git.gag.com Git - fw/openocd/blob - src/target/arm11.c

   1 /***************************************************************************
   2  *   Copyright (C) 2008 digenius technology GmbH.                          *
   3  *   Michael Bruck                                                         *
   4  *                                                                         *
   5  *   Copyright (C) 2008,2009 Oyvind Harboe oyvind.harboe@zylin.com         *
   6  *                                                                         *
   7  *   Copyright (C) 2008 Georg Acher <acher@in.tum.de>                      *
   8  *                                                                         *
   9  *   This program is free software; you can redistribute it and/or modify  *
  10  *   it under the terms of the GNU General Public License as published by  *
  11  *   the Free Software Foundation; either version 2 of the License, or     *
  12  *   (at your option) any later version.                                   *
  13  *                                                                         *
  14  *   This program is distributed in the hope that it will be useful,       *
  15  *   but WITHOUT ANY WARRANTY; without even the implied warranty of        *
  16  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
  17  *   GNU General Public License for more details.                          *
  18  *                                                                         *
  19  *   You should have received a copy of the GNU General Public License     *
  20  *   along with this program; if not, write to the                         *
  21  *   Free Software Foundation, Inc.,                                       *
  22  *   59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
  23  ***************************************************************************/
  24
  25 #ifdef HAVE_CONFIG_H
  26 #include "config.h"
  27 #endif
  28
  29 #include "etm.h"
  30 #include "breakpoints.h"
  31 #include "arm11_dbgtap.h"
  32 #include "arm_simulator.h"
  33 #include "time_support.h"
  34 #include "target_type.h"
  35 #include "algorithm.h"
  36 #include "register.h"
  37
  38
  39 #if 0
  40 #define _DEBUG_INSTRUCTION_EXECUTION_
  41 #endif
  42
  43 static bool arm11_config_memwrite_burst = true;
  44 static bool arm11_config_memwrite_error_fatal = true;
  45 static uint32_t arm11_vcr = 0;
  46 static bool arm11_config_step_irq_enable = false;
  47 static bool arm11_config_hardware_step = false;
  48
  49 enum arm11_regtype
  50 {
  51         ARM11_REGISTER_CORE,
  52         ARM11_REGISTER_CPSR,
  53
  54         ARM11_REGISTER_FX,
  55         ARM11_REGISTER_FPS,
  56
  57         ARM11_REGISTER_FIQ,
  58         ARM11_REGISTER_SVC,
  59         ARM11_REGISTER_ABT,
  60         ARM11_REGISTER_IRQ,
  61         ARM11_REGISTER_UND,
  62         ARM11_REGISTER_MON,
  63
  64         ARM11_REGISTER_SPSR_FIQ,
  65         ARM11_REGISTER_SPSR_SVC,
  66         ARM11_REGISTER_SPSR_ABT,
  67         ARM11_REGISTER_SPSR_IRQ,
  68         ARM11_REGISTER_SPSR_UND,
  69         ARM11_REGISTER_SPSR_MON,
  70
  71         /* debug regs */
  72         ARM11_REGISTER_DSCR,
  73         ARM11_REGISTER_WDTR,
  74         ARM11_REGISTER_RDTR,
  75 };
  76
  77
  78 struct arm11_reg_defs
  79 {
  80         char *                                  name;
  81         uint32_t                                                num;
  82         int                                             gdb_num;
  83         enum arm11_regtype              type;
  84 };
  85
  86 /* update arm11_regcache_ids when changing this */
  87 static const struct arm11_reg_defs arm11_reg_defs[] =
  88 {
  89         {"r0",  0,      0,      ARM11_REGISTER_CORE},
  90         {"r1",  1,      1,      ARM11_REGISTER_CORE},
  91         {"r2",  2,      2,      ARM11_REGISTER_CORE},
  92         {"r3",  3,      3,      ARM11_REGISTER_CORE},
  93         {"r4",  4,      4,      ARM11_REGISTER_CORE},
  94         {"r5",  5,      5,      ARM11_REGISTER_CORE},
  95         {"r6",  6,      6,      ARM11_REGISTER_CORE},
  96         {"r7",  7,      7,      ARM11_REGISTER_CORE},
  97         {"r8",  8,      8,      ARM11_REGISTER_CORE},
  98         {"r9",  9,      9,      ARM11_REGISTER_CORE},
  99         {"r10", 10,     10,     ARM11_REGISTER_CORE},
 100         {"r11", 11,     11,     ARM11_REGISTER_CORE},
 101         {"r12", 12,     12,     ARM11_REGISTER_CORE},
 102         {"sp",  13,     13,     ARM11_REGISTER_CORE},
 103         {"lr",  14,     14,     ARM11_REGISTER_CORE},
 104         {"pc",  15,     15,     ARM11_REGISTER_CORE},
 105
 106         {"cpsr",        0,      25,     ARM11_REGISTER_CPSR},
 107
 108         /* Debug Registers */
 109         {"dscr",        0,      -1,     ARM11_REGISTER_DSCR},
 110         {"wdtr",        0,      -1,     ARM11_REGISTER_WDTR},
 111         {"rdtr",        0,      -1,     ARM11_REGISTER_RDTR},
 112 };
 113
 114 enum arm11_regcache_ids
 115 {
 116         ARM11_RC_R0,
 117         ARM11_RC_RX                     = ARM11_RC_R0,
 118
 119         ARM11_RC_R1,
 120         ARM11_RC_R2,
 121         ARM11_RC_R3,
 122         ARM11_RC_R4,
 123         ARM11_RC_R5,
 124         ARM11_RC_R6,
 125         ARM11_RC_R7,
 126         ARM11_RC_R8,
 127         ARM11_RC_R9,
 128         ARM11_RC_R10,
 129         ARM11_RC_R11,
 130         ARM11_RC_R12,
 131         ARM11_RC_R13,
 132         ARM11_RC_SP                     = ARM11_RC_R13,
 133         ARM11_RC_R14,
 134         ARM11_RC_LR                     = ARM11_RC_R14,
 135         ARM11_RC_R15,
 136         ARM11_RC_PC                     = ARM11_RC_R15,
 137
 138         ARM11_RC_CPSR,
 139
 140         ARM11_RC_DSCR,
 141         ARM11_RC_WDTR,
 142         ARM11_RC_RDTR,
 143
 144         ARM11_RC_MAX,
 145 };
 146
 147 static int arm11_on_enter_debug_state(struct arm11_common *arm11);
 148 static int arm11_step(struct target *target, int current,
 149                 uint32_t address, int handle_breakpoints);
 150 /* helpers */
 151 static int arm11_build_reg_cache(struct target *target);
 152 static int arm11_set_reg(struct reg *reg, uint8_t *buf);
 153 static int arm11_get_reg(struct reg *reg);
 154
 155
 156 /** Check and if necessary take control of the system
 157  *
 158  * \param arm11         Target state variable.
 159  * \param dscr          If the current DSCR content is
 160  *                                      available a pointer to a word holding the
 161  *                                      DSCR can be passed. Otherwise use NULL.
 162  */
 163 static int arm11_check_init(struct arm11_common *arm11, uint32_t *dscr)
 164 {
 165         uint32_t                        dscr_local_tmp_copy;
 166
 167         if (!dscr)
 168         {
 169                 dscr = &dscr_local_tmp_copy;
 170
 171                 CHECK_RETVAL(arm11_read_DSCR(arm11, dscr));
 172         }
 173
 174         if (!(*dscr & ARM11_DSCR_MODE_SELECT))
 175         {
 176                 LOG_DEBUG("Bringing target into debug mode");
 177
 178                 *dscr |= ARM11_DSCR_MODE_SELECT;                /* Halt debug-mode */
 179                 arm11_write_DSCR(arm11, *dscr);
 180
 181                 /* add further reset initialization here */
 182
 183                 arm11->simulate_reset_on_next_halt = true;
 184
 185                 if (*dscr & ARM11_DSCR_CORE_HALTED)
 186                 {
 187                         /** \todo TODO: this needs further scrutiny because
 188                           * arm11_on_enter_debug_state() never gets properly called.
 189                           * As a result we don't read the actual register states from
 190                           * the target.
 191                           */
 192
 193                         arm11->target->state    = TARGET_HALTED;
 194                         arm11->target->debug_reason     = arm11_get_DSCR_debug_reason(*dscr);
 195                 }
 196                 else
 197                 {
 198                         arm11->target->state    = TARGET_RUNNING;
 199                         arm11->target->debug_reason     = DBG_REASON_NOTHALTED;
 200                 }
 201
 202                 arm11_sc7_clear_vbw(arm11);
 203         }
 204
 205         return ERROR_OK;
 206 }
 207
 208
 209
 210 #define R(x) \
 211         (arm11->reg_values[ARM11_RC_##x])
 212
 213 /** Save processor state.
 214   *
 215   * This is called when the HALT instruction has succeeded
 216   * or on other occasions that stop the processor.
 217   *
 218   */
 219 static int arm11_on_enter_debug_state(struct arm11_common *arm11)
 220 {
 221         int retval;
 222
 223         /* REVISIT entire cache should already be invalid !!! */
 224         register_cache_invalidate(arm11->arm.core_cache);
 225
 226         for (size_t i = 0; i < ARRAY_SIZE(arm11->reg_values); i++)
 227         {
 228                 arm11->reg_list[i].valid        = 1;
 229                 arm11->reg_list[i].dirty        = 0;
 230         }
 231
 232         /* Save DSCR */
 233         CHECK_RETVAL(arm11_read_DSCR(arm11, &R(DSCR)));
 234
 235         /* Save wDTR */
 236
 237         if (R(DSCR) & ARM11_DSCR_WDTR_FULL)
 238         {
 239                 arm11_add_debug_SCAN_N(arm11, 0x05, ARM11_TAP_DEFAULT);
 240
 241                 arm11_add_IR(arm11, ARM11_INTEST, ARM11_TAP_DEFAULT);
 242
 243                 struct scan_field       chain5_fields[3];
 244
 245                 arm11_setup_field(arm11, 32, NULL, &R(WDTR),    chain5_fields + 0);
 246                 arm11_setup_field(arm11,  1, NULL, NULL,                chain5_fields + 1);
 247                 arm11_setup_field(arm11,  1, NULL, NULL,                chain5_fields + 2);
 248
 249                 arm11_add_dr_scan_vc(ARRAY_SIZE(chain5_fields), chain5_fields, TAP_DRPAUSE);
 250         }
 251         else
 252         {
 253                 arm11->reg_list[ARM11_RC_WDTR].valid    = 0;
 254         }
 255
 256
 257         /* DSCR: set ARM11_DSCR_EXECUTE_ARM_INSTRUCTION_ENABLE */
 258         /* ARM1176 spec says this is needed only for wDTR/rDTR's "ITR mode", but not to issue ITRs
 259            ARM1136 seems to require this to issue ITR's as well */
 260
 261         uint32_t new_dscr = R(DSCR) | ARM11_DSCR_EXECUTE_ARM_INSTRUCTION_ENABLE;
 262
 263         /* this executes JTAG queue: */
 264
 265         arm11_write_DSCR(arm11, new_dscr);
 266
 267
 268         /* From the spec:
 269            Before executing any instruction in debug state you have to drain the write buffer.
 270            This ensures that no imprecise Data Aborts can return at a later point:*/
 271
 272         /** \todo TODO: Test drain write buffer. */
 273
 274 #if 0
 275         while (1)
 276         {
 277                 /* MRC p14,0,R0,c5,c10,0 */
 278                 //      arm11_run_instr_no_data1(arm11, /*0xee150e1a*/0xe320f000);
 279
 280                 /* mcr     15, 0, r0, cr7, cr10, {4} */
 281                 arm11_run_instr_no_data1(arm11, 0xee070f9a);
 282
 283                 uint32_t dscr = arm11_read_DSCR(arm11);
 284
 285                 LOG_DEBUG("DRAIN, DSCR %08x", dscr);
 286
 287                 if (dscr & ARM11_DSCR_STICKY_IMPRECISE_DATA_ABORT)
 288                 {
 289                         arm11_run_instr_no_data1(arm11, 0xe320f000);
 290
 291                         dscr = arm11_read_DSCR(arm11);
 292
 293                         LOG_DEBUG("DRAIN, DSCR %08x (DONE)", dscr);
 294
 295                         break;
 296                 }
 297         }
 298 #endif
 299
 300         retval = arm_dpm_read_current_registers(&arm11->dpm);
 301         if (retval != ERROR_OK)
 302                 LOG_ERROR("DPM REG READ -- fail %d", retval);
 303
 304         retval = arm11_run_instr_data_prepare(arm11);
 305         if (retval != ERROR_OK)
 306                 return retval;
 307
 308         /* save r0 - r14 */
 309
 310         /** \todo TODO: handle other mode registers */
 311
 312         for (size_t i = 0; i < 15; i++)
 313         {
 314                 /* MCR p14,0,R?,c0,c5,0 */
 315                 retval = arm11_run_instr_data_from_core(arm11, 0xEE000E15 | (i << 12), &R(RX + i), 1);
 316                 if (retval != ERROR_OK)
 317                         return retval;
 318         }
 319
 320         /* save rDTR */
 321
 322         /* check rDTRfull in DSCR */
 323
 324         if (R(DSCR) & ARM11_DSCR_RDTR_FULL)
 325         {
 326                 /* MRC p14,0,R0,c0,c5,0 (move rDTR -> r0 (-> wDTR -> local var)) */
 327                 retval = arm11_run_instr_data_from_core_via_r0(arm11, 0xEE100E15, &R(RDTR));
 328                 if (retval != ERROR_OK)
 329                         return retval;
 330         }
 331         else
 332         {
 333                 arm11->reg_list[ARM11_RC_RDTR].valid    = 0;
 334         }
 335
 336         /* save CPSR */
 337
 338         /* MRS r0,CPSR (move CPSR -> r0 (-> wDTR -> local var)) */
 339         retval = arm11_run_instr_data_from_core_via_r0(arm11, 0xE10F0000, &R(CPSR));
 340         if (retval != ERROR_OK)
 341                 return retval;
 342
 343         /* save PC */
 344
 345         /* MOV R0,PC (move PC -> r0 (-> wDTR -> local var)) */
 346         retval = arm11_run_instr_data_from_core_via_r0(arm11, 0xE1A0000F, &R(PC));
 347         if (retval != ERROR_OK)
 348                 return retval;
 349
 350         /* adjust PC depending on ARM state */
 351
 352         if (R(CPSR) & ARM11_CPSR_J)     /* Java state */
 353         {
 354                 arm11->reg_values[ARM11_RC_PC] -= 0;
 355         }
 356         else if (R(CPSR) & ARM11_CPSR_T)        /* Thumb state */
 357         {
 358                 arm11->reg_values[ARM11_RC_PC] -= 4;
 359         }
 360         else                                    /* ARM state */
 361         {
 362                 arm11->reg_values[ARM11_RC_PC] -= 8;
 363         }
 364
 365         if (arm11->simulate_reset_on_next_halt)
 366         {
 367                 arm11->simulate_reset_on_next_halt = false;
 368
 369                 LOG_DEBUG("Reset c1 Control Register");
 370
 371                 /* Write 0 (reset value) to Control register 0 to disable MMU/Cache etc. */
 372
 373                 /* MCR p15,0,R0,c1,c0,0 */
 374                 retval = arm11_run_instr_data_to_core_via_r0(arm11, 0xee010f10, 0);
 375                 if (retval != ERROR_OK)
 376                         return retval;
 377
 378         }
 379
 380         retval = arm11_run_instr_data_finish(arm11);
 381         if (retval != ERROR_OK)
 382                 return retval;
 383
 384         return ERROR_OK;
 385 }
 386
 387 /** Restore processor state
 388   *
 389   * This is called in preparation for the RESTART function.
 390   *
 391   */
 392 static int arm11_leave_debug_state(struct arm11_common *arm11)
 393 {
 394         int retval;
 395
 396         retval = arm11_run_instr_data_prepare(arm11);
 397         if (retval != ERROR_OK)
 398                 return retval;
 399
 400         /** \todo TODO: handle other mode registers */
 401
 402         /* restore R1 - R14 */
 403
 404         for (unsigned i = 1; i < 15; i++)
 405         {
 406                 if (!arm11->reg_list[ARM11_RC_RX + i].dirty)
 407                         continue;
 408
 409                 /* MRC p14,0,r?,c0,c5,0 */
 410                 arm11_run_instr_data_to_core1(arm11,
 411                                 0xee100e15 | (i << 12), R(RX + i));
 412
 413                 //      LOG_DEBUG("RESTORE R%u %08x", i, R(RX + i));
 414         }
 415
 416         retval = arm11_run_instr_data_finish(arm11);
 417         if (retval != ERROR_OK)
 418                 return retval;
 419
 420         /* spec says clear wDTR and rDTR; we assume they are clear as
 421            otherwise our programming would be sloppy */
 422         {
 423                 uint32_t DSCR;
 424
 425                 CHECK_RETVAL(arm11_read_DSCR(arm11, &DSCR));
 426
 427                 if (DSCR & (ARM11_DSCR_RDTR_FULL | ARM11_DSCR_WDTR_FULL))
 428                 {
 429                         /*
 430                         The wDTR/rDTR two registers that are used to send/receive data to/from
 431                         the core in tandem with corresponding instruction codes that are
 432                         written into the core. The RDTR FULL/WDTR FULL flag indicates that the
 433                         registers hold data that was written by one side (CPU or JTAG) and not
 434                         read out by the other side.
 435                         */
 436                         LOG_ERROR("wDTR/rDTR inconsistent (DSCR %08" PRIx32 ")", DSCR);
 437                         return ERROR_FAIL;
 438                 }
 439         }
 440
 441 /* DEBUG for now, trust "new" code only for shadowed registers */
 442 retval = arm_dpm_write_dirty_registers(&arm11->dpm);
 443
 444         retval = arm11_run_instr_data_prepare(arm11);
 445         if (retval != ERROR_OK)
 446                 return retval;
 447
 448         /* restore original wDTR */
 449
 450         if ((R(DSCR) & ARM11_DSCR_WDTR_FULL) || arm11->reg_list[ARM11_RC_WDTR].dirty)
 451         {
 452                 /* MCR p14,0,R0,c0,c5,0 */
 453                 retval = arm11_run_instr_data_to_core_via_r0(arm11, 0xee000e15, R(WDTR));
 454                 if (retval != ERROR_OK)
 455                         return retval;
 456         }
 457
 458         /* restore CPSR */
 459
 460         /* MSR CPSR,R0*/
 461         retval = arm11_run_instr_data_to_core_via_r0(arm11, 0xe129f000, R(CPSR));
 462         if (retval != ERROR_OK)
 463                 return retval;
 464
 465
 466         /* restore PC */
 467
 468         /* MOV PC,R0 */
 469         retval = arm11_run_instr_data_to_core_via_r0(arm11, 0xe1a0f000, R(PC));
 470         if (retval != ERROR_OK)
 471                 return retval;
 472
 473
 474         /* restore R0 */
 475
 476         /* MRC p14,0,r0,c0,c5,0 */
 477         arm11_run_instr_data_to_core1(arm11, 0xee100e15, R(R0));
 478
 479         retval = arm11_run_instr_data_finish(arm11);
 480         if (retval != ERROR_OK)
 481                 return retval;
 482
 483 /* DEBUG use this when "new" code is really managing core registers */
 484 // retval = arm_dpm_write_dirty_registers(&arm11->dpm);
 485
 486         register_cache_invalidate(arm11->arm.core_cache);
 487
 488         /* restore DSCR */
 489
 490         arm11_write_DSCR(arm11, R(DSCR));
 491
 492         /* restore rDTR */
 493
 494         if (R(DSCR) & ARM11_DSCR_RDTR_FULL || arm11->reg_list[ARM11_RC_RDTR].dirty)
 495         {
 496                 arm11_add_debug_SCAN_N(arm11, 0x05, ARM11_TAP_DEFAULT);
 497
 498                 arm11_add_IR(arm11, ARM11_EXTEST, ARM11_TAP_DEFAULT);
 499
 500                 struct scan_field       chain5_fields[3];
 501
 502                 uint8_t                 Ready           = 0;    /* ignored */
 503                 uint8_t                 Valid           = 0;    /* ignored */
 504
 505                 arm11_setup_field(arm11, 32, &R(RDTR),  NULL, chain5_fields + 0);
 506                 arm11_setup_field(arm11,  1, &Ready,    NULL, chain5_fields + 1);
 507                 arm11_setup_field(arm11,  1, &Valid,    NULL, chain5_fields + 2);
 508
 509                 arm11_add_dr_scan_vc(ARRAY_SIZE(chain5_fields), chain5_fields, TAP_DRPAUSE);
 510         }
 511
 512         return ERROR_OK;
 513 }
 514
 515 /* poll current target status */
 516 static int arm11_poll(struct target *target)
 517 {
 518         int retval;
 519         struct arm11_common *arm11 = target_to_arm11(target);
 520         uint32_t        dscr;
 521
 522         CHECK_RETVAL(arm11_read_DSCR(arm11, &dscr));
 523
 524         LOG_DEBUG("DSCR %08" PRIx32 "", dscr);
 525
 526         CHECK_RETVAL(arm11_check_init(arm11, &dscr));
 527
 528         if (dscr & ARM11_DSCR_CORE_HALTED)
 529         {
 530                 if (target->state != TARGET_HALTED)
 531                 {
 532                         enum target_state old_state = target->state;
 533
 534                         LOG_DEBUG("enter TARGET_HALTED");
 535                         target->state                   = TARGET_HALTED;
 536                         target->debug_reason    = arm11_get_DSCR_debug_reason(dscr);
 537                         retval = arm11_on_enter_debug_state(arm11);
 538                         if (retval != ERROR_OK)
 539                                 return retval;
 540
 541                         target_call_event_callbacks(target,
 542                                 old_state == TARGET_DEBUG_RUNNING ? TARGET_EVENT_DEBUG_HALTED : TARGET_EVENT_HALTED);
 543                 }
 544         }
 545         else
 546         {
 547                 if (target->state != TARGET_RUNNING && target->state != TARGET_DEBUG_RUNNING)
 548                 {
 549                         LOG_DEBUG("enter TARGET_RUNNING");
 550                         target->state                   = TARGET_RUNNING;
 551                         target->debug_reason    = DBG_REASON_NOTHALTED;
 552                 }
 553         }
 554
 555         return ERROR_OK;
 556 }
 557 /* architecture specific status reply */
 558 static int arm11_arch_state(struct target *target)
 559 {
 560         int retval;
 561
 562         retval = armv4_5_arch_state(target);
 563
 564         /* REVISIT also display ARM11-specific MMU and cache status ... */
 565
 566         return retval;
 567 }
 568
 569 /* target request support */
 570 static int arm11_target_request_data(struct target *target,
 571                 uint32_t size, uint8_t *buffer)
 572 {
 573         LOG_WARNING("Not implemented: %s", __func__);
 574
 575         return ERROR_FAIL;
 576 }
 577
 578 /* target execution control */
 579 static int arm11_halt(struct target *target)
 580 {
 581         struct arm11_common *arm11 = target_to_arm11(target);
 582
 583         LOG_DEBUG("target->state: %s",
 584                 target_state_name(target));
 585
 586         if (target->state == TARGET_UNKNOWN)
 587         {
 588                 arm11->simulate_reset_on_next_halt = true;
 589         }
 590
 591         if (target->state == TARGET_HALTED)
 592         {
 593                 LOG_DEBUG("target was already halted");
 594                 return ERROR_OK;
 595         }
 596
 597         arm11_add_IR(arm11, ARM11_HALT, TAP_IDLE);
 598
 599         CHECK_RETVAL(jtag_execute_queue());
 600
 601         uint32_t dscr;
 602
 603         int i = 0;
 604         while (1)
 605         {
 606                 CHECK_RETVAL(arm11_read_DSCR(arm11, &dscr));
 607
 608                 if (dscr & ARM11_DSCR_CORE_HALTED)
 609                         break;
 610
 611
 612                 long long then = 0;
 613                 if (i == 1000)
 614                 {
 615                         then = timeval_ms();
 616                 }
 617                 if (i >= 1000)
 618                 {
 619                         if ((timeval_ms()-then) > 1000)
 620                         {
 621                                 LOG_WARNING("Timeout (1000ms) waiting for instructions to complete");
 622                                 return ERROR_FAIL;
 623                         }
 624                 }
 625                 i++;
 626         }
 627
 628         arm11_on_enter_debug_state(arm11);
 629
 630         enum target_state old_state     = target->state;
 631
 632         target->state           = TARGET_HALTED;
 633         target->debug_reason    = arm11_get_DSCR_debug_reason(dscr);
 634
 635         CHECK_RETVAL(
 636                 target_call_event_callbacks(target,
 637                         old_state == TARGET_DEBUG_RUNNING ? TARGET_EVENT_DEBUG_HALTED : TARGET_EVENT_HALTED));
 638
 639         return ERROR_OK;
 640 }
 641
 642 static int arm11_resume(struct target *target, int current,
 643                 uint32_t address, int handle_breakpoints, int debug_execution)
 644 {
 645         //        LOG_DEBUG("current %d  address %08x  handle_breakpoints %d  debug_execution %d",
 646         //      current, address, handle_breakpoints, debug_execution);
 647
 648         struct arm11_common *arm11 = target_to_arm11(target);
 649
 650         LOG_DEBUG("target->state: %s",
 651                 target_state_name(target));
 652
 653
 654         if (target->state != TARGET_HALTED)
 655         {
 656                 LOG_ERROR("Target not halted");
 657                 return ERROR_TARGET_NOT_HALTED;
 658         }
 659
 660         if (!current)
 661                 R(PC) = address;
 662
 663         LOG_DEBUG("RESUME PC %08" PRIx32 "%s", R(PC), !current ? "!" : "");
 664
 665         /* clear breakpoints/watchpoints and VCR*/
 666         arm11_sc7_clear_vbw(arm11);
 667
 668         if (!debug_execution)
 669                 target_free_all_working_areas(target);
 670
 671         /* Set up breakpoints */
 672         if (handle_breakpoints)
 673         {
 674                 /* check if one matches PC and step over it if necessary */
 675
 676                 struct breakpoint *     bp;
 677
 678                 for (bp = target->breakpoints; bp; bp = bp->next)
 679                 {
 680                         if (bp->address == R(PC))
 681                         {
 682                                 LOG_DEBUG("must step over %08" PRIx32 "", bp->address);
 683                                 arm11_step(target, 1, 0, 0);
 684                                 break;
 685                         }
 686                 }
 687
 688                 /* set all breakpoints */
 689
 690                 unsigned brp_num = 0;
 691
 692                 for (bp = target->breakpoints; bp; bp = bp->next)
 693                 {
 694                         struct arm11_sc7_action brp[2];
 695
 696                         brp[0].write    = 1;
 697                         brp[0].address  = ARM11_SC7_BVR0 + brp_num;
 698                         brp[0].value    = bp->address;
 699                         brp[1].write    = 1;
 700                         brp[1].address  = ARM11_SC7_BCR0 + brp_num;
 701                         brp[1].value    = 0x1 | (3 << 1) | (0x0F << 5) | (0 << 14) | (0 << 16) | (0 << 20) | (0 << 21);
 702
 703                         arm11_sc7_run(arm11, brp, ARRAY_SIZE(brp));
 704
 705                         LOG_DEBUG("Add BP %d at %08" PRIx32, brp_num,
 706                                         bp->address);
 707
 708                         brp_num++;
 709                 }
 710
 711                 arm11_sc7_set_vcr(arm11, arm11_vcr);
 712         }
 713
 714         arm11_leave_debug_state(arm11);
 715
 716         arm11_add_IR(arm11, ARM11_RESTART, TAP_IDLE);
 717
 718         CHECK_RETVAL(jtag_execute_queue());
 719
 720         int i = 0;
 721         while (1)
 722         {
 723                 uint32_t dscr;
 724
 725                 CHECK_RETVAL(arm11_read_DSCR(arm11, &dscr));
 726
 727                 LOG_DEBUG("DSCR %08" PRIx32 "", dscr);
 728
 729                 if (dscr & ARM11_DSCR_CORE_RESTARTED)
 730                         break;
 731
 732
 733                 long long then = 0;
 734                 if (i == 1000)
 735                 {
 736                         then = timeval_ms();
 737                 }
 738                 if (i >= 1000)
 739                 {
 740                         if ((timeval_ms()-then) > 1000)
 741                         {
 742                                 LOG_WARNING("Timeout (1000ms) waiting for instructions to complete");
 743                                 return ERROR_FAIL;
 744                         }
 745                 }
 746                 i++;
 747         }
 748
 749         if (!debug_execution)
 750         {
 751                 target->state                   = TARGET_RUNNING;
 752                 target->debug_reason    = DBG_REASON_NOTHALTED;
 753
 754                 CHECK_RETVAL(target_call_event_callbacks(target, TARGET_EVENT_RESUMED));
 755         }
 756         else
 757         {
 758                 target->state                   = TARGET_DEBUG_RUNNING;
 759                 target->debug_reason    = DBG_REASON_NOTHALTED;
 760
 761                 CHECK_RETVAL(target_call_event_callbacks(target, TARGET_EVENT_RESUMED));
 762         }
 763
 764         return ERROR_OK;
 765 }
 766
 767 static int arm11_step(struct target *target, int current,
 768                 uint32_t address, int handle_breakpoints)
 769 {
 770         LOG_DEBUG("target->state: %s",
 771                 target_state_name(target));
 772
 773         if (target->state != TARGET_HALTED)
 774         {
 775                 LOG_WARNING("target was not halted");
 776                 return ERROR_TARGET_NOT_HALTED;
 777         }
 778
 779         struct arm11_common *arm11 = target_to_arm11(target);
 780
 781         if (!current)
 782                 R(PC) = address;
 783
 784         LOG_DEBUG("STEP PC %08" PRIx32 "%s", R(PC), !current ? "!" : "");
 785
 786
 787         /** \todo TODO: Thumb not supported here */
 788
 789         uint32_t        next_instruction;
 790
 791         CHECK_RETVAL(arm11_read_memory_word(arm11, R(PC), &next_instruction));
 792
 793         /* skip over BKPT */
 794         if ((next_instruction & 0xFFF00070) == 0xe1200070)
 795         {
 796                 R(PC) += 4;
 797                 arm11->reg_list[ARM11_RC_PC].valid = 1;
 798                 arm11->reg_list[ARM11_RC_PC].dirty = 0;
 799                 LOG_DEBUG("Skipping BKPT");
 800         }
 801         /* skip over Wait for interrupt / Standby */
 802         /* mcr  15, 0, r?, cr7, cr0, {4} */
 803         else if ((next_instruction & 0xFFFF0FFF) == 0xee070f90)
 804         {
 805                 R(PC) += 4;
 806                 arm11->reg_list[ARM11_RC_PC].valid = 1;
 807                 arm11->reg_list[ARM11_RC_PC].dirty = 0;
 808                 LOG_DEBUG("Skipping WFI");
 809         }
 810         /* ignore B to self */
 811         else if ((next_instruction & 0xFEFFFFFF) == 0xeafffffe)
 812         {
 813                 LOG_DEBUG("Not stepping jump to self");
 814         }
 815         else
 816         {
 817                 /** \todo TODO: check if break-/watchpoints make any sense at all in combination
 818                 * with this. */
 819
 820                 /** \todo TODO: check if disabling IRQs might be a good idea here. Alternatively
 821                 * the VCR might be something worth looking into. */
 822
 823
 824                 /* Set up breakpoint for stepping */
 825
 826                 struct arm11_sc7_action brp[2];
 827
 828                 brp[0].write    = 1;
 829                 brp[0].address  = ARM11_SC7_BVR0;
 830                 brp[1].write    = 1;
 831                 brp[1].address  = ARM11_SC7_BCR0;
 832
 833                 if (arm11_config_hardware_step)
 834                 {
 835                         /* Hardware single stepping ("instruction address
 836                          * mismatch") is used if enabled.  It's not quite
 837                          * exactly "run one instruction"; "branch to here"
 838                          * loops won't break, neither will some other cases,
 839                          * but it's probably the best default.
 840                          *
 841                          * Hardware single stepping isn't supported on v6
 842                          * debug modules.  ARM1176 and v7 can support it...
 843                          *
 844                          * FIXME Thumb stepping likely needs to use 0x03
 845                          * or 0xc0 byte masks, not 0x0f.
 846                          */
 847                          brp[0].value   = R(PC);
 848                          brp[1].value   = 0x1 | (3 << 1) | (0x0F << 5)
 849                                         | (0 << 14) | (0 << 16) | (0 << 20)
 850                                         | (2 << 21);
 851                 } else
 852                 {
 853                         /* Sets a breakpoint on the next PC, as calculated
 854                          * by instruction set simulation.
 855                          *
 856                          * REVISIT stepping Thumb on ARM1156 requires Thumb2
 857                          * support from the simulator.
 858                          */
 859                         uint32_t next_pc;
 860                         int retval;
 861
 862                         retval = arm_simulate_step(target, &next_pc);
 863                         if (retval != ERROR_OK)
 864                                 return retval;
 865
 866                         brp[0].value    = next_pc;
 867                         brp[1].value    = 0x1 | (3 << 1) | (0x0F << 5)
 868                                         | (0 << 14) | (0 << 16) | (0 << 20)
 869                                         | (0 << 21);
 870                 }
 871
 872                 CHECK_RETVAL(arm11_sc7_run(arm11, brp, ARRAY_SIZE(brp)));
 873
 874                 /* resume */
 875
 876
 877                 if (arm11_config_step_irq_enable)
 878                         R(DSCR) &= ~ARM11_DSCR_INTERRUPTS_DISABLE;              /* should be redundant */
 879                 else
 880                         R(DSCR) |= ARM11_DSCR_INTERRUPTS_DISABLE;
 881
 882
 883                 CHECK_RETVAL(arm11_leave_debug_state(arm11));
 884
 885                 arm11_add_IR(arm11, ARM11_RESTART, TAP_IDLE);
 886
 887                 CHECK_RETVAL(jtag_execute_queue());
 888
 889                 /* wait for halt */
 890                 int i = 0;
 891                 while (1)
 892                 {
 893                         uint32_t dscr;
 894
 895                         CHECK_RETVAL(arm11_read_DSCR(arm11, &dscr));
 896
 897                         LOG_DEBUG("DSCR %08" PRIx32 "e", dscr);
 898
 899                         if ((dscr & (ARM11_DSCR_CORE_RESTARTED | ARM11_DSCR_CORE_HALTED)) ==
 900                                 (ARM11_DSCR_CORE_RESTARTED | ARM11_DSCR_CORE_HALTED))
 901                                 break;
 902
 903                         long long then = 0;
 904                         if (i == 1000)
 905                         {
 906                                 then = timeval_ms();
 907                         }
 908                         if (i >= 1000)
 909                         {
 910                                 if ((timeval_ms()-then) > 1000)
 911                                 {
 912                                         LOG_WARNING("Timeout (1000ms) waiting for instructions to complete");
 913                                         return ERROR_FAIL;
 914                                 }
 915                         }
 916                         i++;
 917                 }
 918
 919                 /* clear breakpoint */
 920                 arm11_sc7_clear_vbw(arm11);
 921
 922                 /* save state */
 923                 CHECK_RETVAL(arm11_on_enter_debug_state(arm11));
 924
 925             /* restore default state */
 926                 R(DSCR) &= ~ARM11_DSCR_INTERRUPTS_DISABLE;
 927
 928         }
 929
 930         //        target->state         = TARGET_HALTED;
 931         target->debug_reason    = DBG_REASON_SINGLESTEP;
 932
 933         CHECK_RETVAL(target_call_event_callbacks(target, TARGET_EVENT_HALTED));
 934
 935         return ERROR_OK;
 936 }
 937
 938 static int arm11_assert_reset(struct target *target)
 939 {
 940         int retval;
 941         struct arm11_common *arm11 = target_to_arm11(target);
 942
 943         retval = arm11_check_init(arm11, NULL);
 944         if (retval != ERROR_OK)
 945                 return retval;
 946
 947         target->state = TARGET_UNKNOWN;
 948
 949         /* we would very much like to reset into the halted, state,
 950          * but resetting and halting is second best... */
 951         if (target->reset_halt)
 952         {
 953                 CHECK_RETVAL(target_halt(target));
 954         }
 955
 956
 957         /* srst is funny. We can not do *anything* else while it's asserted
 958          * and it has unkonwn side effects. Make sure no other code runs
 959          * meanwhile.
 960          *
 961          * Code below assumes srst:
 962          *
 963          * - Causes power-on-reset (but of what parts of the system?). Bug
 964          * in arm11?
 965          *
 966          * - Messes us TAP state without asserting trst.
 967          *
 968          * - There is another bug in the arm11 core. When you generate an access to
 969          * external logic (for example ddr controller via AHB bus) and that block
 970          * is not configured (perhaps it is still held in reset), that transaction
 971          * will never complete. This will hang arm11 core but it will also hang
 972          * JTAG controller. Nothing, short of srst assertion will bring it out of
 973          * this.
 974          *
 975          * Mysteries:
 976          *
 977          * - What should the PC be after an srst reset when starting in the halted
 978          * state?
 979          */
 980
 981         jtag_add_reset(0, 1);
 982         jtag_add_reset(0, 0);
 983
 984         /* How long do we have to wait? */
 985         jtag_add_sleep(5000);
 986
 987         /* un-mess up TAP state */
 988         jtag_add_tlr();
 989
 990         retval = jtag_execute_queue();
 991         if (retval != ERROR_OK)
 992         {
 993                 return retval;
 994         }
 995
 996         return ERROR_OK;
 997 }
 998
 999 static int arm11_deassert_reset(struct target *target)
1000 {
1001         return ERROR_OK;
1002 }
1003
1004 static int arm11_soft_reset_halt(struct target *target)
1005 {
1006         LOG_WARNING("Not implemented: %s", __func__);
1007
1008         return ERROR_FAIL;
1009 }
1010
1011 /* target memory access
1012  * size: 1 = byte (8bit), 2 = half-word (16bit), 4 = word (32bit)
1013  * count: number of items of <size>
1014  *
1015  * arm11_config_memrw_no_increment - in the future we may want to be able
1016  * to read/write a range of data to a "port". a "port" is an action on
1017  * read memory address for some peripheral.
1018  */
1019 static int arm11_read_memory_inner(struct target *target,
1020                 uint32_t address, uint32_t size, uint32_t count, uint8_t *buffer,
1021                 bool arm11_config_memrw_no_increment)
1022 {
1023         /** \todo TODO: check if buffer cast to uint32_t* and uint16_t* might cause alignment problems */
1024         int retval;
1025
1026         if (target->state != TARGET_HALTED)
1027         {
1028                 LOG_WARNING("target was not halted");
1029                 return ERROR_TARGET_NOT_HALTED;
1030         }
1031
1032         LOG_DEBUG("ADDR %08" PRIx32 "  SIZE %08" PRIx32 "  COUNT %08" PRIx32 "", address, size, count);
1033
1034         struct arm11_common *arm11 = target_to_arm11(target);
1035
1036         retval = arm11_run_instr_data_prepare(arm11);
1037         if (retval != ERROR_OK)
1038                 return retval;
1039
1040         /* MRC p14,0,r0,c0,c5,0 */
1041         retval = arm11_run_instr_data_to_core1(arm11, 0xee100e15, address);
1042         if (retval != ERROR_OK)
1043                 return retval;
1044
1045         switch (size)
1046         {
1047         case 1:
1048                 /** \todo TODO: check if dirty is the right choice to force a rewrite on arm11_resume() */
1049                 arm11->reg_list[ARM11_RC_R1].dirty = 1;
1050
1051                 for (size_t i = 0; i < count; i++)
1052                 {
1053                         /* ldrb    r1, [r0], #1 */
1054                         /* ldrb    r1, [r0] */
1055                         arm11_run_instr_no_data1(arm11,
1056                                         !arm11_config_memrw_no_increment ? 0xe4d01001 : 0xe5d01000);
1057
1058                         uint32_t res;
1059                         /* MCR p14,0,R1,c0,c5,0 */
1060                         arm11_run_instr_data_from_core(arm11, 0xEE001E15, &res, 1);
1061
1062                         *buffer++ = res;
1063                 }
1064
1065                 break;
1066
1067         case 2:
1068                 {
1069                         arm11->reg_list[ARM11_RC_R1].dirty = 1;
1070
1071                         for (size_t i = 0; i < count; i++)
1072                         {
1073                                 /* ldrh    r1, [r0], #2 */
1074                                 arm11_run_instr_no_data1(arm11,
1075                                         !arm11_config_memrw_no_increment ? 0xe0d010b2 : 0xe1d010b0);
1076
1077                                 uint32_t res;
1078
1079                                 /* MCR p14,0,R1,c0,c5,0 */
1080                                 arm11_run_instr_data_from_core(arm11, 0xEE001E15, &res, 1);
1081
1082                                 uint16_t svalue = res;
1083                                 memcpy(buffer + i * sizeof(uint16_t), &svalue, sizeof(uint16_t));
1084                         }
1085
1086                         break;
1087                 }
1088
1089         case 4:
1090                 {
1091                 uint32_t instr = !arm11_config_memrw_no_increment ? 0xecb05e01 : 0xed905e00;
1092                 /** \todo TODO: buffer cast to uint32_t* causes alignment warnings */
1093                 uint32_t *words = (uint32_t *)buffer;
1094
1095                 /* LDC p14,c5,[R0],#4 */
1096                 /* LDC p14,c5,[R0] */
1097                 arm11_run_instr_data_from_core(arm11, instr, words, count);
1098                 break;
1099                 }
1100         }
1101
1102         return arm11_run_instr_data_finish(arm11);
1103 }
1104
1105 static int arm11_read_memory(struct target *target, uint32_t address, uint32_t size, uint32_t count, uint8_t *buffer)
1106 {
1107         return arm11_read_memory_inner(target, address, size, count, buffer, false);
1108 }
1109
1110 /*
1111 * arm11_config_memrw_no_increment - in the future we may want to be able
1112 * to read/write a range of data to a "port". a "port" is an action on
1113 * read memory address for some peripheral.
1114 */
1115 static int arm11_write_memory_inner(struct target *target,
1116                 uint32_t address, uint32_t size, uint32_t count, uint8_t *buffer,
1117                 bool arm11_config_memrw_no_increment)
1118 {
1119         int retval;
1120
1121         if (target->state != TARGET_HALTED)
1122         {
1123                 LOG_WARNING("target was not halted");
1124                 return ERROR_TARGET_NOT_HALTED;
1125         }
1126
1127         LOG_DEBUG("ADDR %08" PRIx32 "  SIZE %08" PRIx32 "  COUNT %08" PRIx32 "", address, size, count);
1128
1129         struct arm11_common *arm11 = target_to_arm11(target);
1130
1131         retval = arm11_run_instr_data_prepare(arm11);
1132         if (retval != ERROR_OK)
1133                 return retval;
1134
1135         /* MRC p14,0,r0,c0,c5,0 */
1136         retval = arm11_run_instr_data_to_core1(arm11, 0xee100e15, address);
1137         if (retval != ERROR_OK)
1138                 return retval;
1139
1140         /* burst writes are not used for single words as those may well be
1141          * reset init script writes.
1142          *
1143          * The other advantage is that as burst writes are default, we'll
1144          * now exercise both burst and non-burst code paths with the
1145          * default settings, increasing code coverage.
1146          */
1147         bool burst = arm11_config_memwrite_burst && (count > 1);
1148
1149         switch (size)
1150         {
1151         case 1:
1152                 {
1153                         arm11->reg_list[ARM11_RC_R1].dirty = 1;
1154
1155                         for (size_t i = 0; i < count; i++)
1156                         {
1157                                 /* MRC p14,0,r1,c0,c5,0 */
1158                                 retval = arm11_run_instr_data_to_core1(arm11, 0xee101e15, *buffer++);
1159                                 if (retval != ERROR_OK)
1160                                         return retval;
1161
1162                                 /* strb    r1, [r0], #1 */
1163                                 /* strb    r1, [r0] */
1164                                 retval = arm11_run_instr_no_data1(arm11,
1165                                         !arm11_config_memrw_no_increment ? 0xe4c01001 : 0xe5c01000);
1166                                 if (retval != ERROR_OK)
1167                                         return retval;
1168                         }
1169
1170                         break;
1171                 }
1172
1173         case 2:
1174                 {
1175                         arm11->reg_list[ARM11_RC_R1].dirty = 1;
1176
1177                         for (size_t i = 0; i < count; i++)
1178                         {
1179                                 uint16_t value;
1180                                 memcpy(&value, buffer + i * sizeof(uint16_t), sizeof(uint16_t));
1181
1182                                 /* MRC p14,0,r1,c0,c5,0 */
1183                                 retval = arm11_run_instr_data_to_core1(arm11, 0xee101e15, value);
1184                                 if (retval != ERROR_OK)
1185                                         return retval;
1186
1187                                 /* strh    r1, [r0], #2 */
1188                                 /* strh    r1, [r0] */
1189                                 retval = arm11_run_instr_no_data1(arm11,
1190                                         !arm11_config_memrw_no_increment ? 0xe0c010b2 : 0xe1c010b0);
1191                                 if (retval != ERROR_OK)
1192                                         return retval;
1193                         }
1194
1195                         break;
1196                 }
1197
1198         case 4: {
1199                 uint32_t instr = !arm11_config_memrw_no_increment ? 0xeca05e01 : 0xed805e00;
1200
1201                 /** \todo TODO: buffer cast to uint32_t* causes alignment warnings */
1202                 uint32_t *words = (uint32_t*)buffer;
1203
1204                 if (!burst)
1205                 {
1206                         /* STC p14,c5,[R0],#4 */
1207                         /* STC p14,c5,[R0]*/
1208                         retval = arm11_run_instr_data_to_core(arm11, instr, words, count);
1209                         if (retval != ERROR_OK)
1210                                 return retval;
1211                 }
1212                 else
1213                 {
1214                         /* STC p14,c5,[R0],#4 */
1215                         /* STC p14,c5,[R0]*/
1216                         retval = arm11_run_instr_data_to_core_noack(arm11, instr, words, count);
1217                         if (retval != ERROR_OK)
1218                                 return retval;
1219                 }
1220
1221                 break;
1222         }
1223         }
1224
1225         /* r0 verification */
1226         if (!arm11_config_memrw_no_increment)
1227         {
1228                 uint32_t r0;
1229
1230                 /* MCR p14,0,R0,c0,c5,0 */
1231                 retval = arm11_run_instr_data_from_core(arm11, 0xEE000E15, &r0, 1);
1232                 if (retval != ERROR_OK)
1233                         return retval;
1234
1235                 if (address + size * count != r0)
1236                 {
1237                         LOG_ERROR("Data transfer failed. Expected end "
1238                                         "address 0x%08x, got 0x%08x",
1239                                         (unsigned) (address + size * count),
1240                                         (unsigned) r0);
1241
1242                         if (burst)
1243                                 LOG_ERROR("use 'arm11 memwrite burst disable' to disable fast burst mode");
1244
1245                         if (arm11_config_memwrite_error_fatal)
1246                                 return ERROR_FAIL;
1247                 }
1248         }
1249
1250         return arm11_run_instr_data_finish(arm11);
1251 }
1252
1253 static int arm11_write_memory(struct target *target,
1254                 uint32_t address, uint32_t size, uint32_t count, uint8_t *buffer)
1255 {
1256         return arm11_write_memory_inner(target, address, size, count, buffer, false);
1257 }
1258
1259 /* write target memory in multiples of 4 byte, optimized for writing large quantities of data */
1260 static int arm11_bulk_write_memory(struct target *target,
1261                 uint32_t address, uint32_t count, uint8_t *buffer)
1262 {
1263         if (target->state != TARGET_HALTED)
1264         {
1265                 LOG_WARNING("target was not halted");
1266                 return ERROR_TARGET_NOT_HALTED;
1267         }
1268
1269         return arm11_write_memory(target, address, 4, count, buffer);
1270 }
1271
1272 /* target break-/watchpoint control
1273 * rw: 0 = write, 1 = read, 2 = access
1274 */
1275 static int arm11_add_breakpoint(struct target *target,
1276                 struct breakpoint *breakpoint)
1277 {
1278         struct arm11_common *arm11 = target_to_arm11(target);
1279
1280 #if 0
1281         if (breakpoint->type == BKPT_SOFT)
1282         {
1283                 LOG_INFO("sw breakpoint requested, but software breakpoints not enabled");
1284                 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
1285         }
1286 #endif
1287
1288         if (!arm11->free_brps)
1289         {
1290                 LOG_DEBUG("no breakpoint unit available for hardware breakpoint");
1291                 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
1292         }
1293
1294         if (breakpoint->length != 4)
1295         {
1296                 LOG_DEBUG("only breakpoints of four bytes length supported");
1297                 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
1298         }
1299
1300         arm11->free_brps--;
1301
1302         return ERROR_OK;
1303 }
1304
1305 static int arm11_remove_breakpoint(struct target *target,
1306                 struct breakpoint *breakpoint)
1307 {
1308         struct arm11_common *arm11 = target_to_arm11(target);
1309
1310         arm11->free_brps++;
1311
1312         return ERROR_OK;
1313 }
1314
1315 static int arm11_add_watchpoint(struct target *target,
1316                 struct watchpoint *watchpoint)
1317 {
1318         LOG_WARNING("Not implemented: %s", __func__);
1319
1320         return ERROR_FAIL;
1321 }
1322
1323 static int arm11_remove_watchpoint(struct target *target,
1324                 struct watchpoint *watchpoint)
1325 {
1326         LOG_WARNING("Not implemented: %s", __func__);
1327
1328         return ERROR_FAIL;
1329 }
1330
1331 static int arm11_target_create(struct target *target, Jim_Interp *interp)
1332 {
1333         struct arm11_common *arm11;
1334
1335         if (target->tap == NULL)
1336                 return ERROR_FAIL;
1337
1338         if (target->tap->ir_length != 5)
1339         {
1340                 LOG_ERROR("'target arm11' expects IR LENGTH = 5");
1341                 return ERROR_COMMAND_SYNTAX_ERROR;
1342         }
1343
1344         arm11 = calloc(1, sizeof *arm11);
1345         if (!arm11)
1346                 return ERROR_FAIL;
1347
1348         armv4_5_init_arch_info(target, &arm11->arm);
1349
1350         arm11->target = target;
1351
1352         arm11->jtag_info.tap = target->tap;
1353         arm11->jtag_info.scann_size = 5;
1354         arm11->jtag_info.scann_instr = ARM11_SCAN_N;
1355         /* cur_scan_chain == 0 */
1356         arm11->jtag_info.intest_instr = ARM11_INTEST;
1357
1358         return ERROR_OK;
1359 }
1360
1361 static int arm11_init_target(struct command_context *cmd_ctx,
1362                 struct target *target)
1363 {
1364         /* Initialize anything we can set up without talking to the target */
1365
1366         /* FIXME Switch to use the standard build_reg_cache() not custom
1367          * code.  Do it from examine(), after we check whether we're
1368          * an arm1176 and thus support the Secure Monitor mode.
1369          */
1370         return arm11_build_reg_cache(target);
1371 }
1372
1373 /* talk to the target and set things up */
1374 static int arm11_examine(struct target *target)
1375 {
1376         int retval;
1377         char *type;
1378         struct arm11_common *arm11 = target_to_arm11(target);
1379         uint32_t didr, device_id;
1380         uint8_t implementor;
1381
1382         /* FIXME split into do-first-time and do-every-time logic ... */
1383
1384         /* check IDCODE */
1385
1386         arm11_add_IR(arm11, ARM11_IDCODE, ARM11_TAP_DEFAULT);
1387
1388         struct scan_field               idcode_field;
1389
1390         arm11_setup_field(arm11, 32, NULL, &device_id, &idcode_field);
1391
1392         arm11_add_dr_scan_vc(1, &idcode_field, TAP_DRPAUSE);
1393
1394         /* check DIDR */
1395
1396         arm11_add_debug_SCAN_N(arm11, 0x00, ARM11_TAP_DEFAULT);
1397
1398         arm11_add_IR(arm11, ARM11_INTEST, ARM11_TAP_DEFAULT);
1399
1400         struct scan_field               chain0_fields[2];
1401
1402         arm11_setup_field(arm11, 32, NULL, &didr, chain0_fields + 0);
1403         arm11_setup_field(arm11,  8, NULL, &implementor, chain0_fields + 1);
1404
1405         arm11_add_dr_scan_vc(ARRAY_SIZE(chain0_fields), chain0_fields, TAP_IDLE);
1406
1407         CHECK_RETVAL(jtag_execute_queue());
1408
1409         switch (device_id & 0x0FFFF000)
1410         {
1411         case 0x07B36000:
1412                 type = "ARM1136";
1413                 break;
1414         case 0x07B56000:
1415                 type = "ARM1156";
1416                 break;
1417         case 0x07B76000:
1418                 arm11->arm.core_type = ARM_MODE_MON;
1419                 type = "ARM1176";
1420                 break;
1421         default:
1422                 LOG_ERROR("'target arm11' expects IDCODE 0x*7B*7****");
1423                 return ERROR_FAIL;
1424         }
1425         LOG_INFO("found %s", type);
1426
1427         /* unlikely this could ever fail, but ... */
1428         switch ((didr >> 16) & 0x0F) {
1429         case ARM11_DEBUG_V6:
1430         case ARM11_DEBUG_V61:           /* supports security extensions */
1431                 break;
1432         default:
1433                 LOG_ERROR("Only ARM v6 and v6.1 debug supported.");
1434                 return ERROR_FAIL;
1435         }
1436
1437         arm11->brp = ((didr >> 24) & 0x0F) + 1;
1438         arm11->wrp = ((didr >> 28) & 0x0F) + 1;
1439
1440         /** \todo TODO: reserve one brp slot if we allow breakpoints during step */
1441         arm11->free_brps = arm11->brp;
1442         arm11->free_wrps = arm11->wrp;
1443
1444         LOG_DEBUG("IDCODE %08" PRIx32 " IMPLEMENTOR %02x DIDR %08" PRIx32,
1445                         device_id, implementor, didr);
1446
1447         /* as a side-effect this reads DSCR and thus
1448          * clears the ARM11_DSCR_STICKY_PRECISE_DATA_ABORT / Sticky Precise Data Abort Flag
1449          * as suggested by the spec.
1450          */
1451
1452         retval = arm11_check_init(arm11, NULL);
1453         if (retval != ERROR_OK)
1454                 return retval;
1455
1456         /* Build register cache "late", after target_init(), since we
1457          * want to know if this core supports Secure Monitor mode.
1458          */
1459         if (!target_was_examined(target)) {
1460                 arm11_dpm_init(arm11, didr);
1461                 retval = arm_dpm_setup(&arm11->dpm);
1462         }
1463
1464         /* ETM on ARM11 still uses original scanchain 6 access mode */
1465         if (arm11->arm.etm && !target_was_examined(target)) {
1466                 *register_get_last_cache_p(&target->reg_cache) =
1467                         etm_build_reg_cache(target, &arm11->jtag_info,
1468                                         arm11->arm.etm);
1469                 retval = etm_setup(target);
1470         }
1471
1472         target_set_examined(target);
1473
1474         return ERROR_OK;
1475 }
1476
1477
1478 /** Load a register that is marked !valid in the register cache */
1479 static int arm11_get_reg(struct reg *reg)
1480 {
1481         struct target * target = ((struct arm11_reg_state *)reg->arch_info)->target;
1482
1483         if (target->state != TARGET_HALTED)
1484         {
1485                 LOG_WARNING("target was not halted");
1486                 return ERROR_TARGET_NOT_HALTED;
1487         }
1488
1489         /** \todo TODO: Check this. We assume that all registers are fetched at debug entry. */
1490
1491 #if 0
1492         struct arm11_common *arm11 = target_to_arm11(target);
1493         const struct arm11_reg_defs *arm11_reg_info = arm11_reg_defs + ((struct arm11_reg_state *)reg->arch_info)->def_index;
1494 #endif
1495
1496         return ERROR_OK;
1497 }
1498
1499 /** Change a value in the register cache */
1500 static int arm11_set_reg(struct reg *reg, uint8_t *buf)
1501 {
1502         struct target *target = ((struct arm11_reg_state *)reg->arch_info)->target;
1503         struct arm11_common *arm11 = target_to_arm11(target);
1504 //      const struct arm11_reg_defs *arm11_reg_info = arm11_reg_defs + ((struct arm11_reg_state *)reg->arch_info)->def_index;
1505
1506         arm11->reg_values[((struct arm11_reg_state *)reg->arch_info)->def_index] = buf_get_u32(buf, 0, 32);
1507         reg->valid      = 1;
1508         reg->dirty      = 1;
1509
1510         return ERROR_OK;
1511 }
1512
1513 static const struct reg_arch_type arm11_reg_type = {
1514         .get = arm11_get_reg,
1515         .set = arm11_set_reg,
1516 };
1517
1518 static int arm11_build_reg_cache(struct target *target)
1519 {
1520         struct arm11_common *arm11 = target_to_arm11(target);
1521         struct reg_cache *cache;
1522         struct reg *reg_list;
1523         struct arm11_reg_state *arm11_reg_states;
1524
1525         cache = calloc(1, sizeof *cache);
1526         reg_list = calloc(ARM11_REGCACHE_COUNT, sizeof *reg_list);
1527         arm11_reg_states = calloc(ARM11_REGCACHE_COUNT,
1528                         sizeof *arm11_reg_states);
1529         if (!cache || !reg_list || !arm11_reg_states) {
1530                 free(cache);
1531                 free(reg_list);
1532                 free(arm11_reg_states);
1533                 return ERROR_FAIL;
1534         }
1535
1536         arm11->reg_list = reg_list;
1537
1538         /* Build the process context cache */
1539         cache->name             = "arm11 registers";
1540         cache->next             = NULL;
1541         cache->reg_list = reg_list;
1542         cache->num_regs = ARM11_REGCACHE_COUNT;
1543
1544         struct reg_cache **cache_p = register_get_last_cache_p(&target->reg_cache);
1545         (*cache_p) = cache;
1546
1547         arm11->core_cache = cache;
1548 //        armv7m->process_context = cache;
1549
1550         size_t i;
1551
1552         /* Not very elegant assertion */
1553         if (ARM11_REGCACHE_COUNT != ARRAY_SIZE(arm11->reg_values) ||
1554                 ARM11_REGCACHE_COUNT != ARRAY_SIZE(arm11_reg_defs) ||
1555                 ARM11_REGCACHE_COUNT != ARM11_RC_MAX)
1556         {
1557                 LOG_ERROR("BUG: arm11->reg_values inconsistent (%d %u %u %d)",
1558                                 ARM11_REGCACHE_COUNT,
1559                                 (unsigned) ARRAY_SIZE(arm11->reg_values),
1560                                 (unsigned) ARRAY_SIZE(arm11_reg_defs),
1561                                 ARM11_RC_MAX);
1562                 /* FIXME minimally, use a build_bug_on(X) mechanism;
1563                  * runtime exit() here is bad!
1564                  */
1565                 exit(-1);
1566         }
1567
1568         for (i = 0; i < ARM11_REGCACHE_COUNT; i++)
1569         {
1570                 struct reg *                                            r       = reg_list                      + i;
1571                 const struct arm11_reg_defs *   rd      = arm11_reg_defs        + i;
1572                 struct arm11_reg_state *                        rs      = arm11_reg_states      + i;
1573
1574                 r->name                         = rd->name;
1575                 r->size                         = 32;
1576                 r->value                        = (uint8_t *)(arm11->reg_values + i);
1577                 r->dirty                        = 0;
1578                 r->valid                        = 0;
1579                 r->type = &arm11_reg_type;
1580                 r->arch_info            = rs;
1581
1582                 rs->def_index           = i;
1583                 rs->target                      = target;
1584         }
1585
1586         return ERROR_OK;
1587 }
1588
1589 /* FIXME all these BOOL_WRAPPER things should be modifying
1590  * per-instance state, not shared state; ditto the vector
1591  * catch register support.  Scan chains with multiple cores
1592  * should be able to say "work with this core like this,
1593  * that core like that".  Example, ARM11 MPCore ...
1594  */
1595
1596 #define ARM11_BOOL_WRAPPER(name, print_name)    \
1597                 COMMAND_HANDLER(arm11_handle_bool_##name) \
1598                 { \
1599                         return CALL_COMMAND_HANDLER(handle_command_parse_bool, \
1600                                         &arm11_config_##name, print_name); \
1601                 }
1602
1603 ARM11_BOOL_WRAPPER(memwrite_burst, "memory write burst mode")
1604 ARM11_BOOL_WRAPPER(memwrite_error_fatal, "fatal error mode for memory writes")
1605 ARM11_BOOL_WRAPPER(step_irq_enable, "IRQs while stepping")
1606 ARM11_BOOL_WRAPPER(hardware_step, "hardware single step")
1607
1608 COMMAND_HANDLER(arm11_handle_vcr)
1609 {
1610         switch (CMD_ARGC) {
1611         case 0:
1612                 break;
1613         case 1:
1614                 COMMAND_PARSE_NUMBER(u32, CMD_ARGV[0], arm11_vcr);
1615                 break;
1616         default:
1617                 return ERROR_COMMAND_SYNTAX_ERROR;
1618         }
1619
1620         LOG_INFO("VCR 0x%08" PRIx32 "", arm11_vcr);
1621         return ERROR_OK;
1622 }
1623
1624 static const uint32_t arm11_coproc_instruction_limits[] =
1625 {
1626         15,                             /* coprocessor */
1627         7,                              /* opcode 1 */
1628         15,                             /* CRn */
1629         15,                             /* CRm */
1630         7,                              /* opcode 2 */
1631         0xFFFFFFFF,             /* value */
1632 };
1633
1634 static int arm11_mrc_inner(struct target *target, int cpnum,
1635                 uint32_t op1, uint32_t op2, uint32_t CRn, uint32_t CRm,
1636                 uint32_t *value, bool read)
1637 {
1638         int retval;
1639         struct arm11_common *arm11 = target_to_arm11(target);
1640
1641         if (target->state != TARGET_HALTED)
1642         {
1643                 LOG_ERROR("Target not halted");
1644                 return ERROR_FAIL;
1645         }
1646
1647         uint32_t instr = 0xEE000010     |
1648                 (cpnum <<  8) |
1649                 (op1 << 21) |
1650                 (CRn << 16) |
1651                 (CRm <<  0) |
1652                 (op2 <<  5);
1653
1654         if (read)
1655                 instr |= 0x00100000;
1656
1657         retval = arm11_run_instr_data_prepare(arm11);
1658         if (retval != ERROR_OK)
1659                 return retval;
1660
1661         if (read)
1662         {
1663                 retval = arm11_run_instr_data_from_core_via_r0(arm11, instr, value);
1664                 if (retval != ERROR_OK)
1665                         return retval;
1666         }
1667         else
1668         {
1669                 retval = arm11_run_instr_data_to_core_via_r0(arm11, instr, *value);
1670                 if (retval != ERROR_OK)
1671                         return retval;
1672         }
1673
1674         return arm11_run_instr_data_finish(arm11);
1675 }
1676
1677 static int arm11_mrc(struct target *target, int cpnum,
1678                 uint32_t op1, uint32_t op2, uint32_t CRn, uint32_t CRm, uint32_t *value)
1679 {
1680         return arm11_mrc_inner(target, cpnum, op1, op2, CRn, CRm, value, true);
1681 }
1682
1683 static int arm11_mcr(struct target *target, int cpnum,
1684                 uint32_t op1, uint32_t op2, uint32_t CRn, uint32_t CRm, uint32_t value)
1685 {
1686         return arm11_mrc_inner(target, cpnum, op1, op2, CRn, CRm, &value, false);
1687 }
1688
1689 static int arm11_register_commands(struct command_context *cmd_ctx)
1690 {
1691         struct command *top_cmd, *mw_cmd;
1692
1693         armv4_5_register_commands(cmd_ctx);
1694
1695         top_cmd = register_command(cmd_ctx, NULL, "arm11",
1696                         NULL, COMMAND_ANY, NULL);
1697
1698         /* "hardware_step" is only here to check if the default
1699          * simulate + breakpoint implementation is broken.
1700          * TEMPORARY! NOT DOCUMENTED!
1701          */
1702         register_command(cmd_ctx, top_cmd, "hardware_step",
1703                         arm11_handle_bool_hardware_step, COMMAND_ANY,
1704                         "DEBUG ONLY - Hardware single stepping"
1705                                 " (default: disabled)");
1706
1707         mw_cmd = register_command(cmd_ctx, top_cmd, "memwrite",
1708                         NULL, COMMAND_ANY, NULL);
1709         register_command(cmd_ctx, mw_cmd, "burst",
1710                         arm11_handle_bool_memwrite_burst, COMMAND_ANY,
1711                         "Enable/Disable non-standard but fast burst mode"
1712                                 " (default: enabled)");
1713         register_command(cmd_ctx, mw_cmd, "error_fatal",
1714                         arm11_handle_bool_memwrite_error_fatal, COMMAND_ANY,
1715                         "Terminate program if transfer error was found"
1716                                 " (default: enabled)");
1717
1718         register_command(cmd_ctx, top_cmd, "step_irq_enable",
1719                         arm11_handle_bool_step_irq_enable, COMMAND_ANY,
1720                         "Enable interrupts while stepping"
1721                                 " (default: disabled)");
1722         register_command(cmd_ctx, top_cmd, "vcr",
1723                         arm11_handle_vcr, COMMAND_ANY,
1724                         "Control (Interrupt) Vector Catch Register");
1725
1726         return etm_register_commands(cmd_ctx);
1727 }
1728
1729 /** Holds methods for ARM11xx targets. */
1730 struct target_type arm11_target = {
1731         .name =                 "arm11",
1732
1733         .poll =                 arm11_poll,
1734         .arch_state =           arm11_arch_state,
1735
1736         .target_request_data =  arm11_target_request_data,
1737
1738         .halt =                 arm11_halt,
1739         .resume =               arm11_resume,
1740         .step =                 arm11_step,
1741
1742         .assert_reset =         arm11_assert_reset,
1743         .deassert_reset =       arm11_deassert_reset,
1744         .soft_reset_halt =      arm11_soft_reset_halt,
1745
1746         .get_gdb_reg_list =     armv4_5_get_gdb_reg_list,
1747
1748         .read_memory =          arm11_read_memory,
1749         .write_memory =         arm11_write_memory,
1750
1751         .bulk_write_memory =    arm11_bulk_write_memory,
1752
1753         .checksum_memory =      arm_checksum_memory,
1754         .blank_check_memory =   arm_blank_check_memory,
1755
1756         .add_breakpoint =       arm11_add_breakpoint,
1757         .remove_breakpoint =    arm11_remove_breakpoint,
1758         .add_watchpoint =       arm11_add_watchpoint,
1759         .remove_watchpoint =    arm11_remove_watchpoint,
1760
1761         .run_algorithm =        armv4_5_run_algorithm,
1762
1763         .register_commands =    arm11_register_commands,
1764         .target_create =        arm11_target_create,
1765         .init_target =          arm11_init_target,
1766         .examine =              arm11_examine,
1767
1768         .mrc =                  arm11_mrc,
1769         .mcr =                  arm11_mcr,
1770 };