git.rot13.org Git - goodfet/blob - firmware/apps/jtag/jtagarm7tdmi.c

   1 /*! \file jtagarm7tdmi.c
   2   \brief ARM7TDMI JTAG (AT91R40008, AT91SAM7xxx)
   3 */
   4
   5 #include "platform.h"
   6 #include "command.h"
   7 #include "jtag.h"
   8 #include "jtagarm7tdmi.h"
   9
  10
  11 /**** 20-pin Connection Information (pin1 is on top-right for both connectors)****
  12 GoodFET  ->  7TDMI 20-pin connector (HE-10 connector)
  13   1               13 (TDO)
  14   2               1  (Vdd)
  15   3               5  (TDI)
  16   5               7  (TMS)
  17   7               9  (TCK)
  18   8               15 (nRST)
  19   9               4,6,8,10,12,14,16,18,20 (GND)
  20   11              17/3 (nTRST)  (different sources suggest 17 or 3 alternately)
  21 ********************************/
  22
  23 /**** 14-pin Connection Information (pin1 is on top-right for both connectors)****
  24 GoodFET  ->  7TDMI 14-pin connector
  25   1               11 (TDO)
  26   2               1  (Vdd)
  27   3               5  (TDI)
  28   5               7  (TMS)
  29   7               9  (TCK)
  30   8               12 (nRST)
  31   9               2,4,6,8,10,14 (GND)
  32   11              3 (nTRST)
  33
  34 http://hri.sourceforge.net/tools/jtag_faq_org.html
  35 ********************************/
  36
  37
  38
  39
  40
  41
  42 /****************************************************************
  43 Enabling jtag likely differs with most platforms.  We will attempt to enable most from here.  Override jtagarm7tdmi_start() to extend for other implementations
  44 ARM7TDMI enables three different scan chains:
  45     * Chain0 - "entire periphery" including data bus
  46     * Chain1 - core data bus (subset of Chain0)  - Instruction Pipeline
  47     * Chain2 - EmbeddedICE Logic Registers - This is our way into the fun stuff.
  48
  49
  50 ---
  51 You can disable EmbeddedICE-RT by setting the DBGEN input LOW.
  52 Caution
  53 Hard wiring the DBGEN input LOW permanently disables all debug functionality.
  54 When DBGEN is LOW, it inhibits DBGDEWPT, DBGIEBKPT, and EDBGRQ to
  55 the core, and DBGACK from the ARM9E-S core is always LOW.
  56 ---
  57
  58
  59 ---
  60 When the ARM9E-S core is in debug state, you can examine the core and system state
  61 by forcing the load and store multiples into the instruction pipeline.
  62 Before you can examine the core and system state, the debugger must determine
  63 whether the processor entered debug from Thumb state or ARM state, by examining
  64 bit 4 of the EmbeddedICE-RT debug status register. If bit 4 is HIGH, the core has
  65 entered debug from Thumb state.
  66 For more details about determining the core state, see Determining the core and system
  67 state on page B-18.
  68 ---
  69
  70
  71 --- olimex - http://www.olimex.com/dev/pdf/arm-jtag.pdf
  72 JTAG signals description:
  73 PIN.1 (VTREF) Target voltage sense. Used to indicate the target’s operating voltage to thedebug tool.
  74 PIN.2 (VTARGET) Target voltage. May be used to supply power to the debug tool.
  75 PIN.3 (nTRST) JTAG TAP reset, this signal should be pulled up to Vcc in target board.
  76 PIN4,6, 8, 10,12,14,16,18,20 Ground. The Gnd-Signal-Gnd-Signal strategy implemented on the 20-way connection scheme improves noiseimmunity on the target connect cable.
  77 *PIN.5 (TDI) JTAG serial data in, should be pulled up to Vcc on target board.
  78 *PIN.7 (TMS) JTAG TAP Mode Select, should be pulled up to Vcc on target board.
  79 *PIN.9 (TCK) JTAG clock.
  80 PIN.11 (RTCK) JTAG retimed clock.Implemented on certain ASIC ARM implementations the host ASIC may need to synchronize external inputs (such as JTAG inputs) with its own internal clock.
  81 *PIN.13 (TDO) JTAG serial data out.
  82 *PIN.15 (nSRST) Target system reset.
  83 *PIN.17 (DBGRQ) Asynchronous debug request.  DBGRQ allows an external signal to force the ARM core into debug mode, should be pull down to GND.
  84 PIN.19 (DBGACK) Debug acknowledge. The ARM core acknowledges debug-mode inresponse to a DBGRQ input.
  85
  86
  87 -----------  SAMPLE TIMES  -----------
  88
  89 TDI and TMS are sampled on the rising edge of TCK and TDO transitions appear on the falling edge of TCK. Therefore, TDI and TMS must be written after the falling edge of TCK and TDO must be read after the rising edge of TCK.
  90
  91 for this module, we keep tck high for all changes/sampling, and then bounce it.
  92 ****************************************************************/
  93
  94
  95
  96 /************************** JTAGARM7TDMI Primitives ****************************/
  97 void jtag_goto_shift_ir() {
  98   SETTMS;
  99   jtag_arm_tcktock();
 100   jtag_arm_tcktock();
 101   CLRTMS;
 102   jtag_arm_tcktock();
 103   jtag_arm_tcktock();
 104
 105 }
 106
 107 void jtag_goto_shift_dr() {
 108   SETTMS;
 109   jtag_arm_tcktock();
 110   CLRTMS;
 111   jtag_arm_tcktock();
 112   jtag_arm_tcktock();
 113 }
 114
 115 void jtag_reset_to_runtest_idle() {
 116   SETTMS;
 117   jtag_arm_tcktock();
 118   jtag_arm_tcktock();
 119   jtag_arm_tcktock();
 120   jtag_arm_tcktock();
 121   jtag_arm_tcktock();  // now in Reset state
 122   CLRTMS;
 123   jtag_arm_tcktock();  // now in Run-Test/Idle state
 124 }
 125
 126 void jtag_arm_tcktock() {
 127   delay(100);  // FIXME: Should never wait this long...
 128   CLRTCK;
 129   PLEDOUT^=PLEDPIN;
 130   delay(100);  // FIXME: Should never wait this long...
 131   SETTCK;
 132   PLEDOUT^=PLEDPIN;
 133 }
 134
 135
 136 // ! Start JTAG, setup pins, reset TAP and return IDCODE
 137 unsigned long jtagarm7tdmi_start() {
 138   jtagsetup();
 139   jtagarm7tdmi_resettap();
 140   return jtagarm7tdmi_idcode();
 141 }
 142
 143
 144 //! Reset TAP State Machine
 145 void jtagarm7tdmi_resettap(){               // PROVEN
 146   current_chain = -1;
 147   jtag_reset_to_runtest_idle();
 148 }
 149
 150
 151 //  NOTE: important: THIS MODULE REVOLVES AROUND RETURNING TO RUNTEST/IDLE, OR THE FUNCTIONAL EQUIVALENT
 152
 153
 154 //! Shift N bits over TDI/TDO.  May choose LSB or MSB, and select whether to terminate (TMS-high on last bit) and whether to return to RUNTEST/IDLE
 155 unsigned long jtagarmtransn(unsigned long word, unsigned char bitcount, unsigned char lsb, unsigned char end, unsigned char retidle){               // PROVEN
 156   unsigned char bit;
 157   unsigned long high = 1L;
 158   unsigned long mask;
 159
 160   //for (bit=(bitcount-1)/8; bit>0; bit--)
 161   //  high <<= 8;
 162   //high <<= ((bitcount-1)%8);
 163   high <<= (bitcount-1);
 164
 165   mask = high-1;
 166
 167   if (lsb) {
 168     for (bit = bitcount; bit > 0; bit--) {
 169       /* write MOSI on trailing edge of previous clock */
 170       if (word & 1)
 171         {SETMOSI;}
 172       else
 173         {CLRMOSI;}
 174       word >>= 1;
 175
 176       if (bit==1 && end)
 177         SETTMS;//TMS high on last bit to exit.
 178
 179       jtag_arm_tcktock();
 180
 181       /* read MISO on trailing edge */
 182       if (READMISO){
 183         word += (high);
 184       }
 185     }
 186   } else {
 187     for (bit = bitcount; bit > 0; bit--) {
 188       /* write MOSI on trailing edge of previous clock */
 189       if (word & high)
 190         {SETMOSI;}
 191       else
 192         {CLRMOSI;}
 193       word = (word & mask) << 1;
 194
 195       if (bit==1 && end)
 196         SETTMS;//TMS high on last bit to exit.
 197
 198       jtag_arm_tcktock();
 199
 200       /* read MISO on trailing edge */
 201       word |= (READMISO);
 202     }
 203   }
 204
 205
 206   SETMOSI;
 207
 208   if (end){
 209     // exit state
 210     jtag_arm_tcktock();
 211     // update state
 212     if (retidle){
 213       CLRTMS;
 214       jtag_arm_tcktock();
 215     }
 216   }
 217   return word;
 218 }
 219
 220
 221
 222 /************************************************************************
 223 * ARM7TDMI core has 6 primary registers to be connected between TDI/TDO
 224 *   * Bypass Register
 225 *   * ID Code Register
 226 *   * Scan Chain Select Register    (4 bits_lsb)
 227 *   * Scan Chain 0                  (105 bits: 32_databits_lsb + ctrlbits + 32_addrbits_msb)
 228 *   * Scan Chain 1                  (33 bits: 32_bits + BREAKPT)
 229 *   * Scan Chain 2                  (38 bits: rw + 5_regbits_msb + 32_databits_msb)
 230 ************************************************************************/
 231
 232
 233
 234 /************************** Basic JTAG Verb Commands *******************************/
 235 //! Grab the core ID.
 236 unsigned long jtagarm7tdmi_idcode(){               // PROVEN
 237   jtagarm7tdmi_resettap();
 238   SHIFT_IR;
 239   jtagarmtransn(ARM7TDMI_IR_IDCODE, 4, LSB, END, RETIDLE);
 240   SHIFT_DR;
 241   return jtagarmtransn(0,32, LSB, END, RETIDLE);
 242 }
 243
 244 //!  Connect Bypass Register to TDO/TDI
 245 unsigned char jtagarm7tdmi_bypass(){               // PROVEN
 246   jtagarm7tdmi_resettap();
 247   SHIFT_IR;
 248   return jtagarmtransn(ARM7TDMI_IR_BYPASS, 4, LSB, END, NORETIDLE);
 249 }
 250 //!  INTEST verb - do internal test
 251 unsigned char jtagarm7tdmi_intest() {
 252   SHIFT_IR;
 253   return jtagarmtransn(ARM7TDMI_IR_INTEST, 4, LSB, END, NORETIDLE);
 254 }
 255
 256 //!  EXTEST verb - act like the processor to external components
 257 unsigned char jtagarm7tdmi_extest() {
 258   SHIFT_IR;
 259   return jtagarmtransn(ARM7TDMI_IR_EXTEST, 4, LSB, END, NORETIDLE);
 260 }
 261
 262 //!  SAMPLE verb
 263 //unsigned long jtagarm7tdmi_sample() {
 264 //  jtagarm7tdmi_ir_shift4(ARM7TDMI_IR_SAMPLE);        // ???? same here.
 265 //  return jtagtransn(0,32);
 266 //}
 267
 268 //!  RESTART verb
 269 unsigned char jtagarm7tdmi_restart() {
 270   jtagarm7tdmi_resettap();
 271   SHIFT_IR;
 272   return jtagarmtransn(ARM7TDMI_IR_RESTART, 4, LSB, END, RETIDLE);
 273 }
 274
 275 //!  ARM7TDMI_IR_CLAMP               0x5
 276 //unsigned long jtagarm7tdmi_clamp() {
 277 //  jtagarm7tdmi_resettap();
 278 //  SHIFT_IR;
 279 //  jtagarmtransn(ARM7TDMI_IR_CLAMP, 4, LSB, END, NORETIDLE);
 280 //  SHIFT_DR;
 281 //  return jtagarmtransn(0, 32, LSB, END, RETIDLE);
 282 //}
 283
 284 //!  ARM7TDMI_IR_HIGHZ               0x7
 285 //unsigned char jtagarm7tdmi_highz() {
 286 //  jtagarm7tdmi_resettap();
 287 //  SHIFT_IR;
 288 //  return jtagarmtransn(ARM7TDMI_IR_HIGHZ, 4, LSB, END, NORETIDLE);
 289 //}
 290
 291 //! define ARM7TDMI_IR_CLAMPZ              0x9
 292 //unsigned char jtagarm7tdmi_clampz() {
 293 //  jtagarm7tdmi_resettap();
 294 //  SHIFT_IR;
 295 //  return jtagarmtransn(ARM7TDMI_IR_CLAMPZ, 4, LSB, END, NORETIDLE);
 296 //}
 297
 298
 299 //!  Connect the appropriate scan chain to TDO/TDI.  SCAN_N, INTEST, ENDS IN SHIFT_DR!!!!!
 300 unsigned long jtagarm7tdmi_scan(int chain, int testmode) {               // PROVEN
 301 /*
 302 When selecting a scan chain the “Run Test/Idle” state should never be reached, other-
 303 wise, when in debug state, the core will not be correctly isolated and intrusive
 304 commands occur. Therefore, it is recommended to pass directly from the “Update”
 305 state” to the “Select DR” state each time the “Update” state is reached.
 306 */
 307   unsigned long retval;
 308   if (current_chain != chain) {
 309     //debugstr("===change chains===");
 310     SHIFT_IR;
 311     jtagarmtransn(ARM7TDMI_IR_SCAN_N, 4, LSB, END, NORETIDLE);
 312     SHIFT_DR;
 313     retval = jtagarmtransn(chain, 4, LSB, END, NORETIDLE);
 314     current_chain = chain;
 315   }    else
 316     //debugstr("===NOT change chains===");
 317     retval = current_chain;
 318   // put in test mode...
 319   SHIFT_IR;
 320   jtagarmtransn(testmode, 4, LSB, END, RETIDLE);
 321   return(retval);
 322 }
 323
 324
 325 //!  Connect the appropriate scan chain to TDO/TDI.  SCAN_N, INTEST, ENDS IN SHIFT_DR!!!!!
 326 unsigned long jtagarm7tdmi_scan_intest(int chain) {               // PROVEN
 327   return jtagarm7tdmi_scan(chain, ARM7TDMI_IR_INTEST);
 328 }
 329
 330
 331
 332
 333 //! push an instruction into the pipeline
 334 unsigned long jtagarm7tdmi_instr_primitive(unsigned long instr, char breakpt){  // PROVEN
 335   unsigned long retval;
 336   jtagarm7tdmi_scan_intest(1);
 337
 338   SHIFT_DR;
 339   // if the next instruction is to run using MCLK (master clock), set TDI
 340   if (breakpt)
 341     {
 342     SETMOSI;
 343     count_sysspd_instr_since_debug++;
 344     }
 345   else
 346     {
 347     CLRMOSI;
 348     count_dbgspd_instr_since_debug++;
 349     }
 350   jtag_arm_tcktock();
 351
 352   // Now shift in the 32 bits
 353   retval = jtagarmtransn(instr, 32, MSB, END, RETIDLE);    // Must return to RUN-TEST/IDLE state for instruction to enter pipeline, and causes debug clock.
 354   return(retval);
 355
 356 }
 357
 358 //! push NOP into the instruction pipeline
 359 unsigned long jtagarm7tdmi_nop(char breakpt){  // PROVEN
 360   return jtagarm7tdmi_instr_primitive(ARM_INSTR_NOP, breakpt);
 361 }
 362
 363 /*    stolen from ARM DDI0029G documentation, translated using ARM Architecture Reference Manual (14128.pdf)
 364 STR R0, [R0]; Save R0 before use
 365 MOV R0, PC ; Copy PC into R0
 366 STR R0, [R0]; Now save the PC in R0
 367 BX PC ; Jump into ARM state
 368 MOV R8, R8 ;
 369 MOV R8, R8 ;
 370 NOP
 371 NOP
 372
 373 */
 374
 375 //! set the current mode to ARM, returns PC (FIXME).  Should be used by haltcpu(), which should also store PC and the THUMB state, for use by releasecpu();
 376 unsigned long jtagarm7tdmi_setMode_ARM(){               // PROVEN
 377   debugstr("=== Thumb Mode... Switching to ARM mode ===");
 378   unsigned long retval = 0xffL;
 379   while ((jtagarm7tdmi_get_dbgstate() & JTAG_ARM7TDMI_DBG_TBIT)&& retval-- > 0){
 380     cmddataword[6] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_NOP,0);
 381     cmddataword[1] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_STR_R0_r0,0);
 382     cmddataword[2] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_MOV_R0_PC,0);
 383     cmddataword[3] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_STR_R0_r0,0);
 384     cmddataword[4] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_BX_PC,0);
 385     cmddataword[5] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_NOP,0);
 386     cmddataword[6] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_NOP,0);
 387     jtagarm7tdmi_resettap();                  // seems necessary for some reason.  ugh.
 388   }
 389   return(retval);
 390 }
 391
 392
 393
 394
 395 /************************* EmbeddedICE Primitives ****************************/
 396 //! shifter for writing to chain2 (EmbeddedICE).
 397 unsigned long eice_write(unsigned char reg, unsigned long data){
 398   unsigned long retval, temp;
 399   debugstr("eice_write");
 400   debughex(reg);
 401   debughex32(data);
 402   jtagarm7tdmi_scan_intest(2);
 403   // Now shift in the 32 bits
 404   SHIFT_DR;
 405   retval = jtagarmtransn(data, 32, LSB, NOEND, NORETIDLE);          // send in the data - 32-bits lsb
 406   temp = jtagarmtransn(reg, 5, LSB, NOEND, NORETIDLE);              // send in the register address - 5 bits lsb
 407   jtagarmtransn(1, 1, LSB, END, RETIDLE);                           // send in the WRITE bit
 408
 409   //SETTMS;   // Last Bit - Exit UPDATE_DR
 410   //// is this update a read/write or just read?
 411   //SETMOSI;
 412   //jtag_arm_tcktock();
 413
 414   return(retval);
 415 }
 416
 417 //! shifter for reading from chain2 (EmbeddedICE).
 418 unsigned long eice_read(unsigned char reg){               // PROVEN
 419   unsigned long temp, retval;
 420   debugstr("eice_read");
 421   debughex(reg);
 422   jtagarm7tdmi_scan_intest(2);
 423
 424   // send in the register address - 5 bits LSB
 425   SHIFT_DR;
 426   temp = jtagarmtransn(reg, 5, LSB, NOEND, NORETIDLE);
 427
 428   // clear TDI to select "read only"
 429   jtagarmtransn(0L, 1, LSB, END, RETIDLE);
 430
 431   SHIFT_DR;
 432   // Now shift out the 32 bits
 433   retval = jtagarmtransn(0L, 32, LSB, END, RETIDLE);   // atmel arm jtag docs pp.10-11: LSB first
 434   debughex32(retval);
 435   return(retval);   // atmel arm jtag docs pp.10-11: LSB first
 436
 437 }
 438
 439
 440
 441
 442 /************************* ICEBreaker/EmbeddedICE Stuff ******************************/
 443 //! Grab debug register
 444 unsigned long jtagarm7tdmi_get_dbgstate() {       // ICE Debug register, *NOT* ARM register DSCR    //    PROVEN
 445   //jtagarm7tdmi_resettap();
 446   return eice_read(EICE_DBGSTATUS);
 447 }
 448
 449 //! Grab debug register
 450 unsigned long jtagarm7tdmi_get_dbgctrl() {
 451   return eice_read(EICE_DBGCTRL);
 452 }
 453
 454 //! Update debug register
 455 unsigned long jtagarm7tdmi_set_dbgctrl(unsigned long bits) {
 456   return eice_write(EICE_DBGCTRL, bits);
 457 }
 458
 459
 460
 461 //!  Set and Enable Watchpoint 0
 462 void jtagarm7tdmi_set_watchpoint0(unsigned long addr, unsigned long addrmask, unsigned long data, unsigned long datamask, unsigned long ctrl, unsigned long ctrlmask){
 463   // store watchpoint info?  - not right now
 464     // FIXME: store info
 465
 466   eice_write(EICE_WP0ADDR, addr);           // write 0 in watchpoint 0 address
 467   eice_write(EICE_WP0ADDRMASK, addrmask);   // write 0xffffffff in watchpoint 0 address mask
 468   eice_write(EICE_WP0DATA, data);           // write 0 in watchpoint 0 data
 469   eice_write(EICE_WP0DATAMASK, datamask);   // write 0xffffffff in watchpoint 0 data mask
 470   eice_write(EICE_WP0CTRL, ctrlmask);       // write 0x00000100 in watchpoint 0 control value register (enables watchpoint)
 471   eice_write(EICE_WP0CTRLMASK, ctrlmask);   // write 0xfffffff7 in watchpoint 0 control mask - only detect the fetch instruction
 472 }
 473
 474 //!  Set and Enable Watchpoint 1
 475 void jtagarm7tdmi_set_watchpoint1(unsigned long addr, unsigned long addrmask, unsigned long data, unsigned long datamask, unsigned long ctrl, unsigned long ctrlmask){
 476   // store watchpoint info?  - not right now
 477     // FIXME: store info
 478
 479   eice_write(EICE_WP1ADDR, addr);           // write 0 in watchpoint 1 address
 480   eice_write(EICE_WP1ADDRMASK, addrmask);   // write 0xffffffff in watchpoint 1 address mask
 481   eice_write(EICE_WP1DATA, data);           // write 0 in watchpoint 1 data
 482   eice_write(EICE_WP1DATAMASK, datamask);   // write 0xffffffff in watchpoint 1 data mask
 483   eice_write(EICE_WP1CTRL, ctrl);           // write 0x00000100 in watchpoint 1 control value register (enables watchpoint)
 484   eice_write(EICE_WP1CTRLMASK, ctrlmask);   // write 0xfffffff7 in watchpoint 1 control mask - only detect the fetch instruction
 485 }
 486
 487 //!  Disable Watchpoint 0
 488 void jtagarm7tdmi_disable_watchpoint0(){
 489   eice_write(EICE_WP0CTRL, 0x0L); // write 0 in watchpoint 0 control value - disables watchpoint 0
 490 }
 491
 492 //!  Disable Watchpoint 1
 493 void jtagarm7tdmi_disable_watchpoint1(){
 494   eice_write(EICE_WP1CTRL, 0x0L);            // write 0 in watchpoint 0 control value - disables watchpoint 0
 495 }
 496
 497
 498
 499 /******************** Complex Commands **************************/
 500
 501 //! Push an instruction into the CPU pipeline
 502 //  NOTE!  Must provide EXECNOPARM for parameter if no parm is required.
 503 unsigned long jtagarm7tdmi_exec(unsigned long instr, unsigned long parameter, unsigned char systemspeed) {
 504   unsigned long retval;
 505
 506   debughex32(jtagarm7tdmi_nop( 0));
 507   debughex32(jtagarm7tdmi_nop(systemspeed));
 508   debughex32(jtagarm7tdmi_instr_primitive(instr, 0));      // write 32-bit instruction code into DR
 509   debughex32(jtagarm7tdmi_nop( 0));
 510   debughex32(jtagarm7tdmi_nop( 0));
 511   debughex32(jtagarm7tdmi_instr_primitive(parameter, 0));  // inject long
 512   retval = jtagarm7tdmi_nop( 0);
 513   debughex32(retval);
 514   debughex32(jtagarm7tdmi_nop( 0));
 515   debughex32(jtagarm7tdmi_nop( 0));
 516
 517   return(retval);
 518 }
 519
 520 //! Retrieve a 32-bit Register value
 521 unsigned long jtagarm7tdmi_get_register(unsigned long reg) {
 522   unsigned long retval = 0L, instr, reg2;
 523   reg2 = (reg&0xfL)<<16;
 524   // push nop into pipeline - clean out the pipeline...
 525   instr = (unsigned long)(reg<<12L) | (unsigned long)ARM_READ_REG;   // STR Rx, [R14]
 526   instr ^= reg2;
 527   //instr = (unsigned long)(((unsigned long)reg<<12) | ARM_READ_REG);
 528   //debugstr("Reading:");
 529   debughex32(instr);
 530
 531   jtagarm7tdmi_nop( 0);
 532   jtagarm7tdmi_nop( 0);
 533   jtagarm7tdmi_nop( 0);
 534   jtagarm7tdmi_instr_primitive(instr, 0);
 535   debughex32(jtagarm7tdmi_nop( 0));                // push nop into pipeline - fetched
 536   debughex32(jtagarm7tdmi_nop( 0));                // push nop into pipeline - decoded
 537   debughex32(jtagarm7tdmi_nop( 0));                // push nop into pipeline - executed
 538   retval = jtagarm7tdmi_nop( 0);                        // recover 32-bit word
 539   debughex32(retval);
 540   debughex32(jtagarm7tdmi_nop( 0));
 541   jtagarm7tdmi_nop( 0);
 542   jtagarm7tdmi_nop( 0);
 543   return retval;
 544 }
 545
 546 //! Set a 32-bit Register value
 547 void jtagarm7tdmi_set_register(unsigned long reg, unsigned long val) {
 548   unsigned long instr, reg2;
 549   reg2 = (reg&0xfL)<<16;
 550   instr = (unsigned long)(((unsigned long)reg<<12L) | ARM_WRITE_REG); //  LDR Rx, [R14]
 551   instr ^= reg2;
 552   //instr |= (unsigned long)((((unsigned long)reg)&0x7)<<8)<<8;
 553   //debugstr("Writing:");
 554   debughex32(instr);
 555   //debughex32(val);
 556   jtagarm7tdmi_nop( 0);            // push nop into pipeline - clean out the pipeline...
 557   jtagarm7tdmi_nop( 0);            // push nop into pipeline - clean out the pipeline...
 558   jtagarm7tdmi_instr_primitive(instr, 0); // push instr into pipeline - fetch
 559   jtagarm7tdmi_nop( 0);            // push nop into pipeline - decode
 560   jtagarm7tdmi_nop( 0);            // push nop into pipeline - execute
 561
 562   //jtagarm7tdmi_instr_primitive(val, 0); // push 32-bit word on data bus
 563   jtagarm7tdmi_instr_primitive(val, 0); // push 32-bit word on data bus
 564   //jtagarm7tdmi_instr_primitive(val, 0); // push 32-bit word on data bus
 565   jtagarm7tdmi_nop( 0);            // push nop into pipeline - executed
 566   jtagarm7tdmi_nop( 0);            // push nop into pipeline - executed
 567
 568   if (reg == ARM_REG_PC){
 569     jtagarm7tdmi_nop( 0);
 570     jtagarm7tdmi_nop( 0);
 571   }
 572   jtagarm7tdmi_nop( 0);
 573 }
 574
 575
 576
 577 //! Get all registers, placing them into cmddatalong[0-15]
 578 void jtagarm7tdmi_get_registers() {
 579   debugstr("First 8 registers:");
 580   debugstr("   Instr and the first few pops from the instruction chain:");
 581   debughex32(ARM_INSTR_SKANKREGS1);
 582   debughex32(jtagarm7tdmi_nop( 0));
 583   debughex32(jtagarm7tdmi_instr_primitive(ARM_INSTR_SKANKREGS1,0));
 584   debughex32(jtagarm7tdmi_nop( 0));
 585   debughex32(jtagarm7tdmi_nop( 0));
 586   cmddatalong[ 0] = jtagarm7tdmi_nop( 0);
 587   cmddatalong[ 1] = jtagarm7tdmi_nop( 0);
 588   cmddatalong[ 2] = jtagarm7tdmi_nop( 0);
 589   cmddatalong[ 3] = jtagarm7tdmi_nop( 0);
 590   cmddatalong[ 4] = jtagarm7tdmi_nop( 0);
 591   cmddatalong[ 5] = jtagarm7tdmi_nop( 0);
 592   cmddatalong[ 6] = jtagarm7tdmi_nop( 0);
 593   cmddatalong[ 7] = jtagarm7tdmi_nop( 0);
 594
 595   debugstr("Last 8 registers:");
 596   debugstr("   Instr and the first few pops from the instruction chain:");
 597   debughex32(ARM_INSTR_SKANKREGS2);
 598   debughex32(jtagarm7tdmi_nop( 0));
 599   //jtagarm7tdmi_nop( 0);
 600   debughex32(jtagarm7tdmi_instr_primitive(ARM_INSTR_SKANKREGS2,0));
 601   debughex32(jtagarm7tdmi_nop( 0));
 602   debughex32(jtagarm7tdmi_nop( 0));
 603   //jtagarm7tdmi_nop( 0);
 604   //jtagarm7tdmi_nop( 0);
 605   cmddatalong[ 8] = jtagarm7tdmi_nop( 0);
 606   cmddatalong[ 9] = jtagarm7tdmi_nop( 0);
 607   cmddatalong[10] = jtagarm7tdmi_nop( 0);
 608   cmddatalong[11] = jtagarm7tdmi_nop( 0);
 609   cmddatalong[12] = jtagarm7tdmi_nop( 0);
 610   cmddatalong[13] = jtagarm7tdmi_nop( 0);
 611   cmddatalong[14] = jtagarm7tdmi_nop( 0);
 612   cmddatalong[15] = jtagarm7tdmi_nop( 0);
 613   jtagarm7tdmi_nop( 0);
 614 }
 615
 616 //! Set all registers from cmddatalong[0-15]
 617 void jtagarm7tdmi_set_registers() {   //FIXME: BORKEN... TOTALLY TRYING TO BUY A VOWEL
 618   debughex32(ARM_INSTR_CLOBBEREGS);
 619   jtagarm7tdmi_nop( 0);
 620   debughex32(jtagarm7tdmi_instr_primitive(ARM_INSTR_CLOBBEREGS,0));
 621   jtagarm7tdmi_nop( 0);
 622   jtagarm7tdmi_nop( 0);
 623   debughex32(jtagarm7tdmi_instr_primitive(0x40L,0));
 624   debughex32(jtagarm7tdmi_instr_primitive(0x41L,0));
 625   debughex32(jtagarm7tdmi_instr_primitive(0x42L,0));
 626   debughex32(jtagarm7tdmi_instr_primitive(0x43L,0));
 627   debughex32(jtagarm7tdmi_instr_primitive(0x44L,0));
 628   debughex32(jtagarm7tdmi_instr_primitive(0x45L,0));
 629   debughex32(jtagarm7tdmi_instr_primitive(0x46L,0));
 630   debughex32(jtagarm7tdmi_instr_primitive(0x47L,0));
 631   debughex32(jtagarm7tdmi_instr_primitive(0x48L,0));
 632   debughex32(jtagarm7tdmi_instr_primitive(0x49L,0));
 633   debughex32(jtagarm7tdmi_instr_primitive(0x4aL,0));
 634   debughex32(jtagarm7tdmi_instr_primitive(0x4bL,0));
 635   debughex32(jtagarm7tdmi_instr_primitive(0x4cL,0));
 636   debughex32(jtagarm7tdmi_instr_primitive(0x4dL,0));
 637   debughex32(jtagarm7tdmi_instr_primitive(0x4eL,0));
 638   debughex32(jtagarm7tdmi_instr_primitive(0x4fL,0));
 639 }
 640
 641 //! Retrieve the CPSR Register value
 642 unsigned long jtagarm7tdmi_get_regCPSR() {
 643   unsigned long retval = 0L;
 644
 645   debughex32(jtagarm7tdmi_nop( 0)); // push nop into pipeline - clean out the pipeline...
 646   debughex32(jtagarm7tdmi_instr_primitive(ARM_INSTR_MRS_R0_CPSR, 0)); // push MRS_R0, CPSR into pipeline
 647   debughex32(jtagarm7tdmi_nop( 0)); // push nop into pipeline - fetched
 648   debughex32(jtagarm7tdmi_nop( 0)); // push nop into pipeline - decoded
 649   debughex32(jtagarm7tdmi_nop( 0)); // push nop into pipeline - executed
 650   retval = jtagarm7tdmi_nop( 0);        // recover 32-bit word
 651   debughex32(retval);
 652   return retval;
 653 }
 654
 655 //! Retrieve the CPSR Register value
 656 unsigned long jtagarm7tdmi_set_regCPSR(unsigned long val) {
 657   unsigned long retval = 0L;
 658
 659   debughex32(jtagarm7tdmi_nop( 0));        // push nop into pipeline - clean out the pipeline...
 660   debughex32(jtagarm7tdmi_instr_primitive(ARM_INSTR_MSR_cpsr_cxsf_R0, 0)); // push MSR cpsr_cxsf, R0 into pipeline
 661   debughex32(jtagarm7tdmi_nop( 0));        // push nop into pipeline - fetched
 662   debughex32(jtagarm7tdmi_nop( 0));        // push nop into pipeline - decoded
 663
 664   retval = jtagarm7tdmi_instr_primitive(val, 0);// push 32-bit word on data bus
 665   debughex32(jtagarm7tdmi_nop( 0));        // push nop into pipeline - executed
 666   debughex32(retval);
 667   return(retval);
 668 }
 669
 670 //! Write data to address - Assume TAP in run-test/idle state
 671 unsigned long jtagarm7tdmi_writemem(unsigned long adr, unsigned long data){
 672   unsigned long r0=0L, r1=-1L;
 673
 674   r0 = jtagarm7tdmi_get_register(0);        // store R0 and R1
 675   r1 = jtagarm7tdmi_get_register(1);
 676   jtagarm7tdmi_set_register(0, adr);        // write address into R0
 677   jtagarm7tdmi_set_register(1, data);       // write data in R1
 678   jtagarm7tdmi_nop( 0);                     // push nop into pipeline to "clean" it ???
 679   jtagarm7tdmi_nop( 1);                     // push nop into pipeline with BREAKPT set
 680   jtagarm7tdmi_instr_primitive(ARM_INSTR_LDR_R1_r0_4, 0); // push LDR R1, R0, #4 into instruction pipeline
 681   jtagarm7tdmi_nop( 0);                     // push nop into pipeline
 682   jtagarm7tdmi_set_register(1, r1);         // restore R0 and R1
 683   jtagarm7tdmi_set_register(0, r0);
 684   return(-1);
 685 }
 686
 687
 688
 689
 690 //! Read data from address
 691 unsigned long jtagarm7tdmi_readmem(unsigned long adr){
 692   unsigned long retval = 0L;
 693   unsigned long r0=0L, r1=-1L;
 694   int waitcount = 0xfffL;
 695
 696   r0 = jtagarm7tdmi_get_register(0);        // store R0 and R1
 697   r1 = jtagarm7tdmi_get_register(1);
 698   jtagarm7tdmi_set_register(0, adr);        // write address into R0
 699   jtagarm7tdmi_nop( 0);                     // push nop into pipeline to "clean" it ???
 700   jtagarm7tdmi_nop( 1);                     // push nop into pipeline with BREAKPT set
 701   jtagarm7tdmi_instr_primitive(ARM_INSTR_LDR_R1_r0_4, 0); // push LDR R1, [R0], #4 into instruction pipeline
 702   jtagarm7tdmi_nop( 0);                     // push nop into pipeline
 703   jtagarm7tdmi_restart();                   // SHIFT_IR with RESTART instruction
 704
 705   // Poll the Debug Status Register for DBGACK and nMREQ to be HIGH
 706   while ((jtagarm7tdmi_get_dbgstate() & 9L) == 0  && waitcount > 0){
 707     delay(1);
 708     waitcount --;
 709   }
 710   if (waitcount == 0){
 711     return (-1);
 712   } else {
 713     retval = jtagarm7tdmi_get_register(1);  // read memory value from R1 register
 714     jtagarm7tdmi_set_register(1, r1);         // restore R0 and R1
 715     jtagarm7tdmi_set_register(0, r0);
 716   }
 717   return retval;
 718 }
 719
 720
 721 //! Read Program Counter
 722 unsigned long jtagarm7tdmi_getpc(){
 723   return jtagarm7tdmi_get_register(ARM_REG_PC);
 724 }
 725
 726 //! Set Program Counter
 727 void jtagarm7tdmi_setpc(unsigned long adr){
 728   jtagarm7tdmi_set_register(ARM_REG_PC, adr);
 729 }
 730
 731 //! Halt CPU - returns 0xffff if the operation fails to complete within
 732 unsigned long jtagarm7tdmi_haltcpu(){                   //  PROVEN
 733   int waitcount = 0xfffL;
 734
 735 /********  OLD WAY  ********/
 736   // store watchpoint info?  - not right now
 737   eice_write(EICE_WP1ADDR, 0L);              // write 0 in watchpoint 1 address
 738   eice_write(EICE_WP1ADDRMASK, 0xffffffff); // write 0xffffffff in watchpoint 1 address mask
 739   eice_write(EICE_WP1DATA, 0L);              // write 0 in watchpoint 1 data
 740   eice_write(EICE_WP1DATAMASK, 0xffffffff); // write 0xffffffff in watchpoint 1 data mask
 741   eice_write(EICE_WP1CTRL, 0x100L);          // write 0x00000100 in watchpoint 1 control value register (enables watchpoint)
 742   eice_write(EICE_WP1CTRLMASK, 0xfffffff7); // write 0xfffffff7 in watchpoint 1 control mask - only detect the fetch instruction
 743 /***************************/
 744
 745 /********  NEW WAY  *********/
 746 //  eice_write(EICE_DBGCTRL, JTAG_ARM7TDMI_DBG_DBGRQ);  // r/o register?
 747 /****************************/
 748
 749   // poll until debug status says the cpu is in debug mode
 750   while (!(jtagarm7tdmi_get_dbgstate() & 0x1L)   && waitcount-- > 0){
 751     delay(1);
 752   }
 753
 754 /********  OLD WAY  ********/
 755   eice_write(EICE_WP1CTRL, 0x0L);            // write 0 in watchpoint 0 control value - disables watchpoint 0
 756 /***************************/
 757
 758 /********  NEW WAY  ********/
 759 //  eice_write(EICE_DBGCTRL, 0);        // r/o register?
 760 /***************************/
 761
 762   // store the debug state
 763   last_halt_debug_state = jtagarm7tdmi_get_dbgstate();
 764   last_halt_pc = jtagarm7tdmi_getpc() - 4;  // assume -4 for entering debug mode via watchpoint.
 765   count_dbgspd_instr_since_debug = 0L;
 766   count_sysspd_instr_since_debug = 0L;
 767
 768   // get into ARM mode if the T flag is set (Thumb mode)
 769   while (jtagarm7tdmi_get_dbgstate() & JTAG_ARM7TDMI_DBG_TBIT && waitcount-- > 0) {
 770     jtagarm7tdmi_setMode_ARM();
 771   }
 772   jtagarm7tdmi_resettap();
 773   return waitcount;
 774 }
 775
 776 unsigned long jtagarm7tdmi_releasecpu(){
 777   int waitcount = 0xfff;
 778   unsigned long instr;
 779   // somehow determine what PC should be (a couple ways possible, calculations required)
 780   jtagarm7tdmi_nop(0);                          // NOP
 781   jtagarm7tdmi_nop(1);                          // NOP/BREAKPT
 782
 783   if (last_halt_debug_state & JTAG_ARM7TDMI_DBG_TBIT){      // FIXME:  FORNICATED!  BX requires register, thus more instrs... could we get away with the same instruction but +1 to offset?
 784     instr = ARM_INSTR_B_PC + 0x1000001 - (count_dbgspd_instr_since_debug) - (count_sysspd_instr_since_debug*3);  //FIXME: make this right  - can't we just do an a7solute b/bx?
 785     jtagarm7tdmi_instr_primitive(instr,0);
 786   } else {
 787     instr = ARM_INSTR_B_PC + 0x1000000 - (count_dbgspd_instr_since_debug*4) - (count_sysspd_instr_since_debug*12);
 788     jtagarm7tdmi_instr_primitive(instr,0);
 789   }
 790
 791   SHIFT_IR;
 792   jtagarmtransn(ARM7TDMI_IR_RESTART,4,LSB,END,RETIDLE); // VERB_RESTART
 793
 794   // wait until restart-bit set in debug state register
 795   while ((jtagarm7tdmi_get_dbgstate() & JTAG_ARM7TDMI_DBG_DBGACK) && waitcount > 0){
 796     msdelay(1);
 797     waitcount --;
 798   }
 799   last_halt_debug_state = -1;
 800   last_halt_pc = -1;
 801   return 0;
 802 }
 803
 804
 805
 806
 807 ///////////////////////////////////////////////////////////////////////////////////////////////////
 808 //! Handles ARM7TDMI JTAG commands.  Forwards others to JTAG.
 809 void jtagarm7tdmihandle(unsigned char app, unsigned char verb, unsigned long len){
 810   register char blocks;
 811
 812   unsigned int i,val;
 813   unsigned long at;
 814
 815   jtagarm7tdmi_resettap();
 816
 817   switch(verb){
 818   case START:
 819     //Enter JTAG mode.
 820     debughex32(jtagarm7tdmi_start());
 821     debughex32(jtagarm7tdmi_haltcpu());
 822     //jtagarm7tdmi_resettap();
 823     cmddatalong[0] = jtagarm7tdmi_get_dbgstate();
 824
 825     txdata(app,verb,0x4);
 826     break;
 827   case JTAGARM7TDMI_READMEM:
 828   case PEEK:
 829     at     = cmddatalong[0];
 830     blocks = cmddatalong[1];
 831
 832     txhead(app,verb,len);
 833
 834         jtagarm7tdmi_resettap();
 835         delay(10);
 836
 837     for(i=0;i<blocks;i++){
 838           val=jtagarm7tdmi_readmem(at);
 839
 840           serial_tx(val&0xFFL);
 841           serial_tx((val&0xFF00L)>>8);
 842           serial_tx((val&0xFF0000L)>>8);
 843           serial_tx((val&0xFF000000L)>>8);
 844           at+=4;
 845       }
 846
 847
 848     break;
 849   case JTAGARM7TDMI_GET_CHIP_ID:
 850         jtagarm7tdmi_resettap();
 851     cmddatalong[0] = jtagarm7tdmi_idcode();
 852     txdata(app,verb,4);
 853     break;
 854
 855
 856   case JTAGARM7TDMI_WRITEMEM:
 857   case POKE:
 858         jtagarm7tdmi_resettap();
 859     jtagarm7tdmi_writemem(cmddatalong[0],
 860                        cmddataword[2]);
 861     cmddataword[0]=jtagarm7tdmi_readmem(cmddatalong[0]);
 862     txdata(app,verb,2);
 863     break;
 864
 865   case JTAGARM7TDMI_HALTCPU:
 866     cmddatalong[0] = jtagarm7tdmi_haltcpu();
 867     txdata(app,verb,4);
 868     break;
 869   case JTAGARM7TDMI_RELEASECPU:
 870         jtagarm7tdmi_resettap();
 871     cmddatalong[0] = jtagarm7tdmi_releasecpu();
 872     txdata(app,verb,4);
 873     break;
 874   //unimplemented functions
 875   //case JTAGARM7TDMI_SETINSTRFETCH:
 876   //case JTAGARM7TDMI_WRITEFLASH:
 877   //case JTAGARM7TDMI_ERASEFLASH:
 878   case JTAGARM7TDMI_SET_PC:
 879     jtagarm7tdmi_setpc(cmddatalong[0]);
 880     txdata(app,verb,0);
 881     break;
 882   case JTAGARM7TDMI_GET_DEBUG_CTRL:
 883     cmddatalong[0] = jtagarm7tdmi_get_dbgctrl();
 884     txdata(app,verb,1);
 885     break;
 886   case JTAGARM7TDMI_SET_DEBUG_CTRL:
 887     cmddatalong[0] = jtagarm7tdmi_set_dbgctrl(cmddata[0]);
 888     txdata(app,verb,4);
 889     break;
 890   case JTAGARM7TDMI_GET_PC:
 891     cmddatalong[0] = jtagarm7tdmi_getpc();
 892     txdata(app,verb,4);
 893     break;
 894   case JTAGARM7TDMI_GET_DEBUG_STATE:
 895     //jtagarm7tdmi_resettap();            // Shouldn't need this, but currently do.  FIXME!
 896     cmddatalong[0] = jtagarm7tdmi_get_dbgstate();
 897     txdata(app,verb,4);
 898     break;
 899   //case JTAGARM7TDMI_GET_WATCHPOINT:
 900   //case JTAGARM7TDMI_SET_WATCHPOINT:
 901   case JTAGARM7TDMI_GET_REGISTER:
 902         jtagarm7tdmi_resettap();
 903     val = cmddata[0];
 904     cmddatalong[0] = jtagarm7tdmi_get_register(val);
 905     //debughex32(cmddatalong[0]);
 906     txdata(app,verb,4);
 907     break;
 908   case JTAGARM7TDMI_SET_REGISTER:           // FIXME: NOT AT ALL CORRECT, THIS IS TESTING CODE ONLY
 909         jtagarm7tdmi_resettap();
 910     debughex32(cmddatalong[1]);
 911     jtagarm7tdmi_set_register(cmddata[0], cmddatalong[1]);
 912     cmddatalong[0] = cmddatalong[1];
 913     txdata(app,verb,4);
 914     break;
 915   case JTAGARM7TDMI_GET_REGISTERS:
 916         jtagarm7tdmi_resettap();
 917     jtagarm7tdmi_get_registers();
 918     txdata(app,verb,64);
 919     break;
 920   case JTAGARM7TDMI_SET_REGISTERS:
 921         jtagarm7tdmi_resettap();
 922     jtagarm7tdmi_set_registers();
 923     txdata(app,verb,64);
 924     break;
 925   case JTAGARM7TDMI_DEBUG_INSTR:
 926         jtagarm7tdmi_resettap();
 927     cmddataword[0] = jtagarm7tdmi_exec(cmddataword[0], cmddataword[1], cmddata[9]);
 928     txdata(app,verb,80);
 929     break;
 930   //case JTAGARM7TDMI_STEP_INSTR:
 931 /*  case JTAGARM7TDMI_READ_CODE_MEMORY:
 932   case JTAGARM7TDMI_WRITE_FLASH_PAGE:
 933   case JTAGARM7TDMI_READ_FLASH_PAGE:
 934   case JTAGARM7TDMI_MASS_ERASE_FLASH:
 935   case JTAGARM7TDMI_PROGRAM_FLASH:
 936   case JTAGARM7TDMI_LOCKCHIP:
 937   case JTAGARM7TDMI_CHIP_ERASE:
 938   */
 939 // Really ARM specific stuff
 940   case JTAGARM7TDMI_GET_CPSR:
 941         jtagarm7tdmi_resettap();
 942     cmddatalong[0] = jtagarm7tdmi_get_regCPSR();
 943     txdata(app,verb,4);
 944     break;
 945   case JTAGARM7TDMI_SET_CPSR:
 946         jtagarm7tdmi_resettap();
 947     cmddatalong[0] = jtagarm7tdmi_set_regCPSR(cmddatalong[0]);
 948     txdata(app,verb,4);
 949     break;
 950   case JTAGARM7TDMI_GET_SPSR:           // FIXME: NOT CORRECT
 951         jtagarm7tdmi_resettap();
 952     cmddatalong[0] = jtagarm7tdmi_get_regCPSR();
 953     txdata(app,verb,4);
 954     break;
 955   case JTAGARM7TDMI_SET_SPSR:           // FIXME: NOT CORRECT
 956         jtagarm7tdmi_resettap();
 957     cmddatalong[0] = jtagarm7tdmi_set_regCPSR(cmddatalong[0]);
 958     txdata(app,verb,4);
 959     break;
 960   case JTAGARM7TDMI_SET_MODE_THUMB:
 961   case JTAGARM7TDMI_SET_MODE_ARM:
 962         jtagarm7tdmi_resettap();
 963     cmddataword[0] = jtagarm7tdmi_setMode_ARM();
 964     txdata(app,verb,4);
 965     break;
 966
 967   case 0xD0:          // loopback test
 968     jtagarm7tdmi_resettap();
 969     cmddatalong[0] = jtagarm7tdmi_bypass(cmddatalong[0]);
 970     txdata(app,verb,4);
 971     break;
 972   case 0xD8:          // EICE_READ
 973     jtagarm7tdmi_resettap();
 974     cmddatalong[0] = eice_read(cmddatalong[0]);
 975     txdata(app,verb,4);
 976     break;
 977   case 0xD9:          // EICE_WRITE
 978     jtagarm7tdmi_resettap();
 979     cmddatalong[0] = eice_write(cmddatalong[0], cmddatalong[1]);
 980     txdata(app,verb,4);
 981     break;
 982   case 0xDA:          // TEST MSB THROUGH CHAIN0 and CHAIN1
 983     jtagarm7tdmi_resettap();
 984     jtagarm7tdmi_scan_intest(0);
 985     cmddatalong[0] = jtagarmtransn(0x41414141, 32, LSB, NOEND, NORETIDLE);
 986     cmddatalong[1] = jtagarmtransn(0x42424242, 32, MSB, NOEND, NORETIDLE);
 987     cmddatalong[2] = jtagarmtransn(0x43434343,  9, MSB, NOEND, NORETIDLE);
 988     cmddatalong[3] = jtagarmtransn(0x44444444, 32, MSB, NOEND, NORETIDLE);
 989     cmddatalong[4] = jtagarmtransn(cmddatalong[0], 32, LSB, NOEND, NORETIDLE);
 990     cmddatalong[5] = jtagarmtransn(cmddatalong[1], 32, MSB, NOEND, NORETIDLE);
 991     cmddatalong[6] = jtagarmtransn(cmddatalong[2],  9, MSB, NOEND, NORETIDLE);
 992     cmddatalong[7] = jtagarmtransn(cmddatalong[3], 32, MSB, END, RETIDLE);
 993     jtagarm7tdmi_resettap();
 994     jtagarm7tdmi_scan_intest(1);
 995     cmddatalong[8] = jtagarmtransn(0x41414141, 32, MSB, NOEND, NORETIDLE);
 996     cmddatalong[9] = jtagarmtransn(0x44444444,  1, MSB, NOEND, NORETIDLE);
 997     cmddatalong[10] = jtagarmtransn(cmddatalong[8], 32, MSB, NOEND, NORETIDLE);
 998     cmddatalong[11] = jtagarmtransn(cmddatalong[9],  1, MSB, END, RETIDLE);
 999     jtagarm7tdmi_resettap();
1000     txdata(app,verb,48);
1001     break;
1002
1003   default:
1004     jtaghandle(app,verb,len);
1005   }
1006 }
1007
1008
1009
1010
1011 /*****************************
1012 Captured from FlySwatter against AT91SAM7S, to be used by me for testing.  ignore
1013
1014 > arm reg
1015 System and User mode registers
1016       r0: 300000df       r1: 00000000       r2: 58000000       r3: 00200a75
1017       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1018       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1019      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 000000fc
1020     cpsr: 00000093
1021
1022 FIQ mode shadow registers
1023   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1024  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1025
1026 Supervisor mode shadow registers
1027   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1028
1029 Abort mode shadow registers
1030   sp_abt: 00000000   lr_abt: 00000000 spsr_abt: e00000ff
1031
1032 IRQ mode shadow registers
1033   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1034
1035 Undefined instruction mode shadow registers
1036   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1037 >
1038 > step;arm reg
1039 target state: halted
1040 target halted in ARM state due to single-step, current mode: Supervisor
1041 cpsr: 0x00000093 pc: 0x00000100
1042 System and User mode registers
1043       r0: 300000df       r1: 00000000       r2: 00200000       r3: 00200a75
1044       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1045       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1046      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000100
1047     cpsr: 00000093
1048
1049 FIQ mode shadow registers
1050   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1051  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1052
1053 Supervisor mode shadow registers
1054   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1055
1056 Abort mode shadow registers
1057   sp_abt: 00000000   lr_abt: 00000000 spsr_abt: e00000ff
1058
1059 IRQ mode shadow registers
1060   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1061
1062 Undefined instruction mode shadow registers
1063   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1064 >
1065  step;arm reg
1066 target state: halted
1067 target halted in ARM state due to single-step, current mode: Abort
1068 cpsr: 0x00000097 pc: 0x00000010
1069 System and User mode registers
1070       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1071       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1072       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1073      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1074     cpsr: 00000097
1075
1076 FIQ mode shadow registers
1077   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1078  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1079
1080 Supervisor mode shadow registers
1081   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1082
1083 Abort mode shadow registers
1084   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1085
1086 IRQ mode shadow registers
1087   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1088
1089 Undefined instruction mode shadow registers
1090   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1091 > step;arm reg
1092 target state: halted
1093 target halted in ARM state due to single-step, current mode: Abort
1094 cpsr: 0x00000097 pc: 0x00000010
1095 System and User mode registers
1096       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1097       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1098       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1099      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1100     cpsr: 00000097
1101
1102 FIQ mode shadow registers
1103   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1104  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1105
1106 Supervisor mode shadow registers
1107   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1108
1109 Abort mode shadow registers
1110   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1111
1112 IRQ mode shadow registers
1113   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1114
1115 Undefined instruction mode shadow registers
1116   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1117 > step;arm reg
1118 target state: halted
1119 target halted in ARM state due to single-step, current mode: Abort
1120 cpsr: 0x00000097 pc: 0x00000010
1121 System and User mode registers
1122       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1123       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1124       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1125      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1126     cpsr: 00000097
1127
1128 FIQ mode shadow registers
1129   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1130  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1131
1132 Supervisor mode shadow registers
1133   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1134
1135 Abort mode shadow registers
1136   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1137
1138 IRQ mode shadow registers
1139   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1140
1141 Undefined instruction mode shadow registers
1142   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1143 > step;arm reg
1144 target state: halted
1145 target halted in ARM state due to single-step, current mode: Abort
1146 cpsr: 0x00000097 pc: 0x00000010
1147 System and User mode registers
1148       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1149       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1150       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1151      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1152     cpsr: 00000097
1153
1154 FIQ mode shadow registers
1155   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1156  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1157
1158 Supervisor mode shadow registers
1159   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1160
1161 Abort mode shadow registers
1162   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1163
1164 IRQ mode shadow registers
1165   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1166
1167 Undefined instruction mode shadow registers
1168   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1169 > step;arm reg
1170 target state: halted
1171 target halted in ARM state due to single-step, current mode: Abort
1172 cpsr: 0x00000097 pc: 0x00000010
1173 System and User mode registers
1174       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1175       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1176       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1177      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1178     cpsr: 00000097
1179
1180 FIQ mode shadow registers
1181   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1182  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1183
1184 Supervisor mode shadow registers
1185   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1186
1187 Abort mode shadow registers
1188   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1189
1190 IRQ mode shadow registers
1191   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1192
1193 Undefined instruction mode shadow registers
1194   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1195 > step;arm reg
1196 target state: halted
1197 target halted in ARM state due to single-step, current mode: Abort
1198 cpsr: 0x00000097 pc: 0x00000010
1199 System and User mode registers
1200       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1201       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1202       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1203      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1204     cpsr: 00000097
1205
1206 FIQ mode shadow registers
1207   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1208  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1209
1210 Supervisor mode shadow registers
1211   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1212
1213 Abort mode shadow registers
1214   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1215
1216 IRQ mode shadow registers
1217   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1218
1219 Undefined instruction mode shadow registers
1220   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1221 > step;arm reg
1222 target state: halted
1223 target halted in ARM state due to single-step, current mode: Abort
1224 cpsr: 0x00000097 pc: 0x00000010
1225 System and User mode registers
1226       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1227       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1228       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1229      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1230     cpsr: 00000097
1231
1232 FIQ mode shadow registers
1233   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1234  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1235
1236 Supervisor mode shadow registers
1237   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1238
1239 Abort mode shadow registers
1240   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1241
1242 IRQ mode shadow registers
1243   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1244
1245 Undefined instruction mode shadow registers
1246   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1247 > step;arm reg
1248 target state: halted
1249 target halted in ARM state due to single-step, current mode: Abort
1250 cpsr: 0x00000097 pc: 0x00000010
1251 System and User mode registers
1252       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1253       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1254       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1255      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1256     cpsr: 00000097
1257
1258 FIQ mode shadow registers
1259   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1260  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1261
1262 Supervisor mode shadow registers
1263   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1264
1265 Abort mode shadow registers
1266   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1267
1268 IRQ mode shadow registers
1269   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1270
1271 Undefined instruction mode shadow registers
1272   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1273 > step;arm reg
1274 target state: halted
1275 target halted in ARM state due to single-step, current mode: Abort
1276 cpsr: 0x00000097 pc: 0x00000010
1277 System and User mode registers
1278       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1279       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1280       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1281      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1282     cpsr: 00000097
1283
1284 FIQ mode shadow registers
1285   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1286  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1287
1288 Supervisor mode shadow registers
1289   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1290
1291 Abort mode shadow registers
1292   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1293
1294 IRQ mode shadow registers
1295   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1296
1297 Undefined instruction mode shadow registers
1298   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1299 >
1300 */