]> git.sur5r.net Git - openocd/blob - src/target/arm920t.c
read/write physical target fn's
[openocd] / src / target / arm920t.c
1 /***************************************************************************
2  *   Copyright (C) 2005 by Dominic Rath                                    *
3  *   Dominic.Rath@gmx.de                                                   *
4  *                                                                         *
5  *   This program is free software; you can redistribute it and/or modify  *
6  *   it under the terms of the GNU General Public License as published by  *
7  *   the Free Software Foundation; either version 2 of the License, or     *
8  *   (at your option) any later version.                                   *
9  *                                                                         *
10  *   This program is distributed in the hope that it will be useful,       *
11  *   but WITHOUT ANY WARRANTY; without even the implied warranty of        *
12  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
13  *   GNU General Public License for more details.                          *
14  *                                                                         *
15  *   You should have received a copy of the GNU General Public License     *
16  *   along with this program; if not, write to the                         *
17  *   Free Software Foundation, Inc.,                                       *
18  *   59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
19  ***************************************************************************/
20 #ifdef HAVE_CONFIG_H
21 #include "config.h"
22 #endif
23
24 #include "arm920t.h"
25 #include "time_support.h"
26 #include "target_type.h"
27
28
29 #if 0
30 #define _DEBUG_INSTRUCTION_EXECUTION_
31 #endif
32
33 /* cli handling */
34 int arm920t_handle_cp15_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc);
35 int arm920t_handle_cp15i_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc);
36 int arm920t_handle_cache_info_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc);
37 int arm920t_handle_md_phys_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc);
38 int arm920t_handle_mw_phys_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc);
39 int arm920t_read_phys_memory(struct target_s *target, uint32_t address, uint32_t size, uint32_t count, uint8_t *buffer);
40 int arm920t_write_phys_memory(struct target_s *target, uint32_t address, uint32_t size, uint32_t count, uint8_t *buffer);
41
42 int arm920t_handle_read_cache_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc);
43 int arm920t_handle_read_mmu_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc);
44
45 /* forward declarations */
46 int arm920t_target_create(struct target_s *target, Jim_Interp *interp);
47 int arm920t_init_target(struct command_context_s *cmd_ctx, struct target_s *target);
48 int arm920t_quit(void);
49
50 #define ARM920T_CP15_PHYS_ADDR(x, y, z) ((x << 5) | (y << 1) << (z))
51
52 target_type_t arm920t_target =
53 {
54         .name = "arm920t",
55
56         .poll = arm7_9_poll,
57         .arch_state = arm920t_arch_state,
58
59         .target_request_data = arm7_9_target_request_data,
60
61         .halt = arm7_9_halt,
62         .resume = arm7_9_resume,
63         .step = arm7_9_step,
64
65         .assert_reset = arm7_9_assert_reset,
66         .deassert_reset = arm7_9_deassert_reset,
67         .soft_reset_halt = arm920t_soft_reset_halt,
68
69         .get_gdb_reg_list = armv4_5_get_gdb_reg_list,
70
71         .read_memory = arm920t_read_memory,
72         .write_memory = arm920t_write_memory,
73         .read_phys_memory = arm920t_read_phys_memory,
74         .write_phys_memory = arm920t_write_phys_memory,
75         .bulk_write_memory = arm7_9_bulk_write_memory,
76         .checksum_memory = arm7_9_checksum_memory,
77         .blank_check_memory = arm7_9_blank_check_memory,
78
79         .run_algorithm = armv4_5_run_algorithm,
80
81         .add_breakpoint = arm7_9_add_breakpoint,
82         .remove_breakpoint = arm7_9_remove_breakpoint,
83         .add_watchpoint = arm7_9_add_watchpoint,
84         .remove_watchpoint = arm7_9_remove_watchpoint,
85
86         .register_commands = arm920t_register_commands,
87         .target_create = arm920t_target_create,
88         .init_target = arm920t_init_target,
89         .examine = arm9tdmi_examine,
90         .quit = arm920t_quit
91 };
92
93 int arm920t_read_cp15_physical(target_t *target, int reg_addr, uint32_t *value)
94 {
95         armv4_5_common_t *armv4_5 = target->arch_info;
96         arm7_9_common_t *arm7_9 = armv4_5->arch_info;
97         arm_jtag_t *jtag_info = &arm7_9->jtag_info;
98         scan_field_t fields[4];
99         uint8_t access_type_buf = 1;
100         uint8_t reg_addr_buf = reg_addr & 0x3f;
101         uint8_t nr_w_buf = 0;
102
103         jtag_set_end_state(TAP_IDLE);
104         arm_jtag_scann(jtag_info, 0xf);
105         arm_jtag_set_instr(jtag_info, jtag_info->intest_instr, NULL);
106
107         fields[0].tap = jtag_info->tap;
108         fields[0].num_bits = 1;
109         fields[0].out_value = &access_type_buf;
110         fields[0].in_value = NULL;
111
112         fields[1].tap = jtag_info->tap;
113         fields[1].num_bits = 32;
114         fields[1].out_value = NULL;
115         fields[1].in_value = NULL;
116
117         fields[2].tap = jtag_info->tap;
118         fields[2].num_bits = 6;
119         fields[2].out_value = &reg_addr_buf;
120         fields[2].in_value = NULL;
121
122         fields[3].tap = jtag_info->tap;
123         fields[3].num_bits = 1;
124         fields[3].out_value = &nr_w_buf;
125         fields[3].in_value = NULL;
126
127         jtag_add_dr_scan(4, fields, jtag_get_end_state());
128
129         fields[1].in_value = (uint8_t *)value;
130
131         jtag_add_dr_scan(4, fields, jtag_get_end_state());
132
133         jtag_add_callback(arm_le_to_h_u32, (jtag_callback_data_t)value);
134
135         #ifdef _DEBUG_INSTRUCTION_EXECUTION_
136         jtag_execute_queue();
137         LOG_DEBUG("addr: 0x%x value: %8.8x", reg_addr, *value);
138 #endif
139
140         return ERROR_OK;
141 }
142
143 int arm920t_write_cp15_physical(target_t *target, int reg_addr, uint32_t value)
144 {
145         armv4_5_common_t *armv4_5 = target->arch_info;
146         arm7_9_common_t *arm7_9 = armv4_5->arch_info;
147         arm_jtag_t *jtag_info = &arm7_9->jtag_info;
148         scan_field_t fields[4];
149         uint8_t access_type_buf = 1;
150         uint8_t reg_addr_buf = reg_addr & 0x3f;
151         uint8_t nr_w_buf = 1;
152         uint8_t value_buf[4];
153
154         buf_set_u32(value_buf, 0, 32, value);
155
156         jtag_set_end_state(TAP_IDLE);
157         arm_jtag_scann(jtag_info, 0xf);
158         arm_jtag_set_instr(jtag_info, jtag_info->intest_instr, NULL);
159
160         fields[0].tap = jtag_info->tap;
161         fields[0].num_bits = 1;
162         fields[0].out_value = &access_type_buf;
163         fields[0].in_value = NULL;
164
165         fields[1].tap = jtag_info->tap;
166         fields[1].num_bits = 32;
167         fields[1].out_value = value_buf;
168         fields[1].in_value = NULL;
169
170         fields[2].tap = jtag_info->tap;
171         fields[2].num_bits = 6;
172         fields[2].out_value = &reg_addr_buf;
173         fields[2].in_value = NULL;
174
175         fields[3].tap = jtag_info->tap;
176         fields[3].num_bits = 1;
177         fields[3].out_value = &nr_w_buf;
178         fields[3].in_value = NULL;
179
180         jtag_add_dr_scan(4, fields, jtag_get_end_state());
181
182 #ifdef _DEBUG_INSTRUCTION_EXECUTION_
183         LOG_DEBUG("addr: 0x%x value: %8.8x", reg_addr, value);
184 #endif
185
186         return ERROR_OK;
187 }
188
189 int arm920t_execute_cp15(target_t *target, uint32_t cp15_opcode, uint32_t arm_opcode)
190 {
191         int retval;
192         armv4_5_common_t *armv4_5 = target->arch_info;
193         arm7_9_common_t *arm7_9 = armv4_5->arch_info;
194         arm_jtag_t *jtag_info = &arm7_9->jtag_info;
195         scan_field_t fields[4];
196         uint8_t access_type_buf = 0;            /* interpreted access */
197         uint8_t reg_addr_buf = 0x0;
198         uint8_t nr_w_buf = 0;
199         uint8_t cp15_opcode_buf[4];
200
201         jtag_set_end_state(TAP_IDLE);
202         arm_jtag_scann(jtag_info, 0xf);
203         arm_jtag_set_instr(jtag_info, jtag_info->intest_instr, NULL);
204
205         buf_set_u32(cp15_opcode_buf, 0, 32, cp15_opcode);
206
207         fields[0].tap = jtag_info->tap;
208         fields[0].num_bits = 1;
209         fields[0].out_value = &access_type_buf;
210         fields[0].in_value = NULL;
211
212         fields[1].tap = jtag_info->tap;
213         fields[1].num_bits = 32;
214         fields[1].out_value = cp15_opcode_buf;
215         fields[1].in_value = NULL;
216
217         fields[2].tap = jtag_info->tap;
218         fields[2].num_bits = 6;
219         fields[2].out_value = &reg_addr_buf;
220         fields[2].in_value = NULL;
221
222         fields[3].tap = jtag_info->tap;
223         fields[3].num_bits = 1;
224         fields[3].out_value = &nr_w_buf;
225         fields[3].in_value = NULL;
226
227         jtag_add_dr_scan(4, fields, jtag_get_end_state());
228
229         arm9tdmi_clock_out(jtag_info, arm_opcode, 0, NULL, 0);
230         arm9tdmi_clock_out(jtag_info, ARMV4_5_NOP, 0, NULL, 1);
231         retval = arm7_9_execute_sys_speed(target);
232         if (retval != ERROR_OK)
233                 return retval;
234
235         if ((retval = jtag_execute_queue()) != ERROR_OK)
236         {
237                 LOG_ERROR("failed executing JTAG queue, exiting");
238                 return retval;
239         }
240
241         return ERROR_OK;
242 }
243
244 int arm920t_read_cp15_interpreted(target_t *target, uint32_t cp15_opcode, uint32_t address, uint32_t *value)
245 {
246         armv4_5_common_t *armv4_5 = target->arch_info;
247         uint32_t* regs_p[1];
248         uint32_t regs[2];
249         uint32_t cp15c15 = 0x0;
250
251         /* load address into R1 */
252         regs[1] = address;
253         arm9tdmi_write_core_regs(target, 0x2, regs);
254
255         /* read-modify-write CP15 test state register
256         * to enable interpreted access mode */
257         arm920t_read_cp15_physical(target, 0x1e, &cp15c15);
258         jtag_execute_queue();
259         cp15c15 |= 1;   /* set interpret mode */
260         arm920t_write_cp15_physical(target, 0x1e, cp15c15);
261
262         /* execute CP15 instruction and ARM load (reading from coprocessor) */
263         arm920t_execute_cp15(target, cp15_opcode, ARMV4_5_LDR(0, 1));
264
265         /* disable interpreted access mode */
266         cp15c15 &= ~1U; /* clear interpret mode */
267         arm920t_write_cp15_physical(target, 0x1e, cp15c15);
268
269         /* retrieve value from R0 */
270         regs_p[0] = value;
271         arm9tdmi_read_core_regs(target, 0x1, regs_p);
272         jtag_execute_queue();
273
274 #ifdef _DEBUG_INSTRUCTION_EXECUTION_
275         LOG_DEBUG("cp15_opcode: %8.8x, address: %8.8x, value: %8.8x", cp15_opcode, address, *value);
276 #endif
277
278         if (armv4_5_mode_to_number(armv4_5->core_mode)==-1)
279                 return ERROR_FAIL;
280
281         ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 0).dirty = 1;
282         ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 1).dirty = 1;
283
284         return ERROR_OK;
285 }
286
287 int arm920t_write_cp15_interpreted(target_t *target, uint32_t cp15_opcode, uint32_t value, uint32_t address)
288 {
289         uint32_t cp15c15 = 0x0;
290         armv4_5_common_t *armv4_5 = target->arch_info;
291         uint32_t regs[2];
292
293         /* load value, address into R0, R1 */
294         regs[0] = value;
295         regs[1] = address;
296         arm9tdmi_write_core_regs(target, 0x3, regs);
297
298         /* read-modify-write CP15 test state register
299         * to enable interpreted access mode */
300         arm920t_read_cp15_physical(target, 0x1e, &cp15c15);
301         jtag_execute_queue();
302         cp15c15 |= 1;   /* set interpret mode */
303         arm920t_write_cp15_physical(target, 0x1e, cp15c15);
304
305         /* execute CP15 instruction and ARM store (writing to coprocessor) */
306         arm920t_execute_cp15(target, cp15_opcode, ARMV4_5_STR(0, 1));
307
308         /* disable interpreted access mode */
309         cp15c15 &= ~1U; /* set interpret mode */
310         arm920t_write_cp15_physical(target, 0x1e, cp15c15);
311
312 #ifdef _DEBUG_INSTRUCTION_EXECUTION_
313         LOG_DEBUG("cp15_opcode: %8.8x, value: %8.8x, address: %8.8x", cp15_opcode, value, address);
314 #endif
315
316         if (armv4_5_mode_to_number(armv4_5->core_mode)==-1)
317                 return ERROR_FAIL;
318
319         ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 0).dirty = 1;
320         ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 1).dirty = 1;
321
322         return ERROR_OK;
323 }
324
325 uint32_t arm920t_get_ttb(target_t *target)
326 {
327         int retval;
328         uint32_t ttb = 0x0;
329
330         if ((retval = arm920t_read_cp15_interpreted(target, 0xeebf0f51, 0x0, &ttb)) != ERROR_OK)
331                 return retval;
332
333         return ttb;
334 }
335
336 void arm920t_disable_mmu_caches(target_t *target, int mmu, int d_u_cache, int i_cache)
337 {
338         uint32_t cp15_control;
339
340         /* read cp15 control register */
341         arm920t_read_cp15_physical(target, 0x2, &cp15_control);
342         jtag_execute_queue();
343
344         if (mmu)
345                 cp15_control &= ~0x1U;
346
347         if (d_u_cache)
348                 cp15_control &= ~0x4U;
349
350         if (i_cache)
351                 cp15_control &= ~0x1000U;
352
353         arm920t_write_cp15_physical(target, 0x2, cp15_control);
354 }
355
356 void arm920t_enable_mmu_caches(target_t *target, int mmu, int d_u_cache, int i_cache)
357 {
358         uint32_t cp15_control;
359
360         /* read cp15 control register */
361         arm920t_read_cp15_physical(target, 0x2, &cp15_control);
362         jtag_execute_queue();
363
364         if (mmu)
365                 cp15_control |= 0x1U;
366
367         if (d_u_cache)
368                 cp15_control |= 0x4U;
369
370         if (i_cache)
371                 cp15_control |= 0x1000U;
372
373         arm920t_write_cp15_physical(target, 0x2, cp15_control);
374 }
375
376 void arm920t_post_debug_entry(target_t *target)
377 {
378         uint32_t cp15c15;
379         armv4_5_common_t *armv4_5 = target->arch_info;
380         arm7_9_common_t *arm7_9 = armv4_5->arch_info;
381         arm9tdmi_common_t *arm9tdmi = arm7_9->arch_info;
382         arm920t_common_t *arm920t = arm9tdmi->arch_info;
383
384         /* examine cp15 control reg */
385         arm920t_read_cp15_physical(target, 0x2, &arm920t->cp15_control_reg);
386         jtag_execute_queue();
387         LOG_DEBUG("cp15_control_reg: %8.8" PRIx32 "", arm920t->cp15_control_reg);
388
389         if (arm920t->armv4_5_mmu.armv4_5_cache.ctype == -1)
390         {
391                 uint32_t cache_type_reg;
392                 /* identify caches */
393                 arm920t_read_cp15_physical(target, 0x1, &cache_type_reg);
394                 jtag_execute_queue();
395                 armv4_5_identify_cache(cache_type_reg, &arm920t->armv4_5_mmu.armv4_5_cache);
396         }
397
398         arm920t->armv4_5_mmu.mmu_enabled = (arm920t->cp15_control_reg & 0x1U) ? 1 : 0;
399         arm920t->armv4_5_mmu.armv4_5_cache.d_u_cache_enabled = (arm920t->cp15_control_reg & 0x4U) ? 1 : 0;
400         arm920t->armv4_5_mmu.armv4_5_cache.i_cache_enabled = (arm920t->cp15_control_reg & 0x1000U) ? 1 : 0;
401
402         /* save i/d fault status and address register */
403         arm920t_read_cp15_interpreted(target, 0xee150f10, 0x0, &arm920t->d_fsr);
404         arm920t_read_cp15_interpreted(target, 0xee150f30, 0x0, &arm920t->i_fsr);
405         arm920t_read_cp15_interpreted(target, 0xee160f10, 0x0, &arm920t->d_far);
406         arm920t_read_cp15_interpreted(target, 0xee160f30, 0x0, &arm920t->i_far);
407
408         LOG_DEBUG("D FSR: 0x%8.8" PRIx32 ", D FAR: 0x%8.8" PRIx32 ", I FSR: 0x%8.8" PRIx32 ", I FAR: 0x%8.8" PRIx32 "",
409                 arm920t->d_fsr, arm920t->d_far, arm920t->i_fsr, arm920t->i_far);
410
411         if (arm920t->preserve_cache)
412         {
413                 /* read-modify-write CP15 test state register
414                  * to disable I/D-cache linefills */
415                 arm920t_read_cp15_physical(target, 0x1e, &cp15c15);
416                 jtag_execute_queue();
417                 cp15c15 |= 0x600;
418                 arm920t_write_cp15_physical(target, 0x1e, cp15c15);
419         }
420 }
421
422 void arm920t_pre_restore_context(target_t *target)
423 {
424         uint32_t cp15c15;
425         armv4_5_common_t *armv4_5 = target->arch_info;
426         arm7_9_common_t *arm7_9 = armv4_5->arch_info;
427         arm9tdmi_common_t *arm9tdmi = arm7_9->arch_info;
428         arm920t_common_t *arm920t = arm9tdmi->arch_info;
429
430         /* restore i/d fault status and address register */
431         arm920t_write_cp15_interpreted(target, 0xee050f10, arm920t->d_fsr, 0x0);
432         arm920t_write_cp15_interpreted(target, 0xee050f30, arm920t->i_fsr, 0x0);
433         arm920t_write_cp15_interpreted(target, 0xee060f10, arm920t->d_far, 0x0);
434         arm920t_write_cp15_interpreted(target, 0xee060f30, arm920t->i_far, 0x0);
435
436         /* read-modify-write CP15 test state register
437         * to reenable I/D-cache linefills */
438         if (arm920t->preserve_cache)
439         {
440                 arm920t_read_cp15_physical(target, 0x1e, &cp15c15);
441                 jtag_execute_queue();
442                 cp15c15 &= ~0x600U;
443                 arm920t_write_cp15_physical(target, 0x1e, cp15c15);
444         }
445 }
446
447 int arm920t_get_arch_pointers(target_t *target, armv4_5_common_t **armv4_5_p, arm7_9_common_t **arm7_9_p, arm9tdmi_common_t **arm9tdmi_p, arm920t_common_t **arm920t_p)
448 {
449         armv4_5_common_t *armv4_5 = target->arch_info;
450         arm7_9_common_t *arm7_9;
451         arm9tdmi_common_t *arm9tdmi;
452         arm920t_common_t *arm920t;
453
454         if (armv4_5->common_magic != ARMV4_5_COMMON_MAGIC)
455         {
456                 return -1;
457         }
458
459         arm7_9 = armv4_5->arch_info;
460         if (arm7_9->common_magic != ARM7_9_COMMON_MAGIC)
461         {
462                 return -1;
463         }
464
465         arm9tdmi = arm7_9->arch_info;
466         if (arm9tdmi->common_magic != ARM9TDMI_COMMON_MAGIC)
467         {
468                 return -1;
469         }
470
471         arm920t = arm9tdmi->arch_info;
472         if (arm920t->common_magic != ARM920T_COMMON_MAGIC)
473         {
474                 return -1;
475         }
476
477         *armv4_5_p = armv4_5;
478         *arm7_9_p = arm7_9;
479         *arm9tdmi_p = arm9tdmi;
480         *arm920t_p = arm920t;
481
482         return ERROR_OK;
483 }
484
485 int arm920t_arch_state(struct target_s *target)
486 {
487         armv4_5_common_t *armv4_5 = target->arch_info;
488         arm7_9_common_t *arm7_9 = armv4_5->arch_info;
489         arm9tdmi_common_t *arm9tdmi = arm7_9->arch_info;
490         arm920t_common_t *arm920t = arm9tdmi->arch_info;
491
492         char *state[] =
493         {
494                 "disabled", "enabled"
495         };
496
497         if (armv4_5->common_magic != ARMV4_5_COMMON_MAGIC)
498         {
499                 LOG_ERROR("BUG: called for a non-ARMv4/5 target");
500                 exit(-1);
501         }
502
503         LOG_USER("target halted in %s state due to %s, current mode: %s\n"
504                         "cpsr: 0x%8.8" PRIx32 " pc: 0x%8.8" PRIx32 "\n"
505                         "MMU: %s, D-Cache: %s, I-Cache: %s",
506                          armv4_5_state_strings[armv4_5->core_state],
507                          Jim_Nvp_value2name_simple(nvp_target_debug_reason, target->debug_reason)->name,
508                          armv4_5_mode_strings[armv4_5_mode_to_number(armv4_5->core_mode)],
509                          buf_get_u32(armv4_5->core_cache->reg_list[ARMV4_5_CPSR].value, 0, 32),
510                          buf_get_u32(armv4_5->core_cache->reg_list[15].value, 0, 32),
511                          state[arm920t->armv4_5_mmu.mmu_enabled],
512                          state[arm920t->armv4_5_mmu.armv4_5_cache.d_u_cache_enabled],
513                          state[arm920t->armv4_5_mmu.armv4_5_cache.i_cache_enabled]);
514
515         return ERROR_OK;
516 }
517
518 int arm920t_read_memory(struct target_s *target, uint32_t address, uint32_t size, uint32_t count, uint8_t *buffer)
519 {
520         int retval;
521
522         retval = arm7_9_read_memory(target, address, size, count, buffer);
523
524         return retval;
525 }
526
527
528 int arm920t_read_phys_memory(struct target_s *target, uint32_t address, uint32_t size, uint32_t count, uint8_t *buffer)
529 {
530         armv4_5_common_t *armv4_5 = target->arch_info;
531         arm7_9_common_t *arm7_9 = armv4_5->arch_info;
532         arm9tdmi_common_t *arm9tdmi = arm7_9->arch_info;
533         arm920t_common_t *arm920t = arm9tdmi->arch_info;
534
535         return armv4_5_mmu_read_physical(target, &arm920t->armv4_5_mmu, address, size, count, buffer);
536 }
537
538 int arm920t_write_phys_memory(struct target_s *target, uint32_t address, uint32_t size, uint32_t count, uint8_t *buffer)
539 {
540         armv4_5_common_t *armv4_5 = target->arch_info;
541         arm7_9_common_t *arm7_9 = armv4_5->arch_info;
542         arm9tdmi_common_t *arm9tdmi = arm7_9->arch_info;
543         arm920t_common_t *arm920t = arm9tdmi->arch_info;
544
545         return armv4_5_mmu_write_physical(target, &arm920t->armv4_5_mmu, address, size, count, buffer);
546 }
547
548
549 int arm920t_write_memory(struct target_s *target, uint32_t address, uint32_t size, uint32_t count, uint8_t *buffer)
550 {
551         int retval;
552         armv4_5_common_t *armv4_5 = target->arch_info;
553         arm7_9_common_t *arm7_9 = armv4_5->arch_info;
554         arm9tdmi_common_t *arm9tdmi = arm7_9->arch_info;
555         arm920t_common_t *arm920t = arm9tdmi->arch_info;
556
557         if ((retval = arm7_9_write_memory(target, address, size, count, buffer)) != ERROR_OK)
558                 return retval;
559
560         if (((size == 4) || (size == 2)) && (count == 1))
561         {
562                 if (arm920t->armv4_5_mmu.armv4_5_cache.d_u_cache_enabled)
563                 {
564                         LOG_DEBUG("D-Cache enabled, writing through to main memory");
565                         uint32_t pa, cb, ap;
566                         int type, domain;
567
568                         pa = armv4_5_mmu_translate_va(target, &arm920t->armv4_5_mmu, address, &type, &cb, &domain, &ap);
569                         if (type == -1)
570                                 return ERROR_OK;
571                         /* cacheable & bufferable means write-back region */
572                         if (cb == 3)
573                                 armv4_5_mmu_write_physical(target, &arm920t->armv4_5_mmu, pa, size, count, buffer);
574                 }
575
576                 if (arm920t->armv4_5_mmu.armv4_5_cache.i_cache_enabled)
577                 {
578                         LOG_DEBUG("I-Cache enabled, invalidating affected I-Cache line");
579                         arm920t_write_cp15_interpreted(target, 0xee070f35, 0x0, address);
580                 }
581         }
582
583         return retval;
584 }
585
586 int arm920t_soft_reset_halt(struct target_s *target)
587 {
588         int retval = ERROR_OK;
589         armv4_5_common_t *armv4_5 = target->arch_info;
590         arm7_9_common_t *arm7_9 = armv4_5->arch_info;
591         arm9tdmi_common_t *arm9tdmi = arm7_9->arch_info;
592         arm920t_common_t *arm920t = arm9tdmi->arch_info;
593         reg_t *dbg_stat = &arm7_9->eice_cache->reg_list[EICE_DBG_STAT];
594
595         if ((retval = target_halt(target)) != ERROR_OK)
596         {
597                 return retval;
598         }
599
600         long long then = timeval_ms();
601         int timeout;
602         while (!(timeout = ((timeval_ms()-then) > 1000)))
603         {
604                 if (buf_get_u32(dbg_stat->value, EICE_DBG_STATUS_DBGACK, 1) == 0)
605                 {
606                         embeddedice_read_reg(dbg_stat);
607                         if ((retval = jtag_execute_queue()) != ERROR_OK)
608                         {
609                                 return retval;
610                         }
611                 } else
612                 {
613                         break;
614                 }
615                 if (debug_level >= 3)
616                 {
617                         /* do not eat all CPU, time out after 1 se*/
618                         alive_sleep(100);
619                 } else
620                 {
621                         keep_alive();
622                 }
623         }
624         if (timeout)
625         {
626                 LOG_ERROR("Failed to halt CPU after 1 sec");
627                 return ERROR_TARGET_TIMEOUT;
628         }
629
630         target->state = TARGET_HALTED;
631
632         /* SVC, ARM state, IRQ and FIQ disabled */
633         buf_set_u32(armv4_5->core_cache->reg_list[ARMV4_5_CPSR].value, 0, 8, 0xd3);
634         armv4_5->core_cache->reg_list[ARMV4_5_CPSR].dirty = 1;
635         armv4_5->core_cache->reg_list[ARMV4_5_CPSR].valid = 1;
636
637         /* start fetching from 0x0 */
638         buf_set_u32(armv4_5->core_cache->reg_list[15].value, 0, 32, 0x0);
639         armv4_5->core_cache->reg_list[15].dirty = 1;
640         armv4_5->core_cache->reg_list[15].valid = 1;
641
642         armv4_5->core_mode = ARMV4_5_MODE_SVC;
643         armv4_5->core_state = ARMV4_5_STATE_ARM;
644
645         arm920t_disable_mmu_caches(target, 1, 1, 1);
646         arm920t->armv4_5_mmu.mmu_enabled = 0;
647         arm920t->armv4_5_mmu.armv4_5_cache.d_u_cache_enabled = 0;
648         arm920t->armv4_5_mmu.armv4_5_cache.i_cache_enabled = 0;
649
650         if ((retval = target_call_event_callbacks(target, TARGET_EVENT_HALTED)) != ERROR_OK)
651         {
652                 return retval;
653         }
654
655         return ERROR_OK;
656 }
657
658 int arm920t_init_target(struct command_context_s *cmd_ctx, struct target_s *target)
659 {
660         arm9tdmi_init_target(cmd_ctx, target);
661
662         return ERROR_OK;
663 }
664
665 int arm920t_quit(void)
666 {
667         return ERROR_OK;
668 }
669
670 int arm920t_init_arch_info(target_t *target, arm920t_common_t *arm920t, jtag_tap_t *tap)
671 {
672         arm9tdmi_common_t *arm9tdmi = &arm920t->arm9tdmi_common;
673         arm7_9_common_t *arm7_9 = &arm9tdmi->arm7_9_common;
674
675         /* initialize arm9tdmi specific info (including arm7_9 and armv4_5)
676          */
677         arm9tdmi_init_arch_info(target, arm9tdmi, tap);
678
679         arm9tdmi->arch_info = arm920t;
680         arm920t->common_magic = ARM920T_COMMON_MAGIC;
681
682         arm7_9->post_debug_entry = arm920t_post_debug_entry;
683         arm7_9->pre_restore_context = arm920t_pre_restore_context;
684
685         arm920t->armv4_5_mmu.armv4_5_cache.ctype = -1;
686         arm920t->armv4_5_mmu.get_ttb = arm920t_get_ttb;
687         arm920t->armv4_5_mmu.read_memory = arm7_9_read_memory;
688         arm920t->armv4_5_mmu.write_memory = arm7_9_write_memory;
689         arm920t->armv4_5_mmu.disable_mmu_caches = arm920t_disable_mmu_caches;
690         arm920t->armv4_5_mmu.enable_mmu_caches = arm920t_enable_mmu_caches;
691         arm920t->armv4_5_mmu.has_tiny_pages = 1;
692         arm920t->armv4_5_mmu.mmu_enabled = 0;
693
694         /* disabling linefills leads to lockups, so keep them enabled for now
695          * this doesn't affect correctness, but might affect timing issues, if
696          * important data is evicted from the cache during the debug session
697          * */
698         arm920t->preserve_cache = 0;
699
700         /* override hw single-step capability from ARM9TDMI */
701         arm7_9->has_single_step = 1;
702
703         return ERROR_OK;
704 }
705
706 int arm920t_target_create(struct target_s *target, Jim_Interp *interp)
707 {
708         arm920t_common_t *arm920t = calloc(1,sizeof(arm920t_common_t));
709
710         arm920t_init_arch_info(target, arm920t, target->tap);
711
712         return ERROR_OK;
713 }
714
715 int arm920t_register_commands(struct command_context_s *cmd_ctx)
716 {
717         int retval;
718         command_t *arm920t_cmd;
719
720
721         retval = arm9tdmi_register_commands(cmd_ctx);
722
723         arm920t_cmd = register_command(cmd_ctx, NULL, "arm920t", NULL, COMMAND_ANY, "arm920t specific commands");
724
725         register_command(cmd_ctx, arm920t_cmd, "cp15", arm920t_handle_cp15_command, COMMAND_EXEC, "display/modify cp15 register <num> [value]");
726         register_command(cmd_ctx, arm920t_cmd, "cp15i", arm920t_handle_cp15i_command, COMMAND_EXEC, "display/modify cp15 (interpreted access) <opcode> [value] [address]");
727         register_command(cmd_ctx, arm920t_cmd, "cache_info", arm920t_handle_cache_info_command, COMMAND_EXEC, "display information about target caches");
728
729         register_command(cmd_ctx, arm920t_cmd, "mdw_phys", arm920t_handle_md_phys_command, COMMAND_EXEC, "display memory words <physical addr> [count]");
730         register_command(cmd_ctx, arm920t_cmd, "mdh_phys", arm920t_handle_md_phys_command, COMMAND_EXEC, "display memory half-words <physical addr> [count]");
731         register_command(cmd_ctx, arm920t_cmd, "mdb_phys", arm920t_handle_md_phys_command, COMMAND_EXEC, "display memory bytes <physical addr> [count]");
732
733         register_command(cmd_ctx, arm920t_cmd, "mww_phys", arm920t_handle_mw_phys_command, COMMAND_EXEC, "write memory word <physical addr> <value>");
734         register_command(cmd_ctx, arm920t_cmd, "mwh_phys", arm920t_handle_mw_phys_command, COMMAND_EXEC, "write memory half-word <physical addr> <value>");
735         register_command(cmd_ctx, arm920t_cmd, "mwb_phys", arm920t_handle_mw_phys_command, COMMAND_EXEC, "write memory byte <physical addr> <value>");
736
737         register_command(cmd_ctx, arm920t_cmd, "read_cache", arm920t_handle_read_cache_command, COMMAND_EXEC, "display I/D cache content");
738         register_command(cmd_ctx, arm920t_cmd, "read_mmu", arm920t_handle_read_mmu_command, COMMAND_EXEC, "display I/D mmu content");
739
740         return retval;
741 }
742
743 int arm920t_handle_read_cache_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc)
744 {
745         int retval = ERROR_OK;
746         target_t *target = get_current_target(cmd_ctx);
747         armv4_5_common_t *armv4_5;
748         arm7_9_common_t *arm7_9;
749         arm9tdmi_common_t *arm9tdmi;
750         arm920t_common_t *arm920t;
751         arm_jtag_t *jtag_info;
752         uint32_t cp15c15;
753         uint32_t cp15_ctrl, cp15_ctrl_saved;
754         uint32_t regs[16];
755         uint32_t *regs_p[16];
756         uint32_t C15_C_D_Ind, C15_C_I_Ind;
757         int i;
758         FILE *output;
759         arm920t_cache_line_t d_cache[8][64], i_cache[8][64];
760         int segment, index;
761
762         if (argc != 1)
763         {
764                 command_print(cmd_ctx, "usage: arm920t read_cache <filename>");
765                 return ERROR_OK;
766         }
767
768         if ((output = fopen(args[0], "w")) == NULL)
769         {
770                 LOG_DEBUG("error opening cache content file");
771                 return ERROR_OK;
772         }
773
774         for (i = 0; i < 16; i++)
775                 regs_p[i] = &regs[i];
776
777         if (arm920t_get_arch_pointers(target, &armv4_5, &arm7_9, &arm9tdmi, &arm920t) != ERROR_OK)
778         {
779                 command_print(cmd_ctx, "current target isn't an ARM920t target");
780                 return ERROR_OK;
781         }
782
783         jtag_info = &arm7_9->jtag_info;
784
785         /* disable MMU and Caches */
786         arm920t_read_cp15_physical(target, ARM920T_CP15_PHYS_ADDR(0, 0x1, 0), &cp15_ctrl);
787         if ((retval = jtag_execute_queue()) != ERROR_OK)
788         {
789                 return retval;
790         }
791         cp15_ctrl_saved = cp15_ctrl;
792         cp15_ctrl &= ~(ARMV4_5_MMU_ENABLED | ARMV4_5_D_U_CACHE_ENABLED | ARMV4_5_I_CACHE_ENABLED);
793         arm920t_write_cp15_physical(target, ARM920T_CP15_PHYS_ADDR(0, 0x1, 0), cp15_ctrl);
794
795         /* read CP15 test state register */
796         arm920t_read_cp15_physical(target, ARM920T_CP15_PHYS_ADDR(0, 0xf, 0), &cp15c15);
797         jtag_execute_queue();
798
799         /* read DCache content */
800         fprintf(output, "DCache:\n");
801
802         /* go through segments 0 to nsets (8 on ARM920T, 4 on ARM922T) */
803         for (segment = 0; segment < arm920t->armv4_5_mmu.armv4_5_cache.d_u_size.nsets; segment++)
804         {
805                 fprintf(output, "\nsegment: %i\n----------", segment);
806
807                 /* Ra: r0 = SBZ(31:8):segment(7:5):SBZ(4:0) */
808                 regs[0] = 0x0 | (segment << 5);
809                 arm9tdmi_write_core_regs(target, 0x1, regs);
810
811                 /* set interpret mode */
812                 cp15c15 |= 0x1;
813                 arm920t_write_cp15_physical(target, ARM920T_CP15_PHYS_ADDR(0, 0xf, 0), cp15c15);
814
815                 /* D CAM Read, loads current victim into C15.C.D.Ind */
816                 arm920t_execute_cp15(target, ARMV4_5_MCR(15,2,0,15,6,2), ARMV4_5_LDR(1, 0));
817
818                 /* read current victim */
819                 arm920t_read_cp15_physical(target, 0x3d, &C15_C_D_Ind);
820
821                 /* clear interpret mode */
822                 cp15c15 &= ~0x1;
823                 arm920t_write_cp15_physical(target, 0x1e, cp15c15);
824
825                 for (index = 0; index < 64; index++)
826                 {
827                         /* Ra: r0 = index(31:26):SBZ(25:8):segment(7:5):SBZ(4:0) */
828                         regs[0] = 0x0 | (segment << 5) | (index << 26);
829                         arm9tdmi_write_core_regs(target, 0x1, regs);
830
831                         /* set interpret mode */
832                         cp15c15 |= 0x1;
833                         arm920t_write_cp15_physical(target, ARM920T_CP15_PHYS_ADDR(0, 0xf, 0), cp15c15);
834
835                         /* Write DCache victim */
836                         arm920t_execute_cp15(target, ARMV4_5_MCR(15,0,0,9,1,0), ARMV4_5_LDR(1, 0));
837
838                         /* Read D RAM */
839                         arm920t_execute_cp15(target, ARMV4_5_MCR(15,2,0,15,10,2), ARMV4_5_LDMIA(0, 0x1fe, 0, 0));
840
841                         /* Read D CAM */
842                         arm920t_execute_cp15(target, ARMV4_5_MCR(15,2,0,15,6,2), ARMV4_5_LDR(9, 0));
843
844                         /* clear interpret mode */
845                         cp15c15 &= ~0x1;
846                         arm920t_write_cp15_physical(target, 0x1e, cp15c15);
847
848                         /* read D RAM and CAM content */
849                         arm9tdmi_read_core_regs(target, 0x3fe, regs_p);
850                         if ((retval = jtag_execute_queue()) != ERROR_OK)
851                         {
852                                 return retval;
853                         }
854
855                         d_cache[segment][index].cam = regs[9];
856
857                         /* mask LFSR[6] */
858                         regs[9] &= 0xfffffffe;
859                         fprintf(output, "\nsegment: %i, index: %i, CAM: 0x%8.8" PRIx32 ", content (%s):\n", segment, index, regs[9], (regs[9] & 0x10) ? "valid" : "invalid");
860
861                         for (i = 1; i < 9; i++)
862                         {
863                                  d_cache[segment][index].data[i] = regs[i];
864                                  fprintf(output, "%i: 0x%8.8" PRIx32 "\n", i-1, regs[i]);
865                         }
866
867                 }
868
869                 /* Ra: r0 = index(31:26):SBZ(25:8):segment(7:5):SBZ(4:0) */
870                 regs[0] = 0x0 | (segment << 5) | (C15_C_D_Ind << 26);
871                 arm9tdmi_write_core_regs(target, 0x1, regs);
872
873                 /* set interpret mode */
874                 cp15c15 |= 0x1;
875                 arm920t_write_cp15_physical(target, ARM920T_CP15_PHYS_ADDR(0, 0xf, 0), cp15c15);
876
877                 /* Write DCache victim */
878                 arm920t_execute_cp15(target, ARMV4_5_MCR(15,0,0,9,1,0), ARMV4_5_LDR(1, 0));
879
880                 /* clear interpret mode */
881                 cp15c15 &= ~0x1;
882                 arm920t_write_cp15_physical(target, 0x1e, cp15c15);
883         }
884
885         /* read ICache content */
886         fprintf(output, "ICache:\n");
887
888         /* go through segments 0 to nsets (8 on ARM920T, 4 on ARM922T) */
889         for (segment = 0; segment < arm920t->armv4_5_mmu.armv4_5_cache.d_u_size.nsets; segment++)
890         {
891                 fprintf(output, "segment: %i\n----------", segment);
892
893                 /* Ra: r0 = SBZ(31:8):segment(7:5):SBZ(4:0) */
894                 regs[0] = 0x0 | (segment << 5);
895                 arm9tdmi_write_core_regs(target, 0x1, regs);
896
897                 /* set interpret mode */
898                 cp15c15 |= 0x1;
899                 arm920t_write_cp15_physical(target, ARM920T_CP15_PHYS_ADDR(0, 0xf, 0), cp15c15);
900
901                 /* I CAM Read, loads current victim into C15.C.I.Ind */
902                 arm920t_execute_cp15(target, ARMV4_5_MCR(15,2,0,15,5,2), ARMV4_5_LDR(1, 0));
903
904                 /* read current victim */
905                 arm920t_read_cp15_physical(target, 0x3b, &C15_C_I_Ind);
906
907                 /* clear interpret mode */
908                 cp15c15 &= ~0x1;
909                 arm920t_write_cp15_physical(target, 0x1e, cp15c15);
910
911                 for (index = 0; index < 64; index++)
912                 {
913                         /* Ra: r0 = index(31:26):SBZ(25:8):segment(7:5):SBZ(4:0) */
914                         regs[0] = 0x0 | (segment << 5) | (index << 26);
915                         arm9tdmi_write_core_regs(target, 0x1, regs);
916
917                         /* set interpret mode */
918                         cp15c15 |= 0x1;
919                         arm920t_write_cp15_physical(target, ARM920T_CP15_PHYS_ADDR(0, 0xf, 0), cp15c15);
920
921                         /* Write ICache victim */
922                         arm920t_execute_cp15(target, ARMV4_5_MCR(15,0,0,9,1,1), ARMV4_5_LDR(1, 0));
923
924                         /* Read I RAM */
925                         arm920t_execute_cp15(target, ARMV4_5_MCR(15,2,0,15,9,2), ARMV4_5_LDMIA(0, 0x1fe, 0, 0));
926
927                         /* Read I CAM */
928                         arm920t_execute_cp15(target, ARMV4_5_MCR(15,2,0,15,5,2), ARMV4_5_LDR(9, 0));
929
930                         /* clear interpret mode */
931                         cp15c15 &= ~0x1;
932                         arm920t_write_cp15_physical(target, 0x1e, cp15c15);
933
934                         /* read I RAM and CAM content */
935                         arm9tdmi_read_core_regs(target, 0x3fe, regs_p);
936                         if ((retval = jtag_execute_queue()) != ERROR_OK)
937                         {
938                                 return retval;
939                         }
940
941                         i_cache[segment][index].cam = regs[9];
942
943                         /* mask LFSR[6] */
944                         regs[9] &= 0xfffffffe;
945                         fprintf(output, "\nsegment: %i, index: %i, CAM: 0x%8.8" PRIx32 ", content (%s):\n", segment, index, regs[9], (regs[9] & 0x10) ? "valid" : "invalid");
946
947                         for (i = 1; i < 9; i++)
948                         {
949                                  i_cache[segment][index].data[i] = regs[i];
950                                  fprintf(output, "%i: 0x%8.8" PRIx32 "\n", i-1, regs[i]);
951                         }
952                 }
953
954                 /* Ra: r0 = index(31:26):SBZ(25:8):segment(7:5):SBZ(4:0) */
955                 regs[0] = 0x0 | (segment << 5) | (C15_C_D_Ind << 26);
956                 arm9tdmi_write_core_regs(target, 0x1, regs);
957
958                 /* set interpret mode */
959                 cp15c15 |= 0x1;
960                 arm920t_write_cp15_physical(target, ARM920T_CP15_PHYS_ADDR(0, 0xf, 0), cp15c15);
961
962                 /* Write ICache victim */
963                 arm920t_execute_cp15(target, ARMV4_5_MCR(15,0,0,9,1,1), ARMV4_5_LDR(1, 0));
964
965                 /* clear interpret mode */
966                 cp15c15 &= ~0x1;
967                 arm920t_write_cp15_physical(target, 0x1e, cp15c15);
968         }
969
970         /* restore CP15 MMU and Cache settings */
971         arm920t_write_cp15_physical(target, ARM920T_CP15_PHYS_ADDR(0, 0x1, 0), cp15_ctrl_saved);
972
973         command_print(cmd_ctx, "cache content successfully output to %s", args[0]);
974
975         fclose(output);
976
977         if (armv4_5_mode_to_number(armv4_5->core_mode)==-1)
978                 return ERROR_FAIL;
979
980         /* mark registers dirty. */
981         ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 0).dirty = ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 0).valid;
982         ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 1).dirty = ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 1).valid;
983         ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 2).dirty = ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 2).valid;
984         ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 3).dirty = ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 3).valid;
985         ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 4).dirty = ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 4).valid;
986         ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 5).dirty = ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 5).valid;
987         ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 6).dirty = ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 6).valid;
988         ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 7).dirty = ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 7).valid;
989         ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 8).dirty = ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 8).valid;
990         ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 9).dirty = ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 9).valid;
991
992         return ERROR_OK;
993 }
994
995 int arm920t_handle_read_mmu_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc)
996 {
997         int retval = ERROR_OK;
998         target_t *target = get_current_target(cmd_ctx);
999         armv4_5_common_t *armv4_5;
1000         arm7_9_common_t *arm7_9;
1001         arm9tdmi_common_t *arm9tdmi;
1002         arm920t_common_t *arm920t;
1003         arm_jtag_t *jtag_info;
1004         uint32_t cp15c15;
1005         uint32_t cp15_ctrl, cp15_ctrl_saved;
1006         uint32_t regs[16];
1007         uint32_t *regs_p[16];
1008         int i;
1009         FILE *output;
1010         uint32_t Dlockdown, Ilockdown;
1011         arm920t_tlb_entry_t d_tlb[64], i_tlb[64];
1012         int victim;
1013
1014         if (argc != 1)
1015         {
1016                 command_print(cmd_ctx, "usage: arm920t read_mmu <filename>");
1017                 return ERROR_OK;
1018         }
1019
1020         if ((output = fopen(args[0], "w")) == NULL)
1021         {
1022                 LOG_DEBUG("error opening mmu content file");
1023                 return ERROR_OK;
1024         }
1025
1026         for (i = 0; i < 16; i++)
1027                 regs_p[i] = &regs[i];
1028
1029         if (arm920t_get_arch_pointers(target, &armv4_5, &arm7_9, &arm9tdmi, &arm920t) != ERROR_OK)
1030         {
1031                 command_print(cmd_ctx, "current target isn't an ARM920t target");
1032                 return ERROR_OK;
1033         }
1034
1035         jtag_info = &arm7_9->jtag_info;
1036
1037         /* disable MMU and Caches */
1038         arm920t_read_cp15_physical(target, ARM920T_CP15_PHYS_ADDR(0, 0x1, 0), &cp15_ctrl);
1039         if ((retval = jtag_execute_queue()) != ERROR_OK)
1040         {
1041                 return retval;
1042         }
1043         cp15_ctrl_saved = cp15_ctrl;
1044         cp15_ctrl &= ~(ARMV4_5_MMU_ENABLED | ARMV4_5_D_U_CACHE_ENABLED | ARMV4_5_I_CACHE_ENABLED);
1045         arm920t_write_cp15_physical(target, ARM920T_CP15_PHYS_ADDR(0, 0x1, 0), cp15_ctrl);
1046
1047         /* read CP15 test state register */
1048         arm920t_read_cp15_physical(target, ARM920T_CP15_PHYS_ADDR(0, 0xf, 0), &cp15c15);
1049         if ((retval = jtag_execute_queue()) != ERROR_OK)
1050         {
1051                 return retval;
1052         }
1053
1054         /* prepare reading D TLB content
1055          * */
1056
1057         /* set interpret mode */
1058         cp15c15 |= 0x1;
1059         arm920t_write_cp15_physical(target, ARM920T_CP15_PHYS_ADDR(0, 0xf, 0), cp15c15);
1060
1061         /* Read D TLB lockdown */
1062         arm920t_execute_cp15(target, ARMV4_5_MRC(15,0,0,10,0,0), ARMV4_5_LDR(1, 0));
1063
1064         /* clear interpret mode */
1065         cp15c15 &= ~0x1;
1066         arm920t_write_cp15_physical(target, 0x1e, cp15c15);
1067
1068         /* read D TLB lockdown stored to r1 */
1069         arm9tdmi_read_core_regs(target, 0x2, regs_p);
1070         if ((retval = jtag_execute_queue()) != ERROR_OK)
1071         {
1072                 return retval;
1073         }
1074         Dlockdown = regs[1];
1075
1076         for (victim = 0; victim < 64; victim += 8)
1077         {
1078                 /* new lockdown value: base[31:26]:victim[25:20]:SBZ[19:1]:p[0]
1079                  * base remains unchanged, victim goes through entries 0 to 63 */
1080                 regs[1] = (Dlockdown & 0xfc000000) | (victim << 20);
1081                 arm9tdmi_write_core_regs(target, 0x2, regs);
1082
1083                 /* set interpret mode */
1084                 cp15c15 |= 0x1;
1085                 arm920t_write_cp15_physical(target, ARM920T_CP15_PHYS_ADDR(0, 0xf, 0), cp15c15);
1086
1087                 /* Write D TLB lockdown */
1088                 arm920t_execute_cp15(target, ARMV4_5_MCR(15,0,0,10,0,0), ARMV4_5_STR(1, 0));
1089
1090                 /* Read D TLB CAM */
1091                 arm920t_execute_cp15(target, ARMV4_5_MCR(15,4,0,15,6,4), ARMV4_5_LDMIA(0, 0x3fc, 0, 0));
1092
1093                 /* clear interpret mode */
1094                 cp15c15 &= ~0x1;
1095                 arm920t_write_cp15_physical(target, 0x1e, cp15c15);
1096
1097                 /* read D TLB CAM content stored to r2-r9 */
1098                 arm9tdmi_read_core_regs(target, 0x3fc, regs_p);
1099                 if ((retval = jtag_execute_queue()) != ERROR_OK)
1100                 {
1101                         return retval;
1102                 }
1103
1104                 for (i = 0; i < 8; i++)
1105                         d_tlb[victim + i].cam = regs[i + 2];
1106         }
1107
1108         for (victim = 0; victim < 64; victim++)
1109         {
1110                 /* new lockdown value: base[31:26]:victim[25:20]:SBZ[19:1]:p[0]
1111                  * base remains unchanged, victim goes through entries 0 to 63 */
1112                 regs[1] = (Dlockdown & 0xfc000000) | (victim << 20);
1113                 arm9tdmi_write_core_regs(target, 0x2, regs);
1114
1115                 /* set interpret mode */
1116                 cp15c15 |= 0x1;
1117                 arm920t_write_cp15_physical(target, ARM920T_CP15_PHYS_ADDR(0, 0xf, 0), cp15c15);
1118
1119                 /* Write D TLB lockdown */
1120                 arm920t_execute_cp15(target, ARMV4_5_MCR(15,0,0,10,0,0), ARMV4_5_STR(1, 0));
1121
1122                 /* Read D TLB RAM1 */
1123                 arm920t_execute_cp15(target, ARMV4_5_MCR(15,4,0,15,10,4), ARMV4_5_LDR(2,0));
1124
1125                 /* Read D TLB RAM2 */
1126                 arm920t_execute_cp15(target, ARMV4_5_MCR(15,4,0,15,2,5), ARMV4_5_LDR(3,0));
1127
1128                 /* clear interpret mode */
1129                 cp15c15 &= ~0x1;
1130                 arm920t_write_cp15_physical(target, 0x1e, cp15c15);
1131
1132                 /* read D TLB RAM content stored to r2 and r3 */
1133                 arm9tdmi_read_core_regs(target, 0xc, regs_p);
1134                 if ((retval = jtag_execute_queue()) != ERROR_OK)
1135                 {
1136                         return retval;
1137                 }
1138
1139                 d_tlb[victim].ram1 = regs[2];
1140                 d_tlb[victim].ram2 = regs[3];
1141         }
1142
1143         /* restore D TLB lockdown */
1144         regs[1] = Dlockdown;
1145         arm9tdmi_write_core_regs(target, 0x2, regs);
1146
1147         /* Write D TLB lockdown */
1148         arm920t_execute_cp15(target, ARMV4_5_MCR(15,0,0,10,0,0), ARMV4_5_STR(1, 0));
1149
1150         /* prepare reading I TLB content
1151          * */
1152
1153         /* set interpret mode */
1154         cp15c15 |= 0x1;
1155         arm920t_write_cp15_physical(target, ARM920T_CP15_PHYS_ADDR(0, 0xf, 0), cp15c15);
1156
1157         /* Read I TLB lockdown */
1158         arm920t_execute_cp15(target, ARMV4_5_MRC(15,0,0,10,0,1), ARMV4_5_LDR(1, 0));
1159
1160         /* clear interpret mode */
1161         cp15c15 &= ~0x1;
1162         arm920t_write_cp15_physical(target, 0x1e, cp15c15);
1163
1164         /* read I TLB lockdown stored to r1 */
1165         arm9tdmi_read_core_regs(target, 0x2, regs_p);
1166         if ((retval = jtag_execute_queue()) != ERROR_OK)
1167         {
1168                 return retval;
1169         }
1170         Ilockdown = regs[1];
1171
1172         for (victim = 0; victim < 64; victim += 8)
1173         {
1174                 /* new lockdown value: base[31:26]:victim[25:20]:SBZ[19:1]:p[0]
1175                  * base remains unchanged, victim goes through entries 0 to 63 */
1176                 regs[1] = (Ilockdown & 0xfc000000) | (victim << 20);
1177                 arm9tdmi_write_core_regs(target, 0x2, regs);
1178
1179                 /* set interpret mode */
1180                 cp15c15 |= 0x1;
1181                 arm920t_write_cp15_physical(target, ARM920T_CP15_PHYS_ADDR(0, 0xf, 0), cp15c15);
1182
1183                 /* Write I TLB lockdown */
1184                 arm920t_execute_cp15(target, ARMV4_5_MCR(15,0,0,10,0,1), ARMV4_5_STR(1, 0));
1185
1186                 /* Read I TLB CAM */
1187                 arm920t_execute_cp15(target, ARMV4_5_MCR(15,4,0,15,5,4), ARMV4_5_LDMIA(0, 0x3fc, 0, 0));
1188
1189                 /* clear interpret mode */
1190                 cp15c15 &= ~0x1;
1191                 arm920t_write_cp15_physical(target, 0x1e, cp15c15);
1192
1193                 /* read I TLB CAM content stored to r2-r9 */
1194                 arm9tdmi_read_core_regs(target, 0x3fc, regs_p);
1195                 if ((retval = jtag_execute_queue()) != ERROR_OK)
1196                 {
1197                         return retval;
1198                 }
1199
1200                 for (i = 0; i < 8; i++)
1201                         i_tlb[i + victim].cam = regs[i + 2];
1202         }
1203
1204         for (victim = 0; victim < 64; victim++)
1205         {
1206                 /* new lockdown value: base[31:26]:victim[25:20]:SBZ[19:1]:p[0]
1207                  * base remains unchanged, victim goes through entries 0 to 63 */
1208                 regs[1] = (Dlockdown & 0xfc000000) | (victim << 20);
1209                 arm9tdmi_write_core_regs(target, 0x2, regs);
1210
1211                 /* set interpret mode */
1212                 cp15c15 |= 0x1;
1213                 arm920t_write_cp15_physical(target, ARM920T_CP15_PHYS_ADDR(0, 0xf, 0), cp15c15);
1214
1215                 /* Write I TLB lockdown */
1216                 arm920t_execute_cp15(target, ARMV4_5_MCR(15,0,0,10,0,1), ARMV4_5_STR(1, 0));
1217
1218                 /* Read I TLB RAM1 */
1219                 arm920t_execute_cp15(target, ARMV4_5_MCR(15,4,0,15,9,4), ARMV4_5_LDR(2,0));
1220
1221                 /* Read I TLB RAM2 */
1222                 arm920t_execute_cp15(target, ARMV4_5_MCR(15,4,0,15,1,5), ARMV4_5_LDR(3,0));
1223
1224                 /* clear interpret mode */
1225                 cp15c15 &= ~0x1;
1226                 arm920t_write_cp15_physical(target, 0x1e, cp15c15);
1227
1228                 /* read I TLB RAM content stored to r2 and r3 */
1229                 arm9tdmi_read_core_regs(target, 0xc, regs_p);
1230                 if ((retval = jtag_execute_queue()) != ERROR_OK)
1231                 {
1232                         return retval;
1233                 }
1234
1235                 i_tlb[victim].ram1 = regs[2];
1236                 i_tlb[victim].ram2 = regs[3];
1237         }
1238
1239         /* restore I TLB lockdown */
1240         regs[1] = Ilockdown;
1241         arm9tdmi_write_core_regs(target, 0x2, regs);
1242
1243         /* Write I TLB lockdown */
1244         arm920t_execute_cp15(target, ARMV4_5_MCR(15,0,0,10,0,1), ARMV4_5_STR(1, 0));
1245
1246         /* restore CP15 MMU and Cache settings */
1247         arm920t_write_cp15_physical(target, ARM920T_CP15_PHYS_ADDR(0, 0x1, 0), cp15_ctrl_saved);
1248
1249         /* output data to file */
1250         fprintf(output, "D TLB content:\n");
1251         for (i = 0; i < 64; i++)
1252         {
1253                 fprintf(output, "%i: 0x%8.8" PRIx32 " 0x%8.8" PRIx32 " 0x%8.8" PRIx32 " %s\n", i, d_tlb[i].cam, d_tlb[i].ram1, d_tlb[i].ram2, (d_tlb[i].cam & 0x20) ? "(valid)" : "(invalid)");
1254         }
1255
1256         fprintf(output, "\n\nI TLB content:\n");
1257         for (i = 0; i < 64; i++)
1258         {
1259                 fprintf(output, "%i: 0x%8.8" PRIx32 " 0x%8.8" PRIx32 " 0x%8.8" PRIx32 " %s\n", i, i_tlb[i].cam, i_tlb[i].ram1, i_tlb[i].ram2, (i_tlb[i].cam & 0x20) ? "(valid)" : "(invalid)");
1260         }
1261
1262         command_print(cmd_ctx, "mmu content successfully output to %s", args[0]);
1263
1264         fclose(output);
1265
1266         if (armv4_5_mode_to_number(armv4_5->core_mode)==-1)
1267                 return ERROR_FAIL;
1268
1269         /* mark registers dirty */
1270         ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 0).dirty = ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 0).valid;
1271         ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 1).dirty = ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 1).valid;
1272         ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 2).dirty = ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 2).valid;
1273         ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 3).dirty = ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 3).valid;
1274         ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 4).dirty = ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 4).valid;
1275         ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 5).dirty = ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 5).valid;
1276         ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 6).dirty = ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 6).valid;
1277         ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 7).dirty = ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 7).valid;
1278         ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 8).dirty = ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 8).valid;
1279         ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 9).dirty = ARMV4_5_CORE_REG_MODE(armv4_5->core_cache, armv4_5->core_mode, 9).valid;
1280
1281         return ERROR_OK;
1282 }
1283 int arm920t_handle_cp15_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc)
1284 {
1285         int retval;
1286         target_t *target = get_current_target(cmd_ctx);
1287         armv4_5_common_t *armv4_5;
1288         arm7_9_common_t *arm7_9;
1289         arm9tdmi_common_t *arm9tdmi;
1290         arm920t_common_t *arm920t;
1291         arm_jtag_t *jtag_info;
1292
1293         if (arm920t_get_arch_pointers(target, &armv4_5, &arm7_9, &arm9tdmi, &arm920t) != ERROR_OK)
1294         {
1295                 command_print(cmd_ctx, "current target isn't an ARM920t target");
1296                 return ERROR_OK;
1297         }
1298
1299         jtag_info = &arm7_9->jtag_info;
1300
1301         if (target->state != TARGET_HALTED)
1302         {
1303                 command_print(cmd_ctx, "target must be stopped for \"%s\" command", cmd);
1304                 return ERROR_OK;
1305         }
1306
1307         /* one or more argument, access a single register (write if second argument is given */
1308         if (argc >= 1)
1309         {
1310                 int address = strtoul(args[0], NULL, 0);
1311
1312                 if (argc == 1)
1313                 {
1314                         uint32_t value;
1315                         if ((retval = arm920t_read_cp15_physical(target, address, &value)) != ERROR_OK)
1316                         {
1317                                 command_print(cmd_ctx, "couldn't access reg %i", address);
1318                                 return ERROR_OK;
1319                         }
1320                         if ((retval = jtag_execute_queue()) != ERROR_OK)
1321                         {
1322                                 return retval;
1323                         }
1324
1325                         command_print(cmd_ctx, "%i: %8.8" PRIx32 "", address, value);
1326                 }
1327                 else if (argc == 2)
1328                 {
1329                         uint32_t value = strtoul(args[1], NULL, 0);
1330                         if ((retval = arm920t_write_cp15_physical(target, address, value)) != ERROR_OK)
1331                         {
1332                                 command_print(cmd_ctx, "couldn't access reg %i", address);
1333                                 return ERROR_OK;
1334                         }
1335                         command_print(cmd_ctx, "%i: %8.8" PRIx32 "", address, value);
1336                 }
1337         }
1338
1339         return ERROR_OK;
1340 }
1341
1342 int arm920t_handle_cp15i_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc)
1343 {
1344         int retval;
1345         target_t *target = get_current_target(cmd_ctx);
1346         armv4_5_common_t *armv4_5;
1347         arm7_9_common_t *arm7_9;
1348         arm9tdmi_common_t *arm9tdmi;
1349         arm920t_common_t *arm920t;
1350         arm_jtag_t *jtag_info;
1351
1352         if (arm920t_get_arch_pointers(target, &armv4_5, &arm7_9, &arm9tdmi, &arm920t) != ERROR_OK)
1353         {
1354                 command_print(cmd_ctx, "current target isn't an ARM920t target");
1355                 return ERROR_OK;
1356         }
1357
1358         jtag_info = &arm7_9->jtag_info;
1359
1360         if (target->state != TARGET_HALTED)
1361         {
1362                 command_print(cmd_ctx, "target must be stopped for \"%s\" command", cmd);
1363                 return ERROR_OK;
1364         }
1365
1366         /* one or more argument, access a single register (write if second argument is given */
1367         if (argc >= 1)
1368         {
1369                 uint32_t opcode = strtoul(args[0], NULL, 0);
1370
1371                 if (argc == 1)
1372                 {
1373                         uint32_t value;
1374                         if ((retval = arm920t_read_cp15_interpreted(target, opcode, 0x0, &value)) != ERROR_OK)
1375                         {
1376                                 command_print(cmd_ctx, "couldn't execute %8.8" PRIx32 "", opcode);
1377                                 return ERROR_OK;
1378                         }
1379
1380                         command_print(cmd_ctx, "%8.8" PRIx32 ": %8.8" PRIx32 "", opcode, value);
1381                 }
1382                 else if (argc == 2)
1383                 {
1384                         uint32_t value = strtoul(args[1], NULL, 0);
1385                         if ((retval = arm920t_write_cp15_interpreted(target, opcode, value, 0)) != ERROR_OK)
1386                         {
1387                                 command_print(cmd_ctx, "couldn't execute %8.8" PRIx32 "", opcode);
1388                                 return ERROR_OK;
1389                         }
1390                         command_print(cmd_ctx, "%8.8" PRIx32 ": %8.8" PRIx32 "", opcode, value);
1391                 }
1392                 else if (argc == 3)
1393                 {
1394                         uint32_t value = strtoul(args[1], NULL, 0);
1395                         uint32_t address = strtoul(args[2], NULL, 0);
1396                         if ((retval = arm920t_write_cp15_interpreted(target, opcode, value, address)) != ERROR_OK)
1397                         {
1398                                 command_print(cmd_ctx, "couldn't execute %8.8" PRIx32 "", opcode);
1399                                 return ERROR_OK;
1400                         }
1401                         command_print(cmd_ctx, "%8.8" PRIx32 ": %8.8" PRIx32 " %8.8" PRIx32 "", opcode, value, address);
1402                 }
1403         }
1404         else
1405         {
1406                 command_print(cmd_ctx, "usage: arm920t cp15i <opcode> [value] [address]");
1407         }
1408
1409         return ERROR_OK;
1410 }
1411
1412 int arm920t_handle_cache_info_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc)
1413 {
1414         target_t *target = get_current_target(cmd_ctx);
1415         armv4_5_common_t *armv4_5;
1416         arm7_9_common_t *arm7_9;
1417         arm9tdmi_common_t *arm9tdmi;
1418         arm920t_common_t *arm920t;
1419
1420         if (arm920t_get_arch_pointers(target, &armv4_5, &arm7_9, &arm9tdmi, &arm920t) != ERROR_OK)
1421         {
1422                 command_print(cmd_ctx, "current target isn't an ARM920t target");
1423                 return ERROR_OK;
1424         }
1425
1426         return armv4_5_handle_cache_info_command(cmd_ctx, &arm920t->armv4_5_mmu.armv4_5_cache);
1427 }
1428
1429 int arm920t_handle_md_phys_command(command_context_t *cmd_ctx, char *cmd, char **args, int argc)
1430 {
1431         target_t *target = get_current_target(cmd_ctx);
1432         armv4_5_common_t *armv4_5;
1433         arm7_9_common_t *arm7_9;
1434         arm9tdmi_common_t *arm9tdmi;
1435         arm920t_common_t *arm920t;
1436         arm_jtag_t *jtag_info;
1437
1438         if (arm920t_get_arch_pointers(target, &armv4_5, &arm7_9, &arm9tdmi, &arm920t) != ERROR_OK)
1439         {
1440                 command_print(cmd_ctx, "current target isn't an ARM920t target");
1441                 return ERROR_OK;
1442         }
1443
1444         jtag_info = &arm7_9->jtag_info;
1445
1446         if (target->state != TARGET_HALTED)
1447         {
1448                 command_print(cmd_ctx, "target must be stopped for \"%s\" command", cmd);
1449                 return ERROR_OK;
1450         }
1451
1452         return armv4_5_mmu_handle_md_phys_command(cmd_ctx, cmd, args, argc, target, &arm920t->armv4_5_mmu);
1453 }
1454
1455 int arm920t_handle_mw_phys_command(command_context_t *cmd_ctx, char *cmd, char **args, int argc)
1456 {
1457         target_t *target = get_current_target(cmd_ctx);
1458         armv4_5_common_t *armv4_5;
1459         arm7_9_common_t *arm7_9;
1460         arm9tdmi_common_t *arm9tdmi;
1461         arm920t_common_t *arm920t;
1462         arm_jtag_t *jtag_info;
1463
1464         if (arm920t_get_arch_pointers(target, &armv4_5, &arm7_9, &arm9tdmi, &arm920t) != ERROR_OK)
1465         {
1466                 command_print(cmd_ctx, "current target isn't an ARM920t target");
1467                 return ERROR_OK;
1468         }
1469
1470         jtag_info = &arm7_9->jtag_info;
1471
1472         if (target->state != TARGET_HALTED)
1473         {
1474                 command_print(cmd_ctx, "target must be stopped for \"%s\" command", cmd);
1475                 return ERROR_OK;
1476         }
1477
1478         return armv4_5_mmu_handle_mw_phys_command(cmd_ctx, cmd, args, argc, target, &arm920t->armv4_5_mmu);
1479 }