1 /***************************************************************************
\r
2 * Copyright (C) 2008 digenius technology GmbH. *
\r
4 * This program is free software; you can redistribute it and/or modify *
\r
5 * it under the terms of the GNU General Public License as published by *
\r
6 * the Free Software Foundation; either version 2 of the License, or *
\r
7 * (at your option) any later version. *
\r
9 * This program is distributed in the hope that it will be useful, *
\r
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
\r
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
\r
12 * GNU General Public License for more details. *
\r
14 * You should have received a copy of the GNU General Public License *
\r
15 * along with this program; if not, write to the *
\r
16 * Free Software Foundation, Inc., *
\r
17 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
\r
18 ***************************************************************************/
\r
20 #ifdef HAVE_CONFIG_H
\r
32 #define JTAG_DEBUG(expr ...) \
\r
34 log_printf (LOG_DEBUG, __FILE__, __LINE__, __FUNCTION__, expr); \
\r
37 #define JTAG_DEBUG(expr ...) \
\r
41 /** Code de-clutter: Construct scan_field_t to write out a value
\r
43 * \param arm11 Target state variable.
\r
44 * \param num_bits Length of the data field
\r
45 * \param out_data pointer to the data that will be sent out
\r
46 * <em>(data is read when it is added to the JTAG queue)</em>
\r
47 * \param in_data pointer to the memory that will receive data that was clocked in
\r
48 * <em>(data is written when the JTAG queue is executed)</em>
\r
49 * \param field target data structure that will be initialized
\r
51 void arm11_setup_field(arm11_common_t * arm11, int num_bits, void * out_data, void * in_data, scan_field_t * field)
\r
53 field->device = arm11->jtag_info.chain_pos;
\r
54 field->num_bits = num_bits;
\r
55 field->out_mask = NULL;
\r
56 field->in_check_mask = NULL;
\r
57 field->in_check_value = NULL;
\r
58 field->in_handler = NULL;
\r
59 field->in_handler_priv = NULL;
\r
61 field->out_value = out_data;
\r
62 field->in_value = in_data;
\r
66 /** Write JTAG instruction register
\r
68 * \param arm11 Target state variable.
\r
69 * \param instr An ARM11 DBGTAP instruction. Use enum #arm11_instructions.
\r
70 * \param state Pass the final TAP state or -1 for the default value (Pause-IR).
\r
72 * \remarks This adds to the JTAG command queue but does \em not execute it.
\r
74 void arm11_add_IR(arm11_common_t * arm11, u8 instr, enum tap_state state)
\r
76 jtag_device_t *device = jtag_get_device(arm11->jtag_info.chain_pos);
\r
78 if (buf_get_u32(device->cur_instr, 0, 5) == instr)
\r
80 JTAG_DEBUG("IR <= 0x%02x SKIPPED", instr);
\r
84 JTAG_DEBUG("IR <= 0x%02x", instr);
\r
88 arm11_setup_field(arm11, 5, &instr, NULL, &field);
\r
90 jtag_add_ir_scan_vc(1, &field, state == -1 ? TAP_PI : state);
\r
93 /** Verify shifted out data from Scan Chain Register (SCREG)
\r
94 * Used as parameter to scan_field_t::in_handler in
\r
95 * arm11_add_debug_SCAN_N().
\r
98 static int arm11_in_handler_SCAN_N(u8 *in_value, void *priv, struct scan_field_s *field)
\r
100 /** \todo TODO: clarify why this isnt properly masked in jtag.c jtag_read_buffer() */
\r
101 u8 v = *in_value & 0x1F;
\r
105 ERROR("'arm11 target' JTAG communication error SCREG SCAN OUT 0x%02x (expected 0x10)", v);
\r
109 JTAG_DEBUG("SCREG SCAN OUT 0x%02x", v);
\r
113 /** Select and write to Scan Chain Register (SCREG)
\r
115 * This function sets the instruction register to SCAN_N and writes
\r
116 * the data register with the selected chain number.
\r
118 * http://infocenter.arm.com/help/topic/com.arm.doc.ddi0301f/Cacbjhfg.html
\r
120 * \param arm11 Target state variable.
\r
121 * \param chain Scan chain that will be selected.
\r
122 * \param state Pass the final TAP state or -1 for the default
\r
123 * value (Pause-DR).
\r
125 * The chain takes effect when Update-DR is passed (usually when subsequently
\r
126 * the INTEXT/EXTEST instructions are written).
\r
128 * \warning (Obsolete) Using this twice in a row will \em fail. The first call will end
\r
129 * in Pause-DR. The second call, due to the IR caching, will not
\r
130 * go through Capture-DR when shifting in the new scan chain number.
\r
131 * As a result the verification in arm11_in_handler_SCAN_N() must
\r
134 * \remarks This adds to the JTAG command queue but does \em not execute it.
\r
137 void arm11_add_debug_SCAN_N(arm11_common_t * arm11, u8 chain, enum tap_state state)
\r
139 JTAG_DEBUG("SCREG <= 0x%02x", chain);
\r
141 arm11_add_IR(arm11, ARM11_SCAN_N, -1);
\r
143 scan_field_t field;
\r
145 arm11_setup_field(arm11, 5, &chain, NULL, &field);
\r
147 field.in_handler = arm11_in_handler_SCAN_N;
\r
149 jtag_add_dr_scan_vc(1, &field, state == -1 ? TAP_PD : state);
\r
152 /** Write an instruction into the ITR register
\r
154 * \param arm11 Target state variable.
\r
155 * \param inst An ARM11 processor instruction/opcode.
\r
156 * \param flag Optional parameter to retrieve the InstCompl flag
\r
157 * (this will be written when the JTAG chain is executed).
\r
158 * \param state Pass the final TAP state or -1 for the default
\r
159 * value (Run-Test/Idle).
\r
161 * \remarks By default this ends with Run-Test/Idle state
\r
162 * and causes the instruction to be executed. If
\r
163 * a subsequent write to DTR is needed before
\r
164 * executing the instruction then TAP_PD should be
\r
165 * passed to \p state.
\r
167 * \remarks This adds to the JTAG command queue but does \em not execute it.
\r
169 void arm11_add_debug_INST(arm11_common_t * arm11, u32 inst, u8 * flag, enum tap_state state)
\r
171 JTAG_DEBUG("INST <= 0x%08x", inst);
\r
173 scan_field_t itr[2];
\r
175 arm11_setup_field(arm11, 32, &inst, NULL, itr + 0);
\r
176 arm11_setup_field(arm11, 1, NULL, flag, itr + 1);
\r
178 jtag_add_dr_scan_vc(asizeof(itr), itr, state == -1 ? TAP_RTI : state);
\r
181 /** Read the Debug Status and Control Register (DSCR)
\r
185 * \param arm11 Target state variable.
\r
186 * \return DSCR content
\r
188 * \remarks This is a stand-alone function that executes the JTAG command queue.
\r
190 u32 arm11_read_DSCR(arm11_common_t * arm11)
\r
192 arm11_add_debug_SCAN_N(arm11, 0x01, -1);
\r
194 arm11_add_IR(arm11, ARM11_INTEST, -1);
\r
197 scan_field_t chain1_field;
\r
199 arm11_setup_field(arm11, 32, NULL, &dscr, &chain1_field);
\r
201 jtag_add_dr_scan_vc(1, &chain1_field, TAP_PD);
\r
203 jtag_execute_queue();
\r
205 if (arm11->last_dscr != dscr)
\r
206 JTAG_DEBUG("DSCR = %08x (OLD %08x)", dscr, arm11->last_dscr);
\r
208 arm11->last_dscr = dscr;
\r
213 /** Write the Debug Status and Control Register (DSCR)
\r
217 * \param arm11 Target state variable.
\r
218 * \param dscr DSCR content
\r
220 * \remarks This is a stand-alone function that executes the JTAG command queue.
\r
222 void arm11_write_DSCR(arm11_common_t * arm11, u32 dscr)
\r
224 arm11_add_debug_SCAN_N(arm11, 0x01, -1);
\r
226 arm11_add_IR(arm11, ARM11_EXTEST, -1);
\r
228 scan_field_t chain1_field;
\r
230 arm11_setup_field(arm11, 32, &dscr, NULL, &chain1_field);
\r
232 jtag_add_dr_scan_vc(1, &chain1_field, TAP_PD);
\r
234 jtag_execute_queue();
\r
236 JTAG_DEBUG("DSCR <= %08x (OLD %08x)", dscr, arm11->last_dscr);
\r
238 arm11->last_dscr = dscr;
\r
243 /** Get the debug reason from Debug Status and Control Register (DSCR)
\r
245 * \param dscr DSCR value to analyze
\r
246 * \return Debug reason
\r
249 enum target_debug_reason arm11_get_DSCR_debug_reason(u32 dscr)
\r
251 switch (dscr & ARM11_DSCR_METHOD_OF_DEBUG_ENTRY_MASK)
\r
253 case ARM11_DSCR_METHOD_OF_DEBUG_ENTRY_HALT: return DBG_REASON_DBGRQ;
\r
254 case ARM11_DSCR_METHOD_OF_DEBUG_ENTRY_BREAKPOINT: return DBG_REASON_BREAKPOINT;
\r
255 case ARM11_DSCR_METHOD_OF_DEBUG_ENTRY_WATCHPOINT: return DBG_REASON_WATCHPOINT;
\r
256 case ARM11_DSCR_METHOD_OF_DEBUG_ENTRY_BKPT_INSTRUCTION: return DBG_REASON_BREAKPOINT;
\r
257 case ARM11_DSCR_METHOD_OF_DEBUG_ENTRY_EDBGRQ: return DBG_REASON_DBGRQ;
\r
258 case ARM11_DSCR_METHOD_OF_DEBUG_ENTRY_VECTOR_CATCH: return DBG_REASON_BREAKPOINT;
\r
261 return DBG_REASON_DBGRQ;
\r
267 /** Prepare the stage for ITR/DTR operations
\r
268 * from the arm11_run_instr... group of functions.
\r
270 * Put arm11_run_instr_data_prepare() and arm11_run_instr_data_finish()
\r
271 * around a block of arm11_run_instr_... calls.
\r
273 * Select scan chain 5 to allow quick access to DTR. When scan
\r
274 * chain 4 is needed to put in a register the ITRSel instruction
\r
275 * shortcut is used instead of actually changing the Scan_N
\r
278 * \param arm11 Target state variable.
\r
281 void arm11_run_instr_data_prepare(arm11_common_t * arm11)
\r
283 arm11_add_debug_SCAN_N(arm11, 0x05, -1);
\r
286 /** Cleanup after ITR/DTR operations
\r
287 * from the arm11_run_instr... group of functions
\r
289 * Put arm11_run_instr_data_prepare() and arm11_run_instr_data_finish()
\r
290 * around a block of arm11_run_instr_... calls.
\r
292 * Any RTI can lead to an instruction execution when
\r
293 * scan chains 4 or 5 are selected and the IR holds
\r
294 * INTEST or EXTEST. So we must disable that before
\r
295 * any following activities lead to an RTI.
\r
297 * \param arm11 Target state variable.
\r
300 void arm11_run_instr_data_finish(arm11_common_t * arm11)
\r
302 arm11_add_debug_SCAN_N(arm11, 0x00, -1);
\r
306 /** Execute one or multiple instructions via ITR
\r
308 * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block
\r
310 * \param arm11 Target state variable.
\r
311 * \param opcode Pointer to sequence of ARM opcodes
\r
312 * \param count Number of opcodes to execute
\r
315 void arm11_run_instr_no_data(arm11_common_t * arm11, u32 * opcode, size_t count)
\r
317 arm11_add_IR(arm11, ARM11_ITRSEL, -1);
\r
321 arm11_add_debug_INST(arm11, *opcode++, NULL, TAP_RTI);
\r
327 arm11_add_debug_INST(arm11, 0, &flag, count ? TAP_RTI : TAP_PD);
\r
329 jtag_execute_queue();
\r
337 /** Execute one instruction via ITR
\r
339 * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block
\r
341 * \param arm11 Target state variable.
\r
342 * \param opcode ARM opcode
\r
345 void arm11_run_instr_no_data1(arm11_common_t * arm11, u32 opcode)
\r
347 arm11_run_instr_no_data(arm11, &opcode, 1);
\r
351 /** Execute one instruction via ITR repeatedly while
\r
352 * passing data to the core via DTR on each execution.
\r
354 * The executed instruction \em must read data from DTR.
\r
356 * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block
\r
358 * \param arm11 Target state variable.
\r
359 * \param opcode ARM opcode
\r
360 * \param data Pointer to the data words to be passed to the core
\r
361 * \param count Number of data words and instruction repetitions
\r
364 void arm11_run_instr_data_to_core(arm11_common_t * arm11, u32 opcode, u32 * data, size_t count)
\r
366 arm11_add_IR(arm11, ARM11_ITRSEL, -1);
\r
368 arm11_add_debug_INST(arm11, opcode, NULL, TAP_PD);
\r
370 arm11_add_IR(arm11, ARM11_EXTEST, -1);
\r
372 scan_field_t chain5_fields[3];
\r
378 arm11_setup_field(arm11, 32, &Data, NULL, chain5_fields + 0);
\r
379 arm11_setup_field(arm11, 1, NULL, &Ready, chain5_fields + 1);
\r
380 arm11_setup_field(arm11, 1, NULL, &nRetry, chain5_fields + 2);
\r
388 jtag_add_dr_scan_vc(asizeof(chain5_fields), chain5_fields, TAP_RTI);
\r
389 jtag_execute_queue();
\r
391 JTAG_DEBUG("DTR Ready %d nRetry %d", Ready, nRetry);
\r
398 arm11_add_IR(arm11, ARM11_INTEST, -1);
\r
404 jtag_add_dr_scan_vc(asizeof(chain5_fields), chain5_fields, TAP_PD);
\r
405 jtag_execute_queue();
\r
407 JTAG_DEBUG("DTR Data %08x Ready %d nRetry %d", Data, Ready, nRetry);
\r
414 /** Execute an instruction via ITR while handing data into the core via DTR.
\r
416 * The executed instruction \em must read data from DTR.
\r
418 * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block
\r
420 * \param arm11 Target state variable.
\r
421 * \param opcode ARM opcode
\r
422 * \param data Data word to be passed to the core via DTR
\r
425 void arm11_run_instr_data_to_core1(arm11_common_t * arm11, u32 opcode, u32 data)
\r
427 arm11_run_instr_data_to_core(arm11, opcode, &data, 1);
\r
431 /** Execute one instruction via ITR repeatedly while
\r
432 * reading data from the core via DTR on each execution.
\r
434 * The executed instruction \em must write data to DTR.
\r
436 * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block
\r
438 * \param arm11 Target state variable.
\r
439 * \param opcode ARM opcode
\r
440 * \param data Pointer to an array that receives the data words from the core
\r
441 * \param count Number of data words and instruction repetitions
\r
444 void arm11_run_instr_data_from_core(arm11_common_t * arm11, u32 opcode, u32 * data, size_t count)
\r
446 arm11_add_IR(arm11, ARM11_ITRSEL, -1);
\r
448 arm11_add_debug_INST(arm11, opcode, NULL, TAP_RTI);
\r
450 arm11_add_IR(arm11, ARM11_INTEST, -1);
\r
452 scan_field_t chain5_fields[3];
\r
458 arm11_setup_field(arm11, 32, NULL, &Data, chain5_fields + 0);
\r
459 arm11_setup_field(arm11, 1, NULL, &Ready, chain5_fields + 1);
\r
460 arm11_setup_field(arm11, 1, NULL, &nRetry, chain5_fields + 2);
\r
466 jtag_add_dr_scan_vc(asizeof(chain5_fields), chain5_fields, count ? TAP_RTI : TAP_PD);
\r
467 jtag_execute_queue();
\r
469 JTAG_DEBUG("DTR Data %08x Ready %d nRetry %d", Data, Ready, nRetry);
\r
477 /** Execute one instruction via ITR
\r
478 * then load r0 into DTR and read DTR from core.
\r
480 * The first executed instruction (\p opcode) should write data to r0.
\r
482 * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block
\r
484 * \param arm11 Target state variable.
\r
485 * \param opcode ARM opcode to write r0 with the value of interest
\r
486 * \param data Pointer to a data word that receives the value from r0 after \p opcode was executed.
\r
489 void arm11_run_instr_data_from_core_via_r0(arm11_common_t * arm11, u32 opcode, u32 * data)
\r
491 arm11_run_instr_no_data1(arm11, opcode);
\r
493 /* MCR p14,0,R0,c0,c5,0 (move r0 -> wDTR -> local var) */
\r
494 arm11_run_instr_data_from_core(arm11, 0xEE000E15, data, 1);
\r
497 /** Load data into core via DTR then move it to r0 then
\r
498 * execute one instruction via ITR
\r
500 * The final executed instruction (\p opcode) should read data from r0.
\r
502 * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block
\r
504 * \param arm11 Target state variable.
\r
505 * \param opcode ARM opcode to read r0 act upon it
\r
506 * \param data Data word that will be written to r0 before \p opcode is executed
\r
509 void arm11_run_instr_data_to_core_via_r0(arm11_common_t * arm11, u32 opcode, u32 data)
\r
511 /* MRC p14,0,r0,c0,c5,0 */
\r
512 arm11_run_instr_data_to_core1(arm11, 0xEE100E15, data);
\r
514 arm11_run_instr_no_data1(arm11, opcode);
\r
518 void arm11_sc7_run(arm11_common_t * arm11, arm11_sc7_action_t * actions, size_t count)
\r
520 arm11_add_debug_SCAN_N(arm11, 0x07, -1);
\r
522 arm11_add_IR(arm11, ARM11_EXTEST, -1);
\r
524 scan_field_t chain7_fields[3];
\r
533 arm11_setup_field(arm11, 1, &nRW, &Ready, chain7_fields + 0);
\r
534 arm11_setup_field(arm11, 32, &DataOut, &DataIn, chain7_fields + 1);
\r
535 arm11_setup_field(arm11, 7, &AddressOut, &AddressIn, chain7_fields + 2);
\r
538 for (i = 0; i < count + 1; i++)
\r
542 nRW = actions[i].write ? 1 : 0;
\r
543 DataOut = actions[i].value;
\r
544 AddressOut = actions[i].address;
\r
555 JTAG_DEBUG("SC7 <= Address %02x Data %08x nRW %d", AddressOut, DataOut, nRW);
\r
557 jtag_add_dr_scan_vc(asizeof(chain7_fields), chain7_fields, TAP_PD);
\r
558 jtag_execute_queue();
\r
560 JTAG_DEBUG("SC7 => Address %02x Data %08x Ready %d", AddressIn, DataIn, Ready);
\r
562 while (!Ready); /* 'nRW' is 'Ready' on read out */
\r
566 if (actions[i - 1].address != AddressIn)
\r
568 WARNING("Scan chain 7 shifted out unexpected address");
\r
571 if (!actions[i - 1].write)
\r
573 actions[i - 1].value = DataIn;
\r
577 if (actions[i - 1].value != DataIn)
\r
579 WARNING("Scan chain 7 shifted out unexpected data");
\r
586 for (i = 0; i < count; i++)
\r
588 JTAG_DEBUG("SC7 %02d: %02x %s %08x", i, actions[i].address, actions[i].write ? "<=" : "=>", actions[i].value);
\r
592 void arm11_sc7_clear_bw(arm11_common_t * arm11)
\r
594 size_t actions = arm11->brp + arm11->wrp;
\r
596 arm11_sc7_action_t clear_bw[actions];
\r
599 for (i = 0; i < actions; i++)
\r
601 clear_bw[i].write = true;
\r
602 clear_bw[i].value = 0;
\r
603 clear_bw[i].address =
\r
605 ARM11_SC7_BCR0 + i :
\r
606 ARM11_SC7_WCR0 + i - arm11->brp;
\r
609 arm11_sc7_run(arm11, clear_bw, actions);
\r