2 * Copyright (C) 2009 by David Brownell
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License as published by
6 * the Free Software Foundation; either version 2 of the License, or
7 * (at your option) any later version.
9 * This program is distributed in the hope that it will be useful
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, write to the
16 * Free Software Foundation, Inc.,
17 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
24 #include "armv4_5.h" /* REVISIT to become arm.h */
26 #include <jtag/jtag.h>
28 #include "breakpoints.h"
29 #include "target_type.h"
34 * Implements various ARM DPM operations using architectural debug registers.
35 * These routines layer over core-specific communication methods to cope with
36 * implementation differences between cores like ARM1136 and Cortex-A8.
39 /*----------------------------------------------------------------------*/
45 /* Read coprocessor */
46 static int dpm_mrc(struct target *target, int cpnum,
47 uint32_t op1, uint32_t op2, uint32_t CRn, uint32_t CRm,
50 struct arm *arm = target_to_arm(target);
51 struct arm_dpm *dpm = arm->dpm;
54 retval = dpm->prepare(dpm);
55 if (retval != ERROR_OK)
58 LOG_DEBUG("MRC p%d, %d, r0, c%d, c%d, %d", cpnum, op1, CRn, CRm, op2);
60 /* read coprocessor register into R0; return via DCC */
61 retval = dpm->instr_read_data_r0(dpm,
62 ARMV4_5_MRC(cpnum, op1, 0, CRn, CRm, op2),
65 /* (void) */ dpm->finish(dpm);
69 static int dpm_mcr(struct target *target, int cpnum,
70 uint32_t op1, uint32_t op2, uint32_t CRn, uint32_t CRm,
73 struct arm *arm = target_to_arm(target);
74 struct arm_dpm *dpm = arm->dpm;
77 retval = dpm->prepare(dpm);
78 if (retval != ERROR_OK)
81 LOG_DEBUG("MCR p%d, %d, r0, c%d, c%d, %d", cpnum, op1, CRn, CRm, op2);
83 /* read DCC into r0; then write coprocessor register from R0 */
84 retval = dpm->instr_write_data_r0(dpm,
85 ARMV4_5_MCR(cpnum, op1, 0, CRn, CRm, op2),
88 /* (void) */ dpm->finish(dpm);
92 /*----------------------------------------------------------------------*/
95 * Register access utilities
98 /* Toggles between recorded core mode (USR, SVC, etc) and a temporary one.
99 * Routines *must* restore the original mode before returning!!
101 static int dpm_modeswitch(struct arm_dpm *dpm, enum armv4_5_mode mode)
106 /* restore previous mode */
107 if (mode == ARMV4_5_MODE_ANY)
108 cpsr = buf_get_u32(dpm->arm->cpsr->value, 0, 32);
110 /* else force to the specified mode */
114 retval = dpm->instr_write_data_r0(dpm, ARMV4_5_MSR_GP(0, 0xf, 0), cpsr);
116 if (dpm->instr_cpsr_sync)
117 retval = dpm->instr_cpsr_sync(dpm);
122 /* just read the register -- rely on the core mode being right */
123 static int dpm_read_reg(struct arm_dpm *dpm, struct reg *r, unsigned regnum)
130 /* return via DCC: "MCR p14, 0, Rnum, c0, c5, 0" */
131 retval = dpm->instr_read_data_dcc(dpm,
132 ARMV4_5_MCR(14, 0, regnum, 0, 5, 0),
136 /* "MOV r0, pc"; then return via DCC */
137 retval = dpm->instr_read_data_r0(dpm, 0xe1a0000f, &value);
139 /* NOTE: this seems like a slightly awkward place to update
140 * this value ... but if the PC gets written (the only way
141 * to change what we compute), the arch spec says subsequent
142 * reads return values which are "unpredictable". So this
143 * is always right except in those broken-by-intent cases.
145 switch (dpm->arm->core_state) {
146 case ARMV4_5_STATE_ARM:
149 case ARMV4_5_STATE_THUMB:
150 case ARM_STATE_THUMB_EE:
153 case ARMV4_5_STATE_JAZELLE:
154 /* core-specific ... ? */
155 LOG_WARNING("Jazelle PC adjustment unknown");
160 /* 16: "MRS r0, CPSR"; then return via DCC
161 * 17: "MRS r0, SPSR"; then return via DCC
163 retval = dpm->instr_read_data_r0(dpm,
164 ARMV4_5_MRS(0, regnum & 1),
169 if (retval == ERROR_OK) {
170 buf_set_u32(r->value, 0, 32, value);
173 LOG_DEBUG("READ: %s, %8.8x", r->name, (unsigned) value);
179 /* just write the register -- rely on the core mode being right */
180 static int dpm_write_reg(struct arm_dpm *dpm, struct reg *r, unsigned regnum)
183 uint32_t value = buf_get_u32(r->value, 0, 32);
187 /* load register from DCC: "MRC p14, 0, Rnum, c0, c5, 0" */
188 retval = dpm->instr_write_data_dcc(dpm,
189 ARMV4_5_MRC(14, 0, regnum, 0, 5, 0),
193 /* read r0 from DCC; then "MOV pc, r0" */
194 retval = dpm->instr_write_data_r0(dpm, 0xe1a0f000, value);
197 /* 16: read r0 from DCC, then "MSR r0, CPSR_cxsf"
198 * 17: read r0 from DCC, then "MSR r0, SPSR_cxsf"
200 retval = dpm->instr_write_data_r0(dpm,
201 ARMV4_5_MSR_GP(0, 0xf, regnum & 1),
204 if (regnum == 16 && dpm->instr_cpsr_sync)
205 retval = dpm->instr_cpsr_sync(dpm);
210 if (retval == ERROR_OK) {
212 LOG_DEBUG("WRITE: %s, %8.8x", r->name, (unsigned) value);
219 * Read basic registers of the the current context: R0 to R15, and CPSR;
220 * sets the core mode (such as USR or IRQ) and state (such as ARM or Thumb).
221 * In normal operation this is called on entry to halting debug state,
222 * possibly after some other operations supporting restore of debug state
223 * or making sure the CPU is fully idle (drain write buffer, etc).
225 int arm_dpm_read_current_registers(struct arm_dpm *dpm)
227 struct arm *arm = dpm->arm;
232 retval = dpm->prepare(dpm);
233 if (retval != ERROR_OK)
236 /* read R0 first (it's used for scratch), then CPSR */
237 r = arm->core_cache->reg_list + 0;
239 retval = dpm_read_reg(dpm, r, 0);
240 if (retval != ERROR_OK)
245 retval = dpm->instr_read_data_r0(dpm, ARMV4_5_MRS(0, 0), &cpsr);
246 if (retval != ERROR_OK)
249 /* update core mode and state, plus shadow mapping for R8..R14 */
250 arm_set_cpsr(arm, cpsr);
252 /* REVISIT we can probably avoid reading R1..R14, saving time... */
253 for (unsigned i = 1; i < 16; i++) {
254 r = arm_reg_current(arm, i);
258 retval = dpm_read_reg(dpm, r, i);
259 if (retval != ERROR_OK)
263 /* NOTE: SPSR ignored (if it's even relevant). */
265 /* REVISIT the debugger can trigger various exceptions. See the
266 * ARMv7A architecture spec, section C5.7, for more info about
267 * what defenses are needed; v6 debug has the most issues.
271 /* (void) */ dpm->finish(dpm);
276 * Writes all modified core registers for all processor modes. In normal
277 * operation this is called on exit from halting debug state.
279 * @param dpm: represents the processor
280 * @param bpwp: true ensures breakpoints and watchpoints are set,
281 * false ensures they are cleared
283 int arm_dpm_write_dirty_registers(struct arm_dpm *dpm, bool bpwp)
285 struct arm *arm = dpm->arm;
286 struct reg_cache *cache = arm->core_cache;
290 retval = dpm->prepare(dpm);
291 if (retval != ERROR_OK)
294 /* enable/disable watchpoints */
295 for (unsigned i = 0; i < dpm->nwp; i++) {
296 struct dpm_wp *dwp = dpm->dwp + i;
297 struct watchpoint *wp = dwp->wp;
300 /* Avoid needless I/O ... leave watchpoints alone
301 * unless they're removed, or need updating because
302 * of single-stepping or running debugger code.
308 /* removed or startup; we must disable it */
313 /* disabled, but we must set it */
314 dwp->dirty = disable = false;
319 /* set, but we must temporarily disable it */
320 dwp->dirty = disable = true;
325 retval = dpm->bpwp_disable(dpm, 16 + i);
327 retval = dpm->bpwp_enable(dpm, 16 + i,
328 wp->address, dwp->control);
330 if (retval != ERROR_OK)
331 LOG_ERROR("%s: can't %s HW watchpoint %d",
332 target_name(arm->target),
333 disable ? "disable" : "enable",
337 /* NOTE: writes to breakpoint and watchpoint registers might
338 * be queued, and need (efficient/batched) flushing later.
341 /* Scan the registers until we find one that's both dirty and
342 * eligible for flushing. Flush that and everything else that
343 * shares the same core mode setting. Typically this won't
344 * actually find anything to do...
347 enum armv4_5_mode mode = ARMV4_5_MODE_ANY;
351 /* check everything except our scratch register R0 */
352 for (unsigned i = 1; i < cache->num_regs; i++) {
356 /* also skip PC, CPSR, and non-dirty */
359 if (arm->cpsr == cache->reg_list + i)
361 if (!cache->reg_list[i].dirty)
364 r = cache->reg_list[i].arch_info;
367 /* may need to pick and set a mode */
369 enum armv4_5_mode tmode;
372 mode = tmode = r->mode;
374 /* cope with special cases */
377 /* r8..r12 "anything but FIQ" case;
378 * we "know" core mode is accurate
379 * since we haven't changed it yet
381 if (arm->core_mode == ARMV4_5_MODE_FIQ
384 tmode = ARMV4_5_MODE_USR;
392 /* REVISIT error checks */
393 if (tmode != ARMV4_5_MODE_ANY)
394 retval = dpm_modeswitch(dpm, tmode);
399 retval = dpm_write_reg(dpm,
407 /* Restore original CPSR ... assuming either that we changed it,
408 * or it's dirty. Must write PC to ensure the return address is
409 * defined, and must not write it before CPSR.
411 retval = dpm_modeswitch(dpm, ARMV4_5_MODE_ANY);
412 arm->cpsr->dirty = false;
414 retval = dpm_write_reg(dpm, &cache->reg_list[15], 15);
415 cache->reg_list[15].dirty = false;
417 /* flush R0 -- it's *very* dirty by now */
418 retval = dpm_write_reg(dpm, &cache->reg_list[0], 0);
419 cache->reg_list[0].dirty = false;
421 /* (void) */ dpm->finish(dpm);
426 /* Returns ARMV4_5_MODE_ANY or temporary mode to use while reading the
427 * specified register ... works around flakiness from ARM core calls.
428 * Caller already filtered out SPSR access; mode is never MODE_SYS
431 static enum armv4_5_mode dpm_mapmode(struct arm *arm,
432 unsigned num, enum armv4_5_mode mode)
434 enum armv4_5_mode amode = arm->core_mode;
436 /* don't switch if the mode is already correct */
437 if (amode == ARMV4_5_MODE_SYS)
438 amode = ARMV4_5_MODE_USR;
440 return ARMV4_5_MODE_ANY;
443 /* don't switch for non-shadowed registers (r0..r7, r15/pc, cpsr) */
448 /* r8..r12 aren't shadowed for anything except FIQ */
450 if (mode == ARMV4_5_MODE_FIQ)
453 /* r13/sp, and r14/lr are always shadowed */
458 LOG_WARNING("invalid register #%u", num);
461 return ARMV4_5_MODE_ANY;
466 * Standard ARM register accessors ... there are three methods
467 * in "struct arm", to support individual read/write and bulk read
471 static int arm_dpm_read_core_reg(struct target *target, struct reg *r,
472 int regnum, enum armv4_5_mode mode)
474 struct arm_dpm *dpm = target_to_arm(target)->dpm;
477 if (regnum < 0 || regnum > 16)
478 return ERROR_INVALID_ARGUMENTS;
481 if (mode != ARMV4_5_MODE_ANY)
484 mode = dpm_mapmode(dpm->arm, regnum, mode);
486 /* REVISIT what happens if we try to read SPSR in a core mode
487 * which has no such register?
490 retval = dpm->prepare(dpm);
491 if (retval != ERROR_OK)
494 if (mode != ARMV4_5_MODE_ANY) {
495 retval = dpm_modeswitch(dpm, mode);
496 if (retval != ERROR_OK)
500 retval = dpm_read_reg(dpm, r, regnum);
501 /* always clean up, regardless of error */
503 if (mode != ARMV4_5_MODE_ANY)
504 /* (void) */ dpm_modeswitch(dpm, ARMV4_5_MODE_ANY);
507 /* (void) */ dpm->finish(dpm);
511 static int arm_dpm_write_core_reg(struct target *target, struct reg *r,
512 int regnum, enum armv4_5_mode mode, uint32_t value)
514 struct arm_dpm *dpm = target_to_arm(target)->dpm;
518 if (regnum < 0 || regnum > 16)
519 return ERROR_INVALID_ARGUMENTS;
522 if (mode != ARMV4_5_MODE_ANY)
525 mode = dpm_mapmode(dpm->arm, regnum, mode);
527 /* REVISIT what happens if we try to write SPSR in a core mode
528 * which has no such register?
531 retval = dpm->prepare(dpm);
532 if (retval != ERROR_OK)
535 if (mode != ARMV4_5_MODE_ANY) {
536 retval = dpm_modeswitch(dpm, mode);
537 if (retval != ERROR_OK)
541 retval = dpm_write_reg(dpm, r, regnum);
542 /* always clean up, regardless of error */
544 if (mode != ARMV4_5_MODE_ANY)
545 /* (void) */ dpm_modeswitch(dpm, ARMV4_5_MODE_ANY);
548 /* (void) */ dpm->finish(dpm);
552 static int arm_dpm_full_context(struct target *target)
554 struct arm *arm = target_to_arm(target);
555 struct arm_dpm *dpm = arm->dpm;
556 struct reg_cache *cache = arm->core_cache;
560 retval = dpm->prepare(dpm);
561 if (retval != ERROR_OK)
565 enum armv4_5_mode mode = ARMV4_5_MODE_ANY;
569 /* We "know" arm_dpm_read_current_registers() was called so
570 * the unmapped registers (R0..R7, PC, AND CPSR) and some
571 * view of R8..R14 are current. We also "know" oddities of
572 * register mapping: special cases for R8..R12 and SPSR.
574 * Pick some mode with unread registers and read them all.
577 for (unsigned i = 0; i < cache->num_regs; i++) {
580 if (cache->reg_list[i].valid)
582 r = cache->reg_list[i].arch_info;
584 /* may need to pick a mode and set CPSR */
589 /* For R8..R12 when we've entered debug
590 * state in FIQ mode... patch mode.
592 if (mode == ARMV4_5_MODE_ANY)
593 mode = ARMV4_5_MODE_USR;
595 /* REVISIT error checks */
596 retval = dpm_modeswitch(dpm, mode);
601 /* CPSR was read, so "R16" must mean SPSR */
602 retval = dpm_read_reg(dpm,
604 (r->num == 16) ? 17 : r->num);
610 retval = dpm_modeswitch(dpm, ARMV4_5_MODE_ANY);
611 /* (void) */ dpm->finish(dpm);
617 /*----------------------------------------------------------------------*/
620 * Breakpoint and Watchpoint support.
622 * Hardware {break,watch}points are usually left active, to minimize
623 * debug entry/exit costs. When they are set or cleared, it's done in
624 * batches. Also, DPM-conformant hardware can update debug registers
625 * regardless of whether the CPU is running or halted ... though that
626 * fact isn't currently leveraged.
629 static int dpm_watchpoint_setup(struct arm_dpm *dpm, unsigned index,
630 struct watchpoint *wp)
632 uint32_t addr = wp->address;
635 /* this hardware doesn't support data value matching or masking */
636 if (wp->value || wp->mask != ~(uint32_t)0) {
637 LOG_DEBUG("watchpoint values and masking not supported");
638 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
641 control = (1 << 0) /* enable */
642 | (3 << 1); /* both user and privileged access */
656 /* Match 1, 2, or all 4 byte addresses in this word.
658 * FIXME: v7 hardware allows lengths up to 2 GB, and has eight
659 * byte address select bits. Support larger wp->length, if addr
660 * is suitably aligned.
662 switch (wp->length) {
664 control |= (1 << (addr & 3)) << 5;
668 /* require 2-byte alignment */
670 control |= (3 << (addr & 2)) << 5;
675 /* require 4-byte alignment */
682 LOG_DEBUG("bad watchpoint length or alignment");
683 return ERROR_INVALID_ARGUMENTS;
686 /* other control bits:
687 * bits 9:12 == 0 ... only checking up to four byte addresses (v7 only)
688 * bits 15:14 == 0 ... both secure and nonsecure states (v6.1+ only)
689 * bit 20 == 0 ... not linked to a context ID
690 * bit 28:24 == 0 ... not ignoring N LSBs (v7 only)
693 dpm->dwp[index].wp = wp;
694 dpm->dwp[index].control = control;
695 dpm->dwp[index].dirty = true;
697 /* hardware is updated in write_dirty_registers() */
702 static int dpm_add_watchpoint(struct target *target, struct watchpoint *wp)
704 struct arm *arm = target_to_arm(target);
705 struct arm_dpm *dpm = arm->dpm;
706 int retval = ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
708 if (dpm->bpwp_enable) {
709 for (unsigned i = 0; i < dpm->nwp; i++) {
710 if (!dpm->dwp[i].wp) {
711 retval = dpm_watchpoint_setup(dpm, i, wp);
720 static int dpm_remove_watchpoint(struct target *target, struct watchpoint *wp)
722 struct arm *arm = target_to_arm(target);
723 struct arm_dpm *dpm = arm->dpm;
724 int retval = ERROR_INVALID_ARGUMENTS;
726 for (unsigned i = 0; i < dpm->nwp; i++) {
727 if (dpm->dwp[i].wp == wp) {
728 dpm->dwp[i].wp = NULL;
729 dpm->dwp[i].dirty = true;
731 /* hardware is updated in write_dirty_registers() */
740 void arm_dpm_report_wfar(struct arm_dpm *dpm, uint32_t addr)
742 switch (dpm->arm->core_state) {
743 case ARMV4_5_STATE_ARM:
746 case ARMV4_5_STATE_THUMB:
747 case ARM_STATE_THUMB_EE:
750 case ARMV4_5_STATE_JAZELLE:
757 /*----------------------------------------------------------------------*/
760 * Other debug and support utilities
763 void arm_dpm_report_dscr(struct arm_dpm *dpm, uint32_t dscr)
765 struct target *target = dpm->arm->target;
769 /* Examine debug reason */
770 switch (DSCR_ENTRY(dscr)) {
771 case 6: /* Data abort (v6 only) */
772 case 7: /* Prefetch abort (v6 only) */
773 /* FALL THROUGH -- assume a v6 core in abort mode */
774 case 0: /* HALT request from debugger */
776 target->debug_reason = DBG_REASON_DBGRQ;
778 case 1: /* HW breakpoint */
779 case 3: /* SW BKPT */
780 case 5: /* vector catch */
781 target->debug_reason = DBG_REASON_BREAKPOINT;
783 case 2: /* asynch watchpoint */
784 case 10: /* precise watchpoint */
785 target->debug_reason = DBG_REASON_WATCHPOINT;
788 target->debug_reason = DBG_REASON_UNDEFINED;
793 /*----------------------------------------------------------------------*/
796 * Setup and management support.
800 * Hooks up this DPM to its associated target; call only once.
801 * Initially this only covers the register cache.
803 * Oh, and watchpoints. Yeah.
805 int arm_dpm_setup(struct arm_dpm *dpm)
807 struct arm *arm = dpm->arm;
808 struct target *target = arm->target;
809 struct reg_cache *cache;
813 /* register access setup */
814 arm->full_context = arm_dpm_full_context;
815 arm->read_core_reg = arm_dpm_read_core_reg;
816 arm->write_core_reg = arm_dpm_write_core_reg;
818 cache = armv4_5_build_reg_cache(target, arm);
822 *register_get_last_cache_p(&target->reg_cache) = cache;
824 /* coprocessor access setup */
828 /* breakpoint and watchpoint setup */
829 target->type->add_watchpoint = dpm_add_watchpoint;
830 target->type->remove_watchpoint = dpm_remove_watchpoint;
832 /* FIXME add breakpoint support */
833 /* FIXME add vector catch support */
835 dpm->nbp = 1 + ((dpm->didr >> 24) & 0xf);
836 dpm->dbp = calloc(dpm->nbp, sizeof *dpm->dbp);
838 dpm->nwp = 1 + ((dpm->didr >> 28) & 0xf);
839 dpm->dwp = calloc(dpm->nwp, sizeof *dpm->dwp);
841 if (!dpm->dbp || !dpm->dwp) {
847 LOG_INFO("%s: hardware has %d breakpoints, %d watchpoints",
848 target_name(target), dpm->nbp, dpm->nwp);
850 /* REVISIT ... and some of those breakpoints could match
851 * execution context IDs...
858 * Reinitializes DPM state at the beginning of a new debug session
859 * or after a reset which may have affected the debug module.
861 int arm_dpm_initialize(struct arm_dpm *dpm)
863 /* Disable all breakpoints and watchpoints at startup. */
864 if (dpm->bpwp_disable) {
867 for (i = 0; i < dpm->nbp; i++)
868 (void) dpm->bpwp_disable(dpm, i);
869 for (i = 0; i < dpm->nwp; i++)
870 (void) dpm->bpwp_disable(dpm, 16 + i);
872 LOG_WARNING("%s: can't disable breakpoints and watchpoints",
873 target_name(dpm->arm->target));