From upstream (#331)

* flash/nor: Add support for TI CC26xx/CC13xx flash Added cc26xx flash driver to support the TI CC26xx and CC13xx microcontrollers. Driver is capable of determining which MCU is connected and configures itself accordingly. Added config files for four specific variants: CC26x0, CC13x0, CC26x2, and CC13x2. Note that the flash loader code is based on the sources used to support flash in Code Composer Studio and Uniflash from TI. Removed cc26xx.cfg file made obsolete by this patch. Change-Id: Ie2b0f74f8af7517a9184704b839677d1c9787862 Signed-off-by: Edward Fewell <efewell@ti.com> Reviewed-on: http://openocd.zylin.com/4358 Tested-by: jenkins Reviewed-by: Tomas Vanek <vanekt@fbl.cz> Reviewed-by: Fredrik Hederstierna <fredrik@hederstierna.com> * flash/nor/nrf5: remove is_erased setting and autoerase before write Cached flash erase state in sectors[].is_erased is not reliable as running target can change the flash. Autoerase was issued before flash write on condition is_erased != 1 Remove autoerase completely as it is a quite non-standard feature. Change-Id: I19bef459e6afdc4c5fcaa2ccd194cf05be8a42b6 Signed-off-by: Tomas Vanek <vanekt@fbl.cz> Reviewed-on: http://openocd.zylin.com/4400 Tested-by: jenkins * src/flash/tms470: remove testing of sectors[].is_erased state The erase check routine checked sectors only if is_erased != 1 Check sector unconditionally. While on it fix clang static analyzer warnings. Change-Id: I9988615fd8530c55a9b0c54b1900f89b550345e9 Signed-off-by: Tomas Vanek <vanekt@fbl.cz> Reviewed-on: http://openocd.zylin.com/4401 Tested-by: jenkins * tcl/target/stm32f7x: configure faster system clock in reset-init STM32F7xx devices need faster clock for flash programming over JTAG transport. Using reset default 16 MHz clock resulted in lot of DAP WAITs and substantial decrease of flashing performance. Adapted to the restructured dap support (see 2231da8ec4). Change-Id: Ida6915331dd924c9c0d08822fd94c04ad408cdc5 Signed-off-by: Tomas Vanek <vanekt@fbl.cz> Reviewed-on: http://openocd.zylin.com/4464 Tested-by: jenkins Reviewed-by: Christopher Head <chead@zaber.com> * flash/nor/psoc5lp: fix compile issue on GCC 8.1.0 Issue already identified by Alex https://sourceforge.net/u/alexbour/ in ticket #191 https://sourceforge.net/p/openocd/tickets/191/ src/flash/nor/psoc5lp.c:237:2: error: ‘strncpy’ output truncated before terminating nul copying 2 bytes from a string of the same length [-Werror=stringop-truncation] Fix it by assigning the value to the array elements. Change-Id: I22468e5700efa64ea48ae8cdec930c48b4a7d8fb Signed-off-by: Antonio Borneo <borneo.antonio@gmail.com> Reviewed-on: http://openocd.zylin.com/4563 Tested-by: jenkins Reviewed-by: Tomas Vanek <vanekt@fbl.cz> * target/arm: Add PLD command to ARM disassembler. Updates the ARM disassembler to handle PLD (PreLoad Data) commands. Previously handled by printing a TODO message. There are three forms of the command: literal, register, and immediate. Simply decode based off of the A1 encoding for the instructions in the ARM ARM. Also fixes mask to handle PLDW commands. Change-Id: I63bf97f16af254e838462c7cfac80f6c4681c556 Signed-off-by: James Marshall <jcmarsh@gwmail.gwu.edu> Reviewed-on: http://openocd.zylin.com/4348 Tested-by: jenkins Reviewed-by: Andreas Fritiofson <andreas.fritiofson@gmail.com> * mips_m4k.c: Fix build with --disable-target64 Replace PRIx64 with TARGET_PRIxADDR to avoid build problems when --disable-target64 is used during configure. Change-Id: I054a27a491e86c42c9386a0488194320b808ba96 Signed-off-by: Liviu Ionescu <ilg@livius.net> Reviewed-on: http://openocd.zylin.com/4566 Tested-by: jenkins Reviewed-by: Tomas Vanek <vanekt@fbl.cz> Reviewed-by: Tim Newsome <tim@sifive.com> * target/arm_adi_v5: sync CSW and TAR cache on apreg write When using apreg to change AP registers CSW or TAR we get internal cached value not valid anymore. Reuse the setup functions for CSW and TAR to write them. Invalidate the cached value before the call to force the write, thus keeping original apreg behaviour. Change-Id: Ib14fafd5e584345de94f2e983de55406c588ac1c Signed-off-by: Antonio Borneo <borneo.antonio@gmail.com> Reviewed-on: http://openocd.zylin.com/4565 Tested-by: jenkins Reviewed-by: Tomas Vanek <vanekt@fbl.cz> * target/arm_adi_v5: keep CSW and TAR cache updated The call to dap_queue_ap_write() can fail and the value in CSW and TAR becomes unknown. Invalidate the OpenOCD cache if dap_queue_ap_write() fails. Change-Id: Id6ec370b4c5ad07e454464780c1a1c8ae34ac870 Signed-off-by: Antonio Borneo <borneo.antonio@gmail.com> Reviewed-on: http://openocd.zylin.com/4564 Tested-by: jenkins Reviewed-by: Tomas Vanek <vanekt@fbl.cz> * tcl/target: Add Renesas R-Car R8A7794 E2 target Add configuration for the Renesas R-Car R8A7794 E2 target. This is an SoC with two Cortex A7 ARMv7a cores, both A7 cores are supported. Change-Id: Ic1c81840e3bfcef8ee1de5acedffae5c83612a5e Signed-off-by: Marek Vasut <marek.vasut@gmail.com> Reviewed-on: http://openocd.zylin.com/4531 Tested-by: jenkins Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> * tcl/board: Add Renesas R-Car R8A7790 H2 Stout board Add configuration for the Renesas R-Car R8A7790 H2 based Stout ADAS board. Change-Id: Ib880b5d2e1fab5c8c0bc0dbcedcdce8055463fe2 Signed-off-by: Marek Vasut <marek.vasut@gmail.com> Reviewed-on: http://openocd.zylin.com/4497 Tested-by: jenkins Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> * tcl/board: Add Renesas R-Car R8A7791 M2W Porter board Add configuration for the Renesas R-Car R8A7791 M2W based Porter evaluation board. Change-Id: Iaadb18f29748f890ebb68519ea9ddbd18e7649af Signed-off-by: Marek Vasut <marek.vasut@gmail.com> Reviewed-on: http://openocd.zylin.com/4498 Tested-by: jenkins Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> * tcl/board: Add Renesas R-Car R8A7794 E2 Silk board Add configuration for the Renesas R-Car R8A7794 E2 based Silk evaluation board. Change-Id: I504b5630b1a2791ed6967c6c2af8851ceef9723f Signed-off-by: Marek Vasut <marek.vasut@gmail.com> --- NOTE: This requires SW7[1] in position 1 (default is 0) Reviewed-on: http://openocd.zylin.com/4532 Tested-by: jenkins Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> * tcl/board: Factor out common R-Car Gen2 code Factor out the code shared by all R-Car Gen2 boards into a single file to get rid of the duplication. Change-Id: I70b302c2e71f4e6fdccb2817dd65a5493bb393d8 Signed-off-by: Marek Vasut <marek.vasut@gmail.com> Reviewed-on: http://openocd.zylin.com/4533 Tested-by: jenkins Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> * jtag/drivers/cmsis-dap: fix connect in cmsis_dap_swd_switch_seq() The proc cmsis_dap_swd_switch_seq() is part of the SWD API for this interface driver. It is valid only when the interface is used in SWD mode. In this proc there is the need to call, in sequence, first cmsis_dap_cmd_DAP_Disconnect() then cmsis_dap_cmd_DAP_Connect(). The latter call requires the connection mode as parameter, that inside cmsis_dap_swd_switch_seq() can only be CONNECT_SWD. The current implementation is not correct and in some cases can pass mode CONNECT_JTAG. Moreover, JTAG is optional in CMSIS-DAP and passing mode CONNECT_JTAG triggers an error with SWD-only interfaces. Use mode CONNECT_SWD in SWD specific cmsis_dap_swd_switch_seq(). Change-Id: Ib455bf5b69cb2a2d146a6c8875387b00c27a5690 Signed-off-by: Antonio Borneo <borneo.antonio@gmail.com> Reviewed-on: http://openocd.zylin.com/4571 Tested-by: jenkins Reviewed-by: Tomas Vanek <vanekt@fbl.cz> * target/cortex_m: return error if breakpoint address is out of range If the "Flash Patch and Breakpoint" unit is rev.1 then it can only accept breakpoint addresses below 0x1FFFFFFF. Detailed info in "ARM v7-M Architecture Reference Manual", DDI0403E at chapter "C1.11 Flash Patch and Breakpoint unit". Print a message and return error if the address of hardware breakpoint cannot be handled by the breakpoint unit. Change-Id: I95c92b1f058f0dfc568bf03015f99e439b27c59b Signed-off-by: Antonio Borneo <borneo.antonio@gmail.com> Reviewed-on: http://openocd.zylin.com/4535 Tested-by: jenkins Reviewed-by: Tomas Vanek <vanekt@fbl.cz> Reviewed-by: Christopher Head <chead@zaber.com> * flash/nor/stm32: Report errors in wait_status_busy Flash operation errors that occur during algorithm programming are reported via the algorithm return value. However, Flash operation errors that occur during non-algorithm work (erasing, programming without a work area, programming the last non-multiple-of-32-bytes on an H7, etc.) generally end with a call to stm32x_wait_status_busy, which reads the status register and clears the error flags but fails to actually report that something went wrong should an error flag (other than WRPERR) be set. Return an error status from stm32x_wait_status_busy in those cases. Correct a log message accordingly. Change-Id: I09369ea5f924fe58833aec1f45e52320ab4aaf43 Signed-off-by: Christopher Head <chead@zaber.com> Reviewed-on: http://openocd.zylin.com/4519 Tested-by: jenkins Reviewed-by: Spencer Oliver <spen@spen-soft.co.uk> Reviewed-by: Tomas Vanek <vanekt@fbl.cz> * flash/nor/stm32: Eliminate working area leak On a specific early-return path, an allocated working area was not freed. Free it. Change-Id: I7c8fe51ff475f191624086996be1c77251780b77 Signed-off-by: Christopher Head <chead@zaber.com> Reviewed-on: http://openocd.zylin.com/4520 Tested-by: jenkins Reviewed-by: Spencer Oliver <spen@spen-soft.co.uk> Reviewed-by: Tomas Vanek <vanekt@fbl.cz> * flash/nor/stm32h7: Fix incorrect comment The name of the bit according to the reference manual is inconsistency error, not increment error. Change-Id: Ie3b73c0312db586e35519e03fd1a5cb225673d97 Signed-off-by: Christopher Head <chead@zaber.com> Reviewed-on: http://openocd.zylin.com/4521 Tested-by: jenkins Reviewed-by: Spencer Oliver <spen@spen-soft.co.uk> * target: fix 'bp' command help message "asid" and "length" are separate arguments of the command. Put space between them. Change-Id: I36cfc1e3a01caafef4fc3b26972a0cc192b0b963 Signed-off-by: Antonio Borneo <borneo.antonio@gmail.com> Reviewed-on: http://openocd.zylin.com/4511 Tested-by: jenkins Reviewed-by: Christopher Head <chead@zaber.com> Reviewed-by: Tomas Vanek <vanekt@fbl.cz> * Add ARM v8 AArch64 semihosting support This patch implements semihosting support for AArch64. This picks code from previously submitted AArch64 semihosting support patch and rebases on top of reworked semihosting code. Tested in AArch64 mode on a Lemaker Hikey Board with NewLib and GDB. Change-Id: I228a38f1de24f79e49ba99d8514d822a28c2950b Signed-off-by: Omair Javaid <omair.javaid@linaro.org> Reviewed-on: http://openocd.zylin.com/4537 Tested-by: jenkins Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> * GDB fileIO stdout support This patch fixes gdb fileio support to allow gdb console to be used as stdout. Now we can do something like gdb <inferior file> (gdb) tar ext :3333 (gdb) load (gdb) monitor arm semihosting enable (gdb) monitor arm semihosting_fileio enable (gdb) continue Here: Output from inferior using puts, printf etc will be routed to gdb console. Change-Id: I9cb0dddda1de58038c84f5b035c38229828cd744 Signed-off-by: Omair Javaid <omair.javaid@linaro.org> Reviewed-on: http://openocd.zylin.com/4538 Tested-by: jenkins Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> * target: armv8: Avoid semihosting segfault on halt Avoid a NULL pointer dereference when halting an aarch64 core. Change-Id: I333d40475ab26e2f0dca5c27302a5fa4d817a12f Signed-off-by: Andreas Färber <afaerber@suse.de> Reviewed-on: http://openocd.zylin.com/4593 Tested-by: jenkins Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> * tcl: target: Add NXP LS1012A config As seen on the FRDM-LS1012A board. Change-Id: Ifc9074b3f7535167b9ded5f544501ec2879f5db7 Signed-off-by: Andreas Färber <afaerber@suse.de> Reviewed-on: http://openocd.zylin.com/4594 Tested-by: jenkins Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> * tcl: board: Add NXP Freedom FRDM-LS1012A config An update for the K20 CMSIS-DAP firmware can be found here: https://community.nxp.com/thread/387080?commentID=840141#comment-840141 Change-Id: I149d7f8610aa56daf1aeb95f14ee1bf88f7cb647 Signed-off-by: Andreas Färber <afaerber@suse.de> Reviewed-on: http://openocd.zylin.com/4595 Tested-by: jenkins Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> * gdb_server: only trigger once the event gdb-detach at gdb quit When GDB quits (e.g. with "quit" command) we first execute gdb_detach() to reply "OK" then, at GDB disconnect (either TCP or pipe connection type), we execute gdb_connection_closed(). In case GDB is killed or it crashes, OpenOCD only executes the latter when detects the disconnection. Both gdb_detach() and gdb_connection_closed() trigger the event TARGET_EVENT_GDB_DETACH thus getting it triggered twice on clean GDB quit. Do not trigger the event TARGET_EVENT_GDB_DETACH in gdb_detach() and let only gdb_connection_closed() to handle it. Change-Id: Iacf035c855b8b3e2239c1c0e259c279688b418ee Signed-off-by: Antonio Borneo <borneo.antonio@gmail.com> Reviewed-on: http://openocd.zylin.com/4585 Tested-by: jenkins Reviewed-by: Tomas Vanek <vanekt@fbl.cz> * gdb_server: set current_target from connection's one In a multi-target environment we are supposed to have a single gdb server for each target (or for each group of targets within a SMP node). By default, the gdb attached to a server sends its command to the target (or to the SMP node targets) linked to that server. This is working fine for the normal gdb commands, but it is broken for the native OpenOCD commands executed through gdb "monitor" command. In the latter case, gdb "monitor" commands will be executed on the current target of OpenOCD configuration script (that is either the last target created or the target specified in a "targets" command). Fixed in gdb_new_connection() by replacing the current target in the connection's copy of command context. Change-Id: If7c8f2dce4a3138f0907d3000dd0b15e670cfa80 Signed-off-by: Antonio Borneo <borneo.antonio@gmail.com> Reviewed-on: http://openocd.zylin.com/4586 Tested-by: jenkins Reviewed-by: Tomas Vanek <vanekt@fbl.cz> Reviewed-by: Christopher Head <chead@zaber.com> * target/image: make i/j unsigned to avoid ubsan runtime error src/target/image.c:1055:15: runtime error: left shift of 128 by 24 places cannot be represented in type 'int' Change-Id: I322fd391cf3f242beffc8a274824763c8c5e69a4 Signed-off-by: Cody Schafer <openocd@codyps.com> Reviewed-on: http://openocd.zylin.com/4584 Tested-by: jenkins Reviewed-by: Tomas Vanek <vanekt@fbl.cz> Reviewed-by: Christopher Head <chead@zaber.com> * target/stm32f7x: Clear stuck HSE clock with CSS Change-Id: Ica0025ea465910dd664ab546b66f4f25b271f1f5 Signed-off-by: Christopher Head <chead@zaber.com> Reviewed-on: http://openocd.zylin.com/4570 Tested-by: jenkins Reviewed-by: Andreas Fritiofson <andreas.fritiofson@gmail.com> * psoc5lp: fix erase check, add free_driver_priv psoc5lp_erase_check() was not properly adapted to the new armv7m_blank_check_memory() in the hot fix 53376dbbed This change fixes handling of num_sectors in dependecy of ecc_enabled. Also add comments how ecc_enabled influences num_sectors. Add pointer to default_flash_free_driver_priv() to all psoc5lp flash drivers to keep valgrind happy. Change-Id: Ie1806538becd364fe0efb7a414f0fe6a84b2055b Signed-off-by: Tomas Vanek <vanekt@fbl.cz> Reviewed-on: http://openocd.zylin.com/4569 Tested-by: jenkins * target: atmel samd10 xplained mini cortex m0+ on a tiny board, with an mEDBG (CMSIS-DAP) debug interface. Change-Id: Iaedfab578b4eb4aa2d923bd80f220f59b34e6ef9 Signed-off-by: Karl Palsson <karlp@tweak.net.au> Reviewed-on: http://openocd.zylin.com/3402 Tested-by: jenkins Reviewed-by: Tomas Vanek <vanekt@fbl.cz> * tcl/board: add SAMD11 Xplained Pro evaluation board Change-Id: Id996c4de6dc9f25f71424017bf07689fea7bd3af Signed-off-by: Peter Lawrence <majbthrd@gmail.com> Reviewed-on: http://openocd.zylin.com/4507 Tested-by: jenkins Reviewed-by: Tomas Vanek <vanekt@fbl.cz> * Adds SAMD11D14AU flash support. Corrects names of SAMD11D14AM and SAMD11D14ASS per datasheet. Change-Id: I8beb15d5376966a4f8d7de76bfb2cbda2db440dc Signed-off-by: Christopher Hoover <ch@murgatroid.com> Reviewed-on: http://openocd.zylin.com/4597 Tested-by: jenkins Reviewed-by: Tomas Vanek <vanekt@fbl.cz> * nds32: Avoid detected JTAG clock AICE2 doesn't support scan for the maximum clock frequency of JTAG chain. It will cause USB command timeout. Change-Id: I41d1e3be387b6ed5a4dd0be663385a5f053fbcf9 Signed-off-by: Hellosun Wu <wujiheng.tw@gmail.com> Reviewed-on: http://openocd.zylin.com/4292 Tested-by: jenkins Reviewed-by: Hsiangkai Wang <hsiangkai@gmail.com> Reviewed-by: Tomas Vanek <vanekt@fbl.cz> * flash/nor/tcl: Distinguish between sectors and blocks in status messages Use the right word in flash protect command status messages based on whether the target bank defines num_prot_blocks. Minor message style tidy-up. Change-Id: I5f40fb5627422536ce737f242fbf80feafe7a1fc Signed-off-by: Dominik Peklo <dom.peklo@gmail.com> Reviewed-on: http://openocd.zylin.com/4573 Tested-by: jenkins Reviewed-by: Tomas Vanek <vanekt@fbl.cz> Reviewed-by: Christopher Head <chead@zaber.com> * drivers: cmsis-dap: pull up common connect code Just a minor deduplication Change-Id: Idd256883e5f6d4bd4dcc18462dd5468991f507b3 Signed-off-by: Karl Palsson <karlp@tweak.net.au> Reviewed-on: http://openocd.zylin.com/3403 Tested-by: jenkins Reviewed-by: Tomas Vanek <vanekt@fbl.cz> * drivers: cmsis-dap: Print version info when available No need to wait until after connecting, might help diagnose part information by printing earlier. Change-Id: I51eb0d584be306baa811fbeb1ad6a604773e602c Signed-off-by: Karl Palsson <karlp@tweak.net.au> Reviewed-on: http://openocd.zylin.com/3404 Tested-by: jenkins Reviewed-by: Tomas Vanek <vanekt@fbl.cz> * flash/nor: add support for TI MSP432 devices Added msp432 flash driver to support the TI MSP432P4x and MSP432E4x microcontrollers. Implemented the flash algo helper as used in the TI debug and flash tools. This implemention supports the MSP432E4, Falcon, and Falcon 2M variants. The flash driver automatically detects the connected variant and configures itself appropriately. Added command to mass erase device for consistency with TI tools and added command to unlock the protected BSL region. Tested using MSP432E401Y, MSP432P401R, and MSP432P4111 LaunchPads. Tested with embedded XDS110 debug probe in CMSIS-DAP mode and with external SEGGER J-Link probe. Removed ti_msp432p4xx.cfg file made obsolete by this patch. Change-Id: I3b29d39ccc492524ef2c4a1733f7f9942c2684c0 Signed-off-by: Edward Fewell <efewell@ti.com> Reviewed-on: http://openocd.zylin.com/4153 Tested-by: jenkins Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> Reviewed-by: Tomas Vanek <vanekt@fbl.cz> * flash/nor/at91sam4: fix sam4sa16c flash banks and its gpnvms count There was already a github fork that had this fixed, but as we try to use the latest, non-modified version of all software we use, I would like to have this fix in the next releases of OpenOCD so that if people uses $packagemanager, they will not have issues flashing the last part of the flash of sam4sa16c chips. Additionally, I've added some more logging related to the flash bank that was used, and the chip ID that was detected. Change-Id: I7ea5970105906e4560b727e46222ae9a91e41559 Signed-off-by: Erwin Oegema <blablaechthema@hotmail.com> Reviewed-on: http://openocd.zylin.com/4599 Reviewed-by: Tomas Vanek <vanekt@fbl.cz> Tested-by: jenkins * flash/nor/stm32lx: Add revision 'V' for STM32L1xx Cat.3 devices Change-Id: Ic92b0fb5b738af3bec79ae335876aa9e26f5f4cd Signed-off-by: Marc Schink <openocd-dev@marcschink.de> Reviewed-on: http://openocd.zylin.com/4600 Tested-by: jenkins Reviewed-by: Tomas Vanek <vanekt@fbl.cz> Reviewed-by: Antonio Borneo <borneo.antonio@gmail.com> * Avoid null target->semihosting references. The new common semihosting code introduced a bug, in certain conditions target->semihosting was used without semihosting being initialised. The solution was to explicitly test for target->semihosting before dereferencing it. Change-Id: I4c83e596140c68fe4ab32e586e51f7e981a40798 Signed-off-by: Liviu Ionescu <ilg@livius.net> Reviewed-on: http://openocd.zylin.com/4603 Tested-by: jenkins Reviewed-by: Jonathan Larmour <jifl@eCosCentric.com> Reviewed-by: Tomas Vanek <vanekt@fbl.cz> * nrf5: Add HWID 0x139 (52832 rev E0) Change-Id: I71b7471ccfcb8fcc6de30da57ce4165c7fb1f73f Signed-off-by: James Jacobsson <slowcoder@gmail.com> Reviewed-on: http://openocd.zylin.com/4604 Tested-by: jenkins Reviewed-by: Tomas Vanek <vanekt@fbl.cz> * target: Fix segfault for 'mem2array' Call 'mem2array' without arguments to reproduce the segmentation fault. Change-Id: I02bf46cc8bd317abbb721a8c75d7cbfac99eb34e Signed-off-by: Marc Schink <openocd-dev@marcschink.de> Reviewed-on: http://openocd.zylin.com/4534 Tested-by: jenkins Reviewed-by: Antonio Borneo <borneo.antonio@gmail.com> Reviewed-by: Christopher Head <chead@zaber.com> * target/armv7m_trace: Fix typo in enum Change-Id: I6364ee5011ef2d55c59674e3b97504a285de0cb2 Signed-off-by: Marc Schink <openocd-dev@marcschink.de> Reviewed-on: http://openocd.zylin.com/3904 Tested-by: jenkins Reviewed-by: Paul Fertser <fercerpav@gmail.com> * target/armv7m_trace: Use prefix for enums Change-Id: I3f199e6053146a1094d96b98ea174b41bb021599 Signed-off-by: Marc Schink <openocd-dev@marcschink.de> Reviewed-on: http://openocd.zylin.com/3905 Tested-by: jenkins Reviewed-by: Paul Fertser <fercerpav@gmail.com> * target/aarch64: Call aarch64_init_debug_access() earlier in aarch64_deassert_reset() On Renesas R-Car, calling 'reset halt' and 'reset init' always made DAP inaccessible. Calling 'reset' and 'halt' seperatly worked fine. The only differences seems to be the point in time when aarch64_init_debug_access() is called. This patch aligns the behaviour. Change-Id: I2296c65e48414a7d9846f12a395e5eca315b49ca Signed-off-by: Dennis Ostermann <dennis.ostermann@renesas.com> Reviewed-on: http://openocd.zylin.com/4607 Tested-by: jenkins Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> * server: Improve signal handling under Linux Commit 5087a955 added custom signal handlers for the openocd server process. Before this commit, when openocd is run as a background process having the same controlling terminal as gdb, Control-C would be handled by gdb to stop target execution and return to the gdb prompt. However, after commit 5087a955, the SIGINT caused by pressing Control-C also terminates openocd, effectively crashing the debugging session. The only way to avoid this is run openocd in a different controling terminal or to detach openocd from its controlling terminal, thus losing all job control for the openocd process. This patch improves the server's handling of POSIX signals: 1) Keyboard generated signals (INT and QUIT) are ignored when server process has is no controlling terminal. 2) SIGHUP and SIGPIPE are handled to ensure that .quit functions for each interface are called if user's logs out of X session or there is a network failure. SIG_INT & SIG_QUIT still stop openocd when it is running in the foreground. Change-Id: I03ad645e62408fdaf4edc49a3550b89b287eda10 Signed-off-by: Brent Roman <genosensor@gmail.com> Signed-off-by: Tomas Vanek <vanekt@fbl.cz> Reviewed-on: http://openocd.zylin.com/3963 Tested-by: jenkins Reviewed-by: Antonio Borneo <borneo.antonio@gmail.com> * armv7a: read ttbcr and ttb0/1 at every entry in debug state Commit bfc5c764df avoids reading ttbcr and ttb0/1 at every virt2phys translation by caching them, and it updates the cached values in armv7a_arch_state(). But the purpose of any (*arch_state)() method, thus including armv7a_arch_state(), is to only print out and inform the user about some architecture specific status. Moreover, to reduce the verbosity during a GDB session, the method (*arch_state)() is not executed anymore at debug state entry (check use of target->verbose_halt_msg in src/openocd.c), thus the state of translation table gets out-of-sync triggering Error: Address translation failure or even using a wrong address in the memory R/W operation. In addition, the commit above breaks the case of armv7r by calling armv7a_read_ttbcr() unconditionally. Fixed by moving in cortex_a_post_debug_entry() the call to armv7a_read_ttbcr() on armv7a case only. Remove the call to armv7a_read_ttbcr() in armv7a_identify_cache() since it is (conditionally) called only in the same procedure cortex_a_post_debug_entry(). Fixes: bfc5c764df ("armv7a: cache ttbcr and ttb0/1 on debug state entry") Change-Id: Ifc20eca190111832e339a01b7f85d28c1547c8ba Signed-off-by: Antonio Borneo <borneo.antonio@gmail.com> Reviewed-on: http://openocd.zylin.com/4601 Tested-by: jenkins Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> * Avoid dereferencing NULL pointer. If a NULL pointer is passed, don't attempt to increment it. This avoids passing the now not-NULL pointer on and eventually segfaulting. Also remove some unnecessary temporary variables. Change-Id: I268e225121aa283d59179bfae407ebf6959d3a4e Signed-off-by: Darius Rad <darius@bluespec.com> Reviewed-on: http://openocd.zylin.com/4550 Tested-by: jenkins Reviewed-by: Andreas Fritiofson <andreas.fritiofson@gmail.com> * Remove FSF mailing address. Checkpatch complains about this (FSF_MAILING_ADDRESS). Change-Id: Ib46a7704f9aed4ed16ce7733d43c58254a094149 Signed-off-by: Tim Newsome <tim@sifive.com> Reviewed-on: http://openocd.zylin.com/4559 Tested-by: jenkins Reviewed-by: Spencer Oliver <spen@spen-soft.co.uk> * drivers: cmsis_dap_usb: implement cmd JTAG_TMS Simply add a wrapper around cmsis_dap_cmd_DAP_SWJ_Sequence() Change-Id: Icf86f84b24e9fec56e2f9e155396aac34b0e06d2 Signed-off-by: Antonio Borneo <borneo.antonio@gmail.com> Reviewed-on: http://openocd.zylin.com/4517 Tested-by: jenkins Reviewed-by: Spencer Oliver <spen@spen-soft.co.uk> * arm_adi_v5: put SWJ-DP back to JTAG mode at exit When SWD mode is used, current OpenOCD code left the SWJ-DP in SWD mode at exit. Also, current code is unable to switch back the SWJ-DP in JTAG at next run, thus a power cycle of both target and interface is required in order to run OpenOCD in JTAG mode again. Put the SWJ-DP back to JTAG mode before exit from OpenOCD. Use switch_seq(SWD_TO_JTAG) instead of dap_to_jtag(), because the latter is not implemented on some interfaces. This is aligned with the use of switch_seq(JTAG_TO_SWD) in swd_connect(). Change-Id: I55d3faebe60d6402037ec39dd9700dc5f17c53b0 Signed-off-by: Antonio Borneo <borneo.antonio@gmail.com> Reviewed-on: http://openocd.zylin.com/4493 Tested-by: jenkins Reviewed-by: Bohdan Tymkiv <bhdt@cypress.com> Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> * Add RISC-V support. This supports both 0.11 and 0.13 versions of the debug spec. Support for `-rtos riscv` will come in a separate commit since it was easy to separate out, and is likely to be more controversial. Flash support for the SiFive boards will also come in a later commit. Change-Id: I1d38fe669c2041b4e21a5c54a091594aac3e2190 Signed-off-by: Tim Newsome <tim@sifive.com> Reviewed-on: http://openocd.zylin.com/4578 Tested-by: jenkins Reviewed-by: Liviu Ionescu <ilg@livius.net> Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> * usb_blaster: Don't unnecessarily go through DR-/IR-Pause There is no need to pass through DR-/IR-Pause after a scan if we want to go to DR-/IR-Update. We just have to skip the first step of the path to the end state because we already did that step when shifting the last bit. v2: - Fix comments as remarked in review of v1 Change-Id: I3c10f02794b2233f63d2150934e2768430873caa Signed-off-by: Daniel Glöckner <daniel-gl@gmx.net> Reviewed-on: http://openocd.zylin.com/4245 Tested-by: jenkins Reviewed-by: Christopher Head <chead@zaber.com> Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> * cortex_a: fix virt2phys when mmu is disabled When the MMU is not enabled on debug state entry, virt2phys cannot perform a translation since it is unknown whether a valid MMU configuration existed before. In this case, return the virtual address as physical address. Change-Id: I6f85a7a5dbc200be1a4b5badf10a1a717f1c79c0 Signed-off-by: Matthias Welwarsky <matthias.welwarsky@sysgo.com> Reviewed-on: http://openocd.zylin.com/4480 Tested-by: jenkins Reviewed-by: Antonio Borneo <borneo.antonio@gmail.com> Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> * drivers: cmsis-dap: print serial if available Helpful for sanity checking connections Change-Id: Ife0d8b4e12d4c03685aac8115c9739a4c1e994fe Signed-off-by: Karl Palsson <karlp@tweak.net.au> Reviewed-on: http://openocd.zylin.com/3405 Tested-by: jenkins Reviewed-by: Tomas Vanek <vanekt@fbl.cz> * target/cortex_m: make a variable local The vec_ids variable is not referenced anywhere other than the vector catch command handler. Make it local to that function. Change-Id: Ie5865e8f78698c19a09f0b9d58269ced1c9db440 Signed-off-by: Christopher Head <chead@zaber.com> Reviewed-on: http://openocd.zylin.com/4606 Tested-by: jenkins Reviewed-by: Tomas Vanek <vanekt@fbl.cz> * target/cortex_a: fix compile error for uninitialized variable Commit ad6c71e151 introduced the variable "mmu_enabled" whose pointer is passed to cortex_a_mmu() that initialises it. This initialization is not visible to the compiler that issue a compile error. The same situation is common across the same file and the usual workaround is to initialize it to zero; thus the same fix i applied here. Ticket: https://sourceforge.net/p/openocd/tickets/197/ Fixes: commit ad6c71e151 ("cortex_a: fix virt2phys when mmu is disabled") Change-Id: I77dec41acdf4c715b45ae37b72e36719d96d9283 Signed-off-by: Antonio Borneo <borneo.antonio@gmail.com> Reviewed-on: http://openocd.zylin.com/4619 Tested-by: jenkins Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> * mips_m4k: add optional reset handler In some cases by using SRST we can't halt CPU early enough. And option PrRst is not available too. In this case the only way is to set BOOT flag over EJTAG and reset CPU or SoC from CPU itself. For example by writing to some reset register. This patch is providing possibility to use user defined reset-assert handler which will be enabled only in case SRST is disabled. It is needed to be able switch between two different reset variants on run time. Change-Id: I6ef98f1871ea657115877190f7cc7a5e8f3233e4 Signed-off-by: Oleksij Rempel <linux@rempel-privat.de> Reviewed-on: http://openocd.zylin.com/4404 Tested-by: jenkins Reviewed-by: Paul Fertser <fercerpav@gmail.com> * tcl/target: add config for Qualcomm QCA4531 The QCA4531 is a two stream (2x2) 802.11b/g/n single-band programmable Wi-Fi System-on-Chip (SoC) for the Internet of Things (IoT). https://www.qualcomm.com/products/qca4531 Change-Id: I58398c00943b005cfaf0ac1eaad92d1fa4e2cba7 Signed-off-by: Oleksij Rempel <linux@rempel-privat.de> Reviewed-on: http://openocd.zylin.com/4405 Tested-by: jenkins Reviewed-by: Paul Fertser <fercerpav@gmail.com> * tcl/board: add config for 8devices LIMA board More information about this board can be found here: https://www.8devices.com/products/lima Change-Id: Id35a35d3e986630d58d37b47828870afd107cc6a Signed-off-by: Oleksij Rempel <linux@rempel-privat.de> Reviewed-on: http://openocd.zylin.com/4406 Tested-by: jenkins Reviewed-by: Paul Fertser <fercerpav@gmail.com> * tcl/target|board: move common AR9331 code to atheros_ar9331.cfg The ar9331_25mhz_pll_init and ar9331_ddr1_init routines can be used not only for TP-Link MR3020 board, so move them to the common atheros_ar9331.cfg file. Change-Id: I04090856b08151d6bb0f5ef9cc654efae1c81835 Signed-off-by: Antony Pavlov <antonynpavlov@gmail.com> Reviewed-on: http://openocd.zylin.com/2999 Tested-by: jenkins Reviewed-by: Paul Fertser <fercerpav@gmail.com> * tcl/target/atheros_ar9331: add DDR2 helper this helper works on many different boards, so it is good to have it in target config Change-Id: I068deac36fdd73dbbcedffc87865cc5b9d992c1d Signed-off-by: Oleksij Rempel <linux@rempel-privat.de> Reviewed-on: http://openocd.zylin.com/4422 Tested-by: jenkins Reviewed-by: Paul Fertser <fercerpav@gmail.com> * tcl/target/atheros_ar9331: add documentation and extra helpers Sync it with experience gathered on Qualcomm QCA4531 SoC. This chips are in many ways similar. Change-Id: I06b9c85e5985a09a9be3cb6cc0ce3b37695d2e54 Signed-off-by: Oleksij Rempel <linux@rempel-privat.de> Reviewed-on: http://openocd.zylin.com/4423 Tested-by: jenkins Reviewed-by: Paul Fertser <fercerpav@gmail.com> * tcl/board: add DPTechnics DPT-Board-v1 it is Atheros AR9331 based IoT dev board. Change-Id: I6fc3cdea1bef49c53045018ff5acfec4d5610ba6 Signed-off-by: Oleksij Rempel <linux@rempel-privat.de> Reviewed-on: http://openocd.zylin.com/4424 Tested-by: jenkins Reviewed-by: Paul Fertser <fercerpav@gmail.com> * fpga/altera-10m50: add all device id add all currently know Intel (Alter) MAX 10 device ids Change-Id: I6a88fef222c8e206812499d41be863c3d89fa944 Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de> Reviewed-on: http://openocd.zylin.com/4598 Tested-by: jenkins Reviewed-by: Paul Fertser <fercerpav@gmail.com> * target|board: Add Intel (Altera) Arria 10 target and related board Target information about this SoC can be found here: https://www.altera.com/products/fpga/arria-series/arria-10/overview.html Achilles Instant-Development Kit Arria 10 SoC SoM: https://www.reflexces.com/products-solutions/development-kits/arria-10/achilles-instant-development-kit-arria-10-soc-som Change-Id: Id78c741be6a8b7d3a70f37d41088e47ee61b437a Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de> Reviewed-on: http://openocd.zylin.com/4583 Tested-by: jenkins Reviewed-by: Paul Fertser <fercerpav@gmail.com> * target/riscv: fix compile error with gcc 8.1.1 Fix compile error: src/target/riscv/riscv-011.c: In function ‘slot_offset’: src/target/riscv/riscv-011.c:238:4: error: this statement may fall through [-Werror=implicit-fallthrough=] switch (slot) { ^~~~~~ src/target/riscv/riscv-011.c:243:3: note: here case 64: ^~~~ Fixes: a51ab8ddf6 ("Add RISC-V support.") Change-Id: I7fa86b305bd90cc590fd4359c3698632d44712e5 Signed-off-by: Antonio Borneo <borneo.antonio@gmail.com> Reviewed-on: http://openocd.zylin.com/4618 Tested-by: jenkins Reviewed-by: Jiri Kastner <cz172638@gmail.com> Reviewed-by: Oleksij Rempel <linux@rempel-privat.de> Reviewed-by: Tim Newsome <tim@sifive.com> Reviewed-by: Paul Fertser <fercerpav@gmail.com> * server: explicitly call "shutdown" when catch CTRL-C or a signal Every TCL command can be renamed (or deleted) and then replaced by a TCL proc that has the same name of the original TCL command. This can be used either to completely replace an existing command or to wrap the original command to extend its functionality. This applies also to the OpenOCD command "shutdown" and can be useful, for example, to set back some default value to the target before quitting OpenOCD. E.g. (TCL code): rename shutdown original_shutdown proc shutdown {} { puts "This is my implementation of shutdown" # my own stuff before exit OpenOCD original_shutdown } Unfortunately, sending a signal (or pressing CTRL-C) to terminate OpenOCD doesn't trigger calling the original "shutdown" command nor its (eventual) replacement. Detect if the main loop is terminated by an external signal and in such case execute explicitly the command "shutdown". Replace with enum the magic numbers assumed by "shutdown_openocd". Please notice that it's possible to write a custom "shutdown" TCL proc that does not call the original "shutdown" command. This is useful, for example, to prevent the user to quit OpenOCD by typing "shutdown" in the telnet session. Such case will not prevent OpenOCD to terminate when receiving a signal; OpenOCD will quit after executing the custom "shutdown" command. Change-Id: I86b8f9eab8dbd7a28dad58b8cafd97caa7a82f43 Signed-off-by: Antonio Borneo <borneo.antonio@gmail.com> Reviewed-on: http://openocd.zylin.com/4551 Tested-by: jenkins Reviewed-by: Tomas Vanek <vanekt@fbl.cz> * zy1000: fix compile error with gcc 8.1.1 The fall-through comment is not taken in consideration by gcc 8.1.1 because it is inside the braces of a C-code block. Move the comment outside the C block. Change-Id: I22d87b2dee109fb8bcf2071ac55fdf7171ffcf4b Signed-off-by: Antonio Borneo <borneo.antonio@gmail.com> Reviewed-on: http://openocd.zylin.com/4614 Tested-by: jenkins Reviewed-by: Tomas Vanek <vanekt@fbl.cz> * flash/nor/tcl.c: fix flash bank bounds check in 'flash fill' command handler Steps to reproduce ( STM32F103 'Blue Pill', 128KiB of flash ): > flash fillh 0x0801FFFE 00 1 wrote 2 bytes to 0x0801fffe in 0.019088s (0.102 KiB/s) > flash fillw 0x0801FFFE 00 1 Error: stm32f1x.cpu -- clearing lockup after double fault Error: error waiting for target flash write algorithm Error: error writing to flash at address 0x08000000 at offset 0x0001fffe Change-Id: I145092ec5e45bc586b3df48bf37c38c9226915c1 Signed-off-by: Bohdan Tymkiv <bhdt@cypress.com> Reviewed-on: http://openocd.zylin.com/4516 Tested-by: jenkins Reviewed-by: Tomas Vanek <vanekt@fbl.cz> * target/arm_adi_v5: add command "dpreg" For very low level debug or development around DAP, it is useful to have direct access to DP registers. Add command "dpreg" by mimic the syntax of the existing "apreg" command: $dap_name dpreg reg [value] Change-Id: Ic4ab451eb5e74453133adee61050b4c6f656ffa3 Signed-off-by: Antonio Borneo <borneo.antonio@gmail.com> Reviewed-on: http://openocd.zylin.com/4612 Tested-by: jenkins Reviewed-by: Tomas Vanek <vanekt@fbl.cz> * nrf5: add free_driver_priv Change-Id: I429a9868deb0c4b51f47a4bbad844bdc348e8d21 Signed-off-by: Jim Paris <jim@jtan.com> Reviewed-on: http://openocd.zylin.com/4608 Tested-by: jenkins Reviewed-by: Tomas Vanek <vanekt@fbl.cz> * rtos: add support for NuttX This patch introduces RTOS support for NuttX. Currently, only ARM Cortex-M (both FPU and FPU-less) targets are supported. To use, add the following lines to ~/.gdbinit. define hookpost-file eval "monitor nuttx.pid_offset %d", &((struct tcb_s *)(0))->pid eval "monitor nuttx.xcpreg_offset %d", &((struct tcb_s *)(0))->xcp.regs eval "monitor nuttx.state_offset %d", &((struct tcb_s *)(0))->task_state eval "monitor nuttx.name_offset %d", &((struct tcb_s *)(0))->name eval "monitor nuttx.name_size %d", sizeof(((struct tcb_s *)(0))->name) end And please make sure the above values are the same as in src/rtos/nuttx_header.h Change-Id: I2aaf8644d24dfb84b500516a9685382d5d8fe48f Signed-off-by: Masayuki Ishikawa <Masayuki.Ishikawa@jp.sony.com> Signed-off-by: Masatoshi Tateishi <Masatoshi.Tateishi@jp.sony.com> Signed-off-by: Nobuto Kobayashi <Nobuto.Kobayashi@sony.com> Reviewed-on: http://openocd.zylin.com/4103 Tested-by: jenkins Reviewed-by: Alan Carvalho de Assis <acassis@gmail.com> Reviewed-by: Tomas Vanek <vanekt@fbl.cz> * server/server: Add ability to remove services Add the ability to remove services while OpenOCD is running. Change-Id: I4067916fda6d03485463fa40901b40484d94e24e Signed-off-by: Marc Schink <openocd-dev@marcschink.de> Reviewed-on: http://openocd.zylin.com/4054 Tested-by: jenkins Reviewed-by: Fredrik Hederstierna <fredrik@hederstierna.com> Reviewed-by: Tomas Vanek <vanekt@fbl.cz> * target/cortex_m: fix incorrect comment The code sets C_MASKINTS if that bit is not already set (correctly). Fix the comment to agree. Change-Id: If4543e2660a9fa2cdabb2d2698427a6c8d9a274c Signed-off-by: Christopher Head <chead@zaber.com> Reviewed-on: http://openocd.zylin.com/4620 Tested-by: jenkins Reviewed-by: Tomas Vanek <vanekt@fbl.cz> * tcl/target/stm32f0x: Allow overriding the Flash bank size Copy & paste from another stm32 target. Change-Id: I0f6cbcec974ce70c23c1850526354106caee1172 Signed-off-by: Dominik Peklo <dom.peklo@gmail.com> Reviewed-on: http://openocd.zylin.com/4575 Tested-by: jenkins Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> * tcl/target: add Allwinner V3s SoC support Change-Id: I2459d2b137050985b7301047f9651951d72d9e9e Signed-off-by: Oleksij Rempel <linux@rempel-privat.de> Reviewed-on: http://openocd.zylin.com/4427 Tested-by: jenkins Reviewed-by: Paul Fertser <fercerpav@gmail.com> * target/arm_adi_v5: allow commands apsel and apcsw during init phase The current implementation of apsel cannot be executed during the initialization phase because it queries the DAP AP to retrieve and print the content of IDR register, and the query is only possible later on during the exec phase. But IDR information is already printed by the dedicated command apid, making redundant printing it by apsel too. Being unable to run apsel during initialization, makes also apcsw command (that depends on apsel) not usable in such phase. Modify the command apsel to only set the current AP, without making any transfer to the (possibly not initialized yet) DAP. When run without parameters, just print the current AP number. Change mode to COMMAND_ANY to apsel and to apcsw. Change-Id: Ibea6d531e435d1d49d782de1ed8ee6846e91bfdf Signed-off-by: Antonio Borneo <borneo.antonio@gmail.com> Reviewed-on: http://openocd.zylin.com/4624 Tested-by: jenkins Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> Reviewed-by: Tomas Vanek <vanekt@fbl.cz> * target/cortex_a: allow command dacrfixup during init phase There is no reason to restrict the command "cortex_a dacrfixup" to the EXEC phase only. Change the command mode to ANY so the command can be used in the initialization phase too. Change-Id: I498cc6b2dbdc48b3b2dd5f0445519a51857b295f Signed-off-by: Antonio Borneo <borneo.antonio@gmail.com> Reviewed-on: http://openocd.zylin.com/4623 Tested-by: jenkins Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> * target/armv7a_cache: add gdb keep-alive and fix a missing dpm finish Depending on range size, the loop on cache operations can take quite some time, causing gdb to timeout. Add keep-alive to prevent gdb to timeout. Add also a missing dpm->finish() to balance dpm->prepare(). Change-Id: Ia87934b1ec19a0332bb50e3010b582381e5f3685 Signed-off-by: Antonio Borneo <borneo.antonio@gmail.com> Reviewed-on: http://openocd.zylin.com/4627 Tested-by: jenkins Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> * Add detail to `wrong register size` error. Signed-off-by: Tim Newsome <tim@sifive.com> Change-Id: Id31499c94b539969970251145e42c89c943fd87c Reviewed-on: http://openocd.zylin.com/4577 Tested-by: jenkins Reviewed-by: Tomas Vanek <vanekt@fbl.cz> * doc: fix typo in cortex_m maskisr command Change-Id: I37795c320ff7cbf6f2c7434e03b26dbaf6fc6db4 Signed-off-by: Christopher Head <chead@zaber.com> Reviewed-on: http://openocd.zylin.com/4621 Tested-by: jenkins Reviewed-by: Tomas Vanek <vanekt@fbl.cz> * target/cortex_m: restore C_MASKINTS after reset The cortex_m maskisr user-facing setting is not changed across a target reset. However, the in-core C_MASKINTS bit was always cleared as part of reset processing, meaning that a cortex_m maskisr on setting would not be respected after a reset. Set C_MASKINTS based on the user-facing setting value rather than always clearing it after reset. Change-Id: I5aa5b9dfde04a0fb9c6816fa55b5ef1faf39f8de Signed-off-by: Christopher Head <chead@zaber.com> Reviewed-on: http://openocd.zylin.com/4605 Tested-by: jenkins Reviewed-by: Tomas Vanek <vanekt@fbl.cz> * tcl/board: update all uses of interface/stlink-v2-1 to interface/stlink Change-Id: I5e27e84d022f73101376e8b4a1bdc65f58fd348a Signed-off-by: Cody P Schafer <openocd@codyps.com> Reviewed-on: http://openocd.zylin.com/4456 Tested-by: jenkins Reviewed-by: Tomas Vanek <vanekt@fbl.cz> * target/riscv/riscv-011: fix compile warning about uninitialized variable In MSYS2 MinGW 64-bit git clone git://git.code.sf.net/p/openocd/code openocd $ gcc --version gcc.exe (Rev1, Built by MSYS2 project) 8.2.0 ./bootstrap ./configure --prefix= $ cat config.status | grep CFLAGS CFLAGS='-g -O2' make bindir = "bin-x64" depbase=`echo src/target/riscv/riscv-011.lo | sed 's|[^/]*$|.deps/&|;s|\.lo$||'`;\ /bin/sh ./libtool --tag=CC --mode=compile gcc -DHAVE_CONFIG_H -I. -D__USE_MINGW_ANSI_STDIO -I./src -I./src -I./src/helper -DPKGDATADIR=\"/mingw64/share/openocd\" -DBINDIR=\"bin-x64\" -I./jimtcl -I./jimtcl -Wall -Wstrict-prototypes -Wformat-security -Wshadow -Wextra -Wno-unused-parameter -Wbad-function-cast -Wcast-align -Wredundant-decls -Werror -g -O2 -MT src/target/riscv/riscv-011.lo -MD -MP -MF $depbase.Tpo -c -o src/target/riscv/riscv-011.lo src/target/riscv/riscv-011.c &&\ mv -f $depbase.Tpo $depbase.Plo libtool: compile: gcc -DHAVE_CONFIG_H -I. -D__USE_MINGW_ANSI_STDIO -I./src -I./src -I./src/helper -DPKGDATADIR=\"/mingw64/share/openocd\" -DBINDIR=\"bin-x64\" -I./jimtcl -I./jimtcl -Wall -Wstrict-prototypes -Wformat-security -Wshadow -Wextra -Wno-unused-parameter -Wbad-function-cast -Wcast-align -Wredundant-decls -Werror -g -O2 -MT src/target/riscv/riscv-011.lo -MD -MP -MF src/target/riscv/.deps/riscv-011.Tpo -c src/target/riscv/riscv-011.c -o src/target/riscv/riscv-011.o src/target/riscv/riscv-011.c: In function 'poll_target': src/target/riscv/riscv-011.c:1799:6: error: 'reg' may be used uninitialized in this function [-Werror=maybe-uninitialized] reg_cache_set(target, reg, ((data & 0xffffffff) << 32) | value); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ src/target/riscv/riscv-011.c:1686:17: note: 'reg' was declared here unsigned int reg; ^~~ cc1.exe: all warnings being treated as errors make[2]: *** [Makefile:3250: src/target/riscv/riscv-011.lo] Error 1 Change-Id: I6996dcb866fbace26817636f4bedba09510a087f Signed-off-by: Svetoslav Enchev <svetoslav.enchev@gmail.com> Reviewed-on: http://openocd.zylin.com/4635 Tested-by: jenkins Reviewed-by: Antonio Borneo <borneo.antonio@gmail.com> Reviewed-by: Tim Newsome <tim@sifive.com> Reviewed-by: Tomas Vanek <vanekt@fbl.cz> * max32xxx: Support for MAX32XXX devices. Adding flash programming support for Maxim Integrated MAX32XXX devices. Change-Id: I5b0f57a885f9d813240e4bc2d9f765b743e1cfc3 Signed-off-by: Kevin Gillespie <kgills@gmail.com> Reviewed-on: http://openocd.zylin.com/3543 Tested-by: jenkins Reviewed-by: Ismail H. KOSE <ihkose@gmail.com> Reviewed-by: Tomas Vanek <vanekt@fbl.cz> Reviewed-by: Andreas Fritiofson <andreas.fritiofson@gmail.com> * flash/at91sam4: run probe just once Reread registers in sam4_GetInfo() Change-Id: I3b023b3e642a9c052b5c41673d196317f7e7f2e3 Signed-off-by: Tomas Vanek <vanekt@fbl.cz> Reviewed-on: http://openocd.zylin.com/4609 Tested-by: jenkins Reviewed-by: Erwin Oegema <blablaechthema@hotmail.com> Reviewed-by: Svetoslav Enchev <svetoslav.enchev@gmail.com> * flash/at91sam4: emit flash bank info Change related LOG_INFO to LOG_DEBUG Change-Id: I0c09b1ec83da631b26980dc8632b9031fe2921a3 Signed-off-by: Tomas Vanek <vanekt@fbl.cz> Reviewed-on: http://openocd.zylin.com/4610 Tested-by: jenkins Reviewed-by: Erwin Oegema <blablaechthema@hotmail.com> Reviewed-by: Svetoslav Enchev <svetoslav.enchev@gmail.com> * flash/at91sam4: set wait states only once per write Read-modify-write setting of FMR register requires an USB turnaround. Setting FMR before each page write is not necessary and decreases the write speed. Change-Id: I67844c898aaf117f155c762c979840b603c767ed Signed-off-by: Tomas Vanek <vanekt@fbl.cz> Reviewed-on: http://openocd.zylin.com/4611 Tested-by: jenkins Reviewed-by: Svetoslav Enchev <svetoslav.enchev@gmail.com> * flash/at91sam4: fix clang static analyzer warning Change-Id: I5e5319d855c868adfa012f68086f7f809ec5a069 Signed-off-by: Tomas Vanek <vanekt@fbl.cz> Reviewed-on: http://openocd.zylin.com/4639 Tested-by: jenkins * rtos/linux.c: fix clang static analyzer warning Remove sizeof(int64_t) from string size computation. Change-Id: I029b394df5d62a2594a723c4c0e13608b3423b9b Signed-off-by: Tomas Vanek <vanekt@fbl.cz> Reviewed-on: http://openocd.zylin.com/4640 Tested-by: jenkins * target: armv8: Ensure target is halted for virt2phys Othewise the error reported as Timeout waiting for dpm prepare Change-Id: Ieed2fdcd94ae4e877a749df3eec07a01dbf80b10 Closes: https://sourceforge.net/p/openocd/tickets/201/ Found-by: Matthias Welwarsky <matthias@welwarsky.de> Signed-off-by: Guido Günther <guido.gunther@puri.sm> Reviewed-on: http://openocd.zylin.com/4647 Tested-by: jenkins Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> * adi_v5: enforce check on AP number value The AP number value is restricted in 8 bits unsigned by ADI-v5 specification. Nevertheless, an "invalid" value is used by target cortex-m to force an automatic detection of the AP. Replace magic numbers by using new macros for AP max number and for the value of AP invalid. Check the value passed through -ap-num flag during configuration. Change-Id: Ic19a367db0ab11c0ebd070750eca0647d25279a5 Signed-off-by: Antonio Borneo <borneo.antonio@gmail.com> Reviewed-on: http://openocd.zylin.com/4668 Tested-by: jenkins Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> * gdb_server: add per target option "-gdb-port" The argument passed to global config command "gdb_port" is usually, but not always, a TCP port number. In case of multiple targets, this numeric value is used as the first port of a set of consecutive TCP ports assigned one per target. If the argument is not a numeric value (e.g. "pipe", "disabled", ...) then incrementing it for the next target has no sense. Add the option "-gdb-port number" to the commands "target create" and "$target_name configure" to override, for the specific target, the general global configuration. This permits to use a per target "-gdb-port disabled", when no gdb port is required for that specific target. It also makes possible to choose a custom TCP port number for each target, overriding the usual sequence of consecutive port numbers. Change-Id: I3b9a1910b28ab4bc757e839d0e5d08ffc29f7ab4 Signed-off-by: Antonio Borneo <borneo.antonio@gmail.com> Reviewed-on: http://openocd.zylin.com/4530 Tested-by: jenkins Reviewed-by: Christopher Head <chead@zaber.com> Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> * libusb: return oocd error values keep same return style where possible Change-Id: I2f9b85dbc307a483609f76a84de77e3c74d346c7 Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de> Reviewed-on: http://openocd.zylin.com/4588 Tested-by: jenkins Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> * rtos-helpers: fix minor typo in uC/OS-III helper This patch corrects a spelling error in uCOS-III-openocd.c. Change-Id: I6d1923ff1f5e6361358c45cec3dd6c08ca9ccef0 Signed-off-by: Steven Stallion <stallion@squareup.com> Reviewed-on: http://openocd.zylin.com/4659 Tested-by: jenkins Reviewed-by: Antonio Borneo <borneo.antonio@gmail.com> * flash/stm32f2x: add stm32f7 revision Z identification Signed-off-by: Cody P Schafer <openocd@codyps.com> Change-Id: Ia0169514d494bae2a98d92ebc97c8eccc10bc6c4 Reviewed-on: http://openocd.zylin.com/4657 Tested-by: jenkins Reviewed-by: Christopher Head <chead@zaber.com> Reviewed-by: Tomas Vanek <vanekt@fbl.cz> * target/mem_ap: generic mem-ap target This pseudo target allows attaching to any access point on the DAP at the MEM-AP level and read and write addresses on the connected bus. For example, one can create a mem_ap target on the APB-AP and read and write registers of debug components directly. This allows many diagnostic and other features be programmed entirely using TCL, without necessity of adding drivers to OpenOCD. Change-Id: I53229ffd68fb0f96fb68be15b0f3a76cc8843c8e Signed-off-by: Matthias Welwarsky <matthias.welwarsky@sysgo.com> Reviewed-on: http://openocd.zylin.com/4002 Tested-by: jenkins Reviewed-by: Antonio Borneo <borneo.antonio@gmail.com> Reviewed-by: Leonard Crestez <cdleonard@gmail.com> * interface: adapter configuration for FTDI C232HM This patch adds support for the C232HM-DDSL-0 and C232HM-EDSL-0 FT232H-based cables from FTDI. For more information, see: http://www.ftdichip.com/Products/Cables/USBMPSSE.htm Change-Id: Ic97423eb1e2f6b5ebae04943cd5cce86f38771d5 Signed-off-by: Steven Stallion <stallion@squareup.com> Reviewed-on: http://openocd.zylin.com/4081 Tested-by: jenkins Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> * ftdi: extend ftdi_location format To existing <bus>:<port>,<port> format add <bus>-<port>.<port> support. The last format is used by kernel and other drivers. Change-Id: I6528970d3af4f6a8bf7b27a0f7a763b5957fdf2b Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de> Reviewed-on: http://openocd.zylin.com/4631 Tested-by: jenkins Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> * target/cortex_a: poll all targets in SMP node after halt The periodic poll scans all the targets in the same order they have been declared in the configuration file. When one target in a SMP node halts, the transition is detected in the following poll and this triggers a halt request to all the other cores of the SMP node. The targets that will be polled afterwards will be identified as "halted", but the targets already scanned will remain as "running" until the next periodic poll. This creates a race condition with GDB; GDB sets the breakpoints when runs the target and removes them as soon as the target is halted. When it receives the halt event, it starts removing the breakpoints and fails on the targets that are still reported as "running". Fixed by polling all the targets in the SMP node before informing GDB about the halt event. This implementation is almost copy/paste from the one in aarch64. Change-Id: Id2bd99f1e56b014e48e9e34ccb891b4219c518f8 Signed-off-by: Antonio Borneo <borneo.antonio@gmail.com> Reviewed-on: http://openocd.zylin.com/4622 Tested-by: jenkins Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> * tcl/board: Add Emcraft imx8 SOM BSB support Tested with Olimex ARM-USB-TINY-H adapter Simple commands work fine but there are currently issues when attaching remote gdb or running virt2phys: https://sourceforge.net/p/openocd/tickets/201/ Change-Id: I86ccf1d93c5d23870bb522f92b3e2af190d529e8 Signed-off-by: Guido Günther <agx@sigxcpu.org> Reviewed-on: http://openocd.zylin.com/4646 Tested-by: jenkins Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> * arm_adi_v5: remove useless cast to int The field ap_num in struct adiv5_private_config is already of type int. Casting it to type int has no sense. Change-Id: Ida642e808c02591bb58609425eccd096d404e2c4 Signed-off-by: Antonio Borneo <borneo.antonio@gmail.com> Reviewed-on: http://openocd.zylin.com/4666 Tested-by: jenkins Reviewed-by: Tomas Vanek <vanekt@fbl.cz> * flash/nrf5: time-based timeout waiting for flash controller Change-Id: Id214df154dc359ca130c8d8fe1554d106621b9cd Signed-off-by: Kai Geissdoerfer <kai.geissdoerfer@tu-dresden.de> Reviewed-on: http://openocd.zylin.com/4648 Tested-by: jenkins Reviewed-by: Tomas Vanek <vanekt@fbl.cz> * flash/nrf5: support for nRF52840 Q1AAC0 Change-Id: Id3280dadece84e1d68544936e44d506c7930a55d Signed-off-by: Kai Geissdoerfer <kai.geissdoerfer@tu-dresden.de> Reviewed-on: http://openocd.zylin.com/4649 Tested-by: jenkins Reviewed-by: Tomas Vanek <vanekt@fbl.cz> * doc: fix use of deprecated config file in the example Commit 31c58c139d ("jtag: drivers: stlink: handle all versions with single config") deprecates the use of "interface/stlink-v2-1.cfg" in favor of a unique config file "interface/stlink.cfg". Update the example in the documentation. Change-Id: I1aed7c70e15f4edb4f81a3ee8e3bce575fde873b Signed-off-by: Antonio Borneo <borneo.antonio@gmail.com> Reviewed-on: http://openocd.zylin.com/4667 Tested-by: jenkins Reviewed-by: Andreas Fritiofson <andreas.fritiofson@gmail.com> * Added support for STM32L4X option bytes writing. Enables the programming of Write protection lock bits. - Updated/re-factored with option_read, option_write and option_load commands. Change-Id: I86358c7eb1285c3c0baac1564e46da8ced5fd025 Signed-off-by: Thomas Søhus <tls@ceepro.dk> Reviewed-on: http://openocd.zylin.com/4654 Tested-by: jenkins Reviewed-by: Tomas Vanek <vanekt@fbl.cz> * Clarify what exactly the RISC-V code supports. Change-Id: I8da657426cc52c738ab41bfb0164cbc6721c0aef Signed-off-by: Tim Newsome <tim@sifive.com> Reviewed-on: http://openocd.zylin.com/4655 Tested-by: jenkins Reviewed-by: Philipp Guehring <pg@futureware.at> Reviewed-by: Liviu Ionescu <ilg@livius.net> Reviewed-by: Tomas Vanek <vanekt@fbl.cz> * target/cortex_m: fix typo The subunit of the debug unit is called the Flash Patch and Breakpoint unit, abbreviated (by ARM no less) as FPB, not FBP. Change-Id: Ia2f08470da705f0f1518feeca878f0f500507308 Signed-off-by: Christopher Head <chead@zaber.com> Reviewed-on: http://openocd.zylin.com/4675 Tested-by: jenkins Reviewed-by: Tomas Vanek <vanekt@fbl.cz> Reviewed-by: Antonio Borneo <borneo.antonio@gmail.com> * contrib/60-openocd.rules: provide hint to reload udev rules No need to reboot the Linux box when new rules are added to udev. Suggest the command in the script header. Change-Id: Ie95383bfd73914a3d2e2c05d77fa3eb32e68b7e2 Signed-off-by: Antonio Borneo <borneo.antonio@gmail.com> Reviewed-on: http://openocd.zylin.com/4665 Tested-by: jenkins Reviewed-by: Andreas Fritiofson <andreas.fritiofson@gmail.com> * target/stm32: make APCSW cacheable Change-Id: I7c5c9720ded329848647f17db95f845e46c01c19 Signed-off-by: Christopher Head <chead@zaber.com> Reviewed-on: http://openocd.zylin.com/4674 Tested-by: jenkins Reviewed-by: Tomas Vanek <vanekt@fbl.cz> * target/atsamv: make APCSW cacheable Change-Id: Ic00d3192642c682f370a6f7f8b70ae29744eb746 Signed-off-by: Christopher Head <chead@zaber.com> Reviewed-on: http://openocd.zylin.com/4678 Tested-by: jenkins Reviewed-by: Tomas Vanek <vanekt@fbl.cz> * gdb_server: avoid gdb server for virtual targets Virtual targets, like mem_ap, do not or cannot implement the required functionality to accept a GDB connection. In the case of mem_ap, the method get_gdb_reg_list() is missing and a following connection from gdb causes OpenOCD to segfault. OpenOCD opens a GDB port for each target; it's always possible to connect, by mistake, GDB to one virtual target. Add a method to check if the target supports GDB connections (for the moment just checking if get_gdb_reg_list is implemented). Skip opening a gdb server for every targets that don't support GDB connections. Change-Id: Ia439a43efe1a9adbb1771cd9d252db8ffa32eb9d Signed-off-by: Antonio Borneo <borneo.antonio@gmail.com> Reviewed-on: http://openocd.zylin.com/4676 Tested-by: jenkins Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> * tcl/target: Add Renesas R-Car Gen3 targets Add configuration for the Renesas R-Car Generation 3 targets. These are SoCs with Cortex A57s, A53s, and R7s. All cores are supported. Change-Id: I795233210e4f647a1a2a0adea7c058ae98b5db70 Signed-off-by: Adam Bass <adam.bass@renesas.com> Reviewed-on: http://openocd.zylin.com/4669 Tested-by: jenkins Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> * tcl/board: Add Renesas R-Car Salvator-X(S) boards. Add configuration for the Renesas R-Car Salvator-X and Renesas R-Car Salvator-XS boards. Change-Id: I898008f56adb31908d30760f18217583fabf1c51 Signed-off-by: Adam Bass <adam.bass@renesas.com> Reviewed-on: http://openocd.zylin.com/4670 Tested-by: jenkins Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> * flash/nrf5: support for nRF52810 Change-Id: I01c430bfa593d20ea7a51c90d67052e374d239b3 Signed-off-by: Anders Westrup <anders@westrup.se> Reviewed-on: http://openocd.zylin.com/4680 Tested-by: jenkins Reviewed-by: Tomas Vanek <vanekt@fbl.cz> Reviewed-by: Slowcoder <slowcoder@gmail.com> * drivers: cmsis-dap: fix connection in JTAG mode Commit 5aceec2412 ("drivers: cmsis-dap: pull up common connect code") breaks the driver and it cannot connect anymore in JTAG mode. The issue is caused in cmsis_dap_init() by anticipating the call to cmsis_dap_usb_open(), which then sets cmsis_dap_handle and makes the following test to always fail. Actually the original code was quite tricky: if (swd_mode) do something that also sets cmsis_dap_handle; if (cmsis_dap_handle == NULL) do something for !swd_mode; Convert the sequence of tricky "if"s in a single "if-then-else" to handle clearly the cases swd_mode and !swd_mode. Change-Id: I359a23bf26a3edc2461f4352daa0be83e78868f7 Fixes: 5aceec2412 ("drivers: cmsis-dap: pull up common connect code") Signed-off-by: Antonio Borneo <borneo.antonio@gmail.com> Reviewed-on: http://openocd.zylin.com/4697 Reviewed-by: Tomas Vanek <vanekt@fbl.cz> Tested-by: jenkins * register: support non-existent registers This patch fixes a number of bugs caused by incomplete support for non-existent registers. This is needed for targets that provide optional registers or non-linear register numbers. Change-Id: I216196e0051f28887a2c3da410959382369eed80 Signed-off-by: Steven Stallion <stallion@squareup.com> Reviewed-on: http://openocd.zylin.com/4113 Tested-by: jenkins Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> * rtos: support gdb_get_register_packet This patch adds support for p packet responses by targets configured with RTOS support. This change required moving to a rtos_reg struct, which is similar to struct reg used by targets, which resulted in needing to update each stacking with register numbers. This patch also allows targets with non-linear register numbers to function with RTOSes as well. Change-Id: I5b189d74110d6b6f2fa851a67ab0762ae6b1832f Signed-off-by: Steven Stallion <stallion@squareup.com> Reviewed-on: http://openocd.zylin.com/4121 Tested-by: jenkins Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> * gdb_server: add support for architecture element This change adds optional support for a target to report architecture information in the target description to GDB. This is needed by some GDB implementations to properly support remote target with custom behavior. More information on the architecture element can be found here: https://sourceware.org/gdb/onlinedocs/gdb/Target-Description-Format.html#Target-Description-Format Change-Id: I57b19cae5ac3496256e4e5cc52cf6526ca5c322d Signed-off-by: Steven Stallion <stallion@squareup.com> Reviewed-on: http://openocd.zylin.com/4078 Tested-by: jenkins Reviewed-by: Antonio Borneo <borneo.antonio@gmail.com> Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> * jtag: make cmd_queue_scan_field_clone public This patch makes the cmd_queue_scan_field_clone function public. This permits targets to insert fields without affecting the submitted scan_field list. This will be used in an upcoming target implementation that needs to insert additional padding bits. Change-Id: I8fbd3b9b4e413432471f4f1444048932c8fa189e Signed-off-by: Steven Stallion <stallion@squareup.com> Reviewed-on: http://openocd.zylin.com/4082 Tested-by: jenkins Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> * esirisc: support eSi-RISC targets eSi-RISC is a highly configurable microprocessor architecture for embedded systems provided by EnSilica. This patch adds support for 32-bit targets and also includes an internal flash driver and uC/OS-III RTOS support. This is a non-traditional target and required a number of additional changes to support non-linear register numbers and the 'p' packet in RTOS support for proper integration into EnSilica's GDB port. Change-Id: I59d5c40b3bb2ace1b1a01b2538bfab211adf113f Signed-off-by: Steven Stallion <stallion@squareup.com> Reviewed-on: http://openocd.zylin.com/4660 Tested-by: jenkins Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> * rtos: check symbol list when updating uCOS-III This patch corrects a crash in uCOS-III on a new GDB connection when RTOS autodetection is not used. The crash was caused by not checking if the symbol list had been loaded prior to updating threads. Change-Id: I64c5133e02fe22fc8d14584cc40d87b49c935b0b Signed-off-by: Steven Stallion <stallion@squareup.com> Reviewed-on: http://openocd.zylin.com/4719 Tested-by: jenkins Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> * ftdi: demote unhelpful debug messages Some protocols make use of empty scan fields for optional padding, which causes the log to fill with unhelpful messages that a field is empty. The remaining LOG_DEBUG messages in ftdi_execute_scan have been demoted to DEBUG_JTAG_IO such that these messages are only seen when debugging JTAG. Change-Id: I61fd4551411ce851da34e67d003bca5d7a71cd92 Signed-off-by: Steven Stallion <stallion@squareup.com> Reviewed-on: http://openocd.zylin.com/4112 Tested-by: jenkins Reviewed-by: Andreas Fritiofson <andreas.fritiofson@gmail.com> * tcl: Add support for the Numato Lab Mimas A7 board The Mimas A7 FPGA board has FTDI FT2232 whose channel B is connected to Artix-7 FPGA's JTAG interface. Hence, OpenOCD can easily interface with it via the its ftdi driver interface. Tested to be working great up to 30 MHz. Change-Id: Ieda015fbc6135bf95ad5a069cbf38650da45911e Signed-off-by: Rohit Singh <rohit91.2008@gmail.com> Reviewed-on: http://openocd.zylin.com/4720 Tested-by: jenkins Reviewed-by: Tim "mithro" Ansell <me@mith.ro> Reviewed-by: Robert Jordens <jordens@gmail.com> Reviewed-by: Paul Fertser <fercerpav@gmail.com> * target/arm_adi_v5: fix sync CSW cache on apreg write Commit 0057c71ab6 updates the OpenOCD cached values of CSW and TAR registers if these registers are modified by an apreg command. The condition to force the update of CSW cache is incorrect and it will erase the default CSW value. Moreover, calling mem_ap_setup_csw() does not honor the value requested in the apreg command because such value is incorrectly bitwise or-ed with csw_default. Fix it by updating csw_value, instead of erasing csw_default, and writing directly in CSW register the new value from the command line. Change-Id: I40273cb64d22ccfb9b6d3499bd39b586eb60de38 Fixes: 0057c71ab6 ("target/arm_adi_v5: sync CSW and TAR cache on apreg write") Signed-off-by: Antonio Borneo <borneo.antonio@gmail.com> Reviewed-on: http://openocd.zylin.com/4679 Tested-by: jenkins Reviewed-by: Christopher Head <chead@zaber.com> Reviewed-by: Tomas Vanek <vanekt@fbl.cz> * tcl/board: Add Arty-S7 Spartan 7 FPGA Development Board Change-Id: I8bfe780cb67a1777d5112a68e8a9781bfe4f2038 Signed-off-by: William D. Jones <wjones@wdj-consulting.com> Reviewed-on: http://openocd.zylin.com/4525 Reviewed-by: Robert Jordens <jordens@gmail.com> Tested-by: jenkins Reviewed-by: Rohit Singh <rohit91.2008@gmail.com> Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> * xilinx-xc7: Add additional IDCODEs. Add/detect missing IDCODEs for the Spartan 7 family and Artix 25T and Artix 12T. Change-Id: Ib6c83c5592e90df1eb8e715e79b279da9a95f9c6 Signed-off-by: William D. Jones <wjones@wdj-consulting.com> Reviewed-on: http://openocd.zylin.com/4428 Reviewed-by: Robert Jördens Tested-by: jenkins Reviewed-by: Rohit Singh <rohit91.2008@gmail.com> Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> * target/cortex_a: fix temporary breakpoint during step Commit c8926d1457 introduces the context and hybrid breakpoint types beside existing SW and HW types. The new field "asid" is non-zero only for these new types. The commit above did not properly initialize "asid" to 0 for a temporarily HW breakpoint used during single step. This causes cortex_a_unset_breakpoint() to identify this breakpoint as of type "hybrid". Identified through valgrind error: Conditional jump or move depends on uninitialised value(s) Actually valgrind triggers a total of 10 messages about use of uninitialized variables, but they are all caused by the first conditional jump bases on "asid != 0". Fixed by initializing "asid" to 0 in cortex_a_step(). Fixes: c8926d1457 ("cortex_a hybrid & context breakpoints") Change-Id: Ib674d8457d1e02e10332fd9d73554d13719ef93d Signed-off-by: Antonio Borneo <borneo.antonio@gmail.com> Reviewed-on: http://openocd.zylin.com/4613 Tested-by: jenkins Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> * zynq_7000: Add zynqpl_program command This allows for programming the PL part of the Xilinx Zynq 7000 Change-Id: I89e86c0f381951091f6948c46802d17d7f1f3500 Signed-off-by: Moritz Fischer <moritz.fischer@ettus.com> Reviewed-on: http://openocd.zylin.com/4177 Tested-by: jenkins Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> * target/target.c: adding keep_alive() to while loop. Adding the call to keep_alive() to suppress warnings when running the async flash algorithm. Issue observed when loading large pieces of code on slower debuggers. Change-Id: I7660fa05f68ebd7be07b2ca0a55b0f3b6ae718f3 Signed-off-by: Kevin Gillespie <kgills@gmail.com> Reviewed-on: http://openocd.zylin.com/4686 Tested-by: jenkins Reviewed-by: Jesse Marroquin Reviewed-by: Tomas Vanek <vanekt@fbl.cz> * drivers/cmsis-dap: speed up sending multiple HID requests The performance of CMSIS-DAP in long data transfers was improved substantially in ef02b69b14. But it not as good as some other USB/MCU based adapters. Using HID and therefore interrupt endpoint is slower than USB bulk transfer. CMSIS-DAP adapter implements multiple HID buffer handling and OpenOCD already reads number of buffers from info command. This change adds capability to sumbit more than one HID requests before driver waits for a HID response. This scenario is used for long transfers only. Results show about double speed on USB FS and ~140% speed on USB HS: | w/o this change | with multi HIDrq -----------------------------------------+-----------------+----------------- Open source CMSIS-DAP, USB FS, adapter_khz 1000 dump_image ram32k.bin 0x1fffe000 0x8000 | 23.225 KiB/s | 45.901 KiB/s load_image ram32k.bin 0x1fffe000 | 23.324 KiB/s | 46.552 KiB/s Cypress' Kitprog in CMSIS-DAP mode, USB FS, adapter_khz 1000 (over firmware limit) dump_image ram64k.bin 0x20000000 0x10000 | 15.537 KiB/s | 42.558 KiB/s load_image ram64k.bin 0x20000000 | 15.605 KiB/s | 43.291 KiB/s Atmel's EDBG, USB HS, adapter_khz 10000 (#3945 applied) dump_image ram384k.bin 0x20400000 0x6000 | 248.402 KiB/s | 345.250 KiB/s load_image ram384k.bin 0x20400000 | 256.039 KiB/s | 365.945 KiB/s Change-Id: I9edbe018086176d357c6aaba5d6b657a5e5e1c64 Signed-off-by: Tomas Vanek <vanekt@fbl.cz> Reviewed-on: http://openocd.zylin.com/4080 Tested-by: jenkins Reviewed-by: Paul Fertser <fercerpav@gmail.com> * tcl: target: omit apcsw for hla When using stlink for CM7 targets we have to rely on its firmware to do the right thing as direct DAP access is not possible. Change-Id: Ieee69f4eeea5c911f89f060f31ce86ed043bdfd0 Signed-off-by: Paul Fertser <fercerpav@gmail.com> Reviewed-on: http://openocd.zylin.com/4732 Tested-by: jenkins Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> Reviewed-by: Tomas Vanek <vanekt@fbl.cz> * flash/nor/at91samd: add SAMR21E19A DID While on it correct RAM amount of SAMR21x16A devices Change-Id: Ie9ab9de1551bdceff17af7597a9a2ee41f5aebe0 Signed-off-by: Tomas Vanek <vanekt@fbl.cz> Reviewed-on: http://openocd.zylin.com/4734 Reviewed-by: Eduardo Montoya Tested-by: jenkins * arm_adi_v5: do not deactivate power domains while trying to clear sticky error At OpenOCD start-up the operation of clearing the sticky error in CTRL/STAT register ignores the current value of the power domains bits CDBGPWRUPREQ and CSYSPWRUPREQ in the same register and incorrectly set them to zero. This abrupt disable does not follow the requirement in IHI0031 to wait for the acknowledgment of power disabled before continuing. The power domains are then re-enabled immediately after; it is possible that such short disable period has passed undetected or has been tested only on devices that do not implement the power domains. Anyway, this sequence is incorrect and can generate unexpected and hard-to-debug issues while OpenOCD attaches to a running target that implements power domains. Anticipate the initialization of dap->dp_ctrl_stat and use it while clearing the sticky bit. This has the additional effect of avoiding a power disable in the error recovery part of the function dap_dp_read_atomic(). Keep the same sequence of read/write in dap_dp_init() to avoid breaking the initialization of some problematic target. Add comments to document these choices. Change-Id: I8d6da788f2dd11909792b5d6b69bc90fbe4df25d Signed-off-by: Antonio Borneo <borneo.antonio@gmail.com> Reviewed-on: http://openocd.zylin.com/4677 Tested-by: jenkins Reviewed-by: Tomas Vanek <vanekt@fbl.cz> Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> * flash/nor/stm32f1x: Use of protection blocks, improved option bytes handling Handle write protection status in blocks instead of sectors, removing unnecessary complexity in the process. Now closer to stm32f2x. Support sequential modification of option bytes by read/modify/write directly to option bytes area instead of always starting with the currently loaded bytes from FLASH_OBR/WRPR registers. Added new command 'options_load' to force re-load of option bytes w/o having to power cycle target. Change-Id: I5c76191e29c17a1e11482df06379d10ca8d6d04d Signed-off-by: Dominik Peklo <dom.peklo@gmail.com> Signed-off-by: Tomas Vanek <vanekt@fbl.cz> Reviewed-on: http://openocd.zylin.com/4576 Tested-by: jenkins Reviewed-by: Jan Vojtěch <honza.vojtech@gmail.com> * target/cortex_a: remove unused code controlled by "fast_reg_read" The variable fast_reg_read is always zero, causing some code to never be executed. Such code try to read the target registers by dumping them in memory and then reading back the memory through the debugger. But it is broken due to lack of cache and MMU management. This code also uses the broken memory_ap access that is going to be removed soon. Remove all the code that depends on fast_reg_read not zero. Add a missing check on arm_dpm_read_current_registers() return. Keep the unused function cortex_a_dap_write_coreregister_u32() to balance the used "read" version. Change-Id: If2ff28a8c49eb0a87dc85207f5431978efd158db Signed-off-by: Antonio Borneo <borneo.antonio@gmail.com> Reviewed-on: http://openocd.zylin.com/4746 Tested-by: jenkins Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> * target/cortex_a: remove buggy memory AP accesses The armv7m debug port provides a direct access to the CPU memory bus, allowing the debugger to bypass the CPU for every memory operation. The armv7a debug port doesn't offer the same feature, mainly because CPU caches and MMU makes the direct memory access more tricky. Nevertheless most SoC with armv7a provide direct memory access through an AHB bus available on another DAP access port, different from the debug port. The original port of cortex_a in OpenOCD was inspired from the working cortex_m code, and provided optional memory access through the AHB, if present. The code for AHB access is problematic and partially buggy due to incomplete management of cache coherency and missing check of page boundary during virtual address operations. With the commit 5d458cf727 ("target/mem_ap: generic mem-ap target") we have a clean support for memory access through system buses connected to DAP AP, which obsoletes the buggy memory AP hack in cortex_a. Remove any code that uses the memory AP accesses in cortex_a. Change-Id: I7cd1f94885e5817448058953e043d8da90dea3cc Signed-off-by: Antonio Borneo <borneo.antonio@gmail.com> Reviewed-on: http://openocd.zylin.com/4748 Tested-by: jenkins Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> * target/arm_dpm: uniform names of exported functions The name of the function dpm_modeswitch() does not follow the common style of the other function names in the same file. Rename it as arm_dpm_modeswitch(). Change-Id: Idebf3c7bbddcd9b3c7b44f8d0dea1e5f7549b0eb Signed-off-by: Antonio Borneo <borneo.antonio@gmail.com> Reviewed-on: http://openocd.zylin.com/4756 Tested-by: jenkins Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> * target/cortex_a: remove duplicate code to read target registers The functions cortex_a_dap_{read,write}_coreregister_u32() are duplicate of the functions dpm_{read,write}_reg(). Remove both duplicated functions in cortex_a.c while export only dpm_read_reg(), since dpm_write_reg() is currently not used. Rename dpm_read_reg() as arm_dpm_read_reg() to keep uniform the naming style. Change-Id: I501bc99dc402039e630c47917a086a0bb382782c Signed-off-by: Antonio Borneo <borneo.antonio@gmail.com> Reviewed-on: http://openocd.zylin.com/4747 Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> Tested-by: jenkins * armv7a: ARMv7-A MMU tools factor out mmu-related code from armv7a.c, add a 'dump' command for page tables. Change-Id: Ic1ac3c645d7fd097e9d625c7c8302e7065875dd4 Signed-off-by: Matthias Welwarsky <matthias.welwarsky@sysgo.com> Reviewed-on: http://openocd.zylin.com/4327 Tested-by: jenkins Reviewed-by: Antonio Borneo <borneo.antonio@gmail.com> Reviewed-by: Matthias Welwarsky <matthias@welwarsky.de> * jtag/bitq: array boundary overflow The for loop inside bitq_path_move function is not correct, this will overflow the cmd->path array and produces an unpredictable result. Change-Id: I81e3bc9ee6d1dd948acd2fe4c667103ac22bb26f Signed-off-by: xuguangxiao <szgxxu@qq.com> Reviewed-on: http://openocd.zylin.com/4733 Tested-by: jenkins Reviewed-by: Tomas Vanek <vanekt@fbl.cz> * target/stm32h7x: Fix documentation of reset_config The stm32h7x.cfg does not specify connect_assert_srst or connect_deassert_srst in its reset_config. The comment claims that it will therefore connect in reset. However, per the manual, the default configuration is actually connect_deassert_srst, not connect_assert_srst. In actual fact, connect_assert_srst does not work on the STM32H7 because, while SRST is asserted, everything on the AXI bus is inaccessible. The CPU core is accessible, but since the examine-end event handler also pokes at the DBGMCU peripheral, that will fail in connect_assert_srst mode. So using connect_deassert_srst is appropriate, so fix the comment accordingly. Change-Id: If3e32e871fb19cc61183bdf911b7c5efd80b62e2 Signed-off-by: Christopher Head <chead@zaber.com> Reviewed-on: http://openocd.zylin.com/4741 Tested-by: jenkins Reviewed-by: Tomas Vanek <vanekt@fbl.cz> * docs: fix typo in manual Change-Id: I28717105eb2a907b0cb4b03f4b5ff1f47194413b Signed-off-by: Spencer Oliver <spen@spen-soft.co.uk> Reviewed-on: http://openocd.zylin.com/4751 Tested-by: jenkins Reviewed-by: Antonio Borneo <borneo.antonio@gmail.com> * README: fix stlink instructions Since 31c58c139d there is a unified config for all stlink versions. Change-Id: Id736063496ecd96e2024ed69dcb67a22c44b80bb Signed-off-by: Paul Fertser <fercerpav@gmail.com> Reviewed-on: http://openocd.zylin.com/4672 Tested-by: jenkins Reviewed-by: Antonio Borneo <borneo.antonio@gmail.com> * Permit null target on TCL connection In previous versions of OpenOCD, it was possible to connect to the TCL RPC interface without a current target. In `tcl_new_connection`, the curent target would be queried by number, and the possibility of a null current target was handled properly. In commit bb9d9c6026, the `get_target_by_num` call was replaced by a `get_current_target` call, without noticing that `get_current_target` aborts if there is no current target, whereas `tcl_new_connection` is perfectly able to handle that situation. Provide a `get_current_target_or_null` function for use by consumers who are OK with a null current target, and use it in `tcl_new_connection`. Change-Id: I06f7e1e149f1169e23c73ba328c7ad9f9425cc2a Signed-off-by: Christopher Head <chead@zaber.com> Reviewed-on: http://openocd.zylin.com/4730 Tested-by: jenkins Reviewed-by: Tomas Vanek <vanekt@fbl.cz> Reviewed-by: Franck Jullien <franck.jullien@gmail.com> * riscv_get_thread_reg_list matches new prototype. None of the existing test cases cause this function to be called. I suspect it never gets called, since it is weird to have a function that only returns the GPRs as a full list of registers. Change-Id: Ib54f182c1b2fc4dd711c877cb5c9b3e0af77461d * Fix conflict resolutions. Change-Id: I5228c308a08ee54530f8c1cadac2afe1c974d41e
2018-11-19 12:46:40 -08:00
parent 967238fb6f
commit 7079e0ca7d
89 changed files with 7241 additions and 1635 deletions
@@ -23,6 +23,7 @@ noinst_LTLIBRARIES += %D%/libtarget.la
 	$(NDS32_SRC) \
 	$(STM8_SRC) \
 	$(INTEL_IA32_SRC) \
+	$(ESIRISC_SRC) \
 	%D%/avrt.c \
 	%D%/dsp563xx.c \
 	%D%/dsp563xx_once.c \
@@ -74,8 +75,10 @@ ARMV7_SRC = \
 	%D%/armv7m_trace.c \
 	%D%/cortex_m.c \
 	%D%/armv7a.c \
+	%D%/armv7a_mmu.c \
 	%D%/cortex_a.c \
-	%D%/ls1_sap.c
+	%D%/ls1_sap.c \
+	%D%/mem_ap.c

 ARMV8_SRC = \
 	%D%/armv8_dpm.c \
@@ -138,6 +141,10 @@ INTEL_IA32_SRC = \
 	%D%/lakemont.c \
 	%D%/x86_32_common.c

+ESIRISC_SRC = \
+	%D%/esirisc.c \
+	%D%/esirisc_jtag.c
+
 %C%_libtarget_la_SOURCES += \
 	%D%/algorithm.h \
 	%D%/arm.h \
@@ -146,6 +153,7 @@ INTEL_IA32_SRC = \
 	%D%/arm_adi_v5.h \
 	%D%/armv7a_cache.h \
 	%D%/armv7a_cache_l2x.h \
+	%D%/armv7a_mmu.h \
 	%D%/arm_disassembler.h \
 	%D%/arm_opcodes.h \
 	%D%/arm_simulator.h \
@@ -217,7 +225,10 @@ INTEL_IA32_SRC = \
 	%D%/stm8.h \
 	%D%/lakemont.h \
 	%D%/x86_32_common.h \
-	%D%/arm_cti.h
+	%D%/arm_cti.h \
+	%D%/esirisc.h \
+	%D%/esirisc_jtag.h \
+	%D%/esirisc_regs.h

 include %D%/openrisc/Makefile.am
 include %D%/riscv/Makefile.am
@@ -652,6 +652,15 @@ int dap_dp_init(struct adiv5_dap *dap)

 	dap_invalidate_cache(dap);

+	/*
+	 * Early initialize dap->dp_ctrl_stat.
+	 * In jtag mode only, if the following atomic reads fail and set the
+	 * sticky error, it will trigger the clearing of the sticky. Without this
+	 * initialization system and debug power would be disabled while clearing
+	 * the sticky error bit.
+	 */
+	dap->dp_ctrl_stat = CDBGPWRUPREQ | CSYSPWRUPREQ;
+
 	for (size_t i = 0; i < 30; i++) {
 		/* DP initialization */

@@ -660,7 +669,18 @@ int dap_dp_init(struct adiv5_dap *dap)
 			break;
 	}

-	retval = dap_queue_dp_write(dap, DP_CTRL_STAT, SSTICKYERR);
+	/*
+	 * This write operation clears the sticky error bit in jtag mode only and
+	 * is ignored in swd mode. It also powers-up system and debug domains in
+	 * both jtag and swd modes, if not done before.
+	 * Actually we do not need to clear the sticky error here because it has
+	 * been already cleared (if it was set) in the previous atomic read. This
+	 * write could be removed, but this initial part of dap_dp_init() is the
+	 * result of years of fine tuning and there are strong concerns about any
+	 * unnecessary code change. It doesn't harm, so let's keep it here and
+	 * preserve the historical sequence of read/write operations!
+	 */
+	retval = dap_queue_dp_write(dap, DP_CTRL_STAT, dap->dp_ctrl_stat | SSTICKYERR);
 	if (retval != ERROR_OK)
 		return retval;

@@ -668,7 +688,6 @@ int dap_dp_init(struct adiv5_dap *dap)
 	if (retval != ERROR_OK)
 		return retval;

-	dap->dp_ctrl_stat = CDBGPWRUPREQ | CSYSPWRUPREQ;
 	retval = dap_queue_dp_write(dap, DP_CTRL_STAT, dap->dp_ctrl_stat);
 	if (retval != ERROR_OK)
 		return retval;
@@ -793,7 +812,7 @@ int dap_find_ap(struct adiv5_dap *dap, enum ap_type type_to_find, struct adiv5_a
 	int ap_num;

 	/* Maximum AP number is 255 since the SELECT register is 8 bits */
-	for (ap_num = 0; ap_num <= 255; ap_num++) {
+	for (ap_num = 0; ap_num <= DP_APSEL_MAX; ap_num++) {

 		/* read the IDR register of the Access Port */
 		uint32_t id_val = 0;
@@ -1429,7 +1448,7 @@ int adiv5_jim_configure(struct target *target, Jim_GetOptInfo *goi)
 	pc = (struct adiv5_private_config *)target->private_config;
 	if (pc == NULL) {
 		pc = calloc(1, sizeof(struct adiv5_private_config));
-		pc->ap_num = -1;
+		pc->ap_num = DP_APSEL_INVALID;
 		target->private_config = pc;
 	}

@@ -1498,6 +1517,10 @@ int adiv5_jim_configure(struct target *target, Jim_GetOptInfo *goi)
 				e = Jim_GetOpt_Wide(goi, &ap_num);
 				if (e != JIM_OK)
 					return e;
+				if (ap_num < 0 || ap_num > DP_APSEL_MAX) {
+					Jim_SetResultString(goi->interp, "Invalid AP number!", -1);
+					return JIM_ERR;
+				}
 				pc->ap_num = ap_num;
 			} else {
 				if (goi->argc != 0) {
@@ -1507,11 +1530,11 @@ int adiv5_jim_configure(struct target *target, Jim_GetOptInfo *goi)
 					return JIM_ERR;
 				}

-				if (pc->ap_num < 0) {
+				if (pc->ap_num == DP_APSEL_INVALID) {
 					Jim_SetResultString(goi->interp, "AP number not configured", -1);
 					return JIM_ERR;
 				}
-				Jim_SetResult(goi->interp, Jim_NewIntObj(goi->interp, (int)pc->ap_num));
+				Jim_SetResult(goi->interp, Jim_NewIntObj(goi->interp, pc->ap_num));
 			}
 			break;
 		}
@@ -1543,7 +1566,7 @@ COMMAND_HANDLER(handle_dap_info_command)
 		break;
 	case 1:
 		COMMAND_PARSE_NUMBER(u32, CMD_ARGV[0], apsel);
-		if (apsel >= 256)
+		if (apsel > DP_APSEL_MAX)
 			return ERROR_COMMAND_SYNTAX_ERROR;
 		break;
 	default:
@@ -1566,7 +1589,7 @@ COMMAND_HANDLER(dap_baseaddr_command)
 	case 1:
 		COMMAND_PARSE_NUMBER(u32, CMD_ARGV[0], apsel);
 		/* AP address is in bits 31:24 of DP_SELECT */
-		if (apsel >= 256)
+		if (apsel > DP_APSEL_MAX)
 			return ERROR_COMMAND_SYNTAX_ERROR;
 		break;
 	default:
@@ -1625,7 +1648,7 @@ COMMAND_HANDLER(dap_apsel_command)
 	case 1:
 		COMMAND_PARSE_NUMBER(u32, CMD_ARGV[0], apsel);
 		/* AP address is in bits 31:24 of DP_SELECT */
-		if (apsel >= 256)
+		if (apsel > DP_APSEL_MAX)
 			return ERROR_COMMAND_SYNTAX_ERROR;
 		break;
 	default:
@@ -1691,7 +1714,7 @@ COMMAND_HANDLER(dap_apid_command)
 	case 1:
 		COMMAND_PARSE_NUMBER(u32, CMD_ARGV[0], apsel);
 		/* AP address is in bits 31:24 of DP_SELECT */
-		if (apsel >= 256)
+		if (apsel > DP_APSEL_MAX)
 			return ERROR_COMMAND_SYNTAX_ERROR;
 		break;
 	default:
@@ -1722,7 +1745,7 @@ COMMAND_HANDLER(dap_apreg_command)

 	COMMAND_PARSE_NUMBER(u32, CMD_ARGV[0], apsel);
 	/* AP address is in bits 31:24 of DP_SELECT */
-	if (apsel >= 256)
+	if (apsel > DP_APSEL_MAX)
 		return ERROR_COMMAND_SYNTAX_ERROR;
 	ap = dap_ap(dap, apsel);

@@ -1734,8 +1757,10 @@ COMMAND_HANDLER(dap_apreg_command)
 		COMMAND_PARSE_NUMBER(u32, CMD_ARGV[2], value);
 		switch (reg) {
 		case MEM_AP_REG_CSW:
-			ap->csw_default = 0;  /* invalid, force write */
-			retval = mem_ap_setup_csw(ap, value);
+			ap->csw_value = 0;  /* invalid, in case write fails */
+			retval = dap_queue_ap_write(ap, reg, value);
+			if (retval == ERROR_OK)
+				ap->csw_value = value;
 			break;
 		case MEM_AP_REG_TAR:
 			ap->tar_valid = false;  /* invalid, force write */
@@ -136,6 +136,9 @@
 #define DP_SELECT_DPBANK 0x0000000F
 #define DP_SELECT_INVALID 0x00FFFF00 /* Reserved bits one */

+#define DP_APSEL_MAX        (255)
+#define DP_APSEL_INVALID    (-1)
+
 /**
 * This represents an ARM Debug Interface (v5) Access Port (AP).
 * Most common is a MEM-AP, for memory access.
@@ -431,6 +431,10 @@ static int cti_configure(Jim_GetOptInfo *goi, struct arm_cti_object *cti)
 			e = Jim_GetOpt_Wide(goi, &w);
 			if (e != JIM_OK)
 				return e;
+			if (w < 0 || w > DP_APSEL_MAX) {
+				Jim_SetResultString(goi->interp, "-ap-num is invalid", -1);
+				return JIM_ERR;
+			}
 			cti->ap_num = (uint32_t)w;
 		}
 	}
@@ -48,7 +48,7 @@ static void dap_instance_init(struct adiv5_dap *dap)
 {
 	int i;
 	/* Set up with safe defaults */
-	for (i = 0; i <= 255; i++) {
+	for (i = 0; i <= DP_APSEL_MAX; i++) {
 		dap->ap[i].dap = dap;
 		dap->ap[i].ap_num = i;
 		/* memaccess_tck max is 255 */
@@ -319,7 +319,7 @@ COMMAND_HANDLER(handle_dap_info_command)
 			break;
 		case 1:
 			COMMAND_PARSE_NUMBER(u32, CMD_ARGV[0], apsel);
-			if (apsel >= 256)
+			if (apsel > DP_APSEL_MAX)
 				return ERROR_COMMAND_SYNTAX_ERROR;
 			break;
 		default:
@@ -108,7 +108,7 @@ static int dpm_mcr(struct target *target, int cpnum,
 /* Toggles between recorded core mode (USR, SVC, etc) and a temporary one.
 * Routines *must* restore the original mode before returning!!
 */
-int dpm_modeswitch(struct arm_dpm *dpm, enum arm_mode mode)
+int arm_dpm_modeswitch(struct arm_dpm *dpm, enum arm_mode mode)
 {
 	int retval;
 	uint32_t cpsr;
@@ -168,7 +168,7 @@ static int dpm_read_reg_u64(struct arm_dpm *dpm, struct reg *r, unsigned regnum)
 }

 /* just read the register -- rely on the core mode being right */
-static int dpm_read_reg(struct arm_dpm *dpm, struct reg *r, unsigned regnum)
+int arm_dpm_read_reg(struct arm_dpm *dpm, struct reg *r, unsigned regnum)
 {
 	uint32_t value;
 	int retval;
@@ -352,7 +352,7 @@ int arm_dpm_read_current_registers(struct arm_dpm *dpm)
 	for (unsigned i = 0; i < 2; i++) {
 		r = arm->core_cache->reg_list + i;
 		if (!r->valid) {
-			retval = dpm_read_reg(dpm, r, i);
+			retval = arm_dpm_read_reg(dpm, r, i);
 			if (retval != ERROR_OK)
 				goto fail;
 		}
@@ -372,7 +372,7 @@ int arm_dpm_read_current_registers(struct arm_dpm *dpm)
 		if (r->valid)
 			continue;

-		retval = dpm_read_reg(dpm, r, i);
+		retval = arm_dpm_read_reg(dpm, r, i);
 		if (retval != ERROR_OK)
 			goto fail;
 	}
@@ -543,7 +543,7 @@ int arm_dpm_write_dirty_registers(struct arm_dpm *dpm, bool bpwp)

 				/* REVISIT error checks */
 				if (tmode != ARM_MODE_ANY) {
-					retval = dpm_modeswitch(dpm, tmode);
+					retval = arm_dpm_modeswitch(dpm, tmode);
 					if (retval != ERROR_OK)
 						goto done;
 				}
@@ -564,7 +564,7 @@ int arm_dpm_write_dirty_registers(struct arm_dpm *dpm, bool bpwp)
 	 * or it's dirty.  Must write PC to ensure the return address is
 	 * defined, and must not write it before CPSR.
 	 */
-	retval = dpm_modeswitch(dpm, ARM_MODE_ANY);
+	retval = arm_dpm_modeswitch(dpm, ARM_MODE_ANY);
 	if (retval != ERROR_OK)
 		goto done;
 	arm->cpsr->dirty = false;
@@ -671,18 +671,18 @@ static int arm_dpm_read_core_reg(struct target *target, struct reg *r,
 		return retval;

 	if (mode != ARM_MODE_ANY) {
-		retval = dpm_modeswitch(dpm, mode);
+		retval = arm_dpm_modeswitch(dpm, mode);
 		if (retval != ERROR_OK)
 			goto fail;
 	}

-	retval = dpm_read_reg(dpm, r, regnum);
+	retval = arm_dpm_read_reg(dpm, r, regnum);
 	if (retval != ERROR_OK)
 		goto fail;
 	/* always clean up, regardless of error */

 	if (mode != ARM_MODE_ANY)
-		/* (void) */ dpm_modeswitch(dpm, ARM_MODE_ANY);
+		/* (void) */ arm_dpm_modeswitch(dpm, ARM_MODE_ANY);

 fail:
 	/* (void) */ dpm->finish(dpm);
@@ -715,7 +715,7 @@ static int arm_dpm_write_core_reg(struct target *target, struct reg *r,
 		return retval;

 	if (mode != ARM_MODE_ANY) {
-		retval = dpm_modeswitch(dpm, mode);
+		retval = arm_dpm_modeswitch(dpm, mode);
 		if (retval != ERROR_OK)
 			goto fail;
 	}
@@ -724,7 +724,7 @@ static int arm_dpm_write_core_reg(struct target *target, struct reg *r,
 	/* always clean up, regardless of error */

 	if (mode != ARM_MODE_ANY)
-		/* (void) */ dpm_modeswitch(dpm, ARM_MODE_ANY);
+		/* (void) */ arm_dpm_modeswitch(dpm, ARM_MODE_ANY);

 fail:
 	/* (void) */ dpm->finish(dpm);
@@ -773,9 +773,9 @@ static int arm_dpm_full_context(struct target *target)
 				 * in FIQ mode we need to patch mode.
 				 */
 				if (mode != ARM_MODE_ANY)
-					retval = dpm_modeswitch(dpm, mode);
+					retval = arm_dpm_modeswitch(dpm, mode);
 				else
-					retval = dpm_modeswitch(dpm, ARM_MODE_USR);
+					retval = arm_dpm_modeswitch(dpm, ARM_MODE_USR);

 				if (retval != ERROR_OK)
 					goto done;
@@ -784,7 +784,7 @@ static int arm_dpm_full_context(struct target *target)
 				continue;

 			/* CPSR was read, so "R16" must mean SPSR */
-			retval = dpm_read_reg(dpm,
+			retval = arm_dpm_read_reg(dpm,
 					&cache->reg_list[i],
 					(r->num == 16) ? 17 : r->num);
 			if (retval != ERROR_OK)
@@ -793,7 +793,7 @@ static int arm_dpm_full_context(struct target *target)

 	} while (did_read);

-	retval = dpm_modeswitch(dpm, ARM_MODE_ANY);
+	retval = arm_dpm_modeswitch(dpm, ARM_MODE_ANY);
 	/* (void) */ dpm->finish(dpm);
 done:
 	return retval;
@@ -152,8 +152,9 @@ struct arm_dpm {
 int arm_dpm_setup(struct arm_dpm *dpm);
 int arm_dpm_initialize(struct arm_dpm *dpm);

+int arm_dpm_read_reg(struct arm_dpm *dpm, struct reg *r, unsigned regnum);
 int arm_dpm_read_current_registers(struct arm_dpm *);
-int dpm_modeswitch(struct arm_dpm *dpm, enum arm_mode mode);
+int arm_dpm_modeswitch(struct arm_dpm *dpm, enum arm_mode mode);

 int arm_dpm_write_dirty_registers(struct arm_dpm *, bool bpwp);

@@ -24,6 +24,7 @@
 #include <helper/replacements.h>

 #include "armv7a.h"
+#include "armv7a_mmu.h"
 #include "arm_disassembler.h"

 #include "register.h"
@@ -188,174 +189,6 @@ done:
 	return retval;
 }

-/*  method adapted to Cortex-A : reused ARM v4 v5 method */
-int armv7a_mmu_translate_va(struct target *target,  uint32_t va, uint32_t *val)
-{
-	uint32_t first_lvl_descriptor = 0x0;
-	uint32_t second_lvl_descriptor = 0x0;
-	int retval;
-	struct armv7a_common *armv7a = target_to_armv7a(target);
-	uint32_t ttbidx = 0;	/*  default to ttbr0 */
-	uint32_t ttb_mask;
-	uint32_t va_mask;
-	uint32_t ttb;
-
-	if (target->state != TARGET_HALTED)
-		LOG_INFO("target not halted, using cached values for translation table!");
-
-	/* if va is above the range handled by ttbr0, select ttbr1 */
-	if (va > armv7a->armv7a_mmu.ttbr_range[0]) {
-		/*  select ttb 1 */
-		ttbidx = 1;
-	}
-
-	ttb = armv7a->armv7a_mmu.ttbr[ttbidx];
-	ttb_mask = armv7a->armv7a_mmu.ttbr_mask[ttbidx];
-	va_mask = 0xfff00000 & armv7a->armv7a_mmu.ttbr_range[ttbidx];
-
-	LOG_DEBUG("ttb_mask %" PRIx32 " va_mask %" PRIx32 " ttbidx %i",
-		  ttb_mask, va_mask, ttbidx);
-	retval = armv7a->armv7a_mmu.read_physical_memory(target,
-			(ttb & ttb_mask) | ((va & va_mask) >> 18),
-			4, 1, (uint8_t *)&first_lvl_descriptor);
-	if (retval != ERROR_OK)
-		return retval;
-	first_lvl_descriptor = target_buffer_get_u32(target, (uint8_t *)
-			&first_lvl_descriptor);
-	/*  reuse armv4_5 piece of code, specific armv7a changes may come later */
-	LOG_DEBUG("1st lvl desc: %8.8" PRIx32 "", first_lvl_descriptor);
-
-	if ((first_lvl_descriptor & 0x3) == 0) {
-		LOG_ERROR("Address translation failure");
-		return ERROR_TARGET_TRANSLATION_FAULT;
-	}
-
-
-	if ((first_lvl_descriptor & 0x40002) == 2) {
-		/* section descriptor */
-		*val = (first_lvl_descriptor & 0xfff00000) | (va & 0x000fffff);
-		return ERROR_OK;
-	} else if ((first_lvl_descriptor & 0x40002) == 0x40002) {
-		/* supersection descriptor */
-		if (first_lvl_descriptor & 0x00f001e0) {
-			LOG_ERROR("Physical address does not fit into 32 bits");
-			return ERROR_TARGET_TRANSLATION_FAULT;
-		}
-		*val = (first_lvl_descriptor & 0xff000000) | (va & 0x00ffffff);
-		return ERROR_OK;
-	}
-
-	/* page table */
-	retval = armv7a->armv7a_mmu.read_physical_memory(target,
-			(first_lvl_descriptor & 0xfffffc00) | ((va & 0x000ff000) >> 10),
-			4, 1, (uint8_t *)&second_lvl_descriptor);
-	if (retval != ERROR_OK)
-		return retval;
-
-	second_lvl_descriptor = target_buffer_get_u32(target, (uint8_t *)
-			&second_lvl_descriptor);
-
-	LOG_DEBUG("2nd lvl desc: %8.8" PRIx32 "", second_lvl_descriptor);
-
-	if ((second_lvl_descriptor & 0x3) == 0) {
-		LOG_ERROR("Address translation failure");
-		return ERROR_TARGET_TRANSLATION_FAULT;
-	}
-
-	if ((second_lvl_descriptor & 0x3) == 1) {
-		/* large page descriptor */
-		*val = (second_lvl_descriptor & 0xffff0000) | (va & 0x0000ffff);
-	} else {
-		/* small page descriptor */
-		*val = (second_lvl_descriptor & 0xfffff000) | (va & 0x00000fff);
-	}
-
-	return ERROR_OK;
-}
-
-/*  V7 method VA TO PA  */
-int armv7a_mmu_translate_va_pa(struct target *target, uint32_t va,
-	uint32_t *val, int meminfo)
-{
-	int retval = ERROR_FAIL;
-	struct armv7a_common *armv7a = target_to_armv7a(target);
-	struct arm_dpm *dpm = armv7a->arm.dpm;
-	uint32_t virt = va & ~0xfff;
-	uint32_t NOS, NS, INNER, OUTER;
-	*val = 0xdeadbeef;
-	retval = dpm->prepare(dpm);
-	if (retval != ERROR_OK)
-		goto done;
-	/*  mmu must be enable in order to get a correct translation
-	 *  use VA to PA CP15 register for conversion */
-	retval = dpm->instr_write_data_r0(dpm,
-			ARMV4_5_MCR(15, 0, 0, 7, 8, 0),
-			virt);
-	if (retval != ERROR_OK)
-		goto done;
-	retval = dpm->instr_read_data_r0(dpm,
-			ARMV4_5_MRC(15, 0, 0, 7, 4, 0),
-			val);
-	/* decode memory attribute */
-	NOS = (*val >> 10) & 1;	/*  Not Outer shareable */
-	NS = (*val >> 9) & 1;	/* Non secure */
-	INNER = (*val >> 4) &  0x7;
-	OUTER = (*val >> 2) & 0x3;
-
-	if (retval != ERROR_OK)
-		goto done;
-	*val = (*val & ~0xfff)  +  (va & 0xfff);
-	if (*val == va)
-		LOG_WARNING("virt = phys  : MMU disable !!");
-	if (meminfo) {
-		LOG_INFO("%" PRIx32 " : %" PRIx32 " %s outer shareable %s secured",
-			va, *val,
-			NOS == 1 ? "not" : " ",
-			NS == 1 ? "not" : "");
-		switch (OUTER) {
-			case 0:
-				LOG_INFO("outer: Non-Cacheable");
-				break;
-			case 1:
-				LOG_INFO("outer: Write-Back, Write-Allocate");
-				break;
-			case 2:
-				LOG_INFO("outer: Write-Through, No Write-Allocate");
-				break;
-			case 3:
-				LOG_INFO("outer: Write-Back, no Write-Allocate");
-				break;
-		}
-		switch (INNER) {
-			case 0:
-				LOG_INFO("inner: Non-Cacheable");
-				break;
-			case 1:
-				LOG_INFO("inner: Strongly-ordered");
-				break;
-			case 3:
-				LOG_INFO("inner: Device");
-				break;
-			case 5:
-				LOG_INFO("inner: Write-Back, Write-Allocate");
-				break;
-			case 6:
-				LOG_INFO("inner:  Write-Through");
-				break;
-			case 7:
-				LOG_INFO("inner: Write-Back, no Write-Allocate");
-				break;
-			default:
-				LOG_INFO("inner: %" PRIx32 " ???", INNER);
-		}
-	}
-
-done:
-	dpm->finish(dpm);
-
-	return retval;
-}
-
 /* FIXME: remove it */
 static int armv7a_l2x_cache_init(struct target *target, uint32_t base, uint32_t way)
 {
@@ -106,8 +106,6 @@ struct armv7a_common {
 	struct arm_dpm dpm;
 	uint32_t debug_base;
 	struct adiv5_ap *debug_ap;
-	struct adiv5_ap *memory_ap;
-	bool memory_ap_available;
 	/* mdir */
 	uint8_t multi_processor_system;
 	uint8_t cluster_id;
@@ -188,9 +186,6 @@ static inline bool is_armv7a(struct armv7a_common *armv7a)
 int armv7a_arch_state(struct target *target);
 int armv7a_identify_cache(struct target *target);
 int armv7a_init_arch_info(struct target *target, struct armv7a_common *armv7a);
-int armv7a_mmu_translate_va_pa(struct target *target, uint32_t va,
-		uint32_t *val, int meminfo);
-int armv7a_mmu_translate_va(struct target *target,  uint32_t va, uint32_t *val);

 int armv7a_handle_cache_info_command(struct command_context *cmd_ctx,
 		struct armv7a_cache_common *armv7a_cache);
@@ -0,0 +1,456 @@
+/***************************************************************************
+ *   Copyright (C) 2016 by Matthias Welwarsky                              *
+ *   matthias.welwarsky@sysgo.com                                          *
+ *                                                                         *
+ *   Copyright (C) ST-Ericsson SA 2011 michel.jaouen@stericsson.com        *
+ *                                                                         *
+ *   This program is free software; you can redistribute it and/or modify  *
+ *   it under the terms of the GNU General Public License as published by  *
+ *   the Free Software Foundation; either version 2 of the License, or     *
+ *   (at your option) any later version.                                   *
+ *                                                                         *
+ *   This program is distributed in the hope that it will be useful,       *
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of        *
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
+ *   GNU General Public License for more details.                          *
+ *                                                                         *
+ *   You should have received a copy of the GNU General Public License     *
+ *   along with this program.  If not, see <http://www.gnu.org/licenses/>. *
+ ***************************************************************************/
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <helper/binarybuffer.h>
+#include <helper/command.h>
+
+#include "jtag/interface.h"
+#include "arm.h"
+#include "armv7a.h"
+#include "armv7a_mmu.h"
+#include "arm_opcodes.h"
+#include "cortex_a.h"
+
+#define SCTLR_BIT_AFE (1 << 29)
+
+/*  method adapted to Cortex-A : reused ARM v4 v5 method */
+int armv7a_mmu_translate_va(struct target *target,  uint32_t va, uint32_t *val)
+{
+	uint32_t first_lvl_descriptor = 0x0;
+	uint32_t second_lvl_descriptor = 0x0;
+	int retval;
+	struct armv7a_common *armv7a = target_to_armv7a(target);
+	uint32_t ttbidx = 0;	/*  default to ttbr0 */
+	uint32_t ttb_mask;
+	uint32_t va_mask;
+	uint32_t ttb;
+
+	if (target->state != TARGET_HALTED)
+		LOG_INFO("target not halted, using cached values for translation table!");
+
+	/* if va is above the range handled by ttbr0, select ttbr1 */
+	if (va > armv7a->armv7a_mmu.ttbr_range[0]) {
+		/*  select ttb 1 */
+		ttbidx = 1;
+	}
+
+	ttb = armv7a->armv7a_mmu.ttbr[ttbidx];
+	ttb_mask = armv7a->armv7a_mmu.ttbr_mask[ttbidx];
+	va_mask = 0xfff00000 & armv7a->armv7a_mmu.ttbr_range[ttbidx];
+
+	LOG_DEBUG("ttb_mask %" PRIx32 " va_mask %" PRIx32 " ttbidx %i",
+		  ttb_mask, va_mask, ttbidx);
+	retval = armv7a->armv7a_mmu.read_physical_memory(target,
+			(ttb & ttb_mask) | ((va & va_mask) >> 18),
+			4, 1, (uint8_t *)&first_lvl_descriptor);
+	if (retval != ERROR_OK)
+		return retval;
+	first_lvl_descriptor = target_buffer_get_u32(target, (uint8_t *)
+			&first_lvl_descriptor);
+	/*  reuse armv4_5 piece of code, specific armv7a changes may come later */
+	LOG_DEBUG("1st lvl desc: %8.8" PRIx32 "", first_lvl_descriptor);
+
+	if ((first_lvl_descriptor & 0x3) == 0) {
+		LOG_ERROR("Address translation failure");
+		return ERROR_TARGET_TRANSLATION_FAULT;
+	}
+
+	if ((first_lvl_descriptor & 0x40002) == 2) {
+		/* section descriptor */
+		*val = (first_lvl_descriptor & 0xfff00000) | (va & 0x000fffff);
+		return ERROR_OK;
+	} else if ((first_lvl_descriptor & 0x40002) == 0x40002) {
+		/* supersection descriptor */
+		if (first_lvl_descriptor & 0x00f001e0) {
+			LOG_ERROR("Physical address does not fit into 32 bits");
+			return ERROR_TARGET_TRANSLATION_FAULT;
+		}
+		*val = (first_lvl_descriptor & 0xff000000) | (va & 0x00ffffff);
+		return ERROR_OK;
+	}
+
+	/* page table */
+	retval = armv7a->armv7a_mmu.read_physical_memory(target,
+			(first_lvl_descriptor & 0xfffffc00) | ((va & 0x000ff000) >> 10),
+			4, 1, (uint8_t *)&second_lvl_descriptor);
+	if (retval != ERROR_OK)
+		return retval;
+
+	second_lvl_descriptor = target_buffer_get_u32(target, (uint8_t *)
+			&second_lvl_descriptor);
+
+	LOG_DEBUG("2nd lvl desc: %8.8" PRIx32 "", second_lvl_descriptor);
+
+	if ((second_lvl_descriptor & 0x3) == 0) {
+		LOG_ERROR("Address translation failure");
+		return ERROR_TARGET_TRANSLATION_FAULT;
+	}
+
+	if ((second_lvl_descriptor & 0x3) == 1) {
+		/* large page descriptor */
+		*val = (second_lvl_descriptor & 0xffff0000) | (va & 0x0000ffff);
+	} else {
+		/* small page descriptor */
+		*val = (second_lvl_descriptor & 0xfffff000) | (va & 0x00000fff);
+	}
+
+	return ERROR_OK;
+}
+
+/*  V7 method VA TO PA  */
+int armv7a_mmu_translate_va_pa(struct target *target, uint32_t va,
+	uint32_t *val, int meminfo)
+{
+	int retval = ERROR_FAIL;
+	struct armv7a_common *armv7a = target_to_armv7a(target);
+	struct arm_dpm *dpm = armv7a->arm.dpm;
+	uint32_t virt = va & ~0xfff;
+	uint32_t NOS, NS, INNER, OUTER;
+	*val = 0xdeadbeef;
+	retval = dpm->prepare(dpm);
+	if (retval != ERROR_OK)
+		goto done;
+	/*  mmu must be enable in order to get a correct translation
+	 *  use VA to PA CP15 register for conversion */
+	retval = dpm->instr_write_data_r0(dpm,
+			ARMV4_5_MCR(15, 0, 0, 7, 8, 0),
+			virt);
+	if (retval != ERROR_OK)
+		goto done;
+	retval = dpm->instr_read_data_r0(dpm,
+			ARMV4_5_MRC(15, 0, 0, 7, 4, 0),
+			val);
+	/* decode memory attribute */
+	NOS = (*val >> 10) & 1;	/*  Not Outer shareable */
+	NS = (*val >> 9) & 1;	/* Non secure */
+	INNER = (*val >> 4) &  0x7;
+	OUTER = (*val >> 2) & 0x3;
+
+	if (retval != ERROR_OK)
+		goto done;
+	*val = (*val & ~0xfff)  +  (va & 0xfff);
+	if (*val == va)
+		LOG_WARNING("virt = phys  : MMU disable !!");
+	if (meminfo) {
+		LOG_INFO("%" PRIx32 " : %" PRIx32 " %s outer shareable %s secured",
+			va, *val,
+			NOS == 1 ? "not" : " ",
+			NS == 1 ? "not" : "");
+		switch (OUTER) {
+			case 0:
+				LOG_INFO("outer: Non-Cacheable");
+				break;
+			case 1:
+				LOG_INFO("outer: Write-Back, Write-Allocate");
+				break;
+			case 2:
+				LOG_INFO("outer: Write-Through, No Write-Allocate");
+				break;
+			case 3:
+				LOG_INFO("outer: Write-Back, no Write-Allocate");
+				break;
+		}
+		switch (INNER) {
+			case 0:
+				LOG_INFO("inner: Non-Cacheable");
+				break;
+			case 1:
+				LOG_INFO("inner: Strongly-ordered");
+				break;
+			case 3:
+				LOG_INFO("inner: Device");
+				break;
+			case 5:
+				LOG_INFO("inner: Write-Back, Write-Allocate");
+				break;
+			case 6:
+				LOG_INFO("inner:  Write-Through");
+				break;
+			case 7:
+				LOG_INFO("inner: Write-Back, no Write-Allocate");
+				break;
+			default:
+				LOG_INFO("inner: %" PRIx32 " ???", INNER);
+		}
+	}
+
+done:
+	dpm->finish(dpm);
+
+	return retval;
+}
+
+static const char *desc_bits_to_string(bool c_bit, bool b_bit, bool s_bit, bool ap2, int ap10, bool afe)
+{
+	static char bits_string[64];
+	unsigned int len;
+
+	if (afe) {
+		bool acc_r = true;
+		bool acc_w = !ap2;
+		bool priv = !(ap10 & 2);
+		len = snprintf(bits_string, sizeof(bits_string), "%s%s%s access%s: %s%s",
+					   s_bit ? "S " : "", c_bit ? "C " : "", b_bit ? "B " : "",
+				 priv ? "(priv)" : "", acc_r ? "R" : "N", acc_w ? "W " : "O ");
+	} else {
+		bool priv_acc_w = !ap2;
+		bool priv_acc_r = true;
+		bool unpriv_acc_w = priv_acc_w;
+		bool unpriv_acc_r = priv_acc_r;
+
+		switch (ap10) {
+		case 0:
+			priv_acc_r = priv_acc_w = false;
+			unpriv_acc_r = unpriv_acc_w = false;
+			break;
+		case 1:
+			unpriv_acc_r = unpriv_acc_w = false;
+			break;
+		case 2:
+			unpriv_acc_w = false;
+			break;
+		default:
+			break;
+		}
+
+		len = snprintf(bits_string, sizeof(bits_string), "%s%s%s access(priv): %s%s access(unpriv): %s%s",
+				s_bit ? "S " : "", c_bit ? "C " : "", b_bit ? "B " : "", priv_acc_r ? "R" : "N", priv_acc_w ? "W" : "O",
+				unpriv_acc_r ? "R" : "N", unpriv_acc_w ? "W" : "O");
+	}
+
+	if (len >= sizeof(bits_string))
+		bits_string[63] = 0;
+
+	return bits_string;
+}
+
+static const char *l2_desc_bits_to_string(uint32_t l2_desc, bool afe)
+{
+	bool c_bit = !!(l2_desc & (1 << 3));
+	bool b_bit = !!(l2_desc & (1 << 2));
+	bool s_bit = !!(l2_desc & (1 << 10));
+	bool ap2 = !!(l2_desc & (1 << 9));
+	int ap10 = (l2_desc >> 4) & 3;
+
+	return desc_bits_to_string(c_bit, b_bit, s_bit, ap2, ap10, afe);
+}
+
+static const char *l1_desc_bits_to_string(uint32_t l1_desc, bool afe)
+{
+	bool c_bit = !!(l1_desc & (1 << 3));
+	bool b_bit = !!(l1_desc & (1 << 2));
+	bool s_bit = !!(l1_desc & (1 << 16));
+	bool ap2 = !!(l1_desc & (1 << 15));
+	int ap10 = (l1_desc >> 10) & 3;
+
+	return desc_bits_to_string(c_bit, b_bit, s_bit, ap2, ap10, afe);
+}
+
+COMMAND_HANDLER(armv7a_mmu_dump_table)
+{
+	struct target *target = get_current_target(CMD_CTX);
+	struct cortex_a_common *cortex_a = target_to_cortex_a(target);
+	struct armv7a_common *armv7a = target_to_armv7a(target);
+	struct armv7a_mmu_common *mmu = &armv7a->armv7a_mmu;
+	struct armv7a_cache_common *cache = &mmu->armv7a_cache;
+	uint32_t *first_lvl_ptbl;
+	target_addr_t ttb;
+	int ttbidx = 0;
+	int retval;
+	int pt_idx;
+	int max_pt_idx = 4095;
+	bool afe;
+
+	if (CMD_ARGC < 1)
+		return ERROR_COMMAND_SYNTAX_ERROR;
+
+	if (!strcmp(CMD_ARGV[0], "addr")) {
+		if (CMD_ARGC < 2)
+			return ERROR_COMMAND_SYNTAX_ERROR;
+
+		COMMAND_PARSE_NUMBER(target_addr, CMD_ARGV[1], ttb);
+
+		if (CMD_ARGC > 2) {
+			COMMAND_PARSE_NUMBER(int, CMD_ARGV[2], max_pt_idx);
+
+			if (max_pt_idx < 1 || max_pt_idx > 4096)
+				return ERROR_COMMAND_ARGUMENT_INVALID;
+			max_pt_idx -= 1;
+		}
+	} else {
+		if (mmu->cached != 1) {
+			LOG_ERROR("TTB not cached!");
+			return ERROR_FAIL;
+		}
+
+		COMMAND_PARSE_NUMBER(int, CMD_ARGV[0], ttbidx);
+		if (ttbidx < 0 || ttbidx > 1)
+			return ERROR_COMMAND_ARGUMENT_INVALID;
+
+		ttb = mmu->ttbr[ttbidx] & mmu->ttbr_mask[ttbidx];
+
+		if (ttbidx == 0) {
+			int ttbcr_n = mmu->ttbcr & 0x7;
+			max_pt_idx = 0x0fff >> ttbcr_n;
+		}
+	}
+
+	LOG_USER("Page Directory at (phys): %8.8" TARGET_PRIxADDR, ttb);
+
+	first_lvl_ptbl = malloc(sizeof(uint32_t)*(max_pt_idx+1));
+	if (first_lvl_ptbl == NULL)
+		return ERROR_FAIL;
+
+	/*
+	 * this may or may not be necessary depending on whether
+	 * the table walker is configured to use the cache or not.
+	 */
+	cache->flush_all_data_cache(target);
+
+	retval = mmu->read_physical_memory(target, ttb, 4, max_pt_idx+1, (uint8_t *)first_lvl_ptbl);
+	if (retval != ERROR_OK) {
+		LOG_ERROR("Failed to read first-level page table!");
+		return retval;
+	}
+
+	afe = !!(cortex_a->cp15_control_reg & SCTLR_BIT_AFE);
+
+	for (pt_idx = 0; pt_idx <= max_pt_idx;) {
+		uint32_t first_lvl_descriptor = target_buffer_get_u32(target,
+						(uint8_t *)&first_lvl_ptbl[pt_idx]);
+
+		LOG_DEBUG("L1 desc[%8.8"PRIx32"]: %8.8"PRIx32, pt_idx << 20, first_lvl_descriptor);
+
+		/* skip empty entries in the first level table */
+		if ((first_lvl_descriptor & 3) == 0) {
+			pt_idx++;
+		} else
+		if ((first_lvl_descriptor & 0x40002) == 2) {
+			/* section descriptor */
+			uint32_t va_range = 1024*1024-1; /* 1MB range */
+			uint32_t va_start = pt_idx << 20;
+			uint32_t va_end = va_start + va_range;
+
+			uint32_t pa_start = (first_lvl_descriptor & 0xfff00000);
+			uint32_t pa_end = pa_start + va_range;
+
+			LOG_USER("SECT: VA[%8.8"PRIx32" -- %8.8"PRIx32"]: PA[%8.8"PRIx32" -- %8.8"PRIx32"] %s",
+				va_start, va_end, pa_start, pa_end, l1_desc_bits_to_string(first_lvl_descriptor, afe));
+			pt_idx++;
+		} else
+		if ((first_lvl_descriptor & 0x40002) == 0x40002) {
+			/* supersection descriptor */
+			uint32_t va_range = 16*1024*1024-1; /* 16MB range */
+			uint32_t va_start = pt_idx << 20;
+			uint32_t va_end = va_start + va_range;
+
+			uint32_t pa_start = (first_lvl_descriptor & 0xff000000);
+			uint32_t pa_end = pa_start + va_range;
+
+			LOG_USER("SSCT: VA[%8.8"PRIx32" -- %8.8"PRIx32"]: PA[%8.8"PRIx32" -- %8.8"PRIx32"] %s",
+				va_start, va_end, pa_start, pa_end, l1_desc_bits_to_string(first_lvl_descriptor, afe));
+
+			/* skip next 15 entries, they're duplicating the first entry */
+			pt_idx += 16;
+		} else {
+			target_addr_t second_lvl_ptbl = first_lvl_descriptor & 0xfffffc00;
+			uint32_t second_lvl_descriptor;
+			uint32_t *pt2;
+			int pt2_idx;
+
+			/* page table, always 1KB long */
+			pt2 = malloc(1024);
+			retval = mmu->read_physical_memory(target, second_lvl_ptbl,
+						  4, 256, (uint8_t *)pt2);
+			if (retval != ERROR_OK) {
+				LOG_ERROR("Failed to read second-level page table!");
+				return ERROR_FAIL;
+			}
+
+			for (pt2_idx = 0; pt2_idx < 256; ) {
+				second_lvl_descriptor = target_buffer_get_u32(target,
+						(uint8_t *)&pt2[pt2_idx]);
+
+				if ((second_lvl_descriptor & 3) == 0) {
+					/* skip entry */
+					pt2_idx++;
+				} else
+				if ((second_lvl_descriptor & 3) == 1) {
+					/* large page */
+					uint32_t va_range = 64*1024-1; /* 64KB range */
+					uint32_t va_start = (pt_idx << 20) + (pt2_idx << 12);
+					uint32_t va_end = va_start + va_range;
+
+					uint32_t pa_start = (second_lvl_descriptor & 0xffff0000);
+					uint32_t pa_end = pa_start + va_range;
+
+					LOG_USER("LPGE: VA[%8.8"PRIx32" -- %8.8"PRIx32"]: PA[%8.8"PRIx32" -- %8.8"PRIx32"] %s",
+						va_start, va_end, pa_start, pa_end, l2_desc_bits_to_string(second_lvl_descriptor, afe));
+
+					pt2_idx += 16;
+				} else {
+					/* small page */
+					uint32_t va_range = 4*1024-1; /* 4KB range */
+					uint32_t va_start = (pt_idx << 20) + (pt2_idx << 12);
+					uint32_t va_end = va_start + va_range;
+
+					uint32_t pa_start = (second_lvl_descriptor & 0xfffff000);
+					uint32_t pa_end = pa_start + va_range;
+
+					LOG_USER("SPGE: VA[%8.8"PRIx32" -- %8.8"PRIx32"]: PA[%8.8"PRIx32" -- %8.8"PRIx32"] %s",
+						va_start, va_end, pa_start, pa_end, l2_desc_bits_to_string(second_lvl_descriptor, afe));
+
+					pt2_idx++;
+				}
+			}
+			free(pt2);
+			pt_idx++;
+		}
+	}
+
+	free(first_lvl_ptbl);
+	return ERROR_OK;
+}
+
+static const struct command_registration armv7a_mmu_group_handlers[] = {
+	{
+		.name = "dump",
+		.handler = armv7a_mmu_dump_table,
+		.mode = COMMAND_ANY,
+		.help = "dump translation table 0, 1 or from <address>",
+		.usage = "(0|1|addr <address> [num_entries])",
+	},
+	COMMAND_REGISTRATION_DONE
+};
+
+const struct command_registration armv7a_mmu_command_handlers[] = {
+	{
+		.name = "mmu",
+		.mode = COMMAND_ANY,
+		.help = "mmu command group",
+		.usage = "",
+		.chain = armv7a_mmu_group_handlers,
+	},
+	COMMAND_REGISTRATION_DONE
+};
@@ -0,0 +1,28 @@
+/***************************************************************************
+ *   Copyright (C) 2016 by Matthias Welwarsky                              *
+ *   matthias.welwarsky@sysgo.com                                          *
+ *                                                                         *
+ *   This program is free software; you can redistribute it and/or modify  *
+ *   it under the terms of the GNU General Public License as published by  *
+ *   the Free Software Foundation; either version 2 of the License, or     *
+ *   (at your option) any later version.                                   *
+ *                                                                         *
+ *   This program is distributed in the hope that it will be useful,       *
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of        *
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
+ *   GNU General Public License for more details.                          *
+ *                                                                         *
+ *   You should have received a copy of the GNU General Public License     *
+ *   along with this program.  If not, see <http://www.gnu.org/licenses/>. *
+ ***************************************************************************/
+
+#ifndef OPENOCD_TARGET_ARMV7A_MMU_H
+#define OPENOCD_TARGET_ARMV7A_MMU_H
+
+extern int armv7a_mmu_translate_va(struct target *target,  uint32_t va, uint32_t *val);
+extern int armv7a_mmu_translate_va_pa(struct target *target, uint32_t va,
+	uint32_t *val, int meminfo);
+
+extern const struct command_registration armv7a_mmu_command_handlers[];
+
+#endif /* OPENOCD_TARGET_ARMV7A_MMU_H */
@@ -936,6 +936,11 @@ int armv8_mmu_translate_va_pa(struct target *target, target_addr_t va,
 			"Secure", "Not Secure"
 	};

+	if (target->state != TARGET_HALTED) {
+		LOG_WARNING("target %s not halted", target_name(target));
+		return ERROR_TARGET_NOT_HALTED;
+	}
+
 	retval = dpm->prepare(dpm);
 	if (retval != ERROR_OK)
 		return retval;
@@ -50,6 +50,7 @@
 #include "breakpoints.h"
 #include "cortex_a.h"
 #include "register.h"
+#include "armv7a_mmu.h"
 #include "target_request.h"
 #include "target_type.h"
 #include "arm_opcodes.h"
@@ -57,6 +58,9 @@
 #include "transport/transport.h"
 #include <helper/time_support.h>

+#define foreach_smp_target(pos, head) \
+	for (pos = head; (pos != NULL); pos = pos->next)
+
 static int cortex_a_poll(struct target *target);
 static int cortex_a_debug_entry(struct target *target);
 static int cortex_a_restore_context(struct target *target, bool bpwp);
@@ -68,10 +72,6 @@ static int cortex_a_set_hybrid_breakpoint(struct target *target,
 	struct breakpoint *breakpoint);
 static int cortex_a_unset_breakpoint(struct target *target,
 	struct breakpoint *breakpoint);
-static int cortex_a_dap_read_coreregister_u32(struct target *target,
-	uint32_t *value, int regnum);
-static int cortex_a_dap_write_coreregister_u32(struct target *target,
-	uint32_t value, int regnum);
 static int cortex_a_mmu(struct target *target, int *enabled);
 static int cortex_a_mmu_modify(struct target *target, int enable);
 static int cortex_a_virt2phys(struct target *target,
@@ -110,7 +110,7 @@ static int cortex_a_prep_memaccess(struct target *target, int phys_access)
 	int mmu_enabled = 0;

 	if (phys_access == 0) {
-		dpm_modeswitch(&armv7a->dpm, ARM_MODE_SVC);
+		arm_dpm_modeswitch(&armv7a->dpm, ARM_MODE_SVC);
 		cortex_a_mmu(target, &mmu_enabled);
 		if (mmu_enabled)
 			cortex_a_mmu_modify(target, 1);
@@ -145,7 +145,7 @@ static int cortex_a_post_memaccess(struct target *target, int phys_access)
 					0, 0, 3, 0,
 					cortex_a->cp15_dacr_reg);
 		}
-		dpm_modeswitch(&armv7a->dpm, ARM_MODE_ANY);
+		arm_dpm_modeswitch(&armv7a->dpm, ARM_MODE_ANY);
 	} else {
 		int mmu_enabled = 0;
 		cortex_a_mmu(target, &mmu_enabled);
@@ -304,172 +304,6 @@ static int cortex_a_exec_opcode(struct target *target,
 	return retval;
 }

-/**************************************************************************
-Read core register with very few exec_opcode, fast but needs work_area.
-This can cause problems with MMU active.
-**************************************************************************/
-static int cortex_a_read_regs_through_mem(struct target *target, uint32_t address,
-	uint32_t *regfile)
-{
-	int retval = ERROR_OK;
-	struct armv7a_common *armv7a = target_to_armv7a(target);
-
-	retval = cortex_a_dap_read_coreregister_u32(target, regfile, 0);
-	if (retval != ERROR_OK)
-		return retval;
-	retval = cortex_a_dap_write_coreregister_u32(target, address, 0);
-	if (retval != ERROR_OK)
-		return retval;
-	retval = cortex_a_exec_opcode(target, ARMV4_5_STMIA(0, 0xFFFE, 0, 0), NULL);
-	if (retval != ERROR_OK)
-		return retval;
-
-	retval = mem_ap_read_buf(armv7a->memory_ap,
-			(uint8_t *)(&regfile[1]), 4, 15, address);
-
-	return retval;
-}
-
-static int cortex_a_dap_read_coreregister_u32(struct target *target,
-	uint32_t *value, int regnum)
-{
-	int retval = ERROR_OK;
-	uint8_t reg = regnum&0xFF;
-	uint32_t dscr = 0;
-	struct armv7a_common *armv7a = target_to_armv7a(target);
-
-	if (reg > 17)
-		return retval;
-
-	if (reg < 15) {
-		/* Rn to DCCTX, "MCR p14, 0, Rn, c0, c5, 0"  0xEE00nE15 */
-		retval = cortex_a_exec_opcode(target,
-				ARMV4_5_MCR(14, 0, reg, 0, 5, 0),
-				&dscr);
-		if (retval != ERROR_OK)
-			return retval;
-	} else if (reg == 15) {
-		/* "MOV r0, r15"; then move r0 to DCCTX */
-		retval = cortex_a_exec_opcode(target, 0xE1A0000F, &dscr);
-		if (retval != ERROR_OK)
-			return retval;
-		retval = cortex_a_exec_opcode(target,
-				ARMV4_5_MCR(14, 0, 0, 0, 5, 0),
-				&dscr);
-		if (retval != ERROR_OK)
-			return retval;
-	} else {
-		/* "MRS r0, CPSR" or "MRS r0, SPSR"
-		 * then move r0 to DCCTX
-		 */
-		retval = cortex_a_exec_opcode(target, ARMV4_5_MRS(0, reg & 1), &dscr);
-		if (retval != ERROR_OK)
-			return retval;
-		retval = cortex_a_exec_opcode(target,
-				ARMV4_5_MCR(14, 0, 0, 0, 5, 0),
-				&dscr);
-		if (retval != ERROR_OK)
-			return retval;
-	}
-
-	/* Wait for DTRRXfull then read DTRRTX */
-	int64_t then = timeval_ms();
-	while ((dscr & DSCR_DTR_TX_FULL) == 0) {
-		retval = mem_ap_read_atomic_u32(armv7a->debug_ap,
-				armv7a->debug_base + CPUDBG_DSCR, &dscr);
-		if (retval != ERROR_OK)
-			return retval;
-		if (timeval_ms() > then + 1000) {
-			LOG_ERROR("Timeout waiting for cortex_a_exec_opcode");
-			return ERROR_FAIL;
-		}
-	}
-
-	retval = mem_ap_read_atomic_u32(armv7a->debug_ap,
-			armv7a->debug_base + CPUDBG_DTRTX, value);
-	LOG_DEBUG("read DCC 0x%08" PRIx32, *value);
-
-	return retval;
-}
-
-static int cortex_a_dap_write_coreregister_u32(struct target *target,
-	uint32_t value, int regnum)
-{
-	int retval = ERROR_OK;
-	uint8_t Rd = regnum&0xFF;
-	uint32_t dscr;
-	struct armv7a_common *armv7a = target_to_armv7a(target);
-
-	LOG_DEBUG("register %i, value 0x%08" PRIx32, regnum, value);
-
-	/* Check that DCCRX is not full */
-	retval = mem_ap_read_atomic_u32(armv7a->debug_ap,
-			armv7a->debug_base + CPUDBG_DSCR, &dscr);
-	if (retval != ERROR_OK)
-		return retval;
-	if (dscr & DSCR_DTR_RX_FULL) {
-		LOG_ERROR("DSCR_DTR_RX_FULL, dscr 0x%08" PRIx32, dscr);
-		/* Clear DCCRX with MRC(p14, 0, Rd, c0, c5, 0), opcode  0xEE100E15 */
-		retval = cortex_a_exec_opcode(target, ARMV4_5_MRC(14, 0, 0, 0, 5, 0),
-				&dscr);
-		if (retval != ERROR_OK)
-			return retval;
-	}
-
-	if (Rd > 17)
-		return retval;
-
-	/* Write DTRRX ... sets DSCR.DTRRXfull but exec_opcode() won't care */
-	LOG_DEBUG("write DCC 0x%08" PRIx32, value);
-	retval = mem_ap_write_u32(armv7a->debug_ap,
-			armv7a->debug_base + CPUDBG_DTRRX, value);
-	if (retval != ERROR_OK)
-		return retval;
-
-	if (Rd < 15) {
-		/* DCCRX to Rn, "MRC p14, 0, Rn, c0, c5, 0", 0xEE10nE15 */
-		retval = cortex_a_exec_opcode(target, ARMV4_5_MRC(14, 0, Rd, 0, 5, 0),
-				&dscr);
-
-		if (retval != ERROR_OK)
-			return retval;
-	} else if (Rd == 15) {
-		/* DCCRX to R0, "MRC p14, 0, R0, c0, c5, 0", 0xEE100E15
-		 * then "mov r15, r0"
-		 */
-		retval = cortex_a_exec_opcode(target, ARMV4_5_MRC(14, 0, 0, 0, 5, 0),
-				&dscr);
-		if (retval != ERROR_OK)
-			return retval;
-		retval = cortex_a_exec_opcode(target, 0xE1A0F000, &dscr);
-		if (retval != ERROR_OK)
-			return retval;
-	} else {
-		/* DCCRX to R0, "MRC p14, 0, R0, c0, c5, 0", 0xEE100E15
-		 * then "MSR CPSR_cxsf, r0" or "MSR SPSR_cxsf, r0" (all fields)
-		 */
-		retval = cortex_a_exec_opcode(target, ARMV4_5_MRC(14, 0, 0, 0, 5, 0),
-				&dscr);
-		if (retval != ERROR_OK)
-			return retval;
-		retval = cortex_a_exec_opcode(target, ARMV4_5_MSR_GP(0, 0xF, Rd & 1),
-				&dscr);
-		if (retval != ERROR_OK)
-			return retval;
-
-		/* "Prefetch flush" after modifying execution status in CPSR */
-		if (Rd == 16) {
-			retval = cortex_a_exec_opcode(target,
-					ARMV4_5_MCR(15, 0, 0, 7, 5, 4),
-					&dscr);
-			if (retval != ERROR_OK)
-				return retval;
-		}
-	}
-
-	return retval;
-}
-
 /* Write to memory mapped registers directly with no cache or mmu handling */
 static int cortex_a_dap_write_memap_register_u32(struct target *target,
 	uint32_t address,
@@ -806,12 +640,43 @@ static int cortex_a_halt_smp(struct target *target)

 static int update_halt_gdb(struct target *target)
 {
+	struct target *gdb_target = NULL;
+	struct target_list *head;
+	struct target *curr;
 	int retval = 0;
+
 	if (target->gdb_service && target->gdb_service->core[0] == -1) {
 		target->gdb_service->target = target;
 		target->gdb_service->core[0] = target->coreid;
 		retval += cortex_a_halt_smp(target);
 	}
+
+	if (target->gdb_service)
+		gdb_target = target->gdb_service->target;
+
+	foreach_smp_target(head, target->head) {
+		curr = head->target;
+		/* skip calling context */
+		if (curr == target)
+			continue;
+		if (!target_was_examined(curr))
+			continue;
+		/* skip targets that were already halted */
+		if (curr->state == TARGET_HALTED)
+			continue;
+		/* Skip gdb_target; it alerts GDB so has to be polled as last one */
+		if (curr == gdb_target)
+			continue;
+
+		/* avoid recursion in cortex_a_poll() */
+		curr->smp = 0;
+		cortex_a_poll(curr);
+		curr->smp = 1;
+	}
+
+	/* after all targets were updated, poll the gdb serving target */
+	if (gdb_target != NULL && gdb_target != target)
+		cortex_a_poll(gdb_target);
 	return retval;
 }

@@ -1002,7 +867,7 @@ static int cortex_a_internal_restore(struct target *target, int current,
 	arm->pc->valid = 1;

 	/* restore dpm_mode at system halt */
-	dpm_modeswitch(&armv7a->dpm, ARM_MODE_ANY);
+	arm_dpm_modeswitch(&armv7a->dpm, ARM_MODE_ANY);
 	/* called it now before restoring context because it uses cpu
 	 * register r0 for restoring cp15 control register */
 	retval = cortex_a_restore_cp15_control_reg(target);
@@ -1149,14 +1014,11 @@ static int cortex_a_resume(struct target *target, int current,

 static int cortex_a_debug_entry(struct target *target)
 {
-	int i;
-	uint32_t regfile[16], cpsr, spsr, dscr;
+	uint32_t dscr;
 	int retval = ERROR_OK;
-	struct working_area *regfile_working_area = NULL;
 	struct cortex_a_common *cortex_a = target_to_cortex_a(target);
 	struct armv7a_common *armv7a = target_to_armv7a(target);
 	struct arm *arm = &armv7a->arm;
-	struct reg *reg;

 	LOG_DEBUG("dscr = 0x%08" PRIx32, cortex_a->cpudbg_dscr);

@@ -1193,68 +1055,16 @@ static int cortex_a_debug_entry(struct target *target)
 		arm_dpm_report_wfar(&armv7a->dpm, wfar);
 	}

-	/* REVISIT fast_reg_read is never set ... */
-
-	/* Examine target state and mode */
-	if (cortex_a->fast_reg_read)
-		target_alloc_working_area(target, 64, &regfile_working_area);
-
-
-	/* First load register acessible through core debug port*/
-	if (!regfile_working_area)
-		retval = arm_dpm_read_current_registers(&armv7a->dpm);
-	else {
-		retval = cortex_a_read_regs_through_mem(target,
-				regfile_working_area->address, regfile);
-
-		target_free_working_area(target, regfile_working_area);
-		if (retval != ERROR_OK)
-			return retval;
-
-		/* read Current PSR */
-		retval = cortex_a_dap_read_coreregister_u32(target, &cpsr, 16);
-		/*  store current cpsr */
-		if (retval != ERROR_OK)
-			return retval;
-
-		LOG_DEBUG("cpsr: %8.8" PRIx32, cpsr);
-
-		arm_set_cpsr(arm, cpsr);
-
-		/* update cache */
-		for (i = 0; i <= ARM_PC; i++) {
-			reg = arm_reg_current(arm, i);
-
-			buf_set_u32(reg->value, 0, 32, regfile[i]);
-			reg->valid = 1;
-			reg->dirty = 0;
-		}
-
-		/* Fixup PC Resume Address */
-		if (cpsr & (1 << 5)) {
-			/* T bit set for Thumb or ThumbEE state */
-			regfile[ARM_PC] -= 4;
-		} else {
-			/* ARM state */
-			regfile[ARM_PC] -= 8;
-		}
-
-		reg = arm->pc;
-		buf_set_u32(reg->value, 0, 32, regfile[ARM_PC]);
-		reg->dirty = reg->valid;
-	}
+	/* First load register accessible through core debug port */
+	retval = arm_dpm_read_current_registers(&armv7a->dpm);
+	if (retval != ERROR_OK)
+		return retval;

 	if (arm->spsr) {
-		/* read Saved PSR */
-		retval = cortex_a_dap_read_coreregister_u32(target, &spsr, 17);
-		/*  store current spsr */
+		/* read SPSR */
+		retval = arm_dpm_read_reg(&armv7a->dpm, arm->spsr, 17);
 		if (retval != ERROR_OK)
 			return retval;
-
-		reg = arm->spsr;
-		buf_set_u32(reg->value, 0, 32, spsr);
-		reg->valid = 1;
-		reg->dirty = 0;
 	}

 #if 0
@@ -1316,7 +1126,7 @@ static int cortex_a_post_debug_entry(struct target *target)
 	cortex_a->curr_mode = armv7a->arm.core_mode;

 	/* switch to SVC mode to read DACR */
-	dpm_modeswitch(&armv7a->dpm, ARM_MODE_SVC);
+	arm_dpm_modeswitch(&armv7a->dpm, ARM_MODE_SVC);
 	armv7a->arm.mrc(target, 15,
 			0, 0, 3, 0,
 			&cortex_a->cp15_dacr_reg);
@@ -1324,7 +1134,7 @@ static int cortex_a_post_debug_entry(struct target *target)
 	LOG_DEBUG("cp15_dacr_reg: %8.8" PRIx32,
 			cortex_a->cp15_dacr_reg);

-	dpm_modeswitch(&armv7a->dpm, ARM_MODE_ANY);
+	arm_dpm_modeswitch(&armv7a->dpm, ARM_MODE_ANY);
 	return ERROR_OK;
 }

@@ -1386,6 +1196,7 @@ static int cortex_a_step(struct target *target, int current, target_addr_t addre

 	/* Setup single step breakpoint */
 	stepbreakpoint.address = address;
+	stepbreakpoint.asid = 0;
 	stepbreakpoint.length = (arm->core_state == ARM_STATE_THUMB)
 		? 2 : 4;
 	stepbreakpoint.type = BKPT_HARD;
@@ -2660,9 +2471,6 @@ static int cortex_a_read_phys_memory(struct target *target,
 	target_addr_t address, uint32_t size,
 	uint32_t count, uint8_t *buffer)
 {
-	struct armv7a_common *armv7a = target_to_armv7a(target);
-	struct adiv5_dap *swjdp = armv7a->arm.dap;
-	uint8_t apsel = swjdp->apsel;
 	int retval;

 	if (!count || !buffer)
@@ -2671,9 +2479,6 @@ static int cortex_a_read_phys_memory(struct target *target,
 	LOG_DEBUG("Reading memory at real address " TARGET_ADDR_FMT "; size %" PRId32 "; count %" PRId32,
 		address, size, count);

-	if (armv7a->memory_ap_available && (apsel == armv7a->memory_ap->ap_num))
-		return mem_ap_read_buf(armv7a->memory_ap, buffer, size, count, address);
-
 	/* read memory through the CPU */
 	cortex_a_prep_memaccess(target, 1);
 	retval = cortex_a_read_cpu_memory(target, address, size, count, buffer);
@@ -2698,57 +2503,10 @@ static int cortex_a_read_memory(struct target *target, target_addr_t address,
 	return retval;
 }

-static int cortex_a_read_memory_ahb(struct target *target, target_addr_t address,
-	uint32_t size, uint32_t count, uint8_t *buffer)
-{
-	int mmu_enabled = 0;
-	target_addr_t virt, phys;
-	int retval;
-	struct armv7a_common *armv7a = target_to_armv7a(target);
-	struct adiv5_dap *swjdp = armv7a->arm.dap;
-	uint8_t apsel = swjdp->apsel;
-
-	if (!armv7a->memory_ap_available || (apsel != armv7a->memory_ap->ap_num))
-		return target_read_memory(target, address, size, count, buffer);
-
-	/* cortex_a handles unaligned memory access */
-	LOG_DEBUG("Reading memory at address " TARGET_ADDR_FMT "; size %" PRId32 "; count %" PRId32,
-		address, size, count);
-
-	/* determine if MMU was enabled on target stop */
-	if (!armv7a->is_armv7r) {
-		retval = cortex_a_mmu(target, &mmu_enabled);
-		if (retval != ERROR_OK)
-			return retval;
-	}
-
-	if (mmu_enabled) {
-		virt = address;
-		retval = cortex_a_virt2phys(target, virt, &phys);
-		if (retval != ERROR_OK)
-			return retval;
-
-		LOG_DEBUG("Reading at virtual address. "
-			  "Translating v:" TARGET_ADDR_FMT " to r:" TARGET_ADDR_FMT,
-			  virt, phys);
-		address = phys;
-	}
-
-	if (!count || !buffer)
-		return ERROR_COMMAND_SYNTAX_ERROR;
-
-	retval = mem_ap_read_buf(armv7a->memory_ap, buffer, size, count, address);
-
-	return retval;
-}
-
 static int cortex_a_write_phys_memory(struct target *target,
 	target_addr_t address, uint32_t size,
 	uint32_t count, const uint8_t *buffer)
 {
-	struct armv7a_common *armv7a = target_to_armv7a(target);
-	struct adiv5_dap *swjdp = armv7a->arm.dap;
-	uint8_t apsel = swjdp->apsel;
 	int retval;

 	if (!count || !buffer)
@@ -2757,9 +2515,6 @@ static int cortex_a_write_phys_memory(struct target *target,
 	LOG_DEBUG("Writing memory to real address " TARGET_ADDR_FMT "; size %" PRId32 "; count %" PRId32,
 		address, size, count);

-	if (armv7a->memory_ap_available && (apsel == armv7a->memory_ap->ap_num))
-		return mem_ap_write_buf(armv7a->memory_ap, buffer, size, count, address);
-
 	/* write memory through the CPU */
 	cortex_a_prep_memaccess(target, 1);
 	retval = cortex_a_write_cpu_memory(target, address, size, count, buffer);
@@ -2786,51 +2541,6 @@ static int cortex_a_write_memory(struct target *target, target_addr_t address,
 	return retval;
 }

-static int cortex_a_write_memory_ahb(struct target *target, target_addr_t address,
-	uint32_t size, uint32_t count, const uint8_t *buffer)
-{
-	int mmu_enabled = 0;
-	target_addr_t virt, phys;
-	int retval;
-	struct armv7a_common *armv7a = target_to_armv7a(target);
-	struct adiv5_dap *swjdp = armv7a->arm.dap;
-	uint8_t apsel = swjdp->apsel;
-
-	if (!armv7a->memory_ap_available || (apsel != armv7a->memory_ap->ap_num))
-		return target_write_memory(target, address, size, count, buffer);
-
-	/* cortex_a handles unaligned memory access */
-	LOG_DEBUG("Writing memory at address " TARGET_ADDR_FMT "; size %" PRId32 "; count %" PRId32,
-		address, size, count);
-
-	/* determine if MMU was enabled on target stop */
-	if (!armv7a->is_armv7r) {
-		retval = cortex_a_mmu(target, &mmu_enabled);
-		if (retval != ERROR_OK)
-			return retval;
-	}
-
-	if (mmu_enabled) {
-		virt = address;
-		retval = cortex_a_virt2phys(target, virt, &phys);
-		if (retval != ERROR_OK)
-			return retval;
-
-		LOG_DEBUG("Writing to virtual address. "
-			  "Translating v:" TARGET_ADDR_FMT " to r:" TARGET_ADDR_FMT,
-			  virt,
-			  phys);
-		address = phys;
-	}
-
-	if (!count || !buffer)
-		return ERROR_COMMAND_SYNTAX_ERROR;
-
-	retval = mem_ap_write_buf(armv7a->memory_ap, buffer, size, count, address);
-
-	return retval;
-}
-
 static int cortex_a_read_buffer(struct target *target, target_addr_t address,
 				uint32_t count, uint8_t *buffer)
 {
@@ -2840,7 +2550,7 @@ static int cortex_a_read_buffer(struct target *target, target_addr_t address,
 	 * will have something to do with the size we leave to it. */
 	for (size = 1; size < 4 && count >= size * 2 + (address & size); size *= 2) {
 		if (address & size) {
-			int retval = cortex_a_read_memory_ahb(target, address, size, 1, buffer);
+			int retval = target_read_memory(target, address, size, 1, buffer);
 			if (retval != ERROR_OK)
 				return retval;
 			address += size;
@@ -2853,7 +2563,7 @@ static int cortex_a_read_buffer(struct target *target, target_addr_t address,
 	for (; size > 0; size /= 2) {
 		uint32_t aligned = count - count % size;
 		if (aligned > 0) {
-			int retval = cortex_a_read_memory_ahb(target, address, size, aligned / size, buffer);
+			int retval = target_read_memory(target, address, size, aligned / size, buffer);
 			if (retval != ERROR_OK)
 				return retval;
 			address += aligned;
@@ -2874,7 +2584,7 @@ static int cortex_a_write_buffer(struct target *target, target_addr_t address,
 	 * will have something to do with the size we leave to it. */
 	for (size = 1; size < 4 && count >= size * 2 + (address & size); size *= 2) {
 		if (address & size) {
-			int retval = cortex_a_write_memory_ahb(target, address, size, 1, buffer);
+			int retval = target_write_memory(target, address, size, 1, buffer);
 			if (retval != ERROR_OK)
 				return retval;
 			address += size;
@@ -2887,7 +2597,7 @@ static int cortex_a_write_buffer(struct target *target, target_addr_t address,
 	for (; size > 0; size /= 2) {
 		uint32_t aligned = count - count % size;
 		if (aligned > 0) {
-			int retval = cortex_a_write_memory_ahb(target, address, size, aligned / size, buffer);
+			int retval = target_write_memory(target, address, size, aligned / size, buffer);
 			if (retval != ERROR_OK)
 				return retval;
 			address += aligned;
@@ -2965,21 +2675,6 @@ static int cortex_a_examine_first(struct target *target)

 	armv7a->debug_ap->memaccess_tck = 80;

-	/* Search for the AHB-AB.
-	 * REVISIT: We should search for AXI-AP as well and make sure the AP's MEMTYPE says it
-	 * can access system memory. */
-	armv7a->memory_ap_available = false;
-	retval = dap_find_ap(swjdp, AP_TYPE_AHB_AP, &armv7a->memory_ap);
-	if (retval == ERROR_OK) {
-		retval = mem_ap_init(armv7a->memory_ap);
-		if (retval == ERROR_OK)
-			armv7a->memory_ap_available = true;
-	}
-	if (retval != ERROR_OK) {
-		/* AHB-AP not found or unavailable - use the CPU */
-		LOG_DEBUG("No AHB-AP available for memory access");
-	}
-
 	if (!target->dbgbase_set) {
 		uint32_t dbgbase;
 		/* Get ROM Table base */
@@ -3139,8 +2834,6 @@ static int cortex_a_init_arch_info(struct target *target,
 	cortex_a->common_magic = CORTEX_A_COMMON_MAGIC;
 	armv7a->arm.dap = dap;

-	cortex_a->fast_reg_read = 0;
-
 	/* register arch-specific functions */
 	armv7a->examine_debug_reason = NULL;

@@ -3225,10 +2918,7 @@ static int cortex_a_mmu(struct target *target, int *enabled)
 static int cortex_a_virt2phys(struct target *target,
 	target_addr_t virt, target_addr_t *phys)
 {
-	int retval = ERROR_FAIL;
-	struct armv7a_common *armv7a = target_to_armv7a(target);
-	struct adiv5_dap *swjdp = armv7a->arm.dap;
-	uint8_t apsel = swjdp->apsel;
+	int retval;
 	int mmu_enabled = 0;

 	/*
@@ -3243,23 +2933,12 @@ static int cortex_a_virt2phys(struct target *target,
 		return ERROR_OK;
 	}

-	if (armv7a->memory_ap_available && (apsel == armv7a->memory_ap->ap_num)) {
-		uint32_t ret;
-		retval = armv7a_mmu_translate_va(target,
-				virt, &ret);
-		if (retval != ERROR_OK)
-			goto done;
-		*phys = ret;
-	} else {/*  use this method if armv7a->memory_ap not selected
-		 *  mmu must be enable in order to get a correct translation */
-		retval = cortex_a_mmu_modify(target, 1);
-		if (retval != ERROR_OK)
-			goto done;
-		retval = armv7a_mmu_translate_va_pa(target, (uint32_t)virt,
+	/* mmu must be enable in order to get a correct translation */
+	retval = cortex_a_mmu_modify(target, 1);
+	if (retval != ERROR_OK)
+		return retval;
+	return armv7a_mmu_translate_va_pa(target, (uint32_t)virt,
 						    (uint32_t *)phys, 1);
-	}
-done:
-	return retval;
 }

 COMMAND_HANDLER(cortex_a_handle_cache_info_command)
@@ -3443,6 +3122,9 @@ static const struct command_registration cortex_a_exec_command_handlers[] = {
 			"on memory access",
 		.usage = "['on'|'off']",
 	},
+	{
+		.chain = armv7a_mmu_command_handlers,
+	},

 	COMMAND_REGISTRATION_DONE
 };
@@ -93,9 +93,6 @@ struct cortex_a_common {
 	int brp_num_available;
 	struct cortex_a_brp *brp_list;

-	/* Use cortex_a_read_regs_through_mem for fast register reads */
-	int fast_reg_read;
-
 	uint32_t cpuid;
 	uint32_t didr;

@@ -42,7 +42,7 @@

 /* NOTE:  most of this should work fine for the Cortex-M1 and
 * Cortex-M0 cores too, although they're ARMv6-M not ARMv7-M.
- * Some differences:  M0/M1 doesn't have FBP remapping or the
+ * Some differences:  M0/M1 doesn't have FPB remapping or the
 * DWT tracing/profiling support.  (So the cycle counter will
 * not be usable; the other stuff isn't currently used here.)
 *
@@ -255,7 +255,7 @@ static int cortex_m_endreset_event(struct target *target)
 		return retval;

 	/* Paranoia: evidently some (early?) chips don't preserve all the
-	 * debug state (including FBP, DWT, etc) across reset...
+	 * debug state (including FPB, DWT, etc) across reset...
 	 */

 	/* Enable FPB */
@@ -1277,7 +1277,7 @@ int cortex_m_remove_breakpoint(struct target *target, struct breakpoint *breakpo
 {
 	struct cortex_m_common *cortex_m = target_to_cm(target);

-	/* REVISIT why check? FBP can be updated with core running ... */
+	/* REVISIT why check? FPB can be updated with core running ... */
 	if (target->state != TARGET_HALTED) {
 		LOG_WARNING("target not halted");
 		return ERROR_TARGET_NOT_HALTED;
@@ -1986,7 +1986,7 @@ int cortex_m_examine(struct target *target)
 	/* stlink shares the examine handler but does not support
 	 * all its calls */
 	if (!armv7m->stlink) {
-		if (cortex_m->apsel < 0) {
+		if (cortex_m->apsel == DP_APSEL_INVALID) {
 			/* Search for the MEM-AP */
 			retval = dap_find_ap(swjdp, AP_TYPE_AHB_AP, &armv7m->debug_ap);
 			if (retval != ERROR_OK) {
@@ -0,0 +1,129 @@
+/***************************************************************************
+ *   Copyright (C) 2018 by Square, Inc.                                    *
+ *   Steven Stallion <stallion@squareup.com>                               *
+ *   James Zhao <hjz@squareup.com>                                         *
+ *                                                                         *
+ *   This program is free software; you can redistribute it and/or modify  *
+ *   it under the terms of the GNU General Public License as published by  *
+ *   the Free Software Foundation; either version 2 of the License, or     *
+ *   (at your option) any later version.                                   *
+ *                                                                         *
+ *   This program is distributed in the hope that it will be useful,       *
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of        *
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
+ *   GNU General Public License for more details.                          *
+ *                                                                         *
+ *   You should have received a copy of the GNU General Public License     *
+ *   along with this program.  If not, see <http://www.gnu.org/licenses/>. *
+ ***************************************************************************/
+
+#ifndef OPENOCD_TARGET_ESIRISC_H
+#define OPENOCD_TARGET_ESIRISC_H
+
+#include <target/breakpoints.h>
+#include <target/register.h>
+#include <target/target.h>
+
+#include "esirisc_jtag.h"
+#include "esirisc_regs.h"
+
+#define MAX_BREAKPOINTS			8
+#define MAX_WATCHPOINTS			8
+
+/* Exception IDs */
+#define EID_RESET				0x00
+#define EID_HARDWARE_FAILURE	0x01
+#define EID_NMI					0x02
+#define EID_INST_BREAKPOINT		0x03
+#define EID_DATA_BREAKPOINT		0x04
+#define EID_UNSUPPORTED			0x05
+#define EID_PRIVILEGE_VIOLATION	0x06
+#define EID_INST_BUS_ERROR		0x07
+#define EID_DATA_BUS_ERROR		0x08
+#define EID_ALIGNMENT_ERROR		0x09
+#define EID_ARITHMETIC_ERROR	0x0a
+#define EID_SYSTEM_CALL			0x0b
+#define EID_MEMORY_MANAGEMENT	0x0c
+#define EID_UNRECOVERABLE		0x0d
+#define EID_INTERRUPTn			0x20
+
+/* Exception Entry Points */
+#define ENTRY_RESET				0x00
+#define ENTRY_UNRECOVERABLE		0x01
+#define ENTRY_HARDWARE_FAILURE	0x02
+#define ENTRY_RUNTIME			0x03
+#define ENTRY_MEMORY			0x04
+#define ENTRY_SYSCALL			0x05
+#define ENTRY_DEBUG				0x06
+#define ENTRY_NMI				0x07
+#define ENTRY_INTERRUPTn		0x08
+
+/* Hardware Debug Control */
+#define HWDC_R					(1<<4)	/* Reset & Hardware Failure */
+#define HWDC_I					(1<<3)	/* Interrupts */
+#define HWDC_S					(1<<2)	/* System Calls */
+#define HWDC_E					(1<<1)	/* Program Errors */
+#define HWDC_D					(1<<0)	/* Debug Exceptions */
+
+enum esirisc_cache {
+	ESIRISC_CACHE_VON_NEUMANN,
+	ESIRISC_CACHE_HARVARD,
+};
+
+struct esirisc_common {
+	struct target *target;
+	struct esirisc_jtag jtag_info;
+	enum esirisc_cache cache_arch;
+	char *gdb_arch;
+
+	struct reg_cache *reg_cache;
+	struct reg *epc;
+	struct reg *ecas;
+	struct reg *eid;
+	struct reg *ed;
+	uint32_t etc_save;
+	uint32_t hwdc_save;
+
+	int num_bits;
+	int num_regs;
+	bool has_icache;
+	bool has_dcache;
+	int num_breakpoints;
+	int num_watchpoints;
+
+	struct breakpoint *breakpoints_p[MAX_BREAKPOINTS];
+	struct watchpoint *watchpoints_p[MAX_WATCHPOINTS];
+};
+
+union esirisc_memory {
+	uint32_t word;
+	uint16_t hword;
+	uint8_t byte;
+};
+
+struct esirisc_reg {
+	struct esirisc_common *esirisc;
+
+	uint8_t bank;
+	uint8_t csr;
+
+	int (*read)(struct reg *reg);
+	int (*write)(struct reg *reg);
+};
+
+static inline struct esirisc_common *target_to_esirisc(struct target *target)
+{
+	return (struct esirisc_common *)target->arch_info;
+}
+
+static inline char *esirisc_cache_arch(struct esirisc_common *esirisc)
+{
+	return esirisc->cache_arch == ESIRISC_CACHE_HARVARD ? "harvard" : "von_neumann";
+}
+
+static inline bool esirisc_has_cache(struct esirisc_common *esirisc)
+{
+	return esirisc->has_icache || esirisc->has_dcache;
+}
+
+#endif /* OPENOCD_TARGET_ESIRISC_H */
@@ -0,0 +1,514 @@
+/***************************************************************************
+ *   Copyright (C) 2018 by Square, Inc.                                    *
+ *   Steven Stallion <stallion@squareup.com>                               *
+ *   James Zhao <hjz@squareup.com>                                         *
+ *                                                                         *
+ *   This program is free software; you can redistribute it and/or modify  *
+ *   it under the terms of the GNU General Public License as published by  *
+ *   the Free Software Foundation; either version 2 of the License, or     *
+ *   (at your option) any later version.                                   *
+ *                                                                         *
+ *   This program is distributed in the hope that it will be useful,       *
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of        *
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
+ *   GNU General Public License for more details.                          *
+ *                                                                         *
+ *   You should have received a copy of the GNU General Public License     *
+ *   along with this program.  If not, see <http://www.gnu.org/licenses/>. *
+ ***************************************************************************/
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <helper/binarybuffer.h>
+#include <helper/log.h>
+#include <helper/types.h>
+#include <jtag/jtag.h>
+#include <jtag/commands.h>
+#include <jtag/interface.h>
+
+#include "esirisc_jtag.h"
+
+static void esirisc_jtag_set_instr(struct esirisc_jtag *jtag_info, uint32_t new_instr)
+{
+	struct jtag_tap *tap = jtag_info->tap;
+
+	if (buf_get_u32(tap->cur_instr, 0, tap->ir_length) != new_instr) {
+		struct scan_field field;
+		uint8_t t[4];
+
+		field.num_bits = tap->ir_length;
+		field.out_value = t;
+		buf_set_u32(t, 0, field.num_bits, new_instr);
+		field.in_value = NULL;
+
+		jtag_add_ir_scan(tap, &field, TAP_IDLE);
+	}
+}
+
+/*
+ * The data register is latched every 8 bits while in the Shift-DR state
+ * (Update-DR is not supported). This necessitates prepending padding
+ * bits to ensure data is aligned when multiple TAPs are present.
+ */
+static int esirisc_jtag_get_padding(void)
+{
+	int padding = 0;
+	int bypass_devices = 0;
+
+	for (struct jtag_tap *tap = jtag_tap_next_enabled(NULL); tap != NULL;
+			tap = jtag_tap_next_enabled(tap))
+		if (tap->bypass)
+			bypass_devices++;
+
+	int num_bits = bypass_devices % 8;
+	if (num_bits > 0)
+		padding = 8 - num_bits;
+
+	return padding;
+}
+
+static int esirisc_jtag_count_bits(int num_fields, struct scan_field *fields)
+{
+	int bit_count = 0;
+
+	for (int i = 0; i < num_fields; ++i)
+		bit_count += fields[i].num_bits;
+
+	return bit_count;
+}
+
+/*
+ * Data received from the target will be byte-stuffed if it contains
+ * either the pad byte (0xAA) or stuffing marker (0x55). Buffers should
+ * be sized twice the expected length to account for stuffing overhead.
+ */
+static void esirisc_jtag_unstuff(uint8_t *data, size_t len)
+{
+	uint8_t *r, *w;
+	uint8_t *end;
+
+	r = w = data;
+	end = data + len;
+	while (r < end) {
+		if (*r == STUFF_MARKER) {
+			r++; /* skip stuffing marker */
+			assert(r < end);
+			*w++ = *r++ ^ STUFF_MARKER;
+		} else
+			*w++ = *r++;
+	}
+}
+
+/*
+ * The eSi-Debug protocol defines a byte-oriented command/response
+ * channel that operates over serial or JTAG. While not strictly
+ * required, separate DR scans are used for sending and receiving data.
+ * This allows the TAP to recover gracefully if the byte stream is
+ * corrupted at the expense of sending additional padding bits.
+ */
+
+static int esirisc_jtag_send(struct esirisc_jtag *jtag_info, uint8_t command,
+		int num_out_fields, struct scan_field *out_fields)
+{
+	int num_fields = 2 + num_out_fields;
+	struct scan_field *fields = cmd_queue_alloc(num_fields * sizeof(struct scan_field));
+
+	esirisc_jtag_set_instr(jtag_info, INSTR_DEBUG);
+
+	fields[0].num_bits = esirisc_jtag_get_padding();
+	fields[0].out_value = NULL;
+	fields[0].in_value = NULL;
+
+	fields[1].num_bits = 8;
+	fields[1].out_value = &command;
+	fields[1].in_value = NULL;
+
+	/* append command data */
+	for (int i = 0; i < num_out_fields; ++i)
+		jtag_scan_field_clone(&fields[2+i], &out_fields[i]);
+
+	jtag_add_dr_scan(jtag_info->tap, num_fields, fields, TAP_IDLE);
+
+	return jtag_execute_queue();
+}
+
+static int esirisc_jtag_recv(struct esirisc_jtag *jtag_info,
+		int num_in_fields, struct scan_field *in_fields)
+{
+	int num_in_bits = esirisc_jtag_count_bits(num_in_fields, in_fields);
+	int num_in_bytes = DIV_ROUND_UP(num_in_bits, 8);
+
+	struct scan_field fields[3];
+	uint8_t r[num_in_bytes * 2];
+
+	esirisc_jtag_set_instr(jtag_info, INSTR_DEBUG);
+
+	fields[0].num_bits = esirisc_jtag_get_padding() + 1;
+	fields[0].out_value = NULL;
+	fields[0].in_value = NULL;
+
+	fields[1].num_bits = 8;
+	fields[1].out_value = NULL;
+	fields[1].in_value = &jtag_info->status;
+
+	fields[2].num_bits = num_in_bits * 2;
+	fields[2].out_value = NULL;
+	fields[2].in_value = r;
+
+	jtag_add_dr_scan(jtag_info->tap, ARRAY_SIZE(fields), fields, TAP_IDLE);
+
+	int retval = jtag_execute_queue();
+	if (retval != ERROR_OK)
+		return retval;
+
+	/* unstuff response data and write back to caller */
+	if (num_in_fields > 0) {
+		esirisc_jtag_unstuff(r, ARRAY_SIZE(r));
+
+		int bit_count = 0;
+		for (int i = 0; i < num_in_fields; ++i) {
+			buf_set_buf(r, bit_count, in_fields[i].in_value, 0, in_fields[i].num_bits);
+			bit_count += in_fields[i].num_bits;
+		}
+	}
+
+	return ERROR_OK;
+}
+
+static int esirisc_jtag_check_status(struct esirisc_jtag *jtag_info)
+{
+	uint8_t eid = esirisc_jtag_get_eid(jtag_info);
+	if (eid != EID_NONE) {
+		LOG_ERROR("esirisc_jtag: bad status: 0x%02" PRIx32 " (DA: %" PRId32 ", "
+				"S: %" PRId32 ", EID: 0x%02" PRIx32 ")",
+				jtag_info->status, esirisc_jtag_is_debug_active(jtag_info),
+				esirisc_jtag_is_stopped(jtag_info), eid);
+		return ERROR_FAIL;
+	}
+
+	return ERROR_OK;
+}
+
+static int esirisc_jtag_send_and_recv(struct esirisc_jtag *jtag_info, uint8_t command,
+		int num_out_fields, struct scan_field *out_fields,
+		int num_in_fields, struct scan_field *in_fields)
+{
+	int retval;
+
+	jtag_info->status = 0;	/* clear status */
+
+	retval = esirisc_jtag_send(jtag_info, command, num_out_fields, out_fields);
+	if (retval != ERROR_OK) {
+		LOG_ERROR("esirisc_jtag: send failed (command: 0x%02" PRIx32 ")", command);
+		return ERROR_FAIL;
+	}
+
+	retval = esirisc_jtag_recv(jtag_info, num_in_fields, in_fields);
+	if (retval != ERROR_OK) {
+		LOG_ERROR("esirisc_jtag: recv failed (command: 0x%02" PRIx32 ")", command);
+		return ERROR_FAIL;
+	}
+
+	return esirisc_jtag_check_status(jtag_info);
+}
+
+/*
+ * Status is automatically updated after each command completes;
+ * these functions make each field available to the caller.
+ */
+
+bool esirisc_jtag_is_debug_active(struct esirisc_jtag *jtag_info)
+{
+	return !!(jtag_info->status & 1<<7);	/* DA */
+}
+
+bool esirisc_jtag_is_stopped(struct esirisc_jtag *jtag_info)
+{
+	return !!(jtag_info->status & 1<<6);	/* S */
+}
+
+uint8_t esirisc_jtag_get_eid(struct esirisc_jtag *jtag_info)
+{
+	return jtag_info->status & 0x3f;		/* EID */
+}
+
+/*
+ * Most commands manipulate target data (eg. memory and registers); each
+ * command returns a status byte that indicates success. Commands must
+ * transmit multibyte values in big-endian order, however response
+ * values are in little-endian order. Target endianness does not have an
+ * effect on this ordering.
+ */
+
+int esirisc_jtag_read_byte(struct esirisc_jtag *jtag_info, uint32_t address, uint8_t *data)
+{
+	struct scan_field out_fields[1];
+	uint8_t a[4];
+
+	out_fields[0].num_bits = 32;
+	out_fields[0].out_value = a;
+	h_u32_to_be(a, address);
+	out_fields[0].in_value = NULL;
+
+	struct scan_field in_fields[1];
+	uint8_t d[1];
+
+	in_fields[0].num_bits = 8;
+	in_fields[0].out_value = NULL;
+	in_fields[0].in_value = d;
+
+	int retval = esirisc_jtag_send_and_recv(jtag_info, DEBUG_READ_BYTE,
+			ARRAY_SIZE(out_fields), out_fields, ARRAY_SIZE(in_fields), in_fields);
+	if (retval != ERROR_OK)
+		return retval;
+
+	*data = *d;
+
+	return ERROR_OK;
+}
+
+int esirisc_jtag_read_hword(struct esirisc_jtag *jtag_info, uint32_t address, uint16_t *data)
+{
+	struct scan_field out_fields[1];
+	uint8_t a[4];
+
+	out_fields[0].num_bits = 32;
+	out_fields[0].out_value = a;
+	h_u32_to_be(a, address);
+	out_fields[0].in_value = NULL;
+
+	struct scan_field in_fields[1];
+	uint8_t d[2];
+
+	in_fields[0].num_bits = 16;
+	in_fields[0].out_value = NULL;
+	in_fields[0].in_value = d;
+
+	int retval = esirisc_jtag_send_and_recv(jtag_info, DEBUG_READ_HWORD,
+			ARRAY_SIZE(out_fields), out_fields, ARRAY_SIZE(in_fields), in_fields);
+	if (retval != ERROR_OK)
+		return retval;
+
+	*data = le_to_h_u16(d);
+
+	return ERROR_OK;
+}
+
+int esirisc_jtag_read_word(struct esirisc_jtag *jtag_info, uint32_t address, uint32_t *data)
+{
+	struct scan_field out_fields[1];
+	uint8_t a[4];
+
+	out_fields[0].num_bits = 32;
+	out_fields[0].out_value = a;
+	h_u32_to_be(a, address);
+	out_fields[0].in_value = NULL;
+
+	struct scan_field in_fields[1];
+	uint8_t d[4];
+
+	in_fields[0].num_bits = 32;
+	in_fields[0].out_value = NULL;
+	in_fields[0].in_value = d;
+
+	int retval = esirisc_jtag_send_and_recv(jtag_info, DEBUG_READ_WORD,
+			ARRAY_SIZE(out_fields), out_fields, ARRAY_SIZE(in_fields), in_fields);
+	if (retval != ERROR_OK)
+		return retval;
+
+	*data = le_to_h_u32(d);
+
+	return ERROR_OK;
+}
+
+int esirisc_jtag_write_byte(struct esirisc_jtag *jtag_info, uint32_t address, uint8_t data)
+{
+	struct scan_field out_fields[2];
+	uint8_t a[4];
+
+	out_fields[0].num_bits = 32;
+	out_fields[0].out_value = a;
+	h_u32_to_be(a, address);
+	out_fields[0].in_value = NULL;
+
+	out_fields[1].num_bits = 8;
+	out_fields[1].out_value = &data;
+	out_fields[1].in_value = NULL;
+
+	return esirisc_jtag_send_and_recv(jtag_info, DEBUG_WRITE_BYTE,
+			ARRAY_SIZE(out_fields), out_fields, 0, NULL);
+}
+
+int esirisc_jtag_write_hword(struct esirisc_jtag *jtag_info, uint32_t address, uint16_t data)
+{
+	struct scan_field out_fields[2];
+	uint8_t a[4], d[2];
+
+	out_fields[0].num_bits = 32;
+	out_fields[0].out_value = a;
+	h_u32_to_be(a, address);
+	out_fields[0].in_value = NULL;
+
+	out_fields[1].num_bits = 16;
+	out_fields[1].out_value = d;
+	h_u16_to_be(d, data);
+	out_fields[1].in_value = NULL;
+
+	return esirisc_jtag_send_and_recv(jtag_info, DEBUG_WRITE_HWORD,
+			ARRAY_SIZE(out_fields), out_fields, 0, NULL);
+}
+
+int esirisc_jtag_write_word(struct esirisc_jtag *jtag_info, uint32_t address, uint32_t data)
+{
+	struct scan_field out_fields[2];
+	uint8_t a[4], d[4];
+
+	out_fields[0].num_bits = 32;
+	out_fields[0].out_value = a;
+	h_u32_to_be(a, address);
+	out_fields[0].in_value = NULL;
+
+	out_fields[1].num_bits = 32;
+	out_fields[1].out_value = d;
+	h_u32_to_be(d, data);
+	out_fields[1].in_value = NULL;
+
+	return esirisc_jtag_send_and_recv(jtag_info, DEBUG_WRITE_WORD,
+			ARRAY_SIZE(out_fields), out_fields, 0, NULL);
+}
+
+int esirisc_jtag_read_reg(struct esirisc_jtag *jtag_info, uint8_t reg, uint32_t *data)
+{
+	struct scan_field out_fields[1];
+
+	out_fields[0].num_bits = 8;
+	out_fields[0].out_value = &reg;
+	out_fields[0].in_value = NULL;
+
+	struct scan_field in_fields[1];
+	uint8_t d[4];
+
+	in_fields[0].num_bits = 32;
+	in_fields[0].out_value = NULL;
+	in_fields[0].in_value = d;
+
+	int retval = esirisc_jtag_send_and_recv(jtag_info, DEBUG_READ_REG,
+			ARRAY_SIZE(out_fields), out_fields, ARRAY_SIZE(in_fields), in_fields);
+	if (retval != ERROR_OK)
+		return retval;
+
+	*data = le_to_h_u32(d);
+
+	return ERROR_OK;
+}
+
+int esirisc_jtag_write_reg(struct esirisc_jtag *jtag_info, uint8_t reg, uint32_t data)
+{
+	struct scan_field out_fields[2];
+	uint8_t d[4];
+
+	out_fields[0].num_bits = 8;
+	out_fields[0].out_value = &reg;
+	out_fields[0].in_value = NULL;
+
+	out_fields[1].num_bits = 32;
+	out_fields[1].out_value = d;
+	h_u32_to_be(d, data);
+	out_fields[1].in_value = NULL;
+
+	return esirisc_jtag_send_and_recv(jtag_info, DEBUG_WRITE_REG,
+			ARRAY_SIZE(out_fields), out_fields, 0, NULL);
+}
+
+int esirisc_jtag_read_csr(struct esirisc_jtag *jtag_info, uint8_t bank, uint8_t csr, uint32_t *data)
+{
+	struct scan_field out_fields[1];
+	uint8_t c[2];
+
+	out_fields[0].num_bits = 16;
+	out_fields[0].out_value = c;
+	h_u16_to_be(c, (csr << 5) | bank);
+	out_fields[0].in_value = NULL;
+
+	struct scan_field in_fields[1];
+	uint8_t d[4];
+
+	in_fields[0].num_bits = 32;
+	in_fields[0].out_value = NULL;
+	in_fields[0].in_value = d;
+
+	int retval = esirisc_jtag_send_and_recv(jtag_info, DEBUG_READ_CSR,
+			ARRAY_SIZE(out_fields), out_fields, ARRAY_SIZE(in_fields), in_fields);
+	if (retval != ERROR_OK)
+		return retval;
+
+	*data = le_to_h_u32(d);
+
+	return ERROR_OK;
+}
+
+int esirisc_jtag_write_csr(struct esirisc_jtag *jtag_info, uint8_t bank, uint8_t csr, uint32_t data)
+{
+	struct scan_field out_fields[2];
+	uint8_t c[2], d[4];
+
+	out_fields[0].num_bits = 16;
+	out_fields[0].out_value = c;
+	h_u16_to_be(c, (csr << 5) | bank);
+	out_fields[0].in_value = NULL;
+
+	out_fields[1].num_bits = 32;
+	out_fields[1].out_value = d;
+	h_u32_to_be(d, data);
+	out_fields[1].in_value = NULL;
+
+	return esirisc_jtag_send_and_recv(jtag_info, DEBUG_WRITE_CSR,
+			ARRAY_SIZE(out_fields), out_fields, 0, NULL);
+}
+
+/*
+ * Control commands affect CPU operation; these commands send no data
+ * and return a status byte.
+ */
+
+static inline int esirisc_jtag_send_ctrl(struct esirisc_jtag *jtag_info, uint8_t command)
+{
+	return esirisc_jtag_send_and_recv(jtag_info, command, 0, NULL, 0, NULL);
+}
+
+int esirisc_jtag_enable_debug(struct esirisc_jtag *jtag_info)
+{
+	return esirisc_jtag_send_ctrl(jtag_info, DEBUG_ENABLE_DEBUG);
+}
+
+int esirisc_jtag_disable_debug(struct esirisc_jtag *jtag_info)
+{
+	return esirisc_jtag_send_ctrl(jtag_info, DEBUG_DISABLE_DEBUG);
+}
+
+int esirisc_jtag_assert_reset(struct esirisc_jtag *jtag_info)
+{
+	return esirisc_jtag_send_ctrl(jtag_info, DEBUG_ASSERT_RESET);
+}
+
+int esirisc_jtag_deassert_reset(struct esirisc_jtag *jtag_info)
+{
+	return esirisc_jtag_send_ctrl(jtag_info, DEBUG_DEASSERT_RESET);
+}
+
+int esirisc_jtag_break(struct esirisc_jtag *jtag_info)
+{
+	return esirisc_jtag_send_ctrl(jtag_info, DEBUG_BREAK);
+}
+
+int esirisc_jtag_continue(struct esirisc_jtag *jtag_info)
+{
+	return esirisc_jtag_send_ctrl(jtag_info, DEBUG_CONTINUE);
+}
+
+int esirisc_jtag_flush_caches(struct esirisc_jtag *jtag_info)
+{
+	return esirisc_jtag_send_ctrl(jtag_info, DEBUG_FLUSH_CACHES);
+}
@@ -0,0 +1,104 @@
+/***************************************************************************
+ *   Copyright (C) 2018 by Square, Inc.                                    *
+ *   Steven Stallion <stallion@squareup.com>                               *
+ *   James Zhao <hjz@squareup.com>                                         *
+ *                                                                         *
+ *   This program is free software; you can redistribute it and/or modify  *
+ *   it under the terms of the GNU General Public License as published by  *
+ *   the Free Software Foundation; either version 2 of the License, or     *
+ *   (at your option) any later version.                                   *
+ *                                                                         *
+ *   This program is distributed in the hope that it will be useful,       *
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of        *
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
+ *   GNU General Public License for more details.                          *
+ *                                                                         *
+ *   You should have received a copy of the GNU General Public License     *
+ *   along with this program.  If not, see <http://www.gnu.org/licenses/>. *
+ ***************************************************************************/
+
+#ifndef OPENOCD_TARGET_ESIRISC_JTAG_H
+#define OPENOCD_TARGET_ESIRISC_JTAG_H
+
+#include <jtag/jtag.h>
+
+/* TAP Instructions */
+#define INSTR_IDCODE			0x8
+#define INSTR_DEBUG				0x9
+#define INSTR_BYPASS			0xf
+#define INSTR_LENGTH			4
+
+/* eSi-Debug Commands */
+#define DEBUG_NOP				0x00
+#define DEBUG_READ_BYTE			0x10
+#define DEBUG_READ_HWORD		0x20
+#define DEBUG_READ_WORD			0x30
+#define DEBUG_WRITE_BYTE		0x60
+#define DEBUG_WRITE_HWORD		0x70
+#define DEBUG_WRITE_WORD		0x80
+#define DEBUG_READ_REG			0xb0
+#define DEBUG_WRITE_REG			0xc0
+#define DEBUG_READ_CSR			0xd0
+#define DEBUG_WRITE_CSR			0xe0
+#define DEBUG_ENABLE_DEBUG		0xf0
+#define DEBUG_DISABLE_DEBUG		0xf2
+#define DEBUG_ASSERT_RESET		0xf4
+#define DEBUG_DEASSERT_RESET	0xf6
+#define DEBUG_BREAK				0xf8
+#define DEBUG_CONTINUE			0xfa
+#define DEBUG_FLUSH_CACHES		0xfc
+
+/* Exception IDs */
+#define EID_OVERFLOW			0x3d
+#define EID_CANT_DEBUG			0x3e
+#define EID_NONE				0x3f
+
+/* Byte Stuffing */
+#define STUFF_MARKER			0x55
+#define PAD_BYTE				0xaa
+
+struct esirisc_jtag {
+	struct jtag_tap *tap;
+	uint8_t status;
+};
+
+bool esirisc_jtag_is_debug_active(struct esirisc_jtag *jtag_info);
+bool esirisc_jtag_is_stopped(struct esirisc_jtag *jtag_info);
+uint8_t esirisc_jtag_get_eid(struct esirisc_jtag *jtag_info);
+
+int esirisc_jtag_read_byte(struct esirisc_jtag *jtag_info,
+		uint32_t address, uint8_t *data);
+int esirisc_jtag_read_hword(struct esirisc_jtag *jtag_info,
+		uint32_t address, uint16_t *data);
+int esirisc_jtag_read_word(struct esirisc_jtag *jtag_info,
+		uint32_t address, uint32_t *data);
+
+int esirisc_jtag_write_byte(struct esirisc_jtag *jtag_info,
+		uint32_t address, uint8_t data);
+int esirisc_jtag_write_hword(struct esirisc_jtag *jtag_info,
+		uint32_t address, uint16_t data);
+int esirisc_jtag_write_word(struct esirisc_jtag *jtag_info,
+		uint32_t address, uint32_t data);
+
+int esirisc_jtag_read_reg(struct esirisc_jtag *jtag_info,
+		uint8_t reg, uint32_t *data);
+int esirisc_jtag_write_reg(struct esirisc_jtag *jtag_info,
+		uint8_t reg, uint32_t data);
+
+int esirisc_jtag_read_csr(struct esirisc_jtag *jtag_info,
+		uint8_t bank, uint8_t csr, uint32_t *data);
+int esirisc_jtag_write_csr(struct esirisc_jtag *jtag_info,
+		uint8_t bank, uint8_t csr, uint32_t data);
+
+int esirisc_jtag_enable_debug(struct esirisc_jtag *jtag_info);
+int esirisc_jtag_disable_debug(struct esirisc_jtag *jtag_info);
+
+int esirisc_jtag_assert_reset(struct esirisc_jtag *jtag_info);
+int esirisc_jtag_deassert_reset(struct esirisc_jtag *jtag_info);
+
+int esirisc_jtag_break(struct esirisc_jtag *jtag_info);
+int esirisc_jtag_continue(struct esirisc_jtag *jtag_info);
+
+int esirisc_jtag_flush_caches(struct esirisc_jtag *jtag_info);
+
+#endif /* OPENOCD_TARGET_ESIRISC_JTAG_H */
@@ -0,0 +1,184 @@
+/***************************************************************************
+ *   Copyright (C) 2018 by Square, Inc.                                    *
+ *   Steven Stallion <stallion@squareup.com>                               *
+ *   James Zhao <hjz@squareup.com>                                         *
+ *                                                                         *
+ *   This program is free software; you can redistribute it and/or modify  *
+ *   it under the terms of the GNU General Public License as published by  *
+ *   the Free Software Foundation; either version 2 of the License, or     *
+ *   (at your option) any later version.                                   *
+ *                                                                         *
+ *   This program is distributed in the hope that it will be useful,       *
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of        *
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
+ *   GNU General Public License for more details.                          *
+ *                                                                         *
+ *   You should have received a copy of the GNU General Public License     *
+ *   along with this program.  If not, see <http://www.gnu.org/licenses/>. *
+ ***************************************************************************/
+
+#ifndef OPENOCD_TARGET_ESIRISC_REGS_H
+#define OPENOCD_TARGET_ESIRISC_REGS_H
+
+enum esirisc_reg_num {
+	ESIRISC_SP,
+	ESIRISC_RA,
+	ESIRISC_R2,
+	ESIRISC_R3,
+	ESIRISC_R4,
+	ESIRISC_R5,
+	ESIRISC_R6,
+	ESIRISC_R7,
+	ESIRISC_R8,
+	ESIRISC_R9,
+	ESIRISC_R10,
+	ESIRISC_R11,
+	ESIRISC_R12,
+	ESIRISC_R13,
+	ESIRISC_R14,
+	ESIRISC_R15,
+	ESIRISC_R16,
+	ESIRISC_R17,
+	ESIRISC_R18,
+	ESIRISC_R19,
+	ESIRISC_R20,
+	ESIRISC_R21,
+	ESIRISC_R22,
+	ESIRISC_R23,
+	ESIRISC_R24,
+	ESIRISC_R25,
+	ESIRISC_R26,
+	ESIRISC_R27,
+	ESIRISC_R28,
+	ESIRISC_R29,
+	ESIRISC_R30,
+	ESIRISC_R31,
+
+	ESIRISC_V0,
+	ESIRISC_V1,
+	ESIRISC_V2,
+	ESIRISC_V3,
+	ESIRISC_V4,
+	ESIRISC_V5,
+	ESIRISC_V6,
+	ESIRISC_V7,
+	ESIRISC_V8,
+	ESIRISC_V9,
+	ESIRISC_V10,
+	ESIRISC_V11,
+	ESIRISC_V12,
+	ESIRISC_V13,
+	ESIRISC_V14,
+	ESIRISC_V15,
+	ESIRISC_V16,
+	ESIRISC_V17,
+	ESIRISC_V18,
+	ESIRISC_V19,
+	ESIRISC_V20,
+	ESIRISC_V21,
+	ESIRISC_V22,
+	ESIRISC_V23,
+	ESIRISC_V24,
+	ESIRISC_V25,
+	ESIRISC_V26,
+	ESIRISC_V27,
+	ESIRISC_V28,
+	ESIRISC_V29,
+	ESIRISC_V30,
+	ESIRISC_V31,
+
+	ESIRISC_A0,
+	ESIRISC_A1,
+	ESIRISC_A2,
+	ESIRISC_A3,
+	ESIRISC_A4,
+	ESIRISC_A5,
+	ESIRISC_A6,
+	ESIRISC_A7,
+
+	ESIRISC_PC,
+	ESIRISC_CAS,
+	ESIRISC_TC,
+	ESIRISC_ETA,
+	ESIRISC_ETC,
+	ESIRISC_EPC,
+	ESIRISC_ECAS,
+	ESIRISC_EID,
+	ESIRISC_ED,
+	ESIRISC_IP,
+	ESIRISC_IM,
+	ESIRISC_IS,
+	ESIRISC_IT,
+
+	ESIRISC_NUM_REGS,
+};
+
+/* CSR Banks */
+#define CSR_THREAD					0x00
+#define CSR_INTERRUPT				0x01
+#define CSR_DEBUG					0x04
+#define CSR_CONFIG					0x05
+#define CSR_TRACE					0x09
+
+/* Thread CSRs */
+#define CSR_THREAD_TC				0x00	/* Thread Control */
+#define CSR_THREAD_PC				0x01	/* Program Counter */
+#define CSR_THREAD_CAS				0x02	/* Comparison & Arithmetic Status */
+#define CSR_THREAD_AC				0x03	/* Arithmetic Control */
+#define CSR_THREAD_LF				0x04	/* Locked Flag */
+#define CSR_THREAD_LA				0x05	/* Locked Address */
+#define CSR_THREAD_ETA				0x07	/* Exception Table Address */
+#define CSR_THREAD_ETC				0x08	/* Exception TC */
+#define CSR_THREAD_EPC				0x09	/* Exception PC */
+#define CSR_THREAD_ECAS				0x0a	/* Exception CAS */
+#define CSR_THREAD_EID				0x0b	/* Exception ID */
+#define CSR_THREAD_ED				0x0c	/* Exception Data */
+
+/* Interrupt CSRs */
+#define CSR_INTERRUPT_IP			0x00	/* Interrupt Pending */
+#define CSR_INTERRUPT_IA			0x01	/* Interrupt Acknowledge */
+#define CSR_INTERRUPT_IM			0x02	/* Interrupt Mask */
+#define CSR_INTERRUPT_IS			0x03	/* Interrupt Sense */
+#define CSR_INTERRUPT_IT			0x04	/* Interrupt Trigger */
+
+/* Debug CSRs */
+#define CSR_DEBUG_DC				0x00	/* Debug Control */
+#define CSR_DEBUG_IBC				0x01	/* Instruction Breakpoint Control */
+#define CSR_DEBUG_DBC				0x02	/* Data Breakpoint Control */
+#define CSR_DEBUG_HWDC				0x03	/* Hardware Debug Control */
+#define CSR_DEBUG_DBS				0x04	/* Data Breakpoint Size */
+#define CSR_DEBUG_DBR				0x05	/* Data Breakpoint Range */
+#define CSR_DEBUG_IBAn				0x08	/* Instruction Breakpoint Address [0..7] */
+#define CSR_DEBUG_DBAn				0x10	/* Data Breakpoint Address [0..7] */
+
+/* Configuration CSRs */
+#define CSR_CONFIG_ARCH0			0x00	/* Architectural Configuration 0 */
+#define CSR_CONFIG_ARCH1			0x01	/* Architectural Configuration 1 */
+#define CSR_CONFIG_ARCH2			0x02	/* Architectural Configuration 2 */
+#define CSR_CONFIG_ARCH3			0x03	/* Architectural Configuration 3 */
+#define CSR_CONFIG_MEM				0x04	/* Memory Configuration */
+#define CSR_CONFIG_IC				0x05	/* Instruction Cache Configuration */
+#define CSR_CONFIG_DC				0x06	/* Data Cache Configuration */
+#define CSR_CONFIG_INT				0x07	/* Interrupt Configuration */
+#define	CSR_CONFIG_ISAn				0x08	/* Instruction Set Configuration [0..6] */
+#define CSR_CONFIG_DBG				0x0f	/* Debug Configuration */
+#define CSR_CONFIG_MID				0x10	/* Manufacturer ID */
+#define CSR_CONFIG_REV				0x11	/* Revision Number */
+#define CSR_CONFIG_MPID				0x12	/* Mulitprocessor ID */
+#define CSR_CONFIG_FREQn			0x13	/* Frequency [0..2] */
+#define CSR_CONFIG_TRACE			0x16	/* Trace Configuration */
+
+/* Trace CSRs */
+#define CSR_TRACE_CONTROL			0x00
+#define CSR_TRACE_STATUS			0x01
+#define CSR_TRACE_BUFFER_START		0x02
+#define CSR_TRACE_BUFFER_END		0x03
+#define CSR_TRACE_BUFFER_CUR		0x04
+#define CSR_TRACE_TRIGGER			0x05
+#define CSR_TRACE_START_DATA		0x06
+#define CSR_TRACE_START_MASK		0x07
+#define CSR_TRACE_STOP_DATA			0x08
+#define CSR_TRACE_STOP_MASK			0x09
+#define CSR_TRACE_DELAY				0x0a
+
+#endif /* OPENOCD_TARGET_ESIRISC_REGS_H */
@@ -0,0 +1,181 @@
+/*****************************************************************************
+ *   Copyright (C) 2016 by Matthias Welwarsky <matthias.welwarsky@sysgo.com> *
+ *                                                                           *
+ *   This program is free software; you can redistribute it and/or modify    *
+ *   it under the terms of the GNU General Public License as published by    *
+ *   the Free Software Foundation; either version 2 of the License, or       *
+ *   (at your option) any later version.                                     *
+ *                                                                           *
+ *   This program is distributed in the hope that it will be useful,         *
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of          *
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the           *
+ *   GNU General Public License for more details.                            *
+ ****************************************************************************/
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include "target.h"
+#include "target_type.h"
+#include "arm.h"
+#include "arm_adi_v5.h"
+
+#include <jtag/jtag.h>
+
+struct mem_ap {
+	struct arm arm;
+	struct adiv5_ap *ap;
+	int ap_num;
+};
+
+static int mem_ap_target_create(struct target *target, Jim_Interp *interp)
+{
+	struct mem_ap *mem_ap = calloc(1, sizeof(struct mem_ap));
+	struct adiv5_private_config *pc;
+
+	pc = (struct adiv5_private_config *)target->private_config;
+	if (pc == NULL)
+		return ERROR_FAIL;
+
+	if (pc->ap_num == DP_APSEL_INVALID) {
+		LOG_ERROR("AP number not specified");
+		return ERROR_FAIL;
+	}
+
+	mem_ap->ap_num = pc->ap_num;
+	mem_ap->arm.common_magic = ARM_COMMON_MAGIC;
+	mem_ap->arm.dap = pc->dap;
+
+	target->arch_info = mem_ap;
+
+	return ERROR_OK;
+}
+
+static int mem_ap_init_target(struct command_context *cmd_ctx, struct target *target)
+{
+	LOG_DEBUG("%s", __func__);
+	target->state = TARGET_UNKNOWN;
+	return ERROR_OK;
+}
+
+static int mem_ap_arch_state(struct target *target)
+{
+	LOG_DEBUG("%s", __func__);
+	return ERROR_OK;
+}
+
+static int mem_ap_poll(struct target *target)
+{
+	if (target->state == TARGET_UNKNOWN)
+		target->state = TARGET_RUNNING;
+
+	return ERROR_OK;
+}
+
+static int mem_ap_halt(struct target *target)
+{
+	LOG_DEBUG("%s", __func__);
+	target->state = TARGET_HALTED;
+	return ERROR_OK;
+}
+
+static int mem_ap_resume(struct target *target, int current, target_addr_t address,
+		int handle_breakpoints, int debug_execution)
+{
+	LOG_DEBUG("%s", __func__);
+	target->state = TARGET_RUNNING;
+	return ERROR_OK;
+}
+
+static int mem_ap_step(struct target *target, int current, target_addr_t address,
+				int handle_breakpoints)
+{
+	LOG_DEBUG("%s", __func__);
+	target->state = TARGET_HALTED;
+	return ERROR_OK;
+}
+
+static int mem_ap_assert_reset(struct target *target)
+{
+	target->state = TARGET_RESET;
+
+	LOG_DEBUG("%s", __func__);
+	return ERROR_OK;
+}
+
+static int mem_ap_examine(struct target *target)
+{
+	struct mem_ap *mem_ap = target->arch_info;
+
+	if (!target_was_examined(target)) {
+		mem_ap->ap = dap_ap(mem_ap->arm.dap, mem_ap->ap_num);
+		target_set_examined(target);
+		target->state = TARGET_UNKNOWN;
+		return mem_ap_init(mem_ap->ap);
+	}
+
+	return ERROR_OK;
+}
+
+static int mem_ap_deassert_reset(struct target *target)
+{
+	if (target->reset_halt)
+		target->state = TARGET_HALTED;
+	else
+		target->state = TARGET_RUNNING;
+
+	LOG_DEBUG("%s", __func__);
+	return ERROR_OK;
+}
+
+static int mem_ap_read_memory(struct target *target, target_addr_t address,
+			       uint32_t size, uint32_t count, uint8_t *buffer)
+{
+	struct mem_ap *mem_ap = target->arch_info;
+
+	LOG_DEBUG("Reading memory at physical address 0x" TARGET_ADDR_FMT
+		  "; size %" PRId32 "; count %" PRId32, address, size, count);
+
+	if (count == 0 || buffer == NULL)
+		return ERROR_COMMAND_SYNTAX_ERROR;
+
+	return mem_ap_read_buf(mem_ap->ap, buffer, size, count, address);
+}
+
+static int mem_ap_write_memory(struct target *target, target_addr_t address,
+				uint32_t size, uint32_t count,
+				const uint8_t *buffer)
+{
+	struct mem_ap *mem_ap = target->arch_info;
+
+	LOG_DEBUG("Writing memory at physical address 0x" TARGET_ADDR_FMT
+		  "; size %" PRId32 "; count %" PRId32, address, size, count);
+
+	if (count == 0 || buffer == NULL)
+		return ERROR_COMMAND_SYNTAX_ERROR;
+
+	return mem_ap_write_buf(mem_ap->ap, buffer, size, count, address);
+}
+
+struct target_type mem_ap_target = {
+	.name = "mem_ap",
+
+	.target_create = mem_ap_target_create,
+	.init_target = mem_ap_init_target,
+	.examine = mem_ap_examine,
+	.target_jim_configure = adiv5_jim_configure,
+
+	.poll = mem_ap_poll,
+	.arch_state = mem_ap_arch_state,
+
+	.halt = mem_ap_halt,
+	.resume = mem_ap_resume,
+	.step = mem_ap_step,
+
+	.assert_reset = mem_ap_assert_reset,
+	.deassert_reset = mem_ap_deassert_reset,
+
+	.read_memory = mem_ap_read_memory,
+	.write_memory = mem_ap_write_memory,
+};
@@ -44,6 +44,8 @@ struct reg *register_get_by_name(struct reg_cache *first,

 	while (cache) {
 		for (i = 0; i < cache->num_regs; i++) {
+			if (cache->reg_list[i].exist == false)
+				continue;
 			if (strcmp(cache->reg_list[i].name, name) == 0)
 				return &(cache->reg_list[i]);
 		}
@@ -84,6 +86,8 @@ void register_cache_invalidate(struct reg_cache *cache)
 	struct reg *reg = cache->reg_list;

 	for (unsigned n = cache->num_regs; n != 0; n--, reg++) {
+		if (reg->exist == false)
+			continue;
 		reg->valid = 0;
 		reg->dirty = 0;
 	}
@@ -108,6 +108,8 @@ extern struct target_type quark_x10xx_target;
 extern struct target_type quark_d20xx_target;
 extern struct target_type stm8_target;
 extern struct target_type riscv_target;
+extern struct target_type mem_ap_target;
+extern struct target_type esirisc_target;

 static struct target_type *target_types[] = {
 	&arm7tdmi_target,
@@ -141,6 +143,8 @@ static struct target_type *target_types[] = {
 	&quark_d20xx_target,
 	&stm8_target,
 	&riscv_target,
+	&mem_ap_target,
+	&esirisc_target,
 #if BUILD_TARGET64
 	&aarch64_target,
 #endif
@@ -513,9 +517,7 @@ struct target *get_target_by_num(int num)

 struct target *get_current_target(struct command_context *cmd_ctx)
 {
-	struct target *target = cmd_ctx->current_target_override
-		? cmd_ctx->current_target_override
-		: cmd_ctx->current_target;
+	struct target *target = get_current_target_or_null(cmd_ctx);

 	if (target == NULL) {
 		LOG_ERROR("BUG: current_target out of bounds");
@@ -525,6 +527,13 @@ struct target *get_current_target(struct command_context *cmd_ctx)
 	return target;
 }

+struct target *get_current_target_or_null(struct command_context *cmd_ctx)
+{
+	return cmd_ctx->current_target_override
+		? cmd_ctx->current_target_override
+		: cmd_ctx->current_target;
+}
+
 int target_poll(struct target *target)
 {
 	int retval;
@@ -1043,6 +1052,9 @@ int target_run_flash_async_algorithm(struct target *target,
 		retval = target_write_u32(target, wp_addr, wp);
 		if (retval != ERROR_OK)
 			break;
+
+		/* Avoid GDB timeouts */
+		keep_alive();
 	}

 	if (retval != ERROR_OK) {
@@ -1197,12 +1209,29 @@ int target_hit_watchpoint(struct target *target,
 	return target->type->hit_watchpoint(target, hit_watchpoint);
 }

+const char *target_get_gdb_arch(struct target *target)
+{
+	if (target->type->get_gdb_arch == NULL)
+		return NULL;
+	return target->type->get_gdb_arch(target);
+}
+
 int target_get_gdb_reg_list(struct target *target,
 		struct reg **reg_list[], int *reg_list_size,
 		enum target_register_class reg_class)
 {
 	return target->type->get_gdb_reg_list(target, reg_list, reg_list_size, reg_class);
 }
+
+bool target_supports_gdb_connection(struct target *target)
+{
+	/*
+	 * based on current code, we can simply exclude all the targets that
+	 * don't provide get_gdb_reg_list; this could change with new targets.
+	 */
+	return !!target->type->get_gdb_reg_list;
+}
+
 int target_step(struct target *target,
 		int current, target_addr_t address, int handle_breakpoints)
 {
@@ -1927,6 +1956,7 @@ static void target_destroy(struct target *target)
 		target->smp = 0;
 	}

+	free(target->gdb_port_override);
 	free(target->type);
 	free(target->trace_info);
 	free(target->fileio_info);
@@ -2792,6 +2822,8 @@ COMMAND_HANDLER(handle_reg_command)
 			for (i = 0, reg = cache->reg_list;
 					i < cache->num_regs;
 					i++, reg++, count++) {
+				if (reg->exist == false)
+					continue;
 				/* only print cached values if they are valid */
 				if (reg->exist) {
 					if (reg->valid) {
@@ -2847,14 +2879,15 @@ COMMAND_HANDLER(handle_reg_command)
 		/* access a single register by its name */
 		reg = register_get_by_name(target->reg_cache, CMD_ARGV[0], 1);

-		if (!reg) {
-			command_print(CMD_CTX, "register %s not found in current target", CMD_ARGV[0]);
-			return ERROR_OK;
-		}
+		if (!reg)
+			goto not_found;
 	}

 	assert(reg != NULL); /* give clang a hint that we *know* reg is != NULL here */

+	if (!reg->exist)
+		goto not_found;
+
 	/* display a register */
 	if ((CMD_ARGC == 1) || ((CMD_ARGC == 2) && !((CMD_ARGV[1][0] >= '0')
 			&& (CMD_ARGV[1][0] <= '9')))) {
@@ -2898,6 +2931,10 @@ COMMAND_HANDLER(handle_reg_command)
 	}

 	return ERROR_COMMAND_SYNTAX_ERROR;
+
+not_found:
+	command_print(CMD_CTX, "register %s not found in current target", CMD_ARGV[0]);
+	return ERROR_OK;
 }

 COMMAND_HANDLER(handle_poll_command)
@@ -4550,6 +4587,7 @@ enum target_cfg_param {
 	TCFG_DBGBASE,
 	TCFG_RTOS,
 	TCFG_DEFER_EXAMINE,
+	TCFG_GDB_PORT,
 };

 static Jim_Nvp nvp_config_opts[] = {
@@ -4565,6 +4603,7 @@ static Jim_Nvp nvp_config_opts[] = {
 	{ .name = "-dbgbase",          .value = TCFG_DBGBASE },
 	{ .name = "-rtos",             .value = TCFG_RTOS },
 	{ .name = "-defer-examine",    .value = TCFG_DEFER_EXAMINE },
+	{ .name = "-gdb-port",         .value = TCFG_GDB_PORT },
 	{ .name = NULL, .value = -1 }
 };

@@ -4852,6 +4891,20 @@ no_params:
 			/* loop for more */
 			break;

+		case TCFG_GDB_PORT:
+			if (goi->isconfigure) {
+				const char *s;
+				e = Jim_GetOpt_String(goi, &s, NULL);
+				if (e != JIM_OK)
+					return e;
+				target->gdb_port_override = strdup(s);
+			} else {
+				if (goi->argc != 0)
+					goto no_params;
+			}
+			Jim_SetResultString(goi->interp, target->gdb_port_override ? : "undefined", -1);
+			/* loop for more */
+			break;
 		}
 	} /* while (goi->argc) */

@@ -5626,6 +5679,8 @@ static int target_create(Jim_GetOptInfo *goi)
 	target->rtos = NULL;
 	target->rtos_auto_detect = false;

+	target->gdb_port_override = NULL;
+
 	/* Do the rest as "configure" options */
 	goi->isconfigure = 1;
 	e = target_configure(goi, target);
@@ -5648,6 +5703,7 @@ static int target_create(Jim_GetOptInfo *goi)
 	}

 	if (e != JIM_OK) {
+		free(target->gdb_port_override);
 		free(target->type);
 		free(target);
 		return e;
@@ -5665,6 +5721,7 @@ static int target_create(Jim_GetOptInfo *goi)
 		e = (*(target->type->target_create))(target, goi->interp);
 		if (e != ERROR_OK) {
 			LOG_DEBUG("target_create failed");
+			free(target->gdb_port_override);
 			free(target->type);
 			free(target->cmd_name);
 			free(target);
@@ -206,6 +206,8 @@ struct target {
 	/* file-I/O information for host to do syscall */
 	struct gdb_fileio_info *fileio_info;

+	char *gdb_port_override;			/* target-specific override for gdb_port */
+
 	/* The semihosting information, extracted from the target. */
 	struct semihosting *semihosting;
 };
@@ -223,6 +225,13 @@ struct gdb_fileio_info {
 	uint64_t param_4;
 };

+/** Returns a description of the endianness for the specified target. */
+static inline const char *target_endianness(struct target *target)
+{
+	return (target->endianness == TARGET_ENDIAN_UNKNOWN) ? "unknown" :
+			(target->endianness == TARGET_BIG_ENDIAN) ? "big endian" : "little endian";
+}
+
 /** Returns the instance-specific name of the specified target. */
 static inline const char *target_name(struct target *target)
 {
@@ -387,6 +396,7 @@ int target_call_timer_callbacks_now(void);

 struct target *get_target_by_num(int num);
 struct target *get_current_target(struct command_context *cmd_ctx);
+struct target *get_current_target_or_null(struct command_context *cmd_ctx);
 struct target *get_target(const char *id);

 /**
@@ -470,6 +480,13 @@ int target_remove_watchpoint(struct target *target,
 int target_hit_watchpoint(struct target *target,
 		struct watchpoint **watchpoint);

+/**
+ * Obtain the architecture for GDB.
+ *
+ * This routine is a wrapper for target->type->get_gdb_arch.
+ */
+const char *target_get_gdb_arch(struct target *target);
+
 /**
 * Obtain the registers for GDB.
 *
@@ -479,6 +496,13 @@ int target_get_gdb_reg_list(struct target *target,
 		struct reg **reg_list[], int *reg_list_size,
 		enum target_register_class reg_class);

+/**
+ * Check if @a target allows GDB connections.
+ *
+ * Some target do not implement the necessary code required by GDB.
+ */
+bool target_supports_gdb_connection(struct target *target);
+
 /**
 * Step the target.
 *
@@ -88,6 +88,15 @@ struct target_type {
 	int (*deassert_reset)(struct target *target);
 	int (*soft_reset_halt)(struct target *target);

+	/**
+	 * Target architecture for GDB.
+	 *
+	 * The string returned by this function will not be automatically freed;
+	 * if dynamic allocation is used for this value, it must be managed by
+	 * the target, ideally by caching the result for subsequent calls.
+	 */
+	const char *(*get_gdb_arch)(struct target *target);
+
 	/**
 	 * Target register access for GDB.  Do @b not call this function
 	 * directly, use target_get_gdb_reg_list() instead.