1 /***************************************************************************
2 * Copyright (C) 2005 by Dominic Rath *
3 * Dominic.Rath@gmx.de *
5 * Copyright (C) 2007,2008,2009 Øyvind Harboe *
6 * oyvind.harboe@zylin.com *
8 * Copyright (C) 2008 by Spencer Oliver *
9 * spen@spen-soft.co.uk *
11 * This program is free software; you can redistribute it and/or modify *
12 * it under the terms of the GNU General Public License as published by *
13 * the Free Software Foundation; either version 2 of the License, or *
14 * (at your option) any later version. *
16 * This program is distributed in the hope that it will be useful, *
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
19 * GNU General Public License for more details. *
21 * You should have received a copy of the GNU General Public License *
22 * along with this program; if not, write to the *
23 * Free Software Foundation, Inc., *
24 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
25 ***************************************************************************/
30 #include "embeddedice.h"
32 #define ARRAY_SIZE(x) ((int)(sizeof(x)/sizeof((x)[0])))
37 * This provides lowlevel glue to the EmbeddedICE (or EmbeddedICE-RT)
38 * module found on scan chain 2 in ARM7, ARM9, and some other families
41 * EmbeddedICE provides basic watchpoint/breakpoint hardware and a Debug
42 * Communications Channel (DCC) used to read or write 32-bit words to
43 * OpenOCD-aware code running on the target CPU.
44 * Newer modules also include vector catch hardware. Some versions
45 * support hardware single-stepping, "monitor mode" debug (which is not
46 * currently supported by OpenOCD), or extended reporting on why the
47 * core entered debug mode.
51 * From: ARM9E-S TRM, DDI 0165, table C-4 (and similar, for other cores)
61 /* width is assigned based on EICE version */
64 .name
= "debug_status",
66 /* width is assigned based on EICE version */
78 [EICE_W0_ADDR_VALUE
] = {
79 .name
= "watch_0_addr_value",
83 [EICE_W0_ADDR_MASK
] = {
84 .name
= "watch_0_addr_mask",
88 [EICE_W0_DATA_VALUE
] = {
89 .name
= "watch_0_data_value",
93 [EICE_W0_DATA_MASK
] = {
94 .name
= "watch_0_data_mask",
98 [EICE_W0_CONTROL_VALUE
] = {
99 .name
= "watch_0_control_value",
103 [EICE_W0_CONTROL_MASK
] = {
104 .name
= "watch_0_control_mask",
108 [EICE_W1_ADDR_VALUE
] = {
109 .name
= "watch_1_addr_value",
113 [EICE_W1_ADDR_MASK
] = {
114 .name
= "watch_1_addr_mask",
118 [EICE_W1_DATA_VALUE
] = {
119 .name
= "watch_1_data_value",
123 [EICE_W1_DATA_MASK
] = {
124 .name
= "watch_1_data_mask",
128 [EICE_W1_CONTROL_VALUE
] = {
129 .name
= "watch_1_control_value",
133 [EICE_W1_CONTROL_MASK
] = {
134 .name
= "watch_1_control_mask",
138 /* vector_catch isn't always present */
140 .name
= "vector_catch",
147 static int embeddedice_reg_arch_type
= -1;
149 static int embeddedice_get_reg(struct reg
*reg
)
153 if ((retval
= embeddedice_read_reg(reg
)) != ERROR_OK
)
154 LOG_ERROR("error queueing EmbeddedICE register read");
155 else if ((retval
= jtag_execute_queue()) != ERROR_OK
)
156 LOG_ERROR("EmbeddedICE register read failed");
162 * Probe EmbeddedICE module and set up local records of its registers.
163 * Different versions of the modules have different capabilities, such as
164 * hardware support for vector_catch, single stepping, and monitor mode.
167 embeddedice_build_reg_cache(struct target
*target
, struct arm7_9_common
*arm7_9
)
170 struct reg_cache
*reg_cache
= malloc(sizeof(struct reg_cache
));
171 struct reg
*reg_list
= NULL
;
172 struct embeddedice_reg
*arch_info
= NULL
;
173 struct arm_jtag
*jtag_info
= &arm7_9
->jtag_info
;
174 int num_regs
= ARRAY_SIZE(eice_regs
);
176 int eice_version
= 0;
178 /* register arch-type for EmbeddedICE registers only once */
179 if (embeddedice_reg_arch_type
== -1)
180 embeddedice_reg_arch_type
= register_reg_arch_type(
181 embeddedice_get_reg
, embeddedice_set_reg_w_exec
);
183 /* vector_catch isn't always present */
184 if (!arm7_9
->has_vector_catch
)
187 /* the actual registers are kept in two arrays */
188 reg_list
= calloc(num_regs
, sizeof(struct reg
));
189 arch_info
= calloc(num_regs
, sizeof(struct embeddedice_reg
));
191 /* fill in values for the reg cache */
192 reg_cache
->name
= "EmbeddedICE registers";
193 reg_cache
->next
= NULL
;
194 reg_cache
->reg_list
= reg_list
;
195 reg_cache
->num_regs
= num_regs
;
197 /* set up registers */
198 for (i
= 0; i
< num_regs
; i
++)
200 reg_list
[i
].name
= eice_regs
[i
].name
;
201 reg_list
[i
].size
= eice_regs
[i
].width
;
202 reg_list
[i
].dirty
= 0;
203 reg_list
[i
].valid
= 0;
204 reg_list
[i
].value
= calloc(1, 4);
205 reg_list
[i
].arch_info
= &arch_info
[i
];
206 reg_list
[i
].arch_type
= embeddedice_reg_arch_type
;
207 arch_info
[i
].addr
= eice_regs
[i
].addr
;
208 arch_info
[i
].jtag_info
= jtag_info
;
211 /* identify EmbeddedICE version by reading DCC control register */
212 embeddedice_read_reg(®_list
[EICE_COMMS_CTRL
]);
213 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
215 for (i
= 0; i
< num_regs
; i
++)
217 free(reg_list
[i
].value
);
225 eice_version
= buf_get_u32(reg_list
[EICE_COMMS_CTRL
].value
, 28, 4);
226 LOG_INFO("Embedded ICE version %d", eice_version
);
228 switch (eice_version
)
231 /* ARM7TDMI r3, ARM7TDMI-S r3
233 * REVISIT docs say ARM7TDMI-S r4 uses version 1 but
234 * that it has 6-bit CTRL and 5-bit STAT... doc bug?
235 * ARM7TDMI r4 docs say EICE v4.
237 reg_list
[EICE_DBG_CTRL
].size
= 3;
238 reg_list
[EICE_DBG_STAT
].size
= 5;
242 reg_list
[EICE_DBG_CTRL
].size
= 4;
243 reg_list
[EICE_DBG_STAT
].size
= 5;
244 arm7_9
->has_single_step
= 1;
247 LOG_ERROR("EmbeddedICE v%d handling might be broken",
249 reg_list
[EICE_DBG_CTRL
].size
= 6;
250 reg_list
[EICE_DBG_STAT
].size
= 5;
251 arm7_9
->has_single_step
= 1;
252 arm7_9
->has_monitor_mode
= 1;
256 reg_list
[EICE_DBG_CTRL
].size
= 6;
257 reg_list
[EICE_DBG_STAT
].size
= 5;
258 arm7_9
->has_monitor_mode
= 1;
262 reg_list
[EICE_DBG_CTRL
].size
= 6;
263 reg_list
[EICE_DBG_STAT
].size
= 5;
264 arm7_9
->has_single_step
= 1;
265 arm7_9
->has_monitor_mode
= 1;
268 /* ARM7EJ-S, ARM9E-S rev 2, ARM9EJ-S */
269 reg_list
[EICE_DBG_CTRL
].size
= 6;
270 reg_list
[EICE_DBG_STAT
].size
= 10;
271 /* DBG_STAT has MOE bits */
272 arm7_9
->has_monitor_mode
= 1;
275 LOG_ERROR("EmbeddedICE v%d handling might be broken",
277 reg_list
[EICE_DBG_CTRL
].size
= 6;
278 reg_list
[EICE_DBG_STAT
].size
= 5;
279 arm7_9
->has_monitor_mode
= 1;
283 * The Feroceon implementation has the version number
284 * in some unusual bits. Let feroceon.c validate it
285 * and do the appropriate setup itself.
287 if (strcmp(target_get_name(target
), "feroceon") == 0 ||
288 strcmp(target_get_name(target
), "dragonite") == 0)
290 LOG_ERROR("unknown EmbeddedICE version "
291 "(comms ctrl: 0x%8.8" PRIx32
")",
292 buf_get_u32(reg_list
[EICE_COMMS_CTRL
].value
, 0, 32));
299 * Initialize EmbeddedICE module, if needed.
301 int embeddedice_setup(struct target
*target
)
304 struct arm7_9_common
*arm7_9
= target_to_arm7_9(target
);
306 /* Explicitly disable monitor mode. For now we only support halting
307 * debug ... we don't know how to talk with a resident debug monitor
308 * that manages break requests. ARM's "Angel Debug Monitor" is one
309 * common example of such code.
311 if (arm7_9
->has_monitor_mode
)
313 struct reg
*dbg_ctrl
= &arm7_9
->eice_cache
->reg_list
[EICE_DBG_CTRL
];
315 embeddedice_read_reg(dbg_ctrl
);
316 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
318 buf_set_u32(dbg_ctrl
->value
, 4, 1, 0);
319 embeddedice_set_reg_w_exec(dbg_ctrl
, dbg_ctrl
->value
);
321 return jtag_execute_queue();
325 * Queue a read for an EmbeddedICE register into the register cache,
326 * optionally checking the value read.
327 * Note that at this level, all registers are 32 bits wide.
329 int embeddedice_read_reg_w_check(struct reg
*reg
,
330 uint8_t *check_value
, uint8_t *check_mask
)
332 struct embeddedice_reg
*ice_reg
= reg
->arch_info
;
333 uint8_t reg_addr
= ice_reg
->addr
& 0x1f;
334 struct scan_field fields
[3];
335 uint8_t field1_out
[1];
336 uint8_t field2_out
[1];
338 jtag_set_end_state(TAP_IDLE
);
339 arm_jtag_scann(ice_reg
->jtag_info
, 0x2);
341 arm_jtag_set_instr(ice_reg
->jtag_info
, ice_reg
->jtag_info
->intest_instr
, NULL
);
343 /* bits 31:0 -- data (ignored here) */
344 fields
[0].tap
= ice_reg
->jtag_info
->tap
;
345 fields
[0].num_bits
= 32;
346 fields
[0].out_value
= reg
->value
;
347 fields
[0].in_value
= NULL
;
348 fields
[0].check_value
= NULL
;
349 fields
[0].check_mask
= NULL
;
351 /* bits 36:32 -- register */
352 fields
[1].tap
= ice_reg
->jtag_info
->tap
;
353 fields
[1].num_bits
= 5;
354 fields
[1].out_value
= field1_out
;
355 buf_set_u32(fields
[1].out_value
, 0, 5, reg_addr
);
356 fields
[1].in_value
= NULL
;
357 fields
[1].check_value
= NULL
;
358 fields
[1].check_mask
= NULL
;
360 /* bit 37 -- 0/read */
361 fields
[2].tap
= ice_reg
->jtag_info
->tap
;
362 fields
[2].num_bits
= 1;
363 fields
[2].out_value
= field2_out
;
364 buf_set_u32(fields
[2].out_value
, 0, 1, 0);
365 fields
[2].in_value
= NULL
;
366 fields
[2].check_value
= NULL
;
367 fields
[2].check_mask
= NULL
;
369 /* traverse Update-DR, setting address for the next read */
370 jtag_add_dr_scan(3, fields
, jtag_get_end_state());
372 /* bits 31:0 -- the data we're reading (and maybe checking) */
373 fields
[0].in_value
= reg
->value
;
374 fields
[0].check_value
= check_value
;
375 fields
[0].check_mask
= check_mask
;
377 /* when reading the DCC data register, leaving the address field set to
378 * EICE_COMMS_DATA would read the register twice
379 * reading the control register is safe
381 buf_set_u32(fields
[1].out_value
, 0, 5, eice_regs
[EICE_COMMS_CTRL
].addr
);
383 /* traverse Update-DR, reading but with no other side effects */
384 jtag_add_dr_scan_check(3, fields
, jtag_get_end_state());
390 * Receive a block of size 32-bit words from the DCC.
391 * We assume the target is always going to be fast enough (relative to
392 * the JTAG clock) that the debugger won't need to poll the handshake
393 * bit. The JTAG clock is usually at least six times slower than the
394 * functional clock, so the 50+ JTAG clocks needed to receive the word
395 * allow hundreds of instruction cycles (per word) in the target.
397 int embeddedice_receive(struct arm_jtag
*jtag_info
, uint32_t *data
, uint32_t size
)
399 struct scan_field fields
[3];
400 uint8_t field1_out
[1];
401 uint8_t field2_out
[1];
403 jtag_set_end_state(TAP_IDLE
);
404 arm_jtag_scann(jtag_info
, 0x2);
405 arm_jtag_set_instr(jtag_info
, jtag_info
->intest_instr
, NULL
);
407 fields
[0].tap
= jtag_info
->tap
;
408 fields
[0].num_bits
= 32;
409 fields
[0].out_value
= NULL
;
410 fields
[0].in_value
= NULL
;
412 fields
[1].tap
= jtag_info
->tap
;
413 fields
[1].num_bits
= 5;
414 fields
[1].out_value
= field1_out
;
415 buf_set_u32(fields
[1].out_value
, 0, 5, eice_regs
[EICE_COMMS_DATA
].addr
);
416 fields
[1].in_value
= NULL
;
418 fields
[2].tap
= jtag_info
->tap
;
419 fields
[2].num_bits
= 1;
420 fields
[2].out_value
= field2_out
;
421 buf_set_u32(fields
[2].out_value
, 0, 1, 0);
422 fields
[2].in_value
= NULL
;
424 jtag_add_dr_scan(3, fields
, jtag_get_end_state());
428 /* when reading the last item, set the register address to the DCC control reg,
429 * to avoid reading additional data from the DCC data reg
432 buf_set_u32(fields
[1].out_value
, 0, 5,
433 eice_regs
[EICE_COMMS_CTRL
].addr
);
435 fields
[0].in_value
= (uint8_t *)data
;
436 jtag_add_dr_scan(3, fields
, jtag_get_end_state());
437 jtag_add_callback(arm_le_to_h_u32
, (jtag_callback_data_t
)data
);
443 return jtag_execute_queue();
447 * Queue a read for an EmbeddedICE register into the register cache,
448 * not checking the value read.
450 int embeddedice_read_reg(struct reg
*reg
)
452 return embeddedice_read_reg_w_check(reg
, NULL
, NULL
);
456 * Queue a write for an EmbeddedICE register, updating the register cache.
457 * Uses embeddedice_write_reg().
459 void embeddedice_set_reg(struct reg
*reg
, uint32_t value
)
461 embeddedice_write_reg(reg
, value
);
463 buf_set_u32(reg
->value
, 0, reg
->size
, value
);
470 * Write an EmbeddedICE register, updating the register cache.
471 * Uses embeddedice_set_reg(); not queued.
473 int embeddedice_set_reg_w_exec(struct reg
*reg
, uint8_t *buf
)
477 embeddedice_set_reg(reg
, buf_get_u32(buf
, 0, reg
->size
));
478 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
479 LOG_ERROR("register write failed");
484 * Queue a write for an EmbeddedICE register, bypassing the register cache.
486 void embeddedice_write_reg(struct reg
*reg
, uint32_t value
)
488 struct embeddedice_reg
*ice_reg
= reg
->arch_info
;
490 LOG_DEBUG("%i: 0x%8.8" PRIx32
"", ice_reg
->addr
, value
);
492 jtag_set_end_state(TAP_IDLE
);
493 arm_jtag_scann(ice_reg
->jtag_info
, 0x2);
495 arm_jtag_set_instr(ice_reg
->jtag_info
, ice_reg
->jtag_info
->intest_instr
, NULL
);
497 uint8_t reg_addr
= ice_reg
->addr
& 0x1f;
498 embeddedice_write_reg_inner(ice_reg
->jtag_info
->tap
, reg_addr
, value
);
502 * Queue a write for an EmbeddedICE register, using cached value.
503 * Uses embeddedice_write_reg().
505 void embeddedice_store_reg(struct reg
*reg
)
507 embeddedice_write_reg(reg
, buf_get_u32(reg
->value
, 0, reg
->size
));
511 * Send a block of size 32-bit words to the DCC.
512 * We assume the target is always going to be fast enough (relative to
513 * the JTAG clock) that the debugger won't need to poll the handshake
514 * bit. The JTAG clock is usually at least six times slower than the
515 * functional clock, so the 50+ JTAG clocks needed to receive the word
516 * allow hundreds of instruction cycles (per word) in the target.
518 int embeddedice_send(struct arm_jtag
*jtag_info
, uint32_t *data
, uint32_t size
)
520 struct scan_field fields
[3];
521 uint8_t field0_out
[4];
522 uint8_t field1_out
[1];
523 uint8_t field2_out
[1];
525 jtag_set_end_state(TAP_IDLE
);
526 arm_jtag_scann(jtag_info
, 0x2);
527 arm_jtag_set_instr(jtag_info
, jtag_info
->intest_instr
, NULL
);
529 fields
[0].tap
= jtag_info
->tap
;
530 fields
[0].num_bits
= 32;
531 fields
[0].out_value
= field0_out
;
532 fields
[0].in_value
= NULL
;
534 fields
[1].tap
= jtag_info
->tap
;
535 fields
[1].num_bits
= 5;
536 fields
[1].out_value
= field1_out
;
537 buf_set_u32(fields
[1].out_value
, 0, 5, eice_regs
[EICE_COMMS_DATA
].addr
);
538 fields
[1].in_value
= NULL
;
540 fields
[2].tap
= jtag_info
->tap
;
541 fields
[2].num_bits
= 1;
542 fields
[2].out_value
= field2_out
;
543 buf_set_u32(fields
[2].out_value
, 0, 1, 1);
545 fields
[2].in_value
= NULL
;
549 buf_set_u32(fields
[0].out_value
, 0, 32, *data
);
550 jtag_add_dr_scan(3, fields
, jtag_get_end_state());
556 /* call to jtag_execute_queue() intentionally omitted */
561 * Poll DCC control register until read or write handshake completes.
563 int embeddedice_handshake(struct arm_jtag
*jtag_info
, int hsbit
, uint32_t timeout
)
565 struct scan_field fields
[3];
566 uint8_t field0_in
[4];
567 uint8_t field1_out
[1];
568 uint8_t field2_out
[1];
574 if (hsbit
== EICE_COMM_CTRL_WBIT
)
576 else if (hsbit
== EICE_COMM_CTRL_RBIT
)
579 return ERROR_INVALID_ARGUMENTS
;
581 jtag_set_end_state(TAP_IDLE
);
582 arm_jtag_scann(jtag_info
, 0x2);
583 arm_jtag_set_instr(jtag_info
, jtag_info
->intest_instr
, NULL
);
585 fields
[0].tap
= jtag_info
->tap
;
586 fields
[0].num_bits
= 32;
587 fields
[0].out_value
= NULL
;
588 fields
[0].in_value
= field0_in
;
590 fields
[1].tap
= jtag_info
->tap
;
591 fields
[1].num_bits
= 5;
592 fields
[1].out_value
= field1_out
;
593 buf_set_u32(fields
[1].out_value
, 0, 5, eice_regs
[EICE_COMMS_DATA
].addr
);
594 fields
[1].in_value
= NULL
;
596 fields
[2].tap
= jtag_info
->tap
;
597 fields
[2].num_bits
= 1;
598 fields
[2].out_value
= field2_out
;
599 buf_set_u32(fields
[2].out_value
, 0, 1, 0);
600 fields
[2].in_value
= NULL
;
602 jtag_add_dr_scan(3, fields
, jtag_get_end_state());
603 gettimeofday(&lap
, NULL
);
605 jtag_add_dr_scan(3, fields
, jtag_get_end_state());
606 if ((retval
= jtag_execute_queue()) != ERROR_OK
)
609 if (buf_get_u32(field0_in
, hsbit
, 1) == hsact
)
612 gettimeofday(&now
, NULL
);
613 } while ((uint32_t)((now
.tv_sec
- lap
.tv_sec
) * 1000
614 + (now
.tv_usec
- lap
.tv_usec
) / 1000) <= timeout
);
616 return ERROR_TARGET_TIMEOUT
;
619 #ifndef HAVE_JTAG_MINIDRIVER_H
621 * This is an inner loop of the open loop DCC write of data to target
623 void embeddedice_write_dcc(struct jtag_tap
*tap
,
624 int reg_addr
, uint8_t *buffer
, int little
, int count
)
628 for (i
= 0; i
< count
; i
++)
630 embeddedice_write_reg_inner(tap
, reg_addr
,
631 fast_target_buffer_get_u32(buffer
, little
));
636 /* provided by minidriver */