From upstream (riscv-collab#684)

* flash/nor/atsame5: add LAN9255 devices

Support Microchip LAN9255 devices with embedded SAME53J MCU.

Signed-off-by: Hans-Erik Floryd <[email protected]>
Change-Id: Ia811c593bf7cf73e588d32873c68eb67c6fafad7
Reviewed-on: https://review.openocd.org/c/openocd/+/6811
Tested-by: jenkins
Reviewed-by: Antonio Borneo <[email protected]>
Reviewed-by: Tomas Vanek <[email protected]>

* tcl/board: Add EVB-LAN9255 config

Config for EVB-LAN9255, tested using Atmel-ICE debugger on J10
connector.

Signed-off-by: Hans-Erik Floryd <[email protected]>
Change-Id: I8bcf779e9363499a98aa0b7d10819c53da6a19e7
Reviewed-on: https://review.openocd.org/c/openocd/+/6812
Tested-by: jenkins
Reviewed-by: Antonio Borneo <[email protected]>

* aarch64: support for aarch32 ARM_MODE_UND

Fix:
unrecognized psr mode: 0x1b
cannot read system control register in this mode: (UNRECOGNIZED : 0x1b)

Change-Id: I4dc3e72f90d57e52c0fe63cb59a7529a398757b3

Signed-off-by: Julien Massot <[email protected]>
Change-Id: Ifa5d21ae97492fde9e8c79ee7d99d8a2a871b1b5
Reviewed-on: https://review.openocd.org/c/openocd/+/6808
Tested-by: jenkins
Reviewed-by: Antonio Borneo <[email protected]>

* Combine register lists of smp targets.

This is helpful when you want to pretend to gdb that your heterogeneous
multicore system is homogeneous, because gdb cannot handle heterogeneous
systems. This won't always works, but works fine if e.g. one of the
cores has an FPU while the other does not. (Specifically, HiFive
Unleashed has 1 core with no FPU, plus 4 cores with an FPU.)

Signed-off-by: Tim Newsome <[email protected]>
Change-Id: I05ff4c28646778fbc00327bc510be064bfe6c9f0
Reviewed-on: https://review.openocd.org/c/openocd/+/6362
Tested-by: jenkins
Reviewed-by: Antonio Borneo <[email protected]>

* semihosting: use open mode flags from GDB, not from sys/stat.h

Values defined in sys/stat.h are not guaranteed to match
the constants defined by the GDB remote protocol, which are defined in
https://sourceware.org/gdb/onlinedocs/gdb/Open-Flags.html#Open-Flags.
On my local system (Manjaro 21.2.1 x86_64), for example, O_TRUNC is
defined as 0x40, whereas GDB requires it to be 0x400,
causing all "w" file open modes to misbehave.

This patch has been tested with STM32F446.

Change-Id: Ifb2c740fd689e71d6f1a4bde1edaecd76fdca910
Signed-off-by: Pavel Kirienko <[email protected]>
Reviewed-on: https://review.openocd.org/c/openocd/+/6804
Tested-by: jenkins
Reviewed-by: Antonio Borneo <[email protected]>

* semihosting: User defined operation, Tcl command exec on host

Enabling a portion (0x100 - 0x107) of the user defined semihosting
operation number range (0x100 - 0x1FF) to be processed with the help of
the existing target event mechanism, to implement a general-purpose Tcl
interface for the target available on the host, via semihosting
interface.

Example usage:
- The user configures a Tcl command as a callback for one of the newly
	defined events (semihosting-user-cmd-0x10X) in the configuration
	file.
- The target can make a semihosting call with <opnum>, passing optional
	parameters for the call.

If there is no callback registered to the user defined operation number,
nothing happens.

Example usage: Configure RTT automatically with the exact, linked
control block location from target.

Signed-off-by: Zoltán Dudás <[email protected]>
Change-Id: I10e1784b1fecd4e630d78df81cb44bf1aa2fc247
Reviewed-on: https://review.openocd.org/c/openocd/+/6748
Tested-by: jenkins
Reviewed-by: Oleksij Rempel <[email protected]>
Reviewed-by: Antonio Borneo <[email protected]>

* target/smp: use a struct list_head to hold the smp targets

Instead of reinventing a simply linked list, reuse the list helper
for the list of targets in a smp cluster.
Using the existing helper, that implements a double linked list,
makes trivial going through the list in reverse order.

Change-Id: Ib36ad2955f15cd2a601b0b9e36ca6d948b12d00f
Signed-off-by: Antonio Borneo <[email protected]>
Reviewed-on: https://review.openocd.org/c/openocd/+/6783
Tested-by: jenkins

* helper/list: add list_for_each_entry_direction()

Use a bool flag to specify if the list should be forward or
backward iterated.

Change-Id: Ied19d049f46cdcb7f50137d459cc7c02014526bc
Signed-off-by: Antonio Borneo <[email protected]>
Reviewed-on: https://review.openocd.org/c/openocd/+/6784
Tested-by: jenkins

* target/riscv: revive 'riscv resume_order'

This functionality was lost in [1], which was merged as commit
615709d ("Upstream a whole host of RISC-V changes.").
Now it works as expected again.

Add convenience macro foreach_smp_target_direction().

Link: [1] riscv-collab#567
Change-Id: I1545fa6b45b8a07e27c8ff9dcdcfa2fc4f950cd1
Signed-off-by: Tim Newsome <[email protected]>
Signed-off-by: Antonio Borneo <[email protected]>
Reviewed-on: https://review.openocd.org/c/openocd/+/6785
Tested-by: jenkins

* doxygen: fix some function prototype description

Change-Id: I49311a643ea73143839d2f6bde976cfd76f8c67f
Signed-off-by: Antonio Borneo <[email protected]>
Reviewed-on: https://review.openocd.org/c/openocd/+/6830
Tested-by: jenkins

* Cadence virtual debug interface (vdebug) integration

Change-Id: I1bc105b3addc3f34161c2356c482ff3011e3f2cc
Signed-off-by: Jacek Wuwer <[email protected]>
Reviewed-on: https://review.openocd.org/c/openocd/+/6097
Tested-by: jenkins
Reviewed-by: Oleksij Rempel <[email protected]>
Reviewed-by: zapb <[email protected]>
Reviewed-by: Antonio Borneo <[email protected]>

* gdb_server: Include thread name as XML attribute

Explicitly providing a thread name in the "thread" element produces
better thread visualizations in downstream tools like IDEs.

Signed-off-by: Ben McMorran <[email protected]>
Change-Id: I102c14ddb8b87757fa474de8e3a3f6a1cfe10d98
Reviewed-on: https://review.openocd.org/c/openocd/+/6828
Tested-by: jenkins
Reviewed-by: zapb <[email protected]>
Reviewed-by: Antonio Borneo <[email protected]>

* Fix small memory leak.

See riscv-collab#672

Change-Id: Ia11ab9bcf860f770ea64ad867102c74b898f6b66
Signed-off-by: Tim Newsome <[email protected]>
Reviewed-on: https://review.openocd.org/c/openocd/+/6831
Tested-by: jenkins
Reviewed-by: zapb <[email protected]>
Reviewed-by: Antonio Borneo <[email protected]>

* server: remove remaining crust from dropped eCos code

Commit 39650e2 ("ecosboard: delete bit-rotted eCos code") has
removed eCos code but has left some empty function that was used
during non-eCos build to replace eCos mutex.

Drop the functions and the file that contain them.

Change-Id: I31bc0237ea699c11bd70921660f960ee406ffa80
Signed-off-by: Antonio Borneo <[email protected]>
Reviewed-on: https://review.openocd.org/c/openocd/+/6835
Tested-by: jenkins
Reviewed-by: Tomas Vanek <[email protected]>

* rtos: threadx: Add hla_target support for ThreadX

Tested with an AZ3166 dev board (which uses the STM32F412ZGT6) running
the Azure RTOS ThreadX demonstration system.

Signed-off-by: Ben McMorran <[email protected]>
Change-Id: I44c8f7701d9f1aaa872274166321cd7d34fb1855
Reviewed-on: https://review.openocd.org/c/openocd/+/6829
Tested-by: jenkins
Reviewed-by: Antonio Borneo <[email protected]>

* .gitmodules: switch away from repo.or.cz

The host repo.or.cz is often offline, creating issues for cloning
and building OpenOCD from scratch.
Already 'jimtcl' developer has dropped repo.or.cz, triggering the
OpenOCD commit 861e75f ("jimtcl: switch to github").

Change also the link of the remaining submodules 'git2cl' and
'libjaylink' to their respective main repository.

Change-Id: Ib513237427635359ce36a480a8f2060e2fb12ba4
Signed-off-by: Antonio Borneo <[email protected]>
Reviewed-on: https://review.openocd.org/c/openocd/+/6834
Tested-by: jenkins
Reviewed-by: zapb <[email protected]>

* flash/nor/stm32f2x: Fix erase of bank 2 sectors

This commit corrects the erase function for stm32f2x when dealing with
sectors in bank 2, for STM32F42x/43x devices with 1MB flash.

On STM32F42x/43x with 1MB flash in dual bank configuration, the sector
numbering is not consecutive. The last sector in bank 1 is number 7, and
the first sector in bank 2 is number 12.
The sector indices used by openocd, however, _are_ consecutive (0 to 15
in this case). The arguments "first" and "last" to stm32x_erase() are of
this type, and so the logic surrounding sector numbers needed to be
corrected.
Since the two banks in dual bank mode have the same number of sectors, a
sector index in bank 2 is larger than or equal to half the total number
of sectors.

Change-Id: I15260f8a86d9002769a1ae1c40ebdf62142dae18
Signed-off-by: Simon Johansson <[email protected]>
Reviewed-on: https://review.openocd.org/c/openocd/+/6810
Tested-by: jenkins
Reviewed-by: Tomas Vanek <[email protected]>
Reviewed-by: Tarek BOCHKATI <[email protected]>

* target/cortex_m: fix target_to_cm() helper

The third parameter of container_of() should point to the same member
as target->arch_info points to, struct arm.

It worked just because struct arm is the first member in
struct armv7m_common.
If you move arm member from the first place, OpenOCD fails heavily.

Change-Id: I0c0a5221490945563e17a0a34d99a603f1d6c2ff
Signed-off-by: Tomas Vanek <[email protected]>
Reviewed-on: https://review.openocd.org/c/openocd/+/6749
Tested-by: jenkins
Reviewed-by: Antonio Borneo <[email protected]>

* target/armv7m,cortex_m: introduce checked arch_info cast routines

target_to_armv7m() and target_to_cm() do not match the magic number
so they are not suitable for use outside of target driver code.

Add checked versions of pointer getters. Match the magic number
to ensure the returned value points to struct of the correct type.

Change-Id: If90ef7e969ef04f0f2103e0da29dcbe8e1ac1c0d
Signed-off-by: Tomas Vanek <[email protected]>
Reviewed-on: https://review.openocd.org/c/openocd/+/6750
Tested-by: jenkins
Reviewed-by: Antonio Borneo <[email protected]>

* target/cortex_m: add Cortex-M part number getter

The getter checks the magic numbers in arch_info to detect eventual
type mismatch.

Change-Id: I61134b05310a97ae9831517d0516c7b4240d35a5
Signed-off-by: Tomas Vanek <[email protected]>
Reviewed-on: https://review.openocd.org/c/openocd/+/6751
Tested-by: jenkins
Reviewed-by: Antonio Borneo <[email protected]>
Reviewed-by: Tarek BOCHKATI <[email protected]>

* flash/nor/stm32xx: fix segfault accessing Cortex-M part number

Some of STM32 flash drivers read Cortex-M part number from
cortex_m->core_info.
In corner cases the core_info pointer was observed uninitialised
even if target_was_examined() returned true. See also [1]

Use the new and safe helper to get Cortex-M part number.

While on it switch also target_to_cm()/target_to_armv7m() to the safe
versions. This prevents a crash when the flash bank is misconfigured
with non-Cortex-M target.

Add missing checks for target_was_examined() to flash probes.

[1] 6545: fix crash in case cortex_m->core_info is not set
    https://review.openocd.org/c/openocd/+/6545

Change-Id: If2471af74ebfe22f14442f48ae109b2e1bb5fa3b
Signed-off-by: Tomas Vanek <[email protected]>
Fixes: f5898bd (flash/stm32fxx.c: do not read CPUID as this info is stored in cortex_m_common)
Reviewed-on: https://review.openocd.org/c/openocd/+/6752
Tested-by: jenkins
Reviewed-by: Antonio Borneo <[email protected]>
Reviewed-by: Tarek BOCHKATI <[email protected]>

* cpld: altera-epm240: Add additional IDCODEs

This adds some additional IDCODEs from the datasheet. It also adds
support for customizing the tap name.

Signed-off-by: Sean Anderson <[email protected]>
Change-Id: I7cda10b92c229b61836c12cd9ca410de358ede2e
Reviewed-on: https://review.openocd.org/c/openocd/+/6846
Tested-by: jenkins
Reviewed-by: Antonio Borneo <[email protected]>

* cpld: altera-epm240: Increase adapter speed

According to the datasheet, the minimum clock period with Vccio1 = 1.5V
(the lowest voltage supported) is 143ns, or around 6MHz. Set the default
adapter speed to 5 MHz.

Signed-off-by: Sean Anderson <[email protected]>
Change-Id: I21cad33fa7f1e25e81f43b5d2214d1fa4ec924de
Reviewed-on: https://review.openocd.org/c/openocd/+/6847
Tested-by: jenkins
Reviewed-by: Antonio Borneo <[email protected]>

* target: Add support for ls1088a

The LS1088A is an octo-core aarch64 processor from NXP in the layerscape
family. The JTAG is undocumented, but I was able to figure things out
from the output of `dap info`. This is the first in-tree example of
using the hwthread rtos (as far as I know), so hopefully it can serve as
an example to other developers. There are some ETMs, but I was unable to
try them out because I got 'invalid command name "etm"' when trying to
test things out.

Signed-off-by: Sean Anderson <[email protected]>
Change-Id: I9b0791d27d8c41170a413a8d86431107a85feba2
Reviewed-on: https://review.openocd.org/c/openocd/+/6848
Tested-by: jenkins
Reviewed-by: Antonio Borneo <[email protected]>

* target: ls1088a: Add service processor

Normally the service processor is not necessary for debugging. However,
if you are using the hard-coded RCW or your boot source is otherwise
corrupt, then the general purpose processors will never be released from
hold-off. This will cause GDB to become confused if it tries to attach,
since they will appear to be running arm32 processors. To deal with
this, we can release the CPUs manually with the BRRL register. This
register cannot be written to from the axi target, so we need to do it
from the service processor target. This involves halting the service
processor, modifying the register, and then resuming it again. We try
and determine what state the service processor was in to avoid resuming
it if it was already halted.

The reset vector for the general purpose processors is determined by the
boot logation pointer registers in the device configuration unit.
Normally these are set using pre-boot initialization commands, but if
they are not set then they default to 0. This will cause the CPU to
almost immediately hit an illegal instruction. This is fine because we
will almost certainly want to attach to the processor and load a program
anyway.

I considered adding this as an event handler for either gdb-attach or
reset-init. However, this command shouldn't be necessary most of the
time, and so I don't think we should run it automatically.

Signed-off-by: Sean Anderson <[email protected]>
Change-Id: I1b725292d8a11274d03af5313dc83678e10e944c
Reviewed-on: https://review.openocd.org/c/openocd/+/6850
Tested-by: jenkins
Reviewed-by: Antonio Borneo <[email protected]>

* board: Add NXP LS1088ARDB

This adds a board file for the NXP LS1088ARDB. This only covers the
"primary" JTAG header J55, and not the PCIe header (J91). The only
oddity is that the LS1088A and CPLD are muxed by adding/removing a
jumper from J48. Unfortunately, it doesn't look like OpenOCD supports
this CPLD beyond determining the irlen, so it's not very useful. Those
who are interested in experimenting can define CWTAP to access the CPLD,
but the default is to access the CPU.

Signed-off-by: Sean Anderson <[email protected]>
Change-Id: Ia07436a534f86bd907aa5fe2a78a326a27855a24
Reviewed-on: https://review.openocd.org/c/openocd/+/6849
Tested-by: jenkins
Reviewed-by: Antonio Borneo <[email protected]>

* gdb_server: fix double free

Commit 6541233 ("Combine register lists of smp targets.")
unconditionally assigns the output pointers of the function
smp_reg_list_noread(), even if the function fails and returns
error.
This causes a double free from the caller, that has assigned NULL
to the pointers to simplify the error handling.

Use local variables in smp_reg_list_noread() and assign the output
pointers only on success.

Change-Id: Ic0fd2f26520566cf322f0190780e15637c01cfae
Fixes: 6541233 ("Combine register lists of smp targets.")
Reported-by: Michele Bisogno <[email protected]>
Signed-off-by: Antonio Borneo <[email protected]>
Reviewed-on: https://review.openocd.org/c/openocd/+/6852
Tested-by: jenkins
Reviewed-by: Michele Bisogno <[email protected]>
Reviewed-by: Tim Newsome <[email protected]>

* gdb_server: check target examined while combining reg list

Commit 6541233 ("Combine register lists of smp targets.")
assumes that all the targets in the SMP cluster are already
examined and unconditionally call target_get_gdb_reg_list_noread()
that will in turn return error if the target is not examined yet.

Skip targets not examined yet.
Add an additional check in case the register list cannot be built,
e.g. because no target in the SMP cluster is examined. This should
never happen, but it's better to play safe.

Change-Id: I8609815c3d5144790fb05a870cb0c931540aef8a
Fixes: 6541233 ("Combine register lists of smp targets.")
Reported-by: Michele Bisogno <[email protected]>
Signed-off-by: Antonio Borneo <[email protected]>
Reviewed-on: https://review.openocd.org/c/openocd/+/6853
Tested-by: jenkins
Reviewed-by: Michele Bisogno <[email protected]>
Reviewed-by: Tim Newsome <[email protected]>

* flash/stm32l4x: fix maybe-uninitialized compiler error

using gcc (Ubuntu 9.3.0-17ubuntu1~20.04) 9.3.0 we get:
error: ‘retval’ may be used uninitialized in this function

fixes: 13cd75b (flash/nor/stm32xx: fix segfault accessing Cortex-M part number)
Change-Id: I897c40c5d2233f50a5385d251ebfa536023e5cf7
Signed-off-by: Tarek BOCHKATI <[email protected]>
Reviewed-on: https://review.openocd.org/c/openocd/+/6861
Tested-by: jenkins
Reviewed-by: Tomas Vanek <[email protected]>
Reviewed-by: Antonio Borneo <[email protected]>

* Fix build.

Change-Id: Ia60246246dd859d75659a43d1c59588dbb274d46
Signed-off-by: Tim Newsome <[email protected]>

Co-authored-by: Hans-Erik Floryd <[email protected]>
Co-authored-by: Julien Massot <[email protected]>
Co-authored-by: Pavel Kirienko <[email protected]>
Co-authored-by: Zoltán Dudás <[email protected]>
Co-authored-by: Antonio Borneo <[email protected]>
Co-authored-by: Jacek Wuwer <[email protected]>
Co-authored-by: Ben McMorran <[email protected]>
Co-authored-by: Simon Johansson <[email protected]>
Co-authored-by: Tomas Vanek <[email protected]>
Co-authored-by: Sean Anderson <[email protected]>
Co-authored-by: Tarek BOCHKATI <[email protected]>

Author: 12 people

configure.ac

@@ -275,6 +275,10 @@ AC_ARG_ENABLE([jtag_vpi],
   AS_HELP_STRING([--enable-jtag_vpi], [Enable building support for JTAG VPI]),
   [build_jtag_vpi=$enableval], [build_jtag_vpi=no])
 
+AC_ARG_ENABLE([vdebug],
+  AS_HELP_STRING([--enable-vdebug], [Enable building support for Cadence Virtual Debug Interface]),
+  [build_vdebug=$enableval], [build_vdebug=no])
+
 AC_ARG_ENABLE([jtag_dpi],
   AS_HELP_STRING([--enable-jtag_dpi], [Enable building support for JTAG DPI]),
   [build_jtag_dpi=$enableval], [build_jtag_dpi=no])
@@ -514,6 +518,12 @@ AS_IF([test "x$build_jtag_vpi" = "xyes"], [
   AC_DEFINE([BUILD_JTAG_VPI], [0], [0 if you don't want JTAG VPI.])
 ])
 
+AS_IF([test "x$build_vdebug" = "xyes"], [
+  AC_DEFINE([BUILD_VDEBUG], [1], [1 if you want Cadence vdebug interface.])
+], [
+  AC_DEFINE([BUILD_VDEBUG], [0], [0 if you don't want Cadence vdebug interface.])
+])
+
 AS_IF([test "x$build_jtag_dpi" = "xyes"], [
   AC_DEFINE([BUILD_JTAG_DPI], [1], [1 if you want JTAG DPI.])
 ], [
@@ -689,8 +699,9 @@ AM_CONDITIONAL([AT91RM9200], [test "x$build_at91rm9200" = "xyes"])
 AM_CONDITIONAL([BCM2835GPIO], [test "x$build_bcm2835gpio" = "xyes"])
 AM_CONDITIONAL([IMX_GPIO], [test "x$build_imx_gpio" = "xyes"])
 AM_CONDITIONAL([BITBANG], [test "x$build_bitbang" = "xyes"])
-AM_CONDITIONAL([JTAG_VPI], [test "x$build_jtag_vpi" = "xyes" -o "x$build_jtag_vpi" = "xyes"])
-AM_CONDITIONAL([JTAG_DPI], [test "x$build_jtag_dpi" = "xyes" -o "x$build_jtag_dpi" = "xyes"])
+AM_CONDITIONAL([JTAG_VPI], [test "x$build_jtag_vpi" = "xyes"])
+AM_CONDITIONAL([VDEBUG], [test "x$build_vdebug" = "xyes"])
+AM_CONDITIONAL([JTAG_DPI], [test "x$build_jtag_dpi" = "xyes"])
 AM_CONDITIONAL([USB_BLASTER_DRIVER], [test "x$enable_usb_blaster" != "xno" -o "x$enable_usb_blaster_2" != "xno"])
 AM_CONDITIONAL([AMTJTAGACCEL], [test "x$build_amtjtagaccel" = "xyes"])
 AM_CONDITIONAL([GW16012], [test "x$build_gw16012" = "xyes"])

doc/openocd.texi

@@ -588,6 +588,12 @@ produced, PDF schematics are easily found and it is easy to make.
 @* A JTAG driver acting as a client for the JTAG VPI server interface.
 @* Link: @url{http://github.com/fjullien/jtag_vpi}
 
+@item @b{vdebug}
+@* A driver for Cadence virtual Debug Interface to emulated or simulated targets.
+It implements a client connecting to the vdebug server, which in turn communicates
+with the emulated or simulated RTL model through a transactor. The current version
+supports only JTAG as a transport, but other virtual transports, like DAP are planned.
+
 @item @b{jtag_dpi}
 @* A JTAG driver acting as a client for the SystemVerilog Direct Programming
 Interface (DPI) for JTAG devices. DPI allows OpenOCD to connect to the JTAG
@@ -3345,6 +3351,41 @@ This value is only used with the standard variant.
 @end deffn
 
 
+@deffn {Interface Driver} {vdebug}
+Cadence Virtual Debug Interface driver.
+
+@deffn {Config Command} {vdebug server} host:port
+Specifies the host and TCP port number where the vdebug server runs.
+@end deffn
+
+@deffn {Config Command} {vdebug batching} value
+Specifies the batching method for the vdebug request. Possible values are
+0 for no batching
+1 or wr to batch write transactions together (default)
+2 or rw to batch both read and write transactions
+@end deffn
+
+@deffn {Config Command} {vdebug polling} min max
+Takes two values, representing the polling interval in ms. Lower values mean faster
+debugger responsiveness, but lower emulation performance. The minimum should be
+around 10, maximum should not exceed 1000, which is the default gdb and keepalive
+timeout value.
+@end deffn
+
+@deffn {Config Command} {vdebug bfm_path} path clk_period
+Specifies the hierarchical path and input clk period of the vdebug BFM in the design.
+The hierarchical path uses Verilog notation top.inst.inst
+The clock period must include the unit, for instance 40ns.
+@end deffn
+
+@deffn {Config Command} {vdebug mem_path} path base size
+Specifies the hierarchical path to the design memory instance for backdoor access.
+Up to 4 memories can be specified. The hierarchical path uses Verilog notation.
+The base specifies start address in the design address space, size its size in bytes.
+Both values can use hexadecimal notation with prefix 0x.
+@end deffn
+@end deffn
+
 @deffn {Interface Driver} {jtag_dpi}
 SystemVerilog Direct Programming Interface (DPI) compatible driver for
 JTAG devices in emulation. The driver acts as a client for the SystemVerilog
@@ -5185,6 +5226,22 @@ when reset disables PLLs needed to use a fast clock.
 @* After single-step has completed
 @item @b{trace-config}
 @* After target hardware trace configuration was changed
+@item @b{semihosting-user-cmd-0x100}
+@* The target made a semihosting call with user-defined operation number 0x100
+@item @b{semihosting-user-cmd-0x101}
+@* The target made a semihosting call with user-defined operation number 0x101
+@item @b{semihosting-user-cmd-0x102}
+@* The target made a semihosting call with user-defined operation number 0x102
+@item @b{semihosting-user-cmd-0x103}
+@* The target made a semihosting call with user-defined operation number 0x103
+@item @b{semihosting-user-cmd-0x104}
+@* The target made a semihosting call with user-defined operation number 0x104
+@item @b{semihosting-user-cmd-0x105}
+@* The target made a semihosting call with user-defined operation number 0x105
+@item @b{semihosting-user-cmd-0x106}
+@* The target made a semihosting call with user-defined operation number 0x106
+@item @b{semihosting-user-cmd-0x107}
+@* The target made a semihosting call with user-defined operation number 0x107
 @end itemize
 
 @quotation Note
@@ -9241,6 +9298,17 @@ To make the SEMIHOSTING_SYS_EXIT call return normally, enable
 this option (default: disabled).
 @end deffn
 
+@deffn {Command} {arm semihosting_read_user_param}
+@cindex ARM semihosting
+Read parameter of the semihosting call from the target. Usable in
+semihosting-user-cmd-0x10* event handlers, returning a string.
+
+When the target makes semihosting call with operation number from range 0x100-
+0x107, an optional string parameter can be passed to the server. This parameter
+is valid during the run of the event handlers and is accessible with this
+command.
+@end deffn
+
 @section ARMv4 and ARMv5 Architecture
 @cindex ARMv4
 @cindex ARMv5

src/flash/nor/atsame5.c

@@ -146,6 +146,9 @@ static const struct samd_part same53_parts[] = {
 	{ 0x04, "SAME53J20A", 1024, 256 },
 	{ 0x05, "SAME53J19A", 512, 192 },
 	{ 0x06, "SAME53J18A", 256, 128 },
+	{ 0x55, "LAN9255/ZMX020", 1024, 256 },
+	{ 0x56, "LAN9255/ZMX019", 512, 192 },
+	{ 0x57, "LAN9255/ZMX018", 256, 128 },
 };
 
 /* Known SAME54 parts. */

src/flash/nor/stm32f1x.c

@@ -622,15 +622,14 @@ static int stm32x_write(struct flash_bank *bank, const uint8_t *buffer,
 static int stm32x_get_device_id(struct flash_bank *bank, uint32_t *device_id)
 {
 	struct target *target = bank->target;
-	struct cortex_m_common *cortex_m = target_to_cm(target);
 	uint32_t device_id_register = 0;
 
 	if (!target_was_examined(target)) {
 		LOG_ERROR("Target not examined yet");
-		return ERROR_FAIL;
+		return ERROR_TARGET_NOT_EXAMINED;
 	}
 
-	switch (cortex_m->core_info->partno) {
+	switch (cortex_m_get_partno_safe(target)) {
 	case CORTEX_M0_PARTNO: /* STM32F0x devices */
 		device_id_register = 0x40015800;
 		break;
@@ -659,15 +658,14 @@ static int stm32x_get_device_id(struct flash_bank *bank, uint32_t *device_id)
 static int stm32x_get_flash_size(struct flash_bank *bank, uint16_t *flash_size_in_kb)
 {
 	struct target *target = bank->target;
-	struct cortex_m_common *cortex_m = target_to_cm(target);
 	uint32_t flash_size_reg;
 
 	if (!target_was_examined(target)) {
 		LOG_ERROR("Target not examined yet");
-		return ERROR_FAIL;
+		return ERROR_TARGET_NOT_EXAMINED;
 	}
 
-	switch (cortex_m->core_info->partno) {
+	switch (cortex_m_get_partno_safe(target)) {
 	case CORTEX_M0_PARTNO: /* STM32F0x devices */
 		flash_size_reg = 0x1FFFF7CC;
 		break;

src/flash/nor/stm32f2x.c

@@ -636,8 +636,8 @@ static int stm32x_erase(struct flash_bank *bank, unsigned int first,
 
 	for (unsigned int i = first; i <= last; i++) {
 		unsigned int snb;
-		if (stm32x_info->has_large_mem && i >= 12)
-			snb = (i - 12) | 0x10;
+		if (stm32x_info->has_large_mem && i >= (bank->num_sectors / 2))
+			snb = (i - (bank->num_sectors / 2)) | 0x10;
 		else
 			snb = i;
 
@@ -966,14 +966,14 @@ static int stm32x_get_device_id(struct flash_bank *bank, uint32_t *device_id)
 	 * Only effects Rev A silicon */
 
 	struct target *target = bank->target;
-	struct cortex_m_common *cortex_m = target_to_cm(target);
 
 	/* read stm32 device id register */
 	int retval = target_read_u32(target, 0xE0042000, device_id);
 	if (retval != ERROR_OK)
 		return retval;
 
-	if ((*device_id & 0xfff) == 0x411 && cortex_m->core_info->partno == CORTEX_M4_PARTNO) {
+	if ((*device_id & 0xfff) == 0x411
+			&& cortex_m_get_partno_safe(target) == CORTEX_M4_PARTNO) {
 		*device_id &= ~((0xFFFF << 16) | 0xfff);
 		*device_id |= (0x1000 << 16) | 0x413;
 		LOG_INFO("stm32f4x errata detected - fixing incorrect MCU_IDCODE");
@@ -1011,6 +1011,11 @@ static int stm32x_probe(struct flash_bank *bank)
 	bank->num_prot_blocks = 0;
 	bank->prot_blocks = NULL;
 
+	if (!target_was_examined(target)) {
+		LOG_ERROR("Target not examined yet");
+		return ERROR_TARGET_NOT_EXAMINED;
+	}
+
 	/* if explicitly called out as OTP bank, short circuit probe */
 	if (stm32x_is_otp(bank)) {
 		if (stm32x_otp_is_f7(bank)) {

src/flash/nor/stm32h7x.c

@@ -759,14 +759,18 @@ static int stm32x_read_id_code(struct flash_bank *bank, uint32_t *id)
 static int stm32x_probe(struct flash_bank *bank)
 {
 	struct target *target = bank->target;
-	struct cortex_m_common *cortex_m = target_to_cm(target);
 	struct stm32h7x_flash_bank *stm32x_info = bank->driver_priv;
 	uint16_t flash_size_in_kb;
 	uint32_t device_id;
 
 	stm32x_info->probed = false;
 	stm32x_info->part_info = NULL;
 
+	if (!target_was_examined(target)) {
+		LOG_ERROR("Target not examined yet");
+		return ERROR_TARGET_NOT_EXAMINED;
+	}
+
 	int retval = stm32x_read_id_code(bank, &stm32x_info->idcode);
 	if (retval != ERROR_OK)
 		return retval;
@@ -800,7 +804,8 @@ static int stm32x_probe(struct flash_bank *bank)
 	/* get flash size from target */
 	/* STM32H74x/H75x, the second core (Cortex-M4) cannot read the flash size */
 	retval = ERROR_FAIL;
-	if (device_id == DEVID_STM32H74_H75XX && cortex_m->core_info->partno == CORTEX_M4_PARTNO)
+	if (device_id == DEVID_STM32H74_H75XX
+			&& cortex_m_get_partno_safe(target) == CORTEX_M4_PARTNO)
 		LOG_WARNING("%s cannot read the flash size register", target_name(target));
 	else
 		retval = target_read_u16(target, stm32x_info->part_info->fsize_addr, &flash_size_in_kb);

src/flash/nor/stm32l4x.c

@@ -1632,13 +1632,14 @@ static int stm32l4_write(struct flash_bank *bank, const uint8_t *buffer,
 
 static int stm32l4_read_idcode(struct flash_bank *bank, uint32_t *id)
 {
-	int retval;
+	int retval = ERROR_OK;
+	struct target *target = bank->target;
 
 	/* try reading possible IDCODE registers, in the following order */
 	uint32_t dbgmcu_idcode[] = {DBGMCU_IDCODE_L4_G4, DBGMCU_IDCODE_G0, DBGMCU_IDCODE_L5};
 
 	for (unsigned int i = 0; i < ARRAY_SIZE(dbgmcu_idcode); i++) {
-		retval = target_read_u32(bank->target, dbgmcu_idcode[i], id);
+		retval = target_read_u32(target, dbgmcu_idcode[i], id);
 		if ((retval == ERROR_OK) && ((*id & 0xfff) != 0) && ((*id & 0xfff) != 0xfff))
 			return ERROR_OK;
 	}
@@ -1647,12 +1648,16 @@ static int stm32l4_read_idcode(struct flash_bank *bank, uint32_t *id)
 	 * DBGMCU_IDCODE cannot be read using CPU1 (Cortex-M0+) at AP1,
 	 * to solve this read the UID64 (IEEE 64-bit unique device ID register) */
 
-	struct cortex_m_common *cortex_m = target_to_cm(bank->target);
+	struct armv7m_common *armv7m = target_to_armv7m_safe(target);
+	if (!armv7m) {
+		LOG_ERROR("Flash requires Cortex-M target");
+		return ERROR_TARGET_INVALID;
+	}
 
 	/* CPU2 (Cortex-M0+) is supported only with non-hla adapters because it is on AP1.
 	 * Using HLA adapters armv7m.debug_ap is null, and checking ap_num triggers a segfault */
-	if (cortex_m->core_info->partno == CORTEX_M0P_PARTNO &&
-			cortex_m->armv7m.debug_ap && cortex_m->armv7m.debug_ap->ap_num == 1) {
+	if (cortex_m_get_partno_safe(target) == CORTEX_M0P_PARTNO &&
+			armv7m->debug_ap && armv7m->debug_ap->ap_num == 1) {
 		uint32_t uid64_ids;
 
 		/* UID64 is contains
@@ -1662,7 +1667,7 @@ static int stm32l4_read_idcode(struct flash_bank *bank, uint32_t *id)
 		 *
 		 *  read only the fixed values {STID,DEVID} from UID64_IDS to identify the device as STM32WLx
 		 */
-		retval = target_read_u32(bank->target, UID64_IDS, &uid64_ids);
+		retval = target_read_u32(target, UID64_IDS, &uid64_ids);
 		if (retval == ERROR_OK && uid64_ids == UID64_IDS_STM32WL) {
 			/* force the DEV_ID to DEVID_STM32WLE_WL5XX and the REV_ID to unknown */
 			*id = DEVID_STM32WLE_WL5XX;
@@ -1700,11 +1705,21 @@ static const char *get_stm32l4_bank_type_str(struct flash_bank *bank)
 static int stm32l4_probe(struct flash_bank *bank)
 {
 	struct target *target = bank->target;
-	struct armv7m_common *armv7m = target_to_armv7m(target);
 	struct stm32l4_flash_bank *stm32l4_info = bank->driver_priv;
 	const struct stm32l4_part_info *part_info;
 	uint16_t flash_size_kb = 0xffff;
 
+	if (!target_was_examined(target)) {
+		LOG_ERROR("Target not examined yet");
+		return ERROR_TARGET_NOT_EXAMINED;
+	}
+
+	struct armv7m_common *armv7m = target_to_armv7m_safe(target);
+	if (!armv7m) {
+		LOG_ERROR("Flash requires Cortex-M target");
+		return ERROR_TARGET_INVALID;
+	}
+
 	stm32l4_info->probed = false;
 
 	/* read stm32 device id registers */

src/helper/list.h

@@ -656,6 +656,20 @@ static inline void list_splice_tail_init(struct list_head *list,
 	     !list_entry_is_head(pos, head, member);			\
 	     pos = list_prev_entry(pos, member))
 
+/**
+ * list_for_each_entry_direction - iterate forward/backward over list of given type
+ * @param forward the iterate direction, true for forward, false for backward.
+ * @param pos     the type * to use as a loop cursor.
+ * @param head    the head for your list.
+ * @param member  the name of the list_head within the struct.
+ */
+#define list_for_each_entry_direction(forward, pos, head, member)		\
+	for (pos = forward ? list_first_entry(head, typeof(*pos), member)	\
+					   : list_last_entry(head, typeof(*pos), member);	\
+		 !list_entry_is_head(pos, head, member);						\
+		 pos = forward ? list_next_entry(pos, member)					\
+					   : list_prev_entry(pos, member))
+
 /**
  * list_prepare_entry - prepare a pos entry for use in list_for_each_entry_continue()
  * @param pos    the type * to use as a start point

src/jtag/drivers/Makefile.am

@@ -75,6 +75,9 @@ endif
 if JTAG_VPI
 DRIVERFILES += %D%/jtag_vpi.c
 endif
+if VDEBUG
+DRIVERFILES += %D%/vdebug.c
+endif
 if JTAG_DPI
 DRIVERFILES += %D%/jtag_dpi.c
 endif

src/jtag/drivers/jlink.c

@@ -114,8 +114,6 @@ static int jlink_flush(void);
  * @param in A pointer to store TDO data to, if NULL the data will be discarded.
  * @param in_offset A bit offset for TDO data.
  * @param length Amount of bits to transfer out and in.
- *
- * @retval This function doesn't return any value.
  */
 static void jlink_clock_data(const uint8_t *out, unsigned out_offset,
 			     const uint8_t *tms_out, unsigned tms_offset,

src/jtag/drivers/ulink.c

@@ -604,8 +604,6 @@ static int ulink_get_queue_size(struct ulink *device,
  * Clear the OpenULINK command queue.
  *
  * @param device pointer to struct ulink identifying ULINK driver instance.
- * @return on success: ERROR_OK
- * @return on failure: ERROR_FAIL
  */
 static void ulink_clear_queue(struct ulink *device)
 {