You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
 
 
 
 

824 lines
23 KiB

  1. /***************************************************************************
  2. * Copyright (C) 2007 by Dominic Rath *
  3. * Dominic.Rath@gmx.de *
  4. * *
  5. * Copyright (C) 2007,2008,2009 by √ėyvind Harboe *
  6. * oyvind.harboe@zylin.com *
  7. * *
  8. * This program is free software; you can redistribute it and/or modify *
  9. * it under the terms of the GNU General Public License as published by *
  10. * the Free Software Foundation; either version 2 of the License, or *
  11. * (at your option) any later version. *
  12. * *
  13. * This program is distributed in the hope that it will be useful, *
  14. * but WITHOUT ANY WARRANTY; without even the implied warranty of *
  15. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
  16. * GNU General Public License for more details. *
  17. * *
  18. * You should have received a copy of the GNU General Public License *
  19. * along with this program; if not, write to the *
  20. * Free Software Foundation, Inc., *
  21. * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
  22. ***************************************************************************/
  23. #ifdef HAVE_CONFIG_H
  24. #include "config.h"
  25. #endif
  26. #include "arm926ejs.h"
  27. #include <helper/time_support.h>
  28. #include "target_type.h"
  29. #include "register.h"
  30. #include "arm_opcodes.h"
  31. /*
  32. * The ARM926 is built around the ARM9EJ-S core, and most JTAG docs
  33. * are in the ARM9EJ-S Technical Reference Manual (ARM DDI 0222B) not
  34. * the ARM926 manual (ARM DDI 0198E). The scan chains are:
  35. *
  36. * 1 ... core debugging
  37. * 2 ... EmbeddedICE
  38. * 3 ... external boundary scan (SoC-specific, unused here)
  39. * 6 ... ETM
  40. * 15 ... coprocessor 15
  41. */
  42. #if 0
  43. #define _DEBUG_INSTRUCTION_EXECUTION_
  44. #endif
  45. #define ARM926EJS_CP15_ADDR(opcode_1, opcode_2, CRn, CRm) ((opcode_1 << 11) | (opcode_2 << 8) | (CRn << 4) | (CRm << 0))
  46. static int arm926ejs_cp15_read(struct target *target, uint32_t op1, uint32_t op2,
  47. uint32_t CRn, uint32_t CRm, uint32_t *value)
  48. {
  49. int retval = ERROR_OK;
  50. struct arm7_9_common *arm7_9 = target_to_arm7_9(target);
  51. struct arm_jtag *jtag_info = &arm7_9->jtag_info;
  52. uint32_t address = ARM926EJS_CP15_ADDR(op1, op2, CRn, CRm);
  53. struct scan_field fields[4];
  54. uint8_t address_buf[2] = {0, 0};
  55. uint8_t nr_w_buf = 0;
  56. uint8_t access = 1;
  57. buf_set_u32(address_buf, 0, 14, address);
  58. jtag_set_end_state(TAP_IDLE);
  59. if ((retval = arm_jtag_scann(jtag_info, 0xf)) != ERROR_OK)
  60. {
  61. return retval;
  62. }
  63. arm_jtag_set_instr(jtag_info, jtag_info->intest_instr, NULL);
  64. fields[0].tap = jtag_info->tap;
  65. fields[0].num_bits = 32;
  66. fields[0].out_value = NULL;
  67. fields[0].in_value = (uint8_t *)value;
  68. fields[1].tap = jtag_info->tap;
  69. fields[1].num_bits = 1;
  70. fields[1].out_value = &access;
  71. fields[1].in_value = &access;
  72. fields[2].tap = jtag_info->tap;
  73. fields[2].num_bits = 14;
  74. fields[2].out_value = address_buf;
  75. fields[2].in_value = NULL;
  76. fields[3].tap = jtag_info->tap;
  77. fields[3].num_bits = 1;
  78. fields[3].out_value = &nr_w_buf;
  79. fields[3].in_value = NULL;
  80. jtag_add_dr_scan(4, fields, jtag_get_end_state());
  81. long long then = timeval_ms();
  82. for (;;)
  83. {
  84. /* rescan with NOP, to wait for the access to complete */
  85. access = 0;
  86. nr_w_buf = 0;
  87. jtag_add_dr_scan(4, fields, jtag_get_end_state());
  88. jtag_add_callback(arm_le_to_h_u32, (jtag_callback_data_t)value);
  89. if ((retval = jtag_execute_queue()) != ERROR_OK)
  90. {
  91. return retval;
  92. }
  93. if (buf_get_u32(&access, 0, 1) == 1)
  94. {
  95. break;
  96. }
  97. /* 10ms timeout */
  98. if ((timeval_ms()-then)>10)
  99. {
  100. LOG_ERROR("cp15 read operation timed out");
  101. return ERROR_FAIL;
  102. }
  103. }
  104. #ifdef _DEBUG_INSTRUCTION_EXECUTION_
  105. LOG_DEBUG("addr: 0x%x value: %8.8x", address, *value);
  106. #endif
  107. arm_jtag_set_instr(jtag_info, 0xc, NULL);
  108. return ERROR_OK;
  109. }
  110. static int arm926ejs_mrc(struct target *target, int cpnum, uint32_t op1,
  111. uint32_t op2, uint32_t CRn, uint32_t CRm, uint32_t *value)
  112. {
  113. if (cpnum != 15) {
  114. LOG_ERROR("Only cp15 is supported");
  115. return ERROR_FAIL;
  116. }
  117. return arm926ejs_cp15_read(target, op1, op2, CRn, CRm, value);
  118. }
  119. static int arm926ejs_cp15_write(struct target *target, uint32_t op1, uint32_t op2,
  120. uint32_t CRn, uint32_t CRm, uint32_t value)
  121. {
  122. int retval = ERROR_OK;
  123. struct arm7_9_common *arm7_9 = target_to_arm7_9(target);
  124. struct arm_jtag *jtag_info = &arm7_9->jtag_info;
  125. uint32_t address = ARM926EJS_CP15_ADDR(op1, op2, CRn, CRm);
  126. struct scan_field fields[4];
  127. uint8_t value_buf[4];
  128. uint8_t address_buf[2] = {0, 0};
  129. uint8_t nr_w_buf = 1;
  130. uint8_t access = 1;
  131. buf_set_u32(address_buf, 0, 14, address);
  132. buf_set_u32(value_buf, 0, 32, value);
  133. jtag_set_end_state(TAP_IDLE);
  134. if ((retval = arm_jtag_scann(jtag_info, 0xf)) != ERROR_OK)
  135. {
  136. return retval;
  137. }
  138. arm_jtag_set_instr(jtag_info, jtag_info->intest_instr, NULL);
  139. fields[0].tap = jtag_info->tap;
  140. fields[0].num_bits = 32;
  141. fields[0].out_value = value_buf;
  142. fields[0].in_value = NULL;
  143. fields[1].tap = jtag_info->tap;
  144. fields[1].num_bits = 1;
  145. fields[1].out_value = &access;
  146. fields[1].in_value = &access;
  147. fields[2].tap = jtag_info->tap;
  148. fields[2].num_bits = 14;
  149. fields[2].out_value = address_buf;
  150. fields[2].in_value = NULL;
  151. fields[3].tap = jtag_info->tap;
  152. fields[3].num_bits = 1;
  153. fields[3].out_value = &nr_w_buf;
  154. fields[3].in_value = NULL;
  155. jtag_add_dr_scan(4, fields, jtag_get_end_state());
  156. long long then = timeval_ms();
  157. for (;;)
  158. {
  159. /* rescan with NOP, to wait for the access to complete */
  160. access = 0;
  161. nr_w_buf = 0;
  162. jtag_add_dr_scan(4, fields, jtag_get_end_state());
  163. if ((retval = jtag_execute_queue()) != ERROR_OK)
  164. {
  165. return retval;
  166. }
  167. if (buf_get_u32(&access, 0, 1) == 1)
  168. {
  169. break;
  170. }
  171. /* 10ms timeout */
  172. if ((timeval_ms()-then)>10)
  173. {
  174. LOG_ERROR("cp15 write operation timed out");
  175. return ERROR_FAIL;
  176. }
  177. }
  178. #ifdef _DEBUG_INSTRUCTION_EXECUTION_
  179. LOG_DEBUG("addr: 0x%x value: %8.8x", address, value);
  180. #endif
  181. arm_jtag_set_instr(jtag_info, 0xf, NULL);
  182. return ERROR_OK;
  183. }
  184. static int arm926ejs_mcr(struct target *target, int cpnum, uint32_t op1,
  185. uint32_t op2, uint32_t CRn, uint32_t CRm, uint32_t value)
  186. {
  187. if (cpnum != 15) {
  188. LOG_ERROR("Only cp15 is supported");
  189. return ERROR_FAIL;
  190. }
  191. return arm926ejs_cp15_write(target, op1, op2, CRn, CRm, value);
  192. }
  193. static int arm926ejs_examine_debug_reason(struct target *target)
  194. {
  195. struct arm7_9_common *arm7_9 = target_to_arm7_9(target);
  196. struct reg *dbg_stat = &arm7_9->eice_cache->reg_list[EICE_DBG_STAT];
  197. int debug_reason;
  198. int retval;
  199. embeddedice_read_reg(dbg_stat);
  200. if ((retval = jtag_execute_queue()) != ERROR_OK)
  201. return retval;
  202. /* Method-Of-Entry (MOE) field */
  203. debug_reason = buf_get_u32(dbg_stat->value, 6, 4);
  204. switch (debug_reason)
  205. {
  206. case 0:
  207. LOG_DEBUG("no *NEW* debug entry (?missed one?)");
  208. /* ... since last restart or debug reset ... */
  209. target->debug_reason = DBG_REASON_DBGRQ;
  210. break;
  211. case 1:
  212. LOG_DEBUG("breakpoint from EICE unit 0");
  213. target->debug_reason = DBG_REASON_BREAKPOINT;
  214. break;
  215. case 2:
  216. LOG_DEBUG("breakpoint from EICE unit 1");
  217. target->debug_reason = DBG_REASON_BREAKPOINT;
  218. break;
  219. case 3:
  220. LOG_DEBUG("soft breakpoint (BKPT instruction)");
  221. target->debug_reason = DBG_REASON_BREAKPOINT;
  222. break;
  223. case 4:
  224. LOG_DEBUG("vector catch breakpoint");
  225. target->debug_reason = DBG_REASON_BREAKPOINT;
  226. break;
  227. case 5:
  228. LOG_DEBUG("external breakpoint");
  229. target->debug_reason = DBG_REASON_BREAKPOINT;
  230. break;
  231. case 6:
  232. LOG_DEBUG("watchpoint from EICE unit 0");
  233. target->debug_reason = DBG_REASON_WATCHPOINT;
  234. break;
  235. case 7:
  236. LOG_DEBUG("watchpoint from EICE unit 1");
  237. target->debug_reason = DBG_REASON_WATCHPOINT;
  238. break;
  239. case 8:
  240. LOG_DEBUG("external watchpoint");
  241. target->debug_reason = DBG_REASON_WATCHPOINT;
  242. break;
  243. case 9:
  244. LOG_DEBUG("internal debug request");
  245. target->debug_reason = DBG_REASON_DBGRQ;
  246. break;
  247. case 10:
  248. LOG_DEBUG("external debug request");
  249. target->debug_reason = DBG_REASON_DBGRQ;
  250. break;
  251. case 11:
  252. LOG_DEBUG("debug re-entry from system speed access");
  253. /* This is normal when connecting to something that's
  254. * already halted, or in some related code paths, but
  255. * otherwise is surprising (and presumably wrong).
  256. */
  257. switch (target->debug_reason) {
  258. case DBG_REASON_DBGRQ:
  259. break;
  260. default:
  261. LOG_ERROR("unexpected -- debug re-entry");
  262. /* FALLTHROUGH */
  263. case DBG_REASON_UNDEFINED:
  264. target->debug_reason = DBG_REASON_DBGRQ;
  265. break;
  266. }
  267. break;
  268. case 12:
  269. /* FIX!!!! here be dragons!!! We need to fail here so
  270. * the target will interpreted as halted but we won't
  271. * try to talk to it right now... a resume + halt seems
  272. * to sync things up again. Please send an email to
  273. * openocd development mailing list if you have hardware
  274. * to donate to look into this problem....
  275. */
  276. LOG_WARNING("WARNING: mystery debug reason MOE = 0xc. Try issuing a resume + halt.");
  277. target->debug_reason = DBG_REASON_DBGRQ;
  278. break;
  279. default:
  280. LOG_WARNING("WARNING: unknown debug reason: 0x%x", debug_reason);
  281. /* Oh agony! should we interpret this as a halt request or
  282. * that the target stopped on it's own accord?
  283. */
  284. target->debug_reason = DBG_REASON_DBGRQ;
  285. /* if we fail here, we won't talk to the target and it will
  286. * be reported to be in the halted state */
  287. break;
  288. }
  289. return ERROR_OK;
  290. }
  291. static uint32_t arm926ejs_get_ttb(struct target *target)
  292. {
  293. struct arm926ejs_common *arm926ejs = target_to_arm926(target);
  294. int retval;
  295. uint32_t ttb = 0x0;
  296. if ((retval = arm926ejs->read_cp15(target, 0, 0, 2, 0, &ttb)) != ERROR_OK)
  297. return retval;
  298. return ttb;
  299. }
  300. static void arm926ejs_disable_mmu_caches(struct target *target, int mmu,
  301. int d_u_cache, int i_cache)
  302. {
  303. struct arm926ejs_common *arm926ejs = target_to_arm926(target);
  304. uint32_t cp15_control;
  305. /* read cp15 control register */
  306. arm926ejs->read_cp15(target, 0, 0, 1, 0, &cp15_control);
  307. jtag_execute_queue();
  308. if (mmu)
  309. {
  310. /* invalidate TLB */
  311. arm926ejs->write_cp15(target, 0, 0, 8, 7, 0x0);
  312. cp15_control &= ~0x1U;
  313. }
  314. if (d_u_cache)
  315. {
  316. uint32_t debug_override;
  317. /* read-modify-write CP15 debug override register
  318. * to enable "test and clean all" */
  319. arm926ejs->read_cp15(target, 0, 0, 15, 0, &debug_override);
  320. debug_override |= 0x80000;
  321. arm926ejs->write_cp15(target, 0, 0, 15, 0, debug_override);
  322. /* clean and invalidate DCache */
  323. arm926ejs->write_cp15(target, 0, 0, 7, 5, 0x0);
  324. /* write CP15 debug override register
  325. * to disable "test and clean all" */
  326. debug_override &= ~0x80000;
  327. arm926ejs->write_cp15(target, 0, 0, 15, 0, debug_override);
  328. cp15_control &= ~0x4U;
  329. }
  330. if (i_cache)
  331. {
  332. /* invalidate ICache */
  333. arm926ejs->write_cp15(target, 0, 0, 7, 5, 0x0);
  334. cp15_control &= ~0x1000U;
  335. }
  336. arm926ejs->write_cp15(target, 0, 0, 1, 0, cp15_control);
  337. }
  338. static void arm926ejs_enable_mmu_caches(struct target *target, int mmu,
  339. int d_u_cache, int i_cache)
  340. {
  341. struct arm926ejs_common *arm926ejs = target_to_arm926(target);
  342. uint32_t cp15_control;
  343. /* read cp15 control register */
  344. arm926ejs->read_cp15(target, 0, 0, 1, 0, &cp15_control);
  345. jtag_execute_queue();
  346. if (mmu)
  347. cp15_control |= 0x1U;
  348. if (d_u_cache)
  349. cp15_control |= 0x4U;
  350. if (i_cache)
  351. cp15_control |= 0x1000U;
  352. arm926ejs->write_cp15(target, 0, 0, 1, 0, cp15_control);
  353. }
  354. static void arm926ejs_post_debug_entry(struct target *target)
  355. {
  356. struct arm926ejs_common *arm926ejs = target_to_arm926(target);
  357. /* examine cp15 control reg */
  358. arm926ejs->read_cp15(target, 0, 0, 1, 0, &arm926ejs->cp15_control_reg);
  359. jtag_execute_queue();
  360. LOG_DEBUG("cp15_control_reg: %8.8" PRIx32 "", arm926ejs->cp15_control_reg);
  361. if (arm926ejs->armv4_5_mmu.armv4_5_cache.ctype == -1)
  362. {
  363. uint32_t cache_type_reg;
  364. /* identify caches */
  365. arm926ejs->read_cp15(target, 0, 1, 0, 0, &cache_type_reg);
  366. jtag_execute_queue();
  367. armv4_5_identify_cache(cache_type_reg, &arm926ejs->armv4_5_mmu.armv4_5_cache);
  368. }
  369. arm926ejs->armv4_5_mmu.mmu_enabled = (arm926ejs->cp15_control_reg & 0x1U) ? 1 : 0;
  370. arm926ejs->armv4_5_mmu.armv4_5_cache.d_u_cache_enabled = (arm926ejs->cp15_control_reg & 0x4U) ? 1 : 0;
  371. arm926ejs->armv4_5_mmu.armv4_5_cache.i_cache_enabled = (arm926ejs->cp15_control_reg & 0x1000U) ? 1 : 0;
  372. /* save i/d fault status and address register */
  373. arm926ejs->read_cp15(target, 0, 0, 5, 0, &arm926ejs->d_fsr);
  374. arm926ejs->read_cp15(target, 0, 1, 5, 0, &arm926ejs->i_fsr);
  375. arm926ejs->read_cp15(target, 0, 0, 6, 0, &arm926ejs->d_far);
  376. LOG_DEBUG("D FSR: 0x%8.8" PRIx32 ", D FAR: 0x%8.8" PRIx32 ", I FSR: 0x%8.8" PRIx32 "",
  377. arm926ejs->d_fsr, arm926ejs->d_far, arm926ejs->i_fsr);
  378. uint32_t cache_dbg_ctrl;
  379. /* read-modify-write CP15 cache debug control register
  380. * to disable I/D-cache linefills and force WT */
  381. arm926ejs->read_cp15(target, 7, 0, 15, 0, &cache_dbg_ctrl);
  382. cache_dbg_ctrl |= 0x7;
  383. arm926ejs->write_cp15(target, 7, 0, 15, 0, cache_dbg_ctrl);
  384. }
  385. static void arm926ejs_pre_restore_context(struct target *target)
  386. {
  387. struct arm926ejs_common *arm926ejs = target_to_arm926(target);
  388. /* restore i/d fault status and address register */
  389. arm926ejs->write_cp15(target, 0, 0, 5, 0, arm926ejs->d_fsr);
  390. arm926ejs->write_cp15(target, 0, 1, 5, 0, arm926ejs->i_fsr);
  391. arm926ejs->write_cp15(target, 0, 0, 6, 0, arm926ejs->d_far);
  392. uint32_t cache_dbg_ctrl;
  393. /* read-modify-write CP15 cache debug control register
  394. * to reenable I/D-cache linefills and disable WT */
  395. arm926ejs->read_cp15(target, 7, 0, 15, 0, &cache_dbg_ctrl);
  396. cache_dbg_ctrl &= ~0x7;
  397. arm926ejs->write_cp15(target, 7, 0, 15, 0, cache_dbg_ctrl);
  398. }
  399. static const char arm926_not[] = "target is not an ARM926";
  400. static int arm926ejs_verify_pointer(struct command_context *cmd_ctx,
  401. struct arm926ejs_common *arm926)
  402. {
  403. if (arm926->common_magic != ARM926EJS_COMMON_MAGIC) {
  404. command_print(cmd_ctx, arm926_not);
  405. return ERROR_TARGET_INVALID;
  406. }
  407. return ERROR_OK;
  408. }
  409. /** Logs summary of ARM926 state for a halted target. */
  410. int arm926ejs_arch_state(struct target *target)
  411. {
  412. static const char *state[] =
  413. {
  414. "disabled", "enabled"
  415. };
  416. struct arm926ejs_common *arm926ejs = target_to_arm926(target);
  417. struct arm *armv4_5;
  418. if (arm926ejs->common_magic != ARM926EJS_COMMON_MAGIC)
  419. {
  420. LOG_ERROR("BUG: %s", arm926_not);
  421. return ERROR_TARGET_INVALID;
  422. }
  423. armv4_5 = &arm926ejs->arm7_9_common.armv4_5_common;
  424. arm_arch_state(target);
  425. LOG_USER("MMU: %s, D-Cache: %s, I-Cache: %s",
  426. state[arm926ejs->armv4_5_mmu.mmu_enabled],
  427. state[arm926ejs->armv4_5_mmu.armv4_5_cache.d_u_cache_enabled],
  428. state[arm926ejs->armv4_5_mmu.armv4_5_cache.i_cache_enabled]);
  429. return ERROR_OK;
  430. }
  431. int arm926ejs_soft_reset_halt(struct target *target)
  432. {
  433. int retval = ERROR_OK;
  434. struct arm926ejs_common *arm926ejs = target_to_arm926(target);
  435. struct arm7_9_common *arm7_9 = target_to_arm7_9(target);
  436. struct arm *armv4_5 = &arm7_9->armv4_5_common;
  437. struct reg *dbg_stat = &arm7_9->eice_cache->reg_list[EICE_DBG_STAT];
  438. if ((retval = target_halt(target)) != ERROR_OK)
  439. {
  440. return retval;
  441. }
  442. long long then = timeval_ms();
  443. int timeout;
  444. while (!(timeout = ((timeval_ms()-then) > 1000)))
  445. {
  446. if (buf_get_u32(dbg_stat->value, EICE_DBG_STATUS_DBGACK, 1) == 0)
  447. {
  448. embeddedice_read_reg(dbg_stat);
  449. if ((retval = jtag_execute_queue()) != ERROR_OK)
  450. {
  451. return retval;
  452. }
  453. } else
  454. {
  455. break;
  456. }
  457. if (debug_level >= 1)
  458. {
  459. /* do not eat all CPU, time out after 1 se*/
  460. alive_sleep(100);
  461. } else
  462. {
  463. keep_alive();
  464. }
  465. }
  466. if (timeout)
  467. {
  468. LOG_ERROR("Failed to halt CPU after 1 sec");
  469. return ERROR_TARGET_TIMEOUT;
  470. }
  471. target->state = TARGET_HALTED;
  472. /* SVC, ARM state, IRQ and FIQ disabled */
  473. uint32_t cpsr;
  474. cpsr = buf_get_u32(armv4_5->cpsr->value, 0, 32);
  475. cpsr &= ~0xff;
  476. cpsr |= 0xd3;
  477. arm_set_cpsr(armv4_5, cpsr);
  478. armv4_5->cpsr->dirty = 1;
  479. /* start fetching from 0x0 */
  480. buf_set_u32(armv4_5->core_cache->reg_list[15].value, 0, 32, 0x0);
  481. armv4_5->core_cache->reg_list[15].dirty = 1;
  482. armv4_5->core_cache->reg_list[15].valid = 1;
  483. arm926ejs_disable_mmu_caches(target, 1, 1, 1);
  484. arm926ejs->armv4_5_mmu.mmu_enabled = 0;
  485. arm926ejs->armv4_5_mmu.armv4_5_cache.d_u_cache_enabled = 0;
  486. arm926ejs->armv4_5_mmu.armv4_5_cache.i_cache_enabled = 0;
  487. return target_call_event_callbacks(target, TARGET_EVENT_HALTED);
  488. }
  489. /** Writes a buffer, in the specified word size, with current MMU settings. */
  490. int arm926ejs_write_memory(struct target *target, uint32_t address,
  491. uint32_t size, uint32_t count, uint8_t *buffer)
  492. {
  493. int retval;
  494. struct arm926ejs_common *arm926ejs = target_to_arm926(target);
  495. /* FIX!!!! this should be cleaned up and made much more general. The
  496. * plan is to write up and test on arm926ejs specifically and
  497. * then generalize and clean up afterwards. */
  498. if (arm926ejs->armv4_5_mmu.mmu_enabled && (count == 1) && ((size==2) || (size==4)))
  499. {
  500. /* special case the handling of single word writes to bypass MMU
  501. * to allow implementation of breakpoints in memory marked read only
  502. * by MMU */
  503. if (arm926ejs->armv4_5_mmu.armv4_5_cache.d_u_cache_enabled)
  504. {
  505. /* flush and invalidate data cache
  506. *
  507. * MCR p15,0,p,c7,c10,1 - clean cache line using virtual address
  508. *
  509. */
  510. retval = arm926ejs->write_cp15(target, 0, 1, 7, 10, address&~0x3);
  511. if (retval != ERROR_OK)
  512. return retval;
  513. }
  514. uint32_t pa;
  515. retval = target->type->virt2phys(target, address, &pa);
  516. if (retval != ERROR_OK)
  517. return retval;
  518. /* write directly to physical memory bypassing any read only MMU bits, etc. */
  519. retval = armv4_5_mmu_write_physical(target, &arm926ejs->armv4_5_mmu, pa, size, count, buffer);
  520. if (retval != ERROR_OK)
  521. return retval;
  522. } else
  523. {
  524. if ((retval = arm7_9_write_memory(target, address, size, count, buffer)) != ERROR_OK)
  525. return retval;
  526. }
  527. /* If ICache is enabled, we have to invalidate affected ICache lines
  528. * the DCache is forced to write-through, so we don't have to clean it here
  529. */
  530. if (arm926ejs->armv4_5_mmu.armv4_5_cache.i_cache_enabled)
  531. {
  532. if (count <= 1)
  533. {
  534. /* invalidate ICache single entry with MVA */
  535. arm926ejs->write_cp15(target, 0, 1, 7, 5, address);
  536. }
  537. else
  538. {
  539. /* invalidate ICache */
  540. arm926ejs->write_cp15(target, 0, 0, 7, 5, address);
  541. }
  542. }
  543. return retval;
  544. }
  545. static int arm926ejs_write_phys_memory(struct target *target,
  546. uint32_t address, uint32_t size,
  547. uint32_t count, uint8_t *buffer)
  548. {
  549. struct arm926ejs_common *arm926ejs = target_to_arm926(target);
  550. return armv4_5_mmu_write_physical(target, &arm926ejs->armv4_5_mmu,
  551. address, size, count, buffer);
  552. }
  553. static int arm926ejs_read_phys_memory(struct target *target,
  554. uint32_t address, uint32_t size,
  555. uint32_t count, uint8_t *buffer)
  556. {
  557. struct arm926ejs_common *arm926ejs = target_to_arm926(target);
  558. return armv4_5_mmu_read_physical(target, &arm926ejs->armv4_5_mmu,
  559. address, size, count, buffer);
  560. }
  561. int arm926ejs_init_arch_info(struct target *target, struct arm926ejs_common *arm926ejs,
  562. struct jtag_tap *tap)
  563. {
  564. struct arm7_9_common *arm7_9 = &arm926ejs->arm7_9_common;
  565. arm7_9->armv4_5_common.mrc = arm926ejs_mrc;
  566. arm7_9->armv4_5_common.mcr = arm926ejs_mcr;
  567. /* initialize arm7/arm9 specific info (including armv4_5) */
  568. arm9tdmi_init_arch_info(target, arm7_9, tap);
  569. arm926ejs->common_magic = ARM926EJS_COMMON_MAGIC;
  570. arm7_9->post_debug_entry = arm926ejs_post_debug_entry;
  571. arm7_9->pre_restore_context = arm926ejs_pre_restore_context;
  572. arm926ejs->read_cp15 = arm926ejs_cp15_read;
  573. arm926ejs->write_cp15 = arm926ejs_cp15_write;
  574. arm926ejs->armv4_5_mmu.armv4_5_cache.ctype = -1;
  575. arm926ejs->armv4_5_mmu.get_ttb = arm926ejs_get_ttb;
  576. arm926ejs->armv4_5_mmu.read_memory = arm7_9_read_memory;
  577. arm926ejs->armv4_5_mmu.write_memory = arm7_9_write_memory;
  578. arm926ejs->armv4_5_mmu.disable_mmu_caches = arm926ejs_disable_mmu_caches;
  579. arm926ejs->armv4_5_mmu.enable_mmu_caches = arm926ejs_enable_mmu_caches;
  580. arm926ejs->armv4_5_mmu.has_tiny_pages = 1;
  581. arm926ejs->armv4_5_mmu.mmu_enabled = 0;
  582. arm7_9->examine_debug_reason = arm926ejs_examine_debug_reason;
  583. /* The ARM926EJ-S implements the ARMv5TE architecture which
  584. * has the BKPT instruction, so we don't have to use a watchpoint comparator
  585. */
  586. arm7_9->arm_bkpt = ARMV5_BKPT(0x0);
  587. arm7_9->thumb_bkpt = ARMV5_T_BKPT(0x0) & 0xffff;
  588. return ERROR_OK;
  589. }
  590. static int arm926ejs_target_create(struct target *target, Jim_Interp *interp)
  591. {
  592. struct arm926ejs_common *arm926ejs = calloc(1,sizeof(struct arm926ejs_common));
  593. /* ARM9EJ-S core always reports 0x1 in Capture-IR */
  594. target->tap->ir_capture_mask = 0x0f;
  595. return arm926ejs_init_arch_info(target, arm926ejs, target->tap);
  596. }
  597. COMMAND_HANDLER(arm926ejs_handle_cache_info_command)
  598. {
  599. int retval;
  600. struct target *target = get_current_target(CMD_CTX);
  601. struct arm926ejs_common *arm926ejs = target_to_arm926(target);
  602. retval = arm926ejs_verify_pointer(CMD_CTX, arm926ejs);
  603. if (retval != ERROR_OK)
  604. return retval;
  605. return armv4_5_handle_cache_info_command(CMD_CTX, &arm926ejs->armv4_5_mmu.armv4_5_cache);
  606. }
  607. static int arm926ejs_virt2phys(struct target *target, uint32_t virtual, uint32_t *physical)
  608. {
  609. int type;
  610. uint32_t cb;
  611. int domain;
  612. uint32_t ap;
  613. struct arm926ejs_common *arm926ejs = target_to_arm926(target);
  614. uint32_t ret = armv4_5_mmu_translate_va(target, &arm926ejs->armv4_5_mmu, virtual, &type, &cb, &domain, &ap);
  615. if (type == -1)
  616. {
  617. return ret;
  618. }
  619. *physical = ret;
  620. return ERROR_OK;
  621. }
  622. static int arm926ejs_mmu(struct target *target, int *enabled)
  623. {
  624. struct arm926ejs_common *arm926ejs = target_to_arm926(target);
  625. if (target->state != TARGET_HALTED)
  626. {
  627. LOG_ERROR("Target not halted");
  628. return ERROR_TARGET_INVALID;
  629. }
  630. *enabled = arm926ejs->armv4_5_mmu.mmu_enabled;
  631. return ERROR_OK;
  632. }
  633. static const struct command_registration arm926ejs_exec_command_handlers[] = {
  634. {
  635. .name = "cache_info",
  636. .handler = arm926ejs_handle_cache_info_command,
  637. .mode = COMMAND_EXEC,
  638. .help = "display information about target caches",
  639. },
  640. COMMAND_REGISTRATION_DONE
  641. };
  642. const struct command_registration arm926ejs_command_handlers[] = {
  643. {
  644. .chain = arm9tdmi_command_handlers,
  645. },
  646. {
  647. .name = "arm926ejs",
  648. .mode = COMMAND_ANY,
  649. .help = "arm926ejs command group",
  650. .chain = arm926ejs_exec_command_handlers,
  651. },
  652. COMMAND_REGISTRATION_DONE
  653. };
  654. /** Holds methods for ARM926 targets. */
  655. struct target_type arm926ejs_target =
  656. {
  657. .name = "arm926ejs",
  658. .poll = arm7_9_poll,
  659. .arch_state = arm926ejs_arch_state,
  660. .target_request_data = arm7_9_target_request_data,
  661. .halt = arm7_9_halt,
  662. .resume = arm7_9_resume,
  663. .step = arm7_9_step,
  664. .assert_reset = arm7_9_assert_reset,
  665. .deassert_reset = arm7_9_deassert_reset,
  666. .soft_reset_halt = arm926ejs_soft_reset_halt,
  667. .get_gdb_reg_list = arm_get_gdb_reg_list,
  668. .read_memory = arm7_9_read_memory,
  669. .write_memory = arm926ejs_write_memory,
  670. .bulk_write_memory = arm7_9_bulk_write_memory,
  671. .checksum_memory = arm_checksum_memory,
  672. .blank_check_memory = arm_blank_check_memory,
  673. .run_algorithm = armv4_5_run_algorithm,
  674. .add_breakpoint = arm7_9_add_breakpoint,
  675. .remove_breakpoint = arm7_9_remove_breakpoint,
  676. .add_watchpoint = arm7_9_add_watchpoint,
  677. .remove_watchpoint = arm7_9_remove_watchpoint,
  678. .commands = arm926ejs_command_handlers,
  679. .target_create = arm926ejs_target_create,
  680. .init_target = arm9tdmi_init_target,
  681. .examine = arm7_9_examine,
  682. .virt2phys = arm926ejs_virt2phys,
  683. .mmu = arm926ejs_mmu,
  684. .read_phys_memory = arm926ejs_read_phys_memory,
  685. .write_phys_memory = arm926ejs_write_phys_memory,
  686. };