You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
 
 
 
 

787 lines
22 KiB

  1. /***************************************************************************
  2. * Copyright (C) 2008 digenius technology GmbH. *
  3. * *
  4. * This program is free software; you can redistribute it and/or modify *
  5. * it under the terms of the GNU General Public License as published by *
  6. * the Free Software Foundation; either version 2 of the License, or *
  7. * (at your option) any later version. *
  8. * *
  9. * This program is distributed in the hope that it will be useful, *
  10. * but WITHOUT ANY WARRANTY; without even the implied warranty of *
  11. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
  12. * GNU General Public License for more details. *
  13. * *
  14. * You should have received a copy of the GNU General Public License *
  15. * along with this program; if not, write to the *
  16. * Free Software Foundation, Inc., *
  17. * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
  18. ***************************************************************************/
  19. #ifdef HAVE_CONFIG_H
  20. #include "config.h"
  21. #endif
  22. #include "arm11.h"
  23. #include "jtag.h"
  24. #include "log.h"
  25. #include <stdlib.h>
  26. #include <string.h>
  27. #if 0
  28. #define JTAG_DEBUG(expr ...) \
  29. do { \
  30. log_printf (LOG_DEBUG, __FILE__, __LINE__, __FUNCTION__, expr); \
  31. } while(0)
  32. #else
  33. #define JTAG_DEBUG(expr ...) \
  34. do {} while(0)
  35. #endif
  36. enum tap_state arm11_move_pi_to_si_via_ci[] =
  37. {
  38. TAP_E2I, TAP_UI, TAP_SDS, TAP_SIS, TAP_CI, TAP_SI
  39. };
  40. int arm11_add_ir_scan_vc(int num_fields, scan_field_t *fields, enum tap_state state)
  41. {
  42. if (cmd_queue_cur_state == TAP_PI)
  43. jtag_add_pathmove(asizeof(arm11_move_pi_to_si_via_ci), arm11_move_pi_to_si_via_ci);
  44. return jtag_add_ir_scan(num_fields, fields, state);
  45. }
  46. enum tap_state arm11_move_pd_to_sd_via_cd[] =
  47. {
  48. TAP_E2D, TAP_UD, TAP_SDS, TAP_CD, TAP_SD
  49. };
  50. int arm11_add_dr_scan_vc(int num_fields, scan_field_t *fields, enum tap_state state)
  51. {
  52. if (cmd_queue_cur_state == TAP_PD)
  53. jtag_add_pathmove(asizeof(arm11_move_pd_to_sd_via_cd), arm11_move_pd_to_sd_via_cd);
  54. return jtag_add_dr_scan(num_fields, fields, state);
  55. }
  56. /** Code de-clutter: Construct scan_field_t to write out a value
  57. *
  58. * \param arm11 Target state variable.
  59. * \param num_bits Length of the data field
  60. * \param out_data pointer to the data that will be sent out
  61. * <em>(data is read when it is added to the JTAG queue)</em>
  62. * \param in_data pointer to the memory that will receive data that was clocked in
  63. * <em>(data is written when the JTAG queue is executed)</em>
  64. * \param field target data structure that will be initialized
  65. */
  66. void arm11_setup_field(arm11_common_t * arm11, int num_bits, void * out_data, void * in_data, scan_field_t * field)
  67. {
  68. field->device = arm11->jtag_info.chain_pos;
  69. field->num_bits = num_bits;
  70. field->out_mask = NULL;
  71. field->in_check_mask = NULL;
  72. field->in_check_value = NULL;
  73. field->in_handler = NULL;
  74. field->in_handler_priv = NULL;
  75. field->out_value = out_data;
  76. field->in_value = in_data;
  77. }
  78. /** Write JTAG instruction register
  79. *
  80. * \param arm11 Target state variable.
  81. * \param instr An ARM11 DBGTAP instruction. Use enum #arm11_instructions.
  82. * \param state Pass the final TAP state or -1 for the default value (Pause-IR).
  83. *
  84. * \remarks This adds to the JTAG command queue but does \em not execute it.
  85. */
  86. void arm11_add_IR(arm11_common_t * arm11, u8 instr, enum tap_state state)
  87. {
  88. jtag_device_t *device = jtag_get_device(arm11->jtag_info.chain_pos);
  89. if (buf_get_u32(device->cur_instr, 0, 5) == instr)
  90. {
  91. JTAG_DEBUG("IR <= 0x%02x SKIPPED", instr);
  92. return;
  93. }
  94. JTAG_DEBUG("IR <= 0x%02x", instr);
  95. scan_field_t field;
  96. arm11_setup_field(arm11, 5, &instr, NULL, &field);
  97. arm11_add_ir_scan_vc(1, &field, state == -1 ? TAP_PI : state);
  98. }
  99. /** Verify shifted out data from Scan Chain Register (SCREG)
  100. * Used as parameter to scan_field_t::in_handler in
  101. * arm11_add_debug_SCAN_N().
  102. *
  103. */
  104. static int arm11_in_handler_SCAN_N(u8 *in_value, void *priv, struct scan_field_s *field)
  105. {
  106. /** \todo TODO: clarify why this isnt properly masked in jtag.c jtag_read_buffer() */
  107. u8 v = *in_value & 0x1F;
  108. if (v != 0x10)
  109. {
  110. ERROR("'arm11 target' JTAG communication error SCREG SCAN OUT 0x%02x (expected 0x10)", v);
  111. exit(-1);
  112. }
  113. JTAG_DEBUG("SCREG SCAN OUT 0x%02x", v);
  114. return ERROR_OK;
  115. }
  116. /** Select and write to Scan Chain Register (SCREG)
  117. *
  118. * This function sets the instruction register to SCAN_N and writes
  119. * the data register with the selected chain number.
  120. *
  121. * http://infocenter.arm.com/help/topic/com.arm.doc.ddi0301f/Cacbjhfg.html
  122. *
  123. * \param arm11 Target state variable.
  124. * \param chain Scan chain that will be selected.
  125. * \param state Pass the final TAP state or -1 for the default
  126. * value (Pause-DR).
  127. *
  128. * The chain takes effect when Update-DR is passed (usually when subsequently
  129. * the INTEXT/EXTEST instructions are written).
  130. *
  131. * \warning (Obsolete) Using this twice in a row will \em fail. The first call will end
  132. * in Pause-DR. The second call, due to the IR caching, will not
  133. * go through Capture-DR when shifting in the new scan chain number.
  134. * As a result the verification in arm11_in_handler_SCAN_N() must
  135. * fail.
  136. *
  137. * \remarks This adds to the JTAG command queue but does \em not execute it.
  138. */
  139. void arm11_add_debug_SCAN_N(arm11_common_t * arm11, u8 chain, enum tap_state state)
  140. {
  141. JTAG_DEBUG("SCREG <= 0x%02x", chain);
  142. arm11_add_IR(arm11, ARM11_SCAN_N, -1);
  143. scan_field_t field;
  144. arm11_setup_field(arm11, 5, &chain, NULL, &field);
  145. field.in_handler = arm11_in_handler_SCAN_N;
  146. arm11_add_dr_scan_vc(1, &field, state == -1 ? TAP_PD : state);
  147. }
  148. /** Write an instruction into the ITR register
  149. *
  150. * \param arm11 Target state variable.
  151. * \param inst An ARM11 processor instruction/opcode.
  152. * \param flag Optional parameter to retrieve the InstCompl flag
  153. * (this will be written when the JTAG chain is executed).
  154. * \param state Pass the final TAP state or -1 for the default
  155. * value (Run-Test/Idle).
  156. *
  157. * \remarks By default this ends with Run-Test/Idle state
  158. * and causes the instruction to be executed. If
  159. * a subsequent write to DTR is needed before
  160. * executing the instruction then TAP_PD should be
  161. * passed to \p state.
  162. *
  163. * \remarks This adds to the JTAG command queue but does \em not execute it.
  164. */
  165. void arm11_add_debug_INST(arm11_common_t * arm11, u32 inst, u8 * flag, enum tap_state state)
  166. {
  167. JTAG_DEBUG("INST <= 0x%08x", inst);
  168. scan_field_t itr[2];
  169. arm11_setup_field(arm11, 32, &inst, NULL, itr + 0);
  170. arm11_setup_field(arm11, 1, NULL, flag, itr + 1);
  171. arm11_add_dr_scan_vc(asizeof(itr), itr, state == -1 ? TAP_RTI : state);
  172. }
  173. /** Read the Debug Status and Control Register (DSCR)
  174. *
  175. * same as CP14 c1
  176. *
  177. * \param arm11 Target state variable.
  178. * \return DSCR content
  179. *
  180. * \remarks This is a stand-alone function that executes the JTAG command queue.
  181. */
  182. u32 arm11_read_DSCR(arm11_common_t * arm11)
  183. {
  184. arm11_add_debug_SCAN_N(arm11, 0x01, -1);
  185. arm11_add_IR(arm11, ARM11_INTEST, -1);
  186. u32 dscr;
  187. scan_field_t chain1_field;
  188. arm11_setup_field(arm11, 32, NULL, &dscr, &chain1_field);
  189. arm11_add_dr_scan_vc(1, &chain1_field, TAP_PD);
  190. jtag_execute_queue();
  191. if (arm11->last_dscr != dscr)
  192. JTAG_DEBUG("DSCR = %08x (OLD %08x)", dscr, arm11->last_dscr);
  193. arm11->last_dscr = dscr;
  194. return dscr;
  195. }
  196. /** Write the Debug Status and Control Register (DSCR)
  197. *
  198. * same as CP14 c1
  199. *
  200. * \param arm11 Target state variable.
  201. * \param dscr DSCR content
  202. *
  203. * \remarks This is a stand-alone function that executes the JTAG command queue.
  204. */
  205. void arm11_write_DSCR(arm11_common_t * arm11, u32 dscr)
  206. {
  207. arm11_add_debug_SCAN_N(arm11, 0x01, -1);
  208. arm11_add_IR(arm11, ARM11_EXTEST, -1);
  209. scan_field_t chain1_field;
  210. arm11_setup_field(arm11, 32, &dscr, NULL, &chain1_field);
  211. arm11_add_dr_scan_vc(1, &chain1_field, TAP_PD);
  212. jtag_execute_queue();
  213. JTAG_DEBUG("DSCR <= %08x (OLD %08x)", dscr, arm11->last_dscr);
  214. arm11->last_dscr = dscr;
  215. }
  216. /** Get the debug reason from Debug Status and Control Register (DSCR)
  217. *
  218. * \param dscr DSCR value to analyze
  219. * \return Debug reason
  220. *
  221. */
  222. enum target_debug_reason arm11_get_DSCR_debug_reason(u32 dscr)
  223. {
  224. switch (dscr & ARM11_DSCR_METHOD_OF_DEBUG_ENTRY_MASK)
  225. {
  226. case ARM11_DSCR_METHOD_OF_DEBUG_ENTRY_HALT: return DBG_REASON_DBGRQ;
  227. case ARM11_DSCR_METHOD_OF_DEBUG_ENTRY_BREAKPOINT: return DBG_REASON_BREAKPOINT;
  228. case ARM11_DSCR_METHOD_OF_DEBUG_ENTRY_WATCHPOINT: return DBG_REASON_WATCHPOINT;
  229. case ARM11_DSCR_METHOD_OF_DEBUG_ENTRY_BKPT_INSTRUCTION: return DBG_REASON_BREAKPOINT;
  230. case ARM11_DSCR_METHOD_OF_DEBUG_ENTRY_EDBGRQ: return DBG_REASON_DBGRQ;
  231. case ARM11_DSCR_METHOD_OF_DEBUG_ENTRY_VECTOR_CATCH: return DBG_REASON_BREAKPOINT;
  232. default:
  233. return DBG_REASON_DBGRQ;
  234. }
  235. };
  236. /** Prepare the stage for ITR/DTR operations
  237. * from the arm11_run_instr... group of functions.
  238. *
  239. * Put arm11_run_instr_data_prepare() and arm11_run_instr_data_finish()
  240. * around a block of arm11_run_instr_... calls.
  241. *
  242. * Select scan chain 5 to allow quick access to DTR. When scan
  243. * chain 4 is needed to put in a register the ITRSel instruction
  244. * shortcut is used instead of actually changing the Scan_N
  245. * register.
  246. *
  247. * \param arm11 Target state variable.
  248. *
  249. */
  250. void arm11_run_instr_data_prepare(arm11_common_t * arm11)
  251. {
  252. arm11_add_debug_SCAN_N(arm11, 0x05, -1);
  253. }
  254. /** Cleanup after ITR/DTR operations
  255. * from the arm11_run_instr... group of functions
  256. *
  257. * Put arm11_run_instr_data_prepare() and arm11_run_instr_data_finish()
  258. * around a block of arm11_run_instr_... calls.
  259. *
  260. * Any RTI can lead to an instruction execution when
  261. * scan chains 4 or 5 are selected and the IR holds
  262. * INTEST or EXTEST. So we must disable that before
  263. * any following activities lead to an RTI.
  264. *
  265. * \param arm11 Target state variable.
  266. *
  267. */
  268. void arm11_run_instr_data_finish(arm11_common_t * arm11)
  269. {
  270. arm11_add_debug_SCAN_N(arm11, 0x00, -1);
  271. }
  272. /** Execute one or multiple instructions via ITR
  273. *
  274. * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block
  275. *
  276. * \param arm11 Target state variable.
  277. * \param opcode Pointer to sequence of ARM opcodes
  278. * \param count Number of opcodes to execute
  279. *
  280. */
  281. void arm11_run_instr_no_data(arm11_common_t * arm11, u32 * opcode, size_t count)
  282. {
  283. arm11_add_IR(arm11, ARM11_ITRSEL, -1);
  284. while (count--)
  285. {
  286. arm11_add_debug_INST(arm11, *opcode++, NULL, TAP_RTI);
  287. while (1)
  288. {
  289. u8 flag;
  290. arm11_add_debug_INST(arm11, 0, &flag, count ? TAP_RTI : TAP_PD);
  291. jtag_execute_queue();
  292. if (flag)
  293. break;
  294. }
  295. }
  296. }
  297. /** Execute one instruction via ITR
  298. *
  299. * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block
  300. *
  301. * \param arm11 Target state variable.
  302. * \param opcode ARM opcode
  303. *
  304. */
  305. void arm11_run_instr_no_data1(arm11_common_t * arm11, u32 opcode)
  306. {
  307. arm11_run_instr_no_data(arm11, &opcode, 1);
  308. }
  309. /** Execute one instruction via ITR repeatedly while
  310. * passing data to the core via DTR on each execution.
  311. *
  312. * The executed instruction \em must read data from DTR.
  313. *
  314. * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block
  315. *
  316. * \param arm11 Target state variable.
  317. * \param opcode ARM opcode
  318. * \param data Pointer to the data words to be passed to the core
  319. * \param count Number of data words and instruction repetitions
  320. *
  321. */
  322. void arm11_run_instr_data_to_core(arm11_common_t * arm11, u32 opcode, u32 * data, size_t count)
  323. {
  324. arm11_add_IR(arm11, ARM11_ITRSEL, -1);
  325. arm11_add_debug_INST(arm11, opcode, NULL, TAP_PD);
  326. arm11_add_IR(arm11, ARM11_EXTEST, -1);
  327. scan_field_t chain5_fields[3];
  328. u32 Data;
  329. u8 Ready;
  330. u8 nRetry;
  331. arm11_setup_field(arm11, 32, &Data, NULL, chain5_fields + 0);
  332. arm11_setup_field(arm11, 1, NULL, &Ready, chain5_fields + 1);
  333. arm11_setup_field(arm11, 1, NULL, &nRetry, chain5_fields + 2);
  334. while (count--)
  335. {
  336. do
  337. {
  338. Data = *data;
  339. arm11_add_dr_scan_vc(asizeof(chain5_fields), chain5_fields, TAP_RTI);
  340. jtag_execute_queue();
  341. JTAG_DEBUG("DTR Ready %d nRetry %d", Ready, nRetry);
  342. }
  343. while (!Ready);
  344. data++;
  345. }
  346. arm11_add_IR(arm11, ARM11_INTEST, -1);
  347. do
  348. {
  349. Data = 0;
  350. arm11_add_dr_scan_vc(asizeof(chain5_fields), chain5_fields, TAP_PD);
  351. jtag_execute_queue();
  352. JTAG_DEBUG("DTR Data %08x Ready %d nRetry %d", Data, Ready, nRetry);
  353. }
  354. while (!Ready);
  355. }
  356. /** JTAG path for arm11_run_instr_data_to_core_noack
  357. *
  358. * The repeated TAP_RTI's do not cause a repeated execution
  359. * if passed without leaving the state.
  360. *
  361. * Since this is more than 7 bits (adjustable via adding more
  362. * TAP_RTI's) it produces an artificial delay in the lower
  363. * layer (FT2232) that is long enough to finish execution on
  364. * the core but still shorter than any manually inducible delays.
  365. *
  366. */
  367. enum tap_state arm11_MOVE_PD_RTI_PD_with_delay[] =
  368. {
  369. TAP_E2D, TAP_UD, TAP_RTI, TAP_RTI, TAP_RTI, TAP_SDS, TAP_CD, TAP_SD
  370. };
  371. /** Execute one instruction via ITR repeatedly while
  372. * passing data to the core via DTR on each execution.
  373. *
  374. * No Ready check during transmission.
  375. *
  376. * The executed instruction \em must read data from DTR.
  377. *
  378. * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block
  379. *
  380. * \param arm11 Target state variable.
  381. * \param opcode ARM opcode
  382. * \param data Pointer to the data words to be passed to the core
  383. * \param count Number of data words and instruction repetitions
  384. *
  385. */
  386. void arm11_run_instr_data_to_core_noack(arm11_common_t * arm11, u32 opcode, u32 * data, size_t count)
  387. {
  388. arm11_add_IR(arm11, ARM11_ITRSEL, -1);
  389. arm11_add_debug_INST(arm11, opcode, NULL, TAP_PD);
  390. arm11_add_IR(arm11, ARM11_EXTEST, -1);
  391. scan_field_t chain5_fields[3];
  392. arm11_setup_field(arm11, 32, NULL/*&Data*/, NULL, chain5_fields + 0);
  393. arm11_setup_field(arm11, 1, NULL, NULL /*&Ready*/, chain5_fields + 1);
  394. arm11_setup_field(arm11, 1, NULL, NULL, chain5_fields + 2);
  395. u8 Readies[count + 1];
  396. u8 * ReadyPos = Readies;
  397. while (count--)
  398. {
  399. chain5_fields[0].out_value = (void *)(data++);
  400. chain5_fields[1].in_value = ReadyPos++;
  401. if (count)
  402. {
  403. jtag_add_dr_scan(asizeof(chain5_fields), chain5_fields, TAP_PD);
  404. jtag_add_pathmove(asizeof(arm11_MOVE_PD_RTI_PD_with_delay),
  405. arm11_MOVE_PD_RTI_PD_with_delay);
  406. }
  407. else
  408. {
  409. jtag_add_dr_scan(asizeof(chain5_fields), chain5_fields, TAP_RTI);
  410. }
  411. }
  412. arm11_add_IR(arm11, ARM11_INTEST, -1);
  413. chain5_fields[0].out_value = 0;
  414. chain5_fields[1].in_value = ReadyPos++;
  415. arm11_add_dr_scan_vc(asizeof(chain5_fields), chain5_fields, TAP_PD);
  416. jtag_execute_queue();
  417. size_t error_count = 0;
  418. {size_t i;
  419. for (i = 0; i < asizeof(Readies); i++)
  420. {
  421. if (Readies[i] != 1)
  422. {
  423. error_count++;
  424. }
  425. }}
  426. if (error_count)
  427. ERROR("Transfer errors %d", error_count);
  428. }
  429. /** Execute an instruction via ITR while handing data into the core via DTR.
  430. *
  431. * The executed instruction \em must read data from DTR.
  432. *
  433. * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block
  434. *
  435. * \param arm11 Target state variable.
  436. * \param opcode ARM opcode
  437. * \param data Data word to be passed to the core via DTR
  438. *
  439. */
  440. void arm11_run_instr_data_to_core1(arm11_common_t * arm11, u32 opcode, u32 data)
  441. {
  442. arm11_run_instr_data_to_core(arm11, opcode, &data, 1);
  443. }
  444. /** Execute one instruction via ITR repeatedly while
  445. * reading data from the core via DTR on each execution.
  446. *
  447. * The executed instruction \em must write data to DTR.
  448. *
  449. * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block
  450. *
  451. * \param arm11 Target state variable.
  452. * \param opcode ARM opcode
  453. * \param data Pointer to an array that receives the data words from the core
  454. * \param count Number of data words and instruction repetitions
  455. *
  456. */
  457. void arm11_run_instr_data_from_core(arm11_common_t * arm11, u32 opcode, u32 * data, size_t count)
  458. {
  459. arm11_add_IR(arm11, ARM11_ITRSEL, -1);
  460. arm11_add_debug_INST(arm11, opcode, NULL, TAP_RTI);
  461. arm11_add_IR(arm11, ARM11_INTEST, -1);
  462. scan_field_t chain5_fields[3];
  463. u32 Data;
  464. u8 Ready;
  465. u8 nRetry;
  466. arm11_setup_field(arm11, 32, NULL, &Data, chain5_fields + 0);
  467. arm11_setup_field(arm11, 1, NULL, &Ready, chain5_fields + 1);
  468. arm11_setup_field(arm11, 1, NULL, &nRetry, chain5_fields + 2);
  469. while (count--)
  470. {
  471. do
  472. {
  473. arm11_add_dr_scan_vc(asizeof(chain5_fields), chain5_fields, count ? TAP_RTI : TAP_PD);
  474. jtag_execute_queue();
  475. JTAG_DEBUG("DTR Data %08x Ready %d nRetry %d", Data, Ready, nRetry);
  476. }
  477. while (!Ready);
  478. *data++ = Data;
  479. }
  480. }
  481. /** Execute one instruction via ITR
  482. * then load r0 into DTR and read DTR from core.
  483. *
  484. * The first executed instruction (\p opcode) should write data to r0.
  485. *
  486. * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block
  487. *
  488. * \param arm11 Target state variable.
  489. * \param opcode ARM opcode to write r0 with the value of interest
  490. * \param data Pointer to a data word that receives the value from r0 after \p opcode was executed.
  491. *
  492. */
  493. void arm11_run_instr_data_from_core_via_r0(arm11_common_t * arm11, u32 opcode, u32 * data)
  494. {
  495. arm11_run_instr_no_data1(arm11, opcode);
  496. /* MCR p14,0,R0,c0,c5,0 (move r0 -> wDTR -> local var) */
  497. arm11_run_instr_data_from_core(arm11, 0xEE000E15, data, 1);
  498. }
  499. /** Load data into core via DTR then move it to r0 then
  500. * execute one instruction via ITR
  501. *
  502. * The final executed instruction (\p opcode) should read data from r0.
  503. *
  504. * \pre arm11_run_instr_data_prepare() / arm11_run_instr_data_finish() block
  505. *
  506. * \param arm11 Target state variable.
  507. * \param opcode ARM opcode to read r0 act upon it
  508. * \param data Data word that will be written to r0 before \p opcode is executed
  509. *
  510. */
  511. void arm11_run_instr_data_to_core_via_r0(arm11_common_t * arm11, u32 opcode, u32 data)
  512. {
  513. /* MRC p14,0,r0,c0,c5,0 */
  514. arm11_run_instr_data_to_core1(arm11, 0xEE100E15, data);
  515. arm11_run_instr_no_data1(arm11, opcode);
  516. }
  517. /** Apply reads and writes to scan chain 7
  518. *
  519. * \see arm11_sc7_action_t
  520. *
  521. * \param arm11 Target state variable.
  522. * \param actions A list of read and/or write instructions
  523. * \param count Number of instructions in the list.
  524. *
  525. */
  526. void arm11_sc7_run(arm11_common_t * arm11, arm11_sc7_action_t * actions, size_t count)
  527. {
  528. arm11_add_debug_SCAN_N(arm11, 0x07, -1);
  529. arm11_add_IR(arm11, ARM11_EXTEST, -1);
  530. scan_field_t chain7_fields[3];
  531. u8 nRW;
  532. u32 DataOut;
  533. u8 AddressOut;
  534. u8 Ready;
  535. u32 DataIn;
  536. u8 AddressIn;
  537. arm11_setup_field(arm11, 1, &nRW, &Ready, chain7_fields + 0);
  538. arm11_setup_field(arm11, 32, &DataOut, &DataIn, chain7_fields + 1);
  539. arm11_setup_field(arm11, 7, &AddressOut, &AddressIn, chain7_fields + 2);
  540. {size_t i;
  541. for (i = 0; i < count + 1; i++)
  542. {
  543. if (i < count)
  544. {
  545. nRW = actions[i].write ? 1 : 0;
  546. DataOut = actions[i].value;
  547. AddressOut = actions[i].address;
  548. }
  549. else
  550. {
  551. nRW = 0;
  552. DataOut = 0;
  553. AddressOut = 0;
  554. }
  555. do
  556. {
  557. JTAG_DEBUG("SC7 <= Address %02x Data %08x nRW %d", AddressOut, DataOut, nRW);
  558. arm11_add_dr_scan_vc(asizeof(chain7_fields), chain7_fields, TAP_PD);
  559. jtag_execute_queue();
  560. JTAG_DEBUG("SC7 => Address %02x Data %08x Ready %d", AddressIn, DataIn, Ready);
  561. }
  562. while (!Ready); /* 'nRW' is 'Ready' on read out */
  563. if (i > 0)
  564. {
  565. if (actions[i - 1].address != AddressIn)
  566. {
  567. WARNING("Scan chain 7 shifted out unexpected address");
  568. }
  569. if (!actions[i - 1].write)
  570. {
  571. actions[i - 1].value = DataIn;
  572. }
  573. else
  574. {
  575. if (actions[i - 1].value != DataIn)
  576. {
  577. WARNING("Scan chain 7 shifted out unexpected data");
  578. }
  579. }
  580. }
  581. }}
  582. {size_t i;
  583. for (i = 0; i < count; i++)
  584. {
  585. JTAG_DEBUG("SC7 %02d: %02x %s %08x", i, actions[i].address, actions[i].write ? "<=" : "=>", actions[i].value);
  586. }}
  587. }
  588. /** Clear VCR and all breakpoints and watchpoints via scan chain 7
  589. *
  590. * \param arm11 Target state variable.
  591. *
  592. */
  593. void arm11_sc7_clear_vbw(arm11_common_t * arm11)
  594. {
  595. arm11_sc7_action_t clear_bw[arm11->brp + arm11->wrp + 1];
  596. arm11_sc7_action_t * pos = clear_bw;
  597. {size_t i;
  598. for (i = 0; i < asizeof(clear_bw); i++)
  599. {
  600. clear_bw[i].write = 1;
  601. clear_bw[i].value = 0;
  602. }}
  603. {size_t i;
  604. for (i = 0; i < arm11->brp; i++)
  605. (pos++)->address = ARM11_SC7_BCR0 + i;
  606. }
  607. {size_t i;
  608. for (i = 0; i < arm11->wrp; i++)
  609. (pos++)->address = ARM11_SC7_WCR0 + i;
  610. }
  611. (pos++)->address = ARM11_SC7_VCR;
  612. }
  613. /** Write VCR register
  614. *
  615. * \param arm11 Target state variable.
  616. * \param value Value to be written
  617. */
  618. void arm11_sc7_set_vcr(arm11_common_t * arm11, u32 value)
  619. {
  620. arm11_sc7_action_t set_vcr;
  621. set_vcr.write = 0;
  622. set_vcr.address = ARM11_SC7_VCR;
  623. set_vcr.value = value;
  624. arm11_sc7_run(arm11, &set_vcr, 1);
  625. }
  626. /** Read word from address
  627. *
  628. * \param arm11 Target state variable.
  629. * \param address Memory address to be read
  630. * \param result Pointer where to store result
  631. *
  632. */
  633. void arm11_read_memory_word(arm11_common_t * arm11, u32 address, u32 * result)
  634. {
  635. arm11_run_instr_data_prepare(arm11);
  636. /* MRC p14,0,r0,c0,c5,0 (r0 = address) */
  637. arm11_run_instr_data_to_core1(arm11, 0xee100e15, address);
  638. /* LDC p14,c5,[R0],#4 (DTR = [r0]) */
  639. arm11_run_instr_data_from_core(arm11, 0xecb05e01, result, 1);
  640. arm11_run_instr_data_finish(arm11);
  641. }