git.rot13.org Git - goodfet/blob - firmware/apps/jtag/jtagarm7tdmi.c

   1 /*! \file jtagarm7tdmi.c
   2   \brief ARM7TDMI JTAG (AT91R40008, AT91SAM7xxx)
   3 */
   4
   5 #include "platform.h"
   6 #include "command.h"
   7 #include "jtag.h"
   8 #include "jtagarm7tdmi.h"
   9
  10
  11 /**** 20-pin Connection Information (pin1 is on top-right for both connectors)****
  12 GoodFET  ->  7TDMI 20-pin connector (HE-10 connector)
  13   1               13 (TDO)
  14   2               1  (Vdd)
  15   3               5  (TDI)
  16   5               7  (TMS)
  17   7               9  (TCK)
  18   8               15 (nRST)
  19   9               4,6,8,10,12,14,16,18,20 (GND)
  20   11              17/3 (nTRST)  (different sources suggest 17 or 3 alternately)
  21 ********************************/
  22
  23 /**** 14-pin Connection Information (pin1 is on top-right for both connectors)****
  24 GoodFET  ->  7TDMI 14-pin connector
  25   1               11 (TDO)
  26   2               1  (Vdd)
  27   3               5  (TDI)
  28   5               7  (TMS)
  29   7               9  (TCK)
  30   8               12 (nRST)
  31   9               2,4,6,8,10,14 (GND)
  32   11              3 (nTRST)
  33
  34 http://hri.sourceforge.net/tools/jtag_faq_org.html
  35 ********************************/
  36
  37
  38
  39
  40
  41
  42 /****************************************************************
  43 Enabling jtag likely differs with most platforms.  We will attempt to enable most from here.  Override jtagarm7tdmi_start() to extend for other implementations
  44 ARM7TDMI enables three different scan chains:
  45     * Chain0 - "entire periphery" including data bus
  46     * Chain1 - core data bus (subset of Chain0)  - Instruction Pipeline
  47     * Chain2 - EmbeddedICE Logic Registers - This is our way into the fun stuff.
  48
  49
  50 ---
  51 You can disable EmbeddedICE-RT by setting the DBGEN input LOW.
  52 Caution
  53 Hard wiring the DBGEN input LOW permanently disables all debug functionality.
  54 When DBGEN is LOW, it inhibits DBGDEWPT, DBGIEBKPT, and EDBGRQ to
  55 the core, and DBGACK from the ARM9E-S core is always LOW.
  56 ---
  57
  58
  59 ---
  60 When the ARM9E-S core is in debug state, you can examine the core and system state
  61 by forcing the load and store multiples into the instruction pipeline.
  62 Before you can examine the core and system state, the debugger must determine
  63 whether the processor entered debug from Thumb state or ARM state, by examining
  64 bit 4 of the EmbeddedICE-RT debug status register. If bit 4 is HIGH, the core has
  65 entered debug from Thumb state.
  66 For more details about determining the core state, see Determining the core and system
  67 state on page B-18.
  68 ---
  69
  70
  71 --- olimex - http://www.olimex.com/dev/pdf/arm-jtag.pdf
  72 JTAG signals description:
  73 PIN.1 (VTREF) Target voltage sense. Used to indicate the target’s operating voltage to thedebug tool.
  74 PIN.2 (VTARGET) Target voltage. May be used to supply power to the debug tool.
  75 PIN.3 (nTRST) JTAG TAP reset, this signal should be pulled up to Vcc in target board.
  76 PIN4,6, 8, 10,12,14,16,18,20 Ground. The Gnd-Signal-Gnd-Signal strategy implemented on the 20-way connection scheme improves noiseimmunity on the target connect cable.
  77 *PIN.5 (TDI) JTAG serial data in, should be pulled up to Vcc on target board.
  78 *PIN.7 (TMS) JTAG TAP Mode Select, should be pulled up to Vcc on target board.
  79 *PIN.9 (TCK) JTAG clock.
  80 PIN.11 (RTCK) JTAG retimed clock.Implemented on certain ASIC ARM implementations the host ASIC may need to synchronize external inputs (such as JTAG inputs) with its own internal clock.
  81 *PIN.13 (TDO) JTAG serial data out.
  82 *PIN.15 (nSRST) Target system reset.
  83 *PIN.17 (DBGRQ) Asynchronous debug request.  DBGRQ allows an external signal to force the ARM core into debug mode, should be pull down to GND.
  84 PIN.19 (DBGACK) Debug acknowledge. The ARM core acknowledges debug-mode inresponse to a DBGRQ input.
  85
  86
  87 -----------  SAMPLE TIMES  -----------
  88
  89 TDI and TMS are sampled on the rising edge of TCK and TDO transitions appear on the falling edge of TCK. Therefore, TDI and TMS must be written after the falling edge of TCK and TDO must be read after the rising edge of TCK.
  90
  91 for this module, we keep tck high for all changes/sampling, and then bounce it.
  92 ****************************************************************/
  93
  94
  95
  96 /************************** JTAGARM7TDMI Primitives ****************************/
  97 void jtag_goto_shift_ir() {
  98   SETTMS;
  99   jtag_arm_tcktock();
 100   jtag_arm_tcktock();
 101   CLRTMS;
 102   jtag_arm_tcktock();
 103   jtag_arm_tcktock();
 104
 105 }
 106
 107 void jtag_goto_shift_dr() {
 108   SETTMS;
 109   jtag_arm_tcktock();
 110   CLRTMS;
 111   jtag_arm_tcktock();
 112   jtag_arm_tcktock();
 113 }
 114
 115 void jtag_reset_to_runtest_idle() {
 116   SETTMS;
 117   jtag_arm_tcktock();
 118   jtag_arm_tcktock();
 119   jtag_arm_tcktock();
 120   jtag_arm_tcktock();
 121   jtag_arm_tcktock();  // now in Reset state
 122   CLRTMS;
 123   jtag_arm_tcktock();  // now in Run-Test/Idle state
 124 }
 125
 126 void jtag_arm_tcktock() {
 127   delay(1);  // FIXME: Should never wait this long...
 128   CLRTCK;
 129   PLEDOUT^=PLEDPIN;
 130   delay(1);  // FIXME: Should never wait this long...
 131   SETTCK;
 132   PLEDOUT^=PLEDPIN;
 133 }
 134
 135
 136 // ! Start JTAG, setup pins, reset TAP and return IDCODE
 137 unsigned long jtagarm7tdmi_start() {
 138   jtagsetup();
 139   jtagarm7tdmi_resettap();
 140   return jtagarm7tdmi_idcode();
 141 }
 142
 143
 144 //! Reset TAP State Machine
 145 void jtagarm7tdmi_resettap(){               // PROVEN
 146   current_chain = -1;
 147   jtag_reset_to_runtest_idle();
 148 }
 149
 150
 151 //  NOTE: important: THIS MODULE REVOLVES AROUND RETURNING TO RUNTEST/IDLE, OR THE FUNCTIONAL EQUIVALENT
 152
 153
 154 //! Shift N bits over TDI/TDO.  May choose LSB or MSB, and select whether to terminate (TMS-high on last bit) and whether to return to RUNTEST/IDLE
 155 unsigned long jtagarmtransn(unsigned long word, unsigned char bitcount, unsigned char lsb, unsigned char end, unsigned char retidle){               // PROVEN
 156   unsigned char bit;
 157   unsigned long high = 1L;
 158   unsigned long mask;
 159
 160   //for (bit=(bitcount-1)/8; bit>0; bit--)
 161   //  high <<= 8;
 162   //high <<= ((bitcount-1)%8);
 163   high <<= (bitcount-1);
 164
 165   mask = high-1;
 166
 167   if (lsb) {
 168     for (bit = bitcount; bit > 0; bit--) {
 169       /* write MOSI on trailing edge of previous clock */
 170       if (word & 1)
 171         {SETMOSI;}
 172       else
 173         {CLRMOSI;}
 174       word >>= 1;
 175
 176       if (bit==1 && end)
 177         SETTMS;//TMS high on last bit to exit.
 178
 179       jtag_arm_tcktock();
 180
 181       /* read MISO on trailing edge */
 182       if (READMISO){
 183         word += (high);
 184       }
 185     }
 186   } else {
 187     for (bit = bitcount; bit > 0; bit--) {
 188       /* write MOSI on trailing edge of previous clock */
 189       if (word & high)
 190         {SETMOSI;}
 191       else
 192         {CLRMOSI;}
 193       word = (word & mask) << 1;
 194
 195       if (bit==1 && end)
 196         SETTMS;//TMS high on last bit to exit.
 197
 198       jtag_arm_tcktock();
 199
 200       /* read MISO on trailing edge */
 201       word |= (READMISO);
 202     }
 203   }
 204
 205
 206   SETMOSI;
 207
 208   if (end){
 209     // exit state
 210     jtag_arm_tcktock();
 211     // update state
 212     if (retidle){
 213       CLRTMS;
 214       jtag_arm_tcktock();
 215     }
 216   }
 217   return word;
 218 }
 219
 220
 221
 222 /************************************************************************
 223 * ARM7TDMI core has 6 primary registers to be connected between TDI/TDO
 224 *   * Bypass Register
 225 *   * ID Code Register
 226 *   * Scan Chain Select Register    (4 bits_lsb)
 227 *   * Scan Chain 0                  (105 bits: 32_databits_lsb + ctrlbits + 32_addrbits_msb)
 228 *   * Scan Chain 1                  (33 bits: 32_bits + BREAKPT)
 229 *   * Scan Chain 2                  (38 bits: rw + 5_regbits_msb + 32_databits_msb)
 230 ************************************************************************/
 231
 232
 233
 234 /************************** Basic JTAG Verb Commands *******************************/
 235 //! Grab the core ID.
 236 unsigned long jtagarm7tdmi_idcode(){               // PROVEN
 237   jtagarm7tdmi_resettap();
 238   SHIFT_IR;
 239   jtagarmtransn(ARM7TDMI_IR_IDCODE, 4, LSB, END, RETIDLE);
 240   SHIFT_DR;
 241   return jtagarmtransn(0,32, LSB, END, RETIDLE);
 242 }
 243
 244 //!  Connect Bypass Register to TDO/TDI
 245 unsigned char jtagarm7tdmi_bypass(){               // PROVEN
 246   jtagarm7tdmi_resettap();
 247   SHIFT_IR;
 248   return jtagarmtransn(ARM7TDMI_IR_BYPASS, 4, LSB, END, NORETIDLE);
 249 }
 250 //!  INTEST verb - do internal test
 251 unsigned char jtagarm7tdmi_intest() {
 252   SHIFT_IR;
 253   return jtagarmtransn(ARM7TDMI_IR_INTEST, 4, LSB, END, NORETIDLE);
 254 }
 255
 256 //!  EXTEST verb - act like the processor to external components
 257 unsigned char jtagarm7tdmi_extest() {
 258   SHIFT_IR;
 259   return jtagarmtransn(ARM7TDMI_IR_EXTEST, 4, LSB, END, NORETIDLE);
 260 }
 261
 262 //!  SAMPLE verb
 263 //unsigned long jtagarm7tdmi_sample() {
 264 //  jtagarm7tdmi_ir_shift4(ARM7TDMI_IR_SAMPLE);        // ???? same here.
 265 //  return jtagtransn(0,32);
 266 //}
 267
 268 //!  RESTART verb
 269 unsigned char jtagarm7tdmi_restart() {
 270   jtagarm7tdmi_resettap();
 271   SHIFT_IR;
 272   return jtagarmtransn(ARM7TDMI_IR_RESTART, 4, LSB, END, RETIDLE);
 273 }
 274
 275 //!  ARM7TDMI_IR_CLAMP               0x5
 276 //unsigned long jtagarm7tdmi_clamp() {
 277 //  jtagarm7tdmi_resettap();
 278 //  SHIFT_IR;
 279 //  jtagarmtransn(ARM7TDMI_IR_CLAMP, 4, LSB, END, NORETIDLE);
 280 //  SHIFT_DR;
 281 //  return jtagarmtransn(0, 32, LSB, END, RETIDLE);
 282 //}
 283
 284 //!  ARM7TDMI_IR_HIGHZ               0x7
 285 //unsigned char jtagarm7tdmi_highz() {
 286 //  jtagarm7tdmi_resettap();
 287 //  SHIFT_IR;
 288 //  return jtagarmtransn(ARM7TDMI_IR_HIGHZ, 4, LSB, END, NORETIDLE);
 289 //}
 290
 291 //! define ARM7TDMI_IR_CLAMPZ              0x9
 292 //unsigned char jtagarm7tdmi_clampz() {
 293 //  jtagarm7tdmi_resettap();
 294 //  SHIFT_IR;
 295 //  return jtagarmtransn(ARM7TDMI_IR_CLAMPZ, 4, LSB, END, NORETIDLE);
 296 //}
 297
 298
 299 //!  Connect the appropriate scan chain to TDO/TDI.  SCAN_N, INTEST, ENDS IN SHIFT_DR!!!!!
 300 unsigned long jtagarm7tdmi_scan(int chain, int testmode) {               // PROVEN
 301 /*
 302 When selecting a scan chain the “Run Test/Idle” state should never be reached, other-
 303 wise, when in debug state, the core will not be correctly isolated and intrusive
 304 commands occur. Therefore, it is recommended to pass directly from the “Update”
 305 state” to the “Select DR” state each time the “Update” state is reached.
 306 */
 307   unsigned long retval;
 308   if (current_chain != chain) {
 309     //debugstr("===change chains===");
 310     SHIFT_IR;
 311     jtagarmtransn(ARM7TDMI_IR_SCAN_N, 4, LSB, END, NORETIDLE);
 312     SHIFT_DR;
 313     retval = jtagarmtransn(chain, 4, LSB, END, NORETIDLE);
 314     current_chain = chain;
 315   }    else
 316     //debugstr("===NOT change chains===");
 317     retval = current_chain;
 318   // put in test mode...
 319   SHIFT_IR;
 320   jtagarmtransn(testmode, 4, LSB, END, RETIDLE);
 321   return(retval);
 322 }
 323
 324
 325 //!  Connect the appropriate scan chain to TDO/TDI.  SCAN_N, INTEST, ENDS IN SHIFT_DR!!!!!
 326 unsigned long jtagarm7tdmi_scan_intest(int chain) {               // PROVEN
 327   return jtagarm7tdmi_scan(chain, ARM7TDMI_IR_INTEST);
 328 }
 329
 330
 331
 332
 333 //! push an instruction into the pipeline
 334 unsigned long jtagarm7tdmi_instr_primitive(unsigned long instr, char breakpt){  // PROVEN
 335   unsigned long retval;
 336   jtagarm7tdmi_scan_intest(1);
 337
 338   SHIFT_DR;
 339   // if the next instruction is to run using MCLK (master clock), set TDI
 340   if (breakpt)
 341     {
 342     SETMOSI;
 343     count_sysspd_instr_since_debug++;
 344     }
 345   else
 346     {
 347     CLRMOSI;
 348     count_dbgspd_instr_since_debug++;
 349     }
 350   jtag_arm_tcktock();
 351
 352   // Now shift in the 32 bits
 353   retval = jtagarmtransn(instr, 32, MSB, END, RETIDLE);    // Must return to RUN-TEST/IDLE state for instruction to enter pipeline, and causes debug clock.
 354   return(retval);
 355
 356 }
 357
 358 //! push NOP into the instruction pipeline
 359 unsigned long jtagarm7tdmi_nop(char breakpt){  // PROVEN
 360   return jtagarm7tdmi_instr_primitive(ARM_INSTR_NOP, breakpt);
 361 }
 362
 363 /*    stolen from ARM DDI0029G documentation, translated using ARM Architecture Reference Manual (14128.pdf)
 364 STR R0, [R0]; Save R0 before use
 365 MOV R0, PC ; Copy PC into R0
 366 STR R0, [R0]; Now save the PC in R0
 367 BX PC ; Jump into ARM state
 368 MOV R8, R8 ;
 369 MOV R8, R8 ;
 370 NOP
 371 NOP
 372
 373 */
 374
 375 //! set the current mode to ARM, returns PC (FIXME).  Should be used by haltcpu(), which should also store PC and the THUMB state, for use by releasecpu();
 376 unsigned long jtagarm7tdmi_setMode_ARM(){               // PROVEN
 377   debugstr("=== Thumb Mode... Switching to ARM mode ===");
 378   unsigned long retval = 0xffL;
 379   while ((jtagarm7tdmi_get_dbgstate() & JTAG_ARM7TDMI_DBG_TBIT)&& retval-- > 0){
 380     cmddataword[6] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_NOP,0);
 381     cmddataword[1] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_STR_R0_r0,0);
 382     cmddataword[2] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_MOV_R0_PC,0);
 383     cmddataword[3] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_STR_R0_r0,0);
 384     cmddataword[4] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_BX_PC,0);
 385     cmddataword[5] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_NOP,0);
 386     cmddataword[6] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_NOP,0);
 387     jtagarm7tdmi_resettap();                  // seems necessary for some reason.  ugh.
 388   }
 389   return(retval);
 390 }
 391
 392
 393
 394
 395 /************************* EmbeddedICE Primitives ****************************/
 396 //! shifter for writing to chain2 (EmbeddedICE).
 397 unsigned long eice_write(unsigned char reg, unsigned long data){
 398   unsigned long retval, temp;
 399   //debugstr("eice_write");
 400   //debughex(reg);
 401   //debughex32(data);
 402   jtagarm7tdmi_scan_intest(2);
 403   // Now shift in the 32 bits
 404   SHIFT_DR;
 405   retval = jtagarmtransn(data, 32, LSB, NOEND, NORETIDLE);          // send in the data - 32-bits lsb
 406   temp = jtagarmtransn(reg, 5, LSB, NOEND, NORETIDLE);              // send in the register address - 5 bits lsb
 407   jtagarmtransn(1, 1, LSB, END, RETIDLE);                           // send in the WRITE bit
 408
 409   //SETTMS;   // Last Bit - Exit UPDATE_DR
 410   //// is this update a read/write or just read?
 411   //SETMOSI;
 412   //jtag_arm_tcktock();
 413
 414   return(retval);
 415 }
 416
 417 //! shifter for reading from chain2 (EmbeddedICE).
 418 unsigned long eice_read(unsigned char reg){               // PROVEN
 419   unsigned long temp, retval;
 420   //debugstr("eice_read");
 421   //debughex(reg);
 422   jtagarm7tdmi_scan_intest(2);
 423
 424   // send in the register address - 5 bits LSB
 425   SHIFT_DR;
 426   temp = jtagarmtransn(reg, 5, LSB, NOEND, NORETIDLE);
 427
 428   // clear TDI to select "read only"
 429   jtagarmtransn(0L, 1, LSB, END, RETIDLE);
 430
 431   SHIFT_DR;
 432   // Now shift out the 32 bits
 433   retval = jtagarmtransn(0L, 32, LSB, END, RETIDLE);   // atmel arm jtag docs pp.10-11: LSB first
 434   //debughex32(retval);
 435   return(retval);   // atmel arm jtag docs pp.10-11: LSB first
 436
 437 }
 438
 439
 440
 441
 442 /************************* ICEBreaker/EmbeddedICE Stuff ******************************/
 443 //! Grab debug register
 444 unsigned long jtagarm7tdmi_get_dbgstate() {       // ICE Debug register, *NOT* ARM register DSCR    //    PROVEN
 445   //jtagarm7tdmi_resettap();
 446   return eice_read(EICE_DBGSTATUS);
 447 }
 448
 449 //! Grab debug register
 450 unsigned long jtagarm7tdmi_get_dbgctrl() {
 451   return eice_read(EICE_DBGCTRL);
 452 }
 453
 454 //! Update debug register
 455 unsigned long jtagarm7tdmi_set_dbgctrl(unsigned long bits) {
 456   return eice_write(EICE_DBGCTRL, bits);
 457 }
 458
 459
 460
 461 //!  Set and Enable Watchpoint 0
 462 void jtagarm7tdmi_set_watchpoint0(unsigned long addr, unsigned long addrmask, unsigned long data, unsigned long datamask, unsigned long ctrl, unsigned long ctrlmask){
 463   // store watchpoint info?  - not right now
 464     // FIXME: store info
 465
 466   eice_write(EICE_WP0ADDR, addr);           // write 0 in watchpoint 0 address
 467   eice_write(EICE_WP0ADDRMASK, addrmask);   // write 0xffffffff in watchpoint 0 address mask
 468   eice_write(EICE_WP0DATA, data);           // write 0 in watchpoint 0 data
 469   eice_write(EICE_WP0DATAMASK, datamask);   // write 0xffffffff in watchpoint 0 data mask
 470   eice_write(EICE_WP0CTRL, ctrlmask);       // write 0x00000100 in watchpoint 0 control value register (enables watchpoint)
 471   eice_write(EICE_WP0CTRLMASK, ctrlmask);   // write 0xfffffff7 in watchpoint 0 control mask - only detect the fetch instruction
 472 }
 473
 474 //!  Set and Enable Watchpoint 1
 475 void jtagarm7tdmi_set_watchpoint1(unsigned long addr, unsigned long addrmask, unsigned long data, unsigned long datamask, unsigned long ctrl, unsigned long ctrlmask){
 476   // store watchpoint info?  - not right now
 477     // FIXME: store info
 478
 479   eice_write(EICE_WP1ADDR, addr);           // write 0 in watchpoint 1 address
 480   eice_write(EICE_WP1ADDRMASK, addrmask);   // write 0xffffffff in watchpoint 1 address mask
 481   eice_write(EICE_WP1DATA, data);           // write 0 in watchpoint 1 data
 482   eice_write(EICE_WP1DATAMASK, datamask);   // write 0xffffffff in watchpoint 1 data mask
 483   eice_write(EICE_WP1CTRL, ctrl);           // write 0x00000100 in watchpoint 1 control value register (enables watchpoint)
 484   eice_write(EICE_WP1CTRLMASK, ctrlmask);   // write 0xfffffff7 in watchpoint 1 control mask - only detect the fetch instruction
 485 }
 486
 487 //!  Disable Watchpoint 0
 488 void jtagarm7tdmi_disable_watchpoint0(){
 489   eice_write(EICE_WP0CTRL, 0x0L); // write 0 in watchpoint 0 control value - disables watchpoint 0
 490 }
 491
 492 //!  Disable Watchpoint 1
 493 void jtagarm7tdmi_disable_watchpoint1(){
 494   eice_write(EICE_WP1CTRL, 0x0L);            // write 0 in watchpoint 0 control value - disables watchpoint 0
 495 }
 496
 497
 498
 499 /******************** Complex Commands **************************/
 500
 501 //! Push an instruction into the CPU pipeline
 502 //  NOTE!  Must provide EXECNOPARM for parameter if no parm is required.
 503 unsigned long jtagarm7tdmi_exec(unsigned long instr, unsigned long parameter, unsigned char systemspeed) {
 504   unsigned long retval,waitcount=0xff;
 505
 506   debughex32(jtagarm7tdmi_nop( 0));
 507   debughex32(jtagarm7tdmi_nop(systemspeed));
 508   debughex32(jtagarm7tdmi_instr_primitive(instr, 0));      // write 32-bit instruction code into DR
 509   debughex32(jtagarm7tdmi_nop( 0));
 510   if (systemspeed){
 511     jtagarm7tdmi_restart();                   // SHIFT_IR with RESTART instruction
 512
 513     // Poll the Debug Status Register for DBGACK and nMREQ to be HIGH
 514     while ((jtagarm7tdmi_get_dbgstate() & 9L) == 0  && waitcount > 0){
 515       delay(1);
 516       waitcount --;
 517     }
 518     if (waitcount == 0)
 519       return (-1);
 520     retval = 0x12345678;
 521   } else {
 522     debughex32(jtagarm7tdmi_nop( 0));
 523     debughex32(jtagarm7tdmi_instr_primitive(parameter, 0));  // inject long
 524     retval = jtagarm7tdmi_nop( 0);
 525     debughex32(retval);
 526     debughex32(jtagarm7tdmi_nop( 0));
 527     debughex32(jtagarm7tdmi_nop( 0));
 528   }
 529   return(retval);
 530 }
 531
 532 //! Retrieve a 32-bit Register value
 533 unsigned long jtagarm7tdmi_get_register(unsigned long reg) {
 534   unsigned long retval=0L, instr, reg2=0L;
 535   reg2 = (reg&0xfL)<<16;
 536   // push nop into pipeline - clean out the pipeline...
 537   instr = (unsigned long)(reg<<12L) | (unsigned long)ARM_READ_REG;   // STR Rx, [R14]
 538   instr ^= reg2;
 539   //instr = (unsigned long)(((unsigned long)reg<<12) | ARM_READ_REG);
 540   //debugstr("Reading:");
 541   //debughex32(instr);
 542
 543   jtagarm7tdmi_nop( 0);
 544   jtagarm7tdmi_nop( 0);
 545   jtagarm7tdmi_nop( 0);
 546   jtagarm7tdmi_instr_primitive(instr, 0);
 547   //debughex32(jtagarm7tdmi_nop( 0));                // push nop into pipeline - fetched
 548   //debughex32(jtagarm7tdmi_nop( 0));                // push nop into pipeline - decoded
 549   //debughex32(jtagarm7tdmi_nop( 0));                // push nop into pipeline - executed
 550   jtagarm7tdmi_nop( 0);
 551   jtagarm7tdmi_nop( 0);
 552   jtagarm7tdmi_nop( 0);
 553   retval = jtagarm7tdmi_nop( 0);                        // recover 32-bit word
 554   //debughex32(retval);
 555   //debughex32(jtagarm7tdmi_nop( 0));
 556   jtagarm7tdmi_nop( 0);
 557   jtagarm7tdmi_nop( 0);
 558   jtagarm7tdmi_nop( 0);
 559   return retval;
 560 }
 561
 562 //! Set a 32-bit Register value
 563 void jtagarm7tdmi_set_register(unsigned long reg, unsigned long val) {
 564   unsigned long instr, reg2=0;
 565   reg2 = (reg&0xfL)<<16;
 566   instr = (unsigned long)(((unsigned long)reg<<12L) | ARM_WRITE_REG); //  LDR Rx, [R14]
 567   //instr ^= reg2;
 568   //instr |= (unsigned long)((((unsigned long)reg)&0x7)<<8)<<8;
 569   //debugstr("Writing:");
 570   //debughex32(instr);
 571   //debughex32(val);
 572   jtagarm7tdmi_nop( 0);            // push nop into pipeline - clean out the pipeline...
 573   jtagarm7tdmi_nop( 0);            // push nop into pipeline - clean out the pipeline...
 574   jtagarm7tdmi_instr_primitive(instr, 0); // push instr into pipeline - fetch
 575
 576   if (reg == ARM_REG_PC){
 577   //jtagarm7tdmi_nop( 0);            // push nop into pipeline - execute
 578     jtagarm7tdmi_instr_primitive(val, 0); // push 32-bit word on data bus
 579     jtagarm7tdmi_nop( 0);            // push nop into pipeline - executed
 580     jtagarm7tdmi_nop( 0);            // push nop into pipeline - executed
 581     jtagarm7tdmi_nop( 0);
 582     jtagarm7tdmi_nop( 0);
 583   } else {
 584   jtagarm7tdmi_nop( 0);            // push nop into pipeline - decode
 585   jtagarm7tdmi_nop( 0);            // push nop into pipeline - execute
 586     //jtagarm7tdmi_instr_primitive(val, 0); // push 32-bit word on data bus
 587     jtagarm7tdmi_instr_primitive(val, 0); // push 32-bit word on data bus
 588     //jtagarm7tdmi_instr_primitive(val, 0); // push 32-bit word on data bus
 589     jtagarm7tdmi_nop( 0);            // push nop into pipeline - executed
 590     jtagarm7tdmi_nop( 0);            // push nop into pipeline - executed
 591   }
 592   jtagarm7tdmi_nop( 0);
 593 }
 594
 595
 596
 597 //! Get all registers, placing them into cmddatalong[0-15]
 598 void jtagarm7tdmi_get_registers() {
 599   debugstr("First 8 registers:");
 600   debugstr("   Instr and the first few pops from the instruction chain:");
 601   debughex32(ARM_INSTR_SKANKREGS1);
 602   debughex32(jtagarm7tdmi_nop( 0));
 603   debughex32(jtagarm7tdmi_instr_primitive(ARM_INSTR_SKANKREGS1,0));
 604   debughex32(jtagarm7tdmi_nop( 0));
 605   debughex32(jtagarm7tdmi_nop( 0));
 606   cmddatalong[ 0] = jtagarm7tdmi_nop( 0);
 607   cmddatalong[ 1] = jtagarm7tdmi_nop( 0);
 608   cmddatalong[ 2] = jtagarm7tdmi_nop( 0);
 609   cmddatalong[ 3] = jtagarm7tdmi_nop( 0);
 610   cmddatalong[ 4] = jtagarm7tdmi_nop( 0);
 611   cmddatalong[ 5] = jtagarm7tdmi_nop( 0);
 612   cmddatalong[ 6] = jtagarm7tdmi_nop( 0);
 613   cmddatalong[ 7] = jtagarm7tdmi_nop( 0);
 614
 615   debugstr("Last 8 registers:");
 616   debugstr("   Instr and the first few pops from the instruction chain:");
 617   debughex32(ARM_INSTR_SKANKREGS2);
 618   debughex32(jtagarm7tdmi_nop( 0));
 619   //jtagarm7tdmi_nop( 0);
 620   debughex32(jtagarm7tdmi_instr_primitive(ARM_INSTR_SKANKREGS2,0));
 621   debughex32(jtagarm7tdmi_nop( 0));
 622   debughex32(jtagarm7tdmi_nop( 0));
 623   //jtagarm7tdmi_nop( 0);
 624   //jtagarm7tdmi_nop( 0);
 625   cmddatalong[ 8] = jtagarm7tdmi_nop( 0);
 626   cmddatalong[ 9] = jtagarm7tdmi_nop( 0);
 627   cmddatalong[10] = jtagarm7tdmi_nop( 0);
 628   cmddatalong[11] = jtagarm7tdmi_nop( 0);
 629   cmddatalong[12] = jtagarm7tdmi_nop( 0);
 630   cmddatalong[13] = jtagarm7tdmi_nop( 0);
 631   cmddatalong[14] = jtagarm7tdmi_nop( 0);
 632   cmddatalong[15] = jtagarm7tdmi_nop( 0);
 633   jtagarm7tdmi_nop( 0);
 634 }
 635
 636 //! Set all registers from cmddatalong[0-15]
 637 void jtagarm7tdmi_set_registers() {   //FIXME: BORKEN... TOTALLY TRYING TO BUY A VOWEL
 638   debughex32(ARM_INSTR_CLOBBEREGS);
 639   jtagarm7tdmi_nop( 0);
 640   debughex32(jtagarm7tdmi_instr_primitive(ARM_INSTR_CLOBBEREGS,0));
 641   jtagarm7tdmi_nop( 0);
 642   jtagarm7tdmi_nop( 0);
 643   debughex32(jtagarm7tdmi_instr_primitive(0x40L,0));
 644   debughex32(jtagarm7tdmi_instr_primitive(0x41L,0));
 645   debughex32(jtagarm7tdmi_instr_primitive(0x42L,0));
 646   debughex32(jtagarm7tdmi_instr_primitive(0x43L,0));
 647   debughex32(jtagarm7tdmi_instr_primitive(0x44L,0));
 648   debughex32(jtagarm7tdmi_instr_primitive(0x45L,0));
 649   debughex32(jtagarm7tdmi_instr_primitive(0x46L,0));
 650   debughex32(jtagarm7tdmi_instr_primitive(0x47L,0));
 651   debughex32(jtagarm7tdmi_instr_primitive(0x48L,0));
 652   debughex32(jtagarm7tdmi_instr_primitive(0x49L,0));
 653   debughex32(jtagarm7tdmi_instr_primitive(0x4aL,0));
 654   debughex32(jtagarm7tdmi_instr_primitive(0x4bL,0));
 655   debughex32(jtagarm7tdmi_instr_primitive(0x4cL,0));
 656   debughex32(jtagarm7tdmi_instr_primitive(0x4dL,0));
 657   debughex32(jtagarm7tdmi_instr_primitive(0x4eL,0));
 658   debughex32(jtagarm7tdmi_instr_primitive(0x4fL,0));
 659 }
 660
 661 //! Retrieve the CPSR Register value
 662 unsigned long jtagarm7tdmi_get_regCPSR() {
 663   unsigned long retval = 0L;
 664
 665   debughex32(jtagarm7tdmi_nop( 0)); // push nop into pipeline - clean out the pipeline...
 666   debughex32(jtagarm7tdmi_instr_primitive(ARM_INSTR_MRS_R0_CPSR, 0)); // push MRS_R0, CPSR into pipeline
 667   debughex32(jtagarm7tdmi_nop( 0)); // push nop into pipeline - fetched
 668   debughex32(jtagarm7tdmi_nop( 0)); // push nop into pipeline - decoded
 669   debughex32(jtagarm7tdmi_nop( 0)); // push nop into pipeline - executed
 670   retval = jtagarm7tdmi_nop( 0);        // recover 32-bit word
 671   debughex32(retval);
 672   return retval;
 673 }
 674
 675 //! Retrieve the CPSR Register value
 676 unsigned long jtagarm7tdmi_set_regCPSR(unsigned long val) {
 677   unsigned long retval = 0L;
 678
 679   debughex32(jtagarm7tdmi_nop( 0));        // push nop into pipeline - clean out the pipeline...
 680   debughex32(jtagarm7tdmi_instr_primitive(ARM_INSTR_MSR_cpsr_cxsf_R0, 0)); // push MSR cpsr_cxsf, R0 into pipeline
 681   debughex32(jtagarm7tdmi_nop( 0));        // push nop into pipeline - fetched
 682   debughex32(jtagarm7tdmi_nop( 0));        // push nop into pipeline - decoded
 683
 684   retval = jtagarm7tdmi_instr_primitive(val, 0);// push 32-bit word on data bus
 685   debughex32(jtagarm7tdmi_nop( 0));        // push nop into pipeline - executed
 686   debughex32(retval);
 687   return(retval);
 688 }
 689
 690 //! Write data to address - Assume TAP in run-test/idle state
 691 unsigned long jtagarm7tdmi_writemem(unsigned long adr, unsigned long data){
 692   unsigned long r0=0L, r1=-1L;
 693
 694   r0 = jtagarm7tdmi_get_register(0);        // store R0 and R1
 695   r1 = jtagarm7tdmi_get_register(1);
 696   jtagarm7tdmi_set_register(0, adr);        // write address into R0
 697   jtagarm7tdmi_set_register(1, data);       // write data in R1
 698   jtagarm7tdmi_nop( 0);                     // push nop into pipeline to "clean" it ???
 699   jtagarm7tdmi_nop( 1);                     // push nop into pipeline with BREAKPT set
 700   jtagarm7tdmi_instr_primitive(ARM_INSTR_LDR_R1_r0_4, 0); // push LDR R1, R0, #4 into instruction pipeline
 701   jtagarm7tdmi_nop( 0);                     // push nop into pipeline
 702   jtagarm7tdmi_set_register(1, r1);         // restore R0 and R1
 703   jtagarm7tdmi_set_register(0, r0);
 704   return(-1);
 705 }
 706
 707
 708
 709
 710 //! Read data from address
 711 unsigned long jtagarm7tdmi_readmem(unsigned long adr){
 712   unsigned long retval = 0L;
 713   unsigned long r0=0L, r1=-1L;
 714   int waitcount = 0xfffL;
 715
 716   r0 = jtagarm7tdmi_get_register(0);        // store R0 and R1
 717   r1 = jtagarm7tdmi_get_register(1);
 718   jtagarm7tdmi_set_register(0, adr);        // write address into R0
 719   jtagarm7tdmi_nop( 0);                     // push nop into pipeline to "clean" it ???
 720   jtagarm7tdmi_nop( 1);                     // push nop into pipeline with BREAKPT set
 721   jtagarm7tdmi_instr_primitive(ARM_INSTR_LDR_R1_r0_4, 0); // push LDR R1, [R0], #4 into instruction pipeline
 722   jtagarm7tdmi_nop( 0);                     // push nop into pipeline
 723   jtagarm7tdmi_restart();                   // SHIFT_IR with RESTART instruction
 724
 725   // Poll the Debug Status Register for DBGACK and nMREQ to be HIGH
 726   while ((jtagarm7tdmi_get_dbgstate() & 9L) == 0  && waitcount > 0){
 727     delay(1);
 728     waitcount --;
 729   }
 730   if (waitcount == 0){
 731     return (-1);
 732   } else {
 733     retval = jtagarm7tdmi_get_register(1);  // read memory value from R1 register
 734     jtagarm7tdmi_set_register(1, r1);         // restore R0 and R1
 735     jtagarm7tdmi_set_register(0, r0);
 736   }
 737   return retval;
 738 }
 739
 740
 741 //! Read Program Counter
 742 unsigned long jtagarm7tdmi_getpc(){
 743   return jtagarm7tdmi_get_register(ARM_REG_PC);
 744 }
 745
 746 //! Set Program Counter
 747 void jtagarm7tdmi_setpc(unsigned long adr){
 748   jtagarm7tdmi_set_register(ARM_REG_PC, adr);
 749 }
 750
 751 //! Halt CPU - returns 0xffff if the operation fails to complete within
 752 unsigned long jtagarm7tdmi_haltcpu(){                   //  PROVEN
 753   int waitcount = 0xfffL;
 754
 755 /********  OLD WAY  ********/
 756   // store watchpoint info?  - not right now
 757   eice_write(EICE_WP1ADDR, 0L);              // write 0 in watchpoint 1 address
 758   eice_write(EICE_WP1ADDRMASK, 0xffffffff); // write 0xffffffff in watchpoint 1 address mask
 759   eice_write(EICE_WP1DATA, 0L);              // write 0 in watchpoint 1 data
 760   eice_write(EICE_WP1DATAMASK, 0xffffffff); // write 0xffffffff in watchpoint 1 data mask
 761   eice_write(EICE_WP1CTRL, 0x100L);          // write 0x00000100 in watchpoint 1 control value register (enables watchpoint)
 762   eice_write(EICE_WP1CTRLMASK, 0xfffffff7); // write 0xfffffff7 in watchpoint 1 control mask - only detect the fetch instruction
 763 /***************************/
 764
 765 /********  NEW WAY  *********/
 766 //  eice_write(EICE_DBGCTRL, JTAG_ARM7TDMI_DBG_DBGRQ);  // r/o register?
 767 /****************************/
 768
 769   // poll until debug status says the cpu is in debug mode
 770   while (!(jtagarm7tdmi_get_dbgstate() & 0x1L)   && waitcount-- > 0){
 771     delay(1);
 772   }
 773
 774 /********  OLD WAY  ********/
 775   eice_write(EICE_WP1CTRL, 0x0L);            // write 0 in watchpoint 0 control value - disables watchpoint 0
 776 /***************************/
 777
 778 /********  NEW WAY  ********/
 779 //  eice_write(EICE_DBGCTRL, 0);        // r/o register?
 780 /***************************/
 781
 782   // store the debug state
 783   last_halt_debug_state = jtagarm7tdmi_get_dbgstate();
 784   last_halt_pc = jtagarm7tdmi_getpc() - 4;  // assume -4 for entering debug mode via watchpoint.
 785   count_dbgspd_instr_since_debug = 0L;
 786   count_sysspd_instr_since_debug = 0L;
 787
 788   // get into ARM mode if the T flag is set (Thumb mode)
 789   while (jtagarm7tdmi_get_dbgstate() & JTAG_ARM7TDMI_DBG_TBIT && waitcount-- > 0) {
 790     jtagarm7tdmi_setMode_ARM();
 791   }
 792   jtagarm7tdmi_resettap();
 793   return waitcount;
 794 }
 795
 796 unsigned long jtagarm7tdmi_releasecpu(){
 797   int waitcount = 0xfff;
 798   unsigned long instr;
 799   // somehow determine what PC should be (a couple ways possible, calculations required)
 800   jtagarm7tdmi_nop(0);                          // NOP
 801   jtagarm7tdmi_nop(1);                          // NOP/BREAKPT
 802
 803   if (last_halt_debug_state & JTAG_ARM7TDMI_DBG_TBIT){      // FIXME:  FORNICATED!  BX requires register, thus more instrs... could we get away with the same instruction but +1 to offset?
 804     instr = ARM_INSTR_B_PC + 0x1000001 - (count_dbgspd_instr_since_debug) - (count_sysspd_instr_since_debug*3);  //FIXME: make this right  - can't we just do an a7solute b/bx?
 805     jtagarm7tdmi_instr_primitive(instr,0);
 806   } else {
 807     instr = ARM_INSTR_B_PC + 0x1000000 - (count_dbgspd_instr_since_debug*4) - (count_sysspd_instr_since_debug*12);
 808     jtagarm7tdmi_instr_primitive(instr,0);
 809   }
 810
 811   SHIFT_IR;
 812   jtagarmtransn(ARM7TDMI_IR_RESTART,4,LSB,END,RETIDLE); // VERB_RESTART
 813
 814   // wait until restart-bit set in debug state register
 815   while ((jtagarm7tdmi_get_dbgstate() & JTAG_ARM7TDMI_DBG_DBGACK) && waitcount > 0){
 816     msdelay(1);
 817     waitcount --;
 818   }
 819   last_halt_debug_state = -1;
 820   last_halt_pc = -1;
 821   return 0;
 822 }
 823
 824
 825
 826
 827 ///////////////////////////////////////////////////////////////////////////////////////////////////
 828 //! Handles ARM7TDMI JTAG commands.  Forwards others to JTAG.
 829 void jtagarm7tdmihandle(unsigned char app, unsigned char verb, unsigned long len){
 830   register char blocks;
 831
 832   unsigned int i,val;
 833   unsigned long at;
 834
 835   jtagarm7tdmi_resettap();
 836
 837   switch(verb){
 838   case START:
 839     //Enter JTAG mode.
 840     debughex32(jtagarm7tdmi_start());
 841     debughex32(jtagarm7tdmi_haltcpu());
 842     //jtagarm7tdmi_resettap();
 843     cmddatalong[0] = jtagarm7tdmi_get_dbgstate();
 844     txdata(app,verb,0x4);
 845     break;
 846   case JTAGARM7TDMI_READMEM:
 847   case PEEK:
 848     at     = cmddatalong[0];
 849     blocks = cmddatalong[1];
 850
 851     txhead(app,verb,len);
 852
 853         jtagarm7tdmi_resettap();
 854         delay(1);
 855
 856     for(i=0;i<blocks;i++){
 857           val=jtagarm7tdmi_readmem(at);
 858
 859           serial_tx(val&0xFFL);
 860           serial_tx((val&0xFF00L)>>8);
 861           serial_tx((val&0xFF0000L)>>8);
 862           serial_tx((val&0xFF000000L)>>8);
 863           at+=4;
 864       }
 865
 866
 867     break;
 868   case JTAGARM7TDMI_GET_CHIP_ID:
 869         jtagarm7tdmi_resettap();
 870     cmddatalong[0] = jtagarm7tdmi_idcode();
 871     txdata(app,verb,4);
 872     break;
 873
 874
 875   case JTAGARM7TDMI_WRITEMEM:
 876   case POKE:
 877         jtagarm7tdmi_resettap();
 878     jtagarm7tdmi_writemem(cmddatalong[0],
 879                        cmddataword[2]);
 880     cmddataword[0]=jtagarm7tdmi_readmem(cmddatalong[0]);
 881     txdata(app,verb,2);
 882     break;
 883
 884   case JTAGARM7TDMI_HALTCPU:
 885     cmddatalong[0] = jtagarm7tdmi_haltcpu();
 886     txdata(app,verb,4);
 887     break;
 888   case JTAGARM7TDMI_RELEASECPU:
 889         jtagarm7tdmi_resettap();
 890     cmddatalong[0] = jtagarm7tdmi_releasecpu();
 891     txdata(app,verb,4);
 892     break;
 893   //unimplemented functions
 894   //case JTAGARM7TDMI_SETINSTRFETCH:
 895   //case JTAGARM7TDMI_WRITEFLASH:
 896   //case JTAGARM7TDMI_ERASEFLASH:
 897   case JTAGARM7TDMI_SET_PC:
 898     jtagarm7tdmi_setpc(cmddatalong[0]);
 899     txdata(app,verb,0);
 900     break;
 901   case JTAGARM7TDMI_GET_DEBUG_CTRL:
 902     cmddatalong[0] = jtagarm7tdmi_get_dbgctrl();
 903     txdata(app,verb,1);
 904     break;
 905   case JTAGARM7TDMI_SET_DEBUG_CTRL:
 906     cmddatalong[0] = jtagarm7tdmi_set_dbgctrl(cmddata[0]);
 907     txdata(app,verb,4);
 908     break;
 909   case JTAGARM7TDMI_GET_PC:
 910     cmddatalong[0] = jtagarm7tdmi_getpc();
 911     txdata(app,verb,4);
 912     break;
 913   case JTAGARM7TDMI_GET_DEBUG_STATE:
 914     //jtagarm7tdmi_resettap();            // Shouldn't need this, but currently do.  FIXME!
 915     cmddatalong[0] = jtagarm7tdmi_get_dbgstate();
 916     txdata(app,verb,4);
 917     break;
 918   //case JTAGARM7TDMI_GET_WATCHPOINT:
 919   //case JTAGARM7TDMI_SET_WATCHPOINT:
 920   case JTAGARM7TDMI_GET_REGISTER:
 921         jtagarm7tdmi_resettap();
 922     val = cmddata[0];
 923     cmddatalong[0] = jtagarm7tdmi_get_register(val);
 924     txdata(app,verb,4);
 925     break;
 926   case JTAGARM7TDMI_SET_REGISTER:
 927         jtagarm7tdmi_resettap();
 928     jtagarm7tdmi_set_register(cmddatalong[1], cmddatalong[0]);
 929     txdata(app,verb,4);
 930     break;
 931   case JTAGARM7TDMI_GET_REGISTERS:
 932         jtagarm7tdmi_resettap();
 933     jtagarm7tdmi_get_registers();
 934     txdata(app,verb,64);
 935     break;
 936   case JTAGARM7TDMI_SET_REGISTERS:
 937         jtagarm7tdmi_resettap();
 938     jtagarm7tdmi_set_registers();
 939     txdata(app,verb,64);
 940     break;
 941   case JTAGARM7TDMI_DEBUG_INSTR:
 942         jtagarm7tdmi_resettap();
 943     cmddataword[0] = jtagarm7tdmi_exec(cmddataword[0], cmddataword[1], cmddata[9]);
 944     txdata(app,verb,80);
 945     break;
 946   //case JTAGARM7TDMI_STEP_INSTR:
 947 /*  case JTAGARM7TDMI_READ_CODE_MEMORY:
 948   case JTAGARM7TDMI_WRITE_FLASH_PAGE:
 949   case JTAGARM7TDMI_READ_FLASH_PAGE:
 950   case JTAGARM7TDMI_MASS_ERASE_FLASH:
 951   case JTAGARM7TDMI_PROGRAM_FLASH:
 952   case JTAGARM7TDMI_LOCKCHIP:
 953   case JTAGARM7TDMI_CHIP_ERASE:
 954   */
 955 // Really ARM specific stuff
 956   case JTAGARM7TDMI_GET_CPSR:
 957         jtagarm7tdmi_resettap();
 958     cmddatalong[0] = jtagarm7tdmi_get_regCPSR();
 959     txdata(app,verb,4);
 960     break;
 961   case JTAGARM7TDMI_SET_CPSR:
 962         jtagarm7tdmi_resettap();
 963     cmddatalong[0] = jtagarm7tdmi_set_regCPSR(cmddatalong[0]);
 964     txdata(app,verb,4);
 965     break;
 966   case JTAGARM7TDMI_GET_SPSR:           // FIXME: NOT CORRECT
 967         jtagarm7tdmi_resettap();
 968     cmddatalong[0] = jtagarm7tdmi_get_regCPSR();
 969     txdata(app,verb,4);
 970     break;
 971   case JTAGARM7TDMI_SET_SPSR:           // FIXME: NOT CORRECT
 972         jtagarm7tdmi_resettap();
 973     cmddatalong[0] = jtagarm7tdmi_set_regCPSR(cmddatalong[0]);
 974     txdata(app,verb,4);
 975     break;
 976   case JTAGARM7TDMI_SET_MODE_THUMB:
 977   case JTAGARM7TDMI_SET_MODE_ARM:
 978         jtagarm7tdmi_resettap();
 979     cmddataword[0] = jtagarm7tdmi_setMode_ARM();
 980     txdata(app,verb,4);
 981     break;
 982
 983   case 0xD0:          // loopback test
 984     jtagarm7tdmi_resettap();
 985     cmddatalong[0] = jtagarm7tdmi_bypass(cmddatalong[0]);
 986     txdata(app,verb,4);
 987     break;
 988   case 0xD8:          // EICE_READ
 989     jtagarm7tdmi_resettap();
 990     cmddatalong[0] = eice_read(cmddatalong[0]);
 991     txdata(app,verb,4);
 992     break;
 993   case 0xD9:          // EICE_WRITE
 994     jtagarm7tdmi_resettap();
 995     cmddatalong[0] = eice_write(cmddatalong[0], cmddatalong[1]);
 996     txdata(app,verb,4);
 997     break;
 998   case 0xDA:          // TEST MSB THROUGH CHAIN0 and CHAIN1
 999     jtagarm7tdmi_resettap();
1000     jtagarm7tdmi_scan_intest(0);
1001     cmddatalong[0] = jtagarmtransn(0x41414141, 32, LSB, NOEND, NORETIDLE);
1002     cmddatalong[1] = jtagarmtransn(0x42424242, 32, MSB, NOEND, NORETIDLE);
1003     cmddatalong[2] = jtagarmtransn(0x43434343,  9, MSB, NOEND, NORETIDLE);
1004     cmddatalong[3] = jtagarmtransn(0x44444444, 32, MSB, NOEND, NORETIDLE);
1005     cmddatalong[4] = jtagarmtransn(cmddatalong[0], 32, LSB, NOEND, NORETIDLE);
1006     cmddatalong[5] = jtagarmtransn(cmddatalong[1], 32, MSB, NOEND, NORETIDLE);
1007     cmddatalong[6] = jtagarmtransn(cmddatalong[2],  9, MSB, NOEND, NORETIDLE);
1008     cmddatalong[7] = jtagarmtransn(cmddatalong[3], 32, MSB, END, RETIDLE);
1009     jtagarm7tdmi_resettap();
1010     jtagarm7tdmi_scan_intest(1);
1011     cmddatalong[8] = jtagarmtransn(0x41414141, 32, MSB, NOEND, NORETIDLE);
1012     cmddatalong[9] = jtagarmtransn(0x44444444,  1, MSB, NOEND, NORETIDLE);
1013     cmddatalong[10] = jtagarmtransn(cmddatalong[8], 32, MSB, NOEND, NORETIDLE);
1014     cmddatalong[11] = jtagarmtransn(cmddatalong[9],  1, MSB, END, RETIDLE);
1015     jtagarm7tdmi_resettap();
1016     txdata(app,verb,48);
1017     break;
1018
1019   default:
1020     jtaghandle(app,verb,len);
1021   }
1022 }
1023
1024
1025
1026
1027 /*****************************
1028 Captured from FlySwatter against AT91SAM7S, to be used by me for testing.  ignore
1029
1030 > arm reg
1031 System and User mode registers
1032       r0: 300000df       r1: 00000000       r2: 58000000       r3: 00200a75
1033       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1034       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1035      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 000000fc
1036     cpsr: 00000093
1037
1038 FIQ mode shadow registers
1039   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1040  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1041
1042 Supervisor mode shadow registers
1043   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1044
1045 Abort mode shadow registers
1046   sp_abt: 00000000   lr_abt: 00000000 spsr_abt: e00000ff
1047
1048 IRQ mode shadow registers
1049   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1050
1051 Undefined instruction mode shadow registers
1052   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1053 >
1054 > step;arm reg
1055 target state: halted
1056 target halted in ARM state due to single-step, current mode: Supervisor
1057 cpsr: 0x00000093 pc: 0x00000100
1058 System and User mode registers
1059       r0: 300000df       r1: 00000000       r2: 00200000       r3: 00200a75
1060       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1061       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1062      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000100
1063     cpsr: 00000093
1064
1065 FIQ mode shadow registers
1066   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1067  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1068
1069 Supervisor mode shadow registers
1070   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1071
1072 Abort mode shadow registers
1073   sp_abt: 00000000   lr_abt: 00000000 spsr_abt: e00000ff
1074
1075 IRQ mode shadow registers
1076   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1077
1078 Undefined instruction mode shadow registers
1079   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1080 >
1081  step;arm reg
1082 target state: halted
1083 target halted in ARM state due to single-step, current mode: Abort
1084 cpsr: 0x00000097 pc: 0x00000010
1085 System and User mode registers
1086       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1087       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1088       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1089      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1090     cpsr: 00000097
1091
1092 FIQ mode shadow registers
1093   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1094  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1095
1096 Supervisor mode shadow registers
1097   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1098
1099 Abort mode shadow registers
1100   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1101
1102 IRQ mode shadow registers
1103   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1104
1105 Undefined instruction mode shadow registers
1106   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1107 > step;arm reg
1108 target state: halted
1109 target halted in ARM state due to single-step, current mode: Abort
1110 cpsr: 0x00000097 pc: 0x00000010
1111 System and User mode registers
1112       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1113       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1114       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1115      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1116     cpsr: 00000097
1117
1118 FIQ mode shadow registers
1119   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1120  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1121
1122 Supervisor mode shadow registers
1123   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1124
1125 Abort mode shadow registers
1126   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1127
1128 IRQ mode shadow registers
1129   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1130
1131 Undefined instruction mode shadow registers
1132   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1133 > step;arm reg
1134 target state: halted
1135 target halted in ARM state due to single-step, current mode: Abort
1136 cpsr: 0x00000097 pc: 0x00000010
1137 System and User mode registers
1138       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1139       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1140       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1141      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1142     cpsr: 00000097
1143
1144 FIQ mode shadow registers
1145   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1146  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1147
1148 Supervisor mode shadow registers
1149   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1150
1151 Abort mode shadow registers
1152   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1153
1154 IRQ mode shadow registers
1155   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1156
1157 Undefined instruction mode shadow registers
1158   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1159 > step;arm reg
1160 target state: halted
1161 target halted in ARM state due to single-step, current mode: Abort
1162 cpsr: 0x00000097 pc: 0x00000010
1163 System and User mode registers
1164       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1165       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1166       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1167      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1168     cpsr: 00000097
1169
1170 FIQ mode shadow registers
1171   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1172  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1173
1174 Supervisor mode shadow registers
1175   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1176
1177 Abort mode shadow registers
1178   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1179
1180 IRQ mode shadow registers
1181   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1182
1183 Undefined instruction mode shadow registers
1184   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1185 > step;arm reg
1186 target state: halted
1187 target halted in ARM state due to single-step, current mode: Abort
1188 cpsr: 0x00000097 pc: 0x00000010
1189 System and User mode registers
1190       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1191       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1192       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1193      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1194     cpsr: 00000097
1195
1196 FIQ mode shadow registers
1197   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1198  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1199
1200 Supervisor mode shadow registers
1201   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1202
1203 Abort mode shadow registers
1204   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1205
1206 IRQ mode shadow registers
1207   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1208
1209 Undefined instruction mode shadow registers
1210   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1211 > step;arm reg
1212 target state: halted
1213 target halted in ARM state due to single-step, current mode: Abort
1214 cpsr: 0x00000097 pc: 0x00000010
1215 System and User mode registers
1216       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1217       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1218       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1219      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1220     cpsr: 00000097
1221
1222 FIQ mode shadow registers
1223   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1224  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1225
1226 Supervisor mode shadow registers
1227   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1228
1229 Abort mode shadow registers
1230   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1231
1232 IRQ mode shadow registers
1233   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1234
1235 Undefined instruction mode shadow registers
1236   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1237 > step;arm reg
1238 target state: halted
1239 target halted in ARM state due to single-step, current mode: Abort
1240 cpsr: 0x00000097 pc: 0x00000010
1241 System and User mode registers
1242       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1243       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1244       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1245      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1246     cpsr: 00000097
1247
1248 FIQ mode shadow registers
1249   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1250  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1251
1252 Supervisor mode shadow registers
1253   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1254
1255 Abort mode shadow registers
1256   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1257
1258 IRQ mode shadow registers
1259   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1260
1261 Undefined instruction mode shadow registers
1262   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1263 > step;arm reg
1264 target state: halted
1265 target halted in ARM state due to single-step, current mode: Abort
1266 cpsr: 0x00000097 pc: 0x00000010
1267 System and User mode registers
1268       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1269       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1270       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1271      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1272     cpsr: 00000097
1273
1274 FIQ mode shadow registers
1275   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1276  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1277
1278 Supervisor mode shadow registers
1279   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1280
1281 Abort mode shadow registers
1282   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1283
1284 IRQ mode shadow registers
1285   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1286
1287 Undefined instruction mode shadow registers
1288   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1289 > step;arm reg
1290 target state: halted
1291 target halted in ARM state due to single-step, current mode: Abort
1292 cpsr: 0x00000097 pc: 0x00000010
1293 System and User mode registers
1294       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1295       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1296       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1297      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1298     cpsr: 00000097
1299
1300 FIQ mode shadow registers
1301   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1302  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1303
1304 Supervisor mode shadow registers
1305   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1306
1307 Abort mode shadow registers
1308   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1309
1310 IRQ mode shadow registers
1311   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1312
1313 Undefined instruction mode shadow registers
1314   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1315 >
1316 */