git.rot13.org Git - goodfet/blob - firmware/apps/jtag/jtagarm7tdmi.c

   1 /*! \file jtagarm7tdmi.c
   2   \brief ARM7TDMI JTAG (AT91R40008)
   3 */
   4
   5 #include "platform.h"
   6 #include "command.h"
   7 #include "jtag.h"
   8 #include "jtagarm7tdmi.h"
   9
  10
  11 /**** 20-pin Connection Information (pin1 is on top-right for both connectors)****
  12 GoodFET  ->  7TDMI 20-pin connector (HE-10 connector)
  13   1               13 (TDO)
  14   2               1  (Vdd)
  15   3               5  (TDI)
  16   5               7  (TMS)
  17   7               9  (TCK)
  18   8               15 (nRST)
  19   9               4,6,8,10,12,14,16,18,20 (GND)
  20   11              17/3 (nTRST)  (different sources suggest 17 or 3 alternately)
  21 ********************************/
  22
  23 /**** 14-pin Connection Information (pin1 is on top-right for both connectors)****
  24 GoodFET  ->  7TDMI 14-pin connector
  25   1               11 (TDO)
  26   2               1  (Vdd)
  27   3               5  (TDI)
  28   5               7  (TMS)
  29   7               9  (TCK)
  30   8               12 (nRST)
  31   9               2,4,6,8,10,14 (GND)
  32   11              3 (nTRST)
  33
  34 http://hri.sourceforge.net/tools/jtag_faq_org.html
  35 ********************************/
  36
  37
  38
  39
  40
  41
  42 /****************************************************************
  43 Enabling jtag likely differs with most platforms.  We will attempt to enable most from here.  Override jtagarm7tdmi_start() to extend for other implementations
  44 ARM7TDMI enables three different scan chains:
  45     * Chain0 - "entire periphery" including data bus
  46     * Chain1 - core data bus (subset of Chain0)  - Instruction Pipeline
  47     * Chain2 - EmbeddedICE Logic Registers - This is our way into the fun stuff.
  48
  49
  50 ---
  51 You can disable EmbeddedICE-RT by setting the DBGEN input LOW.
  52 Caution
  53 Hard wiring the DBGEN input LOW permanently disables all debug functionality.
  54 When DBGEN is LOW, it inhibits DBGDEWPT, DBGIEBKPT, and EDBGRQ to
  55 the core, and DBGACK from the ARM9E-S core is always LOW.
  56 ---
  57
  58
  59 ---
  60 When the ARM9E-S core is in debug state, you can examine the core and system state
  61 by forcing the load and store multiples into the instruction pipeline.
  62 Before you can examine the core and system state, the debugger must determine
  63 whether the processor entered debug from Thumb state or ARM state, by examining
  64 bit 4 of the EmbeddedICE-RT debug status register. If bit 4 is HIGH, the core has
  65 entered debug from Thumb state.
  66 For more details about determining the core state, see Determining the core and system
  67 state on page B-18.
  68 ---
  69
  70
  71 --- olimex - http://www.olimex.com/dev/pdf/arm-jtag.pdf
  72 JTAG signals description:
  73 PIN.1 (VTREF) Target voltage sense. Used to indicate the target’s operating voltage to thedebug tool.
  74 PIN.2 (VTARGET) Target voltage. May be used to supply power to the debug tool.
  75 PIN.3 (nTRST) JTAG TAP reset, this signal should be pulled up to Vcc in target board.
  76 PIN4,6, 8, 10,12,14,16,18,20 Ground. The Gnd-Signal-Gnd-Signal strategy implemented on the 20-way connection scheme improves noiseimmunity on the target connect cable.
  77 *PIN.5 (TDI) JTAG serial data in, should be pulled up to Vcc on target board.
  78 *PIN.7 (TMS) JTAG TAP Mode Select, should be pulled up to Vcc on target board.
  79 *PIN.9 (TCK) JTAG clock.
  80 PIN.11 (RTCK) JTAG retimed clock.Implemented on certain ASIC ARM implementations the host ASIC may need to synchronize external inputs (such as JTAG inputs) with its own internal clock.
  81 *PIN.13 (TDO) JTAG serial data out.
  82 *PIN.15 (nSRST) Target system reset.
  83 *PIN.17 (DBGRQ) Asynchronous debug request.  DBGRQ allows an external signal to force the ARM core into debug mode, should be pull down to GND.
  84 PIN.19 (DBGACK) Debug acknowledge. The ARM core acknowledges debug-mode inresponse to a DBGRQ input.
  85
  86
  87 -----------  SAMPLE TIMES  -----------
  88
  89 TDI and TMS are sampled on the rising edge of TCK and TDO transitions appear on the falling edge of TCK. Therefore, TDI and TMS must be written after the falling edge of TCK and TDO must be read after the rising edge of TCK.
  90
  91 for this module, we keep tck high for all changes/sampling, and then bounce it.
  92 ****************************************************************/
  93
  94
  95
  96 /************************** JTAGARM7TDMI Primitives ****************************/
  97 void jtag_goto_shift_ir() {
  98   SETTMS;
  99   jtag_arm_tcktock();
 100   jtag_arm_tcktock();
 101   CLRTMS;
 102   jtag_arm_tcktock();
 103   jtag_arm_tcktock();
 104
 105 }
 106
 107 void jtag_goto_shift_dr() {
 108   SETTMS;
 109   jtag_arm_tcktock();
 110   CLRTMS;
 111   jtag_arm_tcktock();
 112   jtag_arm_tcktock();
 113 }
 114
 115 void jtag_reset_to_runtest_idle() {
 116   SETTMS;
 117   jtag_arm_tcktock();
 118   jtag_arm_tcktock();
 119   jtag_arm_tcktock();
 120   jtag_arm_tcktock();
 121   jtag_arm_tcktock();
 122   jtag_arm_tcktock();
 123   jtag_arm_tcktock();
 124   jtag_arm_tcktock();  // now in Reset state
 125   CLRTMS;
 126   jtag_arm_tcktock();  // now in Run-Test/Idle state
 127 }
 128
 129 void jtag_arm_tcktock() {
 130   delay(1);
 131   CLRTCK;
 132   PLEDOUT^=PLEDPIN;
 133   delay(1);
 134   SETTCK;
 135   PLEDOUT^=PLEDPIN;
 136 }
 137
 138
 139 // ! Start JTAG, setup pins, reset TAP and return IDCODE
 140 unsigned long jtagarm7tdmi_start() {
 141   jtagsetup();
 142   //Known-good starting position.
 143   //Might be unnecessary.
 144   //SETTST;
 145   //SETRST;
 146
 147   //delay(0x2);
 148
 149   //CLRRST;
 150   //delay(2);
 151   //CLRTST;
 152
 153   //msdelay(10);
 154   //SETRST;
 155   /*
 156   P5DIR &=~RST;
 157   */
 158   //delay(0x2);
 159   jtagarm7tdmi_resettap();
 160   return jtagarm7tdmi_idcode();
 161 }
 162
 163
 164 //! Reset TAP State Machine
 165 void jtagarm7tdmi_resettap(){               // PROVEN
 166   current_chain = -1;
 167   jtag_reset_to_runtest_idle();
 168 }
 169
 170
 171 //  NOTE: important: THIS MODULE REVOLVES AROUND RETURNING TO RUNTEST/IDLE, OR THE FUNCTIONAL EQUIVALENT
 172
 173
 174 //! Shift N bits over TDI/TDO.  May choose LSB or MSB, and select whether to terminate (TMS-high on last bit) and whether to return to RUNTEST/IDLE
 175 unsigned long jtagarmtransn(unsigned long word, unsigned char bitcount, unsigned char lsb, unsigned char end, unsigned char retidle){               // PROVEN
 176   unsigned int bit;
 177   unsigned long high = 1;
 178   unsigned long mask;
 179
 180   for (bit=(bitcount-1)/8; bit>0; bit--)
 181     high <<= 8;
 182   high <<= ((bitcount-1)%8);
 183
 184   mask = high-1;
 185
 186   if (lsb) {
 187     for (bit = bitcount; bit > 0; bit--) {
 188       /* write MOSI on trailing edge of previous clock */
 189       if (word & 1)
 190         {SETMOSI;}
 191       else
 192         {CLRMOSI;}
 193       word >>= 1;
 194
 195       if (bit==1 && end)
 196         SETTMS;//TMS high on last bit to exit.
 197
 198       jtag_arm_tcktock();
 199
 200       /* read MISO on trailing edge */
 201       if (READMISO){
 202         word += (high);
 203       }
 204     }
 205   } else {
 206     for (bit = bitcount; bit > 0; bit--) {
 207       /* write MOSI on trailing edge of previous clock */
 208       if (word & high)
 209         {SETMOSI;}
 210       else
 211         {CLRMOSI;}
 212       word = (word & mask) << 1;
 213
 214       if (bit==1 && end)
 215         SETTMS;//TMS high on last bit to exit.
 216
 217       jtag_arm_tcktock();
 218
 219       /* read MISO on trailing edge */
 220       word |= (READMISO);
 221     }
 222   }
 223
 224
 225   SETMOSI;
 226
 227   if (end){
 228     // exit state
 229     jtag_arm_tcktock();
 230     // update state
 231     if (retidle){
 232       CLRTMS;
 233       jtag_arm_tcktock();
 234     }
 235   }
 236   return word;
 237 }
 238
 239
 240
 241 /************************************************************************
 242 * ARM7TDMI core has 6 primary registers to be connected between TDI/TDO
 243 *   * Bypass Register
 244 *   * ID Code Register
 245 *   * Scan Chain Select Register    (4 bits_lsb)
 246 *   * Scan Chain 0                  (64+* bits: 32_databits_lsb + ctrlbits + 32_addrbits_msb)
 247 *   * Scan Chain 1                  (33 bits: 32_bits + BREAKPT)
 248 *   * Scan Chain 2                  (38 bits: rw + 5_regbits_msb + 32_databits_msb)
 249 ************************************************************************/
 250
 251
 252
 253 /************************** Basic JTAG Verb Commands *******************************/
 254 //! Grab the core ID.
 255 unsigned long jtagarm7tdmi_idcode(){               // PROVEN
 256   jtagarm7tdmi_resettap();
 257   SHIFT_IR;
 258   jtagarmtransn(ARM7TDMI_IR_IDCODE, 4, LSB, END, RETIDLE);
 259   SHIFT_DR;
 260   return jtagarmtransn(0,32, LSB, END, RETIDLE);
 261 }
 262
 263 //!  Connect Bypass Register to TDO/TDI
 264 unsigned char jtagarm7tdmi_bypass(){               // PROVEN
 265   jtagarm7tdmi_resettap();
 266   SHIFT_IR;
 267   return jtagarmtransn(ARM7TDMI_IR_BYPASS, 4, LSB, END, NORETIDLE);
 268 }
 269 //!  INTEST verb - do internal test
 270 unsigned char jtagarm7tdmi_intest() {
 271   SHIFT_IR;
 272   return jtagarmtransn(ARM7TDMI_IR_INTEST, 4, LSB, END, NORETIDLE);
 273 }
 274
 275 //!  EXTEST verb
 276 unsigned char jtagarm7tdmi_extest() {
 277   SHIFT_IR;
 278   return jtagarmtransn(ARM7TDMI_IR_EXTEST, 4, LSB, END, NORETIDLE);
 279 }
 280
 281 //!  SAMPLE verb
 282 //unsigned long jtagarm7tdmi_sample() {
 283 //  jtagarm7tdmi_ir_shift4(ARM7TDMI_IR_SAMPLE);        // ???? same here.
 284 //  return jtagtransn(0,32);
 285 //}
 286
 287 //!  RESTART verb
 288 unsigned char jtagarm7tdmi_restart() {
 289   jtagarm7tdmi_resettap();
 290   SHIFT_IR;
 291   return jtagarmtransn(ARM7TDMI_IR_RESTART, 4, LSB, END, RETIDLE);
 292 }
 293
 294 //!  ARM7TDMI_IR_CLAMP               0x5
 295 //unsigned long jtagarm7tdmi_clamp() {
 296 //  jtagarm7tdmi_resettap();
 297 //  SHIFT_IR;
 298 //  jtagarmtransn(ARM7TDMI_IR_CLAMP, 4, LSB, END, NORETIDLE);
 299 //  SHIFT_DR;
 300 //  return jtagarmtransn(0, 32, LSB, END, RETIDLE);
 301 //}
 302
 303 //!  ARM7TDMI_IR_HIGHZ               0x7
 304 //unsigned char jtagarm7tdmi_highz() {
 305 //  jtagarm7tdmi_resettap();
 306 //  SHIFT_IR;
 307 //  return jtagarmtransn(ARM7TDMI_IR_HIGHZ, 4, LSB, END, NORETIDLE);
 308 //}
 309
 310 //! define ARM7TDMI_IR_CLAMPZ              0x9
 311 //unsigned char jtagarm7tdmi_clampz() {
 312 //  jtagarm7tdmi_resettap();
 313 //  SHIFT_IR;
 314 //  return jtagarmtransn(ARM7TDMI_IR_CLAMPZ, 4, LSB, END, NORETIDLE);
 315 //}
 316
 317
 318 //!  Connect the appropriate scan chain to TDO/TDI.  SCAN_N, INTEST, ENDS IN SHIFT_DR!!!!!
 319 unsigned long jtagarm7tdmi_scan(int chain, int testmode) {               // PROVEN
 320 /*
 321 When selecting a scan chain the “Run Test/Idle” state should never be reached, other-
 322 wise, when in debug state, the core will not be correctly isolated and intrusive
 323 commands occur. Therefore, it is recommended to pass directly from the “Update”
 324 state” to the “Select DR” state each time the “Update” state is reached.
 325 */
 326   unsigned long retval;
 327   if (current_chain != chain) {
 328     debugstr("===change chains===");
 329     SHIFT_IR;
 330     jtagarmtransn(ARM7TDMI_IR_SCAN_N, 4, LSB, END, NORETIDLE);
 331     SHIFT_DR;
 332     retval = jtagarmtransn(chain, 4, LSB, END, NORETIDLE);
 333     current_chain = chain;
 334   }    else
 335     debugstr("===NOT change chains===");
 336     retval = current_chain;
 337   // put in test mode...
 338   SHIFT_IR;
 339   jtagarmtransn(testmode, 4, LSB, END, RETIDLE);
 340   return(retval);
 341 }
 342
 343
 344 //!  Connect the appropriate scan chain to TDO/TDI.  SCAN_N, INTEST, ENDS IN SHIFT_DR!!!!!
 345 unsigned long jtagarm7tdmi_scan_intest(int chain) {               // PROVEN
 346   return jtagarm7tdmi_scan(chain, ARM7TDMI_IR_INTEST);
 347 }
 348
 349
 350
 351
 352 //! push an instruction into the pipeline
 353 unsigned long jtagarm7tdmi_instr_primitive(unsigned long instr, char breakpt){  // PROVEN
 354   unsigned long retval;
 355   jtagarm7tdmi_scan_intest(1);
 356
 357   SHIFT_DR;
 358   // if the next instruction is to run using MCLK (master clock), set TDI
 359   if (breakpt)
 360     {
 361     SETMOSI;
 362     count_sysspd_instr_since_debug++;
 363     }
 364   else
 365     {
 366     CLRMOSI;
 367     count_dbgspd_instr_since_debug++;
 368     }
 369   jtag_arm_tcktock();
 370
 371   // Now shift in the 32 bits
 372   retval = jtagarmtransn(instr, 32, MSB, END, RETIDLE);    // Must return to RUN-TEST/IDLE state for instruction to enter pipeline, and causes debug clock.
 373   return(retval);
 374
 375 }
 376
 377 //! push NOP into the instruction pipeline
 378 unsigned long jtagarm7tdmi_nop(char breakpt){  // PROVEN
 379   return jtagarm7tdmi_instr_primitive(ARM_INSTR_NOP, breakpt);
 380 }
 381
 382 /*    stolen from ARM DDI0029G documentation, translated using ARM Architecture Reference Manual (14128.pdf)
 383 STR R0, [R0]; Save R0 before use
 384 MOV R0, PC ; Copy PC into R0
 385 STR R0, [R0]; Now save the PC in R0
 386 BX PC ; Jump into ARM state
 387 MOV R8, R8 ;
 388 MOV R8, R8 ;
 389 NOP
 390 NOP
 391
 392 */
 393
 394 //! set the current mode to ARM, returns PC (FIXME).  Should be used by haltcpu(), which should also store PC and the THUMB state, for use by releasecpu();
 395 unsigned long jtagarm7tdmi_setMode_ARM(){               // PROVEN
 396   debugstr("=== Thumb Mode... Switching to ARM mode ===");
 397   unsigned long retval = 0xff;
 398   while ((jtagarm7tdmi_get_dbgstate() & JTAG_ARM7TDMI_DBG_TBIT)&& retval-- > 0){
 399     cmddataword[6] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_NOP,0);
 400     cmddataword[1] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_STR_R0_r0,0);
 401     cmddataword[2] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_MOV_R0_PC,0);
 402     cmddataword[3] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_STR_R0_r0,0);
 403     cmddataword[4] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_BX_PC,0);
 404     cmddataword[5] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_NOP,0);
 405     cmddataword[6] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_NOP,0);
 406     jtagarm7tdmi_resettap();                  // seems necessary for some reason.  ugh.
 407   }
 408   return(retval);
 409 }
 410
 411
 412
 413
 414 /************************* EmbeddedICE Primitives ****************************/
 415 //! shifter for writing to chain2 (EmbeddedICE).
 416 unsigned long eice_write(unsigned char reg, unsigned long data){
 417   unsigned long retval, temp;
 418   debugstr("eice_write");
 419   debughex(reg);
 420   debughex32(data);
 421   jtagarm7tdmi_scan_intest(2);
 422   // Now shift in the 32 bits
 423   SHIFT_DR;
 424   retval = jtagarmtransn(data, 32, LSB, NOEND, NORETIDLE);          // send in the data - 32-bits lsb
 425   temp = jtagarmtransn(reg, 5, LSB, NOEND, NORETIDLE);              // send in the register address - 5 bits lsb
 426   jtagarmtransn(1, 1, LSB, END, RETIDLE);                           // send in the WRITE bit
 427
 428   //SETTMS;   // Last Bit - Exit UPDATE_DR
 429   //// is this update a read/write or just read?
 430   //SETMOSI;
 431   //jtag_arm_tcktock();
 432
 433   return(retval);
 434 }
 435
 436 //! shifter for reading from chain2 (EmbeddedICE).
 437 unsigned long eice_read(unsigned char reg){               // PROVEN
 438   unsigned long temp, retval;
 439   debugstr("eice_read");
 440   debughex(reg);
 441   jtagarm7tdmi_scan_intest(2);
 442
 443   // send in the register address - 5 bits LSB
 444   SHIFT_DR;
 445   temp = jtagarmtransn(reg, 5, LSB, NOEND, NORETIDLE);
 446
 447   // clear TDI to select "read only"
 448   jtagarmtransn(0, 1, LSB, END, RETIDLE);
 449
 450   SHIFT_DR;
 451   // Now shift out the 32 bits
 452   retval = jtagarmtransn(0, 32, LSB, END, RETIDLE);   // atmel arm jtag docs pp.10-11: LSB first
 453   debughex32(retval);
 454   return(retval);   // atmel arm jtag docs pp.10-11: LSB first
 455
 456 }
 457
 458
 459
 460
 461 /************************* ICEBreaker/EmbeddedICE Stuff ******************************/
 462 //! Grab debug register
 463 unsigned long jtagarm7tdmi_get_dbgstate() {       // ICE Debug register, *NOT* ARM register DSCR    //    PROVEN
 464   //jtagarm7tdmi_resettap();
 465   return eice_read(EICE_DBGSTATUS);
 466 }
 467
 468 //! Grab debug register
 469 unsigned long jtagarm7tdmi_get_dbgctrl() {
 470   return eice_read(EICE_DBGCTRL);
 471 }
 472
 473 //! Update debug register
 474 unsigned long jtagarm7tdmi_set_dbgctrl(unsigned long bits) {
 475   return eice_write(EICE_DBGCTRL, bits);
 476 }
 477
 478
 479
 480 //!  Set and Enable Watchpoint 0
 481 void jtagarm7tdmi_set_watchpoint0(unsigned long addr, unsigned long addrmask, unsigned long data, unsigned long datamask, unsigned long ctrl, unsigned long ctrlmask){
 482   // store watchpoint info?  - not right now
 483     // FIXME: store info
 484
 485   eice_write(EICE_WP0ADDR, addr);           // write 0 in watchpoint 0 address
 486   eice_write(EICE_WP0ADDRMASK, addrmask);   // write 0xffffffff in watchpoint 0 address mask
 487   eice_write(EICE_WP0DATA, data);           // write 0 in watchpoint 0 data
 488   eice_write(EICE_WP0DATAMASK, datamask);   // write 0xffffffff in watchpoint 0 data mask
 489   eice_write(EICE_WP0CTRL, ctrlmask);       // write 0x00000100 in watchpoint 0 control value register (enables watchpoint)
 490   eice_write(EICE_WP0CTRLMASK, ctrlmask);   // write 0xfffffff7 in watchpoint 0 control mask - only detect the fetch instruction
 491 }
 492
 493 //!  Set and Enable Watchpoint 1
 494 void jtagarm7tdmi_set_watchpoint1(unsigned long addr, unsigned long addrmask, unsigned long data, unsigned long datamask, unsigned long ctrl, unsigned long ctrlmask){
 495   // store watchpoint info?  - not right now
 496     // FIXME: store info
 497
 498   eice_write(EICE_WP1ADDR, addr);           // write 0 in watchpoint 1 address
 499   eice_write(EICE_WP1ADDRMASK, addrmask);   // write 0xffffffff in watchpoint 1 address mask
 500   eice_write(EICE_WP1DATA, data);           // write 0 in watchpoint 1 data
 501   eice_write(EICE_WP1DATAMASK, datamask);   // write 0xffffffff in watchpoint 1 data mask
 502   eice_write(EICE_WP1CTRL, ctrl);           // write 0x00000100 in watchpoint 1 control value register (enables watchpoint)
 503   eice_write(EICE_WP1CTRLMASK, ctrlmask);   // write 0xfffffff7 in watchpoint 1 control mask - only detect the fetch instruction
 504 }
 505
 506 //!  Disable Watchpoint 0
 507 void jtagarm7tdmi_disable_watchpoint0(){
 508   eice_write(EICE_WP0CTRL, 0x0); // write 0 in watchpoint 0 control value - disables watchpoint 0
 509 }
 510
 511 //!  Disable Watchpoint 1
 512 void jtagarm7tdmi_disable_watchpoint1(){
 513   eice_write(EICE_WP1CTRL, 0x0);            // write 0 in watchpoint 0 control value - disables watchpoint 0
 514 }
 515
 516
 517
 518 /******************** Complex Commands **************************/
 519
 520 //! Push an instruction into the CPU pipeline
 521 //  NOTE!  Must provide EXECNOPARM for parameter if no parm is required.
 522 unsigned long jtagarm7tdmi_exec(unsigned long instr, unsigned long parameter, unsigned char systemspeed) {
 523   unsigned long retval;
 524
 525   debughex32(jtagarm7tdmi_nop( 0));
 526   debughex32(jtagarm7tdmi_nop(systemspeed));
 527   debughex32(jtagarm7tdmi_instr_primitive(instr, 0));      // write 32-bit instruction code into DR
 528   debughex32(jtagarm7tdmi_nop( 0));
 529   debughex32(jtagarm7tdmi_nop( 0));
 530   debughex32(jtagarm7tdmi_instr_primitive(parameter, 0));  // inject long
 531   retval = jtagarm7tdmi_nop( 0);
 532   debughex32(retval);
 533   debughex32(jtagarm7tdmi_nop( 0));
 534   debughex32(jtagarm7tdmi_nop( 0));
 535
 536   return(retval);
 537 }
 538
 539 //! Retrieve a 32-bit Register value
 540 unsigned long jtagarm7tdmi_get_register(unsigned long reg) {
 541   unsigned long retval = 0, instr;
 542   // push nop into pipeline - clean out the pipeline...
 543   instr = (unsigned long)(reg<<12) | (unsigned long)ARM_READ_REG;   // STR Rx, [R14]
 544   //instr = (unsigned long)(((unsigned long)reg<<12) | ARM_READ_REG);
 545   //debugstr("Reading:");
 546   //debughex32(instr);
 547
 548   jtagarm7tdmi_nop( 0);
 549   jtagarm7tdmi_instr_primitive(instr, 0);
 550   jtagarm7tdmi_nop( 0);                // push nop into pipeline - fetched
 551   jtagarm7tdmi_nop( 0);                // push nop into pipeline - decoded
 552   jtagarm7tdmi_nop( 0);                // push nop into pipeline - executed
 553   retval = jtagarm7tdmi_nop( 0);                        // recover 32-bit word
 554   debughex32(retval);
 555   jtagarm7tdmi_nop( 0);
 556   jtagarm7tdmi_nop( 0);
 557   jtagarm7tdmi_nop( 0);
 558   return retval;
 559 }
 560
 561 //! Set a 32-bit Register value
 562 void jtagarm7tdmi_set_register(unsigned long reg, unsigned long val) {
 563   unsigned long instr;
 564   instr = (unsigned long)(((unsigned long)reg<<12) | ARM_WRITE_REG); //  LDR Rx, [R14]
 565   debugstr("Writing:");
 566   debughex32(instr);
 567   //debughex32(val);
 568   jtagarm7tdmi_nop( 0);            // push nop into pipeline - clean out the pipeline...
 569   jtagarm7tdmi_instr_primitive(instr, 0); // push instr into pipeline - fetch
 570   jtagarm7tdmi_nop( 0);            // push nop into pipeline - decode
 571   jtagarm7tdmi_nop( 0);            // push nop into pipeline - execute
 572
 573   //debughex32(jtagarm7tdmi_instr_primitive(val, 0)); // push 32-bit word on data bus
 574   jtagarm7tdmi_instr_primitive(val, 0); // push 32-bit word on data bus
 575   jtagarm7tdmi_instr_primitive(val, 0); // push 32-bit word on data bus
 576   jtagarm7tdmi_nop( 0);            // push nop into pipeline - executed
 577
 578   //if (reg == ARM_REG_PC){
 579     jtagarm7tdmi_nop( 0);
 580     jtagarm7tdmi_nop( 0);
 581   //}
 582   jtagarm7tdmi_nop( 0);
 583 }
 584
 585
 586
 587 //! Get all registers, placing them into cmddatalong[0-15]
 588 void jtagarm7tdmi_get_registers() {
 589   debughex32(ARM_INSTR_SKANKREGS1);
 590   debughex32(jtagarm7tdmi_nop( 0));
 591   debughex32(jtagarm7tdmi_instr_primitive(ARM_INSTR_SKANKREGS1,0));
 592   debughex32(jtagarm7tdmi_nop( 0));
 593   debughex32(jtagarm7tdmi_nop( 0));
 594   cmddatalong[ 0] = jtagarm7tdmi_nop( 0);
 595   cmddatalong[ 1] = jtagarm7tdmi_nop( 0);
 596   cmddatalong[ 2] = jtagarm7tdmi_nop( 0);
 597   cmddatalong[ 3] = jtagarm7tdmi_nop( 0);
 598   cmddatalong[ 4] = jtagarm7tdmi_nop( 0);
 599   cmddatalong[ 5] = jtagarm7tdmi_nop( 0);
 600   cmddatalong[ 6] = jtagarm7tdmi_nop( 0);
 601   cmddatalong[ 7] = jtagarm7tdmi_nop( 0);
 602   debughex32(ARM_INSTR_SKANKREGS2);
 603   debughex32(jtagarm7tdmi_nop( 0));
 604   //jtagarm7tdmi_nop( 0);
 605   debughex32(jtagarm7tdmi_instr_primitive(ARM_INSTR_SKANKREGS2,0));
 606   debughex32(jtagarm7tdmi_nop( 0));
 607   debughex32(jtagarm7tdmi_nop( 0));
 608   //jtagarm7tdmi_nop( 0);
 609   //jtagarm7tdmi_nop( 0);
 610   cmddatalong[ 8] = jtagarm7tdmi_nop( 0);
 611   cmddatalong[ 9] = jtagarm7tdmi_nop( 0);
 612   cmddatalong[10] = jtagarm7tdmi_nop( 0);
 613   cmddatalong[11] = jtagarm7tdmi_nop( 0);
 614   cmddatalong[12] = jtagarm7tdmi_nop( 0);
 615   cmddatalong[13] = jtagarm7tdmi_nop( 0);
 616   cmddatalong[14] = jtagarm7tdmi_nop( 0);
 617   cmddatalong[15] = jtagarm7tdmi_nop( 0);
 618   jtagarm7tdmi_nop( 0);
 619 }
 620
 621 //! Set all registers from cmddatalong[0-15]
 622 void jtagarm7tdmi_set_registers() {   //FIXME: BORKEN... TOTALLY TRYING TO BUY A VOWEL
 623   debughex32(ARM_INSTR_CLOBBEREGS);
 624   jtagarm7tdmi_nop( 0);
 625   debughex32(jtagarm7tdmi_instr_primitive(ARM_INSTR_CLOBBEREGS,0));
 626   jtagarm7tdmi_nop( 0);
 627   jtagarm7tdmi_nop( 0);
 628   debughex32(jtagarm7tdmi_instr_primitive(0x40,0));
 629   debughex32(jtagarm7tdmi_instr_primitive(0x41,0));
 630   debughex32(jtagarm7tdmi_instr_primitive(0x42,0));
 631   debughex32(jtagarm7tdmi_instr_primitive(0x43,0));
 632   debughex32(jtagarm7tdmi_instr_primitive(0x44,0));
 633   debughex32(jtagarm7tdmi_instr_primitive(0x45,0));
 634   debughex32(jtagarm7tdmi_instr_primitive(0x46,0));
 635   debughex32(jtagarm7tdmi_instr_primitive(0x47,0));
 636   debughex32(jtagarm7tdmi_instr_primitive(0x48,0));
 637   debughex32(jtagarm7tdmi_instr_primitive(0x49,0));
 638   debughex32(jtagarm7tdmi_instr_primitive(0x4a,0));
 639   debughex32(jtagarm7tdmi_instr_primitive(0x4b,0));
 640   debughex32(jtagarm7tdmi_instr_primitive(0x4c,0));
 641   debughex32(jtagarm7tdmi_instr_primitive(0x4d,0));
 642   debughex32(jtagarm7tdmi_instr_primitive(0x4e,0));
 643   debughex32(jtagarm7tdmi_instr_primitive(0x4f,0));
 644 }
 645
 646 //! Retrieve the CPSR Register value
 647 unsigned long jtagarm7tdmi_get_regCPSR() {
 648   unsigned long retval = 0;
 649
 650   debughex32(jtagarm7tdmi_nop( 0)); // push nop into pipeline - clean out the pipeline...
 651   debughex32(jtagarm7tdmi_instr_primitive(ARM_INSTR_MRS_R0_CPSR, 0)); // push MRS_R0, CPSR into pipeline
 652   debughex32(jtagarm7tdmi_nop( 0)); // push nop into pipeline - fetched
 653   debughex32(jtagarm7tdmi_nop( 0)); // push nop into pipeline - decoded
 654   debughex32(jtagarm7tdmi_nop( 0)); // push nop into pipeline - executed
 655   retval = jtagarm7tdmi_nop( 0);        // recover 32-bit word
 656   debughex32(retval);
 657   return retval;
 658 }
 659
 660 //! Retrieve the CPSR Register value
 661 unsigned long jtagarm7tdmi_set_regCPSR(unsigned long val) {
 662   unsigned long retval = 0;
 663
 664   debughex32(jtagarm7tdmi_nop( 0));        // push nop into pipeline - clean out the pipeline...
 665   debughex32(jtagarm7tdmi_instr_primitive(ARM_INSTR_MSR_cpsr_cxsf_R0, 0)); // push MSR cpsr_cxsf, R0 into pipeline
 666   debughex32(jtagarm7tdmi_nop( 0));        // push nop into pipeline - fetched
 667   debughex32(jtagarm7tdmi_nop( 0));        // push nop into pipeline - decoded
 668
 669   retval = jtagarm7tdmi_instr_primitive(val, 0);// push 32-bit word on data bus
 670   debughex32(jtagarm7tdmi_nop( 0));        // push nop into pipeline - executed
 671   debughex32(retval);
 672   return(retval);
 673 }
 674
 675 //! Write data to address - Assume TAP in run-test/idle state
 676 unsigned long jtagarm7tdmi_writemem(unsigned long adr, unsigned long data){
 677   unsigned long r0=0, r1=-1;
 678
 679   r0 = jtagarm7tdmi_get_register(0);        // store R0 and R1
 680   r1 = jtagarm7tdmi_get_register(1);
 681   jtagarm7tdmi_set_register(0, adr);        // write address into R0
 682   jtagarm7tdmi_set_register(1, data);       // write data in R1
 683   jtagarm7tdmi_nop( 0);                     // push nop into pipeline to "clean" it ???
 684   jtagarm7tdmi_nop( 1);                     // push nop into pipeline with BREAKPT set
 685   jtagarm7tdmi_instr_primitive(ARM_INSTR_LDR_R1_r0_4, 0); // push LDR R1, R0, #4 into instruction pipeline
 686   jtagarm7tdmi_nop( 0);                     // push nop into pipeline
 687   jtagarm7tdmi_set_register(1, r1);         // restore R0 and R1
 688   jtagarm7tdmi_set_register(0, r0);
 689   return(-1);
 690 }
 691
 692
 693
 694
 695 //! Read data from address
 696 unsigned long jtagarm7tdmi_readmem(unsigned long adr){
 697   unsigned long retval = 0;
 698   unsigned long r0=0, r1=-1;
 699   int waitcount = 0xfff;
 700
 701   r0 = jtagarm7tdmi_get_register(0);        // store R0 and R1
 702   r1 = jtagarm7tdmi_get_register(1);
 703   jtagarm7tdmi_set_register(0, adr);        // write address into R0
 704   jtagarm7tdmi_nop( 0);                     // push nop into pipeline to "clean" it ???
 705   jtagarm7tdmi_nop( 1);                     // push nop into pipeline with BREAKPT set
 706   jtagarm7tdmi_instr_primitive(ARM_INSTR_LDR_R1_r0_4, 0); // push LDR R1, R0, #4 into instruction pipeline
 707   jtagarm7tdmi_nop( 0);                     // push nop into pipeline
 708   jtagarm7tdmi_restart();                   // SHIFT_IR with RESTART instruction
 709
 710   // Poll the Debug Status Register for DBGACK and nMREQ to be HIGH
 711   while ((jtagarm7tdmi_get_dbgstate() & 9) == 0  && waitcount > 0){
 712     delay(1);
 713     waitcount --;
 714   }
 715   if (waitcount == 0){
 716     return (-1);
 717   } else {
 718     retval = jtagarm7tdmi_get_register(1);  // read memory value from R1 register
 719     jtagarm7tdmi_set_register(1, r1);         // restore R0 and R1
 720     jtagarm7tdmi_set_register(0, r0);
 721   }
 722   return retval;
 723 }
 724
 725
 726 //! Read Program Counter
 727 unsigned long jtagarm7tdmi_getpc(){
 728   return jtagarm7tdmi_get_register(ARM_REG_PC);
 729 }
 730
 731 //! Set Program Counter
 732 void jtagarm7tdmi_setpc(unsigned long adr){
 733   jtagarm7tdmi_set_register(ARM_REG_PC, adr);
 734 }
 735
 736 //! Halt CPU - returns 0xffff if the operation fails to complete within
 737 unsigned long jtagarm7tdmi_haltcpu(){                   //  PROVEN
 738   int waitcount = 0xfff;
 739
 740 /********  OLD WAY  ********/
 741   // store watchpoint info?  - not right now
 742   eice_write(EICE_WP1ADDR, 0);              // write 0 in watchpoint 1 address
 743   eice_write(EICE_WP1ADDRMASK, 0xffffffff); // write 0xffffffff in watchpoint 1 address mask
 744   eice_write(EICE_WP1DATA, 0);              // write 0 in watchpoint 1 data
 745   eice_write(EICE_WP1DATAMASK, 0xffffffff); // write 0xffffffff in watchpoint 1 data mask
 746   eice_write(EICE_WP1CTRL, 0x100);          // write 0x00000100 in watchpoint 1 control value register (enables watchpoint)
 747   eice_write(EICE_WP1CTRLMASK, 0xfffffff7); // write 0xfffffff7 in watchpoint 1 control mask - only detect the fetch instruction
 748 /***************************/
 749
 750 /********  NEW WAY  *********/
 751 //  eice_write(EICE_DBGCTRL, JTAG_ARM7TDMI_DBG_DBGRQ);  // r/o register?
 752 /****************************/
 753
 754   // poll until debug status says the cpu is in debug mode
 755   while (!(jtagarm7tdmi_get_dbgstate() & 0x1)   && waitcount-- > 0){
 756     delay(1);
 757   }
 758
 759 /********  OLD WAY  ********/
 760   eice_write(EICE_WP1CTRL, 0x0);            // write 0 in watchpoint 0 control value - disables watchpoint 0
 761 /***************************/
 762
 763 /********  NEW WAY  ********/
 764 //  eice_write(EICE_DBGCTRL, 0);        // r/o register?
 765 /***************************/
 766
 767   // store the debug state
 768   last_halt_debug_state = jtagarm7tdmi_get_dbgstate();
 769   last_halt_pc = jtagarm7tdmi_getpc() - 4;  // assume -4 for entering debug mode via watchpoint.
 770   count_dbgspd_instr_since_debug = 0;
 771   count_sysspd_instr_since_debug = 0;
 772
 773   // get into ARM mode if the T flag is set (Thumb mode)
 774   while (jtagarm7tdmi_get_dbgstate() & JTAG_ARM7TDMI_DBG_TBIT && waitcount-- > 0) {
 775     jtagarm7tdmi_setMode_ARM();
 776   }
 777   jtagarm7tdmi_resettap();
 778   return waitcount;
 779 }
 780
 781 unsigned long jtagarm7tdmi_releasecpu(){
 782   int waitcount = 0xfff;
 783   unsigned long instr;
 784   // somehow determine what PC should be (a couple ways possible, calculations required)
 785   jtagarm7tdmi_nop(0);                          // NOP
 786   jtagarm7tdmi_nop(1);                          // NOP/BREAKPT
 787
 788   if (last_halt_debug_state & JTAG_ARM7TDMI_DBG_TBIT){      // FIXME:  FORNICATED!  BX requires register, thus more instrs... could we get away with the same instruction but +1 to offset?
 789     instr = ARM_INSTR_B_PC + 0x1000001 - (count_dbgspd_instr_since_debug) - (count_sysspd_instr_since_debug*3);  //FIXME: make this right  - can't we just do an a7solute b/bx?
 790     jtagarm7tdmi_instr_primitive(instr,0);
 791   } else {
 792     instr = ARM_INSTR_B_PC + 0x1000000 - (count_dbgspd_instr_since_debug*4) - (count_sysspd_instr_since_debug*12);
 793     jtagarm7tdmi_instr_primitive(instr,0);
 794   }
 795
 796   SHIFT_IR;
 797   jtagarmtransn(ARM7TDMI_IR_RESTART,4,LSB,END,RETIDLE); // VERB_RESTART
 798
 799   // wait until restart-bit set in debug state register
 800   while ((jtagarm7tdmi_get_dbgstate() & JTAG_ARM7TDMI_DBG_DBGACK) && waitcount > 0){
 801     msdelay(1);
 802     waitcount --;
 803   }
 804   last_halt_debug_state = -1;
 805   last_halt_pc = -1;
 806   return 0;
 807 }
 808
 809
 810
 811
 812 ///////////////////////////////////////////////////////////////////////////////////////////////////
 813 //! Handles ARM7TDMI JTAG commands.  Forwards others to JTAG.
 814 void jtagarm7tdmihandle(unsigned char app, unsigned char verb, unsigned long len){
 815   register char blocks;
 816
 817   unsigned int i,val;
 818   unsigned long at;
 819
 820   jtagarm7tdmi_resettap();
 821
 822   switch(verb){
 823   case START:
 824     //Enter JTAG mode.
 825     debughex32(jtagarm7tdmi_start());
 826     debughex32(jtagarm7tdmi_haltcpu());
 827     //jtagarm7tdmi_resettap();
 828     debughex32(jtagarm7tdmi_get_dbgstate());
 829
 830     // DEBUG: FIXME: NOT PART OF OPERATIONAL CODE
 831     //for (mlop=2;mlop<4;mlop++){
 832     //  jtagarm7tdmi_set_register(mlop, 0x43424140);
 833     //}
 834     /////////////////////////////////////////////
 835     txdata(app,verb,0x4);
 836     break;
 837   case JTAGARM7TDMI_READMEM:
 838   case PEEK:
 839     blocks=(len>4?cmddata[4]:1);
 840     at=cmddatalong[0];
 841
 842     len=0x80;
 843     txhead(app,verb,len);
 844
 845     while(blocks--){
 846       for(i=0;i<len;i+=2){
 847         jtagarm7tdmi_resettap();
 848         delay(10);
 849
 850         val=jtagarm7tdmi_readmem(at);
 851
 852         at+=2;
 853         serial_tx(val&0xFF);
 854         serial_tx((val&0xFF00)>>8);
 855       }
 856     }
 857
 858     break;
 859   case JTAGARM7TDMI_GET_CHIP_ID:
 860         jtagarm7tdmi_resettap();
 861     cmddatalong[0] = jtagarm7tdmi_idcode();
 862     txdata(app,verb,4);
 863     break;
 864
 865
 866   case JTAGARM7TDMI_WRITEMEM:
 867   case POKE:
 868         jtagarm7tdmi_resettap();
 869     jtagarm7tdmi_writemem(cmddatalong[0],
 870                        cmddataword[2]);
 871     cmddataword[0]=jtagarm7tdmi_readmem(cmddatalong[0]);
 872     txdata(app,verb,2);
 873     break;
 874
 875   case JTAGARM7TDMI_HALTCPU:
 876     cmddatalong[0] = jtagarm7tdmi_haltcpu();
 877     txdata(app,verb,4);
 878     break;
 879   case JTAGARM7TDMI_RELEASECPU:
 880         jtagarm7tdmi_resettap();
 881     cmddatalong[0] = jtagarm7tdmi_releasecpu();
 882     txdata(app,verb,4);
 883     break;
 884   //unimplemented functions
 885   //case JTAGARM7TDMI_SETINSTRFETCH:
 886   //case JTAGARM7TDMI_WRITEFLASH:
 887   //case JTAGARM7TDMI_ERASEFLASH:
 888   case JTAGARM7TDMI_SET_PC:
 889     jtagarm7tdmi_setpc(cmddatalong[0]);
 890     txdata(app,verb,0);
 891     break;
 892   case JTAGARM7TDMI_GET_DEBUG_CTRL:
 893     cmddatalong[0] = jtagarm7tdmi_get_dbgctrl();
 894     txdata(app,verb,1);
 895     break;
 896   case JTAGARM7TDMI_SET_DEBUG_CTRL:
 897     cmddatalong[0] = jtagarm7tdmi_set_dbgctrl(cmddata[0]);
 898     txdata(app,verb,4);
 899     break;
 900   case JTAGARM7TDMI_GET_PC:
 901     cmddatalong[0] = jtagarm7tdmi_getpc();
 902     txdata(app,verb,4);
 903     break;
 904   case JTAGARM7TDMI_GET_DEBUG_STATE:
 905     //jtagarm7tdmi_resettap();            // Shouldn't need this, but currently do.  FIXME!
 906     cmddatalong[0] = jtagarm7tdmi_get_dbgstate();
 907     txdata(app,verb,4);
 908     break;
 909   //case JTAGARM7TDMI_GET_WATCHPOINT:
 910   //case JTAGARM7TDMI_SET_WATCHPOINT:
 911   case JTAGARM7TDMI_GET_REGISTER:
 912         jtagarm7tdmi_resettap();
 913     val = cmddata[0];
 914     cmddatalong[0] = jtagarm7tdmi_get_register(val);
 915     txdata(app,verb,4);
 916     break;
 917   case JTAGARM7TDMI_SET_REGISTER:           // FIXME: NOT AT ALL CORRECT, THIS IS TESTING CODE ONLY
 918         jtagarm7tdmi_resettap();
 919     jtagarm7tdmi_set_register(cmddata[0], cmddatalong[1]);
 920     cmddatalong[0] = cmddatalong[1];
 921     txdata(app,verb,4);
 922     break;
 923   case JTAGARM7TDMI_GET_REGISTERS:
 924         jtagarm7tdmi_resettap();
 925     jtagarm7tdmi_get_registers();
 926     txdata(app,verb,64);
 927     break;
 928   case JTAGARM7TDMI_SET_REGISTERS:
 929         jtagarm7tdmi_resettap();
 930     jtagarm7tdmi_set_registers();
 931     txdata(app,verb,64);
 932     break;
 933   case JTAGARM7TDMI_DEBUG_INSTR:
 934         jtagarm7tdmi_resettap();
 935     cmddataword[0] = jtagarm7tdmi_exec(cmddataword[0], cmddataword[1], cmddata[9]);
 936     txdata(app,verb,80);
 937     break;
 938   //case JTAGARM7TDMI_STEP_INSTR:
 939 /*  case JTAGARM7TDMI_READ_CODE_MEMORY:
 940   case JTAGARM7TDMI_WRITE_FLASH_PAGE:
 941   case JTAGARM7TDMI_READ_FLASH_PAGE:
 942   case JTAGARM7TDMI_MASS_ERASE_FLASH:
 943   case JTAGARM7TDMI_PROGRAM_FLASH:
 944   case JTAGARM7TDMI_LOCKCHIP:
 945   case JTAGARM7TDMI_CHIP_ERASE:
 946   */
 947 // Really ARM specific stuff
 948   case JTAGARM7TDMI_GET_CPSR:
 949         jtagarm7tdmi_resettap();
 950     cmddatalong[0] = jtagarm7tdmi_get_regCPSR();
 951     txdata(app,verb,4);
 952     break;
 953   case JTAGARM7TDMI_SET_CPSR:
 954         jtagarm7tdmi_resettap();
 955     cmddatalong[0] = jtagarm7tdmi_set_regCPSR(cmddatalong[0]);
 956     txdata(app,verb,4);
 957     break;
 958   case JTAGARM7TDMI_GET_SPSR:           // FIXME: NOT CORRECT
 959         jtagarm7tdmi_resettap();
 960     cmddatalong[0] = jtagarm7tdmi_get_regCPSR();
 961     txdata(app,verb,4);
 962     break;
 963   case JTAGARM7TDMI_SET_SPSR:           // FIXME: NOT CORRECT
 964         jtagarm7tdmi_resettap();
 965     cmddatalong[0] = jtagarm7tdmi_set_regCPSR(cmddatalong[0]);
 966     txdata(app,verb,4);
 967     break;
 968   case JTAGARM7TDMI_SET_MODE_THUMB:
 969   case JTAGARM7TDMI_SET_MODE_ARM:
 970         jtagarm7tdmi_resettap();
 971     cmddataword[0] = jtagarm7tdmi_setMode_ARM();
 972     txdata(app,verb,4);
 973     break;
 974
 975   case 0xD0:          // loopback test
 976     jtagarm7tdmi_resettap();
 977     cmddatalong[0] = jtagarm7tdmi_bypass(cmddatalong[0]);
 978     txdata(app,verb,4);
 979     break;
 980   case 0xD8:          // EICE_READ
 981     jtagarm7tdmi_resettap();
 982     cmddatalong[0] = eice_read(cmddatalong[0]);
 983     txdata(app,verb,4);
 984     break;
 985   case 0xD9:          // EICE_WRITE
 986     jtagarm7tdmi_resettap();
 987     cmddatalong[0] = eice_write(cmddatalong[0], cmddatalong[1]);
 988     txdata(app,verb,4);
 989     break;
 990   case 0xDA:          // TEST MSB THROUGH CHAIN0 and CHAIN1
 991     jtagarm7tdmi_resettap();
 992     jtagarm7tdmi_scan_intest(0);
 993     cmddatalong[0] = jtagarmtransn(0x41414141, 32, LSB, NOEND, NORETIDLE);
 994     cmddatalong[1] = jtagarmtransn(0x42424242, 32, MSB, NOEND, NORETIDLE);
 995     cmddatalong[2] = jtagarmtransn(0x43434343,  9, MSB, NOEND, NORETIDLE);
 996     cmddatalong[3] = jtagarmtransn(0x44444444, 32, MSB, NOEND, NORETIDLE);
 997     cmddatalong[4] = jtagarmtransn(cmddatalong[0], 32, LSB, NOEND, NORETIDLE);
 998     cmddatalong[5] = jtagarmtransn(cmddatalong[1], 32, MSB, NOEND, NORETIDLE);
 999     cmddatalong[6] = jtagarmtransn(cmddatalong[2],  9, MSB, NOEND, NORETIDLE);
1000     cmddatalong[7] = jtagarmtransn(cmddatalong[3], 32, MSB, END, RETIDLE);
1001     jtagarm7tdmi_resettap();
1002     jtagarm7tdmi_scan_intest(1);
1003     cmddatalong[8] = jtagarmtransn(0x41414141, 32, MSB, NOEND, NORETIDLE);
1004     cmddatalong[9] = jtagarmtransn(0x44444444,  1, MSB, NOEND, NORETIDLE);
1005     cmddatalong[10] = jtagarmtransn(cmddatalong[8], 32, MSB, NOEND, NORETIDLE);
1006     cmddatalong[11] = jtagarmtransn(cmddatalong[9],  1, MSB, END, RETIDLE);
1007     jtagarm7tdmi_resettap();
1008     txdata(app,verb,48);
1009     break;
1010
1011   default:
1012     jtaghandle(app,verb,len);
1013   }
1014 }
1015
1016
1017
1018
1019 /*****************************
1020 Captured from FlySwatter against AT91SAM7S, to be used by me for testing.  ignore
1021
1022 > arm reg
1023 System and User mode registers
1024       r0: 300000df       r1: 00000000       r2: 58000000       r3: 00200a75
1025       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1026       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1027      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 000000fc
1028     cpsr: 00000093
1029
1030 FIQ mode shadow registers
1031   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1032  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1033
1034 Supervisor mode shadow registers
1035   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1036
1037 Abort mode shadow registers
1038   sp_abt: 00000000   lr_abt: 00000000 spsr_abt: e00000ff
1039
1040 IRQ mode shadow registers
1041   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1042
1043 Undefined instruction mode shadow registers
1044   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1045 >
1046 > step;arm reg
1047 target state: halted
1048 target halted in ARM state due to single-step, current mode: Supervisor
1049 cpsr: 0x00000093 pc: 0x00000100
1050 System and User mode registers
1051       r0: 300000df       r1: 00000000       r2: 00200000       r3: 00200a75
1052       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1053       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1054      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000100
1055     cpsr: 00000093
1056
1057 FIQ mode shadow registers
1058   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1059  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1060
1061 Supervisor mode shadow registers
1062   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1063
1064 Abort mode shadow registers
1065   sp_abt: 00000000   lr_abt: 00000000 spsr_abt: e00000ff
1066
1067 IRQ mode shadow registers
1068   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1069
1070 Undefined instruction mode shadow registers
1071   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1072 >
1073  step;arm reg
1074 target state: halted
1075 target halted in ARM state due to single-step, current mode: Abort
1076 cpsr: 0x00000097 pc: 0x00000010
1077 System and User mode registers
1078       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1079       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1080       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1081      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1082     cpsr: 00000097
1083
1084 FIQ mode shadow registers
1085   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1086  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1087
1088 Supervisor mode shadow registers
1089   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1090
1091 Abort mode shadow registers
1092   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1093
1094 IRQ mode shadow registers
1095   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1096
1097 Undefined instruction mode shadow registers
1098   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1099 > step;arm reg
1100 target state: halted
1101 target halted in ARM state due to single-step, current mode: Abort
1102 cpsr: 0x00000097 pc: 0x00000010
1103 System and User mode registers
1104       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1105       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1106       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1107      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1108     cpsr: 00000097
1109
1110 FIQ mode shadow registers
1111   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1112  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1113
1114 Supervisor mode shadow registers
1115   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1116
1117 Abort mode shadow registers
1118   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1119
1120 IRQ mode shadow registers
1121   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1122
1123 Undefined instruction mode shadow registers
1124   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1125 > step;arm reg
1126 target state: halted
1127 target halted in ARM state due to single-step, current mode: Abort
1128 cpsr: 0x00000097 pc: 0x00000010
1129 System and User mode registers
1130       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1131       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1132       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1133      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1134     cpsr: 00000097
1135
1136 FIQ mode shadow registers
1137   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1138  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1139
1140 Supervisor mode shadow registers
1141   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1142
1143 Abort mode shadow registers
1144   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1145
1146 IRQ mode shadow registers
1147   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1148
1149 Undefined instruction mode shadow registers
1150   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1151 > step;arm reg
1152 target state: halted
1153 target halted in ARM state due to single-step, current mode: Abort
1154 cpsr: 0x00000097 pc: 0x00000010
1155 System and User mode registers
1156       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1157       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1158       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1159      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1160     cpsr: 00000097
1161
1162 FIQ mode shadow registers
1163   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1164  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1165
1166 Supervisor mode shadow registers
1167   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1168
1169 Abort mode shadow registers
1170   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1171
1172 IRQ mode shadow registers
1173   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1174
1175 Undefined instruction mode shadow registers
1176   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1177 > step;arm reg
1178 target state: halted
1179 target halted in ARM state due to single-step, current mode: Abort
1180 cpsr: 0x00000097 pc: 0x00000010
1181 System and User mode registers
1182       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1183       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1184       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1185      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1186     cpsr: 00000097
1187
1188 FIQ mode shadow registers
1189   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1190  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1191
1192 Supervisor mode shadow registers
1193   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1194
1195 Abort mode shadow registers
1196   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1197
1198 IRQ mode shadow registers
1199   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1200
1201 Undefined instruction mode shadow registers
1202   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1203 > step;arm reg
1204 target state: halted
1205 target halted in ARM state due to single-step, current mode: Abort
1206 cpsr: 0x00000097 pc: 0x00000010
1207 System and User mode registers
1208       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1209       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1210       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1211      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1212     cpsr: 00000097
1213
1214 FIQ mode shadow registers
1215   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1216  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1217
1218 Supervisor mode shadow registers
1219   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1220
1221 Abort mode shadow registers
1222   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1223
1224 IRQ mode shadow registers
1225   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1226
1227 Undefined instruction mode shadow registers
1228   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1229 > step;arm reg
1230 target state: halted
1231 target halted in ARM state due to single-step, current mode: Abort
1232 cpsr: 0x00000097 pc: 0x00000010
1233 System and User mode registers
1234       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1235       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1236       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1237      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1238     cpsr: 00000097
1239
1240 FIQ mode shadow registers
1241   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1242  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1243
1244 Supervisor mode shadow registers
1245   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1246
1247 Abort mode shadow registers
1248   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1249
1250 IRQ mode shadow registers
1251   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1252
1253 Undefined instruction mode shadow registers
1254   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1255 > step;arm reg
1256 target state: halted
1257 target halted in ARM state due to single-step, current mode: Abort
1258 cpsr: 0x00000097 pc: 0x00000010
1259 System and User mode registers
1260       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1261       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1262       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1263      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1264     cpsr: 00000097
1265
1266 FIQ mode shadow registers
1267   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1268  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1269
1270 Supervisor mode shadow registers
1271   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1272
1273 Abort mode shadow registers
1274   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1275
1276 IRQ mode shadow registers
1277   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1278
1279 Undefined instruction mode shadow registers
1280   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1281 > step;arm reg
1282 target state: halted
1283 target halted in ARM state due to single-step, current mode: Abort
1284 cpsr: 0x00000097 pc: 0x00000010
1285 System and User mode registers
1286       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1287       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1288       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1289      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1290     cpsr: 00000097
1291
1292 FIQ mode shadow registers
1293   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1294  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1295
1296 Supervisor mode shadow registers
1297   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1298
1299 Abort mode shadow registers
1300   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1301
1302 IRQ mode shadow registers
1303   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1304
1305 Undefined instruction mode shadow registers
1306   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1307 >
1308 */