Hi All.
I've hacked together a bit of flashing code across JTAG on ARM920T - very simple stuff using a semaphore to indicate a service request. It all seems to work seamlessly ( at least for the copy code ), and it resumes execution properly after each block of data. Unfortunately, once it leaves the "copy" code I hit a snag : PC becomes corrupt. I'm currently thinking I've mucked up the instruction count for the final PC fixup, and that I'm off by one or two which means in more complex code ( ie : not the semaphore polling code )I've a higher chance of executing code out of sequence.
//Halt code
/* STR r0, [r0] - Save R0 before use */ Data[0] = 0xe5800000; Data[1] = 0x00; debug_exec(Data, DEBUG_SPEED); /* STR r1, [r0] - Save R1 before use */ Data[0] = 0xe5801000; Data[1] = 0x00; debug_exec(Data, DEBUG_SPEED); /* STR r2, [r0] - Save R2 before use */ Data[0] = 0xe5802000; Data[1] = 0x00; debug_exec(Data, DEBUG_SPEED); /* MOV r0, PC - Copy PC to R0 */ Data[0] = 0xe1a0000f; Data[1] = 0x00; debug_exec(Data, DEBUG_SPEED); regs->r[0]=Data[1]; //Read out R0 /* STR r0, [r0] - Save PC into R0 */ Data[0] = 0xe5800000; Data[1] = 0x00; debug_exec(Data, DEBUG_SPEED); regs->r[1]=Data[1]; //Read out R1 /* NOP - Read out R2 */ Data[0] = 0xe1a00000; Data[1] = 0x00; debug_exec(Data, DEBUG_SPEED); regs->r[2]=Data[1]; //Read out R2 /* NOP */ Data[0] = 0xe1a00000; Data[1] = 0x00; debug_exec(Data, DEBUG_SPEED); /* NOP - Read out R1 */ Data[0] = 0xe1a00000; Data[1] = 0x00; debug_exec(Data, DEBUG_SPEED); regs->pc=Data[1]-0xXX; //Read out PC //Halt Code Ends
//Resume Code
/* LDR r2, [r0] - restore R2 */ Data[0] = 0xe5902000; Data[1]=0; debug_exec(Data, DEBUG_SPEED); /* LDR r1, [r0] - restore R1 */ Data[0] = 0xe5901000; Data[1]=0; debug_exec(Data, DEBUG_SPEED); /* LDR r0, [r0] */ Data[0] = 0xe5900000; Data[1]=0; debug_exec(Data, DEBUG_SPEED); /* NOP - scan in value for r2 */ Data[0] = 0xe1a00000; Data[1] = regs->r[2]; debug_exec(Data, DEBUG_SPEED); /* MOV PC, r0 - put r0 into PC */ /* - scan in value for r1 */ Data[0] = 0xe1a0f000; Data[1] = regs->r[1]; debug_exec(Data, DEBUG_SPEED); /* LDR r0, [r0] */ /* - scan in value for pc */ Data[0] = 0xe5900000; Data[1] = regs->pc; debug_exec(Data, DEBUG_SPEED); /* NOP */ Data[0] = 0xe1a00000; Data[1]=0; debug_exec(Data, DEBUG_SPEED); /* NOP */ Data[0] = 0xe1a00000; Data[1]=0; debug_exec(Data, DEBUG_SPEED); /* NOP - scan in value for r0 */ Data[0] = 0xe1a00000; Data[1] = regs->r[0]; debug_exec(Data, DEBUG_SPEED); /* SUB PC, PC, #0xXX - jump back PC */ Data[0] = 0xe24ff0XX; Data[1]=0; debug_exec(Data, DEBUG_SPEED); Data[0] = 0xe1a00000; Data[1]=0; debug_exec(Data, SYSTEM_SPEED);
//Resume Code Ends.
The code I'm injecting into the cache only ever affects R0-R2, and PC.
So : My question is - what are the two vlues of 0xXX above ?
in the Halt code section, does the count start with "MOV r0, PC" , or 4 execs later, with the value of R0 being read ?
I _think_ its the former, and the fixup is 0x20.
More confusingly , in the resume secion - where do you start counting the instructions from : "MOV PC, r0" , or again 4 exec later, with the data being loaded in ?
Any suggestions/corrections gratefully recieved.
J