1 /***************************************************************************
2 * Copyright (C) 2005 by Dominic Rath *
3 * Dominic.Rath@gmx.de *
5 * Copyright (C) 2008 by Spencer Oliver *
6 * spen@spen-soft.co.uk *
8 * Copyright (C) 2008 by Oyvind Harboe *
9 * oyvind.harboe@zylin.com *
11 * This program is free software; you can redistribute it and/or modify *
12 * it under the terms of the GNU General Public License as published by *
13 * the Free Software Foundation; either version 2 of the License, or *
14 * (at your option) any later version. *
16 * This program is distributed in the hope that it will be useful, *
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
19 * GNU General Public License for more details. *
21 * You should have received a copy of the GNU General Public License *
22 * along with this program; if not, write to the *
23 * Free Software Foundation, Inc., *
24 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
25 ***************************************************************************/
33 #include "breakpoints.h"
34 #include "arm_disassembler.h"
35 #include <helper/binarybuffer.h>
36 #include "algorithm.h"
40 /* offsets into armv4_5 core register cache */
43 ARMV4_5_SPSR_FIQ = 32,
44 ARMV4_5_SPSR_IRQ = 33,
45 ARMV4_5_SPSR_SVC = 34,
46 ARMV4_5_SPSR_ABT = 35,
47 ARMV4_5_SPSR_UND = 36,
51 static const uint8_t arm_usr_indices[17] = {
52 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, ARMV4_5_CPSR,
55 static const uint8_t arm_fiq_indices[8] = {
56 16, 17, 18, 19, 20, 21, 22, ARMV4_5_SPSR_FIQ,
59 static const uint8_t arm_irq_indices[3] = {
60 23, 24, ARMV4_5_SPSR_IRQ,
63 static const uint8_t arm_svc_indices[3] = {
64 25, 26, ARMV4_5_SPSR_SVC,
67 static const uint8_t arm_abt_indices[3] = {
68 27, 28, ARMV4_5_SPSR_ABT,
71 static const uint8_t arm_und_indices[3] = {
72 29, 30, ARMV4_5_SPSR_UND,
75 static const uint8_t arm_mon_indices[3] = {
82 /* For user and system modes, these list indices for all registers.
83 * otherwise they're just indices for the shadow registers and SPSR.
85 unsigned short n_indices;
86 const uint8_t *indices;
88 /* Seven modes are standard from ARM7 on. "System" and "User" share
89 * the same registers; other modes shadow from 3 to 8 registers.
94 .n_indices = ARRAY_SIZE(arm_usr_indices),
95 .indices = arm_usr_indices,
100 .n_indices = ARRAY_SIZE(arm_fiq_indices),
101 .indices = arm_fiq_indices,
104 .name = "Supervisor",
106 .n_indices = ARRAY_SIZE(arm_svc_indices),
107 .indices = arm_svc_indices,
112 .n_indices = ARRAY_SIZE(arm_abt_indices),
113 .indices = arm_abt_indices,
118 .n_indices = ARRAY_SIZE(arm_irq_indices),
119 .indices = arm_irq_indices,
122 .name = "Undefined instruction",
124 .n_indices = ARRAY_SIZE(arm_und_indices),
125 .indices = arm_und_indices,
130 .n_indices = ARRAY_SIZE(arm_usr_indices),
131 .indices = arm_usr_indices,
133 /* TrustZone "Security Extensions" add a secure monitor mode.
134 * This is distinct from a "debug monitor" which can support
135 * non-halting debug, in conjunction with some debuggers.
138 .name = "Secure Monitor",
140 .n_indices = ARRAY_SIZE(arm_mon_indices),
141 .indices = arm_mon_indices,
145 /** Map PSR mode bits to the name of an ARM processor operating mode. */
146 const char *arm_mode_name(unsigned psr_mode)
148 for (unsigned i = 0; i < ARRAY_SIZE(arm_mode_data); i++) {
149 if (arm_mode_data[i].psr == psr_mode)
150 return arm_mode_data[i].name;
152 LOG_ERROR("unrecognized psr mode: %#02x", psr_mode);
153 return "UNRECOGNIZED";
156 /** Return true iff the parameter denotes a valid ARM processor mode. */
157 bool is_arm_mode(unsigned psr_mode)
159 for (unsigned i = 0; i < ARRAY_SIZE(arm_mode_data); i++) {
160 if (arm_mode_data[i].psr == psr_mode)
166 /** Map PSR mode bits to linear number indexing armv4_5_core_reg_map */
167 int arm_mode_to_number(enum arm_mode mode)
171 /* map MODE_ANY to user mode */
189 LOG_ERROR("invalid mode value encountered %d", mode);
194 /** Map linear number indexing armv4_5_core_reg_map to PSR mode bits. */
195 enum arm_mode armv4_5_number_to_mode(int number)
215 LOG_ERROR("mode index out of bounds %d", number);
220 static const char *arm_state_strings[] =
222 "ARM", "Thumb", "Jazelle", "ThumbEE",
225 /* Templates for ARM core registers.
227 * NOTE: offsets in this table are coupled to the arm_mode_data
228 * table above, the armv4_5_core_reg_map array below, and also to
229 * the ARMV4_5_CPSR symbol (which should vanish after ARM11 updates).
231 static const struct {
232 /* The name is used for e.g. the "regs" command. */
235 /* The {cookie, mode} tuple uniquely identifies one register.
236 * In a given mode, cookies 0..15 map to registers R0..R15,
237 * with R13..R15 usually called SP, LR, PC.
239 * MODE_ANY is used as *input* to the mapping, and indicates
240 * various special cases (sigh) and errors.
242 * Cookie 16 is (currently) confusing, since it indicates
243 * CPSR -or- SPSR depending on whether 'mode' is MODE_ANY.
244 * (Exception modes have both CPSR and SPSR registers ...)
248 } arm_core_regs[] = {
249 /* IMPORTANT: we guarantee that the first eight cached registers
250 * correspond to r0..r7, and the fifteenth to PC, so that callers
251 * don't need to map them.
253 { .name = "r0", .cookie = 0, .mode = ARM_MODE_ANY, },
254 { .name = "r1", .cookie = 1, .mode = ARM_MODE_ANY, },
255 { .name = "r2", .cookie = 2, .mode = ARM_MODE_ANY, },
256 { .name = "r3", .cookie = 3, .mode = ARM_MODE_ANY, },
257 { .name = "r4", .cookie = 4, .mode = ARM_MODE_ANY, },
258 { .name = "r5", .cookie = 5, .mode = ARM_MODE_ANY, },
259 { .name = "r6", .cookie = 6, .mode = ARM_MODE_ANY, },
260 { .name = "r7", .cookie = 7, .mode = ARM_MODE_ANY, },
262 /* NOTE: regs 8..12 might be shadowed by FIQ ... flagging
263 * them as MODE_ANY creates special cases. (ANY means
264 * "not mapped" elsewhere; here it's "everything but FIQ".)
266 { .name = "r8", .cookie = 8, .mode = ARM_MODE_ANY, },
267 { .name = "r9", .cookie = 9, .mode = ARM_MODE_ANY, },
268 { .name = "r10", .cookie = 10, .mode = ARM_MODE_ANY, },
269 { .name = "r11", .cookie = 11, .mode = ARM_MODE_ANY, },
270 { .name = "r12", .cookie = 12, .mode = ARM_MODE_ANY, },
272 /* NOTE all MODE_USR registers are equivalent to MODE_SYS ones */
273 { .name = "sp_usr", .cookie = 13, .mode = ARM_MODE_USR, },
274 { .name = "lr_usr", .cookie = 14, .mode = ARM_MODE_USR, },
276 /* guaranteed to be at index 15 */
277 { .name = "pc", .cookie = 15, .mode = ARM_MODE_ANY, },
279 { .name = "r8_fiq", .cookie = 8, .mode = ARM_MODE_FIQ, },
280 { .name = "r9_fiq", .cookie = 9, .mode = ARM_MODE_FIQ, },
281 { .name = "r10_fiq", .cookie = 10, .mode = ARM_MODE_FIQ, },
282 { .name = "r11_fiq", .cookie = 11, .mode = ARM_MODE_FIQ, },
283 { .name = "r12_fiq", .cookie = 12, .mode = ARM_MODE_FIQ, },
285 { .name = "sp_fiq", .cookie = 13, .mode = ARM_MODE_FIQ, },
286 { .name = "lr_fiq", .cookie = 14, .mode = ARM_MODE_FIQ, },
288 { .name = "sp_irq", .cookie = 13, .mode = ARM_MODE_IRQ, },
289 { .name = "lr_irq", .cookie = 14, .mode = ARM_MODE_IRQ, },
291 { .name = "sp_svc", .cookie = 13, .mode = ARM_MODE_SVC, },
292 { .name = "lr_svc", .cookie = 14, .mode = ARM_MODE_SVC, },
294 { .name = "sp_abt", .cookie = 13, .mode = ARM_MODE_ABT, },
295 { .name = "lr_abt", .cookie = 14, .mode = ARM_MODE_ABT, },
297 { .name = "sp_und", .cookie = 13, .mode = ARM_MODE_UND, },
298 { .name = "lr_und", .cookie = 14, .mode = ARM_MODE_UND, },
300 { .name = "cpsr", .cookie = 16, .mode = ARM_MODE_ANY, },
301 { .name = "spsr_fiq", .cookie = 16, .mode = ARM_MODE_FIQ, },
302 { .name = "spsr_irq", .cookie = 16, .mode = ARM_MODE_IRQ, },
303 { .name = "spsr_svc", .cookie = 16, .mode = ARM_MODE_SVC, },
304 { .name = "spsr_abt", .cookie = 16, .mode = ARM_MODE_ABT, },
305 { .name = "spsr_und", .cookie = 16, .mode = ARM_MODE_UND, },
307 { .name = "sp_mon", .cookie = 13, .mode = ARM_MODE_MON, },
308 { .name = "lr_mon", .cookie = 14, .mode = ARM_MODE_MON, },
309 { .name = "spsr_mon", .cookie = 16, .mode = ARM_MODE_MON, },
312 /* map core mode (USR, FIQ, ...) and register number to
313 * indices into the register cache
315 const int armv4_5_core_reg_map[8][17] =
318 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 31
320 { /* FIQ (8 shadows of USR, vs normal 3) */
321 0, 1, 2, 3, 4, 5, 6, 7, 16, 17, 18, 19, 20, 21, 22, 15, 32
324 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 23, 24, 15, 33
327 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 25, 26, 15, 34
330 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 27, 28, 15, 35
333 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 29, 30, 15, 36
335 { /* SYS (same registers as USR) */
336 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 31
339 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 37, 38, 15, 39,
344 * Configures host-side ARM records to reflect the specified CPSR.
345 * Later, code can use arm_reg_current() to map register numbers
346 * according to how they are exposed by this mode.
348 void arm_set_cpsr(struct arm *arm, uint32_t cpsr)
350 enum arm_mode mode = cpsr & 0x1f;
353 /* NOTE: this may be called very early, before the register
354 * cache is set up. We can't defend against many errors, in
355 * particular against CPSRs that aren't valid *here* ...
358 buf_set_u32(arm->cpsr->value, 0, 32, cpsr);
359 arm->cpsr->valid = 1;
360 arm->cpsr->dirty = 0;
363 arm->core_mode = mode;
365 /* mode_to_number() warned; set up a somewhat-sane mapping */
366 num = arm_mode_to_number(mode);
372 arm->map = &armv4_5_core_reg_map[num][0];
373 arm->spsr = (mode == ARM_MODE_USR || mode == ARM_MODE_SYS)
375 : arm->core_cache->reg_list + arm->map[16];
377 /* Older ARMs won't have the J bit */
378 enum arm_state state;
380 if (cpsr & (1 << 5)) { /* T */
381 if (cpsr & (1 << 24)) { /* J */
382 LOG_WARNING("ThumbEE -- incomplete support");
383 state = ARM_STATE_THUMB_EE;
385 state = ARM_STATE_THUMB;
387 if (cpsr & (1 << 24)) { /* J */
388 LOG_ERROR("Jazelle state handling is BROKEN!");
389 state = ARM_STATE_JAZELLE;
391 state = ARM_STATE_ARM;
393 arm->core_state = state;
395 LOG_DEBUG("set CPSR %#8.8x: %s mode, %s state", (unsigned) cpsr,
397 arm_state_strings[arm->core_state]);
401 * Returns handle to the register currently mapped to a given number.
402 * Someone must have called arm_set_cpsr() before.
404 * \param arm This core's state and registers are used.
405 * \param regnum From 0..15 corresponding to R0..R14 and PC.
406 * Note that R0..R7 don't require mapping; you may access those
407 * as the first eight entries in the register cache. Likewise
408 * R15 (PC) doesn't need mapping; you may also access it directly.
409 * However, R8..R14, and SPSR (arm->spsr) *must* be mapped.
410 * CPSR (arm->cpsr) is also not mapped.
412 struct reg *arm_reg_current(struct arm *arm, unsigned regnum)
419 r = arm->core_cache->reg_list + arm->map[regnum];
421 /* e.g. invalid CPSR said "secure monitor" mode on a core
422 * that doesn't support it...
425 LOG_ERROR("Invalid CPSR mode");
426 r = arm->core_cache->reg_list + regnum;
432 static const uint8_t arm_gdb_dummy_fp_value[12];
435 * Dummy FPA registers are required to support GDB on ARM.
436 * Register packets require eight obsolete FPA register values.
437 * Modern ARM cores use Vector Floating Point (VFP), if they
438 * have any floating point support. VFP is not FPA-compatible.
440 struct reg arm_gdb_dummy_fp_reg =
442 .name = "GDB dummy FPA register",
443 .value = (uint8_t *) arm_gdb_dummy_fp_value,
448 static const uint8_t arm_gdb_dummy_fps_value[4];
451 * Dummy FPA status registers are required to support GDB on ARM.
452 * Register packets require an obsolete FPA status register.
454 struct reg arm_gdb_dummy_fps_reg =
456 .name = "GDB dummy FPA status register",
457 .value = (uint8_t *) arm_gdb_dummy_fps_value,
462 static void arm_gdb_dummy_init(void) __attribute__ ((constructor));
464 static void arm_gdb_dummy_init(void)
466 register_init_dummy(&arm_gdb_dummy_fp_reg);
467 register_init_dummy(&arm_gdb_dummy_fps_reg);
470 static int armv4_5_get_core_reg(struct reg *reg)
473 struct arm_reg *armv4_5 = reg->arch_info;
474 struct target *target = armv4_5->target;
476 if (target->state != TARGET_HALTED)
478 LOG_ERROR("Target not halted");
479 return ERROR_TARGET_NOT_HALTED;
482 retval = armv4_5->armv4_5_common->read_core_reg(target, reg, armv4_5->num, armv4_5->mode);
483 if (retval == ERROR_OK) {
491 static int armv4_5_set_core_reg(struct reg *reg, uint8_t *buf)
493 struct arm_reg *armv4_5 = reg->arch_info;
494 struct target *target = armv4_5->target;
495 struct arm *armv4_5_target = target_to_arm(target);
496 uint32_t value = buf_get_u32(buf, 0, 32);
498 if (target->state != TARGET_HALTED)
500 LOG_ERROR("Target not halted");
501 return ERROR_TARGET_NOT_HALTED;
504 /* Except for CPSR, the "reg" command exposes a writeback model
505 * for the register cache.
507 if (reg == armv4_5_target->cpsr) {
508 arm_set_cpsr(armv4_5_target, value);
510 /* Older cores need help to be in ARM mode during halt
511 * mode debug, so we clear the J and T bits if we flush.
512 * For newer cores (v6/v7a/v7r) we don't need that, but
513 * it won't hurt since CPSR is always flushed anyway.
515 if (armv4_5_target->core_mode !=
516 (enum arm_mode)(value & 0x1f)) {
517 LOG_DEBUG("changing ARM core mode to '%s'",
518 arm_mode_name(value & 0x1f));
519 value &= ~((1 << 24) | (1 << 5));
520 armv4_5_target->write_core_reg(target, reg,
521 16, ARM_MODE_ANY, value);
524 buf_set_u32(reg->value, 0, 32, value);
532 static const struct reg_arch_type arm_reg_type = {
533 .get = armv4_5_get_core_reg,
534 .set = armv4_5_set_core_reg,
537 struct reg_cache *arm_build_reg_cache(struct target *target, struct arm *arm)
539 int num_regs = ARRAY_SIZE(arm_core_regs);
540 struct reg_cache *cache = malloc(sizeof(struct reg_cache));
541 struct reg *reg_list = calloc(num_regs, sizeof(struct reg));
542 struct arm_reg *arch_info = calloc(num_regs, sizeof(struct arm_reg));
545 if (!cache || !reg_list || !arch_info) {
552 cache->name = "ARM registers";
554 cache->reg_list = reg_list;
557 for (i = 0; i < num_regs; i++)
559 /* Skip registers this core doesn't expose */
560 if (arm_core_regs[i].mode == ARM_MODE_MON
561 && arm->core_type != ARM_MODE_MON)
564 /* REVISIT handle Cortex-M, which only shadows R13/SP */
566 arch_info[i].num = arm_core_regs[i].cookie;
567 arch_info[i].mode = arm_core_regs[i].mode;
568 arch_info[i].target = target;
569 arch_info[i].armv4_5_common = arm;
571 reg_list[i].name = (char *) arm_core_regs[i].name;
572 reg_list[i].size = 32;
573 reg_list[i].value = &arch_info[i].value;
574 reg_list[i].type = &arm_reg_type;
575 reg_list[i].arch_info = &arch_info[i];
580 arm->pc = reg_list + 15;
581 arm->cpsr = reg_list + ARMV4_5_CPSR;
582 arm->core_cache = cache;
586 int arm_arch_state(struct target *target)
588 struct arm *armv4_5 = target_to_arm(target);
590 if (armv4_5->common_magic != ARM_COMMON_MAGIC)
592 LOG_ERROR("BUG: called for a non-ARM target");
596 LOG_USER("target halted in %s state due to %s, current mode: %s\n"
597 "cpsr: 0x%8.8" PRIx32 " pc: 0x%8.8" PRIx32 "%s",
598 arm_state_strings[armv4_5->core_state],
599 debug_reason_name(target),
600 arm_mode_name(armv4_5->core_mode),
601 buf_get_u32(armv4_5->cpsr->value, 0, 32),
602 buf_get_u32(armv4_5->pc->value, 0, 32),
603 armv4_5->is_semihosting ? ", semihosting" : "");
608 #define ARMV4_5_CORE_REG_MODENUM(cache, mode, num) \
609 cache->reg_list[armv4_5_core_reg_map[mode][num]]
611 COMMAND_HANDLER(handle_armv4_5_reg_command)
613 struct target *target = get_current_target(CMD_CTX);
614 struct arm *armv4_5 = target_to_arm(target);
617 if (!is_arm(armv4_5))
619 command_print(CMD_CTX, "current target isn't an ARM");
623 if (target->state != TARGET_HALTED)
625 command_print(CMD_CTX, "error: target must be halted for register accesses");
629 if (armv4_5->core_type != ARM_MODE_ANY)
631 command_print(CMD_CTX, "Microcontroller Profile not supported - use standard reg cmd");
635 if (!is_arm_mode(armv4_5->core_mode))
637 LOG_ERROR("not a valid arm core mode - communication failure?");
641 if (!armv4_5->full_context) {
642 command_print(CMD_CTX, "error: target doesn't support %s",
647 regs = armv4_5->core_cache->reg_list;
649 for (unsigned mode = 0; mode < ARRAY_SIZE(arm_mode_data); mode++) {
654 /* label this bank of registers (or shadows) */
655 switch (arm_mode_data[mode].psr) {
659 name = "System and User";
663 if (armv4_5->core_type != ARM_MODE_MON)
667 name = arm_mode_data[mode].name;
671 command_print(CMD_CTX, "%s%s mode %sregisters",
674 /* display N rows of up to 4 registers each */
675 for (unsigned i = 0; i < arm_mode_data[mode].n_indices;) {
679 for (unsigned j = 0; j < 4; j++, i++) {
681 struct reg *reg = regs;
683 if (i >= arm_mode_data[mode].n_indices)
686 reg += arm_mode_data[mode].indices[i];
688 /* REVISIT be smarter about faults... */
690 armv4_5->full_context(target);
692 value = buf_get_u32(reg->value, 0, 32);
693 output_len += snprintf(output + output_len,
694 sizeof(output) - output_len,
695 "%8s: %8.8" PRIx32 " ",
698 command_print(CMD_CTX, "%s", output);
705 COMMAND_HANDLER(handle_armv4_5_core_state_command)
707 struct target *target = get_current_target(CMD_CTX);
708 struct arm *armv4_5 = target_to_arm(target);
710 if (!is_arm(armv4_5))
712 command_print(CMD_CTX, "current target isn't an ARM");
716 if (armv4_5->core_type == ARM_MODE_THREAD)
718 /* armv7m not supported */
719 command_print(CMD_CTX, "Unsupported Command");
725 if (strcmp(CMD_ARGV[0], "arm") == 0)
727 armv4_5->core_state = ARM_STATE_ARM;
729 if (strcmp(CMD_ARGV[0], "thumb") == 0)
731 armv4_5->core_state = ARM_STATE_THUMB;
735 command_print(CMD_CTX, "core state: %s", arm_state_strings[armv4_5->core_state]);
740 COMMAND_HANDLER(handle_arm_disassemble_command)
742 int retval = ERROR_OK;
743 struct target *target = get_current_target(CMD_CTX);
745 if (target == NULL) {
746 LOG_ERROR("No target selected");
750 struct arm *arm = target_to_arm(target);
756 command_print(CMD_CTX, "current target isn't an ARM");
760 if (arm->core_type == ARM_MODE_THREAD)
762 /* armv7m is always thumb mode */
768 if (strcmp(CMD_ARGV[2], "thumb") != 0)
773 COMMAND_PARSE_NUMBER(int, CMD_ARGV[1], count);
776 COMMAND_PARSE_NUMBER(u32, CMD_ARGV[0], address);
777 if (address & 0x01) {
779 command_print(CMD_CTX, "Disassemble as Thumb");
788 retval = ERROR_COMMAND_SYNTAX_ERROR;
791 while (count-- > 0) {
792 struct arm_instruction cur_instruction;
795 /* Always use Thumb2 disassembly for best handling
796 * of 32-bit BL/BLX, and to work with newer cores
797 * (some ARMv6, all ARMv7) that use Thumb2.
799 retval = thumb2_opcode(target, address,
801 if (retval != ERROR_OK)
806 retval = target_read_u32(target, address, &opcode);
807 if (retval != ERROR_OK)
809 retval = arm_evaluate_opcode(opcode, address,
810 &cur_instruction) != ERROR_OK;
811 if (retval != ERROR_OK)
814 command_print(CMD_CTX, "%s", cur_instruction.text);
815 address += cur_instruction.instruction_size;
821 static int jim_mcrmrc(Jim_Interp *interp, int argc, Jim_Obj *const *argv)
823 struct command_context *context;
824 struct target *target;
828 context = current_command_context(interp);
829 assert( context != NULL);
831 target = get_current_target(context);
832 if (target == NULL) {
833 LOG_ERROR("%s: no current target", __func__);
836 if (!target_was_examined(target)) {
837 LOG_ERROR("%s: not yet examined", target_name(target));
840 arm = target_to_arm(target);
842 LOG_ERROR("%s: not an ARM", target_name(target));
846 if ((argc < 6) || (argc > 7)) {
847 /* FIXME use the command name to verify # params... */
848 LOG_ERROR("%s: wrong number of arguments", __func__);
860 /* NOTE: parameter sequence matches ARM instruction set usage:
861 * MCR pNUM, op1, rX, CRn, CRm, op2 ; write CP from rX
862 * MRC pNUM, op1, rX, CRn, CRm, op2 ; read CP into rX
863 * The "rX" is necessarily omitted; it uses Tcl mechanisms.
865 retval = Jim_GetLong(interp, argv[1], &l);
866 if (retval != JIM_OK)
869 LOG_ERROR("%s: %s %d out of range", __func__,
870 "coprocessor", (int) l);
875 retval = Jim_GetLong(interp, argv[2], &l);
876 if (retval != JIM_OK)
879 LOG_ERROR("%s: %s %d out of range", __func__,
885 retval = Jim_GetLong(interp, argv[3], &l);
886 if (retval != JIM_OK)
889 LOG_ERROR("%s: %s %d out of range", __func__,
895 retval = Jim_GetLong(interp, argv[4], &l);
896 if (retval != JIM_OK)
899 LOG_ERROR("%s: %s %d out of range", __func__,
905 retval = Jim_GetLong(interp, argv[5], &l);
906 if (retval != JIM_OK)
909 LOG_ERROR("%s: %s %d out of range", __func__,
917 /* FIXME don't assume "mrc" vs "mcr" from the number of params;
918 * that could easily be a typo! Check both...
920 * FIXME change the call syntax here ... simplest to just pass
921 * the MRC() or MCR() instruction to be executed. That will also
922 * let us support the "mrc2" and "mcr2" opcodes (toggling one bit)
923 * if that's ever needed.
926 retval = Jim_GetLong(interp, argv[6], &l);
927 if (retval != JIM_OK) {
932 /* NOTE: parameters reordered! */
933 // ARMV4_5_MCR(cpnum, op1, 0, CRn, CRm, op2)
934 retval = arm->mcr(target, cpnum, op1, op2, CRn, CRm, value);
935 if (retval != ERROR_OK)
938 /* NOTE: parameters reordered! */
939 // ARMV4_5_MRC(cpnum, op1, 0, CRn, CRm, op2)
940 retval = arm->mrc(target, cpnum, op1, op2, CRn, CRm, &value);
941 if (retval != ERROR_OK)
944 Jim_SetResult(interp, Jim_NewIntObj(interp, value));
950 COMMAND_HANDLER(handle_arm_semihosting_command)
952 struct target *target = get_current_target(CMD_CTX);
954 if (target == NULL) {
955 LOG_ERROR("No target selected");
959 struct arm *arm = target_to_arm(target);
962 command_print(CMD_CTX, "current target isn't an ARM");
966 if (!arm->setup_semihosting)
968 command_print(CMD_CTX, "semihosting not supported for current target");
976 COMMAND_PARSE_ENABLE(CMD_ARGV[0], semihosting);
978 if (!target_was_examined(target))
980 LOG_ERROR("Target not examined yet");
984 if (arm->setup_semihosting(target, semihosting) != ERROR_OK) {
985 LOG_ERROR("Failed to Configure semihosting");
989 /* FIXME never let that "catch" be dropped! */
990 arm->is_semihosting = semihosting;
993 command_print(CMD_CTX, "semihosting is %s",
995 ? "enabled" : "disabled");
1000 static const struct command_registration arm_exec_command_handlers[] = {
1003 .handler = handle_armv4_5_reg_command,
1004 .mode = COMMAND_EXEC,
1005 .help = "display ARM core registers",
1008 .name = "core_state",
1009 .handler = handle_armv4_5_core_state_command,
1010 .mode = COMMAND_EXEC,
1011 .usage = "['arm'|'thumb']",
1012 .help = "display/change ARM core state",
1015 .name = "disassemble",
1016 .handler = handle_arm_disassemble_command,
1017 .mode = COMMAND_EXEC,
1018 .usage = "address [count ['thumb']]",
1019 .help = "disassemble instructions ",
1023 .mode = COMMAND_EXEC,
1024 .jim_handler = &jim_mcrmrc,
1025 .help = "write coprocessor register",
1026 .usage = "cpnum op1 CRn op2 CRm value",
1030 .jim_handler = &jim_mcrmrc,
1031 .help = "read coprocessor register",
1032 .usage = "cpnum op1 CRn op2 CRm",
1036 .handler = handle_arm_semihosting_command,
1037 .mode = COMMAND_EXEC,
1038 .usage = "['enable'|'disable']",
1039 .help = "activate support for semihosting operations",
1042 COMMAND_REGISTRATION_DONE
1044 const struct command_registration arm_command_handlers[] = {
1047 .mode = COMMAND_ANY,
1048 .help = "ARM command group",
1049 .chain = arm_exec_command_handlers,
1051 COMMAND_REGISTRATION_DONE
1054 int arm_get_gdb_reg_list(struct target *target,
1055 struct reg **reg_list[], int *reg_list_size)
1057 struct arm *armv4_5 = target_to_arm(target);
1060 if (!is_arm_mode(armv4_5->core_mode))
1062 LOG_ERROR("not a valid arm core mode - communication failure?");
1066 *reg_list_size = 26;
1067 *reg_list = malloc(sizeof(struct reg*) * (*reg_list_size));
1069 for (i = 0; i < 16; i++)
1070 (*reg_list)[i] = arm_reg_current(armv4_5, i);
1072 for (i = 16; i < 24; i++)
1073 (*reg_list)[i] = &arm_gdb_dummy_fp_reg;
1075 (*reg_list)[24] = &arm_gdb_dummy_fps_reg;
1076 (*reg_list)[25] = armv4_5->cpsr;
1081 /* wait for execution to complete and check exit point */
1082 static int armv4_5_run_algorithm_completion(struct target *target, uint32_t exit_point, int timeout_ms, void *arch_info)
1085 struct arm *armv4_5 = target_to_arm(target);
1087 if ((retval = target_wait_state(target, TARGET_HALTED, timeout_ms)) != ERROR_OK)
1091 if (target->state != TARGET_HALTED)
1093 if ((retval = target_halt(target)) != ERROR_OK)
1095 if ((retval = target_wait_state(target, TARGET_HALTED, 500)) != ERROR_OK)
1099 return ERROR_TARGET_TIMEOUT;
1102 /* fast exit: ARMv5+ code can use BKPT */
1103 if (exit_point && buf_get_u32(armv4_5->pc->value, 0, 32) != exit_point)
1105 LOG_WARNING("target reentered debug state, but not at the desired exit point: 0x%4.4" PRIx32 "",
1106 buf_get_u32(armv4_5->pc->value, 0, 32));
1107 return ERROR_TARGET_TIMEOUT;
1113 int armv4_5_run_algorithm_inner(struct target *target,
1114 int num_mem_params, struct mem_param *mem_params,
1115 int num_reg_params, struct reg_param *reg_params,
1116 uint32_t entry_point, uint32_t exit_point,
1117 int timeout_ms, void *arch_info,
1118 int (*run_it)(struct target *target, uint32_t exit_point,
1119 int timeout_ms, void *arch_info))
1121 struct arm *armv4_5 = target_to_arm(target);
1122 struct arm_algorithm *arm_algorithm_info = arch_info;
1123 enum arm_state core_state = armv4_5->core_state;
1124 uint32_t context[17];
1126 int exit_breakpoint_size = 0;
1128 int retval = ERROR_OK;
1130 LOG_DEBUG("Running algorithm");
1132 if (arm_algorithm_info->common_magic != ARM_COMMON_MAGIC)
1134 LOG_ERROR("current target isn't an ARMV4/5 target");
1135 return ERROR_TARGET_INVALID;
1138 if (target->state != TARGET_HALTED)
1140 LOG_WARNING("target not halted");
1141 return ERROR_TARGET_NOT_HALTED;
1144 if (!is_arm_mode(armv4_5->core_mode))
1146 LOG_ERROR("not a valid arm core mode - communication failure?");
1150 /* armv5 and later can terminate with BKPT instruction; less overhead */
1151 if (!exit_point && armv4_5->is_armv4)
1153 LOG_ERROR("ARMv4 target needs HW breakpoint location");
1157 /* save r0..pc, cpsr-or-spsr, and then cpsr-for-sure;
1158 * they'll be restored later.
1160 for (i = 0; i <= 16; i++)
1164 r = &ARMV4_5_CORE_REG_MODE(armv4_5->core_cache,
1165 arm_algorithm_info->core_mode, i);
1167 armv4_5->read_core_reg(target, r, i,
1168 arm_algorithm_info->core_mode);
1169 context[i] = buf_get_u32(r->value, 0, 32);
1171 cpsr = buf_get_u32(armv4_5->cpsr->value, 0, 32);
1173 for (i = 0; i < num_mem_params; i++)
1175 if ((retval = target_write_buffer(target, mem_params[i].address, mem_params[i].size, mem_params[i].value)) != ERROR_OK)
1181 for (i = 0; i < num_reg_params; i++)
1183 struct reg *reg = register_get_by_name(armv4_5->core_cache, reg_params[i].reg_name, 0);
1186 LOG_ERROR("BUG: register '%s' not found", reg_params[i].reg_name);
1187 return ERROR_COMMAND_SYNTAX_ERROR;
1190 if (reg->size != reg_params[i].size)
1192 LOG_ERROR("BUG: register '%s' size doesn't match reg_params[i].size", reg_params[i].reg_name);
1193 return ERROR_COMMAND_SYNTAX_ERROR;
1196 if ((retval = armv4_5_set_core_reg(reg, reg_params[i].value)) != ERROR_OK)
1202 armv4_5->core_state = arm_algorithm_info->core_state;
1203 if (armv4_5->core_state == ARM_STATE_ARM)
1204 exit_breakpoint_size = 4;
1205 else if (armv4_5->core_state == ARM_STATE_THUMB)
1206 exit_breakpoint_size = 2;
1209 LOG_ERROR("BUG: can't execute algorithms when not in ARM or Thumb state");
1210 return ERROR_COMMAND_SYNTAX_ERROR;
1213 if (arm_algorithm_info->core_mode != ARM_MODE_ANY)
1215 LOG_DEBUG("setting core_mode: 0x%2.2x",
1216 arm_algorithm_info->core_mode);
1217 buf_set_u32(armv4_5->cpsr->value, 0, 5,
1218 arm_algorithm_info->core_mode);
1219 armv4_5->cpsr->dirty = 1;
1220 armv4_5->cpsr->valid = 1;
1223 /* terminate using a hardware or (ARMv5+) software breakpoint */
1224 if (exit_point && (retval = breakpoint_add(target, exit_point,
1225 exit_breakpoint_size, BKPT_HARD)) != ERROR_OK)
1227 LOG_ERROR("can't add HW breakpoint to terminate algorithm");
1228 return ERROR_TARGET_FAILURE;
1231 if ((retval = target_resume(target, 0, entry_point, 1, 1)) != ERROR_OK)
1236 retval = run_it(target, exit_point, timeout_ms, arch_info);
1239 breakpoint_remove(target, exit_point);
1241 if (retval != ERROR_OK)
1244 for (i = 0; i < num_mem_params; i++)
1246 if (mem_params[i].direction != PARAM_OUT)
1247 if ((retvaltemp = target_read_buffer(target, mem_params[i].address, mem_params[i].size, mem_params[i].value)) != ERROR_OK)
1249 retval = retvaltemp;
1253 for (i = 0; i < num_reg_params; i++)
1255 if (reg_params[i].direction != PARAM_OUT)
1258 struct reg *reg = register_get_by_name(armv4_5->core_cache, reg_params[i].reg_name, 0);
1261 LOG_ERROR("BUG: register '%s' not found", reg_params[i].reg_name);
1262 retval = ERROR_COMMAND_SYNTAX_ERROR;
1266 if (reg->size != reg_params[i].size)
1268 LOG_ERROR("BUG: register '%s' size doesn't match reg_params[i].size", reg_params[i].reg_name);
1269 retval = ERROR_COMMAND_SYNTAX_ERROR;
1273 buf_set_u32(reg_params[i].value, 0, 32, buf_get_u32(reg->value, 0, 32));
1277 /* restore everything we saved before (17 or 18 registers) */
1278 for (i = 0; i <= 16; i++)
1281 regvalue = buf_get_u32(ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, arm_algorithm_info->core_mode, i).value, 0, 32);
1282 if (regvalue != context[i])
1284 LOG_DEBUG("restoring register %s with value 0x%8.8" PRIx32 "", ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, arm_algorithm_info->core_mode, i).name, context[i]);
1285 buf_set_u32(ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, arm_algorithm_info->core_mode, i).value, 0, 32, context[i]);
1286 ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, arm_algorithm_info->core_mode, i).valid = 1;
1287 ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, arm_algorithm_info->core_mode, i).dirty = 1;
1291 arm_set_cpsr(armv4_5, cpsr);
1292 armv4_5->cpsr->dirty = 1;
1294 armv4_5->core_state = core_state;
1299 int armv4_5_run_algorithm(struct target *target, int num_mem_params, struct mem_param *mem_params, int num_reg_params, struct reg_param *reg_params, uint32_t entry_point, uint32_t exit_point, int timeout_ms, void *arch_info)
1301 return armv4_5_run_algorithm_inner(target, num_mem_params, mem_params, num_reg_params, reg_params, entry_point, exit_point, timeout_ms, arch_info, armv4_5_run_algorithm_completion);
1305 * Runs ARM code in the target to calculate a CRC32 checksum.
1308 int arm_checksum_memory(struct target *target,
1309 uint32_t address, uint32_t count, uint32_t *checksum)
1311 struct working_area *crc_algorithm;
1312 struct arm_algorithm armv4_5_info;
1313 struct arm *armv4_5 = target_to_arm(target);
1314 struct reg_param reg_params[2];
1317 uint32_t exit_var = 0;
1319 /* see contib/loaders/checksum/armv4_5_crc.s for src */
1321 static const uint32_t arm_crc_code[] = {
1322 0xE1A02000, /* mov r2, r0 */
1323 0xE3E00000, /* mov r0, #0xffffffff */
1324 0xE1A03001, /* mov r3, r1 */
1325 0xE3A04000, /* mov r4, #0 */
1326 0xEA00000B, /* b ncomp */
1328 0xE7D21004, /* ldrb r1, [r2, r4] */
1329 0xE59F7030, /* ldr r7, CRC32XOR */
1330 0xE0200C01, /* eor r0, r0, r1, asl 24 */
1331 0xE3A05000, /* mov r5, #0 */
1333 0xE3500000, /* cmp r0, #0 */
1334 0xE1A06080, /* mov r6, r0, asl #1 */
1335 0xE2855001, /* add r5, r5, #1 */
1336 0xE1A00006, /* mov r0, r6 */
1337 0xB0260007, /* eorlt r0, r6, r7 */
1338 0xE3550008, /* cmp r5, #8 */
1339 0x1AFFFFF8, /* bne loop */
1340 0xE2844001, /* add r4, r4, #1 */
1342 0xE1540003, /* cmp r4, r3 */
1343 0x1AFFFFF1, /* bne nbyte */
1345 0xe1200070, /* bkpt #0 */
1347 0x04C11DB7 /* .word 0x04C11DB7 */
1350 retval = target_alloc_working_area(target,
1351 sizeof(arm_crc_code), &crc_algorithm);
1352 if (retval != ERROR_OK)
1355 /* convert code into a buffer in target endianness */
1356 for (i = 0; i < ARRAY_SIZE(arm_crc_code); i++) {
1357 retval = target_write_u32(target,
1358 crc_algorithm->address + i * sizeof(uint32_t),
1360 if (retval != ERROR_OK)
1364 armv4_5_info.common_magic = ARM_COMMON_MAGIC;
1365 armv4_5_info.core_mode = ARM_MODE_SVC;
1366 armv4_5_info.core_state = ARM_STATE_ARM;
1368 init_reg_param(®_params[0], "r0", 32, PARAM_IN_OUT);
1369 init_reg_param(®_params[1], "r1", 32, PARAM_OUT);
1371 buf_set_u32(reg_params[0].value, 0, 32, address);
1372 buf_set_u32(reg_params[1].value, 0, 32, count);
1374 /* 20 second timeout/megabyte */
1375 int timeout = 20000 * (1 + (count / (1024 * 1024)));
1377 /* armv4 must exit using a hardware breakpoint */
1378 if (armv4_5->is_armv4)
1379 exit_var = crc_algorithm->address + sizeof(arm_crc_code) - 8;
1381 retval = target_run_algorithm(target, 0, NULL, 2, reg_params,
1382 crc_algorithm->address,
1384 timeout, &armv4_5_info);
1385 if (retval != ERROR_OK) {
1386 LOG_ERROR("error executing ARM crc algorithm");
1387 destroy_reg_param(®_params[0]);
1388 destroy_reg_param(®_params[1]);
1389 target_free_working_area(target, crc_algorithm);
1393 *checksum = buf_get_u32(reg_params[0].value, 0, 32);
1395 destroy_reg_param(®_params[0]);
1396 destroy_reg_param(®_params[1]);
1398 target_free_working_area(target, crc_algorithm);
1404 * Runs ARM code in the target to check whether a memory block holds
1405 * all ones. NOR flash which has been erased, and thus may be written,
1409 int arm_blank_check_memory(struct target *target,
1410 uint32_t address, uint32_t count, uint32_t *blank)
1412 struct working_area *check_algorithm;
1413 struct reg_param reg_params[3];
1414 struct arm_algorithm armv4_5_info;
1415 struct arm *armv4_5 = target_to_arm(target);
1418 uint32_t exit_var = 0;
1420 static const uint32_t check_code[] = {
1422 0xe4d03001, /* ldrb r3, [r0], #1 */
1423 0xe0022003, /* and r2, r2, r3 */
1424 0xe2511001, /* subs r1, r1, #1 */
1425 0x1afffffb, /* bne loop */
1427 0xe1200070, /* bkpt #0 */
1430 /* make sure we have a working area */
1431 retval = target_alloc_working_area(target,
1432 sizeof(check_code), &check_algorithm);
1433 if (retval != ERROR_OK)
1436 /* convert code into a buffer in target endianness */
1437 for (i = 0; i < ARRAY_SIZE(check_code); i++) {
1438 retval = target_write_u32(target,
1439 check_algorithm->address
1440 + i * sizeof(uint32_t),
1442 if (retval != ERROR_OK)
1446 armv4_5_info.common_magic = ARM_COMMON_MAGIC;
1447 armv4_5_info.core_mode = ARM_MODE_SVC;
1448 armv4_5_info.core_state = ARM_STATE_ARM;
1450 init_reg_param(®_params[0], "r0", 32, PARAM_OUT);
1451 buf_set_u32(reg_params[0].value, 0, 32, address);
1453 init_reg_param(®_params[1], "r1", 32, PARAM_OUT);
1454 buf_set_u32(reg_params[1].value, 0, 32, count);
1456 init_reg_param(®_params[2], "r2", 32, PARAM_IN_OUT);
1457 buf_set_u32(reg_params[2].value, 0, 32, 0xff);
1459 /* armv4 must exit using a hardware breakpoint */
1460 if (armv4_5->is_armv4)
1461 exit_var = check_algorithm->address + sizeof(check_code) - 4;
1463 retval = target_run_algorithm(target, 0, NULL, 3, reg_params,
1464 check_algorithm->address,
1466 10000, &armv4_5_info);
1467 if (retval != ERROR_OK) {
1468 destroy_reg_param(®_params[0]);
1469 destroy_reg_param(®_params[1]);
1470 destroy_reg_param(®_params[2]);
1471 target_free_working_area(target, check_algorithm);
1475 *blank = buf_get_u32(reg_params[2].value, 0, 32);
1477 destroy_reg_param(®_params[0]);
1478 destroy_reg_param(®_params[1]);
1479 destroy_reg_param(®_params[2]);
1481 target_free_working_area(target, check_algorithm);
1486 static int arm_full_context(struct target *target)
1488 struct arm *armv4_5 = target_to_arm(target);
1489 unsigned num_regs = armv4_5->core_cache->num_regs;
1490 struct reg *reg = armv4_5->core_cache->reg_list;
1491 int retval = ERROR_OK;
1493 for (; num_regs && retval == ERROR_OK; num_regs--, reg++) {
1496 retval = armv4_5_get_core_reg(reg);
1501 static int arm_default_mrc(struct target *target, int cpnum,
1502 uint32_t op1, uint32_t op2,
1503 uint32_t CRn, uint32_t CRm,
1506 LOG_ERROR("%s doesn't implement MRC", target_type_name(target));
1510 static int arm_default_mcr(struct target *target, int cpnum,
1511 uint32_t op1, uint32_t op2,
1512 uint32_t CRn, uint32_t CRm,
1515 LOG_ERROR("%s doesn't implement MCR", target_type_name(target));
1519 int arm_init_arch_info(struct target *target, struct arm *armv4_5)
1521 target->arch_info = armv4_5;
1522 armv4_5->target = target;
1524 armv4_5->common_magic = ARM_COMMON_MAGIC;
1526 /* core_type may be overridden by subtype logic */
1527 if (armv4_5->core_type != ARM_MODE_THREAD) {
1528 armv4_5->core_type = ARM_MODE_ANY;
1529 arm_set_cpsr(armv4_5, ARM_MODE_USR);
1532 /* default full_context() has no core-specific optimizations */
1533 if (!armv4_5->full_context && armv4_5->read_core_reg)
1534 armv4_5->full_context = arm_full_context;
1537 armv4_5->mrc = arm_default_mrc;
1539 armv4_5->mcr = arm_default_mcr;