git.rot13.org Git - goodfet/blob - firmware/apps/jtag/jtagarm7tdmi.c

   1 /*! \file jtagarm7tdmi.c
   2   \brief ARM7TDMI JTAG (AT91R40008, AT91SAM7xxx)
   3 */
   4
   5 #include "platform.h"
   6 #include "command.h"
   7 #include "jtag.h"
   8 #include "jtagarm7tdmi.h"
   9
  10
  11 /**** 20-pin Connection Information (pin1 is on top-right for both connectors)****
  12 GoodFET  ->  7TDMI 20-pin connector (HE-10 connector)
  13   1               13 (TDO)
  14   2               1  (Vdd)
  15   3               5  (TDI)
  16   5               7  (TMS)
  17   7               9  (TCK)
  18   8               15 (nRST)
  19   9               4,6,8,10,12,14,16,18,20 (GND)
  20   11              17/3 (nTRST)  (different sources suggest 17 or 3 alternately)
  21 ********************************/
  22
  23 /**** 14-pin Connection Information (pin1 is on top-right for both connectors)****
  24 GoodFET  ->  7TDMI 14-pin connector
  25   1               11 (TDO)
  26   2               1  (Vdd)
  27   3               5  (TDI)
  28   5               7  (TMS)
  29   7               9  (TCK)
  30   8               12 (nRST)
  31   9               2,4,6,8,10,14 (GND)
  32   11              3 (nTRST)
  33
  34 http://hri.sourceforge.net/tools/jtag_faq_org.html
  35 ********************************/
  36
  37
  38
  39
  40
  41
  42 /****************************************************************
  43 Enabling jtag likely differs with most platforms.  We will attempt to enable most from here.  Override jtagarm7tdmi_start() to extend for other implementations
  44 ARM7TDMI enables three different scan chains:
  45     * Chain0 - "entire periphery" including data bus
  46     * Chain1 - core data bus (subset of Chain0)  - Instruction Pipeline
  47     * Chain2 - EmbeddedICE Logic Registers - This is our way into the fun stuff.
  48
  49
  50 ---
  51 You can disable EmbeddedICE-RT by setting the DBGEN input LOW.
  52 Caution
  53 Hard wiring the DBGEN input LOW permanently disables all debug functionality.
  54 When DBGEN is LOW, it inhibits DBGDEWPT, DBGIEBKPT, and EDBGRQ to
  55 the core, and DBGACK from the ARM9E-S core is always LOW.
  56 ---
  57
  58
  59 ---
  60 When the ARM9E-S core is in debug state, you can examine the core and system state
  61 by forcing the load and store multiples into the instruction pipeline.
  62 Before you can examine the core and system state, the debugger must determine
  63 whether the processor entered debug from Thumb state or ARM state, by examining
  64 bit 4 of the EmbeddedICE-RT debug status register. If bit 4 is HIGH, the core has
  65 entered debug from Thumb state.
  66 For more details about determining the core state, see Determining the core and system
  67 state on page B-18.
  68 ---
  69
  70
  71 --- olimex - http://www.olimex.com/dev/pdf/arm-jtag.pdf
  72 JTAG signals description:
  73 PIN.1 (VTREF) Target voltage sense. Used to indicate the target’s operating voltage to thedebug tool.
  74 PIN.2 (VTARGET) Target voltage. May be used to supply power to the debug tool.
  75 PIN.3 (nTRST) JTAG TAP reset, this signal should be pulled up to Vcc in target board.
  76 PIN4,6, 8, 10,12,14,16,18,20 Ground. The Gnd-Signal-Gnd-Signal strategy implemented on the 20-way connection scheme improves noiseimmunity on the target connect cable.
  77 *PIN.5 (TDI) JTAG serial data in, should be pulled up to Vcc on target board.
  78 *PIN.7 (TMS) JTAG TAP Mode Select, should be pulled up to Vcc on target board.
  79 *PIN.9 (TCK) JTAG clock.
  80 PIN.11 (RTCK) JTAG retimed clock.Implemented on certain ASIC ARM implementations the host ASIC may need to synchronize external inputs (such as JTAG inputs) with its own internal clock.
  81 *PIN.13 (TDO) JTAG serial data out.
  82 *PIN.15 (nSRST) Target system reset.
  83 *PIN.17 (DBGRQ) Asynchronous debug request.  DBGRQ allows an external signal to force the ARM core into debug mode, should be pull down to GND.
  84 PIN.19 (DBGACK) Debug acknowledge. The ARM core acknowledges debug-mode inresponse to a DBGRQ input.
  85
  86
  87 -----------  SAMPLE TIMES  -----------
  88
  89 TDI and TMS are sampled on the rising edge of TCK and TDO transitions appear on the falling edge of TCK. Therefore, TDI and TMS must be written after the falling edge of TCK and TDO must be read after the rising edge of TCK.
  90
  91 for this module, we keep tck high for all changes/sampling, and then bounce it.
  92 ****************************************************************/
  93
  94
  95
  96 /************************** JTAGARM7TDMI Primitives ****************************/
  97 void jtag_goto_shift_ir() {
  98   SETTMS;
  99   jtag_arm_tcktock();
 100   jtag_arm_tcktock();
 101   CLRTMS;
 102   jtag_arm_tcktock();
 103   jtag_arm_tcktock();
 104
 105 }
 106
 107 void jtag_goto_shift_dr() {
 108   SETTMS;
 109   jtag_arm_tcktock();
 110   CLRTMS;
 111   jtag_arm_tcktock();
 112   jtag_arm_tcktock();
 113 }
 114
 115 void jtag_reset_to_runtest_idle() {
 116   SETTMS;
 117   jtag_arm_tcktock();
 118   jtag_arm_tcktock();
 119   jtag_arm_tcktock();
 120   jtag_arm_tcktock();
 121   jtag_arm_tcktock();  // now in Reset state
 122   CLRTMS;
 123   jtag_arm_tcktock();  // now in Run-Test/Idle state
 124 }
 125
 126 void jtag_arm_tcktock() {
 127   delay(100);  // FIXME: Should never wait this long...
 128   CLRTCK;
 129   PLEDOUT^=PLEDPIN;
 130   delay(100);  // FIXME: Should never wait this long...
 131   SETTCK;
 132   PLEDOUT^=PLEDPIN;
 133 }
 134
 135
 136 // ! Start JTAG, setup pins, reset TAP and return IDCODE
 137 unsigned long jtagarm7tdmi_start() {
 138   jtagsetup();
 139   jtagarm7tdmi_resettap();
 140   return jtagarm7tdmi_idcode();
 141 }
 142
 143
 144 //! Reset TAP State Machine
 145 void jtagarm7tdmi_resettap(){               // PROVEN
 146   current_chain = -1;
 147   jtag_reset_to_runtest_idle();
 148 }
 149
 150
 151 //  NOTE: important: THIS MODULE REVOLVES AROUND RETURNING TO RUNTEST/IDLE, OR THE FUNCTIONAL EQUIVALENT
 152
 153
 154 //! Shift N bits over TDI/TDO.  May choose LSB or MSB, and select whether to terminate (TMS-high on last bit) and whether to return to RUNTEST/IDLE
 155 unsigned long jtagarmtransn(unsigned long word, unsigned char bitcount, unsigned char lsb, unsigned char end, unsigned char retidle){               // PROVEN
 156   unsigned char bit;
 157   unsigned long high = 1L;
 158   unsigned long mask;
 159
 160   //for (bit=(bitcount-1)/8; bit>0; bit--)
 161   //  high <<= 8;
 162   //high <<= ((bitcount-1)%8);
 163   high <<= (bitcount-1);
 164
 165   mask = high-1;
 166
 167   if (lsb) {
 168     for (bit = bitcount; bit > 0; bit--) {
 169       /* write MOSI on trailing edge of previous clock */
 170       if (word & 1)
 171         {SETMOSI;}
 172       else
 173         {CLRMOSI;}
 174       word >>= 1;
 175
 176       if (bit==2 && end)  //FIXME: DID THIS BREAK SOMETHING?
 177         SETTMS;//TMS high on last bit to exit.
 178
 179       jtag_arm_tcktock();
 180
 181       /* read MISO on trailing edge */
 182       if (READMISO){
 183         word += (high);
 184       }
 185     }
 186   } else {
 187     for (bit = bitcount; bit > 0; bit--) {
 188       /* write MOSI on trailing edge of previous clock */
 189       if (word & high)
 190         {SETMOSI;}
 191       else
 192         {CLRMOSI;}
 193       word = (word & mask) << 1;
 194
 195       if (bit==2 && end)  //FIXME: DID THIS BREAK SOMETHING?
 196         SETTMS;//TMS high on last bit to exit.
 197
 198       jtag_arm_tcktock();
 199
 200       /* read MISO on trailing edge */
 201       word |= (READMISO);
 202     }
 203   }
 204
 205
 206   SETMOSI;
 207
 208   if (end){
 209     // exit state
 210     jtag_arm_tcktock();
 211     // update state
 212     if (retidle){
 213       CLRTMS;
 214       jtag_arm_tcktock();
 215     }
 216   }
 217   return word;
 218 }
 219
 220
 221
 222 /************************************************************************
 223 * ARM7TDMI core has 6 primary registers to be connected between TDI/TDO
 224 *   * Bypass Register
 225 *   * ID Code Register
 226 *   * Scan Chain Select Register    (4 bits_lsb)
 227 *   * Scan Chain 0                  (105 bits: 32_databits_lsb + ctrlbits + 32_addrbits_msb)
 228 *   * Scan Chain 1                  (33 bits: 32_bits + BREAKPT)
 229 *   * Scan Chain 2                  (38 bits: rw + 5_regbits_msb + 32_databits_msb)
 230 ************************************************************************/
 231
 232
 233
 234 /************************** Basic JTAG Verb Commands *******************************/
 235 //! Grab the core ID.
 236 unsigned long jtagarm7tdmi_idcode(){               // PROVEN
 237   jtagarm7tdmi_resettap();
 238   SHIFT_IR;
 239   jtagarmtransn(ARM7TDMI_IR_IDCODE, 4, LSB, END, RETIDLE);
 240   SHIFT_DR;
 241   return jtagarmtransn(0,32, LSB, END, RETIDLE);
 242 }
 243
 244 //!  Connect Bypass Register to TDO/TDI
 245 unsigned char jtagarm7tdmi_bypass(){               // PROVEN
 246   jtagarm7tdmi_resettap();
 247   SHIFT_IR;
 248   return jtagarmtransn(ARM7TDMI_IR_BYPASS, 4, LSB, END, NORETIDLE);
 249 }
 250 //!  INTEST verb - do internal test
 251 unsigned char jtagarm7tdmi_intest() {
 252   SHIFT_IR;
 253   return jtagarmtransn(ARM7TDMI_IR_INTEST, 4, LSB, END, NORETIDLE);
 254 }
 255
 256 //!  EXTEST verb - act like the processor to external components
 257 unsigned char jtagarm7tdmi_extest() {
 258   SHIFT_IR;
 259   return jtagarmtransn(ARM7TDMI_IR_EXTEST, 4, LSB, END, NORETIDLE);
 260 }
 261
 262 //!  SAMPLE verb
 263 //unsigned long jtagarm7tdmi_sample() {
 264 //  jtagarm7tdmi_ir_shift4(ARM7TDMI_IR_SAMPLE);        // ???? same here.
 265 //  return jtagtransn(0,32);
 266 //}
 267
 268 //!  RESTART verb
 269 unsigned char jtagarm7tdmi_restart() {
 270   jtagarm7tdmi_resettap();
 271   SHIFT_IR;
 272   return jtagarmtransn(ARM7TDMI_IR_RESTART, 4, LSB, END, RETIDLE);
 273 }
 274
 275 //!  ARM7TDMI_IR_CLAMP               0x5
 276 //unsigned long jtagarm7tdmi_clamp() {
 277 //  jtagarm7tdmi_resettap();
 278 //  SHIFT_IR;
 279 //  jtagarmtransn(ARM7TDMI_IR_CLAMP, 4, LSB, END, NORETIDLE);
 280 //  SHIFT_DR;
 281 //  return jtagarmtransn(0, 32, LSB, END, RETIDLE);
 282 //}
 283
 284 //!  ARM7TDMI_IR_HIGHZ               0x7
 285 //unsigned char jtagarm7tdmi_highz() {
 286 //  jtagarm7tdmi_resettap();
 287 //  SHIFT_IR;
 288 //  return jtagarmtransn(ARM7TDMI_IR_HIGHZ, 4, LSB, END, NORETIDLE);
 289 //}
 290
 291 //! define ARM7TDMI_IR_CLAMPZ              0x9
 292 //unsigned char jtagarm7tdmi_clampz() {
 293 //  jtagarm7tdmi_resettap();
 294 //  SHIFT_IR;
 295 //  return jtagarmtransn(ARM7TDMI_IR_CLAMPZ, 4, LSB, END, NORETIDLE);
 296 //}
 297
 298
 299 //!  Connect the appropriate scan chain to TDO/TDI.  SCAN_N, INTEST, ENDS IN SHIFT_DR!!!!!
 300 unsigned long jtagarm7tdmi_scan(int chain, int testmode) {               // PROVEN
 301 /*
 302 When selecting a scan chain the “Run Test/Idle” state should never be reached, other-
 303 wise, when in debug state, the core will not be correctly isolated and intrusive
 304 commands occur. Therefore, it is recommended to pass directly from the “Update”
 305 state” to the “Select DR” state each time the “Update” state is reached.
 306 */
 307   unsigned long retval;
 308   if (current_chain != chain) {
 309     //debugstr("===change chains===");
 310     SHIFT_IR;
 311     jtagarmtransn(ARM7TDMI_IR_SCAN_N, 4, LSB, END, NORETIDLE);
 312     SHIFT_DR;
 313     retval = jtagarmtransn(chain, 4, LSB, END, NORETIDLE);
 314     current_chain = chain;
 315   }    else
 316     //debugstr("===NOT change chains===");
 317     retval = current_chain;
 318   // put in test mode...
 319   SHIFT_IR;
 320   jtagarmtransn(testmode, 4, LSB, END, RETIDLE);
 321   return(retval);
 322 }
 323
 324
 325 //!  Connect the appropriate scan chain to TDO/TDI.  SCAN_N, INTEST, ENDS IN SHIFT_DR!!!!!
 326 unsigned long jtagarm7tdmi_scan_intest(int chain) {               // PROVEN
 327   return jtagarm7tdmi_scan(chain, ARM7TDMI_IR_INTEST);
 328 }
 329
 330
 331
 332
 333 //! push an instruction into the pipeline
 334 unsigned long jtagarm7tdmi_instr_primitive(unsigned long instr, char breakpt){  // PROVEN
 335   unsigned long retval;
 336   jtagarm7tdmi_scan_intest(1);
 337
 338   SHIFT_DR;
 339   // if the next instruction is to run using MCLK (master clock), set TDI
 340   if (breakpt)
 341     {
 342     SETMOSI;
 343     count_sysspd_instr_since_debug++;
 344     }
 345   else
 346     {
 347     CLRMOSI;
 348     count_dbgspd_instr_since_debug++;
 349     }
 350   jtag_arm_tcktock();
 351
 352   // Now shift in the 32 bits
 353   retval = jtagarmtransn(instr, 32, MSB, END, RETIDLE);    // Must return to RUN-TEST/IDLE state for instruction to enter pipeline, and causes debug clock.
 354   return(retval);
 355
 356 }
 357
 358 //! push NOP into the instruction pipeline
 359 unsigned long jtagarm7tdmi_nop(char breakpt){  // PROVEN
 360   return jtagarm7tdmi_instr_primitive(ARM_INSTR_NOP, breakpt);
 361 }
 362
 363 /*    stolen from ARM DDI0029G documentation, translated using ARM Architecture Reference Manual (14128.pdf)
 364 STR R0, [R0]; Save R0 before use
 365 MOV R0, PC ; Copy PC into R0
 366 STR R0, [R0]; Now save the PC in R0
 367 BX PC ; Jump into ARM state
 368 MOV R8, R8 ;
 369 MOV R8, R8 ;
 370 NOP
 371 NOP
 372
 373 */
 374
 375 //! set the current mode to ARM, returns PC (FIXME).  Should be used by haltcpu(), which should also store PC and the THUMB state, for use by releasecpu();
 376 unsigned long jtagarm7tdmi_setMode_ARM(){               // PROVEN
 377   debugstr("=== Thumb Mode... Switching to ARM mode ===");
 378   unsigned long retval = 0xffL;
 379   while ((jtagarm7tdmi_get_dbgstate() & JTAG_ARM7TDMI_DBG_TBIT)&& retval-- > 0){
 380     cmddataword[6] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_NOP,0);
 381     cmddataword[1] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_STR_R0_r0,0);
 382     cmddataword[2] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_MOV_R0_PC,0);
 383     cmddataword[3] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_STR_R0_r0,0);
 384     cmddataword[4] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_BX_PC,0);
 385     cmddataword[5] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_NOP,0);
 386     cmddataword[6] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_NOP,0);
 387     jtagarm7tdmi_resettap();                  // seems necessary for some reason.  ugh.
 388   }
 389   return(retval);
 390 }
 391
 392
 393
 394
 395 /************************* EmbeddedICE Primitives ****************************/
 396 //! shifter for writing to chain2 (EmbeddedICE).
 397 unsigned long eice_write(unsigned char reg, unsigned long data){
 398   unsigned long retval, temp;
 399   debugstr("eice_write");
 400   debughex(reg);
 401   debughex32(data);
 402   jtagarm7tdmi_scan_intest(2);
 403   // Now shift in the 32 bits
 404   SHIFT_DR;
 405   retval = jtagarmtransn(data, 32, LSB, NOEND, NORETIDLE);          // send in the data - 32-bits lsb
 406   temp = jtagarmtransn(reg, 5, LSB, NOEND, NORETIDLE);              // send in the register address - 5 bits lsb
 407   jtagarmtransn(1, 1, LSB, END, RETIDLE);                           // send in the WRITE bit
 408
 409   //SETTMS;   // Last Bit - Exit UPDATE_DR
 410   //// is this update a read/write or just read?
 411   //SETMOSI;
 412   //jtag_arm_tcktock();
 413
 414   return(retval);
 415 }
 416
 417 //! shifter for reading from chain2 (EmbeddedICE).
 418 unsigned long eice_read(unsigned char reg){               // PROVEN
 419   unsigned long temp, retval;
 420   debugstr("eice_read");
 421   debughex(reg);
 422   jtagarm7tdmi_scan_intest(2);
 423
 424   // send in the register address - 5 bits LSB
 425   SHIFT_DR;
 426   temp = jtagarmtransn(reg, 5, LSB, NOEND, NORETIDLE);
 427
 428   // clear TDI to select "read only"
 429   jtagarmtransn(0L, 1, LSB, END, RETIDLE);
 430
 431   SHIFT_DR;
 432   // Now shift out the 32 bits
 433   retval = jtagarmtransn(0L, 32, LSB, END, RETIDLE);   // atmel arm jtag docs pp.10-11: LSB first
 434   debughex32(retval);
 435   return(retval);   // atmel arm jtag docs pp.10-11: LSB first
 436
 437 }
 438
 439
 440
 441
 442 /************************* ICEBreaker/EmbeddedICE Stuff ******************************/
 443 //! Grab debug register
 444 unsigned long jtagarm7tdmi_get_dbgstate() {       // ICE Debug register, *NOT* ARM register DSCR    //    PROVEN
 445   //jtagarm7tdmi_resettap();
 446   return eice_read(EICE_DBGSTATUS);
 447 }
 448
 449 //! Grab debug register
 450 unsigned long jtagarm7tdmi_get_dbgctrl() {
 451   return eice_read(EICE_DBGCTRL);
 452 }
 453
 454 //! Update debug register
 455 unsigned long jtagarm7tdmi_set_dbgctrl(unsigned long bits) {
 456   return eice_write(EICE_DBGCTRL, bits);
 457 }
 458
 459
 460
 461 //!  Set and Enable Watchpoint 0
 462 void jtagarm7tdmi_set_watchpoint0(unsigned long addr, unsigned long addrmask, unsigned long data, unsigned long datamask, unsigned long ctrl, unsigned long ctrlmask){
 463   // store watchpoint info?  - not right now
 464     // FIXME: store info
 465
 466   eice_write(EICE_WP0ADDR, addr);           // write 0 in watchpoint 0 address
 467   eice_write(EICE_WP0ADDRMASK, addrmask);   // write 0xffffffff in watchpoint 0 address mask
 468   eice_write(EICE_WP0DATA, data);           // write 0 in watchpoint 0 data
 469   eice_write(EICE_WP0DATAMASK, datamask);   // write 0xffffffff in watchpoint 0 data mask
 470   eice_write(EICE_WP0CTRL, ctrlmask);       // write 0x00000100 in watchpoint 0 control value register (enables watchpoint)
 471   eice_write(EICE_WP0CTRLMASK, ctrlmask);   // write 0xfffffff7 in watchpoint 0 control mask - only detect the fetch instruction
 472 }
 473
 474 //!  Set and Enable Watchpoint 1
 475 void jtagarm7tdmi_set_watchpoint1(unsigned long addr, unsigned long addrmask, unsigned long data, unsigned long datamask, unsigned long ctrl, unsigned long ctrlmask){
 476   // store watchpoint info?  - not right now
 477     // FIXME: store info
 478
 479   eice_write(EICE_WP1ADDR, addr);           // write 0 in watchpoint 1 address
 480   eice_write(EICE_WP1ADDRMASK, addrmask);   // write 0xffffffff in watchpoint 1 address mask
 481   eice_write(EICE_WP1DATA, data);           // write 0 in watchpoint 1 data
 482   eice_write(EICE_WP1DATAMASK, datamask);   // write 0xffffffff in watchpoint 1 data mask
 483   eice_write(EICE_WP1CTRL, ctrl);           // write 0x00000100 in watchpoint 1 control value register (enables watchpoint)
 484   eice_write(EICE_WP1CTRLMASK, ctrlmask);   // write 0xfffffff7 in watchpoint 1 control mask - only detect the fetch instruction
 485 }
 486
 487 //!  Disable Watchpoint 0
 488 void jtagarm7tdmi_disable_watchpoint0(){
 489   eice_write(EICE_WP0CTRL, 0x0L); // write 0 in watchpoint 0 control value - disables watchpoint 0
 490 }
 491
 492 //!  Disable Watchpoint 1
 493 void jtagarm7tdmi_disable_watchpoint1(){
 494   eice_write(EICE_WP1CTRL, 0x0L);            // write 0 in watchpoint 0 control value - disables watchpoint 0
 495 }
 496
 497
 498
 499 /******************** Complex Commands **************************/
 500
 501 //! Push an instruction into the CPU pipeline
 502 //  NOTE!  Must provide EXECNOPARM for parameter if no parm is required.
 503 unsigned long jtagarm7tdmi_exec(unsigned long instr, unsigned long parameter, unsigned char systemspeed) {
 504   unsigned long retval;
 505
 506   debughex32(jtagarm7tdmi_nop( 0));
 507   debughex32(jtagarm7tdmi_nop(systemspeed));
 508   debughex32(jtagarm7tdmi_instr_primitive(instr, 0));      // write 32-bit instruction code into DR
 509   debughex32(jtagarm7tdmi_nop( 0));
 510   debughex32(jtagarm7tdmi_nop( 0));
 511   debughex32(jtagarm7tdmi_instr_primitive(parameter, 0));  // inject long
 512   retval = jtagarm7tdmi_nop( 0);
 513   debughex32(retval);
 514   debughex32(jtagarm7tdmi_nop( 0));
 515   debughex32(jtagarm7tdmi_nop( 0));
 516
 517   return(retval);
 518 }
 519
 520 //! Retrieve a 32-bit Register value
 521 unsigned long jtagarm7tdmi_get_register(unsigned long reg) {
 522   unsigned long retval = 0L, instr, reg2;
 523   reg2 = (reg&0xfL)<<16;
 524   // push nop into pipeline - clean out the pipeline...
 525   instr = (unsigned long)(reg<<12L) | (unsigned long)ARM_READ_REG;   // STR Rx, [R14]
 526   instr ^= reg2;
 527   //instr = (unsigned long)(((unsigned long)reg<<12) | ARM_READ_REG);
 528   //debugstr("Reading:");
 529   debughex32(instr);
 530
 531   jtagarm7tdmi_nop( 0);
 532   jtagarm7tdmi_nop( 0);
 533   jtagarm7tdmi_nop( 0);
 534   jtagarm7tdmi_instr_primitive(instr, 0);
 535   jtagarm7tdmi_nop( 0);                // push nop into pipeline - fetched
 536   jtagarm7tdmi_nop( 0);                // push nop into pipeline - decoded
 537   jtagarm7tdmi_nop( 0);                // push nop into pipeline - executed
 538   retval = jtagarm7tdmi_nop( 0);                        // recover 32-bit word
 539   debughex32(retval);
 540   jtagarm7tdmi_nop( 0);
 541   jtagarm7tdmi_nop( 0);
 542   jtagarm7tdmi_nop( 0);
 543   return retval;
 544 }
 545
 546 //! Set a 32-bit Register value
 547 void jtagarm7tdmi_set_register(unsigned long reg, unsigned long val) {
 548   unsigned long instr, reg2;
 549   reg2 = (reg&0xfL);
 550   instr = (unsigned long)(((unsigned long)reg<<12L) | ARM_WRITE_REG); //  LDR Rx, [R14]
 551   instr |= (unsigned long)((unsigned long)reg2<<8L)<<8L;
 552   //instr |= (unsigned long)((((unsigned long)reg)&0x7)<<8)<<8;
 553   //debugstr("Writing:");
 554   debughex32(instr);
 555   //debughex32(val);
 556   jtagarm7tdmi_nop( 0);            // push nop into pipeline - clean out the pipeline...
 557   jtagarm7tdmi_nop( 0);            // push nop into pipeline - clean out the pipeline...
 558   jtagarm7tdmi_instr_primitive(instr, 0); // push instr into pipeline - fetch
 559   jtagarm7tdmi_nop( 0);            // push nop into pipeline - decode
 560   //jtagarm7tdmi_nop( 0);            // push nop into pipeline - execute
 561
 562   jtagarm7tdmi_instr_primitive(val, 0); // push 32-bit word on data bus
 563   jtagarm7tdmi_instr_primitive(val, 0); // push 32-bit word on data bus
 564   jtagarm7tdmi_instr_primitive(val, 0); // push 32-bit word on data bus
 565   jtagarm7tdmi_nop( 0);            // push nop into pipeline - executed
 566   jtagarm7tdmi_nop( 0);            // push nop into pipeline - executed
 567
 568   if (reg == ARM_REG_PC){
 569     jtagarm7tdmi_nop( 0);
 570     jtagarm7tdmi_nop( 0);
 571   }
 572   jtagarm7tdmi_nop( 0);
 573 }
 574
 575
 576
 577 //! Get all registers, placing them into cmddatalong[0-15]
 578 void jtagarm7tdmi_get_registers() {
 579   debugstr("First 8 registers:");
 580   debugstr("   Instr and the first few pops from the instruction chain:");
 581   debughex32(ARM_INSTR_SKANKREGS1);
 582   debughex32(jtagarm7tdmi_nop( 0));
 583   debughex32(jtagarm7tdmi_instr_primitive(ARM_INSTR_SKANKREGS1,0));
 584   debughex32(jtagarm7tdmi_nop( 0));
 585   debughex32(jtagarm7tdmi_nop( 0));
 586   cmddatalong[ 0] = jtagarm7tdmi_nop( 0);
 587   cmddatalong[ 1] = jtagarm7tdmi_nop( 0);
 588   cmddatalong[ 2] = jtagarm7tdmi_nop( 0);
 589   cmddatalong[ 3] = jtagarm7tdmi_nop( 0);
 590   cmddatalong[ 4] = jtagarm7tdmi_nop( 0);
 591   cmddatalong[ 5] = jtagarm7tdmi_nop( 0);
 592   cmddatalong[ 6] = jtagarm7tdmi_nop( 0);
 593   cmddatalong[ 7] = jtagarm7tdmi_nop( 0);
 594
 595   debugstr("Last 8 registers:");
 596   debugstr("   Instr and the first few pops from the instruction chain:");
 597   debughex32(ARM_INSTR_SKANKREGS2);
 598   debughex32(jtagarm7tdmi_nop( 0));
 599   //jtagarm7tdmi_nop( 0);
 600   debughex32(jtagarm7tdmi_instr_primitive(ARM_INSTR_SKANKREGS2,0));
 601   debughex32(jtagarm7tdmi_nop( 0));
 602   debughex32(jtagarm7tdmi_nop( 0));
 603   //jtagarm7tdmi_nop( 0);
 604   //jtagarm7tdmi_nop( 0);
 605   cmddatalong[ 8] = jtagarm7tdmi_nop( 0);
 606   cmddatalong[ 9] = jtagarm7tdmi_nop( 0);
 607   cmddatalong[10] = jtagarm7tdmi_nop( 0);
 608   cmddatalong[11] = jtagarm7tdmi_nop( 0);
 609   cmddatalong[12] = jtagarm7tdmi_nop( 0);
 610   cmddatalong[13] = jtagarm7tdmi_nop( 0);
 611   cmddatalong[14] = jtagarm7tdmi_nop( 0);
 612   cmddatalong[15] = jtagarm7tdmi_nop( 0);
 613   jtagarm7tdmi_nop( 0);
 614 }
 615
 616 //! Set all registers from cmddatalong[0-15]
 617 void jtagarm7tdmi_set_registers() {   //FIXME: BORKEN... TOTALLY TRYING TO BUY A VOWEL
 618   debughex32(ARM_INSTR_CLOBBEREGS);
 619   jtagarm7tdmi_nop( 0);
 620   debughex32(jtagarm7tdmi_instr_primitive(ARM_INSTR_CLOBBEREGS,0));
 621   jtagarm7tdmi_nop( 0);
 622   jtagarm7tdmi_nop( 0);
 623   debughex32(jtagarm7tdmi_instr_primitive(0x40L,0));
 624   debughex32(jtagarm7tdmi_instr_primitive(0x41L,0));
 625   debughex32(jtagarm7tdmi_instr_primitive(0x42L,0));
 626   debughex32(jtagarm7tdmi_instr_primitive(0x43L,0));
 627   debughex32(jtagarm7tdmi_instr_primitive(0x44L,0));
 628   debughex32(jtagarm7tdmi_instr_primitive(0x45L,0));
 629   debughex32(jtagarm7tdmi_instr_primitive(0x46L,0));
 630   debughex32(jtagarm7tdmi_instr_primitive(0x47L,0));
 631   debughex32(jtagarm7tdmi_instr_primitive(0x48L,0));
 632   debughex32(jtagarm7tdmi_instr_primitive(0x49L,0));
 633   debughex32(jtagarm7tdmi_instr_primitive(0x4aL,0));
 634   debughex32(jtagarm7tdmi_instr_primitive(0x4bL,0));
 635   debughex32(jtagarm7tdmi_instr_primitive(0x4cL,0));
 636   debughex32(jtagarm7tdmi_instr_primitive(0x4dL,0));
 637   debughex32(jtagarm7tdmi_instr_primitive(0x4eL,0));
 638   debughex32(jtagarm7tdmi_instr_primitive(0x4fL,0));
 639 }
 640
 641 //! Retrieve the CPSR Register value
 642 unsigned long jtagarm7tdmi_get_regCPSR() {
 643   unsigned long retval = 0L;
 644
 645   debughex32(jtagarm7tdmi_nop( 0)); // push nop into pipeline - clean out the pipeline...
 646   debughex32(jtagarm7tdmi_instr_primitive(ARM_INSTR_MRS_R0_CPSR, 0)); // push MRS_R0, CPSR into pipeline
 647   debughex32(jtagarm7tdmi_nop( 0)); // push nop into pipeline - fetched
 648   debughex32(jtagarm7tdmi_nop( 0)); // push nop into pipeline - decoded
 649   debughex32(jtagarm7tdmi_nop( 0)); // push nop into pipeline - executed
 650   retval = jtagarm7tdmi_nop( 0);        // recover 32-bit word
 651   debughex32(retval);
 652   return retval;
 653 }
 654
 655 //! Retrieve the CPSR Register value
 656 unsigned long jtagarm7tdmi_set_regCPSR(unsigned long val) {
 657   unsigned long retval = 0L;
 658
 659   debughex32(jtagarm7tdmi_nop( 0));        // push nop into pipeline - clean out the pipeline...
 660   debughex32(jtagarm7tdmi_instr_primitive(ARM_INSTR_MSR_cpsr_cxsf_R0, 0)); // push MSR cpsr_cxsf, R0 into pipeline
 661   debughex32(jtagarm7tdmi_nop( 0));        // push nop into pipeline - fetched
 662   debughex32(jtagarm7tdmi_nop( 0));        // push nop into pipeline - decoded
 663
 664   retval = jtagarm7tdmi_instr_primitive(val, 0);// push 32-bit word on data bus
 665   debughex32(jtagarm7tdmi_nop( 0));        // push nop into pipeline - executed
 666   debughex32(retval);
 667   return(retval);
 668 }
 669
 670 //! Write data to address - Assume TAP in run-test/idle state
 671 unsigned long jtagarm7tdmi_writemem(unsigned long adr, unsigned long data){
 672   unsigned long r0=0L, r1=-1L;
 673
 674   r0 = jtagarm7tdmi_get_register(0);        // store R0 and R1
 675   r1 = jtagarm7tdmi_get_register(1);
 676   jtagarm7tdmi_set_register(0, adr);        // write address into R0
 677   jtagarm7tdmi_set_register(1, data);       // write data in R1
 678   jtagarm7tdmi_nop( 0);                     // push nop into pipeline to "clean" it ???
 679   jtagarm7tdmi_nop( 1);                     // push nop into pipeline with BREAKPT set
 680   jtagarm7tdmi_instr_primitive(ARM_INSTR_LDR_R1_r0_4, 0); // push LDR R1, R0, #4 into instruction pipeline
 681   jtagarm7tdmi_nop( 0);                     // push nop into pipeline
 682   jtagarm7tdmi_set_register(1, r1);         // restore R0 and R1
 683   jtagarm7tdmi_set_register(0, r0);
 684   return(-1);
 685 }
 686
 687
 688
 689
 690 //! Read data from address
 691 unsigned long jtagarm7tdmi_readmem(unsigned long adr){
 692   unsigned long retval = 0L;
 693   unsigned long r0=0L, r1=-1L;
 694   int waitcount = 0xfffL;
 695
 696   r0 = jtagarm7tdmi_get_register(0);        // store R0 and R1
 697   r1 = jtagarm7tdmi_get_register(1);
 698   jtagarm7tdmi_set_register(0, adr);        // write address into R0
 699   jtagarm7tdmi_nop( 0);                     // push nop into pipeline to "clean" it ???
 700   jtagarm7tdmi_nop( 1);                     // push nop into pipeline with BREAKPT set
 701   jtagarm7tdmi_instr_primitive(ARM_INSTR_LDR_R1_r0_4, 0); // push LDR R1, R0, #4 into instruction pipeline
 702   jtagarm7tdmi_nop( 0);                     // push nop into pipeline
 703   jtagarm7tdmi_restart();                   // SHIFT_IR with RESTART instruction
 704
 705   // Poll the Debug Status Register for DBGACK and nMREQ to be HIGH
 706   while ((jtagarm7tdmi_get_dbgstate() & 9L) == 0  && waitcount > 0){
 707     delay(1);
 708     waitcount --;
 709   }
 710   if (waitcount == 0){
 711     return (-1);
 712   } else {
 713     retval = jtagarm7tdmi_get_register(1);  // read memory value from R1 register
 714     jtagarm7tdmi_set_register(1, r1);         // restore R0 and R1
 715     jtagarm7tdmi_set_register(0, r0);
 716   }
 717   return retval;
 718 }
 719
 720
 721 //! Read Program Counter
 722 unsigned long jtagarm7tdmi_getpc(){
 723   return jtagarm7tdmi_get_register(ARM_REG_PC);
 724 }
 725
 726 //! Set Program Counter
 727 void jtagarm7tdmi_setpc(unsigned long adr){
 728   jtagarm7tdmi_set_register(ARM_REG_PC, adr);
 729 }
 730
 731 //! Halt CPU - returns 0xffff if the operation fails to complete within
 732 unsigned long jtagarm7tdmi_haltcpu(){                   //  PROVEN
 733   int waitcount = 0xfffL;
 734
 735 /********  OLD WAY  ********/
 736   // store watchpoint info?  - not right now
 737   eice_write(EICE_WP1ADDR, 0L);              // write 0 in watchpoint 1 address
 738   eice_write(EICE_WP1ADDRMASK, 0xffffffff); // write 0xffffffff in watchpoint 1 address mask
 739   eice_write(EICE_WP1DATA, 0L);              // write 0 in watchpoint 1 data
 740   eice_write(EICE_WP1DATAMASK, 0xffffffff); // write 0xffffffff in watchpoint 1 data mask
 741   eice_write(EICE_WP1CTRL, 0x100L);          // write 0x00000100 in watchpoint 1 control value register (enables watchpoint)
 742   eice_write(EICE_WP1CTRLMASK, 0xfffffff7); // write 0xfffffff7 in watchpoint 1 control mask - only detect the fetch instruction
 743 /***************************/
 744
 745 /********  NEW WAY  *********/
 746 //  eice_write(EICE_DBGCTRL, JTAG_ARM7TDMI_DBG_DBGRQ);  // r/o register?
 747 /****************************/
 748
 749   // poll until debug status says the cpu is in debug mode
 750   while (!(jtagarm7tdmi_get_dbgstate() & 0x1L)   && waitcount-- > 0){
 751     delay(1);
 752   }
 753
 754 /********  OLD WAY  ********/
 755   eice_write(EICE_WP1CTRL, 0x0L);            // write 0 in watchpoint 0 control value - disables watchpoint 0
 756 /***************************/
 757
 758 /********  NEW WAY  ********/
 759 //  eice_write(EICE_DBGCTRL, 0);        // r/o register?
 760 /***************************/
 761
 762   // store the debug state
 763   last_halt_debug_state = jtagarm7tdmi_get_dbgstate();
 764   last_halt_pc = jtagarm7tdmi_getpc() - 4;  // assume -4 for entering debug mode via watchpoint.
 765   count_dbgspd_instr_since_debug = 0L;
 766   count_sysspd_instr_since_debug = 0L;
 767
 768   // get into ARM mode if the T flag is set (Thumb mode)
 769   while (jtagarm7tdmi_get_dbgstate() & JTAG_ARM7TDMI_DBG_TBIT && waitcount-- > 0) {
 770     jtagarm7tdmi_setMode_ARM();
 771   }
 772   jtagarm7tdmi_resettap();
 773   return waitcount;
 774 }
 775
 776 unsigned long jtagarm7tdmi_releasecpu(){
 777   int waitcount = 0xfff;
 778   unsigned long instr;
 779   // somehow determine what PC should be (a couple ways possible, calculations required)
 780   jtagarm7tdmi_nop(0);                          // NOP
 781   jtagarm7tdmi_nop(1);                          // NOP/BREAKPT
 782
 783   if (last_halt_debug_state & JTAG_ARM7TDMI_DBG_TBIT){      // FIXME:  FORNICATED!  BX requires register, thus more instrs... could we get away with the same instruction but +1 to offset?
 784     instr = ARM_INSTR_B_PC + 0x1000001 - (count_dbgspd_instr_since_debug) - (count_sysspd_instr_since_debug*3);  //FIXME: make this right  - can't we just do an a7solute b/bx?
 785     jtagarm7tdmi_instr_primitive(instr,0);
 786   } else {
 787     instr = ARM_INSTR_B_PC + 0x1000000 - (count_dbgspd_instr_since_debug*4) - (count_sysspd_instr_since_debug*12);
 788     jtagarm7tdmi_instr_primitive(instr,0);
 789   }
 790
 791   SHIFT_IR;
 792   jtagarmtransn(ARM7TDMI_IR_RESTART,4,LSB,END,RETIDLE); // VERB_RESTART
 793
 794   // wait until restart-bit set in debug state register
 795   while ((jtagarm7tdmi_get_dbgstate() & JTAG_ARM7TDMI_DBG_DBGACK) && waitcount > 0){
 796     msdelay(1);
 797     waitcount --;
 798   }
 799   last_halt_debug_state = -1;
 800   last_halt_pc = -1;
 801   return 0;
 802 }
 803
 804
 805
 806
 807 ///////////////////////////////////////////////////////////////////////////////////////////////////
 808 //! Handles ARM7TDMI JTAG commands.  Forwards others to JTAG.
 809 void jtagarm7tdmihandle(unsigned char app, unsigned char verb, unsigned long len){
 810   register char blocks;
 811
 812   unsigned int i,val;
 813   unsigned long at;
 814
 815   jtagarm7tdmi_resettap();
 816
 817   switch(verb){
 818   case START:
 819     //Enter JTAG mode.
 820     debughex32(jtagarm7tdmi_start());
 821     debughex32(jtagarm7tdmi_haltcpu());
 822     //jtagarm7tdmi_resettap();
 823     debughex32(jtagarm7tdmi_get_dbgstate());
 824
 825     // DEBUG: FIXME: NOT PART OF OPERATIONAL CODE
 826     //for (mlop=2;mlop<4;mlop++){
 827     //  jtagarm7tdmi_set_register(mlop, 0x43424140);
 828     //}
 829     /////////////////////////////////////////////
 830     txdata(app,verb,0x4);
 831     break;
 832   case JTAGARM7TDMI_READMEM:
 833   case PEEK:
 834     blocks=(len>4?cmddata[4]:1);
 835     at=cmddatalong[0];
 836
 837     len=0x80;
 838     txhead(app,verb,len);
 839
 840     while(blocks--){
 841       for(i=0;i<len;i+=2){
 842         jtagarm7tdmi_resettap();
 843         delay(10);
 844
 845         val=jtagarm7tdmi_readmem(at);
 846
 847         at+=2;
 848         serial_tx(val&0xFFL);
 849         serial_tx((val&0xFF00L)>>8);
 850       }
 851     }
 852
 853     break;
 854   case JTAGARM7TDMI_GET_CHIP_ID:
 855         jtagarm7tdmi_resettap();
 856     cmddatalong[0] = jtagarm7tdmi_idcode();
 857     txdata(app,verb,4);
 858     break;
 859
 860
 861   case JTAGARM7TDMI_WRITEMEM:
 862   case POKE:
 863         jtagarm7tdmi_resettap();
 864     jtagarm7tdmi_writemem(cmddatalong[0],
 865                        cmddataword[2]);
 866     cmddataword[0]=jtagarm7tdmi_readmem(cmddatalong[0]);
 867     txdata(app,verb,2);
 868     break;
 869
 870   case JTAGARM7TDMI_HALTCPU:
 871     cmddatalong[0] = jtagarm7tdmi_haltcpu();
 872     txdata(app,verb,4);
 873     break;
 874   case JTAGARM7TDMI_RELEASECPU:
 875         jtagarm7tdmi_resettap();
 876     cmddatalong[0] = jtagarm7tdmi_releasecpu();
 877     txdata(app,verb,4);
 878     break;
 879   //unimplemented functions
 880   //case JTAGARM7TDMI_SETINSTRFETCH:
 881   //case JTAGARM7TDMI_WRITEFLASH:
 882   //case JTAGARM7TDMI_ERASEFLASH:
 883   case JTAGARM7TDMI_SET_PC:
 884     jtagarm7tdmi_setpc(cmddatalong[0]);
 885     txdata(app,verb,0);
 886     break;
 887   case JTAGARM7TDMI_GET_DEBUG_CTRL:
 888     cmddatalong[0] = jtagarm7tdmi_get_dbgctrl();
 889     txdata(app,verb,1);
 890     break;
 891   case JTAGARM7TDMI_SET_DEBUG_CTRL:
 892     cmddatalong[0] = jtagarm7tdmi_set_dbgctrl(cmddata[0]);
 893     txdata(app,verb,4);
 894     break;
 895   case JTAGARM7TDMI_GET_PC:
 896     cmddatalong[0] = jtagarm7tdmi_getpc();
 897     txdata(app,verb,4);
 898     break;
 899   case JTAGARM7TDMI_GET_DEBUG_STATE:
 900     //jtagarm7tdmi_resettap();            // Shouldn't need this, but currently do.  FIXME!
 901     cmddatalong[0] = jtagarm7tdmi_get_dbgstate();
 902     txdata(app,verb,4);
 903     break;
 904   //case JTAGARM7TDMI_GET_WATCHPOINT:
 905   //case JTAGARM7TDMI_SET_WATCHPOINT:
 906   case JTAGARM7TDMI_GET_REGISTER:
 907         jtagarm7tdmi_resettap();
 908     val = cmddata[0];
 909     cmddatalong[0] = jtagarm7tdmi_get_register(val);
 910     //debughex32(cmddatalong[0]);
 911     txdata(app,verb,4);
 912     break;
 913   case JTAGARM7TDMI_SET_REGISTER:           // FIXME: NOT AT ALL CORRECT, THIS IS TESTING CODE ONLY
 914         jtagarm7tdmi_resettap();
 915     debughex32(cmddatalong[1]);
 916     jtagarm7tdmi_set_register(cmddata[0], cmddatalong[1]);
 917     cmddatalong[0] = cmddatalong[1];
 918     txdata(app,verb,4);
 919     break;
 920   case JTAGARM7TDMI_GET_REGISTERS:
 921         jtagarm7tdmi_resettap();
 922     jtagarm7tdmi_get_registers();
 923     txdata(app,verb,64);
 924     break;
 925   case JTAGARM7TDMI_SET_REGISTERS:
 926         jtagarm7tdmi_resettap();
 927     jtagarm7tdmi_set_registers();
 928     txdata(app,verb,64);
 929     break;
 930   case JTAGARM7TDMI_DEBUG_INSTR:
 931         jtagarm7tdmi_resettap();
 932     cmddataword[0] = jtagarm7tdmi_exec(cmddataword[0], cmddataword[1], cmddata[9]);
 933     txdata(app,verb,80);
 934     break;
 935   //case JTAGARM7TDMI_STEP_INSTR:
 936 /*  case JTAGARM7TDMI_READ_CODE_MEMORY:
 937   case JTAGARM7TDMI_WRITE_FLASH_PAGE:
 938   case JTAGARM7TDMI_READ_FLASH_PAGE:
 939   case JTAGARM7TDMI_MASS_ERASE_FLASH:
 940   case JTAGARM7TDMI_PROGRAM_FLASH:
 941   case JTAGARM7TDMI_LOCKCHIP:
 942   case JTAGARM7TDMI_CHIP_ERASE:
 943   */
 944 // Really ARM specific stuff
 945   case JTAGARM7TDMI_GET_CPSR:
 946         jtagarm7tdmi_resettap();
 947     cmddatalong[0] = jtagarm7tdmi_get_regCPSR();
 948     txdata(app,verb,4);
 949     break;
 950   case JTAGARM7TDMI_SET_CPSR:
 951         jtagarm7tdmi_resettap();
 952     cmddatalong[0] = jtagarm7tdmi_set_regCPSR(cmddatalong[0]);
 953     txdata(app,verb,4);
 954     break;
 955   case JTAGARM7TDMI_GET_SPSR:           // FIXME: NOT CORRECT
 956         jtagarm7tdmi_resettap();
 957     cmddatalong[0] = jtagarm7tdmi_get_regCPSR();
 958     txdata(app,verb,4);
 959     break;
 960   case JTAGARM7TDMI_SET_SPSR:           // FIXME: NOT CORRECT
 961         jtagarm7tdmi_resettap();
 962     cmddatalong[0] = jtagarm7tdmi_set_regCPSR(cmddatalong[0]);
 963     txdata(app,verb,4);
 964     break;
 965   case JTAGARM7TDMI_SET_MODE_THUMB:
 966   case JTAGARM7TDMI_SET_MODE_ARM:
 967         jtagarm7tdmi_resettap();
 968     cmddataword[0] = jtagarm7tdmi_setMode_ARM();
 969     txdata(app,verb,4);
 970     break;
 971
 972   case 0xD0:          // loopback test
 973     jtagarm7tdmi_resettap();
 974     cmddatalong[0] = jtagarm7tdmi_bypass(cmddatalong[0]);
 975     txdata(app,verb,4);
 976     break;
 977   case 0xD8:          // EICE_READ
 978     jtagarm7tdmi_resettap();
 979     cmddatalong[0] = eice_read(cmddatalong[0]);
 980     txdata(app,verb,4);
 981     break;
 982   case 0xD9:          // EICE_WRITE
 983     jtagarm7tdmi_resettap();
 984     cmddatalong[0] = eice_write(cmddatalong[0], cmddatalong[1]);
 985     txdata(app,verb,4);
 986     break;
 987   case 0xDA:          // TEST MSB THROUGH CHAIN0 and CHAIN1
 988     jtagarm7tdmi_resettap();
 989     jtagarm7tdmi_scan_intest(0);
 990     cmddatalong[0] = jtagarmtransn(0x41414141, 32, LSB, NOEND, NORETIDLE);
 991     cmddatalong[1] = jtagarmtransn(0x42424242, 32, MSB, NOEND, NORETIDLE);
 992     cmddatalong[2] = jtagarmtransn(0x43434343,  9, MSB, NOEND, NORETIDLE);
 993     cmddatalong[3] = jtagarmtransn(0x44444444, 32, MSB, NOEND, NORETIDLE);
 994     cmddatalong[4] = jtagarmtransn(cmddatalong[0], 32, LSB, NOEND, NORETIDLE);
 995     cmddatalong[5] = jtagarmtransn(cmddatalong[1], 32, MSB, NOEND, NORETIDLE);
 996     cmddatalong[6] = jtagarmtransn(cmddatalong[2],  9, MSB, NOEND, NORETIDLE);
 997     cmddatalong[7] = jtagarmtransn(cmddatalong[3], 32, MSB, END, RETIDLE);
 998     jtagarm7tdmi_resettap();
 999     jtagarm7tdmi_scan_intest(1);
1000     cmddatalong[8] = jtagarmtransn(0x41414141, 32, MSB, NOEND, NORETIDLE);
1001     cmddatalong[9] = jtagarmtransn(0x44444444,  1, MSB, NOEND, NORETIDLE);
1002     cmddatalong[10] = jtagarmtransn(cmddatalong[8], 32, MSB, NOEND, NORETIDLE);
1003     cmddatalong[11] = jtagarmtransn(cmddatalong[9],  1, MSB, END, RETIDLE);
1004     jtagarm7tdmi_resettap();
1005     txdata(app,verb,48);
1006     break;
1007
1008   default:
1009     jtaghandle(app,verb,len);
1010   }
1011 }
1012
1013
1014
1015
1016 /*****************************
1017 Captured from FlySwatter against AT91SAM7S, to be used by me for testing.  ignore
1018
1019 > arm reg
1020 System and User mode registers
1021       r0: 300000df       r1: 00000000       r2: 58000000       r3: 00200a75
1022       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1023       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1024      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 000000fc
1025     cpsr: 00000093
1026
1027 FIQ mode shadow registers
1028   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1029  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1030
1031 Supervisor mode shadow registers
1032   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1033
1034 Abort mode shadow registers
1035   sp_abt: 00000000   lr_abt: 00000000 spsr_abt: e00000ff
1036
1037 IRQ mode shadow registers
1038   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1039
1040 Undefined instruction mode shadow registers
1041   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1042 >
1043 > step;arm reg
1044 target state: halted
1045 target halted in ARM state due to single-step, current mode: Supervisor
1046 cpsr: 0x00000093 pc: 0x00000100
1047 System and User mode registers
1048       r0: 300000df       r1: 00000000       r2: 00200000       r3: 00200a75
1049       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1050       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1051      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000100
1052     cpsr: 00000093
1053
1054 FIQ mode shadow registers
1055   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1056  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1057
1058 Supervisor mode shadow registers
1059   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1060
1061 Abort mode shadow registers
1062   sp_abt: 00000000   lr_abt: 00000000 spsr_abt: e00000ff
1063
1064 IRQ mode shadow registers
1065   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1066
1067 Undefined instruction mode shadow registers
1068   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1069 >
1070  step;arm reg
1071 target state: halted
1072 target halted in ARM state due to single-step, current mode: Abort
1073 cpsr: 0x00000097 pc: 0x00000010
1074 System and User mode registers
1075       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1076       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1077       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1078      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1079     cpsr: 00000097
1080
1081 FIQ mode shadow registers
1082   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1083  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1084
1085 Supervisor mode shadow registers
1086   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1087
1088 Abort mode shadow registers
1089   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1090
1091 IRQ mode shadow registers
1092   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1093
1094 Undefined instruction mode shadow registers
1095   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1096 > step;arm reg
1097 target state: halted
1098 target halted in ARM state due to single-step, current mode: Abort
1099 cpsr: 0x00000097 pc: 0x00000010
1100 System and User mode registers
1101       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1102       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1103       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1104      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1105     cpsr: 00000097
1106
1107 FIQ mode shadow registers
1108   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1109  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1110
1111 Supervisor mode shadow registers
1112   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1113
1114 Abort mode shadow registers
1115   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1116
1117 IRQ mode shadow registers
1118   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1119
1120 Undefined instruction mode shadow registers
1121   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1122 > step;arm reg
1123 target state: halted
1124 target halted in ARM state due to single-step, current mode: Abort
1125 cpsr: 0x00000097 pc: 0x00000010
1126 System and User mode registers
1127       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1128       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1129       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1130      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1131     cpsr: 00000097
1132
1133 FIQ mode shadow registers
1134   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1135  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1136
1137 Supervisor mode shadow registers
1138   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1139
1140 Abort mode shadow registers
1141   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1142
1143 IRQ mode shadow registers
1144   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1145
1146 Undefined instruction mode shadow registers
1147   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1148 > step;arm reg
1149 target state: halted
1150 target halted in ARM state due to single-step, current mode: Abort
1151 cpsr: 0x00000097 pc: 0x00000010
1152 System and User mode registers
1153       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1154       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1155       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1156      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1157     cpsr: 00000097
1158
1159 FIQ mode shadow registers
1160   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1161  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1162
1163 Supervisor mode shadow registers
1164   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1165
1166 Abort mode shadow registers
1167   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1168
1169 IRQ mode shadow registers
1170   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1171
1172 Undefined instruction mode shadow registers
1173   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1174 > step;arm reg
1175 target state: halted
1176 target halted in ARM state due to single-step, current mode: Abort
1177 cpsr: 0x00000097 pc: 0x00000010
1178 System and User mode registers
1179       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1180       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1181       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1182      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1183     cpsr: 00000097
1184
1185 FIQ mode shadow registers
1186   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1187  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1188
1189 Supervisor mode shadow registers
1190   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1191
1192 Abort mode shadow registers
1193   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1194
1195 IRQ mode shadow registers
1196   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1197
1198 Undefined instruction mode shadow registers
1199   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1200 > step;arm reg
1201 target state: halted
1202 target halted in ARM state due to single-step, current mode: Abort
1203 cpsr: 0x00000097 pc: 0x00000010
1204 System and User mode registers
1205       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1206       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1207       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1208      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1209     cpsr: 00000097
1210
1211 FIQ mode shadow registers
1212   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1213  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1214
1215 Supervisor mode shadow registers
1216   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1217
1218 Abort mode shadow registers
1219   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1220
1221 IRQ mode shadow registers
1222   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1223
1224 Undefined instruction mode shadow registers
1225   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1226 > step;arm reg
1227 target state: halted
1228 target halted in ARM state due to single-step, current mode: Abort
1229 cpsr: 0x00000097 pc: 0x00000010
1230 System and User mode registers
1231       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1232       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1233       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1234      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1235     cpsr: 00000097
1236
1237 FIQ mode shadow registers
1238   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1239  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1240
1241 Supervisor mode shadow registers
1242   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1243
1244 Abort mode shadow registers
1245   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1246
1247 IRQ mode shadow registers
1248   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1249
1250 Undefined instruction mode shadow registers
1251   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1252 > step;arm reg
1253 target state: halted
1254 target halted in ARM state due to single-step, current mode: Abort
1255 cpsr: 0x00000097 pc: 0x00000010
1256 System and User mode registers
1257       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1258       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1259       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1260      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1261     cpsr: 00000097
1262
1263 FIQ mode shadow registers
1264   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1265  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1266
1267 Supervisor mode shadow registers
1268   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1269
1270 Abort mode shadow registers
1271   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1272
1273 IRQ mode shadow registers
1274   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1275
1276 Undefined instruction mode shadow registers
1277   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1278 > step;arm reg
1279 target state: halted
1280 target halted in ARM state due to single-step, current mode: Abort
1281 cpsr: 0x00000097 pc: 0x00000010
1282 System and User mode registers
1283       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1284       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1285       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1286      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1287     cpsr: 00000097
1288
1289 FIQ mode shadow registers
1290   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1291  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1292
1293 Supervisor mode shadow registers
1294   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1295
1296 Abort mode shadow registers
1297   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1298
1299 IRQ mode shadow registers
1300   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1301
1302 Undefined instruction mode shadow registers
1303   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1304 >
1305 */