swd: Remove support for turnaround periods other than 1
ARM deprecated other trn periods in ADIv5.1 and one cycle is the only
setting that is guaranteed to be implemented, as well as being the reset
value in ADIv5.0.
Thus it makes no sense supporting anything else.
Change-Id: Iffa16bb0ce74788bca88fd3ace8a026148013d00 Signed-off-by: Andreas Fritiofson <andreas.fritiofson@gmail.com>
Reviewed-on: http://openocd.zylin.com/2132 Tested-by: jenkins Reviewed-by: Paul Fertser <fercerpav@gmail.com>
cortex_m: Do additional initialization during reset
SAM4L requires additional steps to be taken right after SYSRESETREQ is
issued in order to function robustly:
- CMSIS-DAP DAP driver needs to explicitly check for sticky bit
errors since it is possible for adapter to perform successful
write opration, report no errors and then, under the hood, do
some other things that will result in sticky bit being set.
- Debugger needs to wait for security system to finish
intialization and assert CDBGPWRUPACK before proceeding
This change is related to commit http://openocd.zylin.com/#/c/1995/
adi_v5_swd: Separate sticky error clearing from AP abort
Swd_queue_ap_abort should set DAPABORT, not only clear sticky errors.
However, DAPABORT should not be set as soon as there is a single
FAULT/WAIT response. It's an "emergency only" operations for use only when
the AP have stalled the transfer for a long time. So these need to be
separate functions.
Change-Id: I37618447884faad54d846c2b07fa668ad505919d Signed-off-by: Andreas Fritiofson <andreas.fritiofson@gmail.com>
Reviewed-on: http://openocd.zylin.com/1956 Tested-by: jenkins Reviewed-by: Paul Fertser <fercerpav@gmail.com>
adi_v5: Remove strange IDCODE check from dap info handler
Otherwise it breaks SWD targets. The check seems really weird anyway since
it loops through *all* TAPs after the ADIv5 target but doesn't do anything
at all with the result, other than not setting the return values despite
returning ERROR_OK.
Remove a bogus initialization that was needed because of the odd
behaviour of this routine when an IDCODE wasn't found.
Change-Id: Ic086352f6af868b3406b00420291a0a671e3acac Signed-off-by: Andreas Fritiofson <andreas.fritiofson@gmail.com>
Reviewed-on: http://openocd.zylin.com/1953 Tested-by: jenkins Reviewed-by: Paul Fertser <fercerpav@gmail.com>
Paul Fertser [Thu, 12 Jun 2014 14:56:32 +0000 (18:56 +0400)]
jtag/drivers/jlink: better diagnostics for RCLK problems
The JLink protocol description doesn't really specify it for
JTAG-level commands but the real life evidence is that 0x01 error code
means "Adaptive clocking timeout" as it does for e.g. WRITE_MEM_ARM79.
Change-Id: I4e3b568742814271919f92d202713968c8fcccfb Signed-off-by: Paul Fertser <fercerpav@gmail.com>
Reviewed-on: http://openocd.zylin.com/2169 Tested-by: jenkins Reviewed-by: Spencer Oliver <spen@spen-soft.co.uk>
Andrey Yurovsky [Thu, 12 Jun 2014 16:57:29 +0000 (09:57 -0700)]
flash: samd: add SAMD10 and SAMD11 part IDs
Add part IDs for the new SAMD10 and SAMD11 parts within the Atmel SAMD
family, they have the same Flash controller as the other samd parts and
should be supported by the at91samd driver. Compile-tested only.
Joshua Wise [Fri, 16 May 2014 08:08:43 +0000 (01:08 -0700)]
svf: Only read TDO back from the device if we actually need to look at the bits.
This results in a 90% speedup on USB-Blaster, which serializes repeated
TDI input against TDO readback; program time on an 5CGXFC5C6F27 part was
dropped from 2m30s to 9s.
Signed-off-by: Joshua Wise <joshua@joshuawise.com>
Change-Id: I92d5a8b800492283d619328549235b610528c338
Reviewed-on: http://openocd.zylin.com/2145 Reviewed-by: Paul Fertser <fercerpav@gmail.com> Tested-by: jenkins Reviewed-by: Spencer Oliver <spen@spen-soft.co.uk>
Seth LaForge [Tue, 6 May 2014 23:02:23 +0000 (16:02 -0700)]
cortex_a: fix lockup when writing to high address
On a processor with caches, when you write data to memory OpenOCD invalidates
the cache lines affected. If you write to an address within 64 bytes of
UINT32_MAX, then the for loop control variable wrapped around resulting in an
infinite loop. Change control variable to be an offset from the address
involved. We should never be asked to write 2^32 bytes, so wraparound should
not be a problem.
Franck Jullien [Mon, 25 Nov 2013 22:18:19 +0000 (23:18 +0100)]
target: or1k: remove wrong endian swap from or1k generic code
We don't need to swap the endianness in the target generic code.
This swap is necessary because of the adv_debug_if debug unit.
This patch moves this specific piece of code from or1k.c to
or1k_du_adv.c.
Cosmin Gorgovan [Sat, 29 Mar 2014 22:34:43 +0000 (22:34 +0000)]
Flash/LPC2000: Add support for auto-probing flash size
Adds support for auto-probing on devices which support the IAP
Read Part ID command. Includes IDs for all LPC17XX, LPC13XX,
LPC11XX and LPC11XXX devices with publicly available user
manuals.
To use auto-probing, select the 'auto' lpc2000 variant.
STM32F2x: Don't clear FLASH_OPTCR bits when locking register
stm32x_write_options is locking the FLASH_OPTCR register by
writing 0x00000001 to it, which clears the other bits. This
causes problems with subsequent flash operations; the hardware
is probably seeing the write protection bits in the register
set to '0' (protect), causing a WRPERR.
This patch ORs the value of the register with 0x00000001, so that
the only change is the lock bit itself.
Alex Ray [Sun, 6 Apr 2014 14:34:27 +0000 (07:34 -0700)]
Disable multiprocessor-id read on ARMv7-R cores
ARMv7-R cores are largely uniprocessor-configured, and when they are
multiprocessor-configured the format of the MPIDR register isn't
compatible with ARMv7-A cores.
Change-Id: I024ec514496fbab5075c6fb34b6acd870e68e1fc Signed-off-by: Alex Ray <a@machinaut.com>
Reviewed-on: http://openocd.zylin.com/2096 Tested-by: jenkins Reviewed-by: Andreas Fritiofson <andreas.fritiofson@gmail.com>
Paul Fertser [Thu, 15 May 2014 18:17:13 +0000 (22:17 +0400)]
src/target: select the last created target as current
Configuration commands assume the last created target is the one they
should be applied to. An example of this is sourcing an stm32f1.cfg
several times to access several microcontrollers on the same JTAG chain
where cortex_m reset_config should apply to the target that was just
created, not to the first one.
This fixes http://sourceforge.net/p/openocd/tickets/71/ .
Change-Id: I1ca41cc05fe5f36c4bc62dde4614da1405754fd8 Reported-by: Michael Eischer <mieischer@users.sf.net> Signed-off-by: Paul Fertser <fercerpav@gmail.com>
Reviewed-on: http://openocd.zylin.com/2142 Tested-by: jenkins Reviewed-by: Freddie Chopin <freddie.chopin@gmail.com> Reviewed-by: Spencer Oliver <spen@spen-soft.co.uk>
Paul Fertser [Fri, 23 May 2014 11:53:59 +0000 (15:53 +0400)]
jtag/drivers/stlink: allow to reconnect seamlessly after polling failure
If the communication with the target was failing (either because of an
intermittent connection or the target was rebooted), this is needed to
reestablish operational state.
Reported-by: Tim Sander <tim@krieglstein.org> Tested-by: Tim Sander <tim@krieglstein.org>
Change-Id: I91ea2e2b2b5ef8eb27dfe9bae95ef2a919f67e4e Signed-off-by: Paul Fertser <fercerpav@gmail.com>
Reviewed-on: http://openocd.zylin.com/2152 Tested-by: jenkins Reviewed-by: Tim Sander <tim@krieglstein.org> Reviewed-by: Spencer Oliver <spen@spen-soft.co.uk>
Paul Fertser [Fri, 23 May 2014 11:17:31 +0000 (15:17 +0400)]
target: reexamine after polling succeeds again
If polling was failing, it likely meant that either the target was
disconnected or rebooted. In the latter case it needs to be reexamined
to be properly configured for the debug session, so do it just in
case.
Reported-by: Tim Sander <tim@krieglstein.org> Tested-by: Tim Sander <tim@krieglstein.org>
Change-Id: I5b067c18d9276d4e86cc59739f196ae7d0931622 Signed-off-by: Paul Fertser <fercerpav@gmail.com>
Reviewed-on: http://openocd.zylin.com/2151 Tested-by: jenkins Reviewed-by: Tim Sander <tim@krieglstein.org> Reviewed-by: Spencer Oliver <spen@spen-soft.co.uk>
Move logging for cmsis_dap_queue_ap_read/write to happen after a call
to cmsis_dap_ap_q_bankselect so that that SWD operation would appear
in the log in the same sequence they happen on the bus.
arm_adi_v5: Do not ignore register polling timeout
Previous to this commit 'ahbap_debugport_init' would ignore if timeout
happened or not when waiting for CDBGPWRUPACK and CSYSPWRUPACK and would
continue initialization regardless. It also would not reset the
timeout counter after finishing polling for CDBGPWRUPACK and starting
for CSYSPWRUPACK which could potentially cause some problems.
Also refactor code of both snippets into a more generic function to
avoid duplication.
Ivan De Cesaris [Wed, 21 May 2014 13:20:08 +0000 (15:20 +0200)]
quark_x10xx: cleanup of LOG format specifiers
Fix for LOG format specifiers, this is a superset of those
exposed by the arm-none-eabi build.
Add 0x prefix for all values printed in hex.
Add LOG messages for error cases when enabling or disabling
paging.
Change-Id: I070c556e0ad31204231a2b572e7b93af22a9bc61 Signed-off-by: Ivan De Cesaris <ivan.de.cesaris@intel.com>
Reviewed-on: http://openocd.zylin.com/2149 Tested-by: jenkins Reviewed-by: Paul Fertser <fercerpav@gmail.com>
Aurelien Jacobs [Wed, 18 Dec 2013 23:17:49 +0000 (00:17 +0100)]
lpcspifi: setup a valid stack pointer before calling ROM code using stack
The spifi_init_code blob is calling the spifi_init() function from the ROM.
This ROM function is making use of the stack. So if the stack pointer is
invalid, trying to execute this code leads to a double fault and the
target_run_algorithm() call return with an error.
This patch simply ensure that the stack pointer is properly setup before
calling the spifi_init() ROM function.
Yegor Yefremov [Mon, 5 May 2014 15:36:27 +0000 (17:36 +0200)]
KS869x: add new target
This patch adds Micrel's KS869x target. The configuration was taken from
http://www.mmnt.net/db/0/0/www.micrel.com/ethernet/8695 - Micrel's
FTP server i.e. their OpenOCD 7.0 package.
The only change compared to the original file is the removal of
reset configuration, as it belongs to the board configuration.
Andrey Smirnov [Sat, 8 Mar 2014 22:42:28 +0000 (14:42 -0800)]
kinetis: Revise CPU un-securing code
Old version of the code had several problems, among them are:
* Located in a generic ADI source file instead of some Kinetis
specific location
* Incorrect MCU detection code that would read generic ARM ID
registers
* Presence of SRST line was mandatory
* There didn't seem to be any place where after SRST line assertion
it would be de-asserted.
* Reset was asserted after waiting for "Flash Controller Ready" bit
to be set, which contradicts official programming guide AN4835
* Mass erase algorithm implemented by that code was very strange:
** After mass erase was initiated instead of just polling for the
state of "Mass Erase Acknowledged" bit the code would repeatedly
initiate mass erase AND poll the state of the "Mass Erase
Acknowledged"
** Instead of just polling for the state of "Flash Mass Erase in
Progress"(bit 0 in Control register) to wait for the end of the
mass erase operation the code would: write 0 to Control
register, read out Status register ignoring the result and then
read Control register again and see if it is zero.
* dap_syssec_kinetis_mdmap assumed that previously selected(before
it was called) AP was 0.
This commit moves all of the code to kinetis flash driver and
introduces three new commands:
o "kinetis mdm check_security" -- the intent of that function is to be used as
'examine-end' hook for any Kinetis target that has that kind of
JTAG/SWD security mechanism.
o "kinetis mdm mass_erase"" -- This function removes secure status from
MCU be performing special version of flash mass erase.
o "kinetis mdm test_securing" -- Function that allows to test securing
fucntionality. All it does is erase the page with flash security settings thus
making MCU 'secured'.
New version of the code implements the algorithms specified in AN4835
"Production Flash Programming Best Practices for Kinetis K-
and L-series MCUs", specifically sections 4.1.1 and 4.2.1.
It also adds KL26 MCU to the list of devices for which this security
check is performed. Implementing that algorithm also allowed to simplify
mass command in kinetis driver, since we no longer need to write security
bytes. The result that the old version of mass erase code can now be
acheived using 'kinetis mdm mass_erase'
Tested on accidentally locked FRDM-KL26Z with KL26 Kinetis MCU.
Change-Id: Ic085195edfd963dda9d3d4d8acd1e40cc366b16b Signed-off-by: Andrey Smrinov <andrew.smirnov@gmail.com>
Reviewed-on: http://openocd.zylin.com/2034 Tested-by: jenkins Reviewed-by: Paul Fertser <fercerpav@gmail.com> Reviewed-by: Andreas Fritiofson <andreas.fritiofson@gmail.com>
Salvador Arroyo [Tue, 3 Dec 2013 22:25:20 +0000 (23:25 +0100)]
mips32: new code for pracc exec
This is only the basic code proposed for mips32_pracc_exec() function.
It checks every pracc address against the expected address when
reading (instruction fetch).
The code expects to start at PRACC_TEXT and any subsequent read address
is obtained by adding 4 to the previous one.
After shifting out all the instructions the code executes a final check.
It checks now for the first pass trough PRACC_TEXT and shift out
only NOP instructions.
A mips core does not need an additional NOP and after the first check
it exits if there is no store access pending.
After shifting out one NOP the core must be reading at pracc text or the
code exits with error.
The code continues shifting out NOPs until all store accesses have
been performed.
After shifting out 10 NOPs it exits with error.
No assumption is made about the number of store instruction shifted out or
the ordering of the store accesses. It only checks that the number of
store accesses is the same as the number of store instructions at dmseg
after execution.
mips32_pracc_read_ctrl_addr() and mips32_pracc_finish() are added to
simpify a bit the code. Fields pa_ctrl and pa_addr are added
in ejtag_info for storing values of pracc control and address.
Salvador Arroyo [Sun, 1 Dec 2013 09:40:34 +0000 (10:40 +0100)]
mips32: cleanups in legacy pracc code
This is the first patch intended to make a more precise pracc check
when running in legacy mode (code executed by mips32_pracc_exec()).
It only makes some cleanups, mostly due to unnecessary code.
With the last cache optimizations for processor access (pa for short)
all the pracc functions generate the code following some rules that
make pa more easily to check:
There are no load instructions from dmseg. All the read pas are
instruction fetches. PARAM_IN related stuff is not needed.
Registers are restored either from COP0 DeSave or from ejtag
info fields. PRACC_STACK related stuff is not needed any more.
The code starts execution at PRACC_TEXT and there are no branch or jump
instruction in the code, apart from the last jump to PRACC_TEXT.
The fetch address is ever known.
For every store instruction to dmseg the function code sets
the address of the write/store pa.
The address of every store pa is known.
Current code ends execution when reading a second pass through PRACC_TEXT.
This approach has same inconveniences:
If the code starts in the delay slot of a jump it makes a jump
to PRACC_TEXT after executing the first instruction. A second pass
through PRACC_TEXt is read and the function exits without any warning.
This seems to occur sometimes when a 24kc core is halted in the delay
slot of a branch.
If a debug mode exception is triggered during the execution of a
function the core restarts execution at PRACC_TEXT. Again the function
exits without any warning.
If for whatever reason the core starts fetching at an unexpected
address the code now sends a jump instruction to PRACC_TEXT, but due
to the delay slot the core continues fetching at whatever address + 4
and a second jump instruction will be send for execution. The result
of a jump instruction in the delay slot of another jump is
UNPREDICTABLE. It may work as expected (ar7241), or let the core in
the delay slot of a jump to PRACC_TEXT for example. This means the
function called next may also fail (pic32mx).
Salvador Arroyo [Sun, 25 Aug 2013 10:21:18 +0000 (12:21 +0200)]
mips: use cp0 DeSave to cache $15 / t7
Near all pracc functions store $15 in DeSave and
restore it when exiting.
There is no need to save it, if mips32_pracc_read_regs()
save this register in Desave when entering debug mode.
mips32_pracc_write_regs() needs to update it when
exiting debug mode.
Other pracc functions must not modify DeSave.
The jump code in the fastdata transfer function needs also
some little modifications.
Remark:
Like in current code the user can read/modify $15
with the cp0 31 commands.
Change-Id: I5b7dfc1b6169da846f5d2dd3ad4209a9da2c3fad Signed-off-by: Salvador Arroyo <sarroyofdez@yahoo.es>
Reviewed-on: http://openocd.zylin.com/1565 Tested-by: jenkins Reviewed-by: Andreas Fritiofson <andreas.fritiofson@gmail.com> Reviewed-by: Freddie Chopin <freddie.chopin@gmail.com>
Salvador Arroyo [Sat, 24 Aug 2013 12:18:09 +0000 (14:18 +0200)]
mips: load fast data transfer handler code with mips32_pracc_write_mem()
Currently the code is loaded calling mips32_pracc_write_mem_generic().
Cache synchronization is not performed.
If configured as write back cache there is no chance to execute the
handler. If configured as write through cache and the cache
lines written to are not cache resident (I-side cache miss) may work.
The patch makes possible to execute the handler in a cached active
memory segment (mainly from KSEG0), but nothing else. The data
is still loaded without performing cache synchronization, code loaded
may not be executable.
Performance may not be faster. At start, for example, the code resides in
main memory, not in cache, and the core must transfer code from
memory. We can really modify the code to force a wait for the first
transfer like we do with start and end addresses, making sure the code
is cache resident for the rest of the queued transfers.
This can also may happen if we execute code (greater than the I cache size)
and the handler code is evicted from the cache.
Code tested on ar7241.
Change-Id: Iffdb4dae108b872fef0e7bacc5ea99649cdc1630 Signed-off-by: Salvador Arroyo <sarroyofdez@yahoo.es>
Reviewed-on: http://openocd.zylin.com/1564 Tested-by: jenkins Reviewed-by: Andreas Fritiofson <andreas.fritiofson@gmail.com> Reviewed-by: Freddie Chopin <freddie.chopin@gmail.com>
Salvador Arroyo [Fri, 23 Aug 2013 16:50:43 +0000 (18:50 +0200)]
mips: load code in buffer mode
Currently the functions mips32_checksum_memory() and mips32_blank_check_memory()
load the code word by word.
The bug in cache code is a good reason for doing so.
If there is no other reason we can load the code as a buffer to save time.
mips_m4k_write_memory() expect a buffer in target endianness, this is done by
target_buffer_set_u32_array().
Cleaned up exit code.
Tested on ar7241 big endian and pic32mx little endian with verify_image.
Flash erase check only tested in pic32mx.
Change-Id: Ib63ed98732b2e23b058e7349a0a57934b7604905 Signed-off-by: Salvador Arroyo <sarroyofdez@yahoo.es>
Reviewed-on: http://openocd.zylin.com/1562 Tested-by: jenkins Reviewed-by: Andreas Fritiofson <andreas.fritiofson@gmail.com>
Paul Fertser [Mon, 28 Apr 2014 10:34:47 +0000 (14:34 +0400)]
Update to the current Jim Tcl
This is a post-release version but hopefully some fixes that went in
are worth it; also the changes here make OpenOCD compatible with stock
0.75 version if a distro maintainer decides to use it.
Kamal Dasu [Tue, 3 Dec 2013 21:15:42 +0000 (16:15 -0500)]
svf: Fix debug and error messages that print hex buffer
Added SVF_BUF_LOG macro to properly print the hex buffer of parsed
string for SIR, SDR, TDI, TDO and MASK. The original debug and error
logs with respect to printing real values were misleading and also
had endianess issues. All the bits are printed now instead of just
u32 values.
Change-Id: Ie89902403bdb61ff458418446c2ca1253ea2a63f Signed-off-by: Kamal Dasu <kdasu.kdev@gmail.com>
Reviewed-on: http://openocd.zylin.com/1964 Reviewed-by: Andreas Fritiofson <andreas.fritiofson@gmail.com> Tested-by: jenkins
Ash Charles [Thu, 17 Apr 2014 00:32:23 +0000 (17:32 -0700)]
Add support for Gumstix AeroCore device
The Gumstix AeroCore board [1] contains a STM32F427 microcontroller.
Schematics for this board will also be made available [2].
The JTAG interface for this chip can be accessed via a USB connection
provided by an FTDI chip (0403:6011).
Ivan De Cesaris [Fri, 18 Apr 2014 09:19:40 +0000 (11:19 +0200)]
quark_x10xx: fix IO r/w operations with paging enabled
Paging checking and disabling wasn't present for IO r/w,
so the commands were successful only when paging wasn't
enabled (e.g. EFI boot phase).
Change-Id: I41366c0fadff3ea1eb8a153291f20a46cd9ddec1 Signed-off-by: Ivan De Cesaris <ivan.de.cesaris@intel.com>
Reviewed-on: http://openocd.zylin.com/2118 Tested-by: jenkins Reviewed-by: Peter Stuge <peter@stuge.se> Reviewed-by: Paul Fertser <fercerpav@gmail.com>
The TI TMS470 and TMS570 series of processors are BE-32 processors,
despite BE-32 not being supported by ARM in the Cortex-R4 core. TI
hacked in BE-32 support, which requires odd swizzling in OpenOCD to
make memory reads and writes function correctly. In particular,
without this change, OpenOCD word reads and writes had the bytes
reversed, and halfword and byte packed reads were reading garbage.
In my testing, this change fixes these problems.
Change-Id: I21dd30f4b9003f20fcc85f674ab833407bb61f74 Signed-off-by: Seth LaForge <sethml@google.com>
Reviewed-on: http://openocd.zylin.com/2064 Tested-by: jenkins Reviewed-by: Paul Fertser <fercerpav@gmail.com> Reviewed-by: Andreas Fritiofson <andreas.fritiofson@gmail.com>
Paul Fertser [Sat, 12 Apr 2014 13:22:00 +0000 (17:22 +0400)]
mips32, dsp563xx: fix segfault on Gdb attach
Since c6216201b249e6a97fcc085e413e3d34e0de6fb7 gdb target description
generation support is enabled by default and it counts on checking
"feature" pointer in reg_list. Both mips32 and dsp563xx neither used
calloc nor explicitly set feature (as it was a newly introduced struct
field).
This patch changes all targets to use calloc for consistency.
Change-Id: I9eceadef8b04aacb108e24ae23cb51ca3009586f Signed-off-by: Paul Fertser <fercerpav@gmail.com>
Reviewed-on: http://openocd.zylin.com/2102 Tested-by: jenkins Reviewed-by: Salvador Arroyo <sarroyofdez@yahoo.es> Reviewed-by: Spencer Oliver <spen@spen-soft.co.uk>
Paul Fertser [Sun, 6 Apr 2014 04:36:37 +0000 (08:36 +0400)]
jtag/drivers/remote_bitbang: use sizeof to determine maximum unix socket path length
Different *nix systems use different constants, so sizeof should be
used instead. This fixes the build on OS X (as sun_path length is
hardcoded to 104 on Darwin).
Tim Sander [Mon, 31 Mar 2014 20:21:44 +0000 (21:21 +0100)]
target: fix incorrect arm cpu monitor mode encoding
According to the "Arm Arch Ref Manual ARMv7-a and ARMv7-R edition" the
CPSR encoding for Monitor mode is 0b10110 (22) not 0b11010 (26) as is
currently used.
Andrey Smirnov [Mon, 10 Feb 2014 16:06:04 +0000 (08:06 -0800)]
at91smad: Fixes to 'samd_protect'
Some fixes to 'samd_protect' including:
- Fix a bug in which the value of 'set' parameter passed into the
function was ignored so it was impossible to remove flash
protection once it was set.
- Check the protection status of the sector via 'is_protected'
field of the corresponding 'flash_sector' structure to see if
any actual HW manipulations needs to be done.
- Change the way the errors during protection activation are
handled. Now even in the case of error in the middle of
protecting a number of sectors the subroutine would still update
the state of the sector protection in sectors array so as to
avoid cases where openocd thinks that the sector is not protected
while it actually is.
projects / openocd / log