- Work on fixing erase check. Many implementations are plain broken.
[fw/openocd] / src / target / arm926ejs.c
1 /***************************************************************************
2  *   Copyright (C) 2007 by Dominic Rath                                    *
3  *   Dominic.Rath@gmx.de                                                   *
4  *                                                                         *
5  *   This program is free software; you can redistribute it and/or modify  *
6  *   it under the terms of the GNU General Public License as published by  *
7  *   the Free Software Foundation; either version 2 of the License, or     *
8  *   (at your option) any later version.                                   *
9  *                                                                         *
10  *   This program is distributed in the hope that it will be useful,       *
11  *   but WITHOUT ANY WARRANTY; without even the implied warranty of        *
12  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
13  *   GNU General Public License for more details.                          *
14  *                                                                         *
15  *   You should have received a copy of the GNU General Public License     *
16  *   along with this program; if not, write to the                         *
17  *   Free Software Foundation, Inc.,                                       *
18  *   59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
19  ***************************************************************************/
20 #ifdef HAVE_CONFIG_H
21 #include "config.h"
22 #endif
23
24 #include "arm926ejs.h"
25 #include "jtag.h"
26 #include "log.h"
27
28 #include <stdlib.h>
29 #include <string.h>
30
31 #if 1
32 #define _DEBUG_INSTRUCTION_EXECUTION_
33 #endif
34
35 /* cli handling */
36 int arm926ejs_register_commands(struct command_context_s *cmd_ctx);
37
38 int arm926ejs_handle_cp15_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc);
39 int arm926ejs_handle_cp15i_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc);
40 int arm926ejs_handle_virt2phys_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc);
41 int arm926ejs_handle_cache_info_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc);
42 int arm926ejs_handle_md_phys_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc);
43 int arm926ejs_handle_mw_phys_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc);
44
45 int arm926ejs_handle_read_cache_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc);
46 int arm926ejs_handle_read_mmu_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc);
47
48 /* forward declarations */
49 int arm926ejs_target_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc, struct target_s *target);
50 int arm926ejs_init_target(struct command_context_s *cmd_ctx, struct target_s *target);
51 int arm926ejs_quit();
52 int arm926ejs_arch_state(struct target_s *target);
53 int arm926ejs_read_memory(struct target_s *target, u32 address, u32 size, u32 count, u8 *buffer);
54 int arm926ejs_write_memory(struct target_s *target, u32 address, u32 size, u32 count, u8 *buffer);
55 int arm926ejs_soft_reset_halt(struct target_s *target);
56 static int arm926ejs_virt2phys(struct target_s *target, u32 virtual, u32 *physical);
57 static int arm926ejs_mmu(struct target_s *target, int *enabled);
58
59 target_type_t arm926ejs_target =
60 {
61         .name = "arm926ejs",
62
63         .poll = arm7_9_poll,
64         .arch_state = arm926ejs_arch_state,
65
66         .target_request_data = arm7_9_target_request_data,
67
68         .halt = arm7_9_halt,
69         .resume = arm7_9_resume,
70         .step = arm7_9_step,
71
72         .assert_reset = arm7_9_assert_reset,
73         .deassert_reset = arm7_9_deassert_reset,
74         .soft_reset_halt = arm926ejs_soft_reset_halt,
75         
76         .get_gdb_reg_list = armv4_5_get_gdb_reg_list,
77
78         .read_memory = arm7_9_read_memory,
79         .write_memory = arm926ejs_write_memory,
80         .bulk_write_memory = arm7_9_bulk_write_memory,
81         .checksum_memory = arm7_9_checksum_memory,
82         
83         .run_algorithm = armv4_5_run_algorithm,
84
85         .add_breakpoint = arm7_9_add_breakpoint,
86         .remove_breakpoint = arm7_9_remove_breakpoint,
87         .add_watchpoint = arm7_9_add_watchpoint,
88         .remove_watchpoint = arm7_9_remove_watchpoint,
89
90         .register_commands = arm926ejs_register_commands,
91         .target_command = arm926ejs_target_command,
92         .init_target = arm926ejs_init_target,
93         .quit = arm926ejs_quit,
94         .virt2phys = arm926ejs_virt2phys,
95         .mmu = arm926ejs_mmu
96 };
97
98
99 int arm926ejs_catch_broken_irscan(u8 *captured, void *priv, scan_field_t *field)
100 {
101         /* The ARM926EJ-S' instruction register is 4 bits wide */
102         u8 t = *captured & 0xf;
103         u8 t2 = *field->in_check_value & 0xf;
104         if (t == t2)
105         {
106                 return ERROR_OK;
107         }
108         else if ((t == 0x0f) || (t == 0x00))
109         {
110                 LOG_DEBUG("caught ARM926EJ-S invalid Capture-IR result after CP15 access");
111                 return ERROR_OK;
112         }
113         return ERROR_JTAG_QUEUE_FAILED;;
114 }
115
116 #define ARM926EJS_CP15_ADDR(opcode_1, opcode_2, CRn, CRm) ((opcode_1 << 11) | (opcode_2 << 8) | (CRn << 4) | (CRm << 0))
117
118 int arm926ejs_cp15_read(target_t *target, u32 op1, u32 op2, u32 CRn, u32 CRm, u32 *value)
119 {
120         armv4_5_common_t *armv4_5 = target->arch_info;
121         arm7_9_common_t *arm7_9 = armv4_5->arch_info;
122         arm_jtag_t *jtag_info = &arm7_9->jtag_info;
123         u32 address = ARM926EJS_CP15_ADDR(op1, op2, CRn, CRm);
124         scan_field_t fields[4];
125         u8 address_buf[2];
126         u8 nr_w_buf = 0;
127         u8 access = 1;
128         
129         buf_set_u32(address_buf, 0, 14, address);
130         
131         jtag_add_end_state(TAP_RTI);
132         arm_jtag_scann(jtag_info, 0xf);
133         arm_jtag_set_instr(jtag_info, jtag_info->intest_instr, NULL);
134
135         fields[0].device = jtag_info->chain_pos;
136         fields[0].num_bits = 32;
137         fields[0].out_value = NULL;
138         fields[0].out_mask = NULL;
139         fields[0].in_value = NULL;
140         fields[0].in_check_value = NULL;
141         fields[0].in_check_mask = NULL;
142         fields[0].in_handler = NULL;
143         fields[0].in_handler_priv = NULL;
144
145         fields[1].device = jtag_info->chain_pos;
146         fields[1].num_bits = 1;
147         fields[1].out_value = &access;
148         fields[1].out_mask = NULL;
149         fields[1].in_value = &access;
150         fields[1].in_check_value = NULL;
151         fields[1].in_check_mask = NULL;
152         fields[1].in_handler = NULL;
153         fields[1].in_handler_priv = NULL;
154
155         fields[2].device = jtag_info->chain_pos;
156         fields[2].num_bits = 14;
157         fields[2].out_value = address_buf;
158         fields[2].out_mask = NULL;
159         fields[2].in_value = NULL;
160         fields[2].in_check_value = NULL;
161         fields[2].in_check_mask = NULL;
162         fields[2].in_handler = NULL;
163         fields[2].in_handler_priv = NULL;
164
165         fields[3].device = jtag_info->chain_pos;
166         fields[3].num_bits = 1;
167         fields[3].out_value = &nr_w_buf;
168         fields[3].out_mask = NULL;
169         fields[3].in_value = NULL;
170         fields[3].in_check_value = NULL;
171         fields[3].in_check_mask = NULL;
172         fields[3].in_handler = NULL;
173         fields[3].in_handler_priv = NULL;
174         
175         jtag_add_dr_scan(4, fields, -1);
176
177         fields[0].in_handler_priv = value;
178         fields[0].in_handler = arm_jtag_buf_to_u32;
179         
180         /*TODO: add timeout*/
181         do
182         {
183                 /* rescan with NOP, to wait for the access to complete */
184                 access = 0;
185                 nr_w_buf = 0;
186                 jtag_add_dr_scan(4, fields, -1);
187                 jtag_execute_queue();
188         } while (buf_get_u32(&access, 0, 1) != 1);
189
190 #ifdef _DEBUG_INSTRUCTION_EXECUTION_
191         LOG_DEBUG("addr: 0x%x value: %8.8x", address, *value);
192 #endif
193         
194         arm_jtag_set_instr(jtag_info, 0xc, &arm926ejs_catch_broken_irscan);
195
196         return ERROR_OK;
197 }
198
199 int arm926ejs_cp15_write(target_t *target, u32 op1, u32 op2, u32 CRn, u32 CRm, u32 value)
200 {
201         armv4_5_common_t *armv4_5 = target->arch_info;
202         arm7_9_common_t *arm7_9 = armv4_5->arch_info;
203         arm_jtag_t *jtag_info = &arm7_9->jtag_info;
204         u32 address = ARM926EJS_CP15_ADDR(op1, op2, CRn, CRm);
205         scan_field_t fields[4];
206         u8 value_buf[4];
207         u8 address_buf[2];
208         u8 nr_w_buf = 1;
209         u8 access = 1;
210         
211         buf_set_u32(address_buf, 0, 14, address);
212         buf_set_u32(value_buf, 0, 32, value);
213         
214         jtag_add_end_state(TAP_RTI);
215         arm_jtag_scann(jtag_info, 0xf);
216         arm_jtag_set_instr(jtag_info, jtag_info->intest_instr, NULL);
217
218         fields[0].device = jtag_info->chain_pos;
219         fields[0].num_bits = 32;
220         fields[0].out_value = value_buf;
221         fields[0].out_mask = NULL;
222         fields[0].in_value = NULL;
223         fields[0].in_check_value = NULL;
224         fields[0].in_check_mask = NULL;
225         fields[0].in_handler = NULL;
226         fields[0].in_handler_priv = NULL;
227
228         fields[1].device = jtag_info->chain_pos;
229         fields[1].num_bits = 1;
230         fields[1].out_value = &access;
231         fields[1].out_mask = NULL;
232         fields[1].in_value = &access;
233         fields[1].in_check_value = NULL;
234         fields[1].in_check_mask = NULL;
235         fields[1].in_handler = NULL;
236         fields[1].in_handler_priv = NULL;
237
238         fields[2].device = jtag_info->chain_pos;
239         fields[2].num_bits = 14;
240         fields[2].out_value = address_buf;
241         fields[2].out_mask = NULL;
242         fields[2].in_value = NULL;
243         fields[2].in_check_value = NULL;
244         fields[2].in_check_mask = NULL;
245         fields[2].in_handler = NULL;
246         fields[2].in_handler_priv = NULL;
247
248         fields[3].device = jtag_info->chain_pos;
249         fields[3].num_bits = 1;
250         fields[3].out_value = &nr_w_buf;
251         fields[3].out_mask = NULL;
252         fields[3].in_value = NULL;
253         fields[3].in_check_value = NULL;
254         fields[3].in_check_mask = NULL;
255         fields[3].in_handler = NULL;
256         fields[3].in_handler_priv = NULL;
257         
258         jtag_add_dr_scan(4, fields, -1);
259         /*TODO: add timeout*/
260         do
261         {
262                 /* rescan with NOP, to wait for the access to complete */
263                 access = 0;
264                 nr_w_buf = 0;
265                 jtag_add_dr_scan(4, fields, -1);
266                 jtag_execute_queue();
267         } while (buf_get_u32(&access, 0, 1) != 1);
268
269 #ifdef _DEBUG_INSTRUCTION_EXECUTION_
270         LOG_DEBUG("addr: 0x%x value: %8.8x", address, value);
271 #endif
272
273         arm_jtag_set_instr(jtag_info, 0xf, &arm926ejs_catch_broken_irscan);
274
275         return ERROR_OK;
276 }
277
278 int arm926ejs_examine_debug_reason(target_t *target)
279 {
280         armv4_5_common_t *armv4_5 = target->arch_info;
281         arm7_9_common_t *arm7_9 = armv4_5->arch_info;
282         reg_t *dbg_stat = &arm7_9->eice_cache->reg_list[EICE_DBG_STAT];
283         int debug_reason;
284         int retval;
285
286         embeddedice_read_reg(dbg_stat);
287         if ((retval = jtag_execute_queue()) != ERROR_OK)
288                 return retval;
289         
290         debug_reason = buf_get_u32(dbg_stat->value, 6, 4);
291         
292         switch (debug_reason)
293         {
294                 case 1:
295                         LOG_DEBUG("breakpoint from EICE unit 0");
296                         target->debug_reason = DBG_REASON_BREAKPOINT;
297                         break;
298                 case 2:
299                         LOG_DEBUG("breakpoint from EICE unit 1");
300                         target->debug_reason = DBG_REASON_BREAKPOINT;
301                         break;
302                 case 3:
303                         LOG_DEBUG("soft breakpoint (BKPT instruction)");
304                         target->debug_reason = DBG_REASON_BREAKPOINT;
305                         break;
306                 case 4:
307                         LOG_DEBUG("vector catch breakpoint");
308                         target->debug_reason = DBG_REASON_BREAKPOINT;
309                         break;
310                 case 5:
311                         LOG_DEBUG("external breakpoint");
312                         target->debug_reason = DBG_REASON_BREAKPOINT;
313                         break;
314                 case 6:
315                         LOG_DEBUG("watchpoint from EICE unit 0");
316                         target->debug_reason = DBG_REASON_WATCHPOINT;
317                         break;
318                 case 7:
319                         LOG_DEBUG("watchpoint from EICE unit 1");
320                         target->debug_reason = DBG_REASON_WATCHPOINT;
321                         break;
322                 case 8:
323                         LOG_DEBUG("external watchpoint");
324                         target->debug_reason = DBG_REASON_WATCHPOINT;
325                         break;
326                 case 9:
327                         LOG_DEBUG("internal debug request");
328                         target->debug_reason = DBG_REASON_DBGRQ;
329                         break;
330                 case 10:
331                         LOG_DEBUG("external debug request");
332                         target->debug_reason = DBG_REASON_DBGRQ;
333                         break;
334                 case 11:
335                         LOG_ERROR("BUG: debug re-entry from system speed access shouldn't be handled here");
336                         break;
337                 default:
338                         LOG_ERROR("BUG: unknown debug reason: 0x%x", debug_reason);
339                         target->debug_reason = DBG_REASON_DBGRQ;
340                         retval = ERROR_TARGET_FAILURE;
341                         break;
342         }
343         
344         return retval;
345 }
346
347 u32 arm926ejs_get_ttb(target_t *target)
348 {
349         armv4_5_common_t *armv4_5 = target->arch_info;
350         arm7_9_common_t *arm7_9 = armv4_5->arch_info;
351         arm9tdmi_common_t *arm9tdmi = arm7_9->arch_info;
352         arm926ejs_common_t *arm926ejs = arm9tdmi->arch_info;
353         int retval;
354         u32 ttb = 0x0;
355
356         if ((retval = arm926ejs->read_cp15(target, 0, 0, 2, 0, &ttb)) != ERROR_OK)
357                 return retval;
358
359         return ttb;
360 }
361
362 void arm926ejs_disable_mmu_caches(target_t *target, int mmu, int d_u_cache, int i_cache)
363 {
364         armv4_5_common_t *armv4_5 = target->arch_info;
365         arm7_9_common_t *arm7_9 = armv4_5->arch_info;
366         arm9tdmi_common_t *arm9tdmi = arm7_9->arch_info;
367         arm926ejs_common_t *arm926ejs = arm9tdmi->arch_info;
368         u32 cp15_control;
369
370         /* read cp15 control register */
371         arm926ejs->read_cp15(target, 0, 0, 1, 0, &cp15_control);
372         jtag_execute_queue();
373         
374         if (mmu)
375         {
376                 /* invalidate TLB */
377                 arm926ejs->write_cp15(target, 0, 0, 8, 7, 0x0);
378                 
379                 cp15_control &= ~0x1U;
380         }
381         
382         if (d_u_cache)
383         {
384                 u32 debug_override;
385                 /* read-modify-write CP15 debug override register 
386                  * to enable "test and clean all" */
387                 arm926ejs->read_cp15(target, 0, 0, 15, 0, &debug_override);
388                 debug_override |= 0x80000;
389                 arm926ejs->write_cp15(target, 0, 0, 15, 0, debug_override);
390                 
391                 /* clean and invalidate DCache */
392                 arm926ejs->write_cp15(target, 0, 0, 7, 5, 0x0);
393
394                 /* write CP15 debug override register 
395                  * to disable "test and clean all" */
396                 debug_override &= ~0x80000;
397                 arm926ejs->write_cp15(target, 0, 0, 15, 0, debug_override);
398                 
399                 cp15_control &= ~0x4U;
400         }
401         
402         if (i_cache)
403         {
404                 /* invalidate ICache */
405                 arm926ejs->write_cp15(target, 0, 0, 7, 5, 0x0);
406                 
407                 cp15_control &= ~0x1000U;
408         }
409         
410         arm926ejs->write_cp15(target, 0, 0, 1, 0, cp15_control);
411 }
412
413 void arm926ejs_enable_mmu_caches(target_t *target, int mmu, int d_u_cache, int i_cache)
414 {
415         armv4_5_common_t *armv4_5 = target->arch_info;
416         arm7_9_common_t *arm7_9 = armv4_5->arch_info;
417         arm9tdmi_common_t *arm9tdmi = arm7_9->arch_info;
418         arm926ejs_common_t *arm926ejs = arm9tdmi->arch_info;
419         u32 cp15_control;
420
421         /* read cp15 control register */
422         arm926ejs->read_cp15(target, 0, 0, 1, 0, &cp15_control);
423         jtag_execute_queue();
424                 
425         if (mmu)
426                 cp15_control |= 0x1U;
427         
428         if (d_u_cache)
429                 cp15_control |= 0x4U;
430         
431         if (i_cache)
432                 cp15_control |= 0x1000U;
433         
434         arm926ejs->write_cp15(target, 0, 0, 1, 0, cp15_control);
435 }
436
437 void arm926ejs_post_debug_entry(target_t *target)
438 {
439         armv4_5_common_t *armv4_5 = target->arch_info;
440         arm7_9_common_t *arm7_9 = armv4_5->arch_info;
441         arm9tdmi_common_t *arm9tdmi = arm7_9->arch_info;
442         arm926ejs_common_t *arm926ejs = arm9tdmi->arch_info;
443
444         /* examine cp15 control reg */
445         arm926ejs->read_cp15(target, 0, 0, 1, 0, &arm926ejs->cp15_control_reg);
446         jtag_execute_queue();
447         LOG_DEBUG("cp15_control_reg: %8.8x", arm926ejs->cp15_control_reg);
448
449         if (arm926ejs->armv4_5_mmu.armv4_5_cache.ctype == -1)
450         {
451                 u32 cache_type_reg;
452                 /* identify caches */
453                 arm926ejs->read_cp15(target, 0, 1, 0, 0, &cache_type_reg);
454                 jtag_execute_queue();
455                 armv4_5_identify_cache(cache_type_reg, &arm926ejs->armv4_5_mmu.armv4_5_cache);
456         }
457
458         arm926ejs->armv4_5_mmu.mmu_enabled = (arm926ejs->cp15_control_reg & 0x1U) ? 1 : 0;
459         arm926ejs->armv4_5_mmu.armv4_5_cache.d_u_cache_enabled = (arm926ejs->cp15_control_reg & 0x4U) ? 1 : 0;
460         arm926ejs->armv4_5_mmu.armv4_5_cache.i_cache_enabled = (arm926ejs->cp15_control_reg & 0x1000U) ? 1 : 0;
461
462         /* save i/d fault status and address register */
463         arm926ejs->read_cp15(target, 0, 0, 5, 0, &arm926ejs->d_fsr);
464         arm926ejs->read_cp15(target, 0, 1, 5, 0, &arm926ejs->i_fsr);
465         arm926ejs->read_cp15(target, 0, 0, 6, 0, &arm926ejs->d_far);
466         
467         LOG_DEBUG("D FSR: 0x%8.8x, D FAR: 0x%8.8x, I FSR: 0x%8.8x",
468                 arm926ejs->d_fsr, arm926ejs->d_far, arm926ejs->i_fsr);  
469
470
471         u32 cache_dbg_ctrl;
472         
473         /* read-modify-write CP15 cache debug control register 
474          * to disable I/D-cache linefills and force WT */
475         arm926ejs->read_cp15(target, 7, 0, 15, 0, &cache_dbg_ctrl);
476         cache_dbg_ctrl |= 0x7;
477         arm926ejs->write_cp15(target, 7, 0, 15, 0, cache_dbg_ctrl);
478 }
479
480 void arm926ejs_pre_restore_context(target_t *target)
481 {
482         armv4_5_common_t *armv4_5 = target->arch_info;
483         arm7_9_common_t *arm7_9 = armv4_5->arch_info;
484         arm9tdmi_common_t *arm9tdmi = arm7_9->arch_info;
485         arm926ejs_common_t *arm926ejs = arm9tdmi->arch_info;
486
487         /* restore i/d fault status and address register */
488         arm926ejs->write_cp15(target, 0, 0, 5, 0, arm926ejs->d_fsr);
489         arm926ejs->write_cp15(target, 0, 1, 5, 0, arm926ejs->i_fsr);
490         arm926ejs->write_cp15(target, 0, 0, 6, 0, arm926ejs->d_far);
491         
492         u32 cache_dbg_ctrl;
493         
494         /* read-modify-write CP15 cache debug control register 
495          * to reenable I/D-cache linefills and disable WT */
496         arm926ejs->read_cp15(target, 7, 0, 15, 0, &cache_dbg_ctrl);
497         cache_dbg_ctrl &= ~0x7;
498         arm926ejs->write_cp15(target, 7, 0, 15, 0, cache_dbg_ctrl);
499 }
500
501 int arm926ejs_get_arch_pointers(target_t *target, armv4_5_common_t **armv4_5_p, arm7_9_common_t **arm7_9_p, arm9tdmi_common_t **arm9tdmi_p, arm926ejs_common_t **arm926ejs_p)
502 {
503         armv4_5_common_t *armv4_5 = target->arch_info;
504         arm7_9_common_t *arm7_9;
505         arm9tdmi_common_t *arm9tdmi;
506         arm926ejs_common_t *arm926ejs;
507         
508         if (armv4_5->common_magic != ARMV4_5_COMMON_MAGIC)
509         {
510                 return -1;
511         }
512         
513         arm7_9 = armv4_5->arch_info;
514         if (arm7_9->common_magic != ARM7_9_COMMON_MAGIC)
515         {
516                 return -1;
517         }
518         
519         arm9tdmi = arm7_9->arch_info;
520         if (arm9tdmi->common_magic != ARM9TDMI_COMMON_MAGIC)
521         {
522                 return -1;
523         }
524         
525         arm926ejs = arm9tdmi->arch_info;
526         if (arm926ejs->common_magic != ARM926EJS_COMMON_MAGIC)
527         {
528                 return -1;
529         }
530         
531         *armv4_5_p = armv4_5;
532         *arm7_9_p = arm7_9;
533         *arm9tdmi_p = arm9tdmi;
534         *arm926ejs_p = arm926ejs;
535         
536         return ERROR_OK;
537 }
538
539 int arm926ejs_arch_state(struct target_s *target)
540 {
541         armv4_5_common_t *armv4_5 = target->arch_info;
542         arm7_9_common_t *arm7_9 = armv4_5->arch_info;
543         arm9tdmi_common_t *arm9tdmi = arm7_9->arch_info;
544         arm926ejs_common_t *arm926ejs = arm9tdmi->arch_info;
545         
546         char *state[] = 
547         {
548                 "disabled", "enabled"
549         };
550         
551         if (armv4_5->common_magic != ARMV4_5_COMMON_MAGIC)
552         {
553                 LOG_ERROR("BUG: called for a non-ARMv4/5 target");
554                 exit(-1);
555         }
556         
557         LOG_USER(
558                         "target halted in %s state due to %s, current mode: %s\n"
559                         "cpsr: 0x%8.8x pc: 0x%8.8x\n"
560                         "MMU: %s, D-Cache: %s, I-Cache: %s",
561                          armv4_5_state_strings[armv4_5->core_state],
562                          target_debug_reason_strings[target->debug_reason],
563                          armv4_5_mode_strings[armv4_5_mode_to_number(armv4_5->core_mode)],
564                          buf_get_u32(armv4_5->core_cache->reg_list[ARMV4_5_CPSR].value, 0, 32),
565                          buf_get_u32(armv4_5->core_cache->reg_list[15].value, 0, 32),
566                          state[arm926ejs->armv4_5_mmu.mmu_enabled],
567                          state[arm926ejs->armv4_5_mmu.armv4_5_cache.d_u_cache_enabled], 
568                          state[arm926ejs->armv4_5_mmu.armv4_5_cache.i_cache_enabled]);
569         
570         return ERROR_OK;
571 }
572
573 int arm926ejs_soft_reset_halt(struct target_s *target)
574 {
575         armv4_5_common_t *armv4_5 = target->arch_info;
576         arm7_9_common_t *arm7_9 = armv4_5->arch_info;
577         arm9tdmi_common_t *arm9tdmi = arm7_9->arch_info;
578         arm926ejs_common_t *arm926ejs = arm9tdmi->arch_info;
579         reg_t *dbg_stat = &arm7_9->eice_cache->reg_list[EICE_DBG_STAT];
580         int i;
581         
582         target->type->halt(target);
583         
584         for (i=0; i<10; i++)
585         {
586                 if (buf_get_u32(dbg_stat->value, EICE_DBG_STATUS_DBGACK, 1) == 0)
587                 {
588                         embeddedice_read_reg(dbg_stat);
589                         jtag_execute_queue();
590                 }  else
591                 {
592                         break;
593                 }
594                 /* do not eat all CPU, time out after 1 se*/
595                 usleep(100*1000);
596         }
597         if (i==10)
598         {
599                 LOG_ERROR("Failed to halt CPU after 1 sec");
600                 return ERROR_TARGET_TIMEOUT;
601         }
602         
603         target->state = TARGET_HALTED;
604         
605         /* SVC, ARM state, IRQ and FIQ disabled */
606         buf_set_u32(armv4_5->core_cache->reg_list[ARMV4_5_CPSR].value, 0, 8, 0xd3);
607         armv4_5->core_cache->reg_list[ARMV4_5_CPSR].dirty = 1;
608         armv4_5->core_cache->reg_list[ARMV4_5_CPSR].valid = 1;
609         
610         /* start fetching from 0x0 */
611         buf_set_u32(armv4_5->core_cache->reg_list[15].value, 0, 32, 0x0);
612         armv4_5->core_cache->reg_list[15].dirty = 1;
613         armv4_5->core_cache->reg_list[15].valid = 1;
614         
615         armv4_5->core_mode = ARMV4_5_MODE_SVC;
616         armv4_5->core_state = ARMV4_5_STATE_ARM;
617         
618         arm926ejs_disable_mmu_caches(target, 1, 1, 1);
619         arm926ejs->armv4_5_mmu.mmu_enabled = 0;
620         arm926ejs->armv4_5_mmu.armv4_5_cache.d_u_cache_enabled = 0;
621         arm926ejs->armv4_5_mmu.armv4_5_cache.i_cache_enabled = 0;
622
623         target_call_event_callbacks(target, TARGET_EVENT_HALTED);
624         
625         return ERROR_OK;
626 }
627
628 int arm926ejs_write_memory(struct target_s *target, u32 address, u32 size, u32 count, u8 *buffer)
629 {
630         int retval;
631         armv4_5_common_t *armv4_5 = target->arch_info;
632         arm7_9_common_t *arm7_9 = armv4_5->arch_info;
633         arm9tdmi_common_t *arm9tdmi = arm7_9->arch_info;
634         arm926ejs_common_t *arm926ejs = arm9tdmi->arch_info;
635         
636         if ((retval = arm7_9_write_memory(target, address, size, count, buffer)) != ERROR_OK)
637                 return retval;
638
639         /* If ICache is enabled, we have to invalidate affected ICache lines
640          * the DCache is forced to write-through, so we don't have to clean it here
641          */
642         if (arm926ejs->armv4_5_mmu.armv4_5_cache.i_cache_enabled)
643         {
644                 if (count <= 1)
645                 {
646                         /* invalidate ICache single entry with MVA */
647                         arm926ejs->write_cp15(target, 0, 1, 7, 5, address);
648                 }
649                 else
650                 {
651                         /* invalidate ICache */
652                         arm926ejs->write_cp15(target, 0, 0, 7, 5, address);
653                 }
654         }
655
656         return retval;
657 }
658
659 int arm926ejs_init_target(struct command_context_s *cmd_ctx, struct target_s *target)
660 {
661         arm9tdmi_init_target(cmd_ctx, target);
662                 
663         return ERROR_OK;
664         
665 }
666
667 int arm926ejs_quit()
668 {
669         
670         return ERROR_OK;
671 }
672
673 int arm926ejs_init_arch_info(target_t *target, arm926ejs_common_t *arm926ejs, int chain_pos, char *variant)
674 {
675         arm9tdmi_common_t *arm9tdmi = &arm926ejs->arm9tdmi_common;
676         arm7_9_common_t *arm7_9 = &arm9tdmi->arm7_9_common;
677         
678         /* initialize arm9tdmi specific info (including arm7_9 and armv4_5)
679          */
680         arm9tdmi_init_arch_info(target, arm9tdmi, chain_pos, variant);
681
682         arm9tdmi->arch_info = arm926ejs;
683         arm926ejs->common_magic = ARM926EJS_COMMON_MAGIC;
684         
685         arm7_9->post_debug_entry = arm926ejs_post_debug_entry;
686         arm7_9->pre_restore_context = arm926ejs_pre_restore_context;
687         
688         arm926ejs->read_cp15 = arm926ejs_cp15_read;
689         arm926ejs->write_cp15 = arm926ejs_cp15_write;
690         arm926ejs->armv4_5_mmu.armv4_5_cache.ctype = -1;
691         arm926ejs->armv4_5_mmu.get_ttb = arm926ejs_get_ttb;
692         arm926ejs->armv4_5_mmu.read_memory = arm7_9_read_memory;
693         arm926ejs->armv4_5_mmu.write_memory = arm7_9_write_memory;
694         arm926ejs->armv4_5_mmu.disable_mmu_caches = arm926ejs_disable_mmu_caches;
695         arm926ejs->armv4_5_mmu.enable_mmu_caches = arm926ejs_enable_mmu_caches;
696         arm926ejs->armv4_5_mmu.has_tiny_pages = 1;
697         arm926ejs->armv4_5_mmu.mmu_enabled = 0;
698         
699         arm7_9->examine_debug_reason = arm926ejs_examine_debug_reason;
700         
701         /* The ARM926EJ-S implements the ARMv5TE architecture which
702          * has the BKPT instruction, so we don't have to use a watchpoint comparator
703          */
704         arm7_9->arm_bkpt = ARMV5_BKPT(0x0);
705         arm7_9->thumb_bkpt = ARMV5_T_BKPT(0x0) & 0xffff;
706         
707         arm7_9->sw_bkpts_use_wp = 0;
708         arm7_9->sw_bkpts_enabled = 1;
709         
710         return ERROR_OK;
711 }
712
713 int arm926ejs_target_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc, struct target_s *target)
714 {
715         int chain_pos;
716         char *variant = NULL;
717         arm926ejs_common_t *arm926ejs = malloc(sizeof(arm926ejs_common_t));
718         memset(arm926ejs, 0, sizeof(*arm926ejs));
719         
720         if (argc < 4)
721         {
722                 LOG_ERROR("'target arm926ejs' requires at least one additional argument");
723                 exit(-1);
724         }
725         
726         chain_pos = strtoul(args[3], NULL, 0);
727         
728         if (argc >= 5)
729                 variant = args[4];
730         
731         LOG_DEBUG("chain_pos: %i, variant: %s", chain_pos, variant);
732         
733         arm926ejs_init_arch_info(target, arm926ejs, chain_pos, variant);
734
735         return ERROR_OK;
736 }
737
738 int arm926ejs_register_commands(struct command_context_s *cmd_ctx)
739 {
740         int retval;
741         command_t *arm926ejs_cmd;
742         
743                 
744         retval = arm9tdmi_register_commands(cmd_ctx);
745         
746         arm926ejs_cmd = register_command(cmd_ctx, NULL, "arm926ejs", NULL, COMMAND_ANY, "arm926ejs specific commands");
747
748         register_command(cmd_ctx, arm926ejs_cmd, "cp15", arm926ejs_handle_cp15_command, COMMAND_EXEC, "display/modify cp15 register <opcode_1> <opcode_2> <CRn> <CRm> [value]");
749         
750         register_command(cmd_ctx, arm926ejs_cmd, "cache_info", arm926ejs_handle_cache_info_command, COMMAND_EXEC, "display information about target caches");
751         register_command(cmd_ctx, arm926ejs_cmd, "virt2phys", arm926ejs_handle_virt2phys_command, COMMAND_EXEC, "translate va to pa <va>");
752
753         register_command(cmd_ctx, arm926ejs_cmd, "mdw_phys", arm926ejs_handle_md_phys_command, COMMAND_EXEC, "display memory words <physical addr> [count]");
754         register_command(cmd_ctx, arm926ejs_cmd, "mdh_phys", arm926ejs_handle_md_phys_command, COMMAND_EXEC, "display memory half-words <physical addr> [count]");
755         register_command(cmd_ctx, arm926ejs_cmd, "mdb_phys", arm926ejs_handle_md_phys_command, COMMAND_EXEC, "display memory bytes <physical addr> [count]");
756
757         register_command(cmd_ctx, arm926ejs_cmd, "mww_phys", arm926ejs_handle_mw_phys_command, COMMAND_EXEC, "write memory word <physical addr> <value>");
758         register_command(cmd_ctx, arm926ejs_cmd, "mwh_phys", arm926ejs_handle_mw_phys_command, COMMAND_EXEC, "write memory half-word <physical addr> <value>");
759         register_command(cmd_ctx, arm926ejs_cmd, "mwb_phys", arm926ejs_handle_mw_phys_command, COMMAND_EXEC, "write memory byte <physical addr> <value>");
760
761         return ERROR_OK;
762 }
763
764 int arm926ejs_handle_cp15_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc)
765 {
766         int retval;
767         target_t *target = get_current_target(cmd_ctx);
768         armv4_5_common_t *armv4_5;
769         arm7_9_common_t *arm7_9;
770         arm9tdmi_common_t *arm9tdmi;
771         arm926ejs_common_t *arm926ejs;
772         int opcode_1;
773         int opcode_2;
774         int CRn;
775         int CRm;
776
777         if ((argc < 4) || (argc > 5))
778         {
779                 command_print(cmd_ctx, "usage: arm926ejs cp15 <opcode_1> <opcode_2> <CRn> <CRm> [value]");
780                 return ERROR_OK;
781         }
782         
783         opcode_1 = strtoul(args[0], NULL, 0);
784         opcode_2 = strtoul(args[1], NULL, 0);
785         CRn = strtoul(args[2], NULL, 0);
786         CRm = strtoul(args[3], NULL, 0);
787
788         if (arm926ejs_get_arch_pointers(target, &armv4_5, &arm7_9, &arm9tdmi, &arm926ejs) != ERROR_OK)
789         {
790                 command_print(cmd_ctx, "current target isn't an ARM926EJ-S target");
791                 return ERROR_OK;
792         }
793         
794         if (target->state != TARGET_HALTED)
795         {
796                 command_print(cmd_ctx, "target must be stopped for \"%s\" command", cmd);
797                 return ERROR_OK;
798         }
799         
800         if (argc == 4)
801         {
802                 u32 value;
803                 if ((retval = arm926ejs->read_cp15(target, opcode_1, opcode_2, CRn, CRm, &value)) != ERROR_OK)
804                 {
805                         command_print(cmd_ctx, "couldn't access register");
806                         return ERROR_OK;
807                 }
808                 jtag_execute_queue();
809                 
810                 command_print(cmd_ctx, "%i %i %i %i: %8.8x", opcode_1, opcode_2, CRn, CRm, value);
811         }
812         else
813         {
814                 u32 value = strtoul(args[4], NULL, 0);
815                 if ((retval = arm926ejs->write_cp15(target, opcode_1, opcode_2, CRn, CRm, value)) != ERROR_OK)
816                 {
817                         command_print(cmd_ctx, "couldn't access register");
818                         return ERROR_OK;
819                 }
820                 command_print(cmd_ctx, "%i %i %i %i: %8.8x", opcode_1, opcode_2, CRn, CRm, value);
821         }
822
823         return ERROR_OK;
824 }
825
826 int arm926ejs_handle_cache_info_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc)
827 {
828         target_t *target = get_current_target(cmd_ctx);
829         armv4_5_common_t *armv4_5;
830         arm7_9_common_t *arm7_9;
831         arm9tdmi_common_t *arm9tdmi;
832         arm926ejs_common_t *arm926ejs;
833         
834         if (arm926ejs_get_arch_pointers(target, &armv4_5, &arm7_9, &arm9tdmi, &arm926ejs) != ERROR_OK)
835         {
836                 command_print(cmd_ctx, "current target isn't an ARM926EJ-S target");
837                 return ERROR_OK;
838         }
839         
840         return armv4_5_handle_cache_info_command(cmd_ctx, &arm926ejs->armv4_5_mmu.armv4_5_cache);
841 }
842
843 int arm926ejs_handle_virt2phys_command(command_context_t *cmd_ctx, char *cmd, char **args, int argc)
844 {       
845         target_t *target = get_current_target(cmd_ctx);
846         armv4_5_common_t *armv4_5;
847         arm7_9_common_t *arm7_9;
848         arm9tdmi_common_t *arm9tdmi;
849         arm926ejs_common_t *arm926ejs;
850         arm_jtag_t *jtag_info;
851
852         if (arm926ejs_get_arch_pointers(target, &armv4_5, &arm7_9, &arm9tdmi, &arm926ejs) != ERROR_OK)
853         {
854                 command_print(cmd_ctx, "current target isn't an ARM926EJ-S target");
855                 return ERROR_OK;
856         }
857         
858         jtag_info = &arm7_9->jtag_info;
859         
860         if (target->state != TARGET_HALTED)
861         {
862                 command_print(cmd_ctx, "target must be stopped for \"%s\" command", cmd);
863                 return ERROR_OK;
864         }
865                 
866         return armv4_5_mmu_handle_virt2phys_command(cmd_ctx, cmd, args, argc, target, &arm926ejs->armv4_5_mmu);
867 }
868
869 int arm926ejs_handle_md_phys_command(command_context_t *cmd_ctx, char *cmd, char **args, int argc)
870 {       
871         target_t *target = get_current_target(cmd_ctx);
872         armv4_5_common_t *armv4_5;
873         arm7_9_common_t *arm7_9;
874         arm9tdmi_common_t *arm9tdmi;
875         arm926ejs_common_t *arm926ejs;
876         arm_jtag_t *jtag_info;
877
878         if (arm926ejs_get_arch_pointers(target, &armv4_5, &arm7_9, &arm9tdmi, &arm926ejs) != ERROR_OK)
879         {
880                 command_print(cmd_ctx, "current target isn't an ARM926EJ-S target");
881                 return ERROR_OK;
882         }
883         
884         jtag_info = &arm7_9->jtag_info;
885         
886         if (target->state != TARGET_HALTED)
887         {
888                 command_print(cmd_ctx, "target must be stopped for \"%s\" command", cmd);
889                 return ERROR_OK;
890         }
891         
892         return armv4_5_mmu_handle_md_phys_command(cmd_ctx, cmd, args, argc, target, &arm926ejs->armv4_5_mmu);
893 }
894
895 int arm926ejs_handle_mw_phys_command(command_context_t *cmd_ctx, char *cmd, char **args, int argc)
896 {       
897         target_t *target = get_current_target(cmd_ctx);
898         armv4_5_common_t *armv4_5;
899         arm7_9_common_t *arm7_9;
900         arm9tdmi_common_t *arm9tdmi;
901         arm926ejs_common_t *arm926ejs;
902         arm_jtag_t *jtag_info;
903
904         if (arm926ejs_get_arch_pointers(target, &armv4_5, &arm7_9, &arm9tdmi, &arm926ejs) != ERROR_OK)
905         {
906                 command_print(cmd_ctx, "current target isn't an ARM926EJ-S target");
907                 return ERROR_OK;
908         }
909         
910         jtag_info = &arm7_9->jtag_info;
911         
912         if (target->state != TARGET_HALTED)
913         {
914                 command_print(cmd_ctx, "target must be stopped for \"%s\" command", cmd);
915                 return ERROR_OK;
916         }
917         
918         return armv4_5_mmu_handle_mw_phys_command(cmd_ctx, cmd, args, argc, target, &arm926ejs->armv4_5_mmu);
919 }
920 static int arm926ejs_virt2phys(struct target_s *target, u32 virtual, u32 *physical)
921 {
922         int retval;
923         int type;
924         u32 cb;
925         int domain;
926         u32 ap;
927         
928         armv4_5_common_t *armv4_5;
929         arm7_9_common_t *arm7_9;
930         arm9tdmi_common_t *arm9tdmi;
931         arm926ejs_common_t *arm926ejs;
932         retval= arm926ejs_get_arch_pointers(target, &armv4_5, &arm7_9, &arm9tdmi, &arm926ejs);
933         if (retval != ERROR_OK)
934         {
935                 return retval;
936         }
937         u32 ret = armv4_5_mmu_translate_va(target, &arm926ejs->armv4_5_mmu, virtual, &type, &cb, &domain, &ap);
938         if (type == -1)
939         {
940                 return ret;
941         }
942         *physical = ret;
943         return ERROR_OK;
944 }
945
946 static int arm926ejs_mmu(struct target_s *target, int *enabled)
947 {
948         armv4_5_common_t *armv4_5 = target->arch_info;
949         arm926ejs_common_t *arm926ejs = armv4_5->arch_info;
950         
951         if (target->state != TARGET_HALTED)
952         {
953                 LOG_ERROR("Target not halted");
954                 return ERROR_TARGET_INVALID;
955         }
956         *enabled = arm926ejs->armv4_5_mmu.mmu_enabled;
957         return ERROR_OK;
958 }