/** Check and if necessary take control of the system
*
* \param arm11 Target state variable.
*/
static int arm11_check_init(struct arm11_common *arm11)
{
CHECK_RETVAL(arm11_read_DSCR(arm11));
if (!(arm11->dscr & DSCR_HALT_DBG_MODE)) {
LOG_DEBUG("DSCR %08x", (unsigned) arm11->dscr);
LOG_DEBUG("Bringing target into debug mode");
arm11->dscr |= DSCR_HALT_DBG_MODE;
CHECK_RETVAL(arm11_write_DSCR(arm11, arm11->dscr));
/* add further reset initialization here */
arm11->simulate_reset_on_next_halt = true;
if (arm11->dscr & DSCR_CORE_HALTED) {
/** \todo TODO: this needs further scrutiny because
* arm11_debug_entry() never gets called. (WHY NOT?)
* As a result we don't read the actual register states from
* the target.
*/
arm11->arm.target->state = TARGET_HALTED;
arm_dpm_report_dscr(arm11->arm.dpm, arm11->dscr);
} else {
arm11->arm.target->state = TARGET_RUNNING;
arm11->arm.target->debug_reason = DBG_REASON_NOTHALTED;
}
CHECK_RETVAL(arm11_sc7_clear_vbw(arm11));
}
return ERROR_OK;
}
/* target execution control */
static int arm11_halt(struct target *target)
{
struct arm11_common *arm11 = target_to_arm11(target);
LOG_DEBUG("target->state: %s",
target_state_name(target));
if (target->state == TARGET_UNKNOWN)
{
arm11->simulate_reset_on_next_halt = true;
}
if (target->state == TARGET_HALTED)
{
LOG_DEBUG("target was already halted");
return ERROR_OK;
}
arm11_add_IR(arm11, ARM11_HALT, TAP_IDLE);
CHECK_RETVAL(jtag_execute_queue());
int i = 0;
while (1)
{
CHECK_RETVAL(arm11_read_DSCR(arm11));
if (arm11->dscr & DSCR_CORE_HALTED)
break;
long long then = 0;
if (i == 1000)
{
then = timeval_ms();
}
if (i >= 1000)
{
if ((timeval_ms()-then) > 1000)
{
LOG_WARNING("Timeout (1000ms) waiting for instructions to complete");
return ERROR_FAIL;
}
}
i++;
}
enum target_state old_state = target->state;
CHECK_RETVAL(arm11_debug_entry(arm11));
CHECK_RETVAL(
target_call_event_callbacks(target,
old_state == TARGET_DEBUG_RUNNING ? TARGET_EVENT_DEBUG_HALTED : TARGET_EVENT_HALTED));
return ERROR_OK;
}
/**
* Save processor state. This is called after a HALT instruction
* succeeds, and on other occasions the processor enters debug mode
* (breakpoint, watchpoint, etc). Caller has updated arm11->dscr.
*/
static int arm11_debug_entry(struct arm11_common *arm11)
{
int retval;
arm11->arm.target->state = TARGET_HALTED;
arm_dpm_report_dscr(arm11->arm.dpm, arm11->dscr);
/* REVISIT entire cache should already be invalid !!! */
register_cache_invalidate(arm11->arm.core_cache);
/* See e.g. ARM1136 TRM, "14.8.4 Entering Debug state" */
/* maybe save wDTR (pending DCC write to debug SW, e.g. libdcc) */
arm11->is_wdtr_saved = !!(arm11->dscr & DSCR_DTR_TX_FULL);
if (arm11->is_wdtr_saved)
{
arm11_add_debug_SCAN_N(arm11, 0x05, ARM11_TAP_DEFAULT);
arm11_add_IR(arm11, ARM11_INTEST, ARM11_TAP_DEFAULT);
struct scan_field chain5_fields[3];
arm11_setup_field(arm11, 32, NULL,
&arm11->saved_wdtr, chain5_fields + 0);
arm11_setup_field(arm11, 1, NULL, NULL, chain5_fields + 1);
arm11_setup_field(arm11, 1, NULL, NULL, chain5_fields + 2);
arm11_add_dr_scan_vc(arm11->arm.target->tap, ARRAY_SIZE(chain5_fields), chain5_fields, TAP_DRPAUSE);
}
/* DSCR: set the Execute ARM instruction enable bit.
*
* ARM1176 spec says this is needed only for wDTR/rDTR's "ITR mode",
* but not to issue ITRs(?). The ARMv7 arch spec says it's required
* for executing instructions via ITR.
*/
CHECK_RETVAL(arm11_write_DSCR(arm11, DSCR_ITR_EN | arm11->dscr));
/* From the spec:
Before executing any instruction in debug state you have to drain the write buffer.
This ensures that no imprecise Data Aborts can return at a later point:*/
/** \todo TODO: Test drain write buffer. */
#if 0
while (1)
{
/* MRC p14,0,R0,c5,c10,0 */
// arm11_run_instr_no_data1(arm11, /*0xee150e1a*/0xe320f000);
/* mcr 15, 0, r0, cr7, cr10, {4} */
arm11_run_instr_no_data1(arm11, 0xee070f9a);
uint32_t dscr = arm11_read_DSCR(arm11);
LOG_DEBUG("DRAIN, DSCR %08x", dscr);
if (dscr & ARM11_DSCR_STICKY_IMPRECISE_DATA_ABORT)
{
arm11_run_instr_no_data1(arm11, 0xe320f000);
dscr = arm11_read_DSCR(arm11);
LOG_DEBUG("DRAIN, DSCR %08x (DONE)", dscr);
break;
}
}
#endif
/* Save registers.
*
* NOTE: ARM1136 TRM suggests saving just R0 here now, then
* CPSR and PC after the rDTR stuff. We do it all at once.
*/
retval = arm_dpm_read_current_registers(&arm11->dpm);
if (retval != ERROR_OK)
LOG_ERROR("DPM REG READ -- fail");
retval = arm11_run_instr_data_prepare(arm11);
if (retval != ERROR_OK)
return retval;
/* maybe save rDTR (pending DCC read from debug SW, e.g. libdcc) */
arm11->is_rdtr_saved = !!(arm11->dscr & DSCR_DTR_RX_FULL);
if (arm11->is_rdtr_saved)
{
/* MRC p14,0,R0,c0,c5,0 (move rDTR -> r0 (-> wDTR -> local var)) */
retval = arm11_run_instr_data_from_core_via_r0(arm11,
0xEE100E15, &arm11->saved_rdtr);
if (retval != ERROR_OK)
return retval;
}
/* REVISIT Now that we've saved core state, there's may also
* be MMU and cache state to care about ...
*/
if (arm11->simulate_reset_on_next_halt)
{
arm11->simulate_reset_on_next_halt = false;
LOG_DEBUG("Reset c1 Control Register");
/* Write 0 (reset value) to Control register 0 to disable MMU/Cache etc. */
/* MCR p15,0,R0,c1,c0,0 */
retval = arm11_run_instr_data_to_core_via_r0(arm11, 0xee010f10, 0);
if (retval != ERROR_OK)
return retval;
}
if (arm11->arm.target->debug_reason == DBG_REASON_WATCHPOINT) {
uint32_t wfar;
/* MRC p15, 0, <Rd>, c6, c0, 1 ; Read WFAR */
retval = arm11_run_instr_data_from_core_via_r0(arm11,
ARMV4_5_MRC(15, 0, 0, 6, 0, 1),
&wfar);
if (retval != ERROR_OK)
return retval;
arm_dpm_report_wfar(arm11->arm.dpm, wfar);
}
retval = arm11_run_instr_data_finish(arm11);
if (retval != ERROR_OK)
return retval;
return ERROR_OK;
}
static int arm11_step(struct target *target, int current,
uint32_t address, int handle_breakpoints)
{
LOG_DEBUG("target->state: %s",
target_state_name(target));
if (target->state != TARGET_HALTED)
{
LOG_WARNING("target was not halted");
return ERROR_TARGET_NOT_HALTED;
}
struct arm11_common *arm11 = target_to_arm11(target);
address = arm11_nextpc(arm11, current, address);
LOG_DEBUG("STEP PC %08" PRIx32 "%s", address, !current ? "!" : "");
/** \todo TODO: Thumb not supported here */
uint32_t next_instruction;
CHECK_RETVAL(arm11_read_memory_word(arm11, address, &next_instruction));
/* skip over BKPT */
if ((next_instruction & 0xFFF00070) == 0xe1200070)
{
address = arm11_nextpc(arm11, 0, address + 4);
LOG_DEBUG("Skipping BKPT");
}
/* skip over Wait for interrupt / Standby */
/* mcr 15, 0, r?, cr7, cr0, {4} */
else if ((next_instruction & 0xFFFF0FFF) == 0xee070f90)
{
address = arm11_nextpc(arm11, 0, address + 4);
LOG_DEBUG("Skipping WFI");
}
/* ignore B to self */
else if ((next_instruction & 0xFEFFFFFF) == 0xeafffffe)
{
LOG_DEBUG("Not stepping jump to self");
}
else
{
/** \todo TODO: check if break-/watchpoints make any sense at all in combination
* with this. */
/** \todo TODO: check if disabling IRQs might be a good idea here. Alternatively
* the VCR might be something worth looking into. */
/* Set up breakpoint for stepping */
struct arm11_sc7_action brp[2];
brp[0].write = 1;
brp[0].address = ARM11_SC7_BVR0;
brp[1].write = 1;
brp[1].address = ARM11_SC7_BCR0;
if (arm11->hardware_step)
{
/* Hardware single stepping ("instruction address
* mismatch") is used if enabled. It's not quite
* exactly "run one instruction"; "branch to here"
* loops won't break, neither will some other cases,
* but it's probably the best default.
*
* Hardware single stepping isn't supported on v6
* debug modules. ARM1176 and v7 can support it...
*
* FIXME Thumb stepping likely needs to use 0x03
* or 0xc0 byte masks, not 0x0f.
*/
brp[0].value = address;
brp[1].value = 0x1 | (3 << 1) | (0x0F << 5)
| (0 << 14) | (0 << 16) | (0 << 20)
| (2 << 21);
} else
{
/* Sets a breakpoint on the next PC, as calculated
* by instruction set simulation.
*
* REVISIT stepping Thumb on ARM1156 requires Thumb2
* support from the simulator.
*/
uint32_t next_pc;
int retval;
retval = arm_simulate_step(target, &next_pc);
if (retval != ERROR_OK)
return retval;
brp[0].value = next_pc;
brp[1].value = 0x1 | (3 << 1) | (0x0F << 5)
| (0 << 14) | (0 << 16) | (0 << 20)
| (0 << 21);
}
CHECK_RETVAL(arm11_sc7_run(arm11, brp, ARRAY_SIZE(brp)));
/* resume */
if (arm11->step_irq_enable)
/* this disable should be redundant ... */
arm11->dscr &= ~DSCR_INT_DIS;
else
arm11->dscr |= DSCR_INT_DIS;
CHECK_RETVAL(arm11_leave_debug_state(arm11, handle_breakpoints));
arm11_add_IR(arm11, ARM11_RESTART, TAP_IDLE);
CHECK_RETVAL(jtag_execute_queue());
/* wait for halt */
int i = 0;
while (1)
{
const uint32_t mask = DSCR_CORE_RESTARTED
| DSCR_CORE_HALTED;
CHECK_RETVAL(arm11_read_DSCR(arm11));
LOG_DEBUG("DSCR %08x e", (unsigned) arm11->dscr);
if ((arm11->dscr & mask) == mask)
break;
long long then = 0;
if (i == 1000)
{
then = timeval_ms();
}
if (i >= 1000)
{
if ((timeval_ms()-then) > 1000)
{
LOG_WARNING("Timeout (1000ms) waiting for instructions to complete");
return ERROR_FAIL;
}
}
i++;
}
/* clear breakpoint */
CHECK_RETVAL(arm11_sc7_clear_vbw(arm11));
/* save state */
CHECK_RETVAL(arm11_debug_entry(arm11));
/* restore default state */
arm11->dscr &= ~DSCR_INT_DIS;
}
target->debug_reason = DBG_REASON_SINGLESTEP;
CHECK_RETVAL(target_call_event_callbacks(target, TARGET_EVENT_HALTED));
return ERROR_OK;
}
static int arm11_resume(struct target *target, int current,
uint32_t address, int handle_breakpoints, int debug_execution)
{
// LOG_DEBUG("current %d address %08x handle_breakpoints %d debug_execution %d",
// current, address, handle_breakpoints, debug_execution);
struct arm11_common *arm11 = target_to_arm11(target);
LOG_DEBUG("target->state: %s",
target_state_name(target));
if (target->state != TARGET_HALTED)
{
LOG_ERROR("Target not halted");
return ERROR_TARGET_NOT_HALTED;
}
address = arm11_nextpc(arm11, current, address);
LOG_DEBUG("RESUME PC %08" PRIx32 "%s", address, !current ? "!" : "");
/* clear breakpoints/watchpoints and VCR*/
CHECK_RETVAL(arm11_sc7_clear_vbw(arm11));
if (!debug_execution)
target_free_all_working_areas(target);
/* Should we skip over breakpoints matching the PC? */
if (handle_breakpoints) {
struct breakpoint *bp;
for (bp = target->breakpoints; bp; bp = bp->next)
{
if (bp->address == address)
{
LOG_DEBUG("must step over %08" PRIx32 "", bp->address);
arm11_step(target, 1, 0, 0);
break;
}
}
}
/* activate all breakpoints */
if (true) {
struct breakpoint *bp;
unsigned brp_num = 0;
for (bp = target->breakpoints; bp; bp = bp->next)
{
struct arm11_sc7_action brp[2];
brp[0].write = 1;
brp[0].address = ARM11_SC7_BVR0 + brp_num;
brp[0].value = bp->address;
brp[1].write = 1;
brp[1].address = ARM11_SC7_BCR0 + brp_num;
brp[1].value = 0x1 | (3 << 1) | (0x0F << 5) | (0 << 14) | (0 << 16) | (0 << 20) | (0 << 21);
CHECK_RETVAL(arm11_sc7_run(arm11, brp, ARRAY_SIZE(brp)));
LOG_DEBUG("Add BP %d at %08" PRIx32, brp_num,
bp->address);
brp_num++;
}
if (arm11->vcr)
CHECK_RETVAL(arm11_sc7_set_vcr(arm11, arm11->vcr));
}
/* activate all watchpoints and breakpoints */
CHECK_RETVAL(arm11_leave_debug_state(arm11, true));
arm11_add_IR(arm11, ARM11_RESTART, TAP_IDLE);
CHECK_RETVAL(jtag_execute_queue());
int i = 0;
while (1)
{
CHECK_RETVAL(arm11_read_DSCR(arm11));
LOG_DEBUG("DSCR %08x", (unsigned) arm11->dscr);
if (arm11->dscr & DSCR_CORE_RESTARTED)
break;
long long then = 0;
if (i == 1000)
{
then = timeval_ms();
}
if (i >= 1000)
{
if ((timeval_ms()-then) > 1000)
{
LOG_WARNING("Timeout (1000ms) waiting for instructions to complete");
return ERROR_FAIL;
}
}
i++;
}
target->debug_reason = DBG_REASON_NOTHALTED;
if (!debug_execution)
target->state = TARGET_RUNNING;
else
target->state = TARGET_DEBUG_RUNNING;
CHECK_RETVAL(target_call_event_callbacks(target, TARGET_EVENT_RESUMED));
return ERROR_OK;
}
/**
* Restore processor state. This is called in preparation for
* the RESTART function.
*/
static int arm11_leave_debug_state(struct arm11_common *arm11, bool bpwp)
{
int retval;
/* See e.g. ARM1136 TRM, "14.8.5 Leaving Debug state" */
/* NOTE: the ARM1136 TRM suggests restoring all registers
* except R0/PC/CPSR right now. Instead, we do them all
* at once, just a bit later on.
*/
/* REVISIT once we start caring about MMU and cache state,
* address it here ...
*/
/* spec says clear wDTR and rDTR; we assume they are clear as
otherwise our programming would be sloppy */
{
CHECK_RETVAL(arm11_read_DSCR(arm11));
if (arm11->dscr & (DSCR_DTR_RX_FULL | DSCR_DTR_TX_FULL))
{
/*
The wDTR/rDTR two registers that are used to send/receive data to/from
the core in tandem with corresponding instruction codes that are
written into the core. The RDTR FULL/WDTR FULL flag indicates that the
registers hold data that was written by one side (CPU or JTAG) and not
read out by the other side.
*/
LOG_ERROR("wDTR/rDTR inconsistent (DSCR %08x)",
(unsigned) arm11->dscr);
return ERROR_FAIL;
}
}
/* maybe restore original wDTR */
if (arm11->is_wdtr_saved)
{
retval = arm11_run_instr_data_prepare(arm11);
if (retval != ERROR_OK)
return retval;
/* MCR p14,0,R0,c0,c5,0 */
retval = arm11_run_instr_data_to_core_via_r0(arm11,
0xee000e15, arm11->saved_wdtr);
if (retval != ERROR_OK)
return retval;
retval = arm11_run_instr_data_finish(arm11);
if (retval != ERROR_OK)
return retval;
}
/* restore CPSR, PC, and R0 ... after flushing any modified
* registers.
*/
CHECK_RETVAL(arm_dpm_write_dirty_registers(&arm11->dpm, bpwp));
CHECK_RETVAL(arm11_bpwp_flush(arm11));
register_cache_invalidate(arm11->arm.core_cache);
/* restore DSCR */
CHECK_RETVAL(arm11_write_DSCR(arm11, arm11->dscr));
/* maybe restore rDTR */
if (arm11->is_rdtr_saved)
{
arm11_add_debug_SCAN_N(arm11, 0x05, ARM11_TAP_DEFAULT);
arm11_add_IR(arm11, ARM11_EXTEST, ARM11_TAP_DEFAULT);
struct scan_field chain5_fields[3];
uint8_t Ready = 0; /* ignored */
uint8_t Valid = 0; /* ignored */
arm11_setup_field(arm11, 32, &arm11->saved_rdtr,
NULL, chain5_fields + 0);
arm11_setup_field(arm11, 1, &Ready, NULL, chain5_fields + 1);
arm11_setup_field(arm11, 1, &Valid, NULL, chain5_fields + 2);
arm11_add_dr_scan_vc(arm11->arm.target->tap, ARRAY_SIZE(chain5_fields), chain5_fields, TAP_DRPAUSE);
}
/* now processor is ready to RESTART */
return ERROR_OK;
}
