gdbCmdFile

###############################################################################
# Command file for simulating Stream Controller firmware using pinkySim.
#
# Execute in gdb using "source" command.
#  For details refer to: https://sourceware.org/gdb/onlinedocs/gdb/Command-Files.html
#
# Note this was developed by simulating vcf_wired_controller_d0g_57bf5c10.bin,
#  and may not work properly with other firmware.
#
#  MIT License
# 
#  Copyright (c) 2017 Gregory Gluszek
# 
#  Permission is hereby granted, free of charge, to any person obtaining a copy
#  of this software and associated documentation files (the "Software"), to deal
#  in the Software without restriction, including without limitation the rights
#  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
#  copies of the Software, and to permit persons to whom the Software is
#  furnished to do so, subject to the following conditions:
# 
#  The above copyright notice and this permission notice shall be included in all
#  copies or substantial portions of the Software.
# 
#  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
#  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
#  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
#  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
#  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
#  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
#  SOFTWARE.
###############################################################################


# Note: standard breakpoints seem to be broken (gdb issue?) so instead 
#	watchpoints are set for $pc == instruction_addr. The main issue with 
#	this is that it makes execution slow while watchpoint is active and,
#	therefore, these types of watchpoints should be removed once they are
#	no longer needed


#------------------------------------------------------------------------------#


# To stop "Type <return> to continue, or q <return> to quit" from occurring
set pagination off


#------------------------------------------------------------------------------#


# Connect to remote simulator (i.e. pinkySim) being run on port 3333 of local machine
target remote localhost:3333


#------------------------------------------------------------------------------#


# Default register settings according to User Manaul UM10462:

# Default register settings for system control block (base address 0x4004 8000)
set {int}0x40048000 = 0x02
set {int}0x40048028 = 0x080
set {int}0x40048030 = 0x3
set {int}0x40048040 = 0x1
set {int}0x40048044 = 0x1
set {int}0x40048074 = 0x1
set {int}0x40048078 = 0x1
set {int}0x40048080 = 0x3F
# set {int}0x40048100 = User Dependent TODO: need this to be non-zero?
# set {int}0x40048104 = User Dependent TODO: need this to be non-zero?
set {int}0x40048170 = 0x10
set {int}0x4004819C = 0x1
set {int}0x40048230 = 0xFFFF
set {int}0x40048234 = 0xEDF0
set {int}0x40048238 = 0xEDD0
# set {int}0x400483F4 = Part Dependent TODO: need this to be non-zero?

# Default register settings for I/O configuration (base address 0x4004 4000)
set {int}0x40044000 = 0x00000090
set {int}0x40044004 = 0x00000090
set {int}0x40044008 = 0x00000090
set {int}0x4004400C = 0x00000090
set {int}0x40044010 = 0x00000080
set {int}0x40044014 = 0x00000080
set {int}0x40044018 = 0x00000090
set {int}0x4004401C = 0x00000090
set {int}0x40044020 = 0x00000090
set {int}0x40044024 = 0x00000090
set {int}0x40044028 = 0x00000090
set {int}0x4004402C = 0x00000090
set {int}0x40044030 = 0x00000090
set {int}0x40044034 = 0x00000090
set {int}0x40044038 = 0x00000090
set {int}0x4004403C = 0x00000090
set {int}0x40044040 = 0x00000090
set {int}0x40044044 = 0x00000090
set {int}0x40044048 = 0x00000090
set {int}0x4004404C = 0x00000090
set {int}0x40044050 = 0x00000090
set {int}0x40044054 = 0x00000090
set {int}0x40044058 = 0x00000090
set {int}0x4004405C = 0x00000090
set {int}0x40044060 = 0x00000090
set {int}0x40044064 = 0x00000090
set {int}0x40044068 = 0x00000090
set {int}0x4004406C = 0x00000090
set {int}0x40044070 = 0x00000090
set {int}0x40044074 = 0x00000090
set {int}0x40044078 = 0x00000090
set {int}0x4004407C = 0x00000090
set {int}0x40044080 = 0x00000090
set {int}0x40044084 = 0x00000090
set {int}0x40044088 = 0x00000090
set {int}0x4004408C = 0x00000090
set {int}0x40044090 = 0x00000090
set {int}0x40044094 = 0x00000090
set {int}0x40044098 = 0x00000090
set {int}0x4004409C = 0x00000090
set {int}0x400440A0 = 0x00000090
set {int}0x400440A4 = 0x00000090
set {int}0x400440A8 = 0x00000090
set {int}0x400440AC = 0x00000090
set {int}0x400440B0 = 0x00000090
set {int}0x400440B4 = 0x00000090
set {int}0x400440B8 = 0x00000090
set {int}0x400440BC = 0x00000090
set {int}0x400440C0 = 0x00000090
set {int}0x400440C4 = 0x00000090
set {int}0x400440C8 = 0x00000090
set {int}0x400440CC = 0x00000090
set {int}0x400440D0 = 0x00000090
set {int}0x400440D4 = 0x00000090
set {int}0x400440DC = 0x00000090

# Default register settings for GPIO GROUP0 interrupt (base address 0x4005 C000)
set {int}0x4005C020 = 0xFFFFFFFF
set {int}0x4005C024 = 0xFFFFFFFF

# Default register settings for GPIO GROUP1 interrupt (base address 0x4006 0000)
set {int}0x40060020 = 0xFFFFFFFF
set {int}0x40060024 = 0xFFFFFFFF


# Default register settings for GPIO port (base address 0x5000 0000)

# PIO0_0: PIO0_0/nRESET (According to Custom FW)
set {char}0x50000000 = 1
set {int}0x50001000 = 0xffffffff

# PIO0_1: Connected to S6 - RT for purpose of enacting USB In-Systen Programming
set {char}0x50000001 = 1
set {int}0x50001004 = 0xffffffff

# PIO0_2 is read during init. Interrupt setup to monitor state change.
#  Always reads 1 according to Custom Firmware.
set {char}0x50000002 = 1
set {int}0x50001008 = 0xffffffff

# PIO0_3 is USB_VBUS and indiciates if there USB bus power. If 1 system will
#  boot and wait for USB enumeration/probing. If 0 system will boot and wait
#  for data from RF chip.
set {char}0x50000003 = 1
set {int}0x5000100c = 0xffffffff

# PIO0_16: TBD
set {char}0x50000010 = 1
set {int}0x50001040 = 0xffffffff

# PIO0_17: S1 - A Button is not depressed by default
set {char}0x50000011 = 1
set {int}0x50001044 = 0xffffffff

# PIO0_18 always reads 0 according to Custom Firmware
set {char}0x50000012 = 0
set {int}0x50001048 = 0

# PIO0_20: TBD
set {char}0x50000014 = 1
set {int}0x50001050 = 0xffffffff

# PIO0_23: Connected to Data Ready on Right Trackpad ASIC
set {char}0x50000017 = 1
set {int}0x5000105c = 0xffffffff

# PIO1_0: Analog Joystick Click button is not depressed by default
set {char}0x50000020 = 1
set {int}0x50001080 = 0xffffffff

# PIO1_2: S19 - FRONT_R (Front right arrow button) is not depressed by default
set {char}0x50000022 = 1
set {int}0x50001088 = 0xffffffff

# PIO1_3: S16 - Right inner grip button is not depressed by default
set {char}0x50000023 = 1
set {int}0x5000108c = 0xffffffff

# PIO1_4: S8 - LB (Left bumper) is not depressed by default
set {char}0x50000024 = 1
set {int}0x50001090 = 0xffffffff

# PIO1_5: USART/Radio Chip Related. PINT2 setup to monitor change.
set {char}0x50000025 = 1
set {int}0x50001094 = 0xffffffff

# PIO1_8: USART/Radio Chip related maybe?
set {char}0x50000028 = 0
set {int}0x500010a0 = 0

# PIO1_9: S7 - X Button is not depressed by default
set {char}0x50000029 = 1
set {int}0x500010a4 = 0xffffffff

# PIO1_11: S9 - Y Button is not depressed by default
set {char}0x5000002b = 1
set {int}0x500010ac = 0xffffffff

# PIO1_12 always reads 0 according to Custom Firmware
set {char}0x5000002c = 0
set {int}0x500010b0 = 0

# PIO1_13: S6 - RT (Right trigger digital) is not depressed by default
set {char}0x5000002d = 1
set {int}0x500010b4 = 0xffffffff

# PIO1_14: S6 - S10 - RB (Right bumper) is not depressed by default
set {char}0x5000002e = 1
set {int}0x500010b8 = 0xffffffff

# PIO1_16: Connected to Data Ready on Left Trackpad ASIC
set {char}0x50000030 = 1
set {int}0x500010c0 = 0xffffffff

# PIO1_19: S18 - Steam Button is not depressed by default
set {char}0x50000033 = 1
set {int}0x500010cc = 0xffffffff

# PIO1_20: S17 - FRONT_L (Front left arrow button) is not depressed by default
set {char}0x50000034 = 1
set {int}0x500010d0 = 0xffffffff

# PIO1_21: S5 - Right trackpad click is not depressed by default
set {char}0x50000035 = 1
set {int}0x500010d4 = 0xffffffff

# PIO1_22: S4 - B Button is not depressed by default
set {char}0x50000036 = 1
set {int}0x500010d8 = 0xffffffff

# PIO1_24: USART/Radio related?
set {char}0x50000038 = 1
set {int}0x500010e0 = 0xffffffff

# PIO1_25: S14 - Left Inner Grip button is not depressed by default
set {char}0x50000039 = 1
set {int}0x500010e4 = 0xffffffff

# PIO1_26: S2 - Left Trackpad Click is not depressed by default
set {char}0x5000003a = 1
set {int}0x500010e8 = 0xffffffff

# PIO1_27: S3 - LT (Left trigger digital) is not depressed by default
set {char}0x5000003b = 1
set {int}0x500010ec = 0xffffffff


# Default register settings for USB (base address: 0x4008 0000)
set {int}0x40080000 = 0x00000800

# Default register settings for USART (base address: 0x4000 8000)
# set {int}0x40008000 = TODO: reset value is 0x1 if DLAB=1
set {int}0x40008008 = 0x01
set {int}0x40008014 = 0x60
set {int}0x40008028 = 0x10
set {int}0x4000802C = 0xF0
set {int}0x40008030 = 0x80

# Default register settings for SSP/SPI0 (base address 0x4004 0000)
set {int}0x4004000C = 0x00000003
set {int}0x40040018 = 0x00000008

# Default register settings for SSP/SPI1 (base address 0x4005 8000)
set {int}0x4005800C = 0x00000003
set {int}0x40058018 = 0x00000008

# Default register settings for I2C (base address 0x4000 0000)
set {int}0x40000000 = 0x00
set {int}0x40000004 = 0xF8
set {int}0x40000010 = 0x04
set {int}0x40000014 = 0x04

# Default register settings for Watchdog timer (base address 0x4000 4000)
set {int}0x40004004 = 0xFF
set {int}0x4000400C = 0xFF
set {int}0x40004018 = 0xFFFFFF

# Default register settings for SysTick timer (base address 0xE000 E000)
set {int}0xE000E01C = 0x4

# Default register settings for ADC (base address 0x4001 C000)
set {int}0x4001C00C = 0x00000100


#------------------------------------------------------------------------------#


# Non-default register settings required for simulation to progress:

# Flash/EEPROM Controller Non-Default Register Settings (base offset 0x4003C000):

# Set Flash configuration register 0x4003c010 to 0x00000002 (reset value)
set {int}0x4003c010 = 2
# Set Flash module status register 0x4003cfe0 to 0xFFFFFFFF to indicate that EEPROM write finished
#  Note: According to UM10462 datahsset, flash module status register 0x4003cfe0 only has bit 2 as 
#  non-reserved, but boot ROM code is checking other bits for status.Assumptionis that this must be 
#  some weird hardware issue with how reserved bits function. Upper bits should be non-use, but 
#  setting bit 2 does not add up to check being performed on register (lsl immediate).
set {int}0x4003cfe0 = 0xFFFFFFFF


# System Control Non-Default Register Settings (base offset 0x40048000):

# Set System PLL status register 0x4004800c to 0x00000001 (indicates System PLL is locked)
set {int}0x4004800c = 1 
# Set USB PLL status register 0x40048014 to 0x00000001 (indicates USB PLL is locked)
set {int}0x40048014 = 1


#------------------------------------------------------------------------------#


# Fill boot ROM with binary downloaded from LPC11U37
restore LPC11U3x16kBbootROM.bin binary 0x1fff0000


#------------------------------------------------------------------------------#


# {

# This occurs immediately after fnc0x00000bdc() is called by fnc0x00000d04().

# Setup watchpoint for instruction immediately before checking values first
#  read from EEPROM (i.e. magic number and hw version)
watch $pc == 0x00000bdc
watch $pc == 0x000051c4

echo \n
echo Waiting for first EEPROM read to get HW version to complete \n
echo \n

# Execute until watchpoint
continue

eeprom_data_rd

# }


#------------------------------------------------------------------------------#


# {

# This occurs right before PC = 0x000015bf (after fnc0x00000bdc() is called
#	for second time).

# Setup watchpoint for instruction immediately before checking values first
#  read from EEPROM offset 0x500 (TODO: purpose of this data?)
watch $pc == 0x00000bdc
watch $pc == 0x000051c4

echo \n
echo Waiting for second EEPROM read to get data at 0x500 \n
echo \n

# Execute until watchpoint
continue

eeprom_data_rd

# }


#------------------------------------------------------------------------------#


# {

# This occurs immediately after fnc0x1fff1ff0() is called by fnc0x00005d10()
#  (which is called by fnc0x000051c4(), which is called by fnc0x00006644().

# Setup watchpoint for instruction immediately after reading 0x84 bytes from
#  offset 0x0 of EEPROM, after basic init and power up
watch $pc == 0x00000bdc
watch $pc == 0x000051c4

echo \n
echo Waiting for EEPROM read of 0x80 bytes of data from offset 0x000 \n
echo \n

# Execute until watchpoint
continue

eeprom_data_rd

# Remove watchpoint
delete 

# }


#------------------------------------------------------------------------------#


# {

# This occurs in fnc0x00007388().

# Set watch point for 16-bit Timer 1 (CT16B1) Timer Counter register
#  In path for controller not connected to USB cable, CT16B1 is used as PWM
#   for Steam Controller Button LED.
watch *(int*)0x40010008

echo \n
echo Waiting for CT16B1 (LED PWM) setup \n
echo \n

# Execute until watchpoint
continue

# Assumption is we have broken for watch on CT16B1 Timer Counter register
#  Set back to zero to fake wrap around so code can continue
set {int}0x40010008 = 0

# Remove watchpoint
delete 

# }

#------------------------------------------------------------------------------#


# Events change based on whether USB cable is connected (volatage present) or not
if *(char*)0x50000003 == 0

	# NOTE: We need to spend more time on this path. Somehow this "should"
	#  lead to communicating with the RF chip, but I have not figured that out yet...

	#------------------------------------------------------------------------------#


	# {

	# Setup watchpoint for wfi instruction.
	watch $pc ==  0x00002cfe
	
	# Execute until watchpoint
	continue
	
	# Simulate interrupt(s) (either for C conversion, or to carry on sim as though 
	#  fired and was handled properly).
	
	##
	# PIN_INT1 (Setup for state change on PIO0_2) Execution:
	# NOTE: This is DESTRUCTIVE of processor state. Use only to obtain simulation of 
	#  interrupt. Vector Table entry is 0x00000129.
	##set $lr = $pc
	##set $pc = 0x00000128
	#TODO: Might want to try making not destructive (if need to simulate it or other
	#  interrupts in the future). See Fig 81 in UM10462 for what to save to stack, 
	#  and update LR. Then when we get back to PC of wfi we manually pop off stack. 
	##
	
	##
	# ADC Interrupt Execution:
	# NOTE: This is DESTRUCTIVE of processor state. Use only to obtain simulation of 
	#  interrupt. Vector Table entry is 0x00000205.
	##set $lr = $pc
	##set $pc = 0x00000204
	# Counter for how many times interrupt fires initially
	##set {int}0x10000014 = 0x0000012d
	# Counter for how many times interrupt fires for accumulating ADC values
	##set {int}0x10000018 = 0x00000007
	#TODO: Might want to try making not destructive (if need to simulate it or other
	#  interrupts in the future). See Fig 81 in UM10462 for what to save to stack, 
	#  and update LR. Then when we get back to PC of wfi we manually pop off stack. 
	## 
	
	##
	# Change states as though ADC interrupt ran as desired:
	# Set PC to move past wfi (as simulator cannot handle it)
	set $pc = 0x00002d00
	# Set ADC counter variables (should not really be needed once ISR has served its 
	#  purpose. But setting to final values just to be safe and accurate).
	set {int}0x10000014 = 0x0000012d
	set {int}0x10000018 = 0x00000007
	# Set flag to indciate ADC ISR has served its purpose and ADC is shutdown
	set {char}0x10000010 = 1
	# Set value of counter used to accumulate ADC values
	# TODO: Need to figure out what this value should be and how that affects sim...
	set {short}0x10000f8c = 0
	## 
	
	# Remove watchpoint
	delete 

	# }

#TODO: whats next? What causes system to interact with RF chip (and via what interface? USART?)?


	#------------------------------------------------------------------------------#


	# Resume execution (execution will break on wfi that pinkySim cannot handle)
	#
	# This ends in infinite wfi loop (presumably waiting for system to power down
	#  because something is wrong with power supples, or brown out?)
	continue


	#------------------------------------------------------------------------------#



else


	#------------------------------------------------------------------------------#


	# {

	echo \n
	echo Waiting for sleep before putting Trackpad ASICs into shutdown/standby mode \n
	echo \n
	
	reset_top_level_watchpoints
	check_ct16b0_sleep

	# }


	#------------------------------------------------------------------------------#


	# { 

	echo \n
	echo Waiting for SPI write of Shutdown/Standby Command (Value of 0x02 to SysConfig1 Register (Addr = 0x03) for Right Trackpad ASIC \n
	echo \n

	reset_top_level_watchpoints
	check_trackpad_asic_reg_write

	# }


	#------------------------------------------------------------------------------#


	# {

	echo \n
	echo Waiting for SPI write of Shutdown/Standby Command (Value of 0x02 to SysConfig1 Register (Addr = 0x03) for Left Trackpad ASIC \n
	echo \n
	
	reset_top_level_watchpoints
	check_trackpad_asic_reg_write

	# }


	#------------------------------------------------------------------------------#


	# {
	
	# Handle command to put MPU-6500 into sleep mode (called by fnc0x00005fbc()):

	echo Waiting for I2C command for sleep to MPU-6500 \n
	echo \n
	
	reset_top_level_watchpoints
	check_i2c_xfer

	# }


	#------------------------------------------------------------------------------#


	# {

	echo \n
	echo Waiting for initial ADC read for AD6 only \n
	echo \n

	reset_top_level_watchpoints
	check_get_adc_vals

	# }


	#------------------------------------------------------------------------------#


	# {

	# Wait for SysTick to be setup by fnc0x00009b28():
	watch $pc == 0x00009b3a

	echo \n
	echo Waiting for SysTick to be enabled \n
	echo \n

	# Execute until watchpoint
	continue

	# This flag is set by SysTick after a number of executions. 
	#  This seems to allow main loop to proceed with some periodic 
	#  behaviors (i.e. should (and can) HID update messages me sent?)
	set {char}0x10000074 = 1

	# Remove watchpoint
	delete 

	# }


	#------------------------------------------------------------------------------#


	# {

	echo \n
	echo Waiting for Sleep before checking ADC reading for AD0-4 & 6 \n
	echo \n

	reset_top_level_watchpoints
	check_ct16b0_sleep
	
	# } 


	#------------------------------------------------------------------------------#


	# {

	echo \n
	echo Waiting for ADC read of AD0-4 & 6 \n
	echo \n

	reset_top_level_watchpoints
	check_get_adc_vals

	# }


	#------------------------------------------------------------------------------#


	# {

	# Wait for USB to be connected and enabled by fnc0x00002fd8() AND for 
	#  one iteration of main loop to complete (i.e fnc0x0000b84c() has just
	#  finished which checks if HID message needed to be sent for EP).
	watch $pc == 0x0000d818

	echo \n
	echo Waiting for pass of main loop before simulating USB_Configure_Event has occurred \n
	echo \n

	# Execute until watchpoint
	continue

	# Simulate USB_Configure_Event() has fired:
	#  This allows for main loop to perform some additional init.
	set {int}0x100010d8 = 0x00000001 
	set {int}0x100010dc = 0x0000a8ad

	# Remove watchpoint
	delete 

	# }


	#------------------------------------------------------------------------------#


	# {

	echo \n
	echo Waiting for sleep before EEPROM read of 0x400 bytes from offset 0x800 \n
	echo \n

	reset_top_level_watchpoints
	check_ct16b0_sleep

	# }


	#------------------------------------------------------------------------------#


	# {

	# Handle filling in RAM with 0x400 bytes that would have been read from EEPROM offset 0x800	

	# Setup watchpoint for instruction setting mask to check SSP/SPI Status Register Receive FIFO Not Empty bit
	watch $pc == 0x00000bdc
	watch $pc == 0x000051c4

	echo \n
	echo Waiting for EEPROM read 0x400 bytes that would have been read from EEPROM offset 0x800 \n
	echo \n

	# Execute until watchpoint
	continue

	eeprom_data_rd

	# }


	#------------------------------------------------------------------------------#


	# {

	# Handle filling in RAM with 2 bytes that would have been read from EEPROM offset 0x600	

	# Setup watchpoint for instruction setting mask to check SSP/SPI Status Register Receive FIFO Not Empty bit
	watch $pc == 0x00000bdc
	watch $pc == 0x000051c4

	echo \n
	echo Waiting for EEPROM read of 2 bytes from offset 0x600 \n
	echo \n
	
	# Execute until watchpoint
	continue

	eeprom_data_rd

	# }

#TODO: all scenarios above should be encompassed in gdbCustomCmds and made part of loop below


	#------------------------------------------------------------------------------#


	# At this point we just need a loop and goes through and handles functions that
	#  need extra help being simulated (i.e. due to interactions with hardware or
	#  external peripherals). 
	#
	# As more scenarios are encountered add new custom functions to gdbCustomCmds
	#  and call them as part of this loop.
	while (1)

		# TODO: temporary solution to get multiple iterations of filling out USB structures after Trackpad ASIC setup
		set {char}0x10000074 = 1

		# Set watchpoints that relate to functions that need special simulation steps
		reset_top_level_watchpoints

		# Check all functions that we may have stopped at
		check_ct16b0_sleep
		check_trackpad_asic_reg_write
		check_trackpad_asic_reg_read
		check_trackpad_asic_era_write_autoinc
		check_trackpad_asic_dr_interrupts
		eeprom_data_rd
		check_spi_asic_rd_reg_0x11_0x12
		check_pint3_isr_sim
		check_ct32b0_isr_sim
		check_i2c_xfer
		check_get_adc_vals
		check_trackpad_isr_main_loop
	end


	#------------------------------------------------------------------------------#


	# We should never get here due to infinite loop above


end