-/***************************************************************************\r
- * Copyright (C) 2008 digenius technology GmbH. *\r
- * *\r
- * This program is free software; you can redistribute it and/or modify *\r
- * it under the terms of the GNU General Public License as published by *\r
- * the Free Software Foundation; either version 2 of the License, or *\r
- * (at your option) any later version. *\r
- * *\r
- * This program is distributed in the hope that it will be useful, *\r
- * but WITHOUT ANY WARRANTY; without even the implied warranty of *\r
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *\r
- * GNU General Public License for more details. *\r
- * *\r
- * You should have received a copy of the GNU General Public License *\r
- * along with this program; if not, write to the *\r
- * Free Software Foundation, Inc., *\r
- * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *\r
- ***************************************************************************/\r
-\r
-#ifdef HAVE_CONFIG_H\r
-#include "config.h"\r
-#endif\r
-\r
-#include "arm11.h"\r
-#include "jtag.h"\r
-#include "log.h"\r
-\r
-#include <stdlib.h>\r
-#include <string.h>\r
-\r
-#if 0\r
-#define JTAG_DEBUG(expr ...) \\r
- do { \\r
- log_printf (LOG_DEBUG, __FILE__, __LINE__, __FUNCTION__, expr); \\r
- } while(0)\r
-#else\r
-#define JTAG_DEBUG(expr ...) \\r
- do {} while(0)\r
-#endif\r
-\r
-/** Code de-clutter: Construct scan_field_t to write out a value\r
- *\r
- * \param arm11 Target state variable.\r
- * \param num_bits Length of the data field\r
- * \param out_data pointer to the data that will be sent out\r
- * <em>(data is read when it is added to the JTAG queue)</em>\r
- * \param in_data pointer to the memory that will receive data that was clocked in\r
- * <em>(data is written when the JTAG queue is executed)</em>\r
- * \param field target data structure that will be initialized\r
- */\r
-void arm11_setup_field(arm11_common_t * arm11, int num_bits, void * out_data, void * in_data, scan_field_t * field)\r
-{\r
- field->device = arm11->jtag_info.chain_pos;\r
- field->num_bits = num_bits;\r
- field->out_mask = NULL;\r
- field->in_check_mask = NULL;\r
- field->in_check_value = NULL;\r
- field->in_handler = NULL;\r
- field->in_handler_priv = NULL;\r
-\r
- field->out_value = out_data;\r
- field->in_value = in_data;\r
-}\r
-\r
-\r
-/** Write JTAG instruction register\r
- *\r
- * \param arm11 Target state variable.\r
- * \param instr An ARM11 DBGTAP instruction. Use enum #arm11_instructions.\r
- * \param state Pass the final TAP state or -1 for the default value (Pause-IR).\r
- *\r
- * \remarks This adds to the JTAG command queue but does \em not execute it.\r
- */\r
-void arm11_add_IR(arm11_common_t * arm11, u8 instr, enum tap_state state)\r
-{\r
- jtag_device_t *device = jtag_get_device(arm11->jtag_info.chain_pos);\r
-\r
- if (buf_get_u32(device->cur_instr, 0, 5) == instr)\r
- {\r
- JTAG_DEBUG("IR <= 0x%02x SKIPPED", instr);\r
- return;\r
- }\r
-\r
- JTAG_DEBUG("IR <= 0x%02x", instr);\r
-\r
- scan_field_t field;\r
-\r
- arm11_setup_field(arm11, 5, &instr, NULL, &field);\r
-\r
- jtag_add_ir_scan_vc(1, &field, state == -1 ? TAP_PI : state);\r
-}\r
-\r
-/** Verify shifted out data from Scan Chain Register (SCREG)\r
- * Used as parameter to scan_field_t::in_handler in\r
- * arm11_add_debug_SCAN_N().\r
- *\r
- */\r
-static int arm11_in_handler_SCAN_N(u8 *in_value, void *priv, struct scan_field_s *field)\r
-{\r
- /** \todo TODO: clarify why this isnt properly masked in jtag.c jtag_read_buffer() */\r
- u8 v = *in_value & 0x1F;\r
-\r
- if (v != 0x10)\r
- {\r
- ERROR("'arm11 target' JTAG communication error SCREG SCAN OUT 0x%02x (expected 0x10)", v);\r
- exit(-1);\r
- }\r
-\r
- JTAG_DEBUG("SCREG SCAN OUT 0x%02x", v);\r
- return ERROR_OK;\r
-}\r
-\r
-/** Select and write to Scan Chain Register (SCREG)\r
- * \r
- * This function sets the instruction register to SCAN_N and writes\r
- * the data register with the selected chain number.\r
- *\r
- * http://infocenter.arm.com/help/topic/com.arm.doc.ddi0301f/Cacbjhfg.html\r
- *\r
- * \param arm11 Target state variable.\r
- * \param chain Scan chain that will be selected.\r
- * \param state Pass the final TAP state or -1 for the default\r
- * value (Pause-DR).\r
- *\r
- * The chain takes effect when Update-DR is passed (usually when subsequently\r
- * the INTEXT/EXTEST instructions are written).\r
- *\r
- * \warning (Obsolete) Using this twice in a row will \em fail. The first call will end\r
- * in Pause-DR. The second call, due to the IR caching, will not\r
- * go through Capture-DR when shifting in the new scan chain number.\r
- * As a result the verification in arm11_in_handler_SCAN_N() must\r
- * fail.\r
- *\r
- * \remarks This adds to the JTAG command queue but does \em not execute it.\r
- */\r
-\r
-void arm11_add_debug_SCAN_N(arm11_common_t * arm11, u8 chain, enum tap_state state)\r
-{\r
- JTAG_DEBUG("SCREG <= 0x%02x", chain);\r
-\r
- arm11_add_IR(arm11, ARM11_SCAN_N, -1);\r
-\r
- scan_field_t field;\r
-\r
- arm11_setup_field(arm11, 5, &chain, NULL, &field);\r
-\r
- field.in_handler = arm11_in_handler_SCAN_N;\r
-\r
- jtag_add_dr_scan_vc(1, &field, state == -1 ? TAP_PD : state);\r
-}\r
-\r
-/** Write an instruction into the ITR register\r
- * \r
- * \param arm11 Target state variable.\r
- * \param inst An ARM11 processor instruction/opcode.\r
- * \param flag Optional parameter to retrieve the InstCompl flag\r
- * (this will be written when the JTAG chain is executed). \r
- * \param state Pass the final TAP state or -1 for the default\r
- * value (Run-Test/Idle).\r
- *\r
- * \remarks By default this ends with Run-Test/Idle state\r
- * and causes the instruction to be executed. If\r
- * a subsequent write to DTR is needed before\r
- * executing the instruction then TAP_PD should be\r
- * passed to \p state.\r
- *\r
- * \remarks This adds to the JTAG command queue but does \em not execute it.\r
- */\r
-void arm11_add_debug_INST(arm11_common_t * arm11, u32 inst, u8 * flag, enum tap_state state)\r
-{\r
- JTAG_DEBUG("INST <= 0x%08x", inst);\r
-\r
- scan_field_t itr[2];\r
-\r
- arm11_setup_field(arm11, 32, &inst, NULL, itr + 0);\r
- arm11_setup_field(arm11, 1, NULL, flag, itr + 1);\r
-\r
- jtag_add_dr_scan_vc(asizeof(itr), itr, state == -1 ? TAP_RTI : state);\r
-}\r
-\r
-/** Read the Debug Status and Control Register (DSCR)\r
- *\r
- * same as CP14 c1\r
- *\r
- * \param arm11 Target state variable.\r
- * \return DSCR content\r
- * \r
- * \remarks This is a stand-alone function that executes the JTAG command queue.\r
- */\r
-u32 arm11_read_DSCR(arm11_common_t * arm11)\r
-{\r
- arm11_add_debug_SCAN_N(arm11, 0x01, -1);\r
-\r
- arm11_add_IR(arm11, ARM11_INTEST, -1);\r
-\r
- u32 dscr;\r
- scan_field_t chain1_field;\r
-\r
- arm11_setup_field(arm11, 32, NULL, &dscr, &chain1_field);\r
-\r
- jtag_add_dr_scan_vc(1, &chain1_field, TAP_PD);\r
-\r
- jtag_execute_queue();\r
-\r
- if (arm11->last_dscr != dscr)\r
- JTAG_DEBUG("DSCR = %08x (OLD %08x)", dscr, arm11->last_dscr);\r
-\r
- arm11->last_dscr = dscr;\r
-\r
- return dscr;\r
-}\r
-\r
-/** Write the Debug Status and Control Register (DSCR)\r
- *\r
- * same as CP14 c1\r
- *\r
- * \param arm11 Target state variable.\r
- * \param dscr DSCR content\r
- * \r
- * \remarks This is a stand-alone function that executes the JTAG command queue.\r
- */\r
-void arm11_write_DSCR(arm11_common_t * arm11, u32 dscr)\r
-{\r
- arm11_add_debug_SCAN_N(arm11, 0x01, -1);\r
-\r
- arm11_add_IR(arm11, ARM11_EXTEST, -1);\r
-\r
- scan_field_t chain1_field;\r
-\r
- arm11_setup_field(arm11, 32, &dscr, NULL, &chain1_field);\r
-\r
- jtag_add_dr_scan_vc(1, &chain1_field, TAP_PD);\r
-\r
- jtag_execute_queue();\r
-\r
- JTAG_DEBUG("DSCR <= %08x (OLD %08x)", dscr, arm11->last_dscr);\r
-\r
- arm11->last_dscr = dscr;\r
-}\r
-\r
-\r
-\r
-/** Get the debug reason from Debug Status and Control Register (DSCR)\r
- *\r
- * \param dscr DSCR value to analyze\r
- * \return Debug reason\r
- * \r
- */\r
-enum target_debug_reason arm11_get_DSCR_debug_reason(u32 dscr)\r
-{\r
- switch (dscr & ARM11_DSCR_METHOD_OF_DEBUG_ENTRY_MASK)\r
- {\r
- case ARM11_DSCR_METHOD_OF_DEBUG_ENTRY_HALT: return DBG_REASON_DBGRQ;\r
- case ARM11_DSCR_METHOD_OF_DEBUG_ENTRY_BREAKPOINT: return DBG_REASON_BREAKPOINT;\r
- case ARM11_DSCR_METHOD_OF_DEBUG_ENTRY_WATCHPOINT: return DBG_REASON_WATCHPOINT;\r
- case ARM11_DSCR_METHOD_OF_DEBUG_ENTRY_BKPT_INSTRUCTION: return DBG_REASON_BREAKPOINT;\r
- case ARM11_DSCR_METHOD_OF_DEBUG_ENTRY_EDBGRQ: return DBG_REASON_DBGRQ;\r
- case ARM11_DSCR_METHOD_OF_DEBUG_ENTRY_VECTOR_CATCH: return DBG_REASON_BREAKPOINT;\r
-\r
- default:\r
- return DBG_REASON_DBGRQ;\r
- }\r
-};\r
-\r
-\r
-\r
-/** Prepare the stage for ITR/DTR operations\r
- * from the arm11_run_instr... group of functions.\r
- *\r
- * Put arm11_run_instr_data_prepare() and arm11_run_instr_data_finish()\r
- * around a block of arm11_run_instr_... calls.\r
- *\r
- * Select scan chain 5 to allow quick access to DTR. When scan\r
- * chain 4 is needed to put in a register the ITRSel instruction\r
- * shortcut is used instead of actually changing the Scan_N\r
- * register.\r
- *\r
- * \param arm11 Target state variable.\r
- *\r
- */\r
-void arm11_run_instr_data_prepare(arm11_common_t * arm11)\r
-{\r
- arm11_add_debug_SCAN_N(arm11, 0x05, -1);\r
-}\r
-\r
-/** Cleanup after ITR/DTR operations\r
- * from the arm11_run_instr... group of functions\r
- *\r
- * Put arm11_run_instr_data_prepare() and arm11_run_instr_data_finish()\r
- * around a block of arm11_run_instr_... calls.\r
- *\r
- * Any RTI can lead to an instruction execution when\r
- * scan chains 4 or 5 are selected and the IR holds\r
- * INTEST or EXTEST. So we must disable that before\r
- * any following activities lead to an RTI.\r
- *\r
- * \param arm11 Target state variable.\r
- *\r
- */\r
-void arm11_run_instr_data_finish(arm11_common_t * arm11)\r
-{\r
- arm11_add_debug_SCAN_N(arm11, 0x00, -1);\r
-}\r
-\r
-\r
-/** Execute one or multiple instructions via ITR\r
- *\r
- * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block\r
- *\r
- * \param arm11 Target state variable.\r
- * \param opcode Pointer to sequence of ARM opcodes\r
- * \param count Number of opcodes to execute\r
- *\r
- */\r
-void arm11_run_instr_no_data(arm11_common_t * arm11, u32 * opcode, size_t count)\r
-{\r
- arm11_add_IR(arm11, ARM11_ITRSEL, -1);\r
-\r
- while (count--)\r
- {\r
- arm11_add_debug_INST(arm11, *opcode++, NULL, TAP_RTI);\r
-\r
- while (1)\r
- {\r
- u8 flag;\r
-\r
- arm11_add_debug_INST(arm11, 0, &flag, count ? TAP_RTI : TAP_PD);\r
-\r
- jtag_execute_queue();\r
-\r
- if (flag)\r
- break;\r
- }\r
- }\r
-}\r
-\r
-/** Execute one instruction via ITR\r
- *\r
- * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block\r
- *\r
- * \param arm11 Target state variable.\r
- * \param opcode ARM opcode\r
- *\r
- */\r
-void arm11_run_instr_no_data1(arm11_common_t * arm11, u32 opcode)\r
-{\r
- arm11_run_instr_no_data(arm11, &opcode, 1);\r
-}\r
-\r
-\r
-/** Execute one instruction via ITR repeatedly while\r
- * passing data to the core via DTR on each execution.\r
- *\r
- * The executed instruction \em must read data from DTR.\r
- *\r
- * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block\r
- *\r
- * \param arm11 Target state variable.\r
- * \param opcode ARM opcode\r
- * \param data Pointer to the data words to be passed to the core\r
- * \param count Number of data words and instruction repetitions\r
- *\r
- */\r
-void arm11_run_instr_data_to_core(arm11_common_t * arm11, u32 opcode, u32 * data, size_t count)\r
-{\r
- arm11_add_IR(arm11, ARM11_ITRSEL, -1);\r
-\r
- arm11_add_debug_INST(arm11, opcode, NULL, TAP_PD);\r
-\r
- arm11_add_IR(arm11, ARM11_EXTEST, -1);\r
-\r
- scan_field_t chain5_fields[3];\r
-\r
- u32 Data;\r
- u8 Ready;\r
- u8 nRetry;\r
-\r
- arm11_setup_field(arm11, 32, &Data, NULL, chain5_fields + 0);\r
- arm11_setup_field(arm11, 1, NULL, &Ready, chain5_fields + 1);\r
- arm11_setup_field(arm11, 1, NULL, &nRetry, chain5_fields + 2);\r
-\r
- while (count--)\r
- {\r
- do\r
- {\r
- Data = *data;\r
-\r
- jtag_add_dr_scan_vc(asizeof(chain5_fields), chain5_fields, TAP_RTI);\r
- jtag_execute_queue();\r
-\r
- JTAG_DEBUG("DTR Ready %d nRetry %d", Ready, nRetry);\r
- }\r
- while (!Ready);\r
-\r
- data++;\r
- }\r
-\r
- arm11_add_IR(arm11, ARM11_INTEST, -1);\r
-\r
- do\r
- {\r
- Data = 0;\r
-\r
- jtag_add_dr_scan_vc(asizeof(chain5_fields), chain5_fields, TAP_PD);\r
- jtag_execute_queue();\r
-\r
- JTAG_DEBUG("DTR Data %08x Ready %d nRetry %d", Data, Ready, nRetry);\r
- }\r
- while (!Ready);\r
-\r
-\r
-}\r
-\r
-/** Execute an instruction via ITR while handing data into the core via DTR.\r
- *\r
- * The executed instruction \em must read data from DTR.\r
- *\r
- * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block\r
- *\r
- * \param arm11 Target state variable.\r
- * \param opcode ARM opcode\r
- * \param data Data word to be passed to the core via DTR\r
- *\r
- */\r
-void arm11_run_instr_data_to_core1(arm11_common_t * arm11, u32 opcode, u32 data)\r
-{\r
- arm11_run_instr_data_to_core(arm11, opcode, &data, 1);\r
-}\r
-\r
-\r
-/** Execute one instruction via ITR repeatedly while\r
- * reading data from the core via DTR on each execution.\r
- *\r
- * The executed instruction \em must write data to DTR.\r
- *\r
- * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block\r
- *\r
- * \param arm11 Target state variable.\r
- * \param opcode ARM opcode\r
- * \param data Pointer to an array that receives the data words from the core\r
- * \param count Number of data words and instruction repetitions\r
- *\r
- */\r
-void arm11_run_instr_data_from_core(arm11_common_t * arm11, u32 opcode, u32 * data, size_t count)\r
-{\r
- arm11_add_IR(arm11, ARM11_ITRSEL, -1);\r
-\r
- arm11_add_debug_INST(arm11, opcode, NULL, TAP_RTI);\r
-\r
- arm11_add_IR(arm11, ARM11_INTEST, -1);\r
-\r
- scan_field_t chain5_fields[3];\r
-\r
- u32 Data;\r
- u8 Ready;\r
- u8 nRetry;\r
-\r
- arm11_setup_field(arm11, 32, NULL, &Data, chain5_fields + 0);\r
- arm11_setup_field(arm11, 1, NULL, &Ready, chain5_fields + 1);\r
- arm11_setup_field(arm11, 1, NULL, &nRetry, chain5_fields + 2);\r
-\r
- while (count--)\r
- {\r
- do\r
- {\r
- jtag_add_dr_scan_vc(asizeof(chain5_fields), chain5_fields, count ? TAP_RTI : TAP_PD);\r
- jtag_execute_queue();\r
-\r
- JTAG_DEBUG("DTR Data %08x Ready %d nRetry %d", Data, Ready, nRetry);\r
- }\r
- while (!Ready);\r
-\r
- *data++ = Data;\r
- }\r
-}\r
-\r
-/** Execute one instruction via ITR\r
- * then load r0 into DTR and read DTR from core.\r
- *\r
- * The first executed instruction (\p opcode) should write data to r0.\r
- *\r
- * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block\r
- *\r
- * \param arm11 Target state variable.\r
- * \param opcode ARM opcode to write r0 with the value of interest\r
- * \param data Pointer to a data word that receives the value from r0 after \p opcode was executed.\r
- *\r
- */\r
-void arm11_run_instr_data_from_core_via_r0(arm11_common_t * arm11, u32 opcode, u32 * data)\r
-{\r
- arm11_run_instr_no_data1(arm11, opcode);\r
-\r
- /* MCR p14,0,R0,c0,c5,0 (move r0 -> wDTR -> local var) */\r
- arm11_run_instr_data_from_core(arm11, 0xEE000E15, data, 1);\r
-}\r
-\r
-/** Load data into core via DTR then move it to r0 then\r
- * execute one instruction via ITR\r
- *\r
- * The final executed instruction (\p opcode) should read data from r0.\r
- *\r
- * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block\r
- *\r
- * \param arm11 Target state variable.\r
- * \param opcode ARM opcode to read r0 act upon it\r
- * \param data Data word that will be written to r0 before \p opcode is executed\r
- *\r
- */\r
-void arm11_run_instr_data_to_core_via_r0(arm11_common_t * arm11, u32 opcode, u32 data)\r
-{\r
- /* MRC p14,0,r0,c0,c5,0 */\r
- arm11_run_instr_data_to_core1(arm11, 0xEE100E15, data);\r
-\r
- arm11_run_instr_no_data1(arm11, opcode);\r
-}\r
-\r
-\r
-void arm11_sc7_run(arm11_common_t * arm11, arm11_sc7_action_t * actions, size_t count)\r
-{\r
- arm11_add_debug_SCAN_N(arm11, 0x07, -1);\r
-\r
- arm11_add_IR(arm11, ARM11_EXTEST, -1);\r
-\r
- scan_field_t chain7_fields[3];\r
-\r
- u8 nRW;\r
- u32 DataOut;\r
- u8 AddressOut;\r
- u8 Ready;\r
- u32 DataIn;\r
- u8 AddressIn;\r
-\r
- arm11_setup_field(arm11, 1, &nRW, &Ready, chain7_fields + 0);\r
- arm11_setup_field(arm11, 32, &DataOut, &DataIn, chain7_fields + 1);\r
- arm11_setup_field(arm11, 7, &AddressOut, &AddressIn, chain7_fields + 2);\r
-\r
- {size_t i;\r
- for (i = 0; i < count + 1; i++)\r
- {\r
- if (i < count)\r
- {\r
- nRW = actions[i].write ? 1 : 0;\r
- DataOut = actions[i].value;\r
- AddressOut = actions[i].address;\r
- }\r
- else\r
- {\r
- nRW = 0;\r
- DataOut = 0;\r
- AddressOut = 0;\r
- }\r
-\r
- do\r
- {\r
- JTAG_DEBUG("SC7 <= Address %02x Data %08x nRW %d", AddressOut, DataOut, nRW);\r
-\r
- jtag_add_dr_scan_vc(asizeof(chain7_fields), chain7_fields, TAP_PD);\r
- jtag_execute_queue();\r
-\r
- JTAG_DEBUG("SC7 => Address %02x Data %08x Ready %d", AddressIn, DataIn, Ready);\r
- }\r
- while (!Ready); /* 'nRW' is 'Ready' on read out */\r
-\r
- if (i > 0)\r
- {\r
- if (actions[i - 1].address != AddressIn)\r
- {\r
- WARNING("Scan chain 7 shifted out unexpected address");\r
- }\r
-\r
- if (!actions[i - 1].write)\r
- {\r
- actions[i - 1].value = DataIn;\r
- }\r
- else\r
- {\r
- if (actions[i - 1].value != DataIn)\r
- {\r
- WARNING("Scan chain 7 shifted out unexpected data");\r
- }\r
- }\r
- }\r
- }}\r
-\r
- {size_t i;\r
- for (i = 0; i < count; i++)\r
- {\r
- JTAG_DEBUG("SC7 %02d: %02x %s %08x", i, actions[i].address, actions[i].write ? "<=" : "=>", actions[i].value);\r
- }}\r
-}\r
-\r
-void arm11_sc7_clear_bw(arm11_common_t * arm11)\r
-{\r
- size_t actions = arm11->brp + arm11->wrp;\r
-\r
- arm11_sc7_action_t clear_bw[actions];\r
-\r
- {size_t i;\r
- for (i = 0; i < actions; i++)\r
- {\r
- clear_bw[i].write = true;\r
- clear_bw[i].value = 0;\r
- clear_bw[i].address =\r
- i < arm11->brp ?\r
- ARM11_SC7_BCR0 + i :\r
- ARM11_SC7_WCR0 + i - arm11->brp;\r
- }}\r
-\r
- arm11_sc7_run(arm11, clear_bw, actions);\r
-}\r
-\r
+/***************************************************************************
+ * Copyright (C) 2008 digenius technology GmbH. *
+ * Michael Bruck *
+ * *
+ * Copyright (C) 2008,2009 Oyvind Harboe oyvind.harboe@zylin.com *
+ * *
+ * This program is free software; you can redistribute it and/or modify *
+ * it under the terms of the GNU General Public License as published by *
+ * the Free Software Foundation; either version 2 of the License, or *
+ * (at your option) any later version. *
+ * *
+ * This program is distributed in the hope that it will be useful, *
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of *
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
+ * GNU General Public License for more details. *
+ * *
+ * You should have received a copy of the GNU General Public License *
+ * along with this program; if not, write to the *
+ * Free Software Foundation, Inc., *
+ * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
+ ***************************************************************************/
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include "arm_jtag.h"
+#include "arm11_dbgtap.h"
+
+#include <helper/time_support.h>
+
+#if 0
+#define JTAG_DEBUG(expr ...) do { if (1) LOG_DEBUG(expr); } while (0)
+#else
+#define JTAG_DEBUG(expr ...) do { if (0) LOG_DEBUG(expr); } while (0)
+#endif
+
+/*
+This pathmove goes from Pause-IR to Shift-IR while avoiding RTI. The
+behavior of the FTDI driver IIRC was to go via RTI.
+
+Conversely there may be other places in this code where the ARM11 code relies
+on the driver to hit through RTI when coming from Update-?R.
+*/
+static const tap_state_t arm11_move_pi_to_si_via_ci[] =
+{
+ TAP_IREXIT2, TAP_IRUPDATE, TAP_DRSELECT, TAP_IRSELECT, TAP_IRCAPTURE, TAP_IRSHIFT
+};
+
+
+/* REVISIT no error handling here! */
+static void arm11_add_ir_scan_vc(struct jtag_tap *tap, struct scan_field *fields,
+ tap_state_t state)
+{
+ if (cmd_queue_cur_state == TAP_IRPAUSE)
+ jtag_add_pathmove(ARRAY_SIZE(arm11_move_pi_to_si_via_ci), arm11_move_pi_to_si_via_ci);
+
+ jtag_add_ir_scan(tap, fields, state);
+}
+
+static const tap_state_t arm11_move_pd_to_sd_via_cd[] =
+{
+ TAP_DREXIT2, TAP_DRUPDATE, TAP_DRSELECT, TAP_DRCAPTURE, TAP_DRSHIFT
+};
+
+/* REVISIT no error handling here! */
+void arm11_add_dr_scan_vc(struct jtag_tap *tap, int num_fields, struct scan_field *fields,
+ tap_state_t state)
+{
+ if (cmd_queue_cur_state == TAP_DRPAUSE)
+ jtag_add_pathmove(ARRAY_SIZE(arm11_move_pd_to_sd_via_cd), arm11_move_pd_to_sd_via_cd);
+
+ jtag_add_dr_scan(tap, num_fields, fields, state);
+}
+
+
+/** Code de-clutter: Construct struct scan_field to write out a value
+ *
+ * \param arm11 Target state variable.
+ * \param num_bits Length of the data field
+ * \param out_data pointer to the data that will be sent out
+ * <em > (data is read when it is added to the JTAG queue)</em>
+ * \param in_data pointer to the memory that will receive data that was clocked in
+ * <em > (data is written when the JTAG queue is executed)</em>
+ * \param field target data structure that will be initialized
+ */
+void arm11_setup_field(struct arm11_common *arm11, int num_bits,
+ void *out_data, void *in_data, struct scan_field *field)
+{
+ field->num_bits = num_bits;
+ field->out_value = out_data;
+ field->in_value = in_data;
+}
+
+static const char *arm11_ir_to_string(uint8_t ir)
+{
+ const char *s = "unknown";
+
+ switch (ir) {
+ case ARM11_EXTEST:
+ s = "EXTEST";
+ break;
+ case ARM11_SCAN_N:
+ s = "SCAN_N";
+ break;
+ case ARM11_RESTART:
+ s = "RESTART";
+ break;
+ case ARM11_HALT:
+ s = "HALT";
+ break;
+ case ARM11_INTEST:
+ s = "INTEST";
+ break;
+ case ARM11_ITRSEL:
+ s = "ITRSEL";
+ break;
+ case ARM11_IDCODE:
+ s = "IDCODE";
+ break;
+ case ARM11_BYPASS:
+ s = "BYPASS";
+ break;
+ }
+ return s;
+}
+
+/** Write JTAG instruction register
+ *
+ * \param arm11 Target state variable.
+ * \param instr An ARM11 DBGTAP instruction. Use enum #arm11_instructions.
+ * \param state Pass the final TAP state or ARM11_TAP_DEFAULT for the default value (Pause-IR).
+ *
+ * \remarks This adds to the JTAG command queue but does \em not execute it.
+ */
+void arm11_add_IR(struct arm11_common * arm11, uint8_t instr, tap_state_t state)
+{
+ struct jtag_tap *tap = arm11->arm.target->tap;
+
+ if (buf_get_u32(tap->cur_instr, 0, 5) == instr)
+ {
+ JTAG_DEBUG("IR <= 0x%02x SKIPPED", instr);
+ return;
+ }
+
+ JTAG_DEBUG("IR <= %s (0x%02x)", arm11_ir_to_string(instr), instr);
+
+ struct scan_field field;
+
+ arm11_setup_field(arm11, 5, &instr, NULL, &field);
+
+ arm11_add_ir_scan_vc(arm11->arm.target->tap, &field, state == ARM11_TAP_DEFAULT ? TAP_IRPAUSE : state);
+}
+
+/** Verify data shifted out from Scan Chain Register (SCREG). */
+static void arm11_in_handler_SCAN_N(uint8_t *in_value)
+{
+ /* Don't expect JTAG layer to modify bits we didn't ask it to read */
+ uint8_t v = *in_value & 0x1F;
+
+ if (v != 0x10)
+ {
+ LOG_ERROR("'arm11 target' JTAG error SCREG OUT 0x%02x", v);
+ jtag_set_error(ERROR_FAIL);
+ }
+}
+
+/** Select and write to Scan Chain Register (SCREG)
+ *
+ * This function sets the instruction register to SCAN_N and writes
+ * the data register with the selected chain number.
+ *
+ * http://infocenter.arm.com/help/topic/com.arm.doc.ddi0301f/Cacbjhfg.html
+ *
+ * \param arm11 Target state variable.
+ * \param chain Scan chain that will be selected.
+ * \param state Pass the final TAP state or ARM11_TAP_DEFAULT for the default
+ * value (Pause-DR).
+ *
+ * Changes the current scan chain if needed, transitions to the specified
+ * TAP state, and leaves the IR undefined.
+ *
+ * The chain takes effect when Update-DR is passed (usually when subsequently
+ * the INTEXT/EXTEST instructions are written).
+ *
+ * \warning (Obsolete) Using this twice in a row will \em fail. The first
+ * call will end in Pause-DR. The second call, due to the IR
+ * caching, will not go through Capture-DR when shifting in the
+ * new scan chain number. As a result the verification in
+ * arm11_in_handler_SCAN_N() must fail.
+ *
+ * \remarks This adds to the JTAG command queue but does \em not execute it.
+ */
+
+int arm11_add_debug_SCAN_N(struct arm11_common *arm11,
+ uint8_t chain, tap_state_t state)
+{
+ /* Don't needlessly switch the scan chain.
+ * NOTE: the ITRSEL instruction fakes SCREG changing;
+ * but leaves its actual value unchanged.
+ */
+#if 0
+ // FIX!!! the optimization below is broken because we do not
+ // invalidate the cur_scan_chain upon a TRST/TMS. See arm_jtag.c
+ // for example on how to invalidate cur_scan_chain. Tested patches gladly
+ // accepted!
+ if (arm11->jtag_info.cur_scan_chain == chain) {
+ JTAG_DEBUG("SCREG <= %d SKIPPED", chain);
+ return jtag_add_statemove((state == ARM11_TAP_DEFAULT)
+ ? TAP_DRPAUSE : state);
+ }
+#endif
+ JTAG_DEBUG("SCREG <= %d", chain);
+
+ arm11_add_IR(arm11, ARM11_SCAN_N, ARM11_TAP_DEFAULT);
+
+ struct scan_field field;
+
+ uint8_t tmp[1];
+ arm11_setup_field(arm11, 5, &chain, &tmp, &field);
+
+ arm11_add_dr_scan_vc(arm11->arm.target->tap, 1, &field, state == ARM11_TAP_DEFAULT ? TAP_DRPAUSE : state);
+
+ jtag_execute_queue_noclear();
+
+ arm11_in_handler_SCAN_N(tmp);
+
+ arm11->jtag_info.cur_scan_chain = chain;
+
+ return jtag_execute_queue();
+}
+
+/**
+ * Queue a DR scan of the ITR register. Caller must have selected
+ * scan chain 4 (ITR), possibly using ITRSEL.
+ *
+ * \param arm11 Target state variable.
+ * \param inst An ARM11 processor instruction/opcode.
+ * \param flag Optional parameter to retrieve the Ready flag;
+ * this address will be written when the JTAG chain is scanned.
+ * \param state The TAP state to enter after the DR scan.
+ *
+ * Going through the TAP_DRUPDATE state writes ITR only if Ready was
+ * previously set. Only the Ready flag is readable by the scan.
+ *
+ * An instruction loaded into ITR is executed when going through the
+ * TAP_IDLE state only if Ready was previously set and the debug state
+ * is properly set up. Depending on the instruction, you may also need
+ * to ensure that the rDTR is ready before that Run-Test/Idle state.
+ */
+static void arm11_add_debug_INST(struct arm11_common * arm11,
+ uint32_t inst, uint8_t * flag, tap_state_t state)
+{
+ JTAG_DEBUG("INST <= 0x%08x", (unsigned) inst);
+
+ struct scan_field itr[2];
+
+ arm11_setup_field(arm11, 32, &inst, NULL, itr + 0);
+ arm11_setup_field(arm11, 1, NULL, flag, itr + 1);
+
+ arm11_add_dr_scan_vc(arm11->arm.target->tap, ARRAY_SIZE(itr), itr, state);
+}
+
+/**
+ * Read and save the Debug Status and Control Register (DSCR).
+ *
+ * \param arm11 Target state variable.
+ * \return Error status; arm11->dscr is updated on success.
+ *
+ * \remarks This is a stand-alone function that executes the JTAG
+ * command queue. It does not require the ARM11 debug TAP to be
+ * in any particular state.
+ */
+int arm11_read_DSCR(struct arm11_common *arm11)
+{
+ int retval;
+
+ retval = arm11_add_debug_SCAN_N(arm11, 0x01, ARM11_TAP_DEFAULT);
+ if (retval != ERROR_OK)
+ return retval;
+
+ arm11_add_IR(arm11, ARM11_INTEST, ARM11_TAP_DEFAULT);
+
+ uint32_t dscr;
+ struct scan_field chain1_field;
+
+ arm11_setup_field(arm11, 32, NULL, &dscr, &chain1_field);
+
+ arm11_add_dr_scan_vc(arm11->arm.target->tap, 1, &chain1_field, TAP_DRPAUSE);
+
+ CHECK_RETVAL(jtag_execute_queue());
+
+ if (arm11->dscr != dscr)
+ JTAG_DEBUG("DSCR = %08x (OLD %08x)",
+ (unsigned) dscr,
+ (unsigned) arm11->dscr);
+
+ arm11->dscr = dscr;
+
+ return ERROR_OK;
+}
+
+/** Write the Debug Status and Control Register (DSCR)
+ *
+ * same as CP14 c1
+ *
+ * \param arm11 Target state variable.
+ * \param dscr DSCR content
+ *
+ * \remarks This is a stand-alone function that executes the JTAG command queue.
+ */
+int arm11_write_DSCR(struct arm11_common * arm11, uint32_t dscr)
+{
+ int retval;
+ retval = arm11_add_debug_SCAN_N(arm11, 0x01, ARM11_TAP_DEFAULT);
+ if (retval != ERROR_OK)
+ return retval;
+
+ arm11_add_IR(arm11, ARM11_EXTEST, ARM11_TAP_DEFAULT);
+
+ struct scan_field chain1_field;
+
+ arm11_setup_field(arm11, 32, &dscr, NULL, &chain1_field);
+
+ arm11_add_dr_scan_vc(arm11->arm.target->tap, 1, &chain1_field, TAP_DRPAUSE);
+
+ CHECK_RETVAL(jtag_execute_queue());
+
+ JTAG_DEBUG("DSCR <= %08x (OLD %08x)",
+ (unsigned) dscr,
+ (unsigned) arm11->dscr);
+
+ arm11->dscr = dscr;
+
+ return ERROR_OK;
+}
+
+/** Prepare the stage for ITR/DTR operations
+ * from the arm11_run_instr... group of functions.
+ *
+ * Put arm11_run_instr_data_prepare() and arm11_run_instr_data_finish()
+ * around a block of arm11_run_instr_... calls.
+ *
+ * Select scan chain 5 to allow quick access to DTR. When scan
+ * chain 4 is needed to put in a register the ITRSel instruction
+ * shortcut is used instead of actually changing the Scan_N
+ * register.
+ *
+ * \param arm11 Target state variable.
+ *
+ */
+int arm11_run_instr_data_prepare(struct arm11_common * arm11)
+{
+ return arm11_add_debug_SCAN_N(arm11, 0x05, ARM11_TAP_DEFAULT);
+}
+
+/** Cleanup after ITR/DTR operations
+ * from the arm11_run_instr... group of functions
+ *
+ * Put arm11_run_instr_data_prepare() and arm11_run_instr_data_finish()
+ * around a block of arm11_run_instr_... calls.
+ *
+ * Any IDLE can lead to an instruction execution when
+ * scan chains 4 or 5 are selected and the IR holds
+ * INTEST or EXTEST. So we must disable that before
+ * any following activities lead to an IDLE.
+ *
+ * \param arm11 Target state variable.
+ *
+ */
+int arm11_run_instr_data_finish(struct arm11_common * arm11)
+{
+ return arm11_add_debug_SCAN_N(arm11, 0x00, ARM11_TAP_DEFAULT);
+}
+
+
+
+/**
+ * Execute one or more instructions via ITR.
+ * Caller guarantees that processor is in debug state, that DSCR_ITR_EN
+ * is set, the ITR Ready flag is set (as seen on the previous entry to
+ * TAP_DRCAPTURE), and the DSCR sticky abort flag is clear.
+ *
+ * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block
+ *
+ * \param arm11 Target state variable.
+ * \param opcode Pointer to sequence of ARM opcodes
+ * \param count Number of opcodes to execute
+ *
+ */
+static
+int arm11_run_instr_no_data(struct arm11_common * arm11,
+ uint32_t * opcode, size_t count)
+{
+ arm11_add_IR(arm11, ARM11_ITRSEL, ARM11_TAP_DEFAULT);
+
+ while (count--)
+ {
+ arm11_add_debug_INST(arm11, *opcode++, NULL, TAP_IDLE);
+
+ int i = 0;
+ while (1)
+ {
+ uint8_t flag;
+
+ arm11_add_debug_INST(arm11, 0, &flag, count ? TAP_IDLE : TAP_DRPAUSE);
+
+ CHECK_RETVAL(jtag_execute_queue());
+
+ if (flag)
+ break;
+
+ long long then = 0;
+
+ if (i == 1000)
+ {
+ then = timeval_ms();
+ }
+ if (i >= 1000)
+ {
+ if ((timeval_ms()-then) > 1000)
+ {
+ LOG_WARNING("Timeout (1000ms) waiting for instructions to complete");
+ return ERROR_FAIL;
+ }
+ }
+
+ i++;
+ }
+ }
+
+ return ERROR_OK;
+}
+
+/** Execute one instruction via ITR
+ *
+ * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block
+ *
+ * \param arm11 Target state variable.
+ * \param opcode ARM opcode
+ *
+ */
+int arm11_run_instr_no_data1(struct arm11_common * arm11, uint32_t opcode)
+{
+ return arm11_run_instr_no_data(arm11, &opcode, 1);
+}
+
+
+/** Execute one instruction via ITR repeatedly while
+ * passing data to the core via DTR on each execution.
+ *
+ * Caller guarantees that processor is in debug state, that DSCR_ITR_EN
+ * is set, the ITR Ready flag is set (as seen on the previous entry to
+ * TAP_DRCAPTURE), and the DSCR sticky abort flag is clear.
+ *
+ * The executed instruction \em must read data from DTR.
+ *
+ * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block
+ *
+ * \param arm11 Target state variable.
+ * \param opcode ARM opcode
+ * \param data Pointer to the data words to be passed to the core
+ * \param count Number of data words and instruction repetitions
+ *
+ */
+int arm11_run_instr_data_to_core(struct arm11_common * arm11, uint32_t opcode, uint32_t * data, size_t count)
+{
+ arm11_add_IR(arm11, ARM11_ITRSEL, ARM11_TAP_DEFAULT);
+
+ arm11_add_debug_INST(arm11, opcode, NULL, TAP_DRPAUSE);
+
+ arm11_add_IR(arm11, ARM11_EXTEST, ARM11_TAP_DEFAULT);
+
+ struct scan_field chain5_fields[3];
+
+ uint32_t Data;
+ uint8_t Ready;
+ uint8_t nRetry;
+
+ arm11_setup_field(arm11, 32, &Data, NULL, chain5_fields + 0);
+ arm11_setup_field(arm11, 1, NULL, &Ready, chain5_fields + 1);
+ arm11_setup_field(arm11, 1, NULL, &nRetry, chain5_fields + 2);
+
+ while (count--)
+ {
+ int i = 0;
+ do
+ {
+ Data = *data;
+
+ arm11_add_dr_scan_vc(arm11->arm.target->tap, ARRAY_SIZE(chain5_fields), chain5_fields, TAP_IDLE);
+
+ CHECK_RETVAL(jtag_execute_queue());
+
+ JTAG_DEBUG("DTR Ready %d nRetry %d", Ready, nRetry);
+
+ long long then = 0;
+
+ if (i == 1000)
+ {
+ then = timeval_ms();
+ }
+ if (i >= 1000)
+ {
+ if ((timeval_ms()-then) > 1000)
+ {
+ LOG_WARNING("Timeout (1000ms) waiting for instructions to complete");
+ return ERROR_FAIL;
+ }
+ }
+
+ i++;
+ }
+ while (!Ready);
+
+ data++;
+ }
+
+ arm11_add_IR(arm11, ARM11_INTEST, ARM11_TAP_DEFAULT);
+
+ int i = 0;
+ do
+ {
+ Data = 0;
+
+ arm11_add_dr_scan_vc(arm11->arm.target->tap, ARRAY_SIZE(chain5_fields), chain5_fields, TAP_DRPAUSE);
+
+ CHECK_RETVAL(jtag_execute_queue());
+
+ JTAG_DEBUG("DTR Data %08x Ready %d nRetry %d",
+ (unsigned) Data, Ready, nRetry);
+
+ long long then = 0;
+
+ if (i == 1000)
+ {
+ then = timeval_ms();
+ }
+ if (i >= 1000)
+ {
+ if ((timeval_ms()-then) > 1000)
+ {
+ LOG_WARNING("Timeout (1000ms) waiting for instructions to complete");
+ return ERROR_FAIL;
+ }
+ }
+
+ i++;
+ }
+ while (!Ready);
+
+ return ERROR_OK;
+}
+
+/** JTAG path for arm11_run_instr_data_to_core_noack
+ *
+ * The repeated TAP_IDLE's do not cause a repeated execution
+ * if passed without leaving the state.
+ *
+ * Since this is more than 7 bits (adjustable via adding more
+ * TAP_IDLE's) it produces an artificial delay in the lower
+ * layer (FT2232) that is long enough to finish execution on
+ * the core but still shorter than any manually inducible delays.
+ *
+ * To disable this code, try "memwrite burst false"
+ *
+ * FIX!!! should we use multiple TAP_IDLE here or not???
+ *
+ * https://lists.berlios.de/pipermail/openocd-development/2009-July/009698.html
+ * https://lists.berlios.de/pipermail/openocd-development/2009-August/009865.html
+ */
+static const tap_state_t arm11_MOVE_DRPAUSE_IDLE_DRPAUSE_with_delay[] =
+{
+ TAP_DREXIT2, TAP_DRUPDATE, TAP_IDLE, TAP_IDLE, TAP_IDLE, TAP_DRSELECT, TAP_DRCAPTURE, TAP_DRSHIFT
+};
+
+/* This inner loop can be implemented by the minidriver, oftentimes in hardware... The
+ * minidriver can call the default implementation as a fallback or implement it
+ * from scratch.
+ */
+int arm11_run_instr_data_to_core_noack_inner_default(struct jtag_tap * tap, uint32_t opcode, uint32_t * data, size_t count)
+{
+ struct scan_field chain5_fields[3];
+
+ chain5_fields[0].num_bits = 32;
+ chain5_fields[0].out_value = NULL; /*&Data*/
+ chain5_fields[0].in_value = NULL;
+
+ chain5_fields[1].num_bits = 1;
+ chain5_fields[1].out_value = NULL;
+ chain5_fields[1].in_value = NULL; /*&Ready*/
+
+ chain5_fields[2].num_bits = 1;
+ chain5_fields[2].out_value = NULL;
+ chain5_fields[2].in_value = NULL;
+
+ uint8_t *Readies;
+ unsigned readiesNum = count;
+ unsigned bytes = sizeof(*Readies)*readiesNum;
+
+ Readies = (uint8_t *) malloc(bytes);
+ if (Readies == NULL)
+ {
+ LOG_ERROR("Out of memory allocating %u bytes", bytes);
+ return ERROR_FAIL;
+ }
+
+ uint8_t * ReadyPos = Readies;
+ while (count--)
+ {
+ chain5_fields[0].out_value = (void *)(data++);
+ chain5_fields[1].in_value = ReadyPos++;
+
+ if (count > 0)
+ {
+ jtag_add_dr_scan(tap, ARRAY_SIZE(chain5_fields), chain5_fields, TAP_DRPAUSE);
+ jtag_add_pathmove(ARRAY_SIZE(arm11_MOVE_DRPAUSE_IDLE_DRPAUSE_with_delay),
+ arm11_MOVE_DRPAUSE_IDLE_DRPAUSE_with_delay);
+ } else
+ {
+ jtag_add_dr_scan(tap, ARRAY_SIZE(chain5_fields), chain5_fields, TAP_IDLE);
+ }
+ }
+
+ int retval = jtag_execute_queue();
+ if (retval == ERROR_OK)
+ {
+ unsigned error_count = 0;
+
+ for (size_t i = 0; i < readiesNum; i++)
+ {
+ if (Readies[i] != 1)
+ {
+ error_count++;
+ }
+ }
+
+ if (error_count > 0 )
+ {
+ LOG_ERROR("%u words out of %u not transferred",
+ error_count, readiesNum);
+ retval = ERROR_FAIL;
+ }
+ }
+ free(Readies);
+
+ return retval;
+}
+
+int arm11_run_instr_data_to_core_noack_inner(struct jtag_tap * tap, uint32_t opcode, uint32_t * data, size_t count);
+
+#ifndef HAVE_JTAG_MINIDRIVER_H
+int arm11_run_instr_data_to_core_noack_inner(struct jtag_tap * tap, uint32_t opcode, uint32_t * data, size_t count)
+{
+ return arm11_run_instr_data_to_core_noack_inner_default(tap, opcode, data, count);
+}
+#endif
+
+/** Execute one instruction via ITR repeatedly while
+ * passing data to the core via DTR on each execution.
+ *
+ * Caller guarantees that processor is in debug state, that DSCR_ITR_EN
+ * is set, the ITR Ready flag is set (as seen on the previous entry to
+ * TAP_DRCAPTURE), and the DSCR sticky abort flag is clear.
+ *
+ * No Ready check during transmission.
+ *
+ * The executed instruction \em must read data from DTR.
+ *
+ * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block
+ *
+ * \param arm11 Target state variable.
+ * \param opcode ARM opcode
+ * \param data Pointer to the data words to be passed to the core
+ * \param count Number of data words and instruction repetitions
+ *
+ */
+int arm11_run_instr_data_to_core_noack(struct arm11_common * arm11, uint32_t opcode, uint32_t * data, size_t count)
+{
+ arm11_add_IR(arm11, ARM11_ITRSEL, ARM11_TAP_DEFAULT);
+
+ arm11_add_debug_INST(arm11, opcode, NULL, TAP_DRPAUSE);
+
+ arm11_add_IR(arm11, ARM11_EXTEST, ARM11_TAP_DEFAULT);
+
+ int retval = arm11_run_instr_data_to_core_noack_inner(arm11->arm.target->tap, opcode, data, count);
+
+ if (retval != ERROR_OK)
+ return retval;
+
+ arm11_add_IR(arm11, ARM11_INTEST, ARM11_TAP_DEFAULT);
+
+ struct scan_field chain5_fields[3];
+
+ arm11_setup_field(arm11, 32, NULL/*&Data*/, NULL, chain5_fields + 0);
+ arm11_setup_field(arm11, 1, NULL, NULL /*&Ready*/, chain5_fields + 1);
+ arm11_setup_field(arm11, 1, NULL, NULL, chain5_fields + 2);
+
+ uint8_t ready_flag;
+ chain5_fields[1].in_value = &ready_flag;
+
+ arm11_add_dr_scan_vc(arm11->arm.target->tap, ARRAY_SIZE(chain5_fields), chain5_fields, TAP_DRPAUSE);
+
+ retval = jtag_execute_queue();
+ if (retval == ERROR_OK)
+ {
+ if (ready_flag != 1)
+ {
+ LOG_ERROR("last word not transferred");
+ retval = ERROR_FAIL;
+ }
+ }
+
+ return retval;
+}
+
+
+/** Execute an instruction via ITR while handing data into the core via DTR.
+ *
+ * The executed instruction \em must read data from DTR.
+ *
+ * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block
+ *
+ * \param arm11 Target state variable.
+ * \param opcode ARM opcode
+ * \param data Data word to be passed to the core via DTR
+ *
+ */
+int arm11_run_instr_data_to_core1(struct arm11_common * arm11, uint32_t opcode, uint32_t data)
+{
+ return arm11_run_instr_data_to_core(arm11, opcode, &data, 1);
+}
+
+
+/** Execute one instruction via ITR repeatedly while
+ * reading data from the core via DTR on each execution.
+ *
+ * Caller guarantees that processor is in debug state, that DSCR_ITR_EN
+ * is set, the ITR Ready flag is set (as seen on the previous entry to
+ * TAP_DRCAPTURE), and the DSCR sticky abort flag is clear.
+ *
+ * The executed instruction \em must write data to DTR.
+ *
+ * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block
+ *
+ * \param arm11 Target state variable.
+ * \param opcode ARM opcode
+ * \param data Pointer to an array that receives the data words from the core
+ * \param count Number of data words and instruction repetitions
+ *
+ */
+int arm11_run_instr_data_from_core(struct arm11_common * arm11, uint32_t opcode, uint32_t * data, size_t count)
+{
+ arm11_add_IR(arm11, ARM11_ITRSEL, ARM11_TAP_DEFAULT);
+
+ arm11_add_debug_INST(arm11, opcode, NULL, TAP_IDLE);
+
+ arm11_add_IR(arm11, ARM11_INTEST, ARM11_TAP_DEFAULT);
+
+ struct scan_field chain5_fields[3];
+
+ uint32_t Data;
+ uint8_t Ready;
+ uint8_t nRetry;
+
+ arm11_setup_field(arm11, 32, NULL, &Data, chain5_fields + 0);
+ arm11_setup_field(arm11, 1, NULL, &Ready, chain5_fields + 1);
+ arm11_setup_field(arm11, 1, NULL, &nRetry, chain5_fields + 2);
+
+ while (count--)
+ {
+ int i = 0;
+ do
+ {
+ arm11_add_dr_scan_vc(arm11->arm.target->tap, ARRAY_SIZE(chain5_fields), chain5_fields, count ? TAP_IDLE : TAP_DRPAUSE);
+
+ CHECK_RETVAL(jtag_execute_queue());
+
+ JTAG_DEBUG("DTR Data %08x Ready %d nRetry %d",
+ (unsigned) Data, Ready, nRetry);
+
+ long long then = 0;
+
+ if (i == 1000)
+ {
+ then = timeval_ms();
+ }
+ if (i >= 1000)
+ {
+ if ((timeval_ms()-then) > 1000)
+ {
+ LOG_WARNING("Timeout (1000ms) waiting for instructions to complete");
+ return ERROR_FAIL;
+ }
+ }
+
+ i++;
+ }
+ while (!Ready);
+
+ *data++ = Data;
+ }
+
+ return ERROR_OK;
+}
+
+/** Execute one instruction via ITR
+ * then load r0 into DTR and read DTR from core.
+ *
+ * The first executed instruction (\p opcode) should write data to r0.
+ *
+ * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block
+ *
+ * \param arm11 Target state variable.
+ * \param opcode ARM opcode to write r0 with the value of interest
+ * \param data Pointer to a data word that receives the value from r0 after \p opcode was executed.
+ *
+ */
+int arm11_run_instr_data_from_core_via_r0(struct arm11_common * arm11, uint32_t opcode, uint32_t * data)
+{
+ int retval;
+ retval = arm11_run_instr_no_data1(arm11, opcode);
+ if (retval != ERROR_OK)
+ return retval;
+
+ /* MCR p14,0,R0,c0,c5,0 (move r0 -> wDTR -> local var) */
+ arm11_run_instr_data_from_core(arm11, 0xEE000E15, data, 1);
+
+ return ERROR_OK;
+}
+
+/** Load data into core via DTR then move it to r0 then
+ * execute one instruction via ITR
+ *
+ * The final executed instruction (\p opcode) should read data from r0.
+ *
+ * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block
+ *
+ * \param arm11 Target state variable.
+ * \param opcode ARM opcode to read r0 act upon it
+ * \param data Data word that will be written to r0 before \p opcode is executed
+ *
+ */
+int arm11_run_instr_data_to_core_via_r0(struct arm11_common * arm11, uint32_t opcode, uint32_t data)
+{
+ int retval;
+ /* MRC p14,0,r0,c0,c5,0 */
+ retval = arm11_run_instr_data_to_core1(arm11, 0xEE100E15, data);
+ if (retval != ERROR_OK)
+ return retval;
+
+ retval = arm11_run_instr_no_data1(arm11, opcode);
+ if (retval != ERROR_OK)
+ return retval;
+
+ return ERROR_OK;
+}
+
+/** Apply reads and writes to scan chain 7
+ *
+ * \see struct arm11_sc7_action
+ *
+ * \param arm11 Target state variable.
+ * \param actions A list of read and/or write instructions
+ * \param count Number of instructions in the list.
+ *
+ */
+int arm11_sc7_run(struct arm11_common * arm11, struct arm11_sc7_action * actions, size_t count)
+{
+ int retval;
+
+ retval = arm11_add_debug_SCAN_N(arm11, 0x07, ARM11_TAP_DEFAULT);
+ if (retval != ERROR_OK)
+ return retval;
+
+ arm11_add_IR(arm11, ARM11_EXTEST, ARM11_TAP_DEFAULT);
+
+ struct scan_field chain7_fields[3];
+
+ uint8_t nRW;
+ uint32_t DataOut;
+ uint8_t AddressOut;
+ uint8_t Ready;
+ uint32_t DataIn;
+ uint8_t AddressIn;
+
+ arm11_setup_field(arm11, 1, &nRW, &Ready, chain7_fields + 0);
+ arm11_setup_field(arm11, 32, &DataOut, &DataIn, chain7_fields + 1);
+ arm11_setup_field(arm11, 7, &AddressOut, &AddressIn, chain7_fields + 2);
+
+ for (size_t i = 0; i < count + 1; i++)
+ {
+ if (i < count)
+ {
+ nRW = actions[i].write ? 1 : 0;
+ DataOut = actions[i].value;
+ AddressOut = actions[i].address;
+ }
+ else
+ {
+ nRW = 1;
+ DataOut = 0;
+ AddressOut = 0;
+ }
+
+ /* Timeout here so we don't get stuck. */
+ int i_n = 0;
+ while (1)
+ {
+ JTAG_DEBUG("SC7 <= c%-3d Data %08x %s",
+ (unsigned) AddressOut,
+ (unsigned) DataOut,
+ nRW ? "write" : "read");
+
+ arm11_add_dr_scan_vc(arm11->arm.target->tap, ARRAY_SIZE(chain7_fields),
+ chain7_fields, TAP_DRPAUSE);
+
+ CHECK_RETVAL(jtag_execute_queue());
+
+ /* 'nRW' is 'Ready' on read out */
+ if (Ready)
+ break;
+
+ long long then = 0;
+
+ if (i_n == 1000)
+ {
+ then = timeval_ms();
+ }
+ if (i_n >= 1000)
+ {
+ if ((timeval_ms()-then) > 1000)
+ {
+ LOG_WARNING("Timeout (1000ms) waiting for instructions to complete");
+ return ERROR_FAIL;
+ }
+ }
+
+ i_n++;
+ }
+
+ if (!nRW)
+ JTAG_DEBUG("SC7 => Data %08x", (unsigned) DataIn);
+
+ if (i > 0)
+ {
+ if (actions[i - 1].address != AddressIn)
+ {
+ LOG_WARNING("Scan chain 7 shifted out unexpected address");
+ }
+
+ if (!actions[i - 1].write)
+ {
+ actions[i - 1].value = DataIn;
+ }
+ else
+ {
+ if (actions[i - 1].value != DataIn)
+ {
+ LOG_WARNING("Scan chain 7 shifted out unexpected data");
+ }
+ }
+ }
+ }
+ return ERROR_OK;
+}
+
+/** Clear VCR and all breakpoints and watchpoints via scan chain 7
+ *
+ * \param arm11 Target state variable.
+ *
+ */
+int arm11_sc7_clear_vbw(struct arm11_common * arm11)
+{
+ size_t clear_bw_size = arm11->brp + 1;
+ struct arm11_sc7_action *clear_bw = malloc(sizeof(struct arm11_sc7_action) * clear_bw_size);
+ struct arm11_sc7_action * pos = clear_bw;
+
+ for (size_t i = 0; i < clear_bw_size; i++)
+ {
+ clear_bw[i].write = true;
+ clear_bw[i].value = 0;
+ }
+
+ for (size_t i = 0; i < arm11->brp; i++)
+ (pos++)->address = ARM11_SC7_BCR0 + i;
+
+ (pos++)->address = ARM11_SC7_VCR;
+
+ int retval;
+ retval = arm11_sc7_run(arm11, clear_bw, clear_bw_size);
+
+ free (clear_bw);
+
+ return retval;
+}
+
+/** Write VCR register
+ *
+ * \param arm11 Target state variable.
+ * \param value Value to be written
+ */
+int arm11_sc7_set_vcr(struct arm11_common * arm11, uint32_t value)
+{
+ struct arm11_sc7_action set_vcr;
+
+ set_vcr.write = true;
+ set_vcr.address = ARM11_SC7_VCR;
+ set_vcr.value = value;
+
+ return arm11_sc7_run(arm11, &set_vcr, 1);
+}
+
+
+
+/** Read word from address
+ *
+ * \param arm11 Target state variable.
+ * \param address Memory address to be read
+ * \param result Pointer where to store result
+ *
+ */
+int arm11_read_memory_word(struct arm11_common * arm11, uint32_t address, uint32_t * result)
+{
+ int retval;
+ retval = arm11_run_instr_data_prepare(arm11);
+ if (retval != ERROR_OK)
+ return retval;
+
+ /* MRC p14,0,r0,c0,c5,0 (r0 = address) */
+ CHECK_RETVAL(arm11_run_instr_data_to_core1(arm11, 0xee100e15, address));
+
+ /* LDC p14,c5,[R0],#4 (DTR = [r0]) */
+ CHECK_RETVAL(arm11_run_instr_data_from_core(arm11, 0xecb05e01, result, 1));
+
+ return arm11_run_instr_data_finish(arm11);
+}
+
+
+/************************************************************************/
+
+/*
+ * ARM11 provider for the OpenOCD implementation of the standard
+ * architectural ARM v6/v7 "Debug Programmer's Model" (DPM).
+ */
+
+static inline struct arm11_common *dpm_to_arm11(struct arm_dpm *dpm)
+{
+ return container_of(dpm, struct arm11_common, dpm);
+}
+
+static int arm11_dpm_prepare(struct arm_dpm *dpm)
+{
+ return arm11_run_instr_data_prepare(dpm_to_arm11(dpm));
+}
+
+static int arm11_dpm_finish(struct arm_dpm *dpm)
+{
+ return arm11_run_instr_data_finish(dpm_to_arm11(dpm));
+}
+
+static int arm11_dpm_instr_write_data_dcc(struct arm_dpm *dpm,
+ uint32_t opcode, uint32_t data)
+{
+ return arm11_run_instr_data_to_core(dpm_to_arm11(dpm),
+ opcode, &data, 1);
+}
+
+static int arm11_dpm_instr_write_data_r0(struct arm_dpm *dpm,
+ uint32_t opcode, uint32_t data)
+{
+ return arm11_run_instr_data_to_core_via_r0(dpm_to_arm11(dpm),
+ opcode, data);
+}
+
+static int arm11_dpm_instr_read_data_dcc(struct arm_dpm *dpm,
+ uint32_t opcode, uint32_t *data)
+{
+ return arm11_run_instr_data_from_core(dpm_to_arm11(dpm),
+ opcode, data, 1);
+}
+
+static int arm11_dpm_instr_read_data_r0(struct arm_dpm *dpm,
+ uint32_t opcode, uint32_t *data)
+{
+ return arm11_run_instr_data_from_core_via_r0(dpm_to_arm11(dpm),
+ opcode, data);
+}
+
+/* Because arm11_sc7_run() takes a vector of actions, we batch breakpoint
+ * and watchpoint operations instead of running them right away. Since we
+ * pre-allocated our vector, we don't need to worry about space.
+ */
+static int arm11_bpwp_enable(struct arm_dpm *dpm, unsigned index_t,
+ uint32_t addr, uint32_t control)
+{
+ struct arm11_common *arm11 = dpm_to_arm11(dpm);
+ struct arm11_sc7_action *action;
+
+ action = arm11->bpwp_actions + arm11->bpwp_n;
+
+ /* Invariant: this bp/wp is disabled.
+ * It also happens that the core is halted here, but for
+ * DPM-based cores we don't actually care about that.
+ */
+
+ action[0].write = action[1].write = true;
+
+ action[0].value = addr;
+ action[1].value = control;
+
+ switch (index_t) {
+ case 0 ... 15:
+ action[0].address = ARM11_SC7_BVR0 + index_t;
+ action[1].address = ARM11_SC7_BCR0 + index_t;
+ break;
+ case 16 ... 32:
+ index_t -= 16;
+ action[0].address = ARM11_SC7_WVR0 + index_t;
+ action[1].address = ARM11_SC7_WCR0 + index_t;
+ break;
+ default:
+ return ERROR_FAIL;
+ }
+
+ arm11->bpwp_n += 2;
+
+ return ERROR_OK;
+}
+
+static int arm11_bpwp_disable(struct arm_dpm *dpm, unsigned index_t)
+{
+ struct arm11_common *arm11 = dpm_to_arm11(dpm);
+ struct arm11_sc7_action *action;
+
+ action = arm11->bpwp_actions + arm11->bpwp_n;
+
+ action[0].write = true;
+ action[0].value = 0;
+
+ switch (index_t) {
+ case 0 ... 15:
+ action[0].address = ARM11_SC7_BCR0 + index_t;
+ break;
+ case 16 ... 32:
+ index_t -= 16;
+ action[0].address = ARM11_SC7_WCR0 + index_t;
+ break;
+ default:
+ return ERROR_FAIL;
+ }
+
+ arm11->bpwp_n += 1;
+
+ return ERROR_OK;
+}
+
+/** Flush any pending breakpoint and watchpoint updates. */
+int arm11_bpwp_flush(struct arm11_common *arm11)
+{
+ int retval;
+
+ if (!arm11->bpwp_n)
+ return ERROR_OK;
+
+ retval = arm11_sc7_run(arm11, arm11->bpwp_actions, arm11->bpwp_n);
+ arm11->bpwp_n = 0;
+
+ return retval;
+}
+
+/** Set up high-level debug module utilities */
+int arm11_dpm_init(struct arm11_common *arm11, uint32_t didr)
+{
+ struct arm_dpm *dpm = &arm11->dpm;
+ int retval;
+
+ dpm->arm = &arm11->arm;
+
+ dpm->didr = didr;
+
+ dpm->prepare = arm11_dpm_prepare;
+ dpm->finish = arm11_dpm_finish;
+
+ dpm->instr_write_data_dcc = arm11_dpm_instr_write_data_dcc;
+ dpm->instr_write_data_r0 = arm11_dpm_instr_write_data_r0;
+
+ dpm->instr_read_data_dcc = arm11_dpm_instr_read_data_dcc;
+ dpm->instr_read_data_r0 = arm11_dpm_instr_read_data_r0;
+
+ dpm->bpwp_enable = arm11_bpwp_enable;
+ dpm->bpwp_disable = arm11_bpwp_disable;
+
+ retval = arm_dpm_setup(dpm);
+ if (retval != ERROR_OK)
+ return retval;
+
+ /* alloc enough to enable all breakpoints and watchpoints at once */
+ arm11->bpwp_actions = calloc(2 * (dpm->nbp + dpm->nwp),
+ sizeof *arm11->bpwp_actions);
+ if (!arm11->bpwp_actions)
+ return ERROR_FAIL;
+
+ retval = arm_dpm_initialize(dpm);
+ if (retval != ERROR_OK)
+ return retval;
+
+ return arm11_bpwp_flush(arm11);
+}
projects / fw / openocd / blobdiff