest(1, TAP_IDLE);
997 }
998 else
999 {
1000 /* program watchpoint unit to match on reset vector
1001 * address
1002 */
1003 embeddedice_write_reg(&arm7_9->eice_cache
1004 ->reg_list[EICE_W0_ADDR_VALUE], 0x0);
1005 embeddedice_write_reg(&arm7_9->eice_cache
1006 ->reg_list[EICE_W0_ADDR_MASK], 0x3);
1007 embeddedice_write_reg(&arm7_9->eice_cache
1008 ->reg_list[EICE_W0_DATA_MASK],
1009 0xffffffff);
1010 embeddedice_write_reg(&arm7_9->eice_cache
1011 ->reg_list[EICE_W0_CONTROL_VALUE],
1012 EICE_W_CTRL_ENABLE);
1013 embeddedice_write_reg(&arm7_9->eice_cache
1014 ->reg_list[EICE_W0_CONTROL_MASK],
1015 ~EICE_W_CTRL_nOPC & 0xff);
1016 }
1017 }
1018
1019 if (use_event) {
1020 target_handle_event(target, TARGET_EVENT_RESET_ASSERT);
1021 } else {
1022 /* If we use SRST ... we'd like to issue just SRST, but the
1023 * board or chip may be set up so we have to assert TRST as
1024 * well. On some chips that combination is equivalent to a
1025 * power-up reset, and generally clobbers EICE state.
1026 */
1027 if (jtag_reset_config & RESET_SRST_PULLS_TRST)
1028 jtag_add_reset(1, 1);
1029 else if (!srst_asserted)
1030 jtag_add_reset(0, 1);
1031 jtag_add_sleep(50000);
1032 }
1033
1034 target->state = TARGET_RESET;
1035 register_cache_invalidate(arm7_9->armv4_5_common.core_cache);
1036
1037 /* REVISIT why isn't standard debug entry logic sufficient?? */
1038 if (target->reset_halt
1039 && (!(jtag_reset_config & RESET_SRST_PULLS_TRST)
1040 || use_event))
1041 {
1042 /* debug entry was prepared above */
1043 target->debug_reason = DBG_REASON_DBGRQ;
1044 }
1045
1046 return ERROR_OK;
1047 }
1048
1049 /**
1050 * Deassert the reset (SRST) signal on an ARM7/9 target. If SRST pulls TRST
1051 * and the target is being reset into a halt, a warning will be triggered
1052 * because it is not possible to reset into a halted mode in this case. The
1053 * target is halted using the target's functions.
1054 *
1055 * @param target Pointer to the target to have the reset deasserted
1056 * @return ERROR_OK or an error from polling or halting the target
1057 */
1058 int arm7_9_deassert_reset(struct target *target)
1059 {
1060 int retval = ERROR_OK;
1061 LOG_DEBUG("target->state: %s",
1062 target_state_name(target));
1063
1064 /* deassert reset lines */
1065 jtag_add_reset(0, 0);
1066
1067 enum reset_types jtag_reset_config = jtag_get_reset_config();
1068 if (target->reset_halt && (jtag_reset_config & RESET_SRST_PULLS_TRST) != 0)
1069 {
1070 LOG_WARNING("srst pulls trst - can not reset into halted mode. Issuing halt after reset.");
1071 /* set up embedded ice registers again */
1072 if ((retval = target_examine_one(target)) != ERROR_OK)
1073 return retval;
1074
1075 if ((retval = target_poll(target)) != ERROR_OK)
1076 {
1077 return retval;
1078 }
1079
1080 if ((retval = target_halt(target)) != ERROR_OK)
1081 {
1082 return retval;
1083 }
1084
1085 }
1086 return retval;
1087 }
1088
1089 /**
1090 * Clears the halt condition for an ARM7/9 target. If it isn't coming out of
1091 * reset and if DBGRQ is used, it is progammed to be deasserted. If the reset
1092 * vector catch was used, it is restored. Otherwise, the control value is
1093 * restored and the watchpoint unit is restored if it was in use.
1094 *
1095 * @param target Pointer to the ARM7/9 target to have halt cleared
1096 * @return Always ERROR_OK
1097 */
1098 static int arm7_9_clear_halt(struct target *target)
1099 {
1100 struct arm7_9_common *arm7_9 = target_to_arm7_9(target);
1101 struct reg *dbg_ctrl = &arm7_9->eice_cache->reg_list[EICE_DBG_CTRL];
1102
1103 /* we used DBGRQ only if we didn't come out of reset */
1104 if (!arm7_9->debug_entry_from_reset && arm7_9->use_dbgrq)
1105 {
1106 /* program EmbeddedICE Debug Control Register to deassert DBGRQ
1107 */
1108 buf_set_u32(dbg_ctrl->value, EICE_DBG_CONTROL_DBGRQ, 1, 0);
1109 embeddedice_store_reg(dbg_ctrl);
1110 }
1111 else
1112 {
1113 if (arm7_9->debug_entry_from_reset && arm7_9->has_vector_catch)
1114 {
1115 /* if we came out of reset, and vector catch is supported, we used
1116 * vector catch to enter debug state
1117 * restore the register in that case
1118 */
1119 embeddedice_store_reg(&arm7_9->eice_cache->reg_list[EICE_VEC_CATCH]);
1120 }
1121 else
1122 {
1123 /* restore registers if watchpoint unit 0 was in use
1124 */
1125 if (arm7_9->wp0_used)
1126 {
1127 if (arm7_9->debug_entry_from_reset)
1128 {
1129 embeddedice_store_reg(&arm7_9->eice_cache->reg_list[EICE_W0_ADDR_VALUE]);
1130 }
1131 embeddedice_store_reg(&arm7_9->eice_cache->reg_list[EICE_W0_ADDR_MASK]);
1132 embeddedice_store_reg(&arm7_9->eice_cache->reg_list[EICE_W0_DATA_MASK]);
1133 embeddedice_store_reg(&arm7_9->eice_cache->reg_list[EICE_W0_CONTROL_MASK]);
1134 }
1135 /* control value always has to be restored, as it was either disabled,
1136 * or enabled with possibly different bits
1137 */
1138 embeddedice_store_reg(&arm7_9->eice_cache->reg_list[EICE_W0_CONTROL_VALUE]);
1139 }
1140 }
1141
1142 return ERROR_OK;
1143 }
1144
1145 /**
1146 * Issue a software reset and halt to an ARM7/9 target. The target is halted
1147 * and then there is a wait until the processor shows the halt. This wait can
1148 * timeout and results in an error being returned. The software reset involves
1149 * clearing the halt, updating the debug control register, changing to ARM mode,
1150 * reset of the program counter, and reset of all of the registers.
1151 *
1152 * @param target Pointer to the ARM7/9 target to be reset and halted by software
1153 * @return Error status if any of the commands fail, otherwise ERROR_OK
1154 */
1155 int arm7_9_soft_reset_halt(struct target *target)
1156 {
1157 struct arm7_9_common *arm7_9 = target_to_arm7_9(target);
1158 struct arm *armv4_5 = &arm7_9->armv4_5_common;
1159 struct reg *dbg_stat = &arm7_9->eice_cache->reg_list[EICE_DBG_STAT];
1160 struct reg *dbg_ctrl = &arm7_9->eice_cache->reg_list[EICE_DBG_CTRL];
1161 int i;
1162 int retval;
1163
1164 /* FIX!!! replace some of this code with tcl commands
1165 *
1166 * halt # the halt command is synchronous
1167 * armv4_5 core_state arm
1168 *
1169 */
1170
1171 if ((retval = target_halt(target)) != ERROR_OK)
1172 return retval;
1173
1174 long long then = timeval_ms();
1175 int timeout;
1176 while (!(timeout = ((timeval_ms()-then) > 1000)))
1177 {
1178 if (buf_get_u32(dbg_stat->value, EICE_DBG_STATUS_DBGACK, 1) != 0)
1179 break;
1180 embeddedice_read_reg(dbg_stat);
1181 if ((retval = jtag_execute_queue()) != ERROR_OK)
1182 return retval;
1183 if (debug_level >= 3)
1184 {
1185 alive_sleep(100);
1186 } else
1187 {
1188 keep_alive();
1189 }
1190 }
1191 if (timeout)
1192 {
1193 LOG_ERROR("Failed to halt CPU after 1 sec");
1194 return ERROR_TARGET_TIMEOUT;
1195 }
1196 target->state = TARGET_HALTED;
1197
1198 /* program EmbeddedICE Debug Control Register to assert DBGACK and INTDIS
1199 * ensure that DBGRQ is cleared
1200 */
1201 buf_set_u32(dbg_ctrl->value, EICE_DBG_CONTROL_DBGACK, 1, 1);
1202 buf_set_u32(dbg_ctrl->value, EICE_DBG_CONTROL_DBGRQ, 1, 0);
1203 buf_set_u32(dbg_ctrl->value, EICE_DBG_CONTROL_INTDIS, 1, 1);
1204 embeddedice_store_reg(dbg_ctrl);
1205
1206 if ((retval = arm7_9_clear_halt(target)) != ERROR_OK)
1207 {
1208 return retval;
1209 }
1210
1211 /* if the target is in Thumb state, change to ARM state */
1212 if (buf_get_u32(dbg_stat->value, EICE_DBG_STATUS_ITBIT, 1))
1213 {
1214 uint32_t r0_thumb, pc_thumb;
1215 LOG_DEBUG("target entered debug from Thumb state, changing to ARM");
1216 /* Entered debug from Thumb mode */
1217 armv4_5->core_state = ARM_STATE_THUMB;
1218 arm7_9->change_to_arm(target, &r0_thumb, &pc_thumb);
1219 }
1220
1221 /* REVISIT likewise for bit 5 -- switch Jazelle-to-ARM */
1222
1223 /* all register content is now invalid */
1224 register_cache_invalidate(armv4_5->core_cache);
1225
1226 /* SVC, ARM state, IRQ and FIQ disabled */
1227 uint32_t cpsr;
1228
1229 cpsr = buf_get_u32(armv4_5->cpsr->value, 0, 32);
1230 cpsr &= ~0xff;
1231 cpsr |= 0xd3;
1232 arm_set_cpsr(armv4_5, cpsr);
1233 armv4_5->cpsr->dirty = 1;
1234
1235 /* start fetching from 0x0 */
1236 buf_set_u32(armv4_5->pc->value, 0, 32, 0x0);
1237 armv4_5->pc->dirty = 1;
1238 armv4_5->pc->valid = 1;
1239
1240 /* reset registers */
1241 for (i = 0; i <= 14; i++)
1242 {
1243 struct reg *r = arm_reg_current(armv4_5, i);
1244
1245 buf_set_u32(r->value, 0, 32, 0xffffffff);
1246 r->dirty = 1;
1247 r->valid = 1;
1248 }
1249
1250 if ((retval = target_call_event_callbacks(target, TARGET_EVENT_HALTED)) != ERROR_OK)
1251 {
1252 return retval;
1253 }
1254
1255 return ERROR_OK;
1256 }
1257
1258 /**
1259 * Halt an ARM7/9 target. This is accomplished by either asserting the DBGRQ
1260 * line or by programming a watchpoint to trigger on any address. It is
1261 * considered a bug to call this function while the target is in the
1262 * TARGET_RESET state.
1263 *
1264 * @param target Pointer to the ARM7/9 target to be halted
1265 * @return Always ERROR_OK
1266 */
1267 int arm7_9_halt(struct target *target)
1268 {
1269 if (target->state == TARGET_RESET)
1270 {
1271 LOG_ERROR("BUG: arm7/9 does not support halt during reset. This is handled in arm7_9_assert_reset()");
1272 return ERROR_OK;
1273 }
1274
1275 struct arm7_9_common *arm7_9 = target_to_arm7_9(target);
1276 struct reg *dbg_ctrl = &arm7_9->eice_cache->reg_list[EICE_DBG_CTRL];
1277
1278 LOG_DEBUG("target->state: %s",
1279 target_state_name(target));
1280
1281 if (target->state == TARGET_HALTED)
1282 {
1283 LOG_DEBUG("target was already halted");
1284 return ERROR_OK;
1285 }
1286
1287 if (target->state == TARGET_UNKNOWN)
1288 {
1289 LOG_WARNING("target was in unknown state when halt was requested");
1290 }
1291
1292 if (arm7_9->use_dbgrq)
1293 {
1294 /* program EmbeddedICE Debug Control Register to assert DBGRQ
1295 */
1296 if (arm7_9->set_special_dbgrq) {
1297 arm7_9->set_special_dbgrq(target);
1298 } else {
1299 buf_set_u32(dbg_ctrl->value, EICE_DBG_CONTROL_DBGRQ, 1, 1);
1300 embeddedice_store_reg(dbg_ctrl);
1301 }
1302 }
1303 else
1304 {
1305 /* program watchpoint unit to match on any address
1306 */
1307 embeddedice_write_reg(&arm7_9->eice_cache->reg_list[EICE_W0_ADDR_MASK], 0xffffffff);
1308 embeddedice_write_reg(&arm7_9->eice_cache->reg_list[EICE_W0_DATA_MASK], 0xffffffff);
1309 embeddedice_write_reg(&arm7_9->eice_cache->reg_list[EICE_W0_CONTROL_VALUE], EICE_W_CTRL_ENABLE);
1310 embeddedice_write_reg(&arm7_9->eice_cache->reg_list[EICE_W0_CONTROL_MASK], ~EICE_W_CTRL_nOPC & 0xff);
1311 }
1312
1313 target->debug_reason = DBG_REASON_DBGRQ;
1314
1315 return ERROR_OK;
1316 }
1317
1318 /**
1319 * Handle an ARM7/9 target's entry into debug mode. The halt is cleared on the
1320 * ARM. The JTAG queue is then executed and the reason for debug entry is
1321 * examined. Once done, the target is verified to be halted and the processor
1322 * is forced into ARM mode. The core registers are saved for the current core
1323 * mode and the program counter (register 15) is updated as needed. The core
1324 * registers and CPSR and SPSR are saved for restoration later.
1325 *
1326 * @param target Pointer to target that is entering debug mode
1327 * @return Error code if anything fails, otherwise ERROR_OK
1328 */
1329 static int arm7_9_debug_entry(struct target *target)
1330 {
1331 int i;
1332 uint32_t context[16];
1333 uint32_t* context_p[16];
1334 uint32_t r0_thumb, pc_thumb;
1335 uint32_t cpsr, cpsr_mask = 0;
1336 int retval;
1337 struct arm7_9_common *arm7_9 = target_to_arm7_9(target);
1338 struct arm *armv4_5 = &arm7_9->armv4_5_common;
1339 struct reg *dbg_stat = &arm7_9->eice_cache->reg_list[EICE_DBG_STAT];
1340 struct reg *dbg_ctrl = &arm7_9->eice_cache->reg_list[EICE_DBG_CTRL];
1341
1342 #ifdef _DEBUG_ARM7_9_
1343 LOG_DEBUG("-");
1344 #endif
1345
1346 /* program EmbeddedICE Debug Control Register to assert DBGACK and INTDIS
1347 * ensure that DBGRQ is cleared
1348 */
1349 buf_set_u32(dbg_ctrl->value, EICE_DBG_CONTROL_DBGACK, 1, 1);
1350 buf_set_u32(dbg_ctrl->value, EICE_DBG_CONTROL_DBGRQ, 1, 0);
1351 buf_set_u32(dbg_ctrl->value, EICE_DBG_CONTROL_INTDIS, 1, 1);
1352 embeddedice_store_reg(dbg_ctrl);
1353
1354 if ((retval = arm7_9_clear_halt(target)) != ERROR_OK)
1355 {
1356 return retval;
1357 }
1358
1359 if ((retval = jtag_execute_queue()) != ERROR_OK)
1360 {
1361 return retval;
1362 }
1363
1364 if ((retval = arm7_9->examine_debug_reason(target)) != ERROR_OK)
1365 return retval;
1366
1367
1368 if (target->state != TARGET_HALTED)
1369 {
1370 LOG_WARNING("target not halted");
1371 return ERROR_TARGET_NOT_HALTED;
1372 }
1373
1374 /* if the target is in Thumb state, change to ARM state */
1375 if (buf_get_u32(dbg_stat->value, EICE_DBG_STATUS_ITBIT, 1))
1376 {
1377 LOG_DEBUG("target entered debug from Thumb state");
1378 /* Entered debug from Thumb mode */
1379 armv4_5->core_state = ARM_STATE_THUMB;
1380 cpsr_mask = 1 << 5;
1381 arm7_9->change_to_arm(target, &r0_thumb, &pc_thumb);
1382 LOG_DEBUG("r0_thumb: 0x%8.8" PRIx32
1383 ", pc_thumb: 0x%8.8" PRIx32, r0_thumb, pc_thumb);
1384 } else if (buf_get_u32(dbg_stat->value, 5, 1)) {
1385 /* \todo Get some vaguely correct handling of Jazelle, if
1386 * anyone ever uses it and full info becomes available.
1387 * See ARM9EJS TRM B.7.1 for how to switch J->ARM; and
1388 * B.7.3 for the reverse. That'd be the bare minimum...
1389 */
1390 LOG_DEBUG("target entered debug from Jazelle state");
1391 armv4_5->core_state = ARM_STATE_JAZELLE;
1392 cpsr_mask = 1 << 24;
1393 LOG_ERROR("Jazelle debug entry -- BROKEN!");
1394 } else {
1395 LOG_DEBUG("target entered debug from ARM state");
1396 /* Entered debug from ARM mode */
1397 armv4_5->core_state = ARM_STATE_ARM;
1398 }
1399
1400 for (i = 0; i < 16; i++)
1401 context_p[i] = &context[i];
1402 /* save core registers (r0 - r15 of current core mode) */
1403 arm7_9->read_core_regs(target, 0xffff, context_p);
1404
1405 arm7_9->read_xpsr(target, &cpsr, 0);
1406
1407 if ((retval = jtag_execute_queue()) != ERROR_OK)
1408 return retval;
1409
1410 /* Sync our CPSR copy with J or T bits EICE reported, but
1411 * which we then erased by putting the core into ARM mode.
1412 */
1413 arm_set_cpsr(armv4_5, cpsr | cpsr_mask);
1414
1415 if (!is_arm_mode(armv4_5->core_mode))
1416 {
1417 target->state = TARGET_UNKNOWN;
1418 LOG_ERROR("cpsr contains invalid mode value - communication failure");
1419 return ERROR_TARGET_FAILURE;
1420 }
1421
1422 LOG_DEBUG("target entered debug state in %s mode",
1423 arm_mode_name(armv4_5->core_mode));
1424
1425 if (armv4_5->core_state == ARM_STATE_THUMB)
1426 {
1427 LOG_DEBUG("thumb state, applying fixups");
1428 context[0] = r0_thumb;
1429 context[15] = pc_thumb;
1430 } else if (armv4_5->core_state == ARM_STATE_ARM)
1431 {
1432 /* adjust value stored by STM */
1433 context[15] -= 3 * 4;
1434 }
1435
1436 if ((target->debug_reason != DBG_REASON_DBGRQ) || (!arm7_9->use_dbgrq))
1437 context[15] -= 3 * ((armv4_5->core_state == ARM_STATE_ARM) ? 4 : 2);
1438 else
1439 context[15] -= arm7_9->dbgreq_adjust_pc * ((armv4_5->core_state == ARM_STATE_ARM) ? 4 : 2);
1440
1441 for (i = 0; i <= 15; i++)
1442 {
1443 struct reg *r = arm_reg_current(armv4_5, i);
1444
1445 LOG_DEBUG("r%i: 0x%8.8" PRIx32 "", i, context[i]);
1446
1447 buf_set_u32(r->value, 0, 32, context[i]);
1448 /* r0 and r15 (pc) have to be restored later */
1449 r->dirty = (i == 0) || (i == 15);
1450 r->valid = 1;
1451 }
1452
1453 LOG_DEBUG("entered debug state at PC 0x%" PRIx32 "", context[15]);
1454
1455 /* exceptions other than USR & SYS have a saved program status register */
1456 if (armv4_5->spsr) {
1457 uint32_t spsr;
1458 arm7_9->read_xpsr(target, &spsr, 1);
1459 if ((retval = jtag_execute_queue()) != ERROR_OK)
1460 {
1461 return retval;
1462 }
1463 buf_set_u32(armv4_5->spsr->value, 0, 32, spsr);
1464 armv4_5->spsr->dirty = 0;
1465 armv4_5->spsr->valid = 1;
1466 }
1467
1468 if ((retval = jtag_execute_queue()) != ERROR_OK)
1469 return retval;
1470
1471 if (arm7_9->post_debug_entry)
1472 arm7_9->post_debug_entry(target);
1473
1474 return ERROR_OK;
1475 }
1476
1477 /**
1478 * Validate the full context for an ARM7/9 target in all processor modes. If
1479 * there are any invalid registers for the target, they will all be read. This
1480 * includes the PSR.
1481 *
1482 * @param target Pointer to the ARM7/9 target to capture the full context from
1483 * @return Error if the target is not halted, has an invalid core mode, or if
1484 * the JTAG queue fails to execute
1485 */
1486 static int arm7_9_full_context(struct target *target)
1487 {
1488 int i;
1489 int retval;
1490 struct arm7_9_common *arm7_9 = target_to_arm7_9(target);
1491 struct arm *armv4_5 = &arm7_9->armv4_5_common;
1492
1493 LOG_DEBUG("-");
1494
1495 if (target->state != TARGET_HALTED)
1496 {
1497 LOG_WARNING("target not halted");
1498 return ERROR_TARGET_NOT_HALTED;
1499 }
1500
1501 if (!is_arm_mode(armv4_5->core_mode))
1502 return ERROR_FAIL;
1503
1504 /* iterate through processor modes (User, FIQ, IRQ, SVC, ABT, UND)
1505 * SYS shares registers with User, so we don't touch SYS
1506 */
1507 for (i = 0; i < 6; i++)
1508 {
1509 uint32_t mask = 0;
1510 uint32_t* reg_p[16];
1511 int j;
1512 int valid = 1;
1513
1514 /* check if there are invalid registers in the current mode
1515 */
1516 for (j = 0; j <= 16; j++)
1517 {
1518 if (ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5_number_to_mode(i), j).valid == 0)
1519 valid = 0;
1520 }
1521
1522 if (!valid)
1523 {
1524 uint32_t tmp_cpsr;
1525
1526 /* change processor mode (and mask T bit) */
1527 tmp_cpsr = buf_get_u32(armv4_5->cpsr->value, 0, 8)
1528 & 0xe0;
1529 tmp_cpsr |= armv4_5_number_to_mode(i);
1530 tmp_cpsr &= ~0x20;
1531 arm7_9->write_xpsr_im8(target, tmp_cpsr & 0xff, 0, 0);
1532
1533 for (j = 0; j < 15; j++)
1534 {
1535 if (ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5_number_to_mode(i), j).valid == 0)
1536 {
1537 reg_p[j] = (uint32_t*)ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5_number_to_mode(i), j).value;
1538 mask |= 1 << j;
1539 ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5_number_to_mode(i), j).valid = 1;
1540 ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5_number_to_mode(i), j).dirty = 0;
1541 }
1542 }
1543
1544 /* if only the PSR is invalid, mask is all zeroes */
1545 if (mask)
1546 arm7_9->read_core_regs(target, mask, reg_p);
1547
1548 /* check if the PSR has to be read */
1549 if (ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5_number_to_mode(i), 16).valid == 0)
1550 {
1551 arm7_9->read_xpsr(target, (uint32_t*)ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5_number_to_mode(i), 16).value, 1);
1552 ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5_number_to_mode(i), 16).valid = 1;
1553 ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5_number_to_mode(i), 16).dirty = 0;
1554 }
1555 }
1556 }
1557
1558 /* restore processor mode (mask T bit) */
1559 arm7_9->write_xpsr_im8(target,
1560 buf_get_u32(armv4_5->cpsr->value, 0, 8) & ~0x20,
1561 0, 0);
1562
1563 if ((retval = jtag_execute_queue()) != ERROR_OK)
1564 {
1565 return retval;
1566 }
1567 return ERROR_OK;
1568 }
1569
1570 /**
1571 * Restore the processor context on an ARM7/9 target. The full processor
1572 * context is analyzed to see if any of the registers are dirty on this end, but
1573 * have a valid new value. If this is the case, the processor is changed to the
1574 * appropriate mode and the new register values are written out to the
1575 * processor. If there happens to be a dirty register with an invalid value, an
1576 * error will be logged.
1577 *
1578 * @param target Pointer to the ARM7/9 target to have its context restored
1579 * @return Error status if the target is not halted or the core mode in the
1580 * armv4_5 struct is invalid.
1581 */
1582 static int arm7_9_restore_context(struct target *target)
1583 {
1584 struct arm7_9_common *arm7_9 = target_to_arm7_9(target);
1585 struct arm *armv4_5 = &arm7_9->armv4_5_common;
1586 struct reg *reg;
1587 struct arm_reg *reg_arch_info;
1588 enum arm_mode current_mode = armv4_5->core_mode;
1589 int i, j;
1590 int dirty;
1591 int mode_change;
1592
1593 LOG_DEBUG("-");
1594
1595 if (target->state != TARGET_HALTED)
1596 {
1597 LOG_WARNING("target not halted");
1598 return ERROR_TARGET_NOT_HALTED;
1599 }
1600
1601 if (arm7_9->pre_restore_context)
1602 arm7_9->pre_restore_context(target);
1603
1604 if (!is_arm_mode(armv4_5->core_mode))
1605 return ERROR_FAIL;
1606
1607 /* iterate through processor modes (User, FIQ, IRQ, SVC, ABT, UND)
1608 * SYS shares registers with User, so we don't touch SYS
1609 */
1610 for (i = 0; i < 6; i++)
1611 {
1612 LOG_DEBUG("examining %s mode",
1613 arm_mode_name(armv4_5->core_mode));
1614 dirty = 0;
1615 mode_change = 0;
1616 /* check if there are dirty registers in the current mode
1617 */
1618 for (j = 0; j <= 16; j++)
1619 {
1620 reg = &ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5_number_to_mode(i), j);
1621 reg_arch_info = reg->arch_info;
1622 if (reg->dirty == 1)
1623 {
1624 if (reg->valid == 1)
1625 {
1626 dirty = 1;
1627 LOG_DEBUG("examining dirty reg: %s", reg->name);
1628 if ((reg_arch_info->mode != ARM_MODE_ANY)
1629 && (reg_arch_info->mode != current_mode)
1630 && !((reg_arch_info->mode == ARM_MODE_USR) && (armv4_5->core_mode == ARM_MODE_SYS))
1631 && !((reg_arch_info->mode == ARM_MODE_SYS) && (armv4_5->core_mode == ARM_MODE_USR)))
1632 {
1633 mode_change = 1;
1634 LOG_DEBUG("require mode change");
1635 }
1636 }
1637 else
1638 {
1639 LOG_ERROR("BUG: dirty register '%s', but no valid data", reg->name);
1640 }
1641 }
1642 }
1643
1644 if (dirty)
1645 {
1646 uint32_t mask = 0x0;
1647 int num_regs = 0;
1648 uint32_t regs[16];
1649
1650 if (mode_change)
1651 {
1652 uint32_t tmp_cpsr;
1653
1654 /* change processor mode (mask T bit) */
1655 tmp_cpsr = buf_get_u32(armv4_5->cpsr->value,
1656 0, 8) & 0xe0;
1657 tmp_cpsr |= armv4_5_number_to_mode(i);
1658 tmp_cpsr &= ~0x20;
1659 arm7_9->write_xpsr_im8(target, tmp_cpsr & 0xff, 0, 0);
1660 current_mode = armv4_5_number_to_mode(i);
1661 }
1662
1663 for (j = 0; j <= 14; j++)
1664 {
1665 reg = &ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5_number_to_mode(i), j);
1666 reg_arch_info = reg->arch_info;
1667
1668
1669 if (reg->dirty == 1)
1670 {
1671 regs[j] = buf_get_u32(reg->value, 0, 32);
1672 mask |= 1 << j;
1673 num_regs++;
1674 reg->dirty = 0;
1675 reg->valid = 1;
1676 LOG_DEBUG("writing register %i mode %s "
1677 "with value 0x%8.8" PRIx32, j,
1678 arm_mode_name(armv4_5->core_mode),
1679 regs[j]);
1680 }
1681 }
1682
1683 if (mask)
1684 {
1685 arm7_9->write_core_regs(target, mask, regs);
1686 }
1687
1688 reg = &ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5_number_to_mode(i), 16);
1689 reg_arch_info = reg->arch_info;
1690 if ((reg->dirty) && (reg_arch_info->mode != ARM_MODE_ANY))
1691 {
1692 LOG_DEBUG("writing SPSR of mode %i with value 0x%8.8" PRIx32 "", i, buf_get_u32(reg->value, 0, 32));
1693 arm7_9->write_xpsr(target, buf_get_u32(reg->value, 0, 32), 1);
1694 }
1695 }
1696 }
1697
1698 if (!armv4_5->cpsr->dirty && (armv4_5->core_mode != current_mode))
1699 {
1700 /* restore processor mode (mask T bit) */
1701 uint32_t tmp_cpsr;
1702
1703 tmp_cpsr = buf_get_u32(armv4_5->cpsr->value, 0, 8) & 0xE0;
1704 tmp_cpsr |= armv4_5_number_to_mode(i);
1705 tmp_cpsr &= ~0x20;
1706 LOG_DEBUG("writing lower 8 bit of cpsr with value 0x%2.2x", (unsigned)(tmp_cpsr));
1707 arm7_9->write_xpsr_im8(target, tmp_cpsr & 0xff, 0, 0);
1708 }
1709 else if (armv4_5->cpsr->dirty)
1710 {
1711 /* CPSR has been changed, full restore necessary (mask T bit) */
1712 LOG_DEBUG("writing cpsr with value 0x%8.8" PRIx32,
1713 buf_get_u32(armv4_5->cpsr->value, 0, 32));
1714 arm7_9->write_xpsr(target,
1715 buf_get_u32(armv4_5->cpsr->value, 0, 32)
1716 & ~0x20, 0);
1717 armv4_5->cpsr->dirty = 0;
1718 armv4_5->cpsr->valid = 1;
1719 }
1720
1721 /* restore PC */
1722 LOG_DEBUG("writing PC with value 0x%8.8" PRIx32,
1723 buf_get_u32(armv4_5->pc->value, 0, 32));
1724 arm7_9->write_pc(target, buf_get_u32(armv4_5->pc->value, 0, 32));
1725 armv4_5->pc->dirty = 0;
1726
1727 return ERROR_OK;
1728 }
1729
1730 /**
1731 * Restart the core of an ARM7/9 target. A RESTART command is sent to the
1732 * instruction register and the JTAG state is set to TAP_IDLE causing a core
1733 * restart.
1734 *
1735 * @param target Pointer to the ARM7/9 target to be restarted
1736 * @return Result of executing the JTAG queue
1737 */
1738 static int arm7_9_restart_core(struct target *target)
1739 {
1740 struct arm7_9_common *arm7_9 = target_to_arm7_9(target);
1741 struct arm_jtag *jtag_info = &arm7_9->jtag_info;
1742
1743 /* set RESTART instruction */
1744 if (arm7_9->need_bypass_before_restart) {
1745 arm7_9->need_bypass_before_restart = 0;
1746 arm_jtag_set_instr(jtag_info, 0xf, NULL, TAP_IDLE);
1747 }
1748 arm_jtag_set_instr(jtag_info, 0x4, NULL, TAP_IDLE);
1749
1750 jtag_add_runtest(1, TAP_IDLE);
1751 return jtag_execute_queue();
1752 }
1753
1754 /**
1755 * Enable the watchpoints on an ARM7/9 target. The target's watchpoints are
1756 * iterated through and are set on the target if they aren't already set.
1757 *
1758 * @param target Pointer to the ARM7/9 target to enable watchpoints on
1759 */
1760 static void arm7_9_enable_watchpoints(struct target *target)
1761 {
1762 struct watchpoint *watchpoint = target->watchpoints;
1763
1764 while (watchpoint)
1765 {
1766 if (watchpoint->set == 0)
1767 arm7_9_set_watchpoint(target, watchpoint);
1768 watchpoint = watchpoint->next;
1769 }
1770 }
1771
1772 /**
1773 * Enable the breakpoints on an ARM7/9 target. The target's breakpoints are
1774 * iterated through and are set on the target.
1775 *
1776 * @param target Pointer to the ARM7/9 target to enable breakpoints on
1777 */
1778 static void arm7_9_enable_breakpoints(struct target *target)
1779 {
1780 struct breakpoint *breakpoint = target->breakpoints;
1781
1782 /* set any pending breakpoints */
1783 while (breakpoint)
1784 {
1785 arm7_9_set_breakpoint(target, breakpoint);
1786 breakpoint = breakpoint->next;
1787 }
1788 }
1789
1790 int arm7_9_resume(struct target *target, int current, uint32_t address, int handle_breakpoints, int debug_execution)
1791 {
1792 struct arm7_9_common *arm7_9 = target_to_arm7_9(target);
1793 struct arm *armv4_5 = &arm7_9->armv4_5_common;
1794 struct breakpoint *breakpoint = target->breakpoints;
1795 struct reg *dbg_ctrl = &arm7_9->eice_cache->reg_list[EICE_DBG_CTRL];
1796 int err, retval = ERROR_OK;
1797
1798 LOG_DEBUG("-");
1799
1800 if (target->state != TARGET_HALTED)
1801 {
1802 LOG_WARNING("target not halted");
1803 return ERROR_TARGET_NOT_HALTED;
1804 }
1805
1806 if (!debug_execution)
1807 {
1808 target_free_all_working_areas(target);
1809 }
1810
1811 /* current = 1: continue on current pc, otherwise continue at <address> */
1812 if (!current)
1813 buf_set_u32(armv4_5->pc->value, 0, 32, address);
1814
1815 uint32_t current_pc;
1816 current_pc = buf_get_u32(armv4_5->pc->value, 0, 32);
1817
1818 /* the front-end may request us not to handle breakpoints */
1819 if (handle_breakpoints)
1820 {
1821 breakpoint = breakpoint_find(target,
1822 buf_get_u32(armv4_5->pc->value, 0, 32));
1823 if (breakpoint != NULL)
1824 {
1825 LOG_DEBUG("unset breakpoint at 0x%8.8" PRIx32 " (id: %d)", breakpoint->address, breakpoint->unique_id );
1826 if ((retval = arm7_9_unset_breakpoint(target, breakpoint)) != ERROR_OK)
1827 {
1828 return retval;
1829 }
1830
1831 /* calculate PC of next instruction */
1832 uint32_t next_pc;
1833 if ((retval = arm_simulate_step(target, &next_pc)) != ERROR_OK)
1834 {
1835 uint32_t current_opcode;
1836 target_read_u32(target, current_pc, &current_opcode);
1837 LOG_ERROR("Couldn't calculate PC of next instruction, current opcode was 0x%8.8" PRIx32 "", current_opcode);
1838 return retval;
1839 }
1840
1841 LOG_DEBUG("enable single-step");
1842 arm7_9->enable_single_step(target, next_pc);
1843
1844 target->debug_reason = DBG_REASON_SINGLESTEP;
1845
1846 if ((retval = arm7_9_restore_context(target)) != ERROR_OK)
1847 {
1848 return retval;
1849 }
1850
1851 if (armv4_5->core_state == ARM_STATE_ARM)
1852 arm7_9->branch_resume(target);
1853 else if (armv4_5->core_state == ARM_STATE_THUMB)
1854 {
1855 arm7_9->branch_resume_thumb(target);
1856 }
1857 else
1858 {
1859 LOG_ERROR("unhandled core state");
1860 return ERROR_FAIL;
1861 }
1862
1863 buf_set_u32(dbg_ctrl->value, EICE_DBG_CONTROL_DBGACK, 1, 0);
1864 embeddedice_write_reg(dbg_ctrl, buf_get_u32(dbg_ctrl->value, 0, dbg_ctrl->size));
1865 err = arm7_9_execute_sys_speed(target);
1866
1867 LOG_DEBUG("disable single-step");
1868 arm7_9->disable_single_step(target);
1869
1870 if (err != ERROR_OK)
1871 {
1872 if ((retval = arm7_9_set_breakpoint(target, breakpoint)) != ERROR_OK)
1873 {
1874 return retval;
1875 }
1876 target->state = TARGET_UNKNOWN;
1877 return err;
1878 }
1879
1880 arm7_9_debug_entry(target);
1881 LOG_DEBUG("new PC after step: 0x%8.8" PRIx32,
1882 buf_get_u32(armv4_5->pc->value, 0, 32));
1883
1884 LOG_DEBUG("set breakpoint at 0x%8.8" PRIx32 "", breakpoint->address);
1885 if ((retval = arm7_9_set_breakpoint(target, breakpoint)) != ERROR_OK)
1886 {
1887 return retval;
1888 }
1889 }
1890 }
1891
1892 /* enable any pending breakpoints and watchpoints */
1893 arm7_9_enable_breakpoints(target);
1894 arm7_9_enable_watchpoints(target);
1895
1896 if ((retval = arm7_9_restore_context(target)) != ERROR_OK)
1897 {
1898 return retval;
1899 }
1900
1901 if (armv4_5->core_state == ARM_STATE_ARM)
1902 {
1903 arm7_9->branch_resume(target);
1904 }
1905 else if (armv4_5->core_state == ARM_STATE_THUMB)
1906 {
1907 arm7_9->branch_resume_thumb(target);
1908 }
1909 else
1910 {
1911 LOG_ERROR("unhandled core state");
1912 return ERROR_FAIL;
1913 }
1914
1915 /* deassert DBGACK and INTDIS */
1916 buf_set_u32(dbg_ctrl->value, EICE_DBG_CONTROL_DBGACK, 1, 0);
1917 /* INTDIS only when we really resume, not during debug execution */
1918 if (!debug_execution)
1919 buf_set_u32(dbg_ctrl->value, EICE_DBG_CONTROL_INTDIS, 1, 0);
1920 embeddedice_write_reg(dbg_ctrl, buf_get_u32(dbg_ctrl->value, 0, dbg_ctrl->size));
1921
1922 if ((retval = arm7_9_restart_core(target)) != ERROR_OK)
1923 {
1924 return retval;
1925 }
1926
1927 target->debug_reason = DBG_REASON_NOTHALTED;
1928
1929 if (!debug_execution)
1930 {
1931 /* registers are now invalid */
1932 register_cache_invalidate(armv4_5->core_cache);
1933 target->state = TARGET_RUNNING;
1934 if ((retval = target_call_event_callbacks(target, TARGET_EVENT_RESUMED)) != ERROR_OK)
1935 {
1936 return retval;
1937 }
1938 }
1939 else
1940 {
1941 target->state = TARGET_DEBUG_RUNNING;
1942 if ((retval = target_call_event_callbacks(target, TARGET_EVENT_DEBUG_RESUMED)) != ERROR_OK)
1943 {
1944 return retval;
1945 }
1946 }
1947
1948 LOG_DEBUG("target resumed");
1949
1950 return ERROR_OK;
1951 }
1952
1953 void arm7_9_enable_eice_step(struct target *target, uint32_t next_pc)
1954 {
1955 struct arm7_9_common *arm7_9 = target_to_arm7_9(target);
1956 struct arm *armv4_5 = &arm7_9->armv4_5_common;
1957 uint32_t current_pc;
1958 current_pc = buf_get_u32(armv4_5->pc->value, 0, 32);
1959
1960 if (next_pc != current_pc)
1961 {
1962 /* setup an inverse breakpoint on the current PC
1963 * - comparator 1 matches the current address
1964 * - rangeout from comparator 1 is connected to comparator 0 rangein
1965 * - comparator 0 matches any address, as long as rangein is low */
1966 embeddedice_write_reg(&arm7_9->eice_cache->reg_list[EICE_W0_ADDR_MASK], 0xffffffff);
1967 embeddedice_write_reg(&arm7_9->eice_cache->reg_list[EICE_W0_DATA_MASK], 0xffffffff);
1968 embeddedice_write_reg(&arm7_9->eice_cache->reg_list[EICE_W0_CONTROL_VALUE], EICE_W_CTRL_ENABLE);
1969 embeddedice_write_reg(&arm7_9->eice_cache->reg_list[EICE_W0_CONTROL_MASK], ~(EICE_W_CTRL_RANGE | EICE_W_CTRL_nOPC) & 0xff);
1970 embeddedice_write_reg(&arm7_9->eice_cache->reg_list[EICE_W1_ADDR_VALUE], current_pc);
1971 embeddedice_write_reg(&arm7_9->eice_cache->reg_list[EICE_W1_ADDR_MASK], 0);
1972 embeddedice_write_reg(&arm7_9->eice_cache->reg_list[EICE_W1_DATA_MASK], 0xffffffff);
1973 embeddedice_write_reg(&arm7_9->eice_cache->reg_list[EICE_W1_CONTROL_VALUE], 0x0);
1974 embeddedice_write_reg(&arm7_9->eice_cache->reg_list[EICE_W1_CONTROL_MASK], ~EICE_W_CTRL_nOPC & 0xff);
1975 }
1976 else
1977 {
1978 embeddedice_write_reg(&arm7_9->eice_cache->reg_list[EICE_W0_ADDR_MASK], 0xffffffff);
1979 embeddedice_write_reg(&arm7_9->eice_cache->reg_list[EICE_W0_DATA_MASK], 0xffffffff);
1980 embeddedice_write_reg(&arm7_9->eice_cache->reg_list[EICE_W0_CONTROL_VALUE], 0x0);
1981 embeddedice_write_reg(&arm7_9->eice_cache->reg_list[EICE_W0_CONTROL_MASK], 0xff);
1982 embeddedice_write_reg(&arm7_9->eice_cache->reg_list[EICE_W1_ADDR_VALUE], next_pc);
1983 embeddedice_write_reg(&arm7_9->eice_cache->reg_list[EICE_W1_ADDR_MASK], 0);
1984 embeddedice_write_reg(&arm7_9->eice_cache->reg_list[EICE_W1_DATA_MASK], 0xffffffff);
1985 embeddedice_write_reg(&arm7_9->eice_cache->reg_list[EICE_W1_CONTROL_VALUE], EICE_W_CTRL_ENABLE);
1986 embeddedice_write_reg(&arm7_9->eice_cache->reg_list[EICE_W1_CONTROL_MASK], ~EICE_W_CTRL_nOPC & 0xff);
1987 }
1988 }
1989
1990 void arm7_9_disable_eice_step(struct target *target)
1991 {
1992 struct arm7_9_common *arm7_9 = target_to_arm7_9(target);
1993
1994 embeddedice_store_reg(&arm7_9->eice_cache->reg_list[EICE_W0_ADDR_MASK]);
1995 embeddedice_store_reg(&arm7_9->eice_cache->reg_list[EICE_W0_DATA_MASK]);
1996 embeddedice_store_reg(&arm7_9->eice_cache->reg_list[EICE_W0_CONTROL_VALUE]);
1997 embeddedice_store_reg(&arm7_9->eice_cache->reg_list[EICE_W0_CONTROL_MASK]);
1998 embeddedice_store_reg(&arm7_9->eice_cache->reg_list[EICE_W1_ADDR_VALUE]);
1999 embeddedice_store_reg(&arm7_9->eice_cache->reg_list[EICE_W1_ADDR_MASK]);
2000 embeddedice_store_reg(&arm7_9->eice_cache->reg_list[EICE_W1_DATA_MASK]);
2001 embeddedice_store_reg(&arm7_9->eice_cache->reg_list[EICE_W1_CONTROL_MASK]);
2002 embeddedice_store_reg(&arm7_9->eice_cache->reg_list[EICE_W1_CONTROL_VALUE]);
2003 }
2004
2005 int arm7_9_step(struct target *target, int current, uint32_t address, int handle_breakpoints)
2006 {
2007 struct arm7_9_common *arm7_9 = target_to_arm7_9(target);
2008 struct arm *armv4_5 = &arm7_9->armv4_5_common;
2009 struct breakpoint *breakpoint = NULL;
2010 int err, retval;
2011
2012 if (target->state != TARGET_HALTED)
2013 {
2014 LOG_WARNING("target not halted");
2015 return ERROR_TARGET_NOT_HALTED;
2016 }
2017
2018 /* current = 1: continue on current pc, otherwise continue at <address> */
2019 if (!current)
2020 buf_set_u32(armv4_5->pc->value, 0, 32, address);
2021
2022 uint32_t current_pc = buf_get_u32(armv4_5->pc->value, 0, 32);
2023
2024 /* the front-end may request us not to handle breakpoints */
2025 if (handle_breakpoints)
2026 breakpoint = breakpoint_find(target, current_pc);
2027 if (breakpoint != NULL) {
2028 retval = arm7_9_unset_breakpoint(target, breakpoint);
2029 if (retval != ERROR_OK)
2030 return retval;
2031 }
2032
2033 target->debug_reason = DBG_REASON_SINGLESTEP;
2034
2035 /* calculate PC of next instruction */
2036 uint32_t next_pc;
2037 if ((retval = arm_simulate_step(target, &next_pc)) != ERROR_OK)
2038 {
2039 uint32_t current_opcode;
2040 target_read_u32(target, current_pc, &current_opcode);
2041 LOG_ERROR("Couldn't calculate PC of next instruction, current opcode was 0x%8.8" PRIx32 "", current_opcode);
2042 return retval;
2043 }
2044
2045 if ((retval = arm7_9_restore_context(target)) != ERROR_OK)
2046 {
2047 return retval;
2048 }
2049
2050 arm7_9->enable_single_step(target, next_pc);
2051
2052 if (armv4_5->core_state == ARM_STATE_ARM)
2053 {
2054 arm7_9->branch_resume(target);
2055 }
2056 else if (armv4_5->core_state == ARM_STATE_THUMB)
2057 {
2058 arm7_9->branch_resume_thumb(target);
2059 }
2060 else
2061 {
2062 LOG_ERROR("unhandled core state");
2063 return ERROR_FAIL;
2064 }
2065
2066 if ((retval = target_call_event_callbacks(target, TARGET_EVENT_RESUMED)) != ERROR_OK)
2067 {
2068 return retval;
2069 }
2070
2071 err = arm7_9_execute_sys_speed(target);
2072 arm7_9->disable_single_step(target);
2073
2074 /* registers are now invalid */
2075 register_cache_invalidate(armv4_5->core_cache);
2076
2077 if (err != ERROR_OK)
2078 {
2079 target->state = TARGET_UNKNOWN;
2080 } else {
2081 arm7_9_debug_entry(target);
2082 if ((retval = target_call_event_callbacks(target, TARGET_EVENT_HALTED)) != ERROR_OK)
2083 {
2084 return retval;
2085 }
2086 LOG_DEBUG("target stepped");
2087 }
2088
2089 if (breakpoint)
2090 if ((retval = arm7_9_set_breakpoint(target, breakpoint)) != ERROR_OK)
2091 {
2092 return retval;
2093 }
2094
2095 return err;
2096 }
2097
2098 static int arm7_9_read_core_reg(struct target *target, struct reg *r,
2099 int num, enum arm_mode mode)
2100 {
2101 uint32_t* reg_p[16];
2102 uint32_t value;
2103 int retval;
2104 struct arm_reg *areg = r->arch_info;
2105 struct arm7_9_common *arm7_9 = target_to_arm7_9(target);
2106 struct arm *armv4_5 = &arm7_9->armv4_5_common;
2107
2108 if (!is_arm_mode(armv4_5->core_mode))
2109 return ERROR_FAIL;
2110 if ((num < 0) || (num > 16))
2111 return ERROR_INVALID_ARGUMENTS;
2112
2113 if ((mode != ARM_MODE_ANY)
2114 && (mode != armv4_5->core_mode)
2115 && (areg->mode != ARM_MODE_ANY))
2116 {
2117 uint32_t tmp_cpsr;
2118
2119 /* change processor mode (mask T bit) */
2120 tmp_cpsr = buf_get_u32(armv4_5->cpsr->value, 0, 8) & 0xE0;
2121 tmp_cpsr |= mode;
2122 tmp_cpsr &= ~0x20;
2123 arm7_9->write_xpsr_im8(target, tmp_cpsr & 0xff, 0, 0);
2124 }
2125
2126 if ((num >= 0) && (num <= 15))
2127 {
2128 /* read a normal core register */
2129 reg_p[num] = &value;
2130
2131 arm7_9->read_core_regs(target, 1 << num, reg_p);
2132 }
2133 else
2134 {
2135 /* read a program status register
2136 * if the register mode is MODE_ANY, we read the cpsr, otherwise a spsr
2137 */
2138 arm7_9->read_xpsr(target, &value, areg->mode != ARM_MODE_ANY);
2139 }
2140
2141 if ((retval = jtag_execute_queue()) != ERROR_OK)
2142 {
2143 return retval;
2144 }
2145
2146 r->valid = 1;
2147 r->dirty = 0;
2148 buf_set_u32(r->value, 0, 32, value);
2149
2150 if ((mode != ARM_MODE_ANY)
2151 && (mode != armv4_5->core_mode)
2152 && (areg->mode != ARM_MODE_ANY)) {
2153 /* restore processor mode (mask T bit) */
2154 arm7_9->write_xpsr_im8(target,
2155 buf_get_u32(armv4_5->cpsr->value, 0, 8)
2156 & ~0x20, 0, 0);
2157 }
2158
2159 return ERROR_OK;
2160 }
2161
2162 static int arm7_9_write_core_reg(struct target *target, struct reg *r,
2163 int num, enum arm_mode mode, uint32_t value)
2164 {
2165 uint32_t reg[16];
2166 struct arm_reg *areg = r->arch_info;
2167 struct arm7_9_common *arm7_9 = target_to_arm7_9(target);
2168 struct arm *armv4_5 = &arm7_9->armv4_5_common;
2169
2170 if (!is_arm_mode(armv4_5->core_mode))
2171 return ERROR_FAIL;
2172 if ((num < 0) || (num > 16))
2173 return ERROR_INVALID_ARGUMENTS;
2174
2175 if ((mode != ARM_MODE_ANY)
2176 && (mode != armv4_5->core_mode)
2177 && (areg->mode != ARM_MODE_ANY)) {
2178 uint32_t tmp_cpsr;
2179
2180 /* change processor mode (mask T bit) */
2181 tmp_cpsr = buf_get_u32(armv4_5->cpsr->value, 0, 8) & 0xE0;
2182 tmp_cpsr |= mode;
2183 tmp_cpsr &= ~0x20;
2184 arm7_9->write_xpsr_im8(target, tmp_cpsr & 0xff, 0, 0);
2185 }
2186
2187 if ((num >= 0) && (num <= 15))
2188 {
2189 /* write a normal core register */
2190 reg[num] = value;
2191
2192 arm7_9->write_core_regs(target, 1 << num, reg);
2193 }
2194 else
2195 {
2196 /* write a program status register
2197 * if the register mode is MODE_ANY, we write the cpsr, otherwise a spsr
2198 */
2199 int spsr = (areg->mode != ARM_MODE_ANY);
2200
2201 /* if we're writing the CPSR, mask the T bit */
2202 if (!spsr)
2203 value &= ~0x20;
2204
2205 arm7_9->write_xpsr(target, value, spsr);
2206 }
2207
2208 r->valid = 1;
2209 r->dirty = 0;
2210
2211 if ((mode != ARM_MODE_ANY)
2212 && (mode != armv4_5->core_mode)
2213 && (areg->mode != ARM_MODE_ANY)) {
2214 /* restore processor mode (mask T bit) */
2215 arm7_9->write_xpsr_im8(target,
2216 buf_get_u32(armv4_5->cpsr->value, 0, 8)
2217 & ~0x20, 0, 0);
2218 }
2219
2220 return jtag_execute_queue();
2221 }
2222
2223 int arm7_9_read_memory(struct target *target, uint32_t address, uint32_t size, uint32_t count, uint8_t *buffer)
2224 {
2225 struct arm7_9_common *arm7_9 = target_to_arm7_9(target);
2226 struct arm *armv4_5 = &arm7_9->armv4_5_common;
2227 uint32_t reg[16];
2228 uint32_t num_accesses = 0;
2229 int thisrun_accesses;
2230 int i;
2231 uint32_t cpsr;
2232 int retval;
2233 int last_reg = 0;
2234
2235 LOG_DEBUG("address: 0x%8.8" PRIx32 ", size: 0x%8.8" PRIx32 ", count: 0x%8.8" PRIx32 "", address, size, count);
2236
2237 if (target->state != TARGET_HALTED)
2238 {
2239 LOG_WARNING("target not halted");
2240 return ERROR_TARGET_NOT_HALTED;
2241 }
2242
2243 /* sanitize arguments */
2244 if (((size != 4) && (size != 2) && (size != 1)) || (count == 0) || !(buffer))
2245 return ERROR_INVALID_ARGUMENTS;
2246
2247 if (((size == 4) && (address & 0x3u)) || ((size == 2) && (address & 0x1u)))
2248 return ERROR_TARGET_UNALIGNED_ACCESS;
2249
2250 /* load the base register with the address of the first word */
2251 reg[0] = address;
2252 arm7_9->write_core_regs(target, 0x1, reg);
2253
2254 int j = 0;
2255
2256 switch (size)
2257 {
2258 case 4:
2259 while (num_accesses < count)
2260 {
2261 uint32_t reg_list;
2262 thisrun_accesses = ((count - num_accesses) >= 14) ? 14 : (count - num_accesses);
2263 reg_list = (0xffff >> (15 - thisrun_accesses)) & 0xfffe;
2264
2265 if (last_reg <= thisrun_accesses)
2266 last_reg = thisrun_accesses;
2267
2268 arm7_9->load_word_regs(target, reg_list);
2269
2270 /* fast memory reads are only safe when the target is running
2271 * from a sufficiently high clock (32 kHz is usually too slow)
2272 */
2273 if (arm7_9->fast_memory_access)
2274 retval = arm7_9_execute_fast_sys_speed(target);
2275 else
2276 retval = arm7_9_execute_sys_speed(target);
2277 if (retval != ERROR_OK)
2278 return retval;
2279
2280 arm7_9->read_core_regs_target_buffer(target, reg_list, buffer, 4);
2281
2282 /* advance buffer, count number of accesses */
2283 buffer += thisrun_accesses * 4;
2284 num_accesses += thisrun_accesses;
2285
2286 if ((j++%1024) == 0)
2287 {
2288 keep_alive();
2289 }
2290 }
2291 break;
2292 case 2:
2293 while (num_accesses < count)
2294 {
2295 uint32_t reg_list;
2296 thisrun_accesses = ((count - num_accesses) >= 14) ? 14 : (count - num_accesses);
2297 reg_list = (0xffff >> (15 - thisrun_accesses)) & 0xfffe;
2298
2299 for (i = 1; i <= thisrun_accesses; i++)
2300 {
2301 if (i > last_reg)
2302 last_reg = i;
2303 arm7_9->load_hword_reg(target, i);
2304 /* fast memory reads are only safe when the target is running
2305 * from a sufficiently high clock (32 kHz is usually too slow)
2306 */
2307 if (arm7_9->fast_memory_access)
2308 retval = arm7_9_execute_fast_sys_speed(target);
2309 else
2310 retval = arm7_9_execute_sys_speed(target);
2311 if (retval != ERROR_OK)
2312 {
2313 return retval;
2314 }
2315
2316 }
2317
2318 arm7_9->read_core_regs_target_buffer(target, reg_list, buffer, 2);
2319
2320 /* advance buffer, count number of accesses */
2321 buffer += thisrun_accesses * 2;
2322 num_accesses += thisrun_accesses;
2323
2324 if ((j++%1024) == 0)
2325 {
2326 keep_alive();
2327 }
2328 }
2329 break;
2330 case 1:
2331 while (num_accesses < count)
2332 {
2333 uint32_t reg_list;
2334 thisrun_accesses = ((count - num_accesses) >= 14) ? 14 : (count - num_accesses);
2335 reg_list = (0xffff >> (15 - thisrun_accesses)) & 0xfffe;
2336
2337 for (i = 1; i <= thisrun_accesses; i++)
2338 {
2339 if (i > last_reg)
2340 last_reg = i;
2341 arm7_9->load_byte_reg(target, i);
2342 /* fast memory reads are only safe when the target is running
2343 * from a sufficiently high clock (32 kHz is usually too slow)
2344 */
2345 if (arm7_9->fast_memory_access)
2346 retval = arm7_9_execute_fast_sys_speed(target);
2347 else
2348 retval = arm7_9_execute_sys_speed(target);
2349 if (retval != ERROR_OK)
2350 {
2351 return retval;
2352 }
2353 }
2354
2355 arm7_9->read_core_regs_target_buffer(target, reg_list, buffer, 1);
2356
2357 /* advance buffer, count number of accesses */
2358 buffer += thisrun_accesses * 1;
2359 num_accesses += thisrun_accesses;
2360
2361 if ((j++%1024) == 0)
2362 {
2363 keep_alive();
2364 }
2365 }
2366 break;
2367 }
2368
2369 if (!is_arm_mode(armv4_5->core_mode))
2370 return ERROR_FAIL;
2371
2372 for (i = 0; i <= last_reg; i++) {
2373 struct reg *r = arm_reg_current(armv4_5, i);
2374
2375 r->dirty = r->valid;
2376 }
2377
2378 arm7_9->read_xpsr(target, &cpsr, 0);
2379 if ((retval = jtag_execute_queue()) != ERROR_OK)
2380 {
2381 LOG_ERROR("JTAG error while reading cpsr");
2382 return ERROR_TARGET_DATA_ABORT;
2383 }
2384
2385 if (((cpsr & 0x1f) == ARM_MODE_ABT) && (armv4_5->core_mode != ARM_MODE_ABT))
2386 {
2387 LOG_WARNING("memory read caused data abort (address: 0x%8.8" PRIx32 ", size: 0x%" PRIx32 ", count: 0x%" PRIx32 ")", address, size, count);
2388
2389 arm7_9->write_xpsr_im8(target,
2390 buf_get_u32(armv4_5->cpsr->value, 0, 8)
2391 & ~0x20, 0, 0);
2392
2393 return ERROR_TARGET_DATA_ABORT;
2394 }
2395
2396 return ERROR_OK;
2397 }
2398
2399 int arm7_9_write_memory(struct target *target, uint32_t address, uint32_t size, uint32_t count, uint8_t *buffer)
2400 {
2401 struct arm7_9_common *arm7_9 = target_to_arm7_9(target);
2402 struct arm *armv4_5 = &arm7_9->armv4_5_common;
2403 struct reg *dbg_ctrl = &arm7_9->eice_cache->reg_list[EICE_DBG_CTRL];
2404
2405 uint32_t reg[16];
2406 uint32_t num_accesses = 0;
2407 int thisrun_accesses;
2408 int i;
2409 uint32_t cpsr;
2410 int retval;
2411 int last_reg = 0;
2412
2413 #ifdef _DEBUG_ARM7_9_
2414 LOG_DEBUG("address: 0x%8.8x, size: 0x%8.8x, count: 0x%8.8x", address, size, count);
2415 #endif
2416
2417 if (target->state != TARGET_HALTED)
2418 {
2419 LOG_WARNING("target not halted");
2420 return ERROR_TARGET_NOT_HALTED;
2421 }
2422
2423 /* sanitize arguments */
2424 if (((size != 4) && (size != 2) && (size != 1)) || (count == 0) || !(buffer))
2425 return ERROR_INVALID_ARGUMENTS;
2426
2427 if (((size == 4) && (address & 0x3u)) || ((size == 2) && (address & 0x1u)))
2428 return ERROR_TARGET_UNALIGNED_ACCESS;
2429
2430 /* load the base register with the address of the first word */
2431 reg[0] = address;
2432 arm7_9->write_core_regs(target, 0x1, reg);
2433
2434 /* Clear DBGACK, to make sure memory fetches work as expected */
2435 buf_set_u32(dbg_ctrl->value, EICE_DBG_CONTROL_DBGACK, 1, 0);
2436 embeddedice_store_reg(dbg_ctrl);
2437
2438 switch (size)
2439 {
2440 case 4:
2441 while (num_accesses < count)
2442 {
2443 uint32_t reg_list;
2444 thisrun_accesses = ((count - num_accesses) >= 14) ? 14 : (count - num_accesses);
2445 reg_list = (0xffff >> (15 - thisrun_accesses)) & 0xfffe;
2446
2447 for (i = 1; i <= thisrun_accesses; i++)
2448 {
2449 if (i > last_reg)
2450 last_reg = i;
2451 reg[i] = target_buffer_get_u32(target, buffer);
2452 buffer += 4;
2453 }
2454
2455 arm7_9->write_core_regs(target, reg_list, reg);
2456
2457 arm7_9->store_word_regs(target, reg_list);
2458
2459 /* fast memory writes are only safe when the target is running
2460 * from a sufficiently high clock (32 kHz is usually too slow)
2461 */
2462 if (arm7_9->fast_memory_access)
2463 retval = arm7_9_execute_fast_sys_speed(target);
2464 else
2465 retval = arm7_9_execute_sys_speed(target);
2466 if (retval != ERROR_OK)
2467 {
2468 return retval;
2469 }
2470
2471 num_accesses += thisrun_accesses;
2472 }
2473 break;
2474 case 2:
2475 while (num_accesses < count)
2476 {
2477 uint32_t reg_list;
2478 thisrun_accesses = ((count - num_accesses) >= 14) ? 14 : (count - num_accesses);
2479 reg_list = (0xffff >> (15 - thisrun_accesses)) & 0xfffe;
2480
2481 for (i = 1; i <= thisrun_accesses; i++)
2482 {
2483 if (i > last_reg)
2484 last_reg = i;
2485 reg[i] = target_buffer_get_u16(target, buffer) & 0xffff;
2486 buffer += 2;
2487 }
2488
2489 arm7_9->write_core_regs(target, reg_list, reg);
2490
2491 for (i = 1; i <= thisrun_accesses; i++)
2492 {
2493 arm7_9->store_hword_reg(target, i);
2494
2495 /* fast memory writes are only safe when the target is running
2496 * from a sufficiently high clock (32 kHz is usually too slow)
2497 */
2498 if (arm7_9->fast_memory_access)
2499 retval = arm7_9_execute_fast_sys_speed(target);
2500 else
2501 retval = arm7_9_execute_sys_speed(target);
2502 if (retval != ERROR_OK)
2503 {
2504 return retval;
2505 }
2506 }
2507
2508 num_accesses += thisrun_accesses;
2509 }
2510 break;
2511 case 1:
2512 while (num_accesses < count)
2513 {
2514 uint32_t reg_list;
2515 thisrun_accesses = ((count - num_accesses) >= 14) ? 14 : (count - num_accesses);
2516 reg_list = (0xffff >> (15 - thisrun_accesses)) & 0xfffe;
2517
2518 for (i = 1; i <= thisrun_accesses; i++)
2519 {
2520 if (i > last_reg)
2521 last_reg = i;
2522 reg[i] = *buffer++ & 0xff;
2523 }
2524
2525 arm7_9->write_core_regs(target, reg_list, reg);
2526
2527 for (i = 1; i <= thisrun_accesses; i++)
2528 {
2529 arm7_9->store_byte_reg(target, i);
2530 /* fast memory writes are only safe when the target is running
2531 * from a sufficiently high clock (32 kHz is usually too slow)
2532 */
2533 if (arm7_9->fast_memory_access)
2534 retval = arm7_9_execute_fast_sys_speed(target);
2535 else
2536 retval = arm7_9_execute_sys_speed(target);
2537 if (retval != ERROR_OK)
2538 {
2539 return retval;
2540 }
2541
2542 }
2543
2544 num_accesses += thisrun_accesses;
2545 }
2546 break;
2547 }
2548
2549 /* Re-Set DBGACK */
2550 buf_set_u32(dbg_ctrl->value, EICE_DBG_CONTROL_DBGACK, 1, 1);
2551 embeddedice_store_reg(dbg_ctrl);
2552
2553 if (!is_arm_mode(armv4_5->core_mode))
2554 return ERROR_FAIL;
2555
2556 for (i = 0; i <= last_reg; i++) {
2557 struct reg *r = arm_reg_current(armv4_5, i);
2558
2559 r->dirty = r->valid;
2560 }
2561
2562 arm7_9->read_xpsr(target, &cpsr, 0);
2563 if ((retval = jtag_execute_queue()) != ERROR_OK)
2564 {
2565 LOG_ERROR("JTAG error while reading cpsr");
2566 return ERROR_TARGET_DATA_ABORT;
2567 }
2568
2569 if (((cpsr & 0x1f) == ARM_MODE_ABT) && (armv4_5->core_mode != ARM_MODE_ABT))
2570 {
2571 LOG_WARNING("memory write caused data abort (address: 0x%8.8" PRIx32 ", size: 0x%" PRIx32 ", count: 0x%" PRIx32 ")", address, size, count);
2572
2573 arm7_9->write_xpsr_im8(target,
2574 buf_get_u32(armv4_5->cpsr->value, 0, 8)
2575 & ~0x20, 0, 0);
2576
2577 return ERROR_TARGET_DATA_ABORT;
2578 }
2579
2580 return ERROR_OK;
2581 }
2582
2583 static int dcc_count;
2584 static uint8_t *dcc_buffer;
2585
2586 static int arm7_9_dcc_completion(struct target *target, uint32_t exit_point, int timeout_ms, void *arch_info)
2587 {
2588 int retval = ERROR_OK;
2589 struct arm7_9_common *arm7_9 = target_to_arm7_9(target);
2590
2591 if ((retval = target_wait_state(target, TARGET_DEBUG_RUNNING, 500)) != ERROR_OK)
2592 return retval;
2593
2594 int little = target->endianness == TARGET_LITTLE_ENDIAN;
2595 int count = dcc_count;
2596 uint8_t *buffer = dcc_buffer;
2597 if (count > 2)
2598 {
2599 /* Handle first & last using standard embeddedice_write_reg and the middle ones w/the
2600 * core function repeated. */
2601 embeddedice_write_reg(&arm7_9->eice_cache->reg_list[EICE_COMMS_DATA], fast_target_buffer_get_u32(buffer, little));
2602 buffer += 4;
2603
2604 struct embeddedice_reg *ice_reg = arm7_9->eice_cache->reg_list[EICE_COMMS_DATA].arch_info;
2605 uint8_t reg_addr = ice_reg->addr & 0x1f;
2606 struct jtag_tap *tap;
2607 tap = ice_reg->jtag_info->tap;
2608
2609 embeddedice_write_dcc(tap, reg_addr, buffer, little, count-2);
2610 buffer += (count-2)*4;
2611
2612 embeddedice_write_reg(&arm7_9->eice_cache->reg_list[EICE_COMMS_DATA], fast_target_buffer_get_u32(buffer, little));
2613 } else
2614 {
2615 int i;
2616 for (i = 0; i < count; i++)
2617 {
2618 embeddedice_write_reg(&arm7_9->eice_cache->reg_list[EICE_COMMS_DATA], fast_target_buffer_get_u32(buffer, little));
2619 buffer += 4;
2620 }
2621 }
2622
2623 if ((retval = target_halt(target))!= ERROR_OK)
2624 {
2625 return retval;
2626 }
2627 return target_wait_state(target, TARGET_HALTED, 500);
2628 }
2629
2630 static const uint32_t dcc_code[] =
2631 {
2632 /* r0 == input, points to memory buffer
2633 * r1 == scratch
2634 */
2635
2636 /* spin until DCC control (c0) reports data arrived */
2637 0xee101e10, /* w: mrc p14, #0, r1, c0, c0 */
2638 0xe3110001, /* tst r1, #1 */
2639 0x0afffffc, /* bne w */
2640
2641 /* read word from DCC (c1), write to memory */
2642 0xee111e10, /* mrc p14, #0, r1, c1, c0 */
2643 0xe4801004, /* str r1, [r0], #4 */
2644
2645 /* repeat */
2646 0xeafffff9 /* b w */
2647 };
2648
2649 int arm7_9_bulk_write_memory(struct target *target, uint32_t address, uint32_t count, uint8_t *buffer)
2650 {
2651 int retval;
2652 struct arm7_9_common *arm7_9 = target_to_arm7_9(target);
2653 int i;
2654
2655 if (!arm7_9->dcc_downloads)
2656 return target_write_memory(target, address, 4, count, buffer);
2657
2658 /* regrab previously allocated working_area, or allocate a new one */
2659 if (!arm7_9->dcc_working_area)
2660 {
2661 uint8_t dcc_code_buf[6 * 4];
2662
2663 /* make sure we have a working area */
2664 if (target_alloc_working_area(target, 24, &arm7_9->dcc_working_area) != ERROR_OK)
2665 {
2666 LOG_INFO("no working area available, falling back to memory writes");
2667 return target_write_memory(target, address, 4, count, buffer);
2668 }
2669
2670 /* copy target instructions to target endianness */
2671 for (i = 0; i < 6; i++)
2672 {
2673 target_buffer_set_u32(target, dcc_code_buf + i*4, dcc_code[i]);
2674 }
2675
2676 /* write DCC code to working area */
2677 if ((retval = target_write_memory(target, arm7_9->dcc_working_area->address, 4, 6, dcc_code_buf)) != ERROR_OK)
2678 {
2679 return retval;
2680 }
2681 }
2682
2683 struct arm_algorithm armv4_5_info;
2684 struct reg_param reg_params[1];
2685
2686 armv4_5_info.common_magic = ARM_COMMON_MAGIC;
2687 armv4_5_info.core_mode = ARM_MODE_SVC;
2688 armv4_5_info.core_state = ARM_STATE_ARM;
2689
2690 init_reg_param(&reg_params[0], "r0", 32, PARAM_IN_OUT);
2691
2692 buf_set_u32(reg_params[0].value, 0, 32, address);
2693
2694 dcc_count = count;
2695 dcc_buffer = buffer;
2696 retval = armv4_5_run_algorithm_inner(target, 0, NULL, 1, reg_params,
2697 arm7_9->dcc_working_area->address,
2698 arm7_9->dcc_working_area->address + 6*4,
2699 20*1000, &armv4_5_info, arm7_9_dcc_completion);
2700
2701 if (retval == ERROR_OK)
2702 {
2703 uint32_t endaddress = buf_get_u32(reg_params[0].value, 0, 32);
2704 if (endaddress != (address + count*4))
2705 {
2706 LOG_ERROR("DCC write failed, expected end address 0x%08" PRIx32 " got 0x%0" PRIx32 "", (address + count*4), endaddress);
2707 retval = ERROR_FAIL;
2708 }
2709 }
2710
2711 destroy_reg_param(&reg_params[0]);
2712
2713 return retval;
2714 }
2715
2716 /**
2717 * Perform per-target setup that requires JTAG access.
2718 */
2719 int arm7_9_examine(struct target *target)
2720 {
2721 struct arm7_9_common *arm7_9 = target_to_arm7_9(target);
2722 int retval;
2723
2724 if (!target_was_examined(target)) {
2725 struct reg_cache *t, **cache_p;
2726
2727 t = embeddedice_build_reg_cache(target, arm7_9);
2728 if (t == NULL)
2729 return ERROR_FAIL;
2730
2731 cache_p = register_get_last_cache_p(&target->reg_cache);
2732 (*cache_p) = t;
2733 arm7_9->eice_cache = (*cache_p);
2734
2735 if (arm7_9->armv4_5_common.etm)
2736 (*cache_p)->next = etm_build_reg_cache(target,
2737 &arm7_9->jtag_info,
2738 arm7_9->armv4_5_common.etm);
2739
2740 target_set_examined(target);
2741 }
2742
2743 retval = embeddedice_setup(target);
2744 if (retval == ERROR_OK)
2745 retval = arm7_9_setup(target);
2746 if (retval == ERROR_OK && arm7_9->armv4_5_common.etm)
2747 retval = etm_setup(target);
2748 return retval;
2749 }
2750
2751
2752 int arm7_9_check_reset(struct target *target)
2753 {
2754 struct arm7_9_common *arm7_9 = target_to_arm7_9(target);
2755
2756 if (get_target_reset_nag() && !arm7_9->dcc_downloads)
2757 {
2758 LOG_WARNING("NOTE! DCC downloads have not been enabled, defaulting to slow memory writes. Type 'help dcc'.");
2759 }
2760
2761 if (get_target_reset_nag() && (target->working_area_size == 0))
2762 {
2763 LOG_WARNING("NOTE! Severe performance degradation without working memory enabled.");
2764 }
2765
2766 if (get_target_reset_nag() && !arm7_9->fast_memory_access)
2767 {
2768 LOG_WARNING("NOTE! Severe performance degradation without fast memory access enabled. Type 'help fast'.");
2769 }
2770
2771 return ERROR_OK;
2772 }
2773
2774 COMMAND_HANDLER(handle_arm7_9_dbgrq_command)
2775 {
2776 struct target *target = get_current_target(CMD_CTX);
2777 struct arm7_9_common *arm7_9 = target_to_arm7_9(target);
2778
2779 if (!is_arm7_9(arm7_9))
2780 {
2781 command_print(CMD_CTX, "current target isn't an ARM7/ARM9 target");
2782 return ERROR_TARGET_INVALID;
2783 }
2784
2785 if (CMD_ARGC > 0)
2786 COMMAND_PARSE_ENABLE(CMD_ARGV[0],arm7_9->use_dbgrq);
2787
2788 command_print(CMD_CTX, "use of EmbeddedICE dbgrq instead of breakpoint for target halt %s", (arm7_9->use_dbgrq) ? "enabled" : "disabled");
2789
2790 return ERROR_OK;
2791 }
2792
2793 COMMAND_HANDLER(handle_arm7_9_fast_memory_access_command)
2794 {
2795 struct target *target = get_current_target(CMD_CTX);
2796 struct arm7_9_common *arm7_9 = target_to_arm7_9(target);
2797
2798 if (!is_arm7_9(arm7_9))
2799 {
2800 command_print(CMD_CTX, "current target isn't an ARM7/ARM9 target");
2801 return ERROR_TARGET_INVALID;
2802 }
2803
2804 if (CMD_ARGC > 0)
2805 COMMAND_PARSE_ENABLE(CMD_ARGV[0], arm7_9->fast_memory_access);
2806
2807 command_print(CMD_CTX, "fast memory access is %s", (arm7_9->fast_memory_access) ? "enabled" : "disabled");
2808
2809 return ERROR_OK;
2810 }
2811
2812 COMMAND_HANDLER(handle_arm7_9_dcc_downloads_command)
2813 {
2814 struct target *target = get_current_target(CMD_CTX);
2815 struct arm7_9_common *arm7_9 = target_to_arm7_9(target);
2816
2817 if (!is_arm7_9(arm7_9))
2818 {
2819 command_print(CMD_CTX, "current target isn't an ARM7/ARM9 target");
2820 return ERROR_TARGET_INVALID;
2821 }
2822
2823 if (CMD_ARGC > 0)
2824 COMMAND_PARSE_ENABLE(CMD_ARGV[0], arm7_9->dcc_downloads);
2825
2826 command_print(CMD_CTX, "dcc downloads are %s", (arm7_9->dcc_downloads) ? "enabled" : "disabled");
2827
2828 return ERROR_OK;
2829 }
2830
2831 static int arm7_9_setup_semihosting(struct target *target, int enable)
2832 {
2833 struct arm7_9_common *arm7_9 = target_to_arm7_9(target);
2834
2835 if (!is_arm7_9(arm7_9))
2836 {
2837 LOG_USER("current target isn't an ARM7/ARM9 target");
2838 return ERROR_TARGET_INVALID;
2839 }
2840
2841 if (arm7_9->has_vector_catch) {
2842 struct reg *vector_catch = &arm7_9->eice_cache
2843 ->reg_list[EICE_VEC_CATCH];
2844
2845 if (!vector_catch->valid)
2846 embeddedice_read_reg(vector_catch);
2847 buf_set_u32(vector_catch->value, 2, 1, enable);
2848 embeddedice_store_reg(vector_catch);
2849 } else {
2850 /* TODO: allow optional high vectors and/or BKPT_HARD */
2851 if (enable)
2852 breakpoint_add(target, 8, 4, BKPT_SOFT);
2853 else
2854 breakpoint_remove(target, 8);
2855 }
2856
2857 return ERROR_OK;
2858 }
2859
2860 int arm7_9_init_arch_info(struct target *target, struct arm7_9_common *arm7_9)
2861 {
2862 int retval = ERROR_OK;
2863 struct arm *armv4_5 = &arm7_9->armv4_5_common;
2864
2865 arm7_9->common_magic = ARM7_9_COMMON_MAGIC;
2866
2867 if ((retval = arm_jtag_setup_connection(&arm7_9->jtag_info)) != ERROR_OK)
2868 return retval;
2869
2870 /* caller must have allocated via calloc(), so everything's zeroed */
2871
2872 arm7_9->wp_available_max = 2;
2873
2874 arm7_9->fast_memory_access = false;
2875 arm7_9->dcc_downloads = false;
2876
2877 armv4_5->arch_info = arm7_9;
2878 armv4_5->read_core_reg = arm7_9_read_core_reg;
2879 armv4_5->write_core_reg = arm7_9_write_core_reg;
2880 armv4_5->full_context = arm7_9_full_context;
2881 armv4_5->setup_semihosting = arm7_9_setup_semihosting;
2882
2883 retval = arm_init_arch_info(target, armv4_5);
2884 if (retval != ERROR_OK)
2885 return retval;
2886
2887 return target_register_timer_callback(arm7_9_handle_target_request,
2888 1, 1, target);
2889 }
2890
2891 static const struct command_registration arm7_9_any_command_handlers[] = {
2892 {
2893 "dbgrq",
2894 .handler = handle_arm7_9_dbgrq_command,
2895 .mode = COMMAND_ANY,
2896 .usage = "['enable'|'disable']",
2897 .help = "use EmbeddedICE dbgrq instead of breakpoint "
2898 "for target halt requests",
2899 },
2900 {
2901 "fast_memory_access",
2902 .handler = handle_arm7_9_fast_memory_access_command,
2903 .mode = COMMAND_ANY,
2904 .usage = "['enable'|'disable']",
2905 .help = "use fast memory accesses instead of slower "
2906 "but potentially safer accesses",
2907 },
2908 {
2909 "dcc_downloads",
2910 .handler = handle_arm7_9_dcc_downloads_command,
2911 .mode = COMMAND_ANY,
2912 .usage = "['enable'|'disable']",
2913 .help = "use DCC downloads for larger memory writes",
2914 },
2915 COMMAND_REGISTRATION_DONE
2916 };
2917 const struct command_registration arm7_9_command_handlers[] = {
2918 {
2919 .chain = arm_command_handlers,
2920 },
2921 {
2922 .chain = etm_command_handlers,
2923 },
2924 {
2925 .name = "arm7_9",
2926 .mode = COMMAND_ANY,
2927 .help = "arm7/9 specific commands",
2928 .chain = arm7_9_any_command_handlers,
2929 },
2930 COMMAND_REGISTRATION_DONE
2931 };
Marex's Cortex A8 development branch