path: root/utils/hwstub
AgeCommit message (Collapse)AuthorFilesLines
2021-03-25usb: implement macro for initializing USB stringsJames Buren2-22/+11
This uses the new unicode string literal feature that is available now to greatly simplify the initialization of these special string types. This makes them much more readable at a quick glance. Change-Id: Iad8b49aa763486608e3bb7e83fb8abfb48ce0a7b
2020-09-17jz4760: Heavily rework USB driver to add working DMA supportSolomon Peachy1-0/+5
* DMA Bulk IN (ie our TX) results in sequential transfers 33-68% faster. * DMA Bulk OUT (ie RX) is mostly stripped out due to complete brokenness. * Interrupt and control endpoints remain PIO-driven. Other improvements: 1) Use consistent endpoint references (no magic numbers) 2) Greatly enhanced logging 3) DMA support can be compiled out completely 4) Setting lockswitch will disable all DMA operations at runtime 5) Much more robust error checking and recovery Change-Id: I57b82e655e55ced0dfe289e379b0b61d8fe443b4
2018-09-07MIPS: fix memset()Marcin Bukat1-112/+3
swr/swl instructions used for word aligning were wrong. This made memset() terribly broken. I can't imagine how it went uncaught for soooo long. Spotted by Solomon Peachy. I run unit tests for alignments 0,1,2,3 size 1, 2, 3, 4, 5, 63, 64, 65, 127, 128, 129; and fill pattern 0x00 and other (since 0 is special case in this implementation). Change-Id: I513a10734335fe97734c10ab5a6c3e3fb3f4687a
2017-11-12hwstub: add code to dump STMP romAmaury Pouly2-1/+18
Change-Id: I083024662f3c085f7bcd2f85b0a68de85725b0f3
2017-11-12hwstub: expose read/write functionsAmaury Pouly1-0/+30
Previously only atomic read/write 8/16/32 were exposed. But it is useful to be able to read a whole buffer at once, this is more efficient than N times read8. Change-Id: I06e331641e1ab1f74c0e16e8c432eafb398e8e6d
2017-11-12hwstub: fix horrible bugAmaury Pouly1-1/+1
It's a wonder it worked, basically any big transfer returned garbage Change-Id: Ic2b2fc1805423c70db8eac40692ba842c72462ab
2017-09-15ATJ hwstub: Add cache coherencyMarcin Bukat1-0/+7
All the hard work was done by pamaury. I simply added proper defines. Change-Id: Ib374eea7cd20f35518ad8a68d771c57c54ae01ca
2017-08-28qeditor: fix compile error and some commentsAmaury Pouly2-5/+6
Change-Id: I157c83fea8173adc53254f15aa49e41ee1ba7549
2017-01-24hwstub: be more quiet about register description loading failureAmaury Pouly1-2/+4
Change-Id: I0edbb838022b71485179edec7361a6c554a1ab11
2017-01-24hwstub: fix memory leak in net backendAmaury Pouly1-0/+2
Change-Id: I98bef5aa0c518e698c42761d02899adde8bc4aca
2017-01-24hwstub/jz4760b: add lua code to probe for ei/di and ext instructionsAmaury Pouly1-0/+67
Add lua code to check whether ei/di and ext instructions are supported. This is unclear since xburst is somewhere between mips32r1 and mips32r2. Details results are below, but in summary: they don't work (ei has no effect, di/ext cause illegal instruction exceptions) > ./hwstub_shell -q -b -e 'require("jz/misc"); JZ.misc.enable_sram()' \ -f lua/xburst.lua -e "XBURST.test_ext_inst(0xb32d0000)" [...] Selecting soc jz4760b. Redirecting HW to hwstub.soc.jz4760b data: d7168acf error: lua/xburst.lua:209: call failed trapped exception in call > ./hwstub_shell -q -b -e 'require("jz/misc"); JZ.misc.enable_sram()' \ -f lua/xburst.lua -e "XBURST.test_ei_di_inst(0xb32d0000)" [...] Selecting soc jz4760b. Redirecting HW to hwstub.soc.jz4760b Testing ei Test SR Enable interrupts with CP0 SR: 0x1 Disable interrupts with CP0 SR: 0x0 Test ei/di Enable interrupts with ei SR: 0x0 Disable interrupts with di error: lua/xburst.lua:244: call failed trapped exception in call Change-Id: I2e162b5dd5e70488bcd8b58f3ca401a3ecab3c4b
2017-01-24hwstub: rewrite exception catchingAmaury Pouly10-3269/+125
Since we can catch exceptions like data aborts on read/write, it takes very little to also catch exceptions in calls. When extending this with the catching of illegal instructions, the call instruction now becomes much more robust and also for address and instruction probing. Since we can catch several types of exception, rename set_data_abort_jmp to set_exception_jmp. At the same time, simplify the logic in read/write request handlers. Also fix a bug in ARM jump code: it was using stmia r1, {..., pc} as if pc would get current pc + 8 but this is actually implementation defined on older ARMs (typically pc + 12) and deprecated on newer ARMs, so rewrite the code avoid that. The set_exception_jmp() function now also reports the exception type. Change-Id: Icd0dd52d2456b361b27c4776be09c3d13528ed93
2017-01-24hwstub/jz460b: implement exception recoveryAmaury Pouly4-1/+106
Now that we now that jz4760b implements EBASE, we can use it to rebase exceptions to use a k1seg address, that maps to the physical address of the TCSM0. It requires to enable HAB1 to have this translation. This most the most inefficient way to access tighly coupled memory ever, but it works. Change-Id: I894ca929c9835696102eb2fef44b06e6eaf96d44
2017-01-24hwstub: add tool to dump memory regions (such as ROM, RAM, or peripherals)Amaury Pouly2-1/+163
Although this case be done with hwstub_shell, this is common enough to deserve its own tool. Change-Id: I9253e40850f37257464548a3acefb14ea083841d
2017-01-24hwstub: small fixes to argument processing and usage()Amaury Pouly2-5/+6
Change-Id: I3daa5e0c3fa2e7eab6a3d75b4c8aa66254d72f3c
2017-01-24hwstub/jz4760b: build packtools automatically if neeededAmaury Pouly1-0/+7
Change-Id: I543e405bf75868d0f7509a35e08fe31ed253e0e6
2017-01-24hwstub: add verbose mode to makeAmaury Pouly1-1/+3
Use make V=1 to print all commands Change-Id: I28bd4151178413f10ddab292f1d582a9d019f5ea
2017-01-24hwstub: fix long transfers failing because of control xfer size of libusbAmaury Pouly2-2/+23
libusb limits control transfer sizes to 4k, see diff for details. Change-Id: Id2e638010274009ea641d06e9040a8b9ab9d54a9
2017-01-24hwstub: fix library sending wrong data on long transfersAmaury Pouly1-1/+1
Change-Id: I886b8dc28e306f631389dbed41451eb086fea4fc
2017-01-24hwstub: add Fiio X3II IPL/SPL dumping codeAmaury Pouly1-0/+50
Change-Id: I76f7cffc700e8051d02936c24e8a70a0f8925edf
2017-01-24hwstub: add Shanling M2 IPL/SPL dumping codeAmaury Pouly1-0/+50
Change-Id: I14987d9783dd371f4990a5bcfbfb2d1c0c9be213
2017-01-24hwstub: add various jz stuff and xburst testsAmaury Pouly2-0/+281
The JZ misc allows to enable and test SRAM. The XBurst code uses the coprocessor interface to analyse the cpu. It also provides a test platform for various features like EBASE and exceptions. I was able to test and confirm that on jz4760b (thus xburst), EBASE works (but top 2 bits are not controllable and always 01). The processor claims to support vector interrupts but this is untested. The values in ConfigX are not to be trusted blindly, clearly some are wrong. I tried to use the JZ4780 Config7 "ebase gate" to change bit 30 of EBASE but it does not work, which suggests that JZ480 uses a newer version of XBurst. Detailled log below: > ./hwstub_shell -q -f lua/xburst.lua -e "XBURST.init()" [...] XBurst: PRId: 0x2ed0024f CPU: JZ4760(B) Config: 0x80000483 Architecture Type: MIPS32 Architecture Level: Release 2 (or more) MMU Type: Standard TLB Config1: 0x3e63318a MMU Size: 32 ICache Sets per way: 128 Ways: 4 Line size: 32 DCache Sets per way: 128 Ways: 4 Line size: 32 FPU: no Config2: 0x80000000 Config3: 0x20 Vectored interrupt: yes Config7: 0x0 > ./hwstub_shell -q -e 'require("jz/misc"); JZ.misc.enable_sram()' \ -f lua/xburst.lua -e "XBURST.test_ebase(0x80000000);XBURST.test_ebase(0xb32d0000) [...] Testing EBASE... Disable BEV SR value: 0x2000fc00 EBASE value: 0x80000000 Value after writing 0x80000000: 0x80000000 Value after writing 0x80040000: 0x80040000 Test result: EBase seems to work Disable config7 gate: write 0x0 to Config7 Value after writing 0xfffff000: 0xbffff000 Enable config7 gate: write 0x80 to Config7 Value after writing 0xc0000000: 0x80000000 Config7 result: Config7 gate does not work Exception test with EBASE at 0x80000000... Writing instructions to memory Old SR: 0x2000fc00 New SR: 0xfc00 EBASE: 80000000 Before: cafebabe After: deadbeef Exception result: Exception and EBASE are working Testing EBASE... Disable BEV SR value: 0x2000fc00 EBASE value: 0x80000000 Value after writing 0x80000000: 0x80000000 Value after writing 0x80040000: 0x80040000 Test result: EBase seems to work Disable config7 gate: write 0x0 to Config7 Value after writing 0xfffff000: 0xbffff000 Enable config7 gate: write 0x80 to Config7 Value after writing 0xc0000000: 0x80000000 Config7 result: Config7 gate does not work Exception test with EBASE at 0xb32d0000... Writing instructions to memory Old SR: 0x2000fc00 New SR: 0xfc00 EBASE: b32d0000 Before: cafebabe After: deadbeef Exception result: Exception and EBASE are working Change-Id: I894227981a141a8c14419b36ed9f519baf145ad1
2017-01-24hwstub: fix bug in jz4760B boot rom backend probeAmaury Pouly1-1/+3
Change-Id: Idb2b3b3903d88c8f6b494d5c9f04778daf3aaed0
2017-01-24hwstub: add support for coprocessor operationsAmaury Pouly11-17/+423
At the moment the stub only implement them for MIPS. Change-Id: Ica835a0e9c70fa5675c3d655eae986e812a47de8
2017-01-24hwstub: implement EXEC command over netAmaury Pouly3-12/+90
Apparently I completely forgot to implement it so using hwstub over net would just fail all EXEC commands :-s Change-Id: I0d0506cbbce9b86c9a4f19036dacc922d1e51338
2017-01-24hwstub: add the possibility to flush caches before execAmaury Pouly4-1/+45
This is needed on the jz4760b because if some data is loaded to DRAM, then it is cached and a disaster lurks if dcaches/icache are not flushed. Targets that needs this must define CONFIG_FLUSH_CACHES in target-config.h and implement target_flush_caches(). Currently MIPS has some generic code for mips32r1 that requires to define {D,I}CACHE_SIZE and {D,I}CACHE_LINE_SIZE in target-config.h Change-Id: I5a3fc085de9445d8c8a2eb61ae4e2dc9bb6b4e8e
2017-01-24hwstub/jz4760b: fix some typos in lua script after register name changesAmaury Pouly2-9/+10
Change-Id: Ie46ec293fcd5a16143818e77cd6c79cc08620fb5
2017-01-24hwstub: add jz4760b stubAmaury Pouly11-0/+13307
The stub is quite versatile: it can be loaded using bootrom or another other means (like factory boot on Fiio X1). It relocates itself to TCSM0 and provides basic functionality (it does not recover from failed read/writes at the moment). Change-Id: Ib646a4b43fba9358d6f93f0f73a5c2e9bcd775a7
2017-01-24hwstub/tools/shell: add JZ4760B and Fiio X1 codeAmaury Pouly5-0/+686
The jz code can do several useful things like dumping the IPL and SPL. The Fiio code can play with backlight and has code do dump the IPL and SPL with the correct parameters (extracted by reverse engineering). Change-Id: I317b3174f5db8d38c9a56670c1d45565142ec208
2016-12-12hwstub/tools: always run make for the librariesAmaury Pouly1-2/+5
This ensures that the libs are always up-to-date hopefully. Change-Id: I790302fcabc91457091006de749b76735fdd510f
2016-12-12hwstub: various cleanupsAmaury Pouly4-6/+44
- hwstub load now properly stops reading the log when the device returns a 0 size buffer instead of STALLing - add debug output option to hwstub_load - correctly report transfered size on write error - add some debug error message in usb code so that some errors can be diagnosed more easily - add a batch mode to hwstub_shell to disable the interactive shell - increase usb control timeout to 1sec, 100ms was really tight - cap usb buffer size to ~4000 bytes because libusb has a hardwired limit of 4096 bytes for control transfers Change-Id: Id3200ab99ce70a7a3b09ce7faeaafa4a0fac64c7
2016-11-20hwstub/tools: fix compilation of shell against lua5.3Amaury Pouly1-49/+67
The unsigned function were deprecated and hidden begind a compat flag. Since they will get removed in the next version, I simply reimplemented them, those are mostly casts anyway. Change-Id: Ie5db81d7c8589b1e5e9b45a2a4ed41919aa07387
2016-11-10ATJ hwstub make irq based usb driver workMarcin Bukat1-112/+195
0e2b490 introduced rework of usb driver which was broken. It was reverted in f2da975 to restore hwstub functionality on ATJ. This commit reenables usb rework AND fixes remining issues. The problem was with 0 length OUT thransfers. Additionally a few cleanups were made. Change-Id: I529ea9ad6540509e9287ca7e1cd2b44369b03cbb
2016-11-08Revert "hwstub: rework usb driver for atj213x"Marcin Bukat1-142/+104
This reverts commit 0e2b4908d012dbd45a58002774f32b64ea8f83e3. Although I swear it was tested it apparently broke hwstub on atj. I will need to investigate more whats going on. Revert for now. Change-Id: I2ff3adf8c72bb0e53be7d81b975382adfb700eab
2016-11-06hwstub_shell: fix a horrible bugAmaury Pouly1-1/+1
Change-Id: I4ac259e6cd7b707ca725c6ba1c526f5aeed56b71
2016-10-22hwstub: fix compile and linking orderingAmaury Pouly2-5/+5
Change-Id: I0acd3db2f644f4521da715d4931315bdb7548eae
2016-10-19fix typoAmaury Pouly1-1/+1
Change-Id: Ia69e5ff941549ca98b23b40927137bb29876b8f9
2016-04-08hwstub: remove the old libraryAmaury Pouly3-335/+3
Change-Id: I94d0f67cfd0d636407cd9cf3afbe0db4064de28e
2016-04-08hwstub: port hwstub_shell to the new libraryAmaury Pouly9-266/+740
Also use this opportunity to cleanup support for multiple devices: the shell now supports dynamic changes in the device and will call init() everytime a new device is selected, to prepare a new environment. The shell now honors register width on register read/write. The shell also provides access to variants as follows by creating a subtable under the register using the variant type in UPPER case and having the same layout as a register. For example if register HW.GPIO.DIR has variants "set" and "clr", those can be used like this: HW.GPIO.DIR.SET.write(0xff) HW.GPIO.DIR.CLR.write(0xff00) Change-Id: I943947fa98bce875de0cba4338e8b7196a4c1165
2016-04-08hwstub: port hwstub_load to the new libraryAmaury Pouly1-51/+43
Change-Id: I7e8ae50907401a9480a0da809a4470f1728d3a57
2016-04-08hwstub: rewrite and expand libraryAmaury Pouly19-28/+5051
Rewrite the hwstub library in C++, with a clean and modular design. The library was designed from the ground up to be aware of multithreading issues and to handle memory allocation nicely with shared pointers. Compared to the original library, it brings the following major features: - support for JZ boot devices, it is very easy to add support for others - support for network transparent operations (through sockets): both tcp and unix domains are support Change-Id: I75899cb9c7aa938c17ede2bb3f468e7a55d625b4
2016-03-14hwstub: fix warning: no newline at end of file with newer gccMarcin Bukat2-2/+4
Change-Id: Icb4233fb9b2b0d5b6f8c4a35dff300f38c8d3025
2016-03-14hwstub: rework usb driver for atj213xMarcin Bukat1-104/+142
Change-Id: I7b175103e567ae4375ff94e74ed1a06215f640c3
2015-11-17hwstub: fix atj213x dsp lua codeMarcin Bukat1-9/+9
Change-Id: I5fbd1799b958bedbe74f91bdcdd8a544e15d2a78
2015-11-17hwstub: Add ajt213x lua interface for DSP blockMarcin Bukat2-0/+159
With this you can upload and run code on DSP core in atj213x. The files can be produced using as2181. You can download this assembler from You should use extended mode (-x switch) since DSP core in atj is non standard and uses 24bit operands. PX register has different meaning as well and is used as MSB when loading other registers with immediates (immediate field is 16bit in instruction so to set register to 24bit value you need to store MSB in PX prior to this). MAC MR is 56bit accordingly. HIP interface seems to be mapped at standard addresses (except that regular 218x doesn't have HIP). Have a fun! Change-Id: I9a80ca0dd3718ba8435ae8579bfffa66e067e022
2015-09-29hwstub: make it possible to override toolchainAmaury Pouly4-16/+20
Default toolchain can be overriden using PREFIX, for example: PREFIX=arm-none-eabi- make Change-Id: I06f5ad0ad492b9f648ccba853a851918644f0500
2015-09-11soc_desc: new version of the desc file formatAmaury Pouly2-155/+224
Fix qeditor to use the old soc_desc_v1. Port hwstub_shell to the new description format. Change-Id: I9fefbff534bfaa5c3603bb3dd8307a2b76e88cfc
2015-06-28hwstub: Add completion and some pretty printing to the shellMarcin Bukat5-18/+1724
This uses slightly hacked luaprompt to provide all the goodis. See for original. Change-Id: Iedddb79abae5809299322bc215722dd928c35cca
2015-01-13hwstub: implement read/write data abort recoveryAmaury Pouly11-39/+304
Change-Id: I1625873b6864584c40984723d82548ad242ee08e
2014-11-28hwstub/atj213x: add clock setup to crt0.SMarcin Bukat1-1/+29
Change-Id: I3b6e1b8ee1fa76396f7abe7df69af26e9599cfe9 Reviewed-on: Reviewed-by: Marcin Bukat <> Tested: Marcin Bukat <>