git.rot13.org Git - goodfet/blob - firmware/apps/jtag/jtagarm7tdmi.c

   1 /*! \file jtagarm7tdmi.c
   2   \brief ARM7TDMI JTAG (AT91R40008)
   3 */
   4
   5 #include "platform.h"
   6 #include "command.h"
   7 #include "jtag.h"
   8 #include "jtagarm7tdmi.h"
   9
  10
  11 /**** 20-pin Connection Information (pin1 is on top-right for both connectors)****
  12 GoodFET  ->  7TDMI 20-pin connector (HE-10 connector)
  13   1               13 (TDO)
  14   2               1  (Vdd)
  15   3               5  (TDI)
  16   5               7  (TMS)
  17   7               9  (TCK)
  18   8               15 (nRST)
  19   9               4,6,8,10,12,14,16,18,20 (GND)
  20   11              17/3 (nTRST)  (different sources suggest 17 or 3 alternately)
  21 ********************************/
  22
  23 /**** 14-pin Connection Information (pin1 is on top-right for both connectors)****
  24 GoodFET  ->  7TDMI 14-pin connector
  25   1               11 (TDO)
  26   2               1  (Vdd)
  27   3               5  (TDI)
  28   5               7  (TMS)
  29   7               9  (TCK)
  30   8               12 (nRST)
  31   9               2,4,6,8,10,14 (GND)
  32   11              3 (nTRST)
  33
  34 http://hri.sourceforge.net/tools/jtag_faq_org.html
  35 ********************************/
  36
  37
  38
  39
  40
  41
  42 /****************************************************************
  43 Enabling jtag likely differs with most platforms.  We will attempt to enable most from here.  Override jtagarm7tdmi_start() to extend for other implementations
  44 ARM7TDMI enables three different scan chains:
  45     * Chain0 - "entire periphery" including data bus
  46     * Chain1 - core data bus (subset of Chain0)  - Instruction Pipeline
  47     * Chain2 - EmbeddedICE Logic Registers - This is our way into the fun stuff.
  48
  49
  50 ---
  51 You can disable EmbeddedICE-RT by setting the DBGEN input LOW.
  52 Caution
  53 Hard wiring the DBGEN input LOW permanently disables all debug functionality.
  54 When DBGEN is LOW, it inhibits DBGDEWPT, DBGIEBKPT, and EDBGRQ to
  55 the core, and DBGACK from the ARM9E-S core is always LOW.
  56 ---
  57
  58
  59 ---
  60 When the ARM9E-S core is in debug state, you can examine the core and system state
  61 by forcing the load and store multiples into the instruction pipeline.
  62 Before you can examine the core and system state, the debugger must determine
  63 whether the processor entered debug from Thumb state or ARM state, by examining
  64 bit 4 of the EmbeddedICE-RT debug status register. If bit 4 is HIGH, the core has
  65 entered debug from Thumb state.
  66 For more details about determining the core state, see Determining the core and system
  67 state on page B-18.
  68 ---
  69
  70
  71 --- olimex - http://www.olimex.com/dev/pdf/arm-jtag.pdf
  72 JTAG signals description:
  73 PIN.1 (VTREF) Target voltage sense. Used to indicate the target’s operating voltage to thedebug tool.
  74 PIN.2 (VTARGET) Target voltage. May be used to supply power to the debug tool.
  75 PIN.3 (nTRST) JTAG TAP reset, this signal should be pulled up to Vcc in target board.
  76 PIN4,6, 8, 10,12,14,16,18,20 Ground. The Gnd-Signal-Gnd-Signal strategy implemented on the 20-way connection scheme improves noiseimmunity on the target connect cable.
  77 *PIN.5 (TDI) JTAG serial data in, should be pulled up to Vcc on target board.
  78 *PIN.7 (TMS) JTAG TAP Mode Select, should be pulled up to Vcc on target board.
  79 *PIN.9 (TCK) JTAG clock.
  80 PIN.11 (RTCK) JTAG retimed clock.Implemented on certain ASIC ARM implementations the host ASIC may need to synchronize external inputs (such as JTAG inputs) with its own internal clock.
  81 *PIN.13 (TDO) JTAG serial data out.
  82 *PIN.15 (nSRST) Target system reset.
  83 *PIN.17 (DBGRQ) Asynchronous debug request.  DBGRQ allows an external signal to force the ARM core into debug mode, should be pull down to GND.
  84 PIN.19 (DBGACK) Debug acknowledge. The ARM core acknowledges debug-mode inresponse to a DBGRQ input.
  85
  86
  87 -----------  SAMPLE TIMES  -----------
  88
  89 TDI and TMS are sampled on the rising edge of TCK and TDO transitions appear on the falling edge of TCK. Therefore, TDI and TMS must be written after the falling edge of TCK and TDO must be read after the rising edge of TCK.
  90
  91 for this module, we keep tck high for all changes/sampling, and then bounce it.
  92 ****************************************************************/
  93
  94
  95
  96 /************************** JTAGARM7TDMI Primitives ****************************/
  97 void jtag_goto_shift_ir() {
  98   SETTMS;
  99   jtag_arm_tcktock();
 100   jtag_arm_tcktock();
 101   CLRTMS;
 102   jtag_arm_tcktock();
 103   jtag_arm_tcktock();
 104
 105 }
 106
 107 void jtag_goto_shift_dr() {
 108   SETTMS;
 109   jtag_arm_tcktock();
 110   CLRTMS;
 111   jtag_arm_tcktock();
 112   jtag_arm_tcktock();
 113 }
 114
 115 void jtag_reset_to_runtest_idle() {
 116   SETTMS;
 117   jtag_arm_tcktock();
 118   jtag_arm_tcktock();
 119   jtag_arm_tcktock();
 120   jtag_arm_tcktock();
 121   jtag_arm_tcktock();
 122   jtag_arm_tcktock();
 123   jtag_arm_tcktock();
 124   jtag_arm_tcktock();  // now in Reset state
 125   CLRTMS;
 126   jtag_arm_tcktock();  // now in Run-Test/Idle state
 127 }
 128
 129 void jtag_arm_tcktock() {
 130   CLRTCK;
 131   PLEDOUT^=PLEDPIN;
 132   SETTCK;
 133   PLEDOUT^=PLEDPIN;
 134 }
 135
 136
 137 // ! Start JTAG, setup pins, reset TAP and return IDCODE
 138 unsigned long jtagarm7tdmi_start() {
 139   jtagsetup();
 140   //Known-good starting position.
 141   //Might be unnecessary.
 142   SETTST;
 143   SETRST;
 144
 145   delay(0x2);
 146
 147   CLRRST;
 148   delay(2);
 149   CLRTST;
 150
 151   msdelay(10);
 152   SETRST;
 153   /*
 154   P5DIR &=~RST;
 155   */
 156   delay(0x2);
 157   jtagarm7tdmi_resettap();
 158   return jtagarm7tdmi_idcode();
 159 }
 160
 161
 162 //! Reset TAP State Machine
 163 void jtagarm7tdmi_resettap(){               // PROVEN
 164   current_chain = -1;
 165   jtag_reset_to_runtest_idle();
 166 }
 167
 168
 169 //  NOTE: important: THIS MODULE REVOLVES AROUND RETURNING TO RUNTEST/IDLE, OR THE FUNCTIONAL EQUIVALENT
 170
 171
 172 //! Shift N bits over TDI/TDO.  May choose LSB or MSB, and select whether to terminate (TMS-high on last bit) and whether to return to RUNTEST/IDLE
 173 unsigned long jtagarmtransn(unsigned long word, unsigned char bitcount, unsigned char lsb, unsigned char end, unsigned char retidle){               // PROVEN
 174   unsigned int bit;
 175   unsigned long high = 1;
 176   unsigned long mask;
 177
 178   for (bit=(bitcount-1)/8; bit>0; bit--)
 179     high <<= 8;
 180   high <<= ((bitcount-1)%8);
 181
 182   mask = high-1;
 183
 184   if (lsb) {
 185     for (bit = bitcount; bit > 0; bit--) {
 186       /* write MOSI on trailing edge of previous clock */
 187       if (word & 1)
 188         {SETMOSI;}
 189       else
 190         {CLRMOSI;}
 191       word >>= 1;
 192
 193       if (bit==1 && end)
 194         SETTMS;//TMS high on last bit to exit.
 195
 196       jtag_arm_tcktock();
 197
 198       /* read MISO on trailing edge */
 199       if (READMISO){
 200         word += (high);
 201       }
 202     }
 203   } else {
 204     for (bit = bitcount; bit > 0; bit--) {
 205       /* write MOSI on trailing edge of previous clock */
 206       if (word & high)
 207         {SETMOSI;}
 208       else
 209         {CLRMOSI;}
 210       word = (word & mask) << 1;
 211
 212       if (bit==1 && end)
 213         SETTMS;//TMS high on last bit to exit.
 214
 215       jtag_arm_tcktock();
 216
 217       /* read MISO on trailing edge */
 218       word |= (READMISO);
 219     }
 220   }
 221
 222
 223   SETMOSI;
 224
 225   if (end){
 226     // exit state
 227     jtag_arm_tcktock();
 228     // update state
 229     if (retidle){
 230       CLRTMS;
 231       jtag_arm_tcktock();
 232     }
 233   }
 234   return word;
 235 }
 236
 237
 238
 239 /************************************************************************
 240 * ARM7TDMI core has 6 primary registers to be connected between TDI/TDO
 241 *   * Bypass Register
 242 *   * ID Code Register
 243 *   * Scan Chain Select Register    (4 bits_lsb)
 244 *   * Scan Chain 0                  (64+* bits: 32_databits_lsb + ctrlbits + 32_addrbits_msb)
 245 *   * Scan Chain 1                  (33 bits: 32_bits + BREAKPT)
 246 *   * Scan Chain 2                  (38 bits: rw + 5_regbits_msb + 32_databits_msb)
 247 ************************************************************************/
 248
 249
 250
 251 /************************** Basic JTAG Verb Commands *******************************/
 252 //! Grab the core ID.
 253 unsigned long jtagarm7tdmi_idcode(){               // PROVEN
 254   jtagarm7tdmi_resettap();
 255   SHIFT_IR;
 256   jtagarmtransn(ARM7TDMI_IR_IDCODE, 4, LSB, END, RETIDLE);
 257   SHIFT_DR;
 258   return jtagarmtransn(0,32, LSB, END, RETIDLE);
 259 }
 260
 261 //!  Connect Bypass Register to TDO/TDI
 262 unsigned char jtagarm7tdmi_bypass(){               // PROVEN
 263   //jtagarm7tdmi_resettap();
 264   SHIFT_IR;
 265   return jtagarmtransn(ARM7TDMI_IR_BYPASS, 4, LSB, END, NORETIDLE);
 266 }
 267 //!  INTEST verb - do internal test
 268 unsigned char jtagarm7tdmi_intest() {
 269   //jtagarm7tdmi_resettap();
 270   SHIFT_IR;
 271   return jtagarmtransn(ARM7TDMI_IR_INTEST, 4, LSB, END, NORETIDLE);
 272 }
 273
 274 //!  EXTEST verb
 275 unsigned char jtagarm7tdmi_extest() {
 276   //jtagarm7tdmi_resettap();
 277   SHIFT_IR;
 278   return jtagarmtransn(ARM7TDMI_IR_EXTEST, 4, LSB, END, NORETIDLE);
 279 }
 280
 281 //!  SAMPLE verb
 282 //unsigned long jtagarm7tdmi_sample() {
 283 //  jtagarm7tdmi_ir_shift4(ARM7TDMI_IR_SAMPLE);        // ???? same here.
 284 //  return jtagtransn(0,32);
 285 //}
 286
 287 //!  RESTART verb
 288 unsigned char jtagarm7tdmi_restart() {
 289   //jtagarm7tdmi_resettap();
 290   SHIFT_IR;
 291   return jtagarmtransn(ARM7TDMI_IR_RESTART, 4, LSB, END, RETIDLE);
 292 }
 293
 294 //!  ARM7TDMI_IR_CLAMP               0x5
 295 //unsigned long jtagarm7tdmi_clamp() {
 296 //  jtagarm7tdmi_resettap();
 297 //  SHIFT_IR;
 298 //  jtagarmtransn(ARM7TDMI_IR_CLAMP, 4, LSB, END, NORETIDLE);
 299 //  SHIFT_DR;
 300 //  return jtagarmtransn(0, 32, LSB, END, RETIDLE);
 301 //}
 302
 303 //!  ARM7TDMI_IR_HIGHZ               0x7
 304 //unsigned char jtagarm7tdmi_highz() {
 305 //  jtagarm7tdmi_resettap();
 306 //  SHIFT_IR;
 307 //  return jtagarmtransn(ARM7TDMI_IR_HIGHZ, 4, LSB, END, NORETIDLE);
 308 //}
 309
 310 //! define ARM7TDMI_IR_CLAMPZ              0x9
 311 //unsigned char jtagarm7tdmi_clampz() {
 312 //  jtagarm7tdmi_resettap();
 313 //  SHIFT_IR;
 314 //  return jtagarmtransn(ARM7TDMI_IR_CLAMPZ, 4, LSB, END, NORETIDLE);
 315 //}
 316
 317
 318 //!  Connect the appropriate scan chain to TDO/TDI.  SCAN_N, INTEST, ENDS IN SHIFT_DR!!!!!
 319 unsigned long jtagarm7tdmi_scan(int chain, int testmode) {               // PROVEN
 320 /*
 321 When selecting a scan chain the “Run Test/Idle” state should never be reached, other-
 322 wise, when in debug state, the core will not be correctly isolated and intrusive
 323 commands occur. Therefore, it is recommended to pass directly from the “Update”
 324 state” to the “Select DR” state each time the “Update” state is reached.
 325 */
 326   unsigned long retval;
 327   if (current_chain != chain) {     // breaks shit when going from idcode back to scan chain
 328     SHIFT_IR;
 329     jtagarmtransn(ARM7TDMI_IR_SCAN_N, 4, LSB, END, NORETIDLE);
 330     SHIFT_DR;
 331     retval = jtagarmtransn(chain, 4, LSB, END, NORETIDLE);
 332     current_chain = chain;
 333   }    else
 334     retval = current_chain;
 335   // put in test mode...
 336   SHIFT_IR;
 337   jtagarmtransn(testmode, 4, LSB, END, RETIDLE);
 338   return(retval);
 339 }
 340
 341
 342 //!  Connect the appropriate scan chain to TDO/TDI.  SCAN_N, INTEST, ENDS IN SHIFT_DR!!!!!
 343 unsigned long jtagarm7tdmi_scan_intest(int chain) {               // PROVEN
 344   return jtagarm7tdmi_scan(chain, ARM7TDMI_IR_INTEST);
 345 }
 346
 347
 348
 349
 350 //! push an instruction into the pipeline
 351 unsigned long jtagarm7tdmi_instr_primitive(unsigned long instr, char breakpt){
 352   unsigned long retval;
 353   //jtagarm7tdmi_resettap();                  // FIXME: DEBUG: seems necessary for some reason.  ugh.
 354   jtagarm7tdmi_scan_intest(1);
 355
 356   SHIFT_DR;
 357   // if the next instruction is to run using MCLK (master clock), set TDI
 358   if (breakpt)
 359     {
 360     SETMOSI;
 361     count_sysspd_instr_since_debug++;
 362     }
 363   else
 364     {
 365     CLRMOSI;
 366     count_dbgspd_instr_since_debug++;
 367     }
 368   jtag_arm_tcktock();
 369
 370   // Now shift in the 32 bits
 371   retval = jtagarmtransn(instr, 32, MSB, END, RETIDLE);    // Must return to RUN-TEST/IDLE state for instruction to enter pipeline, and causes debug clock.
 372   //jtag_arm_tcktock();
 373   return(retval);
 374
 375 }
 376
 377
 378 unsigned long jtagarm7tdmi_nop(char breakpt){
 379   return jtagarm7tdmi_instr_primitive(ARM_INSTR_NOP, breakpt);
 380 }
 381
 382 /*    stolen from ARM DDI0029G documentation, translated using ARM Architecture Reference Manual (14128.pdf)
 383 STR R0, [R0]; Save R0 before use
 384 MOV R0, PC ; Copy PC into R0
 385 STR R0, [R0]; Now save the PC in R0
 386 BX PC ; Jump into ARM state
 387 MOV R8, R8 ;
 388 MOV R8, R8 ;
 389 NOP
 390 NOP
 391
 392 */
 393 //! set the current mode to ARM, returns PC (FIXME).  Should be used by haltcpu(), which should also store PC and the THUMB state, for use by releasecpu();
 394 unsigned long jtagarm7tdmi_setMode_ARM(){               // PROVEN
 395   unsigned long retval = 0xff;
 396   while ((jtagarm7tdmi_get_dbgstate() & JTAG_ARM7TDMI_DBG_TBIT)&& retval-- > 0){
 397     cmddataword[6] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_NOP,0);
 398     cmddataword[1] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_STR_R0_r0,0);
 399     cmddataword[2] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_MOV_R0_PC,0);
 400     cmddataword[3] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_STR_R0_r0,0);
 401     cmddataword[4] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_BX_PC,0);
 402     cmddataword[5] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_NOP,0);
 403     cmddataword[6] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_NOP,0);
 404     jtagarm7tdmi_resettap();                  // seems necessary for some reason.  ugh.
 405   }
 406   return(retval);
 407 }
 408
 409
 410
 411
 412 /************************* EmbeddedICE Primitives ****************************/
 413 //! shifter for writing to chain2 (EmbeddedICE).
 414 unsigned long eice_write(unsigned char reg, unsigned long data){
 415   unsigned long retval, temp;
 416   jtagarm7tdmi_scan_intest(2);
 417   // Now shift in the 32 bits
 418   SHIFT_DR;
 419   retval = jtagarmtransn(data, 32, LSB, NOEND, NORETIDLE);          // send in the data - 32-bits lsb
 420   temp = jtagarmtransn(reg, 5, LSB, NOEND, NORETIDLE);              // send in the register address - 5 bits lsb
 421   jtagarmtransn(1, 1, LSB, END, RETIDLE);                           // send in the WRITE bit
 422
 423   //SETTMS;   // Last Bit - Exit UPDATE_DR
 424   //// is this update a read/write or just read?
 425   //SETMOSI;
 426   //jtag_arm_tcktock();
 427
 428   return(retval);
 429 }
 430
 431 //! shifter for reading from chain2 (EmbeddedICE).
 432 unsigned long eice_read(unsigned char reg){               // PROVEN
 433   unsigned long temp;
 434   jtagarm7tdmi_scan_intest(2);
 435
 436   // send in the register address - 5 bits LSB
 437   SHIFT_DR;
 438   temp = jtagarmtransn(reg, 5, LSB, NOEND, NORETIDLE);
 439
 440   // clear TDI to select "read only"
 441   jtagarmtransn(0, 1, LSB, END, RETIDLE);
 442
 443   SHIFT_DR;
 444   // Now shift out the 32 bits
 445   return(jtagarmtransn(0, 32, LSB, END, RETIDLE));   // atmel arm jtag docs pp.10-11: LSB first
 446
 447 }
 448
 449
 450
 451
 452 /************************* ICEBreaker/EmbeddedICE Stuff ******************************/
 453 //! Grab debug register
 454 unsigned long jtagarm7tdmi_get_dbgstate() {       // ICE Debug register, *NOT* ARM register DSCR    //    PROVEN
 455   //jtagarm7tdmi_resettap();
 456   return eice_read(EICE_DBGSTATUS);
 457 }
 458
 459 //! Grab debug register
 460 unsigned long jtagarm7tdmi_get_dbgctrl() {
 461   return eice_read(EICE_DBGCTRL);
 462 }
 463
 464 //! Update debug register
 465 unsigned long jtagarm7tdmi_set_dbgctrl(unsigned long bits) {
 466   return eice_write(EICE_DBGCTRL, bits);
 467 }
 468
 469
 470
 471 //!  Set and Enable Watchpoint 0
 472 void jtagarm7tdmi_set_watchpoint0(unsigned long addr, unsigned long addrmask, unsigned long data, unsigned long datamask, unsigned long ctrl, unsigned long ctrlmask){
 473   // store watchpoint info?  - not right now
 474     // FIXME: store info
 475
 476   eice_write(EICE_WP0ADDR, addr);           // write 0 in watchpoint 0 address
 477   eice_write(EICE_WP0ADDRMASK, addrmask);   // write 0xffffffff in watchpoint 0 address mask
 478   eice_write(EICE_WP0DATA, data);           // write 0 in watchpoint 0 data
 479   eice_write(EICE_WP0DATAMASK, datamask);   // write 0xffffffff in watchpoint 0 data mask
 480   eice_write(EICE_WP0CTRL, ctrlmask);       // write 0x00000100 in watchpoint 0 control value register (enables watchpoint)
 481   eice_write(EICE_WP0CTRLMASK, ctrlmask);   // write 0xfffffff7 in watchpoint 0 control mask - only detect the fetch instruction
 482 }
 483
 484 //!  Set and Enable Watchpoint 1
 485 void jtagarm7tdmi_set_watchpoint1(unsigned long addr, unsigned long addrmask, unsigned long data, unsigned long datamask, unsigned long ctrl, unsigned long ctrlmask){
 486   // store watchpoint info?  - not right now
 487     // FIXME: store info
 488
 489   eice_write(EICE_WP1ADDR, addr);           // write 0 in watchpoint 1 address
 490   eice_write(EICE_WP1ADDRMASK, addrmask);   // write 0xffffffff in watchpoint 1 address mask
 491   eice_write(EICE_WP1DATA, data);           // write 0 in watchpoint 1 data
 492   eice_write(EICE_WP1DATAMASK, datamask);   // write 0xffffffff in watchpoint 1 data mask
 493   eice_write(EICE_WP1CTRL, ctrl);           // write 0x00000100 in watchpoint 1 control value register (enables watchpoint)
 494   eice_write(EICE_WP1CTRLMASK, ctrlmask);   // write 0xfffffff7 in watchpoint 1 control mask - only detect the fetch instruction
 495 }
 496
 497 //!  Disable Watchpoint 0
 498 void jtagarm7tdmi_disable_watchpoint0(){
 499   eice_write(EICE_WP0CTRL, 0x0); // write 0 in watchpoint 0 control value - disables watchpoint 0
 500 }
 501
 502 //!  Disable Watchpoint 1
 503 void jtagarm7tdmi_disable_watchpoint1(){
 504   eice_write(EICE_WP1CTRL, 0x0);            // write 0 in watchpoint 0 control value - disables watchpoint 0
 505 }
 506
 507
 508
 509 /******************** Complex Commands **************************/
 510 //! Push an instruction into the CPU pipeline
 511 //  NOTE!  Must provide EXECNOPARM for parameter if no parm is required.
 512 unsigned long test_exec(unsigned long instr, unsigned long parameter, unsigned char systemspeed) {
 513   unsigned long retval;
 514
 515   cmddatalong[1] = jtagarm7tdmi_nop( 0);
 516   cmddatalong[2] = jtagarm7tdmi_nop(systemspeed);
 517   cmddatalong[3] = jtagarm7tdmi_instr_primitive(instr, 0);      // write 32-bit instruction code into DR
 518   cmddatalong[4] = jtagarm7tdmi_nop( 0);
 519   cmddatalong[5] = jtagarm7tdmi_nop( 0);
 520   cmddatalong[6] = jtagarm7tdmi_instr_primitive(parameter, 0);  // inject long
 521   cmddatalong[7] = jtagarm7tdmi_nop( 0);
 522   cmddatalong[8] = jtagarm7tdmi_nop( 0);
 523   cmddatalong[9] = jtagarm7tdmi_nop( 0);
 524   retval = cmddatalong[9];
 525
 526   return(retval);
 527 }
 528
 529
 530 //! Push an instruction into the CPU pipeline
 531 //  NOTE!  Must provide EXECNOPARM for parameter if no parm is required.
 532 unsigned long jtagarm7tdmi_exec(unsigned long instr, unsigned long parameter, unsigned char systemspeed) {
 533   unsigned long retval;
 534
 535   cmddatalong[1] = jtagarm7tdmi_nop( 0);
 536   cmddatalong[2] = jtagarm7tdmi_nop(systemspeed);
 537   cmddatalong[3] = jtagarm7tdmi_instr_primitive(instr, 0);      // write 32-bit instruction code into DR
 538   cmddatalong[4] = jtagarm7tdmi_nop( 0);
 539   cmddatalong[5] = jtagarm7tdmi_nop( 0);
 540   cmddatalong[6] = jtagarm7tdmi_instr_primitive(parameter, 0);  // inject long
 541   cmddatalong[7] = jtagarm7tdmi_nop( 0);
 542   retval = jtagarm7tdmi_nop( 0);
 543   cmddatalong[9] = jtagarm7tdmi_nop( 0);
 544   cmddatalong[8] = retval;
 545
 546   return(retval);
 547 }
 548
 549 //! Retrieve a 32-bit Register value
 550 unsigned long jtagarm7tdmi_get_register(unsigned char reg) {
 551   unsigned long retval = 0, instr;
 552   // push nop into pipeline - clean out the pipeline...
 553   cmddatalong[2] = jtagarm7tdmi_nop( 0);
 554
 555   instr = ARM_READ_REG | (reg<<12);                     // push STR Rx, [R14] into pipeline
 556   cmddatalong[1] = jtagarm7tdmi_instr_primitive(instr, 0);
 557   cmddatalong[2] = jtagarm7tdmi_nop( 0);                // push nop into pipeline - fetched
 558   cmddatalong[3] = jtagarm7tdmi_nop( 0);                // push nop into pipeline - decoded
 559   cmddatalong[4] = jtagarm7tdmi_nop( 0);                // push nop into pipeline - executed
 560   retval = jtagarm7tdmi_nop( 0);                        // recover 32-bit word
 561   cmddatalong[5] = retval;
 562   cmddatalong[6] = jtagarm7tdmi_nop( 0);
 563   cmddatalong[7] = jtagarm7tdmi_nop( 0);
 564   cmddatalong[8] = jtagarm7tdmi_nop( 0);
 565   return retval;
 566 }
 567
 568 //! Retrieve a 32-bit Register value
 569 unsigned long test_get_register(unsigned char reg) {
 570   unsigned long retval = 0, instr;
 571   // push nop into pipeline - clean out the pipeline...
 572   cmddatalong[2] = jtagarm7tdmi_nop( 0);
 573
 574   instr = ARM_READ_REG | (reg<<12);                     // push STR Rx, [R14] into pipeline
 575   cmddatalong[1] = jtagarm7tdmi_instr_primitive(instr, 0);      // fetch
 576   cmddatalong[2] = jtagarm7tdmi_nop( 0);                        // decode
 577   cmddatalong[3] = jtagarm7tdmi_nop( 0);                        // execute
 578   cmddatalong[4] = jtagarm7tdmi_nop( 0);                        // ??? what happens here ???
 579   retval = jtagarm7tdmi_nop( 0);                                // recover 32-bit word
 580   cmddatalong[5] = retval;
 581   cmddatalong[6] = jtagarm7tdmi_nop( 0);
 582   cmddatalong[7] = jtagarm7tdmi_nop( 0);
 583   cmddatalong[8] = jtagarm7tdmi_nop( 0);
 584   return retval;
 585 }
 586
 587 //! Set a 32-bit Register value
 588 unsigned long jtagarm7tdmi_set_register(unsigned char reg, unsigned long val) {
 589   unsigned long retval = 0, instr;
 590   cmddatalong[1] = jtagarm7tdmi_nop( 0); // push nop into pipeline - clean out the pipeline...
 591
 592   instr = ARM_WRITE_REG | (reg<<12);     // push LDR Rx, [R14] into pipeline
 593   cmddatalong[2] = jtagarm7tdmi_instr_primitive(instr, 0); // push nop into pipeline - fetch
 594   cmddatalong[3] = jtagarm7tdmi_nop( 0); // push nop into pipeline - decode
 595   cmddatalong[4] = jtagarm7tdmi_instr_primitive(val-16, 0); // push 32-bit word on data bus
 596   //cmddatalong[4] = jtagarm7tdmi_nop( 0); // push nop into pipeline - execute
 597
 598   cmddatalong[5] = jtagarm7tdmi_instr_primitive(val, 0); // push 32-bit word on data bus
 599   cmddatalong[6] = jtagarm7tdmi_instr_primitive(val+16, 0); // push 32-bit word on data bus
 600   //cmddatalong[6] = jtagarm7tdmi_nop( 0); // push nop into pipeline - executed
 601
 602   if (reg == ARM_REG_PC){
 603     cmddatalong[7] = jtagarm7tdmi_nop( 0);
 604     cmddatalong[8] = jtagarm7tdmi_nop( 0);
 605   }
 606   cmddatalong[9] = jtagarm7tdmi_nop( 0);
 607
 608   retval = cmddatalong[5];
 609   return(retval);
 610 }
 611
 612 //! Set a 32-bit Register value
 613 unsigned long test_set_register(unsigned char reg, unsigned long val) {
 614   unsigned long retval = 0, instr;
 615   cmddatalong[1] = jtagarm7tdmi_nop( 0); // push nop into pipeline - clean out the pipeline...
 616
 617   instr = ARM_WRITE_REG | (reg<<12);     // push LDR Rx, [R14] into pipeline
 618   cmddatalong[2] = jtagarm7tdmi_instr_primitive(instr, 0);
 619
 620   cmddatalong[3] = jtagarm7tdmi_instr_primitive(val+32, 0); // push 32-bit word on data bus - execute state
 621   cmddatalong[4] = jtagarm7tdmi_instr_primitive(val+16, 0); // push 32-bit word on data bus - execute state
 622   cmddatalong[5] = jtagarm7tdmi_instr_primitive(val, 0); // push 32-bit word on data bus - execute state
 623   cmddatalong[6] = jtagarm7tdmi_instr_primitive(val-16, 0); // push 32-bit word on data bus - execute state
 624
 625   if (reg == ARM_REG_PC){
 626     cmddatalong[7] = jtagarm7tdmi_nop( 0);
 627     cmddatalong[8] = jtagarm7tdmi_nop( 0);
 628   }
 629   cmddatalong[9] = jtagarm7tdmi_instr_primitive(val-32, 0); // push 32-bit word on data bus - execute state
 630
 631   retval = cmddatalong[5];
 632   return(retval);
 633 }
 634
 635
 636
 637
 638 //! Get all registers.  Return an array
 639 unsigned long* jtagarm7tdmi_get_registers() {
 640   cmddatalong[1] = jtagarm7tdmi_instr_primitive(ARM_INSTR_SKANKREGS,0);
 641   cmddatalong[2] = jtagarm7tdmi_nop( 0);
 642   cmddatalong[3] = jtagarm7tdmi_nop( 0);
 643   cmddatalong[4] = jtagarm7tdmi_nop( 0);
 644   cmddatalong[5] = jtagarm7tdmi_nop( 0);
 645   cmddatalong[6] = jtagarm7tdmi_nop( 0);
 646   cmddatalong[7] = jtagarm7tdmi_nop( 0);
 647   cmddatalong[8] = jtagarm7tdmi_nop( 0);
 648   cmddatalong[9] = jtagarm7tdmi_nop( 0);
 649   cmddatalong[10] = jtagarm7tdmi_nop( 0);
 650   cmddatalong[11] = jtagarm7tdmi_nop( 0);
 651   cmddatalong[12] = jtagarm7tdmi_nop( 0);
 652   cmddatalong[13] = jtagarm7tdmi_nop( 0);
 653   cmddatalong[14] = jtagarm7tdmi_nop( 0);
 654   cmddatalong[15] = jtagarm7tdmi_nop( 0);
 655   cmddatalong[16] = jtagarm7tdmi_nop( 0);
 656   cmddatalong[17] = jtagarm7tdmi_nop( 0);
 657   cmddatalong[18] = jtagarm7tdmi_nop( 0);
 658   cmddatalong[19] = jtagarm7tdmi_nop( 0);
 659   cmddatalong[20] = jtagarm7tdmi_nop( 0);
 660   return registers;
 661 }
 662
 663 //! Get all registers.  Return an array
 664 unsigned long* jtagarm7tdmi_set_registers() {
 665   cmddatalong[1] = jtagarm7tdmi_instr_primitive(ARM_INSTR_SKANKREGS,0);
 666   cmddatalong[2] = jtagarm7tdmi_nop( 0);
 667   cmddatalong[3] = jtagarm7tdmi_nop( 0);
 668   cmddatalong[4] = jtagarm7tdmi_instr_primitive(0x40,0);
 669   cmddatalong[5] = jtagarm7tdmi_instr_primitive(0x41,0);
 670   cmddatalong[6] = jtagarm7tdmi_instr_primitive(0x42,0);
 671   cmddatalong[7] = jtagarm7tdmi_instr_primitive(0x43,0);
 672   cmddatalong[8] = jtagarm7tdmi_instr_primitive(0x44,0);
 673   cmddatalong[9] = jtagarm7tdmi_instr_primitive(0x45,0);
 674   cmddatalong[10] = jtagarm7tdmi_instr_primitive(0x46,0);
 675   cmddatalong[11] = jtagarm7tdmi_instr_primitive(0x47,0);
 676   cmddatalong[12] = jtagarm7tdmi_instr_primitive(0x48,0);
 677   cmddatalong[13] = jtagarm7tdmi_instr_primitive(0x49,0);
 678   cmddatalong[14] = jtagarm7tdmi_instr_primitive(0x4a,0);
 679   cmddatalong[15] = jtagarm7tdmi_instr_primitive(0x4b,0);
 680   cmddatalong[16] = jtagarm7tdmi_instr_primitive(0x4c,0);
 681   cmddatalong[17] = jtagarm7tdmi_instr_primitive(0x4d,0);
 682   cmddatalong[18] = jtagarm7tdmi_instr_primitive(0x4e,0);
 683   cmddatalong[19] = jtagarm7tdmi_instr_primitive(0x4f,0);
 684   return registers;
 685 }
 686
 687 //! Retrieve the CPSR Register value
 688 unsigned long jtagarm7tdmi_get_regCPSR() {
 689   unsigned long retval = 0;
 690
 691   cmddatalong[1] = jtagarm7tdmi_nop( 0); // push nop into pipeline - clean out the pipeline...
 692   cmddatalong[2] = jtagarm7tdmi_instr_primitive(ARM_INSTR_MRS_R0_CPSR, 0); // push MRS_R0, CPSR into pipeline
 693   cmddatalong[3] = jtagarm7tdmi_nop( 0); // push nop into pipeline - fetched
 694   cmddatalong[4] = jtagarm7tdmi_nop( 0); // push nop into pipeline - decoded
 695   cmddatalong[5] = jtagarm7tdmi_nop( 0); // push nop into pipeline - executed
 696   retval = jtagarm7tdmi_nop( 0);        // recover 32-bit word
 697   cmddatalong[6] = retval;
 698   return retval;
 699 }
 700
 701 //! Retrieve the CPSR Register value
 702 unsigned long jtagarm7tdmi_set_regCPSR(unsigned long val) {
 703   unsigned long retval = 0;
 704
 705   cmddatalong[1] = jtagarm7tdmi_nop( 0);        // push nop into pipeline - clean out the pipeline...
 706   cmddatalong[1] = jtagarm7tdmi_instr_primitive(ARM_INSTR_MSR_cpsr_cxsf_R0, 0); // push MSR cpsr_cxsf, R0 into pipeline
 707   cmddatalong[2] = jtagarm7tdmi_nop( 0);        // push nop into pipeline - fetched
 708   cmddatalong[3] = jtagarm7tdmi_nop( 0);        // push nop into pipeline - decoded
 709
 710   retval = jtagarm7tdmi_instr_primitive(val, 0);// push 32-bit word on data bus
 711   cmddatalong[5] = jtagarm7tdmi_nop( 0);        // push nop into pipeline - executed
 712   cmddatalong[4] = retval;
 713   return(retval);
 714 }
 715
 716 //! Write data to address - Assume TAP in run-test/idle state
 717 unsigned long jtagarm7tdmi_writemem(unsigned long adr, unsigned long data){
 718   unsigned long r0=0, r1=-1;
 719
 720   r0 = jtagarm7tdmi_get_register(0);        // store R0 and R1
 721   r1 = jtagarm7tdmi_get_register(1);
 722   jtagarm7tdmi_set_register(0, adr);        // write address into R0
 723   jtagarm7tdmi_set_register(1, data);       // write data in R1
 724   jtagarm7tdmi_nop( 0);                     // push nop into pipeline to "clean" it ???
 725   jtagarm7tdmi_nop( 1);                     // push nop into pipeline with BREAKPT set
 726   jtagarm7tdmi_instr_primitive(ARM_INSTR_LDR_R1_r0_4, 0); // push LDR R1, R0, #4 into instruction pipeline
 727   jtagarm7tdmi_nop( 0);                     // push nop into pipeline
 728   jtagarm7tdmi_set_register(1, r1);         // restore R0 and R1
 729   jtagarm7tdmi_set_register(0, r0);
 730   return(-1);
 731 }
 732
 733
 734
 735
 736 //! Read data from address
 737 unsigned long jtagarm7tdmi_readmem(unsigned long adr){
 738   unsigned long retval = 0;
 739   unsigned long r0=0, r1=-1;
 740   int waitcount = 0xfff;
 741
 742   r0 = jtagarm7tdmi_get_register(0);        // store R0 and R1
 743   r1 = jtagarm7tdmi_get_register(1);
 744   jtagarm7tdmi_set_register(0, adr);        // write address into R0
 745   jtagarm7tdmi_nop( 0);                     // push nop into pipeline to "clean" it ???
 746   jtagarm7tdmi_nop( 1);                     // push nop into pipeline with BREAKPT set
 747   jtagarm7tdmi_instr_primitive(ARM_INSTR_LDR_R1_r0_4, 0); // push LDR R1, R0, #4 into instruction pipeline
 748   jtagarm7tdmi_nop( 0);                     // push nop into pipeline
 749   jtagarm7tdmi_restart();                   // SHIFT_IR with RESTART instruction
 750
 751   // Poll the Debug Status Register for DBGACK and nMREQ to be HIGH
 752   while ((jtagarm7tdmi_get_dbgstate() & 9) == 0  && waitcount > 0){
 753     delay(1);
 754     waitcount --;
 755   }
 756   if (waitcount == 0){
 757     return (-1);
 758   } else {
 759     retval = jtagarm7tdmi_get_register(1);  // read memory value from R1 register
 760     jtagarm7tdmi_set_register(1, r1);         // restore R0 and R1
 761     jtagarm7tdmi_set_register(0, r0);
 762   }
 763   return retval;
 764 }
 765
 766
 767 //! Read Program Counter
 768 unsigned long jtagarm7tdmi_getpc(){
 769   return jtagarm7tdmi_get_register(ARM_REG_PC);
 770 }
 771
 772 //! Set Program Counter
 773 unsigned long jtagarm7tdmi_setpc(unsigned long adr){
 774   return jtagarm7tdmi_set_register(ARM_REG_PC, adr);
 775 }
 776
 777 //! Halt CPU - returns 0xffff if the operation fails to complete within
 778 unsigned long jtagarm7tdmi_haltcpu(){                   //  PROVEN
 779   int waitcount = 0xfff;
 780
 781   // store watchpoint info?  - not right now
 782   eice_write(EICE_WP1ADDR, 0);              // write 0 in watchpoint 1 address
 783   eice_write(EICE_WP1ADDRMASK, 0xffffffff); // write 0xffffffff in watchpoint 1 address mask
 784   eice_write(EICE_WP1DATA, 0);              // write 0 in watchpoint 1 data
 785   eice_write(EICE_WP1DATAMASK, 0xffffffff); // write 0xffffffff in watchpoint 1 data mask
 786   eice_write(EICE_WP1CTRL, 0x100);          //!!!!! WTF!  THIS IS SUPPOSED TO BE 9 bits wide?!?  // write 0x00000100 in watchpoint 1 control value register (enables watchpoint)
 787   eice_write(EICE_WP1CTRLMASK, 0xfffffff7); //!!!!! WTF!  THIS IS SUPPOSED TO BE 8 bits wide?!?  // write 0xfffffff7 in watchpoint 1 control mask - only detect the fetch instruction
 788
 789   // poll until debug status says the cpu is in debug mode
 790   while (!(jtagarm7tdmi_get_dbgstate() & 0x1)   && waitcount-- > 0){
 791     delay(1);
 792   }
 793   eice_write(EICE_WP1CTRL, 0x0);            // write 0 in watchpoint 0 control value - disables watchpoint 0
 794
 795   // store the debug state
 796   last_halt_debug_state = jtagarm7tdmi_get_dbgstate();
 797   last_halt_pc = jtagarm7tdmi_getpc() - 4;  // assume -4 for entering debug mode via watchpoint.
 798   count_dbgspd_instr_since_debug = 0;
 799   count_sysspd_instr_since_debug = 0;
 800
 801   // get into ARM mode if the T flag is set (Thumb mode)
 802   while (jtagarm7tdmi_get_dbgstate() & JTAG_ARM7TDMI_DBG_TBIT && waitcount-- > 0) {
 803     jtagarm7tdmi_setMode_ARM();
 804   }
 805   jtagarm7tdmi_resettap();
 806   return waitcount;
 807 }
 808
 809 unsigned long jtagarm7tdmi_releasecpu(){
 810   int waitcount = 0xfff;
 811   unsigned long instr;
 812   // somehow determine what PC should be (a couple ways possible, calculations required)
 813   jtagarm7tdmi_nop(0);                          // NOP
 814   jtagarm7tdmi_nop(1);                          // NOP/BREAKPT
 815
 816   if (last_halt_debug_state & JTAG_ARM7TDMI_DBG_TBIT){      // FIXME:  FORNICATED!  BX requires register, thus more instrs... could we get away with the same instruction but +1 to offset?
 817     instr = ARM_INSTR_B_PC + 0x1000001 - (count_dbgspd_instr_since_debug) - (count_sysspd_instr_since_debug*3);  //FIXME: make this right  - can't we just do an a7solute b/bx?
 818     jtagarm7tdmi_instr_primitive(instr,0);
 819   } else {
 820     instr = ARM_INSTR_B_PC + 0x1000000 - (count_dbgspd_instr_since_debug*4) - (count_sysspd_instr_since_debug*12);
 821     jtagarm7tdmi_instr_primitive(instr,0);
 822   }
 823
 824   SHIFT_IR;
 825   jtagarmtransn(ARM7TDMI_IR_RESTART,4,LSB,END,RETIDLE); // VERB_RESTART
 826
 827   // wait until restart-bit set in debug state register
 828   while ((jtagarm7tdmi_get_dbgstate() & JTAG_ARM7TDMI_DBG_DBGACK) && waitcount > 0){
 829     msdelay(1);
 830     waitcount --;
 831   }
 832   last_halt_debug_state = -1;
 833   last_halt_pc = -1;
 834   return 0;
 835 }
 836
 837
 838
 839
 840 ///////////////////////////////////////////////////////////////////////////////////////////////////
 841 //! Handles ARM7TDMI JTAG commands.  Forwards others to JTAG.
 842 void jtagarm7tdmihandle(unsigned char app, unsigned char verb, unsigned long len){
 843   register char blocks;
 844
 845   unsigned int i,val,mlop;
 846   unsigned long at;
 847
 848   jtagarm7tdmi_resettap();
 849
 850   switch(verb){
 851   case START:
 852     //Enter JTAG mode.
 853     cmddatalong[0] = jtagarm7tdmi_start();
 854     cmddatalong[2] = jtagarm7tdmi_haltcpu();
 855     //jtagarm7tdmi_resettap();
 856     cmddatalong[1] = jtagarm7tdmi_get_dbgstate();
 857
 858     // DEBUG: FIXME: NOT PART OF OPERATIONAL CODE
 859     //for (mlop=2;mlop<4;mlop++){
 860     //  jtagarm7tdmi_set_register(mlop, 0x43424140);
 861     //}
 862     /////////////////////////////////////////////
 863     txdata(app,verb,0xc);
 864     break;
 865   case JTAGARM7TDMI_READMEM:
 866   case PEEK:
 867     blocks=(len>4?cmddata[4]:1);
 868     at=cmddatalong[0];
 869
 870     len=0x80;
 871     txhead(app,verb,len);
 872
 873     while(blocks--){
 874       for(i=0;i<len;i+=2){
 875         jtagarm7tdmi_resettap();
 876         delay(10);
 877
 878         val=jtagarm7tdmi_readmem(at);
 879
 880         at+=2;
 881         serial_tx(val&0xFF);
 882         serial_tx((val&0xFF00)>>8);
 883       }
 884     }
 885
 886     break;
 887   case JTAGARM7TDMI_GET_CHIP_ID:
 888         jtagarm7tdmi_resettap();
 889     cmddatalong[0] = jtagarm7tdmi_idcode();
 890     txdata(app,verb,4);
 891     break;
 892
 893
 894   case JTAGARM7TDMI_WRITEMEM:
 895   case POKE:
 896         jtagarm7tdmi_resettap();
 897     jtagarm7tdmi_writemem(cmddatalong[0],
 898                        cmddataword[2]);
 899     cmddataword[0]=jtagarm7tdmi_readmem(cmddatalong[0]);
 900     txdata(app,verb,2);
 901     break;
 902
 903   case JTAGARM7TDMI_HALTCPU:
 904     cmddatalong[0] = jtagarm7tdmi_haltcpu();
 905     txdata(app,verb,4);
 906     break;
 907   case JTAGARM7TDMI_RELEASECPU:
 908         jtagarm7tdmi_resettap();
 909     cmddatalong[0] = jtagarm7tdmi_releasecpu();
 910     txdata(app,verb,4);
 911     break;
 912   //unimplemented functions
 913   //case JTAGARM7TDMI_SETINSTRFETCH:
 914   //case JTAGARM7TDMI_WRITEFLASH:
 915   //case JTAGARM7TDMI_ERASEFLASH:
 916   case JTAGARM7TDMI_SET_PC:
 917     cmddatalong[0] = jtagarm7tdmi_setpc(cmddatalong[0]);
 918     txdata(app,verb,4);
 919     break;
 920   case JTAGARM7TDMI_GET_DEBUG_CTRL:
 921     cmddatalong[0] = jtagarm7tdmi_get_dbgctrl();
 922     txdata(app,verb,1);
 923     break;
 924   case JTAGARM7TDMI_SET_DEBUG_CTRL:
 925     cmddatalong[0] = jtagarm7tdmi_set_dbgctrl(cmddata[0]);
 926     txdata(app,verb,4);
 927     break;
 928   case JTAGARM7TDMI_GET_PC:
 929     cmddatalong[0] = jtagarm7tdmi_getpc();
 930     txdata(app,verb,4);
 931     break;
 932   case JTAGARM7TDMI_GET_DEBUG_STATE:
 933     //jtagarm7tdmi_resettap();            // Shouldn't need this, but currently do.  FIXME!
 934     cmddatalong[0] = jtagarm7tdmi_get_dbgstate();
 935     txdata(app,verb,4);
 936     break;
 937   //case JTAGARM7TDMI_GET_WATCHPOINT:
 938   //case JTAGARM7TDMI_SET_WATCHPOINT:
 939   case JTAGARM7TDMI_GET_REGISTER:
 940         jtagarm7tdmi_resettap();
 941     cmddatalong[0] = jtagarm7tdmi_get_register(cmddata[0]);
 942     //cmddatalong[0] = test_get_register(cmddata[0]);
 943     txdata(app,verb,96);
 944     break;
 945   case JTAGARM7TDMI_SET_REGISTER:           // FIXME: NOT AT ALL CORRECT, THIS IS TESTING CODE ONLY
 946         jtagarm7tdmi_resettap();
 947     cmddatalong[0] = cmddatalong[1];
 948     jtagarm7tdmi_set_register(cmddata[0], cmddatalong[1]);
 949     //test_set_register(cmddata[0], cmddatalong[1]);
 950     txdata(app,verb,96);
 951     break;
 952   case JTAGARM7TDMI_GET_REGISTERS:
 953         jtagarm7tdmi_resettap();
 954     jtagarm7tdmi_get_registers();
 955     txdata(app,verb,200);
 956     break;
 957   case JTAGARM7TDMI_SET_REGISTERS:
 958         jtagarm7tdmi_resettap();
 959     jtagarm7tdmi_set_registers();
 960     txdata(app,verb,200);
 961     break;
 962   case JTAGARM7TDMI_DEBUG_INSTR:
 963         jtagarm7tdmi_resettap();
 964     cmddataword[0] = jtagarm7tdmi_exec(cmddataword[0], cmddataword[1], cmddata[9]);
 965     txdata(app,verb,80);
 966     break;
 967   //case JTAGARM7TDMI_STEP_INSTR:
 968 /*  case JTAGARM7TDMI_READ_CODE_MEMORY:
 969   case JTAGARM7TDMI_WRITE_FLASH_PAGE:
 970   case JTAGARM7TDMI_READ_FLASH_PAGE:
 971   case JTAGARM7TDMI_MASS_ERASE_FLASH:
 972   case JTAGARM7TDMI_PROGRAM_FLASH:
 973   case JTAGARM7TDMI_LOCKCHIP:
 974   case JTAGARM7TDMI_CHIP_ERASE:
 975   */
 976 // Really ARM specific stuff
 977   case JTAGARM7TDMI_GET_CPSR:
 978         jtagarm7tdmi_resettap();
 979     cmddatalong[0] = jtagarm7tdmi_get_regCPSR();
 980     txdata(app,verb,4);
 981     break;
 982   case JTAGARM7TDMI_SET_CPSR:
 983         jtagarm7tdmi_resettap();
 984     cmddatalong[0] = jtagarm7tdmi_set_regCPSR(cmddatalong[0]);
 985     txdata(app,verb,4);
 986     break;
 987   case JTAGARM7TDMI_GET_SPSR:           // FIXME: NOT CORRECT
 988         jtagarm7tdmi_resettap();
 989     cmddatalong[0] = jtagarm7tdmi_get_regCPSR();
 990     txdata(app,verb,4);
 991     break;
 992   case JTAGARM7TDMI_SET_SPSR:           // FIXME: NOT CORRECT
 993         jtagarm7tdmi_resettap();
 994     cmddatalong[0] = jtagarm7tdmi_set_regCPSR(cmddatalong[0]);
 995     txdata(app,verb,4);
 996     break;
 997   case JTAGARM7TDMI_SET_MODE_THUMB:
 998   case JTAGARM7TDMI_SET_MODE_ARM:
 999         jtagarm7tdmi_resettap();
1000     cmddataword[0] = jtagarm7tdmi_setMode_ARM();
1001     txdata(app,verb,4);
1002     break;
1003
1004   case 0xD0:          // loopback test
1005     jtagarm7tdmi_resettap();
1006     cmddatalong[0] = jtagarm7tdmi_bypass(cmddatalong[0]);
1007     txdata(app,verb,4);
1008     break;
1009   case 0xD8:          // EICE_READ
1010     jtagarm7tdmi_resettap();
1011     cmddatalong[0] = eice_read(cmddatalong[0]);
1012     txdata(app,verb,4);
1013     break;
1014   case 0xD9:          // EICE_WRITE
1015     jtagarm7tdmi_resettap();
1016     cmddatalong[0] = eice_write(cmddatalong[0], cmddatalong[1]);
1017     txdata(app,verb,4);
1018     break;
1019   case 0xDA:          // TEST MSB THROUGH CHAIN0 and CHAIN1
1020     jtagarm7tdmi_resettap();
1021     jtagarm7tdmi_scan_intest(0);
1022     cmddatalong[0] = jtagarmtransn(0x41414141, 32, LSB, NOEND, NORETIDLE);
1023     cmddatalong[1] = jtagarmtransn(0x42424242, 32, MSB, NOEND, NORETIDLE);
1024     cmddatalong[2] = jtagarmtransn(0x43434343,  9, MSB, NOEND, NORETIDLE);
1025     cmddatalong[3] = jtagarmtransn(0x44444444, 32, MSB, NOEND, NORETIDLE);
1026     cmddatalong[4] = jtagarmtransn(cmddatalong[0], 32, LSB, NOEND, NORETIDLE);
1027     cmddatalong[5] = jtagarmtransn(cmddatalong[1], 32, MSB, NOEND, NORETIDLE);
1028     cmddatalong[6] = jtagarmtransn(cmddatalong[2],  9, MSB, NOEND, NORETIDLE);
1029     cmddatalong[7] = jtagarmtransn(cmddatalong[3], 32, MSB, END, RETIDLE);
1030     jtagarm7tdmi_resettap();
1031     jtagarm7tdmi_scan_intest(1);
1032     cmddatalong[8] = jtagarmtransn(0x41414141, 32, MSB, NOEND, NORETIDLE);
1033     cmddatalong[9] = jtagarmtransn(0x44444444,  1, MSB, NOEND, NORETIDLE);
1034     cmddatalong[10] = jtagarmtransn(cmddatalong[8], 32, MSB, NOEND, NORETIDLE);
1035     cmddatalong[11] = jtagarmtransn(cmddatalong[9],  1, MSB, END, RETIDLE);
1036     jtagarm7tdmi_resettap();
1037     txdata(app,verb,48);
1038     break;
1039
1040   default:
1041     jtaghandle(app,verb,len);
1042   }
1043 }
1044
1045
1046
1047
1048 /*****************************
1049 Captured from FlySwatter against AT91SAM7S, to be used by me for testing.  ignore
1050
1051 > arm reg
1052 System and User mode registers
1053       r0: 300000df       r1: 00000000       r2: 58000000       r3: 00200a75
1054       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1055       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1056      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 000000fc
1057     cpsr: 00000093
1058
1059 FIQ mode shadow registers
1060   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1061  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1062
1063 Supervisor mode shadow registers
1064   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1065
1066 Abort mode shadow registers
1067   sp_abt: 00000000   lr_abt: 00000000 spsr_abt: e00000ff
1068
1069 IRQ mode shadow registers
1070   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1071
1072 Undefined instruction mode shadow registers
1073   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1074 >
1075 > step;arm reg
1076 target state: halted
1077 target halted in ARM state due to single-step, current mode: Supervisor
1078 cpsr: 0x00000093 pc: 0x00000100
1079 System and User mode registers
1080       r0: 300000df       r1: 00000000       r2: 00200000       r3: 00200a75
1081       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1082       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1083      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000100
1084     cpsr: 00000093
1085
1086 FIQ mode shadow registers
1087   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1088  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1089
1090 Supervisor mode shadow registers
1091   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1092
1093 Abort mode shadow registers
1094   sp_abt: 00000000   lr_abt: 00000000 spsr_abt: e00000ff
1095
1096 IRQ mode shadow registers
1097   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1098
1099 Undefined instruction mode shadow registers
1100   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1101 >
1102  step;arm reg
1103 target state: halted
1104 target halted in ARM state due to single-step, current mode: Abort
1105 cpsr: 0x00000097 pc: 0x00000010
1106 System and User mode registers
1107       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1108       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1109       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1110      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1111     cpsr: 00000097
1112
1113 FIQ mode shadow registers
1114   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1115  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1116
1117 Supervisor mode shadow registers
1118   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1119
1120 Abort mode shadow registers
1121   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1122
1123 IRQ mode shadow registers
1124   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1125
1126 Undefined instruction mode shadow registers
1127   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1128 > step;arm reg
1129 target state: halted
1130 target halted in ARM state due to single-step, current mode: Abort
1131 cpsr: 0x00000097 pc: 0x00000010
1132 System and User mode registers
1133       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1134       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1135       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1136      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1137     cpsr: 00000097
1138
1139 FIQ mode shadow registers
1140   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1141  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1142
1143 Supervisor mode shadow registers
1144   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1145
1146 Abort mode shadow registers
1147   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1148
1149 IRQ mode shadow registers
1150   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1151
1152 Undefined instruction mode shadow registers
1153   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1154 > step;arm reg
1155 target state: halted
1156 target halted in ARM state due to single-step, current mode: Abort
1157 cpsr: 0x00000097 pc: 0x00000010
1158 System and User mode registers
1159       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1160       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1161       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1162      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1163     cpsr: 00000097
1164
1165 FIQ mode shadow registers
1166   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1167  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1168
1169 Supervisor mode shadow registers
1170   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1171
1172 Abort mode shadow registers
1173   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1174
1175 IRQ mode shadow registers
1176   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1177
1178 Undefined instruction mode shadow registers
1179   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1180 > step;arm reg
1181 target state: halted
1182 target halted in ARM state due to single-step, current mode: Abort
1183 cpsr: 0x00000097 pc: 0x00000010
1184 System and User mode registers
1185       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1186       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1187       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1188      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1189     cpsr: 00000097
1190
1191 FIQ mode shadow registers
1192   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1193  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1194
1195 Supervisor mode shadow registers
1196   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1197
1198 Abort mode shadow registers
1199   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1200
1201 IRQ mode shadow registers
1202   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1203
1204 Undefined instruction mode shadow registers
1205   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1206 > step;arm reg
1207 target state: halted
1208 target halted in ARM state due to single-step, current mode: Abort
1209 cpsr: 0x00000097 pc: 0x00000010
1210 System and User mode registers
1211       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1212       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1213       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1214      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1215     cpsr: 00000097
1216
1217 FIQ mode shadow registers
1218   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1219  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1220
1221 Supervisor mode shadow registers
1222   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1223
1224 Abort mode shadow registers
1225   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1226
1227 IRQ mode shadow registers
1228   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1229
1230 Undefined instruction mode shadow registers
1231   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1232 > step;arm reg
1233 target state: halted
1234 target halted in ARM state due to single-step, current mode: Abort
1235 cpsr: 0x00000097 pc: 0x00000010
1236 System and User mode registers
1237       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1238       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1239       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1240      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1241     cpsr: 00000097
1242
1243 FIQ mode shadow registers
1244   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1245  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1246
1247 Supervisor mode shadow registers
1248   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1249
1250 Abort mode shadow registers
1251   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1252
1253 IRQ mode shadow registers
1254   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1255
1256 Undefined instruction mode shadow registers
1257   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1258 > step;arm reg
1259 target state: halted
1260 target halted in ARM state due to single-step, current mode: Abort
1261 cpsr: 0x00000097 pc: 0x00000010
1262 System and User mode registers
1263       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1264       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1265       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1266      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1267     cpsr: 00000097
1268
1269 FIQ mode shadow registers
1270   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1271  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1272
1273 Supervisor mode shadow registers
1274   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1275
1276 Abort mode shadow registers
1277   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1278
1279 IRQ mode shadow registers
1280   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1281
1282 Undefined instruction mode shadow registers
1283   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1284 > step;arm reg
1285 target state: halted
1286 target halted in ARM state due to single-step, current mode: Abort
1287 cpsr: 0x00000097 pc: 0x00000010
1288 System and User mode registers
1289       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1290       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1291       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1292      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1293     cpsr: 00000097
1294
1295 FIQ mode shadow registers
1296   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1297  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1298
1299 Supervisor mode shadow registers
1300   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1301
1302 Abort mode shadow registers
1303   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1304
1305 IRQ mode shadow registers
1306   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1307
1308 Undefined instruction mode shadow registers
1309   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1310 > step;arm reg
1311 target state: halted
1312 target halted in ARM state due to single-step, current mode: Abort
1313 cpsr: 0x00000097 pc: 0x00000010
1314 System and User mode registers
1315       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1316       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1317       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1318      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1319     cpsr: 00000097
1320
1321 FIQ mode shadow registers
1322   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1323  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1324
1325 Supervisor mode shadow registers
1326   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1327
1328 Abort mode shadow registers
1329   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1330
1331 IRQ mode shadow registers
1332   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1333
1334 Undefined instruction mode shadow registers
1335   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1336 >
1337