The Hex parser uses a fixed number of sections.  When the
number of sections in the file is greater than that, the
stack get corrupted and a CHECKSUM ERROR is detected
which is very confusing.

This checks the number of sections read, and increases
IMAGE_MAX_SECTIONS so it works on my file.

Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>

Only type 1 branch instruction has a condition code, not type 2.
Currently they're both tagged with ARM_B which doesn't allow for the
distinction.

Signed-off-by: Nicolas Pitre <nico@marvell.com>
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>

A Thumb BLX instruction is branching to ARM code, and therefore the
first 2 bits of the target address must be cleared.

Signed-off-by: Nicolas Pitre <nico@marvell.com>
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>

This patch includes partial support for these new JTAG adapters.
More complete support will require updates to the libftdi code,
for EEPROM access.

[dbrownell@users.sourceforge.net: fix whitespace, linelen, etc ]

Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>

Currently, OpenOCD is always caching the PC value without the T bit.
This means that assignment to the PC register must clear that bit and set
the processor state to Thumb when it is set.  And when the PC register
value is transferred to another register or stored into memory then
the T bit must be restored.

Discussion: It is arguable if OpenOCd should have preserved the original
PC value which would have greatly simplified this code.  The processor
state could then be obtained simply by getting at bit 0 of the PC.  This
however would require special handling elsewhere instead since the T bit
is not always relevant (like when PC is used with ALU insns or as an index
with some addressing modes).  It is unclear which way would be simpler in
the end.

Signed-off-by: Nicolas Pitre <nico@marvell.com>
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>

Whenever an unconditional branch with the H bits set to 0b10 is met, the
offset must be combined with the offset from the following opcode and not
ignored like it is now.

A comment in evaluate_b_bl_blx_thumb() suggests that the Thumb2 decoder
would be a simpler solution.  That might be true when single-stepping of
Thumb2 code is implemented.  But for now this appears to be the simplest
solution to fix Thumb1 support.

Signed-off-by: Nicolas Pitre <nico@marvell.com>
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>

Calling it first with every opcodes and then testing if the opcode
was indeed a branch instruction is wasteful and rather strange.
If ever thumb_pass_branch_condition() has side effects (say, like
printing a debugging traces) then the result would be garbage for most
Thumb instructions which have no condition code.

While at it, let's make the nearby code more readable by reducing some of
the redundant brace noise and reworking the error handling construct.

Signed-off-by: Nicolas Pitre <nico@marvell.com>
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>

Don't log "Yes, I'm *still* in TAP_IDLE" every seven runtest clocks.

Get rid of needless variable, improve and shrink diagnostic.

Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>

Make the "dap info" output more comprehensible:

 - Don't show CIDs unless they're incorrect (only four bits matter)
 - For CoreSight parts, interpret the part type
 - Interpret the part number
 - Show all five PID bytes together
 - Other minor cleanups

Also some whitespace fixes, and shrink a few overlong source lines.

Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>

Ignore leading '0' characters on hex strings.  For example a bit
pattern consisting of 6 bits could be written as 3f, 03f or 003f and
so on.

Signed-off-by: Michael Roth <mroth@nessie.de>
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>

This patch adds basic autoprobing support for the JTAG scan chains
which cooperate.  To use, you can invoke OpenOCD with just:

 - interface spec: "-f interface/...cfg"
 - possibly with "-c 'reset_config ...'" for SRST/TRST
 - possibly with "-c 'jtag_khz ...'" for the JTAG clock

Then set up config files matching the reported TAPs.  It doesn't
declare targets ... just TAPs.  So facilities above the JTAG and
SVF/XSVF levels won't be available without a real config; this is
almost purely a way to generate diagnostics.

Autoprobe was successful with most boards I tested, except ones
incorporating C55x DSPs (which don't cooperate with this scheme
for IR length autodetection).  Here's what one multi-TAP chip
reported, with the "Warn:" prefixes removed:

 clock speed 500 kHz
 There are no enabled taps.  AUTO PROBING MIGHT NOT WORK!!
 AUTO auto0.tap - use "jtag newtap auto0 tap -expected-id 0x2b900f0f ..."
 AUTO auto1.tap - use "jtag newtap auto1 tap -expected-id 0x07926001 ..."
 AUTO auto2.tap - use "jtag newtap auto2 tap -expected-id 0x0b73b02f ..."
 AUTO auto0.tap - use "... -irlen 4"
 AUTO auto1.tap - use "... -irlen 4"
 AUTO auto2.tap - use "... -irlen 6"
 no gdb ports allocated as no target has been specified

The patch tweaks IR setup a bit, so we can represent TAPs with
undeclared IR length.

Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>

And update doc accordingly.  That EmbeddedICE register was
introduced for ARM9TDMI and then carried forward into most
new chips that use EmbeddedICE.

Stop allocating three bytes per IR bit, and cope somewhat better
with IR lengths over 32 bits.

Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>

Remove needless debug handler state.

 - "handler_installed" became wrong as soon as the second TRST+SRST
   reset was issued ... so the handler was never reloaded after the
   reset removed it from the mini-icache.

   This fixes the bug where subsequent resets fail on PXA255 (if the
   first one even worked, which is uncommon).  Other XScale chips
   would have problems too; PXA270 seems to have, IXP425 maybe not.

 - "handler_running" was never tested; it's pointless.

Plus a related bugfix: invalidate OpenOCD's ARM register cache on reset.
It was no more valid than the XScale's mini-icache.  (Though ... such
invalidations might be better done in "SRST asserted" callbacks.)

Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>

Bit 5 shouldn't be used.  Remove all support for modifying it.
Matches the exception vector table, of course ... more than one
bootloader uses that non-vector to help distinguish valid boot
images from random garbage in flash.

Some cosmetic cleanup, and switch to a single table mapping
between state names and symbols (vs two routines which only
share that state with difficulty).

Get rid of TAP_NUM_STATES, and some related knowledge about
how TAP numbers are assigned.  Later on, this will help us
get rid of more such hardwired knowlege.

Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>

 - Use the name mappings all the other code uses:
    + name-to-state ... needed to add one special case
    + state-to-name
 - Improve various diagnostics:
    + don't complain about a "valid" state when the issue
      is actually that it must be "stable"
    + say which command was affected
 - Misc:
    + make more private data and code be static
    + use public DIM() not private dimof()
    + shorten the affected lines

Re the mappings, this means we're more generous in inputs we
accept, since case won't matter.  Also our output diagnostics
will be a smidgeon more informative, saying "RUN/IDLE" not
just "IDLE" (emphasizing that there can be side effects).

Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>

The wrong variable (pc instead of r0) was used.  Furthermore, someone
did cover this error by stupidly silencing the compiler warning that
occurred before a dummy void reference to r0 was added to the code.

Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>

When dumping over 100 registers (as on most ARM9 + ETM cores),
aid readability by splitting them into logical groups.

Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>

The register names are perversely not documented as zero-indexed,
so rename them to match that convention.  Also switch to lowercase
suffixes and infix numbering, matching ETB and EmbeddedICE usage.

Update docs to be a bit more accurate, especially regarding what
the "trigger" event can cause; and to split the issues into a few
more paragraphs, for clarity.

Make "configure" helptext point out that "oocd_trace" is prototype
hardware, not anything "real".

Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>

retire obsolete mXY_phys commands. Handled by generic memory read/modify commands and target read/write physical memory callbacks.

Added target_read/write_phys_memory() fn's. mdX/mwX commands updated to support phys flag to specify bypassing of MMU.

Retire obsolete and superfluous implementations of virt2phys in each target. This is done in a polymorphic implementation in target.c

Retire obsolete and superfluous implementations of virt2phys in each target. This is done in a polymorphic implementation in target.c

Defined target_write_memory() to be able to handle implementing breakpoints for read only ram(e.g. MMU write protected.

XSVF improvements:

 - Layer parts of XSVF directly over SVF, calling svf_add_statemove()
   instead of expecting jtag_add_statemove() to conform to the SVF/XSVF
   requirements (which it doesn't).

   This should improve XSTATE handling a lot; it removes most users of
   jtag_add_statemove(), and the comments about how it should really do
   what svf_add_statemove() does.

 - Update XSTATE logic to be a closer match to the XSVF spec.  The main
   open issue here is (still) that this implementation doesn't know how
   to build and submit paths from single-state transitions ... but now
   it will report that error case.

 - Update the User's Guide to mention the two utility scripts for
   working with XSVF, and to mention the five extension opcodes.

Handling of state transition paths is, overall, still a mess.  I think
they should all be specified as paths not unlike SVF uses, and compiled
to the bitstrings later ... so that we can actually make sense of the
paths.  (And see the extra clocks, detours through RUN, etc.)

Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>

Removed unused interface_jtag_set_end_state and wrote down some notes on TCP/IP client/server scheme.