More EM260 code. RNG works only after another board has initialized the chip.
[goodfet] / firmware / apps / jtag / jtagarm7tdmi.c
1 /*! \file jtagarm7tdmi.c
2   \brief ARM7TDMI JTAG (AT91R40008, AT91SAM7xxx)
3 */
4
5 #include "platform.h"
6 #include "command.h"
7 #include "jtag.h"
8 #include "jtagarm7tdmi.h"
9
10
11 /**** 20-pin Connection Information (pin1 is on top-right for both connectors)****
12 GoodFET  ->  7TDMI 20-pin connector (HE-10 connector)
13   1               13 (TDO)
14   2               1  (Vdd)
15   3               5  (TDI)
16   5               7  (TMS)
17   7               9  (TCK)
18   8               15 (nRST)
19   9               4,6,8,10,12,14,16,18,20 (GND)
20   11              17/3 (nTRST)  (different sources suggest 17 or 3 alternately)
21 ********************************/
22
23 /**** 14-pin Connection Information (pin1 is on top-right for both connectors)****
24 GoodFET  ->  7TDMI 14-pin connector
25   1               11 (TDO)
26   2               1  (Vdd)
27   3               5  (TDI)
28   5               7  (TMS)
29   7               9  (TCK)
30   8               12 (nRST)
31   9               2,4,6,8,10,14 (GND)
32   11              3 (nTRST)
33
34 http://hri.sourceforge.net/tools/jtag_faq_org.html
35 ********************************/
36
37
38
39
40
41
42 /****************************************************************
43 Enabling jtag likely differs with most platforms.  We will attempt to enable most from here.  Override jtagarm7tdmi_start() to extend for other implementations
44 ARM7TDMI enables three different scan chains:
45     * Chain0 - "entire periphery" including data bus
46     * Chain1 - core data bus (subset of Chain0)  - Instruction Pipeline
47     * Chain2 - EmbeddedICE Logic Registers - This is our way into the fun stuff.
48     
49
50 ---
51 You can disable EmbeddedICE-RT by setting the DBGEN input LOW.
52 Caution
53 Hard wiring the DBGEN input LOW permanently disables all debug functionality.
54 When DBGEN is LOW, it inhibits DBGDEWPT, DBGIEBKPT, and EDBGRQ to
55 the core, and DBGACK from the ARM9E-S core is always LOW.
56 ---
57
58
59 ---
60 When the ARM9E-S core is in debug state, you can examine the core and system state
61 by forcing the load and store multiples into the instruction pipeline.
62 Before you can examine the core and system state, the debugger must determine
63 whether the processor entered debug from Thumb state or ARM state, by examining
64 bit 4 of the EmbeddedICE-RT debug status register. If bit 4 is HIGH, the core has
65 entered debug from Thumb state.
66 For more details about determining the core state, see Determining the core and system
67 state on page B-18.
68 ---
69
70
71 --- olimex - http://www.olimex.com/dev/pdf/arm-jtag.pdf
72 JTAG signals description:
73 PIN.1 (VTREF) Target voltage sense. Used to indicate the target’s operating voltage to thedebug tool.
74 PIN.2 (VTARGET) Target voltage. May be used to supply power to the debug tool.
75 PIN.3 (nTRST) JTAG TAP reset, this signal should be pulled up to Vcc in target board.
76 PIN4,6, 8, 10,12,14,16,18,20 Ground. The Gnd-Signal-Gnd-Signal strategy implemented on the 20-way connection scheme improves noiseimmunity on the target connect cable.
77 *PIN.5 (TDI) JTAG serial data in, should be pulled up to Vcc on target board.
78 *PIN.7 (TMS) JTAG TAP Mode Select, should be pulled up to Vcc on target board.
79 *PIN.9 (TCK) JTAG clock.
80 PIN.11 (RTCK) JTAG retimed clock.Implemented on certain ASIC ARM implementations the host ASIC may need to synchronize external inputs (such as JTAG inputs) with its own internal clock.
81 *PIN.13 (TDO) JTAG serial data out.
82 *PIN.15 (nSRST) Target system reset.
83 *PIN.17 (DBGRQ) Asynchronous debug request.  DBGRQ allows an external signal to force the ARM core into debug mode, should be pull down to GND.
84 PIN.19 (DBGACK) Debug acknowledge. The ARM core acknowledges debug-mode inresponse to a DBGRQ input.
85
86
87 -----------  SAMPLE TIMES  -----------
88
89 TDI and TMS are sampled on the rising edge of TCK and TDO transitions appear on the falling edge of TCK. Therefore, TDI and TMS must be written after the falling edge of TCK and TDO must be read after the rising edge of TCK.
90
91 for this module, we keep tck high for all changes/sampling, and then bounce it.
92 ****************************************************************/
93
94
95
96 /************************** JTAGARM7TDMI Primitives ****************************/
97 void jtag_goto_shift_ir() {
98   SETTMS;
99   jtag_arm_tcktock();
100   jtag_arm_tcktock();
101   CLRTMS;
102   jtag_arm_tcktock();
103   jtag_arm_tcktock();
104
105 }
106
107 void jtag_goto_shift_dr() {
108   SETTMS;
109   jtag_arm_tcktock();
110   CLRTMS;
111   jtag_arm_tcktock();
112   jtag_arm_tcktock();
113 }
114
115 void jtag_reset_to_runtest_idle() {
116   SETTMS;
117   jtag_arm_tcktock();
118   jtag_arm_tcktock();
119   jtag_arm_tcktock();
120   jtag_arm_tcktock();
121   jtag_arm_tcktock();  // now in Reset state
122   CLRTMS;
123   jtag_arm_tcktock();  // now in Run-Test/Idle state
124 }
125
126 void jtag_arm_tcktock() {
127   delay(1);  // FIXME: Should never wait this long...
128   CLRTCK; 
129   PLEDOUT^=PLEDPIN; 
130   delay(1);  // FIXME: Should never wait this long...
131   SETTCK; 
132   PLEDOUT^=PLEDPIN;
133 }
134
135
136 // ! Start JTAG, setup pins, reset TAP and return IDCODE
137 unsigned long jtagarm7tdmi_start() {
138   jtagsetup();
139   jtagarm7tdmi_resettap();
140   return jtagarm7tdmi_idcode();
141 }
142
143
144 //! Reset TAP State Machine       
145 void jtagarm7tdmi_resettap(){               // PROVEN
146   current_chain = -1;
147   jtag_reset_to_runtest_idle();
148 }
149
150
151 //  NOTE: important: THIS MODULE REVOLVES AROUND RETURNING TO RUNTEST/IDLE, OR THE FUNCTIONAL EQUIVALENT
152
153
154 //! Shift N bits over TDI/TDO.  May choose LSB or MSB, and select whether to terminate (TMS-high on last bit) and whether to return to RUNTEST/IDLE
155 unsigned long jtagarmtransn(unsigned long word, unsigned char bitcount, unsigned char lsb, unsigned char end, unsigned char retidle){               // PROVEN
156   unsigned char bit;
157   unsigned long high = 1L;
158   unsigned long mask;
159
160   //for (bit=(bitcount-1)/8; bit>0; bit--)
161   //  high <<= 8;
162   //high <<= ((bitcount-1)%8);
163   high <<= (bitcount-1);
164
165   mask = high-1;
166
167   if (lsb) {
168     for (bit = bitcount; bit > 0; bit--) {
169       /* write MOSI on trailing edge of previous clock */
170       if (word & 1)
171         {SETMOSI;}
172       else
173         {CLRMOSI;}
174       word >>= 1;
175
176       if (bit==1 && end)
177         SETTMS;//TMS high on last bit to exit.
178        
179       jtag_arm_tcktock();
180
181       /* read MISO on trailing edge */
182       if (READMISO){
183         word += (high);
184       }
185     }
186   } else {
187     for (bit = bitcount; bit > 0; bit--) {
188       /* write MOSI on trailing edge of previous clock */
189       if (word & high)
190         {SETMOSI;}
191       else
192         {CLRMOSI;}
193       word = (word & mask) << 1;
194
195       if (bit==1 && end)
196         SETTMS;//TMS high on last bit to exit.
197
198       jtag_arm_tcktock();
199
200       /* read MISO on trailing edge */
201       word |= (READMISO);
202     }
203   }
204  
205
206   SETMOSI;
207
208   if (end){
209     // exit state
210     jtag_arm_tcktock();
211     // update state
212     if (retidle){
213       CLRTMS;
214       jtag_arm_tcktock();
215     }
216   }
217   return word;
218 }
219
220
221
222 /************************************************************************
223 * ARM7TDMI core has 6 primary registers to be connected between TDI/TDO
224 *   * Bypass Register
225 *   * ID Code Register
226 *   * Scan Chain Select Register    (4 bits_lsb)
227 *   * Scan Chain 0                  (105 bits: 32_databits_lsb + ctrlbits + 32_addrbits_msb)
228 *   * Scan Chain 1                  (33 bits: 32_bits + BREAKPT)
229 *   * Scan Chain 2                  (38 bits: rw + 5_regbits_msb + 32_databits_msb)
230 ************************************************************************/
231
232
233
234 /************************** Basic JTAG Verb Commands *******************************/
235 //! Grab the core ID.
236 unsigned long jtagarm7tdmi_idcode(){               // PROVEN
237   jtagarm7tdmi_resettap();
238   SHIFT_IR;
239   jtagarmtransn(ARM7TDMI_IR_IDCODE, 4, LSB, END, RETIDLE);
240   SHIFT_DR;
241   return jtagarmtransn(0,32, LSB, END, RETIDLE);
242 }
243
244 //!  Connect Bypass Register to TDO/TDI
245 unsigned char jtagarm7tdmi_bypass(){               // PROVEN
246   jtagarm7tdmi_resettap();
247   SHIFT_IR;
248   return jtagarmtransn(ARM7TDMI_IR_BYPASS, 4, LSB, END, NORETIDLE);
249 }
250 //!  INTEST verb - do internal test
251 unsigned char jtagarm7tdmi_intest() { 
252   SHIFT_IR;
253   return jtagarmtransn(ARM7TDMI_IR_INTEST, 4, LSB, END, NORETIDLE); 
254 }
255
256 //!  EXTEST verb - act like the processor to external components
257 unsigned char jtagarm7tdmi_extest() { 
258   SHIFT_IR;
259   return jtagarmtransn(ARM7TDMI_IR_EXTEST, 4, LSB, END, NORETIDLE);
260 }
261
262 //!  SAMPLE verb
263 //unsigned long jtagarm7tdmi_sample() { 
264 //  jtagarm7tdmi_ir_shift4(ARM7TDMI_IR_SAMPLE);        // ???? same here.
265 //  return jtagtransn(0,32);
266 //}
267
268 //!  RESTART verb
269 unsigned char jtagarm7tdmi_restart() { 
270   jtagarm7tdmi_resettap();
271   SHIFT_IR;
272   return jtagarmtransn(ARM7TDMI_IR_RESTART, 4, LSB, END, RETIDLE); 
273 }
274
275 //!  ARM7TDMI_IR_CLAMP               0x5
276 //unsigned long jtagarm7tdmi_clamp() { 
277 //  jtagarm7tdmi_resettap();
278 //  SHIFT_IR;
279 //  jtagarmtransn(ARM7TDMI_IR_CLAMP, 4, LSB, END, NORETIDLE);
280 //  SHIFT_DR;
281 //  return jtagarmtransn(0, 32, LSB, END, RETIDLE);
282 //}
283
284 //!  ARM7TDMI_IR_HIGHZ               0x7
285 //unsigned char jtagarm7tdmi_highz() { 
286 //  jtagarm7tdmi_resettap();
287 //  SHIFT_IR;
288 //  return jtagarmtransn(ARM7TDMI_IR_HIGHZ, 4, LSB, END, NORETIDLE);
289 //}
290
291 //! define ARM7TDMI_IR_CLAMPZ              0x9
292 //unsigned char jtagarm7tdmi_clampz() { 
293 //  jtagarm7tdmi_resettap();
294 //  SHIFT_IR;
295 //  return jtagarmtransn(ARM7TDMI_IR_CLAMPZ, 4, LSB, END, NORETIDLE);
296 //}
297
298
299 //!  Connect the appropriate scan chain to TDO/TDI.  SCAN_N, INTEST, ENDS IN SHIFT_DR!!!!!
300 unsigned long jtagarm7tdmi_scan(int chain, int testmode) {               // PROVEN
301 /*
302 When selecting a scan chain the “Run Test/Idle” state should never be reached, other-
303 wise, when in debug state, the core will not be correctly isolated and intrusive
304 commands occur. Therefore, it is recommended to pass directly from the “Update”
305 state” to the “Select DR” state each time the “Update” state is reached.
306 */
307   unsigned long retval;
308   if (current_chain != chain) {
309     //debugstr("===change chains===");
310     SHIFT_IR;
311     jtagarmtransn(ARM7TDMI_IR_SCAN_N, 4, LSB, END, NORETIDLE);
312     SHIFT_DR;
313     retval = jtagarmtransn(chain, 4, LSB, END, NORETIDLE);
314     current_chain = chain;
315   }    else
316     //debugstr("===NOT change chains===");
317     retval = current_chain;
318   // put in test mode...
319   SHIFT_IR;
320   jtagarmtransn(testmode, 4, LSB, END, RETIDLE); 
321   return(retval);
322 }
323
324
325 //!  Connect the appropriate scan chain to TDO/TDI.  SCAN_N, INTEST, ENDS IN SHIFT_DR!!!!!
326 unsigned long jtagarm7tdmi_scan_intest(int chain) {               // PROVEN
327   return jtagarm7tdmi_scan(chain, ARM7TDMI_IR_INTEST);
328 }
329
330
331
332
333 //! push an instruction into the pipeline
334 unsigned long jtagarm7tdmi_instr_primitive(unsigned long instr, char breakpt){  // PROVEN
335   unsigned long retval;
336   jtagarm7tdmi_scan_intest(1);
337
338   SHIFT_DR;
339   // if the next instruction is to run using MCLK (master clock), set TDI
340   if (breakpt)
341     {
342     SETMOSI;
343     count_sysspd_instr_since_debug++;
344     } 
345   else
346     {
347     CLRMOSI; 
348     count_dbgspd_instr_since_debug++;
349     }
350   jtag_arm_tcktock();
351   
352   // Now shift in the 32 bits
353   retval = jtagarmtransn(instr, 32, MSB, END, RETIDLE);    // Must return to RUN-TEST/IDLE state for instruction to enter pipeline, and causes debug clock.
354   return(retval);
355   
356 }
357
358 //! push NOP into the instruction pipeline
359 unsigned long jtagarm7tdmi_nop(char breakpt){  // PROVEN
360   return jtagarm7tdmi_instr_primitive(ARM_INSTR_NOP, breakpt);
361 }
362
363 /*    stolen from ARM DDI0029G documentation, translated using ARM Architecture Reference Manual (14128.pdf)
364 STR R0, [R0]; Save R0 before use
365 MOV R0, PC ; Copy PC into R0
366 STR R0, [R0]; Now save the PC in R0
367 BX PC ; Jump into ARM state
368 MOV R8, R8 ;
369 MOV R8, R8 ;
370 NOP
371 NOP
372
373 */
374
375 //! set the current mode to ARM, returns PC (FIXME).  Should be used by haltcpu(), which should also store PC and the THUMB state, for use by releasecpu();
376 unsigned long jtagarm7tdmi_setMode_ARM(){               // PROVEN
377   debugstr("=== Thumb Mode... Switching to ARM mode ===");
378   unsigned long retval = 0xffL;
379   while ((jtagarm7tdmi_get_dbgstate() & JTAG_ARM7TDMI_DBG_TBIT)&& retval-- > 0){
380     cmddataword[6] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_NOP,0);
381     cmddataword[1] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_STR_R0_r0,0);
382     cmddataword[2] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_MOV_R0_PC,0);
383     cmddataword[3] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_STR_R0_r0,0);
384     cmddataword[4] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_BX_PC,0);
385     cmddataword[5] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_NOP,0);
386     cmddataword[6] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_NOP,0);
387     jtagarm7tdmi_resettap();                  // seems necessary for some reason.  ugh.
388   }
389   return(retval);
390 }
391
392
393
394
395 /************************* EmbeddedICE Primitives ****************************/
396 //! shifter for writing to chain2 (EmbeddedICE). 
397 unsigned long eice_write(unsigned char reg, unsigned long data){
398   unsigned long retval, temp;
399   //debugstr("eice_write");
400   //debughex(reg);
401   //debughex32(data);
402   jtagarm7tdmi_scan_intest(2);
403   // Now shift in the 32 bits
404   SHIFT_DR;
405   retval = jtagarmtransn(data, 32, LSB, NOEND, NORETIDLE);          // send in the data - 32-bits lsb
406   temp = jtagarmtransn(reg, 5, LSB, NOEND, NORETIDLE);              // send in the register address - 5 bits lsb
407   jtagarmtransn(1, 1, LSB, END, RETIDLE);                           // send in the WRITE bit
408   
409   //SETTMS;   // Last Bit - Exit UPDATE_DR
410   //// is this update a read/write or just read?
411   //SETMOSI;
412   //jtag_arm_tcktock();
413   
414   return(retval); 
415 }
416
417 //! shifter for reading from chain2 (EmbeddedICE).
418 unsigned long eice_read(unsigned char reg){               // PROVEN
419   unsigned long temp, retval;
420   //debugstr("eice_read");
421   //debughex(reg);
422   jtagarm7tdmi_scan_intest(2);
423
424   // send in the register address - 5 bits LSB
425   SHIFT_DR;
426   temp = jtagarmtransn(reg, 5, LSB, NOEND, NORETIDLE);
427   
428   // clear TDI to select "read only"
429   jtagarmtransn(0L, 1, LSB, END, RETIDLE);
430   
431   SHIFT_DR;
432   // Now shift out the 32 bits
433   retval = jtagarmtransn(0L, 32, LSB, END, RETIDLE);   // atmel arm jtag docs pp.10-11: LSB first
434   //debughex32(retval);
435   return(retval);   // atmel arm jtag docs pp.10-11: LSB first
436   
437 }
438
439
440
441
442 /************************* ICEBreaker/EmbeddedICE Stuff ******************************/
443 //! Grab debug register
444 unsigned long jtagarm7tdmi_get_dbgstate() {       // ICE Debug register, *NOT* ARM register DSCR    //    PROVEN
445   //jtagarm7tdmi_resettap();
446   return eice_read(EICE_DBGSTATUS);
447 }
448
449 //! Grab debug register
450 unsigned long jtagarm7tdmi_get_dbgctrl() {
451   return eice_read(EICE_DBGCTRL);
452 }
453
454 //! Update debug register
455 unsigned long jtagarm7tdmi_set_dbgctrl(unsigned long bits) {
456   return eice_write(EICE_DBGCTRL, bits);
457 }
458
459
460
461 //!  Set and Enable Watchpoint 0
462 void jtagarm7tdmi_set_watchpoint0(unsigned long addr, unsigned long addrmask, unsigned long data, unsigned long datamask, unsigned long ctrl, unsigned long ctrlmask){
463   // store watchpoint info?  - not right now
464     // FIXME: store info
465
466   eice_write(EICE_WP0ADDR, addr);           // write 0 in watchpoint 0 address
467   eice_write(EICE_WP0ADDRMASK, addrmask);   // write 0xffffffff in watchpoint 0 address mask
468   eice_write(EICE_WP0DATA, data);           // write 0 in watchpoint 0 data
469   eice_write(EICE_WP0DATAMASK, datamask);   // write 0xffffffff in watchpoint 0 data mask
470   eice_write(EICE_WP0CTRL, ctrlmask);       // write 0x00000100 in watchpoint 0 control value register (enables watchpoint)
471   eice_write(EICE_WP0CTRLMASK, ctrlmask);   // write 0xfffffff7 in watchpoint 0 control mask - only detect the fetch instruction
472 }
473
474 //!  Set and Enable Watchpoint 1
475 void jtagarm7tdmi_set_watchpoint1(unsigned long addr, unsigned long addrmask, unsigned long data, unsigned long datamask, unsigned long ctrl, unsigned long ctrlmask){
476   // store watchpoint info?  - not right now
477     // FIXME: store info
478
479   eice_write(EICE_WP1ADDR, addr);           // write 0 in watchpoint 1 address
480   eice_write(EICE_WP1ADDRMASK, addrmask);   // write 0xffffffff in watchpoint 1 address mask
481   eice_write(EICE_WP1DATA, data);           // write 0 in watchpoint 1 data
482   eice_write(EICE_WP1DATAMASK, datamask);   // write 0xffffffff in watchpoint 1 data mask
483   eice_write(EICE_WP1CTRL, ctrl);           // write 0x00000100 in watchpoint 1 control value register (enables watchpoint)
484   eice_write(EICE_WP1CTRLMASK, ctrlmask);   // write 0xfffffff7 in watchpoint 1 control mask - only detect the fetch instruction
485 }
486
487 //!  Disable Watchpoint 0
488 void jtagarm7tdmi_disable_watchpoint0(){
489   eice_write(EICE_WP0CTRL, 0x0L); // write 0 in watchpoint 0 control value - disables watchpoint 0
490 }
491   
492 //!  Disable Watchpoint 1
493 void jtagarm7tdmi_disable_watchpoint1(){
494   eice_write(EICE_WP1CTRL, 0x0L);            // write 0 in watchpoint 0 control value - disables watchpoint 0
495 }
496
497
498
499 /******************** Complex Commands **************************/
500
501 //! Push an instruction into the CPU pipeline
502 //  NOTE!  Must provide EXECNOPARM for parameter if no parm is required.
503 unsigned long jtagarm7tdmi_exec(unsigned long instr, unsigned long parameter, unsigned char systemspeed) {
504   unsigned long retval,waitcount=0xff;
505
506   debughex32(jtagarm7tdmi_nop( 0));
507   debughex32(jtagarm7tdmi_nop(systemspeed));
508   debughex32(jtagarm7tdmi_instr_primitive(instr, 0));      // write 32-bit instruction code into DR
509   debughex32(jtagarm7tdmi_nop( 0));
510   if (systemspeed){
511     jtagarm7tdmi_restart();                   // SHIFT_IR with RESTART instruction
512
513     // Poll the Debug Status Register for DBGACK and nMREQ to be HIGH
514     while ((jtagarm7tdmi_get_dbgstate() & 9L) == 0  && waitcount > 0){
515       delay(1);
516       waitcount --;
517     }
518     if (waitcount == 0)
519       return (-1);
520     retval = 0x12345678;
521   } else {
522     debughex32(jtagarm7tdmi_nop( 0));
523     debughex32(jtagarm7tdmi_instr_primitive(parameter, 0));  // inject long
524     retval = jtagarm7tdmi_nop( 0);
525     debughex32(retval);
526     debughex32(jtagarm7tdmi_nop( 0));
527     debughex32(jtagarm7tdmi_nop( 0));
528   }
529   return(retval);
530 }
531
532 //! Retrieve a 32-bit Register value
533 unsigned long jtagarm7tdmi_get_register(unsigned long reg) {
534   unsigned long retval=0L, instr, reg2=0L;
535   reg2 = (reg&0xfL)<<16;
536   // push nop into pipeline - clean out the pipeline...
537   instr = (unsigned long)(reg<<12L) | (unsigned long)ARM_READ_REG;   // STR Rx, [R14] 
538   instr ^= reg2;
539   //instr = (unsigned long)(((unsigned long)reg<<12) | ARM_READ_REG); 
540   //debugstr("Reading:");
541   //debughex32(instr);
542
543   jtagarm7tdmi_nop( 0);
544   jtagarm7tdmi_nop( 0);
545   jtagarm7tdmi_nop( 0);
546   jtagarm7tdmi_instr_primitive(instr, 0);
547   //debughex32(jtagarm7tdmi_nop( 0));                // push nop into pipeline - fetched
548   //debughex32(jtagarm7tdmi_nop( 0));                // push nop into pipeline - decoded
549   //debughex32(jtagarm7tdmi_nop( 0));                // push nop into pipeline - executed 
550   jtagarm7tdmi_nop( 0);
551   jtagarm7tdmi_nop( 0);
552   jtagarm7tdmi_nop( 0);
553   retval = jtagarm7tdmi_nop( 0);                        // recover 32-bit word
554   //debughex32(retval);
555   //debughex32(jtagarm7tdmi_nop( 0));
556   jtagarm7tdmi_nop( 0);
557   jtagarm7tdmi_nop( 0);
558   jtagarm7tdmi_nop( 0);
559   return retval;
560 }
561
562 //! Set a 32-bit Register value
563 void jtagarm7tdmi_set_register(unsigned long reg, unsigned long val) {
564   unsigned long instr, reg2=0;
565   reg2 = (reg&0xfL)<<16;
566   instr = (unsigned long)(((unsigned long)reg<<12L) | ARM_WRITE_REG); //  LDR Rx, [R14]
567   //instr ^= reg2;
568   //instr |= (unsigned long)((((unsigned long)reg)&0x7)<<8)<<8;
569   //debugstr("Writing:");
570   //debughex32(instr);
571   //debughex32(val);
572   jtagarm7tdmi_nop( 0);            // push nop into pipeline - clean out the pipeline...
573   jtagarm7tdmi_nop( 0);            // push nop into pipeline - clean out the pipeline...
574   jtagarm7tdmi_instr_primitive(instr, 0); // push instr into pipeline - fetch
575   
576   if (reg == ARM_REG_PC){
577   //jtagarm7tdmi_nop( 0);            // push nop into pipeline - execute
578     jtagarm7tdmi_instr_primitive(val, 0); // push 32-bit word on data bus
579     jtagarm7tdmi_nop( 0);            // push nop into pipeline - executed 
580     jtagarm7tdmi_nop( 0);            // push nop into pipeline - executed 
581     jtagarm7tdmi_nop( 0);
582     jtagarm7tdmi_nop( 0);
583   } else {
584   jtagarm7tdmi_nop( 0);            // push nop into pipeline - decode
585   jtagarm7tdmi_nop( 0);            // push nop into pipeline - execute
586     //jtagarm7tdmi_instr_primitive(val, 0); // push 32-bit word on data bus
587     jtagarm7tdmi_instr_primitive(val, 0); // push 32-bit word on data bus
588     //jtagarm7tdmi_instr_primitive(val, 0); // push 32-bit word on data bus
589     jtagarm7tdmi_nop( 0);            // push nop into pipeline - executed 
590     jtagarm7tdmi_nop( 0);            // push nop into pipeline - executed 
591   }
592   jtagarm7tdmi_nop( 0);
593 }
594
595
596
597 //! Get all registers, placing them into cmddatalong[0-15]
598 void jtagarm7tdmi_get_registers() {
599   debugstr("First 8 registers:");
600   debugstr("   Instr and the first few pops from the instruction chain:");
601   debughex32(ARM_INSTR_SKANKREGS1);
602   debughex32(jtagarm7tdmi_nop( 0));
603   debughex32(jtagarm7tdmi_instr_primitive(ARM_INSTR_SKANKREGS1,0));
604   debughex32(jtagarm7tdmi_nop( 0));
605   debughex32(jtagarm7tdmi_nop( 0));
606   cmddatalong[ 0] = jtagarm7tdmi_nop( 0);
607   cmddatalong[ 1] = jtagarm7tdmi_nop( 0);
608   cmddatalong[ 2] = jtagarm7tdmi_nop( 0);
609   cmddatalong[ 3] = jtagarm7tdmi_nop( 0);
610   cmddatalong[ 4] = jtagarm7tdmi_nop( 0);
611   cmddatalong[ 5] = jtagarm7tdmi_nop( 0);
612   cmddatalong[ 6] = jtagarm7tdmi_nop( 0);
613   cmddatalong[ 7] = jtagarm7tdmi_nop( 0);
614
615   debugstr("Last 8 registers:");
616   debugstr("   Instr and the first few pops from the instruction chain:");
617   debughex32(ARM_INSTR_SKANKREGS2);
618   debughex32(jtagarm7tdmi_nop( 0));
619   //jtagarm7tdmi_nop( 0);
620   debughex32(jtagarm7tdmi_instr_primitive(ARM_INSTR_SKANKREGS2,0));
621   debughex32(jtagarm7tdmi_nop( 0));
622   debughex32(jtagarm7tdmi_nop( 0));
623   //jtagarm7tdmi_nop( 0);
624   //jtagarm7tdmi_nop( 0);
625   cmddatalong[ 8] = jtagarm7tdmi_nop( 0);
626   cmddatalong[ 9] = jtagarm7tdmi_nop( 0);
627   cmddatalong[10] = jtagarm7tdmi_nop( 0);
628   cmddatalong[11] = jtagarm7tdmi_nop( 0);
629   cmddatalong[12] = jtagarm7tdmi_nop( 0);
630   cmddatalong[13] = jtagarm7tdmi_nop( 0);
631   cmddatalong[14] = jtagarm7tdmi_nop( 0);
632   cmddatalong[15] = jtagarm7tdmi_nop( 0);
633   jtagarm7tdmi_nop( 0);
634 }
635
636 //! Set all registers from cmddatalong[0-15]
637 void jtagarm7tdmi_set_registers() {   //FIXME: BORKEN... TOTALLY TRYING TO BUY A VOWEL
638   debughex32(ARM_INSTR_CLOBBEREGS);
639   jtagarm7tdmi_nop( 0);
640   debughex32(jtagarm7tdmi_instr_primitive(ARM_INSTR_CLOBBEREGS,0));
641   jtagarm7tdmi_nop( 0);
642   jtagarm7tdmi_nop( 0);
643   debughex32(jtagarm7tdmi_instr_primitive(0x40L,0));
644   debughex32(jtagarm7tdmi_instr_primitive(0x41L,0));
645   debughex32(jtagarm7tdmi_instr_primitive(0x42L,0));
646   debughex32(jtagarm7tdmi_instr_primitive(0x43L,0));
647   debughex32(jtagarm7tdmi_instr_primitive(0x44L,0));
648   debughex32(jtagarm7tdmi_instr_primitive(0x45L,0));
649   debughex32(jtagarm7tdmi_instr_primitive(0x46L,0));
650   debughex32(jtagarm7tdmi_instr_primitive(0x47L,0));
651   debughex32(jtagarm7tdmi_instr_primitive(0x48L,0));
652   debughex32(jtagarm7tdmi_instr_primitive(0x49L,0));
653   debughex32(jtagarm7tdmi_instr_primitive(0x4aL,0));
654   debughex32(jtagarm7tdmi_instr_primitive(0x4bL,0));
655   debughex32(jtagarm7tdmi_instr_primitive(0x4cL,0));
656   debughex32(jtagarm7tdmi_instr_primitive(0x4dL,0));
657   debughex32(jtagarm7tdmi_instr_primitive(0x4eL,0));
658   debughex32(jtagarm7tdmi_instr_primitive(0x4fL,0));
659 }
660
661 //! Retrieve the CPSR Register value
662 unsigned long jtagarm7tdmi_get_regCPSR() {
663   unsigned long retval = 0L;
664
665   debughex32(jtagarm7tdmi_nop( 0)); // push nop into pipeline - clean out the pipeline...
666   debughex32(jtagarm7tdmi_instr_primitive(ARM_INSTR_MRS_R0_CPSR, 0)); // push MRS_R0, CPSR into pipeline
667   debughex32(jtagarm7tdmi_nop( 0)); // push nop into pipeline - fetched
668   debughex32(jtagarm7tdmi_nop( 0)); // push nop into pipeline - decoded
669   debughex32(jtagarm7tdmi_nop( 0)); // push nop into pipeline - executed 
670   retval = jtagarm7tdmi_nop( 0);        // recover 32-bit word
671   debughex32(retval);
672   return retval;
673 }
674
675 //! Retrieve the CPSR Register value
676 unsigned long jtagarm7tdmi_set_regCPSR(unsigned long val) {
677   unsigned long retval = 0L;
678
679   debughex32(jtagarm7tdmi_nop( 0));        // push nop into pipeline - clean out the pipeline...
680   debughex32(jtagarm7tdmi_instr_primitive(ARM_INSTR_MSR_cpsr_cxsf_R0, 0)); // push MSR cpsr_cxsf, R0 into pipeline
681   debughex32(jtagarm7tdmi_nop( 0));        // push nop into pipeline - fetched
682   debughex32(jtagarm7tdmi_nop( 0));        // push nop into pipeline - decoded
683   
684   retval = jtagarm7tdmi_instr_primitive(val, 0);// push 32-bit word on data bus
685   debughex32(jtagarm7tdmi_nop( 0));        // push nop into pipeline - executed 
686   debughex32(retval);
687   return(retval);
688 }
689
690 //! Write data to address - Assume TAP in run-test/idle state
691 unsigned long jtagarm7tdmi_writemem(unsigned long adr, unsigned long data){
692   unsigned long r0=0L, r1=-1L;
693
694   r0 = jtagarm7tdmi_get_register(0);        // store R0 and R1
695   r1 = jtagarm7tdmi_get_register(1);
696   jtagarm7tdmi_set_register(0, adr);        // write address into R0
697   jtagarm7tdmi_set_register(1, data);       // write data in R1
698   jtagarm7tdmi_nop( 0);                     // push nop into pipeline to "clean" it ???
699   jtagarm7tdmi_nop( 1);                     // push nop into pipeline with BREAKPT set
700   jtagarm7tdmi_instr_primitive(ARM_INSTR_LDR_R1_r0_4, 0); // push LDR R1, R0, #4 into instruction pipeline
701   jtagarm7tdmi_nop( 0);                     // push nop into pipeline
702   jtagarm7tdmi_set_register(1, r1);         // restore R0 and R1 
703   jtagarm7tdmi_set_register(0, r0);
704   return(-1);
705 }
706
707
708
709
710 //! Read data from address
711 unsigned long jtagarm7tdmi_readmem(unsigned long adr){
712   unsigned long retval = 0L;
713   unsigned long r0=0L, r1=-1L;
714   int waitcount = 0xfffL;
715
716   r0 = jtagarm7tdmi_get_register(0);        // store R0 and R1
717   r1 = jtagarm7tdmi_get_register(1);
718   jtagarm7tdmi_set_register(0, adr);        // write address into R0
719   jtagarm7tdmi_nop( 0);                     // push nop into pipeline to "clean" it ???
720   jtagarm7tdmi_nop( 1);                     // push nop into pipeline with BREAKPT set
721   jtagarm7tdmi_instr_primitive(ARM_INSTR_LDR_R1_r0_4, 0); // push LDR R1, [R0], #4 into instruction pipeline
722   jtagarm7tdmi_nop( 0);                     // push nop into pipeline
723   jtagarm7tdmi_restart();                   // SHIFT_IR with RESTART instruction
724
725   // Poll the Debug Status Register for DBGACK and nMREQ to be HIGH
726   while ((jtagarm7tdmi_get_dbgstate() & 9L) == 0  && waitcount > 0){
727     delay(1);
728     waitcount --;
729   }
730   if (waitcount == 0){
731     return (-1);
732   } else {
733     retval = jtagarm7tdmi_get_register(1);  // read memory value from R1 register
734     jtagarm7tdmi_set_register(1, r1);         // restore R0 and R1 
735     jtagarm7tdmi_set_register(0, r0);
736   }
737   return retval;
738 }
739
740
741 //! Read Program Counter
742 unsigned long jtagarm7tdmi_getpc(){
743   return jtagarm7tdmi_get_register(ARM_REG_PC);
744 }
745
746 //! Set Program Counter
747 void jtagarm7tdmi_setpc(unsigned long adr){
748   jtagarm7tdmi_set_register(ARM_REG_PC, adr);
749 }
750
751 //! Halt CPU - returns 0xffff if the operation fails to complete within 
752 unsigned long jtagarm7tdmi_haltcpu(){                   //  PROVEN
753   int waitcount = 0xfffL;
754
755 /********  OLD WAY  ********/
756   // store watchpoint info?  - not right now
757   eice_write(EICE_WP1ADDR, 0L);              // write 0 in watchpoint 1 address
758   eice_write(EICE_WP1ADDRMASK, 0xffffffff); // write 0xffffffff in watchpoint 1 address mask
759   eice_write(EICE_WP1DATA, 0L);              // write 0 in watchpoint 1 data
760   eice_write(EICE_WP1DATAMASK, 0xffffffff); // write 0xffffffff in watchpoint 1 data mask
761   eice_write(EICE_WP1CTRL, 0x100L);          // write 0x00000100 in watchpoint 1 control value register (enables watchpoint)
762   eice_write(EICE_WP1CTRLMASK, 0xfffffff7); // write 0xfffffff7 in watchpoint 1 control mask - only detect the fetch instruction
763 /***************************/
764
765 /********  NEW WAY  *********/
766 //  eice_write(EICE_DBGCTRL, JTAG_ARM7TDMI_DBG_DBGRQ);  // r/o register?
767 /****************************/
768
769   // poll until debug status says the cpu is in debug mode
770   while (!(jtagarm7tdmi_get_dbgstate() & 0x1L)   && waitcount-- > 0){
771     delay(1);
772   }
773
774 /********  OLD WAY  ********/
775   eice_write(EICE_WP1CTRL, 0x0L);            // write 0 in watchpoint 0 control value - disables watchpoint 0
776 /***************************/
777
778 /********  NEW WAY  ********/
779 //  eice_write(EICE_DBGCTRL, 0);        // r/o register?
780 /***************************/
781
782   // store the debug state
783   last_halt_debug_state = jtagarm7tdmi_get_dbgstate();
784   last_halt_pc = jtagarm7tdmi_getpc() - 4;  // assume -4 for entering debug mode via watchpoint.
785   count_dbgspd_instr_since_debug = 0L;
786   count_sysspd_instr_since_debug = 0L;
787
788   // get into ARM mode if the T flag is set (Thumb mode)
789   while (jtagarm7tdmi_get_dbgstate() & JTAG_ARM7TDMI_DBG_TBIT && waitcount-- > 0) {
790     jtagarm7tdmi_setMode_ARM();
791   }
792   jtagarm7tdmi_resettap();
793   return waitcount;
794 }
795
796 unsigned long jtagarm7tdmi_releasecpu(){
797   int waitcount = 0xfff;
798   unsigned long instr;
799   // somehow determine what PC should be (a couple ways possible, calculations required)
800   jtagarm7tdmi_nop(0);                          // NOP
801   jtagarm7tdmi_nop(1);                          // NOP/BREAKPT
802
803   if (last_halt_debug_state & JTAG_ARM7TDMI_DBG_TBIT){      // FIXME:  FORNICATED!  BX requires register, thus more instrs... could we get away with the same instruction but +1 to offset?
804     instr = ARM_INSTR_B_PC + 0x1000001 - (count_dbgspd_instr_since_debug) - (count_sysspd_instr_since_debug*3);  //FIXME: make this right  - can't we just do an a7solute b/bx?
805     jtagarm7tdmi_instr_primitive(instr,0);
806   } else {
807     instr = ARM_INSTR_B_PC + 0x1000000 - (count_dbgspd_instr_since_debug*4) - (count_sysspd_instr_since_debug*12);
808     jtagarm7tdmi_instr_primitive(instr,0);
809   }
810
811   SHIFT_IR;
812   jtagarmtransn(ARM7TDMI_IR_RESTART,4,LSB,END,RETIDLE); // VERB_RESTART
813
814   // wait until restart-bit set in debug state register
815   while ((jtagarm7tdmi_get_dbgstate() & JTAG_ARM7TDMI_DBG_DBGACK) && waitcount > 0){
816     msdelay(1);
817     waitcount --;
818   }
819   last_halt_debug_state = -1;
820   last_halt_pc = -1;
821   return 0;
822 }
823  
824
825
826
827 ///////////////////////////////////////////////////////////////////////////////////////////////////
828 //! Handles ARM7TDMI JTAG commands.  Forwards others to JTAG.
829 void jtagarm7tdmihandle(unsigned char app, unsigned char verb, unsigned long len){
830   register char blocks;
831   
832   unsigned int i,val;
833   unsigned long at;
834   
835   jtagarm7tdmi_resettap();
836  
837   switch(verb){
838   case START:
839     //Enter JTAG mode.
840     debughex32(jtagarm7tdmi_start());
841     debughex32(jtagarm7tdmi_haltcpu());
842     //jtagarm7tdmi_resettap();
843     cmddatalong[0] = jtagarm7tdmi_get_dbgstate();
844     txdata(app,verb,0x4);
845     break;
846   case JTAGARM7TDMI_READMEM:
847   case PEEK:
848     at     = cmddatalong[0];
849     blocks = cmddatalong[1];
850     
851     txhead(app,verb,len);
852     
853         jtagarm7tdmi_resettap();
854         delay(1);
855         
856     for(i=0;i<blocks;i++){
857           val=jtagarm7tdmi_readmem(at);
858                 
859           serial_tx(val&0xFFL);
860           serial_tx((val&0xFF00L)>>8);
861           serial_tx((val&0xFF0000L)>>8);
862           serial_tx((val&0xFF000000L)>>8);
863           at+=4;
864       }
865     
866     
867     break;
868   case JTAGARM7TDMI_GET_CHIP_ID:
869         jtagarm7tdmi_resettap();
870     cmddatalong[0] = jtagarm7tdmi_idcode();
871     txdata(app,verb,4);
872     break;
873
874
875   case JTAGARM7TDMI_WRITEMEM:
876   case POKE:
877         jtagarm7tdmi_resettap();
878     jtagarm7tdmi_writemem(cmddatalong[0],
879                        cmddataword[2]);
880     cmddataword[0]=jtagarm7tdmi_readmem(cmddatalong[0]);
881     txdata(app,verb,2);
882     break;
883
884   case JTAGARM7TDMI_HALTCPU:  
885     cmddatalong[0] = jtagarm7tdmi_haltcpu();
886     txdata(app,verb,4);
887     break;
888   case JTAGARM7TDMI_RELEASECPU:
889         jtagarm7tdmi_resettap();
890     cmddatalong[0] = jtagarm7tdmi_releasecpu();
891     txdata(app,verb,4);
892     break;
893   //unimplemented functions
894   //case JTAGARM7TDMI_SETINSTRFETCH:
895   //case JTAGARM7TDMI_WRITEFLASH:
896   //case JTAGARM7TDMI_ERASEFLASH:
897   case JTAGARM7TDMI_SET_PC:
898     jtagarm7tdmi_setpc(cmddatalong[0]);
899     txdata(app,verb,0);
900     break;
901   case JTAGARM7TDMI_GET_DEBUG_CTRL:
902     cmddatalong[0] = jtagarm7tdmi_get_dbgctrl();
903     txdata(app,verb,1);
904     break;
905   case JTAGARM7TDMI_SET_DEBUG_CTRL:
906     cmddatalong[0] = jtagarm7tdmi_set_dbgctrl(cmddata[0]);
907     txdata(app,verb,4);
908     break;
909   case JTAGARM7TDMI_GET_PC:
910     cmddatalong[0] = jtagarm7tdmi_getpc();
911     txdata(app,verb,4);
912     break;
913   case JTAGARM7TDMI_GET_DEBUG_STATE:
914     //jtagarm7tdmi_resettap();            // Shouldn't need this, but currently do.  FIXME!
915     cmddatalong[0] = jtagarm7tdmi_get_dbgstate();
916     txdata(app,verb,4);
917     break;
918   //case JTAGARM7TDMI_GET_WATCHPOINT:
919   //case JTAGARM7TDMI_SET_WATCHPOINT:
920   case JTAGARM7TDMI_GET_REGISTER:
921         jtagarm7tdmi_resettap();
922     val = cmddata[0];
923     cmddatalong[0] = jtagarm7tdmi_get_register(val);
924     txdata(app,verb,4);
925     break;
926   case JTAGARM7TDMI_SET_REGISTER:
927         jtagarm7tdmi_resettap();
928     jtagarm7tdmi_set_register(cmddatalong[1], cmddatalong[0]);
929     txdata(app,verb,4);
930     break;
931   case JTAGARM7TDMI_GET_REGISTERS:
932         jtagarm7tdmi_resettap();
933     jtagarm7tdmi_get_registers();
934     txdata(app,verb,64);
935     break;
936   case JTAGARM7TDMI_SET_REGISTERS:
937         jtagarm7tdmi_resettap();
938     jtagarm7tdmi_set_registers();
939     txdata(app,verb,64);
940     break;
941   case JTAGARM7TDMI_DEBUG_INSTR:
942         jtagarm7tdmi_resettap();
943     cmddataword[0] = jtagarm7tdmi_exec(cmddataword[0], cmddataword[1], cmddata[9]);
944     txdata(app,verb,80);
945     break;
946   //case JTAGARM7TDMI_STEP_INSTR:
947 /*  case JTAGARM7TDMI_READ_CODE_MEMORY:
948   case JTAGARM7TDMI_WRITE_FLASH_PAGE:
949   case JTAGARM7TDMI_READ_FLASH_PAGE:
950   case JTAGARM7TDMI_MASS_ERASE_FLASH:
951   case JTAGARM7TDMI_PROGRAM_FLASH:
952   case JTAGARM7TDMI_LOCKCHIP:
953   case JTAGARM7TDMI_CHIP_ERASE:
954   */
955 // Really ARM specific stuff
956   case JTAGARM7TDMI_GET_CPSR:
957         jtagarm7tdmi_resettap();
958     cmddatalong[0] = jtagarm7tdmi_get_regCPSR();
959     txdata(app,verb,4);
960     break;
961   case JTAGARM7TDMI_SET_CPSR:
962         jtagarm7tdmi_resettap();
963     cmddatalong[0] = jtagarm7tdmi_set_regCPSR(cmddatalong[0]);
964     txdata(app,verb,4);
965     break;
966   case JTAGARM7TDMI_GET_SPSR:           // FIXME: NOT CORRECT
967         jtagarm7tdmi_resettap();
968     cmddatalong[0] = jtagarm7tdmi_get_regCPSR();
969     txdata(app,verb,4);
970     break;
971   case JTAGARM7TDMI_SET_SPSR:           // FIXME: NOT CORRECT
972         jtagarm7tdmi_resettap();
973     cmddatalong[0] = jtagarm7tdmi_set_regCPSR(cmddatalong[0]);
974     txdata(app,verb,4);
975     break;
976   case JTAGARM7TDMI_SET_MODE_THUMB:
977   case JTAGARM7TDMI_SET_MODE_ARM:
978         jtagarm7tdmi_resettap();
979     cmddataword[0] = jtagarm7tdmi_setMode_ARM();
980     txdata(app,verb,4);
981     break;
982     
983   case 0xD0:          // loopback test
984     jtagarm7tdmi_resettap();
985     cmddatalong[0] = jtagarm7tdmi_bypass(cmddatalong[0]);
986     txdata(app,verb,4);
987     break;
988   case 0xD8:          // EICE_READ
989     jtagarm7tdmi_resettap();
990     cmddatalong[0] = eice_read(cmddatalong[0]);
991     txdata(app,verb,4);
992     break;
993   case 0xD9:          // EICE_WRITE
994     jtagarm7tdmi_resettap();
995     cmddatalong[0] = eice_write(cmddatalong[0], cmddatalong[1]);
996     txdata(app,verb,4);
997     break;
998   case 0xDA:          // TEST MSB THROUGH CHAIN0 and CHAIN1
999     jtagarm7tdmi_resettap();
1000     jtagarm7tdmi_scan_intest(0);
1001     cmddatalong[0] = jtagarmtransn(0x41414141, 32, LSB, NOEND, NORETIDLE);
1002     cmddatalong[1] = jtagarmtransn(0x42424242, 32, MSB, NOEND, NORETIDLE);
1003     cmddatalong[2] = jtagarmtransn(0x43434343,  9, MSB, NOEND, NORETIDLE);
1004     cmddatalong[3] = jtagarmtransn(0x44444444, 32, MSB, NOEND, NORETIDLE);
1005     cmddatalong[4] = jtagarmtransn(cmddatalong[0], 32, LSB, NOEND, NORETIDLE);
1006     cmddatalong[5] = jtagarmtransn(cmddatalong[1], 32, MSB, NOEND, NORETIDLE);
1007     cmddatalong[6] = jtagarmtransn(cmddatalong[2],  9, MSB, NOEND, NORETIDLE);
1008     cmddatalong[7] = jtagarmtransn(cmddatalong[3], 32, MSB, END, RETIDLE);
1009     jtagarm7tdmi_resettap();
1010     jtagarm7tdmi_scan_intest(1);
1011     cmddatalong[8] = jtagarmtransn(0x41414141, 32, MSB, NOEND, NORETIDLE);
1012     cmddatalong[9] = jtagarmtransn(0x44444444,  1, MSB, NOEND, NORETIDLE);
1013     cmddatalong[10] = jtagarmtransn(cmddatalong[8], 32, MSB, NOEND, NORETIDLE);
1014     cmddatalong[11] = jtagarmtransn(cmddatalong[9],  1, MSB, END, RETIDLE);
1015     jtagarm7tdmi_resettap();
1016     txdata(app,verb,48);
1017     break;
1018     
1019   default:
1020     jtaghandle(app,verb,len);
1021   }
1022 }
1023
1024
1025
1026
1027 /*****************************
1028 Captured from FlySwatter against AT91SAM7S, to be used by me for testing.  ignore
1029
1030 > arm reg
1031 System and User mode registers
1032       r0: 300000df       r1: 00000000       r2: 58000000       r3: 00200a75
1033       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1034       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1035      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 000000fc
1036     cpsr: 00000093
1037
1038 FIQ mode shadow registers
1039   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1040  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1041
1042 Supervisor mode shadow registers
1043   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1044
1045 Abort mode shadow registers
1046   sp_abt: 00000000   lr_abt: 00000000 spsr_abt: e00000ff
1047
1048 IRQ mode shadow registers
1049   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1050
1051 Undefined instruction mode shadow registers
1052   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1053
1054 > step;arm reg
1055 target state: halted
1056 target halted in ARM state due to single-step, current mode: Supervisor
1057 cpsr: 0x00000093 pc: 0x00000100
1058 System and User mode registers
1059       r0: 300000df       r1: 00000000       r2: 00200000       r3: 00200a75 
1060       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c 
1061       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000 
1062      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000100 
1063     cpsr: 00000093 
1064
1065 FIQ mode shadow registers
1066   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000 
1067  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb 
1068
1069 Supervisor mode shadow registers
1070   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3 
1071
1072 Abort mode shadow registers
1073   sp_abt: 00000000   lr_abt: 00000000 spsr_abt: e00000ff 
1074
1075 IRQ mode shadow registers
1076   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b 
1077
1078 Undefined instruction mode shadow registers
1079   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df 
1080
1081  step;arm reg
1082 target state: halted
1083 target halted in ARM state due to single-step, current mode: Abort
1084 cpsr: 0x00000097 pc: 0x00000010
1085 System and User mode registers
1086       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75 
1087       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c 
1088       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000 
1089      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010 
1090     cpsr: 00000097 
1091
1092 FIQ mode shadow registers
1093   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000 
1094  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb 
1095
1096 Supervisor mode shadow registers
1097   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3 
1098
1099 Abort mode shadow registers
1100   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093 
1101
1102 IRQ mode shadow registers
1103   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b 
1104
1105 Undefined instruction mode shadow registers
1106   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df 
1107 > step;arm reg
1108 target state: halted
1109 target halted in ARM state due to single-step, current mode: Abort
1110 cpsr: 0x00000097 pc: 0x00000010
1111 System and User mode registers
1112       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75 
1113       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c 
1114       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000 
1115      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010 
1116     cpsr: 00000097 
1117
1118 FIQ mode shadow registers
1119   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000 
1120  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb 
1121
1122 Supervisor mode shadow registers
1123   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3 
1124
1125 Abort mode shadow registers
1126   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093 
1127
1128 IRQ mode shadow registers
1129   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b 
1130
1131 Undefined instruction mode shadow registers
1132   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df 
1133 > step;arm reg
1134 target state: halted
1135 target halted in ARM state due to single-step, current mode: Abort
1136 cpsr: 0x00000097 pc: 0x00000010
1137 System and User mode registers
1138       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1139       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1140       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1141      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1142     cpsr: 00000097
1143
1144 FIQ mode shadow registers
1145   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1146  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1147
1148 Supervisor mode shadow registers
1149   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1150
1151 Abort mode shadow registers
1152   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1153
1154 IRQ mode shadow registers
1155   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1156
1157 Undefined instruction mode shadow registers
1158   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1159 > step;arm reg
1160 target state: halted
1161 target halted in ARM state due to single-step, current mode: Abort
1162 cpsr: 0x00000097 pc: 0x00000010
1163 System and User mode registers
1164       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1165       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1166       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1167      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1168     cpsr: 00000097
1169
1170 FIQ mode shadow registers
1171   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1172  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1173
1174 Supervisor mode shadow registers
1175   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1176
1177 Abort mode shadow registers
1178   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1179
1180 IRQ mode shadow registers
1181   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1182
1183 Undefined instruction mode shadow registers
1184   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1185 > step;arm reg
1186 target state: halted
1187 target halted in ARM state due to single-step, current mode: Abort
1188 cpsr: 0x00000097 pc: 0x00000010
1189 System and User mode registers
1190       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1191       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1192       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1193      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1194     cpsr: 00000097
1195
1196 FIQ mode shadow registers
1197   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1198  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1199
1200 Supervisor mode shadow registers
1201   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1202
1203 Abort mode shadow registers
1204   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1205
1206 IRQ mode shadow registers
1207   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1208
1209 Undefined instruction mode shadow registers
1210   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1211 > step;arm reg
1212 target state: halted
1213 target halted in ARM state due to single-step, current mode: Abort
1214 cpsr: 0x00000097 pc: 0x00000010
1215 System and User mode registers
1216       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1217       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1218       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1219      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1220     cpsr: 00000097
1221
1222 FIQ mode shadow registers
1223   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1224  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1225
1226 Supervisor mode shadow registers
1227   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1228
1229 Abort mode shadow registers
1230   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1231
1232 IRQ mode shadow registers
1233   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1234
1235 Undefined instruction mode shadow registers
1236   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1237 > step;arm reg
1238 target state: halted
1239 target halted in ARM state due to single-step, current mode: Abort
1240 cpsr: 0x00000097 pc: 0x00000010
1241 System and User mode registers
1242       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1243       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1244       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1245      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1246     cpsr: 00000097
1247
1248 FIQ mode shadow registers
1249   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1250  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1251
1252 Supervisor mode shadow registers
1253   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1254
1255 Abort mode shadow registers
1256   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1257
1258 IRQ mode shadow registers
1259   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1260
1261 Undefined instruction mode shadow registers
1262   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1263 > step;arm reg
1264 target state: halted
1265 target halted in ARM state due to single-step, current mode: Abort
1266 cpsr: 0x00000097 pc: 0x00000010
1267 System and User mode registers
1268       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1269       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1270       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1271      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1272     cpsr: 00000097
1273
1274 FIQ mode shadow registers
1275   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1276  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1277
1278 Supervisor mode shadow registers
1279   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1280
1281 Abort mode shadow registers
1282   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1283
1284 IRQ mode shadow registers
1285   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1286
1287 Undefined instruction mode shadow registers
1288   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1289 > step;arm reg
1290 target state: halted
1291 target halted in ARM state due to single-step, current mode: Abort
1292 cpsr: 0x00000097 pc: 0x00000010
1293 System and User mode registers
1294       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1295       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1296       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1297      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1298     cpsr: 00000097
1299
1300 FIQ mode shadow registers
1301   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1302  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1303
1304 Supervisor mode shadow registers
1305   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1306
1307 Abort mode shadow registers
1308   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1309
1310 IRQ mode shadow registers
1311   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1312
1313 Undefined instruction mode shadow registers
1314   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1315 >
1316 */