git.rot13.org Git - goodfet/blob - firmware/apps/jtag/jtagarm7tdmi.c

   1 /*! \file jtagarm7tdmi.c
   2   \brief ARM7TDMI JTAG (AT91R40008)
   3 */
   4
   5 #include "platform.h"
   6 #include "command.h"
   7 #include "jtag.h"
   8 #include "jtagarm7tdmi.h"
   9
  10
  11 /**** 20-pin Connection Information (pin1 is on top-right for both connectors)****
  12 GoodFET  ->  7TDMI 20-pin connector (HE-10 connector)
  13   1               13 (TDO)
  14   2               1  (Vdd)
  15   3               5  (TDI)
  16   5               7  (TMS)
  17   7               9  (TCK)
  18   8               15 (nRST)
  19   9               4,6,8,10,12,14,16,18,20 (GND)
  20   11              17/3 (nTRST)  (different sources suggest 17 or 3 alternately)
  21 ********************************/
  22
  23 /**** 14-pin Connection Information (pin1 is on top-right for both connectors)****
  24 GoodFET  ->  7TDMI 14-pin connector
  25   1               11 (TDO)
  26   2               1  (Vdd)
  27   3               5  (TDI)
  28   5               7  (TMS)
  29   7               9  (TCK)
  30   8               12 (nRST)
  31   9               2,4,6,8,10,14 (GND)
  32   11              3 (nTRST)
  33
  34 http://hri.sourceforge.net/tools/jtag_faq_org.html
  35 ********************************/
  36
  37
  38
  39
  40
  41
  42 /****************************************************************
  43 Enabling jtag likely differs with most platforms.  We will attempt to enable most from here.  Override jtagarm7tdmi_start() to extend for other implementations
  44 ARM7TDMI enables three different scan chains:
  45     * Chain0 - "entire periphery" including data bus
  46     * Chain1 - core data bus (subset of Chain0)  - Instruction Pipeline
  47     * Chain2 - EmbeddedICE Logic Registers - This is our way into the fun stuff.
  48
  49
  50 ---
  51 You can disable EmbeddedICE-RT by setting the DBGEN input LOW.
  52 Caution
  53 Hard wiring the DBGEN input LOW permanently disables all debug functionality.
  54 When DBGEN is LOW, it inhibits DBGDEWPT, DBGIEBKPT, and EDBGRQ to
  55 the core, and DBGACK from the ARM9E-S core is always LOW.
  56 ---
  57
  58
  59 ---
  60 When the ARM9E-S core is in debug state, you can examine the core and system state
  61 by forcing the load and store multiples into the instruction pipeline.
  62 Before you can examine the core and system state, the debugger must determine
  63 whether the processor entered debug from Thumb state or ARM state, by examining
  64 bit 4 of the EmbeddedICE-RT debug status register. If bit 4 is HIGH, the core has
  65 entered debug from Thumb state.
  66 For more details about determining the core state, see Determining the core and system
  67 state on page B-18.
  68 ---
  69
  70
  71 --- olimex - http://www.olimex.com/dev/pdf/arm-jtag.pdf
  72 JTAG signals description:
  73 PIN.1 (VTREF) Target voltage sense. Used to indicate the target’s operating voltage to thedebug tool.
  74 PIN.2 (VTARGET) Target voltage. May be used to supply power to the debug tool.
  75 PIN.3 (nTRST) JTAG TAP reset, this signal should be pulled up to Vcc in target board.
  76 PIN4,6, 8, 10,12,14,16,18,20 Ground. The Gnd-Signal-Gnd-Signal strategy implemented on the 20-way connection scheme improves noiseimmunity on the target connect cable.
  77 *PIN.5 (TDI) JTAG serial data in, should be pulled up to Vcc on target board.
  78 *PIN.7 (TMS) JTAG TAP Mode Select, should be pulled up to Vcc on target board.
  79 *PIN.9 (TCK) JTAG clock.
  80 PIN.11 (RTCK) JTAG retimed clock.Implemented on certain ASIC ARM implementations the host ASIC may need to synchronize external inputs (such as JTAG inputs) with its own internal clock.
  81 *PIN.13 (TDO) JTAG serial data out.
  82 *PIN.15 (nSRST) Target system reset.
  83 *PIN.17 (DBGRQ) Asynchronous debug request.  DBGRQ allows an external signal to force the ARM core into debug mode, should be pull down to GND.
  84 PIN.19 (DBGACK) Debug acknowledge. The ARM core acknowledges debug-mode inresponse to a DBGRQ input.
  85
  86
  87 -----------  SAMPLE TIMES  -----------
  88
  89 TDI and TMS are sampled on the rising edge of TCK and TDO transitions appear on the falling edge of TCK. Therefore, TDI and TMS must be written after the falling edge of TCK and TDO must be read after the rising edge of TCK.
  90
  91 for this module, we keep tck high for all changes/sampling, and then bounce it.
  92 ****************************************************************/
  93
  94
  95
  96 /************************** JTAGARM7TDMI Primitives ****************************/
  97 void jtag_goto_shift_ir() {
  98   SETTMS;
  99   jtag_arm_tcktock();
 100   jtag_arm_tcktock();
 101   CLRTMS;
 102   jtag_arm_tcktock();
 103   jtag_arm_tcktock();
 104
 105 }
 106
 107 void jtag_goto_shift_dr() {
 108   SETTMS;
 109   jtag_arm_tcktock();
 110   CLRTMS;
 111   jtag_arm_tcktock();
 112   jtag_arm_tcktock();
 113 }
 114
 115 void jtag_reset_to_runtest_idle() {
 116   SETTMS;
 117   jtag_arm_tcktock();
 118   jtag_arm_tcktock();
 119   jtag_arm_tcktock();
 120   jtag_arm_tcktock();
 121   jtag_arm_tcktock();
 122   jtag_arm_tcktock();
 123   jtag_arm_tcktock();
 124   jtag_arm_tcktock();  // now in Reset state
 125   CLRTMS;
 126   jtag_arm_tcktock();  // now in Run-Test/Idle state
 127 }
 128
 129 void jtag_arm_tcktock() {
 130   CLRTCK;
 131   PLEDOUT^=PLEDPIN;
 132   SETTCK;
 133   PLEDOUT^=PLEDPIN;
 134 }
 135
 136
 137 // ! Start JTAG, setup pins, reset TAP and return IDCODE
 138 unsigned long jtagarm7tdmi_start() {
 139   jtagsetup();
 140   //Known-good starting position.
 141   //Might be unnecessary.
 142   //SETTST;
 143   //SETRST;
 144
 145   //delay(0x2);
 146
 147   //CLRRST;
 148   //delay(2);
 149   //CLRTST;
 150
 151   //msdelay(10);
 152   //SETRST;
 153   /*
 154   P5DIR &=~RST;
 155   */
 156   //delay(0x2);
 157   jtagarm7tdmi_resettap();
 158   return jtagarm7tdmi_idcode();
 159 }
 160
 161
 162 //! Reset TAP State Machine
 163 void jtagarm7tdmi_resettap(){               // PROVEN
 164   current_chain = -1;
 165   jtag_reset_to_runtest_idle();
 166 }
 167
 168
 169 //  NOTE: important: THIS MODULE REVOLVES AROUND RETURNING TO RUNTEST/IDLE, OR THE FUNCTIONAL EQUIVALENT
 170
 171
 172 //! Shift N bits over TDI/TDO.  May choose LSB or MSB, and select whether to terminate (TMS-high on last bit) and whether to return to RUNTEST/IDLE
 173 unsigned long jtagarmtransn(unsigned long word, unsigned char bitcount, unsigned char lsb, unsigned char end, unsigned char retidle){               // PROVEN
 174   unsigned int bit;
 175   unsigned long high = 1;
 176   unsigned long mask;
 177
 178   for (bit=(bitcount-1)/8; bit>0; bit--)
 179     high <<= 8;
 180   high <<= ((bitcount-1)%8);
 181
 182   mask = high-1;
 183
 184   if (lsb) {
 185     for (bit = bitcount; bit > 0; bit--) {
 186       /* write MOSI on trailing edge of previous clock */
 187       if (word & 1)
 188         {SETMOSI;}
 189       else
 190         {CLRMOSI;}
 191       word >>= 1;
 192
 193       if (bit==1 && end)
 194         SETTMS;//TMS high on last bit to exit.
 195
 196       jtag_arm_tcktock();
 197
 198       /* read MISO on trailing edge */
 199       if (READMISO){
 200         word += (high);
 201       }
 202     }
 203   } else {
 204     for (bit = bitcount; bit > 0; bit--) {
 205       /* write MOSI on trailing edge of previous clock */
 206       if (word & high)
 207         {SETMOSI;}
 208       else
 209         {CLRMOSI;}
 210       word = (word & mask) << 1;
 211
 212       if (bit==1 && end)
 213         SETTMS;//TMS high on last bit to exit.
 214
 215       jtag_arm_tcktock();
 216
 217       /* read MISO on trailing edge */
 218       word |= (READMISO);
 219     }
 220   }
 221
 222
 223   SETMOSI;
 224
 225   if (end){
 226     // exit state
 227     jtag_arm_tcktock();
 228     // update state
 229     if (retidle){
 230       CLRTMS;
 231       jtag_arm_tcktock();
 232     }
 233   }
 234   return word;
 235 }
 236
 237
 238
 239 /************************************************************************
 240 * ARM7TDMI core has 6 primary registers to be connected between TDI/TDO
 241 *   * Bypass Register
 242 *   * ID Code Register
 243 *   * Scan Chain Select Register    (4 bits_lsb)
 244 *   * Scan Chain 0                  (64+* bits: 32_databits_lsb + ctrlbits + 32_addrbits_msb)
 245 *   * Scan Chain 1                  (33 bits: 32_bits + BREAKPT)
 246 *   * Scan Chain 2                  (38 bits: rw + 5_regbits_msb + 32_databits_msb)
 247 ************************************************************************/
 248
 249
 250
 251 /************************** Basic JTAG Verb Commands *******************************/
 252 //! Grab the core ID.
 253 unsigned long jtagarm7tdmi_idcode(){               // PROVEN
 254   jtagarm7tdmi_resettap();
 255   SHIFT_IR;
 256   jtagarmtransn(ARM7TDMI_IR_IDCODE, 4, LSB, END, RETIDLE);
 257   SHIFT_DR;
 258   return jtagarmtransn(0,32, LSB, END, RETIDLE);
 259 }
 260
 261 //!  Connect Bypass Register to TDO/TDI
 262 unsigned char jtagarm7tdmi_bypass(){               // PROVEN
 263   //jtagarm7tdmi_resettap();
 264   SHIFT_IR;
 265   return jtagarmtransn(ARM7TDMI_IR_BYPASS, 4, LSB, END, NORETIDLE);
 266 }
 267 //!  INTEST verb - do internal test
 268 unsigned char jtagarm7tdmi_intest() {
 269   //jtagarm7tdmi_resettap();
 270   SHIFT_IR;
 271   return jtagarmtransn(ARM7TDMI_IR_INTEST, 4, LSB, END, NORETIDLE);
 272 }
 273
 274 //!  EXTEST verb
 275 unsigned char jtagarm7tdmi_extest() {
 276   //jtagarm7tdmi_resettap();
 277   SHIFT_IR;
 278   return jtagarmtransn(ARM7TDMI_IR_EXTEST, 4, LSB, END, NORETIDLE);
 279 }
 280
 281 //!  SAMPLE verb
 282 //unsigned long jtagarm7tdmi_sample() {
 283 //  jtagarm7tdmi_ir_shift4(ARM7TDMI_IR_SAMPLE);        // ???? same here.
 284 //  return jtagtransn(0,32);
 285 //}
 286
 287 //!  RESTART verb
 288 unsigned char jtagarm7tdmi_restart() {
 289   //jtagarm7tdmi_resettap();
 290   SHIFT_IR;
 291   return jtagarmtransn(ARM7TDMI_IR_RESTART, 4, LSB, END, RETIDLE);
 292 }
 293
 294 //!  ARM7TDMI_IR_CLAMP               0x5
 295 //unsigned long jtagarm7tdmi_clamp() {
 296 //  jtagarm7tdmi_resettap();
 297 //  SHIFT_IR;
 298 //  jtagarmtransn(ARM7TDMI_IR_CLAMP, 4, LSB, END, NORETIDLE);
 299 //  SHIFT_DR;
 300 //  return jtagarmtransn(0, 32, LSB, END, RETIDLE);
 301 //}
 302
 303 //!  ARM7TDMI_IR_HIGHZ               0x7
 304 //unsigned char jtagarm7tdmi_highz() {
 305 //  jtagarm7tdmi_resettap();
 306 //  SHIFT_IR;
 307 //  return jtagarmtransn(ARM7TDMI_IR_HIGHZ, 4, LSB, END, NORETIDLE);
 308 //}
 309
 310 //! define ARM7TDMI_IR_CLAMPZ              0x9
 311 //unsigned char jtagarm7tdmi_clampz() {
 312 //  jtagarm7tdmi_resettap();
 313 //  SHIFT_IR;
 314 //  return jtagarmtransn(ARM7TDMI_IR_CLAMPZ, 4, LSB, END, NORETIDLE);
 315 //}
 316
 317
 318 //!  Connect the appropriate scan chain to TDO/TDI.  SCAN_N, INTEST, ENDS IN SHIFT_DR!!!!!
 319 unsigned long jtagarm7tdmi_scan(int chain, int testmode) {               // PROVEN
 320 /*
 321 When selecting a scan chain the “Run Test/Idle” state should never be reached, other-
 322 wise, when in debug state, the core will not be correctly isolated and intrusive
 323 commands occur. Therefore, it is recommended to pass directly from the “Update”
 324 state” to the “Select DR” state each time the “Update” state is reached.
 325 */
 326   unsigned long retval;
 327   if (current_chain != chain) {     // breaks shit when going from idcode back to scan chain
 328     SHIFT_IR;
 329     jtagarmtransn(ARM7TDMI_IR_SCAN_N, 4, LSB, END, NORETIDLE);
 330     SHIFT_DR;
 331     retval = jtagarmtransn(chain, 4, LSB, END, NORETIDLE);
 332     current_chain = chain;
 333   }    else
 334     retval = current_chain;
 335   // put in test mode...
 336   SHIFT_IR;
 337   jtagarmtransn(testmode, 4, LSB, END, RETIDLE);
 338   return(retval);
 339 }
 340
 341
 342 //!  Connect the appropriate scan chain to TDO/TDI.  SCAN_N, INTEST, ENDS IN SHIFT_DR!!!!!
 343 unsigned long jtagarm7tdmi_scan_intest(int chain) {               // PROVEN
 344   return jtagarm7tdmi_scan(chain, ARM7TDMI_IR_INTEST);
 345 }
 346
 347
 348
 349
 350 //! push an instruction into the pipeline
 351 unsigned long jtagarm7tdmi_instr_primitive(unsigned long instr, char breakpt){
 352   unsigned long retval;
 353   //jtagarm7tdmi_resettap();                  // FIXME: DEBUG: seems necessary for some reason.  ugh.
 354   jtagarm7tdmi_scan_intest(1);
 355
 356   SHIFT_DR;
 357   // if the next instruction is to run using MCLK (master clock), set TDI
 358   if (breakpt)
 359     {
 360     SETMOSI;
 361     count_sysspd_instr_since_debug++;
 362     }
 363   else
 364     {
 365     CLRMOSI;
 366     count_dbgspd_instr_since_debug++;
 367     }
 368   jtag_arm_tcktock();
 369
 370   // Now shift in the 32 bits
 371   retval = jtagarmtransn(instr, 32, MSB, END, RETIDLE);    // Must return to RUN-TEST/IDLE state for instruction to enter pipeline, and causes debug clock.
 372   //jtag_arm_tcktock();
 373   return(retval);
 374
 375 }
 376
 377
 378 unsigned long jtagarm7tdmi_nop(char breakpt){
 379   return jtagarm7tdmi_instr_primitive(ARM_INSTR_NOP, breakpt);
 380 }
 381
 382 /*    stolen from ARM DDI0029G documentation, translated using ARM Architecture Reference Manual (14128.pdf)
 383 STR R0, [R0]; Save R0 before use
 384 MOV R0, PC ; Copy PC into R0
 385 STR R0, [R0]; Now save the PC in R0
 386 BX PC ; Jump into ARM state
 387 MOV R8, R8 ;
 388 MOV R8, R8 ;
 389 NOP
 390 NOP
 391
 392 */
 393 //! set the current mode to ARM, returns PC (FIXME).  Should be used by haltcpu(), which should also store PC and the THUMB state, for use by releasecpu();
 394 unsigned long jtagarm7tdmi_setMode_ARM(){               // PROVEN
 395   unsigned long retval = 0xff;
 396   while ((jtagarm7tdmi_get_dbgstate() & JTAG_ARM7TDMI_DBG_TBIT)&& retval-- > 0){
 397     cmddataword[6] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_NOP,0);
 398     cmddataword[1] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_STR_R0_r0,0);
 399     cmddataword[2] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_MOV_R0_PC,0);
 400     cmddataword[3] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_STR_R0_r0,0);
 401     cmddataword[4] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_BX_PC,0);
 402     cmddataword[5] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_NOP,0);
 403     cmddataword[6] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_NOP,0);
 404     jtagarm7tdmi_resettap();                  // seems necessary for some reason.  ugh.
 405   }
 406   return(retval);
 407 }
 408
 409
 410
 411
 412 /************************* EmbeddedICE Primitives ****************************/
 413 //! shifter for writing to chain2 (EmbeddedICE).
 414 unsigned long eice_write(unsigned char reg, unsigned long data){
 415   unsigned long retval, temp;
 416   jtagarm7tdmi_scan_intest(2);
 417   // Now shift in the 32 bits
 418   SHIFT_DR;
 419   retval = jtagarmtransn(data, 32, LSB, NOEND, NORETIDLE);          // send in the data - 32-bits lsb
 420   temp = jtagarmtransn(reg, 5, LSB, NOEND, NORETIDLE);              // send in the register address - 5 bits lsb
 421   jtagarmtransn(1, 1, LSB, END, RETIDLE);                           // send in the WRITE bit
 422
 423   //SETTMS;   // Last Bit - Exit UPDATE_DR
 424   //// is this update a read/write or just read?
 425   //SETMOSI;
 426   //jtag_arm_tcktock();
 427
 428   return(retval);
 429 }
 430
 431 //! shifter for reading from chain2 (EmbeddedICE).
 432 unsigned long eice_read(unsigned char reg){               // PROVEN
 433   unsigned long temp;
 434   jtagarm7tdmi_scan_intest(2);
 435
 436   // send in the register address - 5 bits LSB
 437   SHIFT_DR;
 438   temp = jtagarmtransn(reg, 5, LSB, NOEND, NORETIDLE);
 439
 440   // clear TDI to select "read only"
 441   jtagarmtransn(0, 1, LSB, END, RETIDLE);
 442
 443   SHIFT_DR;
 444   // Now shift out the 32 bits
 445   return(jtagarmtransn(0, 32, LSB, END, RETIDLE));   // atmel arm jtag docs pp.10-11: LSB first
 446
 447 }
 448
 449
 450
 451
 452 /************************* ICEBreaker/EmbeddedICE Stuff ******************************/
 453 //! Grab debug register
 454 unsigned long jtagarm7tdmi_get_dbgstate() {       // ICE Debug register, *NOT* ARM register DSCR    //    PROVEN
 455   //jtagarm7tdmi_resettap();
 456   return eice_read(EICE_DBGSTATUS);
 457 }
 458
 459 //! Grab debug register
 460 unsigned long jtagarm7tdmi_get_dbgctrl() {
 461   return eice_read(EICE_DBGCTRL);
 462 }
 463
 464 //! Update debug register
 465 unsigned long jtagarm7tdmi_set_dbgctrl(unsigned long bits) {
 466   return eice_write(EICE_DBGCTRL, bits);
 467 }
 468
 469
 470
 471 //!  Set and Enable Watchpoint 0
 472 void jtagarm7tdmi_set_watchpoint0(unsigned long addr, unsigned long addrmask, unsigned long data, unsigned long datamask, unsigned long ctrl, unsigned long ctrlmask){
 473   // store watchpoint info?  - not right now
 474     // FIXME: store info
 475
 476   eice_write(EICE_WP0ADDR, addr);           // write 0 in watchpoint 0 address
 477   eice_write(EICE_WP0ADDRMASK, addrmask);   // write 0xffffffff in watchpoint 0 address mask
 478   eice_write(EICE_WP0DATA, data);           // write 0 in watchpoint 0 data
 479   eice_write(EICE_WP0DATAMASK, datamask);   // write 0xffffffff in watchpoint 0 data mask
 480   eice_write(EICE_WP0CTRL, ctrlmask);       // write 0x00000100 in watchpoint 0 control value register (enables watchpoint)
 481   eice_write(EICE_WP0CTRLMASK, ctrlmask);   // write 0xfffffff7 in watchpoint 0 control mask - only detect the fetch instruction
 482 }
 483
 484 //!  Set and Enable Watchpoint 1
 485 void jtagarm7tdmi_set_watchpoint1(unsigned long addr, unsigned long addrmask, unsigned long data, unsigned long datamask, unsigned long ctrl, unsigned long ctrlmask){
 486   // store watchpoint info?  - not right now
 487     // FIXME: store info
 488
 489   eice_write(EICE_WP1ADDR, addr);           // write 0 in watchpoint 1 address
 490   eice_write(EICE_WP1ADDRMASK, addrmask);   // write 0xffffffff in watchpoint 1 address mask
 491   eice_write(EICE_WP1DATA, data);           // write 0 in watchpoint 1 data
 492   eice_write(EICE_WP1DATAMASK, datamask);   // write 0xffffffff in watchpoint 1 data mask
 493   eice_write(EICE_WP1CTRL, ctrl);           // write 0x00000100 in watchpoint 1 control value register (enables watchpoint)
 494   eice_write(EICE_WP1CTRLMASK, ctrlmask);   // write 0xfffffff7 in watchpoint 1 control mask - only detect the fetch instruction
 495 }
 496
 497 //!  Disable Watchpoint 0
 498 void jtagarm7tdmi_disable_watchpoint0(){
 499   eice_write(EICE_WP0CTRL, 0x0); // write 0 in watchpoint 0 control value - disables watchpoint 0
 500 }
 501
 502 //!  Disable Watchpoint 1
 503 void jtagarm7tdmi_disable_watchpoint1(){
 504   eice_write(EICE_WP1CTRL, 0x0);            // write 0 in watchpoint 0 control value - disables watchpoint 0
 505 }
 506
 507
 508
 509 /******************** Complex Commands **************************/
 510
 511 //! Push an instruction into the CPU pipeline
 512 //  NOTE!  Must provide EXECNOPARM for parameter if no parm is required.
 513 unsigned long jtagarm7tdmi_exec(unsigned long instr, unsigned long parameter, unsigned char systemspeed) {
 514   unsigned long retval;
 515
 516   debughex32(jtagarm7tdmi_nop( 0));
 517   debughex32(jtagarm7tdmi_nop(systemspeed));
 518   debughex32(jtagarm7tdmi_instr_primitive(instr, 0));      // write 32-bit instruction code into DR
 519   debughex32(jtagarm7tdmi_nop( 0));
 520   debughex32(jtagarm7tdmi_nop( 0));
 521   debughex32(jtagarm7tdmi_instr_primitive(parameter, 0));  // inject long
 522   debughex32(jtagarm7tdmi_nop( 0));
 523   retval = jtagarm7tdmi_nop( 0);
 524   debughex32(retval);
 525   debughex32(jtagarm7tdmi_nop( 0));
 526
 527   return(retval);
 528 }
 529
 530 //! Retrieve a 32-bit Register value
 531 unsigned long jtagarm7tdmi_get_register(unsigned char reg) {
 532   unsigned long retval = 0, instr;
 533   // push nop into pipeline - clean out the pipeline...
 534   instr = ARM_READ_REG | (reg<<12);                     // push STR Rx, [R14] into pipeline
 535
 536   debughex32(jtagarm7tdmi_nop( 0));
 537   debughex32(jtagarm7tdmi_instr_primitive(instr, 0));
 538   debughex32(jtagarm7tdmi_nop( 0));                // push nop into pipeline - fetched
 539   debughex32(jtagarm7tdmi_nop( 0));                // push nop into pipeline - decoded
 540   jtagarm7tdmi_nop( 0);                // push nop into pipeline - executed
 541   retval = jtagarm7tdmi_nop( 0);                        // recover 32-bit word
 542   debughex32(retval);
 543   debughex32(jtagarm7tdmi_nop( 0));
 544   debughex32(jtagarm7tdmi_nop( 0));
 545   debughex32(jtagarm7tdmi_nop( 0));
 546   return retval;
 547 }
 548
 549 //! Set a 32-bit Register value
 550 unsigned long jtagarm7tdmi_set_register(unsigned char reg, unsigned long val) {
 551   unsigned long retval = 0, instr;
 552   instr = ARM_WRITE_REG | (reg<<12);                // push LDR Rx, [R14] into pipeline
 553
 554   debughex32(jtagarm7tdmi_nop( 0));            // push nop into pipeline - clean out the pipeline...
 555   debughex32(jtagarm7tdmi_instr_primitive(instr, 0)); // push nop into pipeline - fetch
 556   debughex32(jtagarm7tdmi_nop( 0));            // push nop into pipeline - decode
 557   debughex32(jtagarm7tdmi_nop( 0));            // push nop into pipeline - execute
 558
 559   debughex32(jtagarm7tdmi_instr_primitive(val, 0)); // push 32-bit word on data bus
 560   debughex32(jtagarm7tdmi_nop( 0));            // push nop into pipeline - executed
 561
 562   //if (reg == ARM_REG_PC){
 563     debughex32(jtagarm7tdmi_nop( 0));
 564     debughex32(jtagarm7tdmi_nop( 0));
 565   //}
 566   debughex32(jtagarm7tdmi_nop( 0));
 567
 568   retval = cmddatalong[5];
 569   return(retval);
 570 }
 571
 572
 573
 574 //! Get all registers.  Return an array
 575 unsigned long* jtagarm7tdmi_get_registers() {
 576   debughex32(jtagarm7tdmi_instr_primitive(ARM_INSTR_SKANKREGS,0));
 577   debughex32(jtagarm7tdmi_nop( 0));
 578   debughex32(jtagarm7tdmi_nop( 0));
 579   debughex32(jtagarm7tdmi_nop( 0));
 580   debughex32(jtagarm7tdmi_nop( 0));
 581   debughex32(jtagarm7tdmi_nop( 0));
 582   debughex32(jtagarm7tdmi_nop( 0));
 583   debughex32(jtagarm7tdmi_nop( 0));
 584   debughex32(jtagarm7tdmi_nop( 0));
 585   debughex32(jtagarm7tdmi_nop( 0));
 586   debughex32(jtagarm7tdmi_nop( 0));
 587   debughex32(jtagarm7tdmi_nop( 0));
 588   debughex32(jtagarm7tdmi_nop( 0));
 589   debughex32(jtagarm7tdmi_nop( 0));
 590   debughex32(jtagarm7tdmi_nop( 0));
 591   debughex32(jtagarm7tdmi_nop( 0));
 592   debughex32(jtagarm7tdmi_nop( 0));
 593   debughex32(jtagarm7tdmi_nop( 0));
 594   debughex32(jtagarm7tdmi_nop( 0));
 595   debughex32(jtagarm7tdmi_nop( 0));
 596   return registers;
 597 }
 598
 599 //! Get all registers.  Return an array
 600 unsigned long* jtagarm7tdmi_set_registers() {   //FIXME: BORKEN... TOTALLY TRYING TO BUY A VOWEL
 601   debughex32(jtagarm7tdmi_instr_primitive(ARM_INSTR_SKANKREGS,0));
 602   debughex32(jtagarm7tdmi_nop( 0));
 603   debughex32(jtagarm7tdmi_nop( 0));
 604   debughex32(jtagarm7tdmi_instr_primitive(0x40,0));
 605   debughex32(jtagarm7tdmi_instr_primitive(0x41,0));
 606   debughex32(jtagarm7tdmi_instr_primitive(0x42,0));
 607   debughex32(jtagarm7tdmi_instr_primitive(0x43,0));
 608   debughex32(jtagarm7tdmi_instr_primitive(0x44,0));
 609   debughex32(jtagarm7tdmi_instr_primitive(0x45,0));
 610   debughex32(jtagarm7tdmi_instr_primitive(0x46,0));
 611   debughex32(jtagarm7tdmi_instr_primitive(0x47,0));
 612   debughex32(jtagarm7tdmi_instr_primitive(0x48,0));
 613   debughex32(jtagarm7tdmi_instr_primitive(0x49,0));
 614   debughex32(jtagarm7tdmi_instr_primitive(0x4a,0));
 615   debughex32(jtagarm7tdmi_instr_primitive(0x4b,0));
 616   debughex32(jtagarm7tdmi_instr_primitive(0x4c,0));
 617   debughex32(jtagarm7tdmi_instr_primitive(0x4d,0));
 618   debughex32(jtagarm7tdmi_instr_primitive(0x4e,0));
 619   debughex32(jtagarm7tdmi_instr_primitive(0x4f,0));
 620   return registers;
 621 }
 622
 623 //! Retrieve the CPSR Register value
 624 unsigned long jtagarm7tdmi_get_regCPSR() {
 625   unsigned long retval = 0;
 626
 627   cmddatalong[1] = jtagarm7tdmi_nop( 0); // push nop into pipeline - clean out the pipeline...
 628   cmddatalong[2] = jtagarm7tdmi_instr_primitive(ARM_INSTR_MRS_R0_CPSR, 0); // push MRS_R0, CPSR into pipeline
 629   cmddatalong[3] = jtagarm7tdmi_nop( 0); // push nop into pipeline - fetched
 630   cmddatalong[4] = jtagarm7tdmi_nop( 0); // push nop into pipeline - decoded
 631   cmddatalong[5] = jtagarm7tdmi_nop( 0); // push nop into pipeline - executed
 632   retval = jtagarm7tdmi_nop( 0);        // recover 32-bit word
 633   cmddatalong[6] = retval;
 634   return retval;
 635 }
 636
 637 //! Retrieve the CPSR Register value
 638 unsigned long jtagarm7tdmi_set_regCPSR(unsigned long val) {
 639   unsigned long retval = 0;
 640
 641   cmddatalong[1] = jtagarm7tdmi_nop( 0);        // push nop into pipeline - clean out the pipeline...
 642   cmddatalong[1] = jtagarm7tdmi_instr_primitive(ARM_INSTR_MSR_cpsr_cxsf_R0, 0); // push MSR cpsr_cxsf, R0 into pipeline
 643   cmddatalong[2] = jtagarm7tdmi_nop( 0);        // push nop into pipeline - fetched
 644   cmddatalong[3] = jtagarm7tdmi_nop( 0);        // push nop into pipeline - decoded
 645
 646   retval = jtagarm7tdmi_instr_primitive(val, 0);// push 32-bit word on data bus
 647   cmddatalong[5] = jtagarm7tdmi_nop( 0);        // push nop into pipeline - executed
 648   cmddatalong[4] = retval;
 649   return(retval);
 650 }
 651
 652 //! Write data to address - Assume TAP in run-test/idle state
 653 unsigned long jtagarm7tdmi_writemem(unsigned long adr, unsigned long data){
 654   unsigned long r0=0, r1=-1;
 655
 656   r0 = jtagarm7tdmi_get_register(0);        // store R0 and R1
 657   r1 = jtagarm7tdmi_get_register(1);
 658   jtagarm7tdmi_set_register(0, adr);        // write address into R0
 659   jtagarm7tdmi_set_register(1, data);       // write data in R1
 660   jtagarm7tdmi_nop( 0);                     // push nop into pipeline to "clean" it ???
 661   jtagarm7tdmi_nop( 1);                     // push nop into pipeline with BREAKPT set
 662   jtagarm7tdmi_instr_primitive(ARM_INSTR_LDR_R1_r0_4, 0); // push LDR R1, R0, #4 into instruction pipeline
 663   jtagarm7tdmi_nop( 0);                     // push nop into pipeline
 664   jtagarm7tdmi_set_register(1, r1);         // restore R0 and R1
 665   jtagarm7tdmi_set_register(0, r0);
 666   return(-1);
 667 }
 668
 669
 670
 671
 672 //! Read data from address
 673 unsigned long jtagarm7tdmi_readmem(unsigned long adr){
 674   unsigned long retval = 0;
 675   unsigned long r0=0, r1=-1;
 676   int waitcount = 0xfff;
 677
 678   r0 = jtagarm7tdmi_get_register(0);        // store R0 and R1
 679   r1 = jtagarm7tdmi_get_register(1);
 680   jtagarm7tdmi_set_register(0, adr);        // write address into R0
 681   jtagarm7tdmi_nop( 0);                     // push nop into pipeline to "clean" it ???
 682   jtagarm7tdmi_nop( 1);                     // push nop into pipeline with BREAKPT set
 683   jtagarm7tdmi_instr_primitive(ARM_INSTR_LDR_R1_r0_4, 0); // push LDR R1, R0, #4 into instruction pipeline
 684   jtagarm7tdmi_nop( 0);                     // push nop into pipeline
 685   jtagarm7tdmi_restart();                   // SHIFT_IR with RESTART instruction
 686
 687   // Poll the Debug Status Register for DBGACK and nMREQ to be HIGH
 688   while ((jtagarm7tdmi_get_dbgstate() & 9) == 0  && waitcount > 0){
 689     delay(1);
 690     waitcount --;
 691   }
 692   if (waitcount == 0){
 693     return (-1);
 694   } else {
 695     retval = jtagarm7tdmi_get_register(1);  // read memory value from R1 register
 696     jtagarm7tdmi_set_register(1, r1);         // restore R0 and R1
 697     jtagarm7tdmi_set_register(0, r0);
 698   }
 699   return retval;
 700 }
 701
 702
 703 //! Read Program Counter
 704 unsigned long jtagarm7tdmi_getpc(){
 705   return jtagarm7tdmi_get_register(ARM_REG_PC);
 706 }
 707
 708 //! Set Program Counter
 709 unsigned long jtagarm7tdmi_setpc(unsigned long adr){
 710   return jtagarm7tdmi_set_register(ARM_REG_PC, adr);
 711 }
 712
 713 //! Halt CPU - returns 0xffff if the operation fails to complete within
 714 unsigned long jtagarm7tdmi_haltcpu(){                   //  PROVEN
 715   int waitcount = 0xfff;
 716
 717   // store watchpoint info?  - not right now
 718   eice_write(EICE_WP1ADDR, 0);              // write 0 in watchpoint 1 address
 719   eice_write(EICE_WP1ADDRMASK, 0xffffffff); // write 0xffffffff in watchpoint 1 address mask
 720   eice_write(EICE_WP1DATA, 0);              // write 0 in watchpoint 1 data
 721   eice_write(EICE_WP1DATAMASK, 0xffffffff); // write 0xffffffff in watchpoint 1 data mask
 722   eice_write(EICE_WP1CTRL, 0x100);          //!!!!! WTF!  THIS IS SUPPOSED TO BE 9 bits wide?!?  // write 0x00000100 in watchpoint 1 control value register (enables watchpoint)
 723   eice_write(EICE_WP1CTRLMASK, 0xfffffff7); //!!!!! WTF!  THIS IS SUPPOSED TO BE 8 bits wide?!?  // write 0xfffffff7 in watchpoint 1 control mask - only detect the fetch instruction
 724
 725   // poll until debug status says the cpu is in debug mode
 726   while (!(jtagarm7tdmi_get_dbgstate() & 0x1)   && waitcount-- > 0){
 727     delay(1);
 728   }
 729   eice_write(EICE_WP1CTRL, 0x0);            // write 0 in watchpoint 0 control value - disables watchpoint 0
 730
 731   // store the debug state
 732   last_halt_debug_state = jtagarm7tdmi_get_dbgstate();
 733   last_halt_pc = jtagarm7tdmi_getpc() - 4;  // assume -4 for entering debug mode via watchpoint.
 734   count_dbgspd_instr_since_debug = 0;
 735   count_sysspd_instr_since_debug = 0;
 736
 737   // get into ARM mode if the T flag is set (Thumb mode)
 738   while (jtagarm7tdmi_get_dbgstate() & JTAG_ARM7TDMI_DBG_TBIT && waitcount-- > 0) {
 739     jtagarm7tdmi_setMode_ARM();
 740   }
 741   jtagarm7tdmi_resettap();
 742   return waitcount;
 743 }
 744
 745 unsigned long jtagarm7tdmi_releasecpu(){
 746   int waitcount = 0xfff;
 747   unsigned long instr;
 748   // somehow determine what PC should be (a couple ways possible, calculations required)
 749   jtagarm7tdmi_nop(0);                          // NOP
 750   jtagarm7tdmi_nop(1);                          // NOP/BREAKPT
 751
 752   if (last_halt_debug_state & JTAG_ARM7TDMI_DBG_TBIT){      // FIXME:  FORNICATED!  BX requires register, thus more instrs... could we get away with the same instruction but +1 to offset?
 753     instr = ARM_INSTR_B_PC + 0x1000001 - (count_dbgspd_instr_since_debug) - (count_sysspd_instr_since_debug*3);  //FIXME: make this right  - can't we just do an a7solute b/bx?
 754     jtagarm7tdmi_instr_primitive(instr,0);
 755   } else {
 756     instr = ARM_INSTR_B_PC + 0x1000000 - (count_dbgspd_instr_since_debug*4) - (count_sysspd_instr_since_debug*12);
 757     jtagarm7tdmi_instr_primitive(instr,0);
 758   }
 759
 760   SHIFT_IR;
 761   jtagarmtransn(ARM7TDMI_IR_RESTART,4,LSB,END,RETIDLE); // VERB_RESTART
 762
 763   // wait until restart-bit set in debug state register
 764   while ((jtagarm7tdmi_get_dbgstate() & JTAG_ARM7TDMI_DBG_DBGACK) && waitcount > 0){
 765     msdelay(1);
 766     waitcount --;
 767   }
 768   last_halt_debug_state = -1;
 769   last_halt_pc = -1;
 770   return 0;
 771 }
 772
 773
 774
 775
 776 ///////////////////////////////////////////////////////////////////////////////////////////////////
 777 //! Handles ARM7TDMI JTAG commands.  Forwards others to JTAG.
 778 void jtagarm7tdmihandle(unsigned char app, unsigned char verb, unsigned long len){
 779   register char blocks;
 780
 781   unsigned int i,val,mlop;
 782   unsigned long at;
 783
 784   jtagarm7tdmi_resettap();
 785
 786   switch(verb){
 787   case START:
 788     //Enter JTAG mode.
 789     cmddatalong[0] = jtagarm7tdmi_start();
 790     cmddatalong[2] = jtagarm7tdmi_haltcpu();
 791     //jtagarm7tdmi_resettap();
 792     cmddatalong[1] = jtagarm7tdmi_get_dbgstate();
 793
 794     // DEBUG: FIXME: NOT PART OF OPERATIONAL CODE
 795     //for (mlop=2;mlop<4;mlop++){
 796     //  jtagarm7tdmi_set_register(mlop, 0x43424140);
 797     //}
 798     /////////////////////////////////////////////
 799     txdata(app,verb,0xc);
 800     break;
 801   case JTAGARM7TDMI_READMEM:
 802   case PEEK:
 803     blocks=(len>4?cmddata[4]:1);
 804     at=cmddatalong[0];
 805
 806     len=0x80;
 807     txhead(app,verb,len);
 808
 809     while(blocks--){
 810       for(i=0;i<len;i+=2){
 811         jtagarm7tdmi_resettap();
 812         delay(10);
 813
 814         val=jtagarm7tdmi_readmem(at);
 815
 816         at+=2;
 817         serial_tx(val&0xFF);
 818         serial_tx((val&0xFF00)>>8);
 819       }
 820     }
 821
 822     break;
 823   case JTAGARM7TDMI_GET_CHIP_ID:
 824         jtagarm7tdmi_resettap();
 825     cmddatalong[0] = jtagarm7tdmi_idcode();
 826     txdata(app,verb,4);
 827     break;
 828
 829
 830   case JTAGARM7TDMI_WRITEMEM:
 831   case POKE:
 832         jtagarm7tdmi_resettap();
 833     jtagarm7tdmi_writemem(cmddatalong[0],
 834                        cmddataword[2]);
 835     cmddataword[0]=jtagarm7tdmi_readmem(cmddatalong[0]);
 836     txdata(app,verb,2);
 837     break;
 838
 839   case JTAGARM7TDMI_HALTCPU:
 840     cmddatalong[0] = jtagarm7tdmi_haltcpu();
 841     txdata(app,verb,4);
 842     break;
 843   case JTAGARM7TDMI_RELEASECPU:
 844         jtagarm7tdmi_resettap();
 845     cmddatalong[0] = jtagarm7tdmi_releasecpu();
 846     txdata(app,verb,4);
 847     break;
 848   //unimplemented functions
 849   //case JTAGARM7TDMI_SETINSTRFETCH:
 850   //case JTAGARM7TDMI_WRITEFLASH:
 851   //case JTAGARM7TDMI_ERASEFLASH:
 852   case JTAGARM7TDMI_SET_PC:
 853     cmddatalong[0] = jtagarm7tdmi_setpc(cmddatalong[0]);
 854     txdata(app,verb,4);
 855     break;
 856   case JTAGARM7TDMI_GET_DEBUG_CTRL:
 857     cmddatalong[0] = jtagarm7tdmi_get_dbgctrl();
 858     txdata(app,verb,1);
 859     break;
 860   case JTAGARM7TDMI_SET_DEBUG_CTRL:
 861     cmddatalong[0] = jtagarm7tdmi_set_dbgctrl(cmddata[0]);
 862     txdata(app,verb,4);
 863     break;
 864   case JTAGARM7TDMI_GET_PC:
 865     cmddatalong[0] = jtagarm7tdmi_getpc();
 866     txdata(app,verb,4);
 867     break;
 868   case JTAGARM7TDMI_GET_DEBUG_STATE:
 869     //jtagarm7tdmi_resettap();            // Shouldn't need this, but currently do.  FIXME!
 870     cmddatalong[0] = jtagarm7tdmi_get_dbgstate();
 871     txdata(app,verb,4);
 872     break;
 873   //case JTAGARM7TDMI_GET_WATCHPOINT:
 874   //case JTAGARM7TDMI_SET_WATCHPOINT:
 875   case JTAGARM7TDMI_GET_REGISTER:
 876         jtagarm7tdmi_resettap();
 877     cmddatalong[0] = jtagarm7tdmi_get_register(cmddata[0]);
 878     //cmddatalong[0] = test_get_register(cmddata[0]);
 879     txdata(app,verb,96);
 880     break;
 881   case JTAGARM7TDMI_SET_REGISTER:           // FIXME: NOT AT ALL CORRECT, THIS IS TESTING CODE ONLY
 882         jtagarm7tdmi_resettap();
 883     cmddatalong[0] = cmddatalong[1];
 884     jtagarm7tdmi_set_register(cmddata[0], cmddatalong[1]);
 885     //test_set_register(cmddata[0], cmddatalong[1]);
 886     txdata(app,verb,96);
 887     break;
 888   case JTAGARM7TDMI_GET_REGISTERS:
 889         jtagarm7tdmi_resettap();
 890     jtagarm7tdmi_get_registers();
 891     txdata(app,verb,200);
 892     break;
 893   case JTAGARM7TDMI_SET_REGISTERS:
 894         jtagarm7tdmi_resettap();
 895     jtagarm7tdmi_set_registers();
 896     txdata(app,verb,200);
 897     break;
 898   case JTAGARM7TDMI_DEBUG_INSTR:
 899         jtagarm7tdmi_resettap();
 900     cmddataword[0] = jtagarm7tdmi_exec(cmddataword[0], cmddataword[1], cmddata[9]);
 901     txdata(app,verb,80);
 902     break;
 903   //case JTAGARM7TDMI_STEP_INSTR:
 904 /*  case JTAGARM7TDMI_READ_CODE_MEMORY:
 905   case JTAGARM7TDMI_WRITE_FLASH_PAGE:
 906   case JTAGARM7TDMI_READ_FLASH_PAGE:
 907   case JTAGARM7TDMI_MASS_ERASE_FLASH:
 908   case JTAGARM7TDMI_PROGRAM_FLASH:
 909   case JTAGARM7TDMI_LOCKCHIP:
 910   case JTAGARM7TDMI_CHIP_ERASE:
 911   */
 912 // Really ARM specific stuff
 913   case JTAGARM7TDMI_GET_CPSR:
 914         jtagarm7tdmi_resettap();
 915     cmddatalong[0] = jtagarm7tdmi_get_regCPSR();
 916     txdata(app,verb,4);
 917     break;
 918   case JTAGARM7TDMI_SET_CPSR:
 919         jtagarm7tdmi_resettap();
 920     cmddatalong[0] = jtagarm7tdmi_set_regCPSR(cmddatalong[0]);
 921     txdata(app,verb,4);
 922     break;
 923   case JTAGARM7TDMI_GET_SPSR:           // FIXME: NOT CORRECT
 924         jtagarm7tdmi_resettap();
 925     cmddatalong[0] = jtagarm7tdmi_get_regCPSR();
 926     txdata(app,verb,4);
 927     break;
 928   case JTAGARM7TDMI_SET_SPSR:           // FIXME: NOT CORRECT
 929         jtagarm7tdmi_resettap();
 930     cmddatalong[0] = jtagarm7tdmi_set_regCPSR(cmddatalong[0]);
 931     txdata(app,verb,4);
 932     break;
 933   case JTAGARM7TDMI_SET_MODE_THUMB:
 934   case JTAGARM7TDMI_SET_MODE_ARM:
 935         jtagarm7tdmi_resettap();
 936     cmddataword[0] = jtagarm7tdmi_setMode_ARM();
 937     txdata(app,verb,4);
 938     break;
 939
 940   case 0xD0:          // loopback test
 941     jtagarm7tdmi_resettap();
 942     cmddatalong[0] = jtagarm7tdmi_bypass(cmddatalong[0]);
 943     txdata(app,verb,4);
 944     break;
 945   case 0xD8:          // EICE_READ
 946     jtagarm7tdmi_resettap();
 947     cmddatalong[0] = eice_read(cmddatalong[0]);
 948     txdata(app,verb,4);
 949     break;
 950   case 0xD9:          // EICE_WRITE
 951     jtagarm7tdmi_resettap();
 952     cmddatalong[0] = eice_write(cmddatalong[0], cmddatalong[1]);
 953     txdata(app,verb,4);
 954     break;
 955   case 0xDA:          // TEST MSB THROUGH CHAIN0 and CHAIN1
 956     jtagarm7tdmi_resettap();
 957     jtagarm7tdmi_scan_intest(0);
 958     cmddatalong[0] = jtagarmtransn(0x41414141, 32, LSB, NOEND, NORETIDLE);
 959     cmddatalong[1] = jtagarmtransn(0x42424242, 32, MSB, NOEND, NORETIDLE);
 960     cmddatalong[2] = jtagarmtransn(0x43434343,  9, MSB, NOEND, NORETIDLE);
 961     cmddatalong[3] = jtagarmtransn(0x44444444, 32, MSB, NOEND, NORETIDLE);
 962     cmddatalong[4] = jtagarmtransn(cmddatalong[0], 32, LSB, NOEND, NORETIDLE);
 963     cmddatalong[5] = jtagarmtransn(cmddatalong[1], 32, MSB, NOEND, NORETIDLE);
 964     cmddatalong[6] = jtagarmtransn(cmddatalong[2],  9, MSB, NOEND, NORETIDLE);
 965     cmddatalong[7] = jtagarmtransn(cmddatalong[3], 32, MSB, END, RETIDLE);
 966     jtagarm7tdmi_resettap();
 967     jtagarm7tdmi_scan_intest(1);
 968     cmddatalong[8] = jtagarmtransn(0x41414141, 32, MSB, NOEND, NORETIDLE);
 969     cmddatalong[9] = jtagarmtransn(0x44444444,  1, MSB, NOEND, NORETIDLE);
 970     cmddatalong[10] = jtagarmtransn(cmddatalong[8], 32, MSB, NOEND, NORETIDLE);
 971     cmddatalong[11] = jtagarmtransn(cmddatalong[9],  1, MSB, END, RETIDLE);
 972     jtagarm7tdmi_resettap();
 973     txdata(app,verb,48);
 974     break;
 975
 976   default:
 977     jtaghandle(app,verb,len);
 978   }
 979 }
 980
 981
 982
 983
 984 /*****************************
 985 Captured from FlySwatter against AT91SAM7S, to be used by me for testing.  ignore
 986
 987 > arm reg
 988 System and User mode registers
 989       r0: 300000df       r1: 00000000       r2: 58000000       r3: 00200a75
 990       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
 991       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
 992      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 000000fc
 993     cpsr: 00000093
 994
 995 FIQ mode shadow registers
 996   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
 997  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
 998
 999 Supervisor mode shadow registers
1000   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1001
1002 Abort mode shadow registers
1003   sp_abt: 00000000   lr_abt: 00000000 spsr_abt: e00000ff
1004
1005 IRQ mode shadow registers
1006   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1007
1008 Undefined instruction mode shadow registers
1009   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1010 >
1011 > step;arm reg
1012 target state: halted
1013 target halted in ARM state due to single-step, current mode: Supervisor
1014 cpsr: 0x00000093 pc: 0x00000100
1015 System and User mode registers
1016       r0: 300000df       r1: 00000000       r2: 00200000       r3: 00200a75
1017       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1018       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1019      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000100
1020     cpsr: 00000093
1021
1022 FIQ mode shadow registers
1023   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1024  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1025
1026 Supervisor mode shadow registers
1027   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1028
1029 Abort mode shadow registers
1030   sp_abt: 00000000   lr_abt: 00000000 spsr_abt: e00000ff
1031
1032 IRQ mode shadow registers
1033   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1034
1035 Undefined instruction mode shadow registers
1036   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1037 >
1038  step;arm reg
1039 target state: halted
1040 target halted in ARM state due to single-step, current mode: Abort
1041 cpsr: 0x00000097 pc: 0x00000010
1042 System and User mode registers
1043       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1044       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1045       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1046      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1047     cpsr: 00000097
1048
1049 FIQ mode shadow registers
1050   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1051  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1052
1053 Supervisor mode shadow registers
1054   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1055
1056 Abort mode shadow registers
1057   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1058
1059 IRQ mode shadow registers
1060   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1061
1062 Undefined instruction mode shadow registers
1063   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1064 > step;arm reg
1065 target state: halted
1066 target halted in ARM state due to single-step, current mode: Abort
1067 cpsr: 0x00000097 pc: 0x00000010
1068 System and User mode registers
1069       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1070       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1071       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1072      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1073     cpsr: 00000097
1074
1075 FIQ mode shadow registers
1076   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1077  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1078
1079 Supervisor mode shadow registers
1080   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1081
1082 Abort mode shadow registers
1083   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1084
1085 IRQ mode shadow registers
1086   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1087
1088 Undefined instruction mode shadow registers
1089   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1090 > step;arm reg
1091 target state: halted
1092 target halted in ARM state due to single-step, current mode: Abort
1093 cpsr: 0x00000097 pc: 0x00000010
1094 System and User mode registers
1095       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1096       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1097       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1098      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1099     cpsr: 00000097
1100
1101 FIQ mode shadow registers
1102   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1103  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1104
1105 Supervisor mode shadow registers
1106   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1107
1108 Abort mode shadow registers
1109   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1110
1111 IRQ mode shadow registers
1112   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1113
1114 Undefined instruction mode shadow registers
1115   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1116 > step;arm reg
1117 target state: halted
1118 target halted in ARM state due to single-step, current mode: Abort
1119 cpsr: 0x00000097 pc: 0x00000010
1120 System and User mode registers
1121       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1122       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1123       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1124      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1125     cpsr: 00000097
1126
1127 FIQ mode shadow registers
1128   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1129  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1130
1131 Supervisor mode shadow registers
1132   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1133
1134 Abort mode shadow registers
1135   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1136
1137 IRQ mode shadow registers
1138   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1139
1140 Undefined instruction mode shadow registers
1141   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1142 > step;arm reg
1143 target state: halted
1144 target halted in ARM state due to single-step, current mode: Abort
1145 cpsr: 0x00000097 pc: 0x00000010
1146 System and User mode registers
1147       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1148       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1149       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1150      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1151     cpsr: 00000097
1152
1153 FIQ mode shadow registers
1154   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1155  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1156
1157 Supervisor mode shadow registers
1158   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1159
1160 Abort mode shadow registers
1161   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1162
1163 IRQ mode shadow registers
1164   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1165
1166 Undefined instruction mode shadow registers
1167   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1168 > step;arm reg
1169 target state: halted
1170 target halted in ARM state due to single-step, current mode: Abort
1171 cpsr: 0x00000097 pc: 0x00000010
1172 System and User mode registers
1173       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1174       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1175       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1176      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1177     cpsr: 00000097
1178
1179 FIQ mode shadow registers
1180   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1181  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1182
1183 Supervisor mode shadow registers
1184   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1185
1186 Abort mode shadow registers
1187   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1188
1189 IRQ mode shadow registers
1190   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1191
1192 Undefined instruction mode shadow registers
1193   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1194 > step;arm reg
1195 target state: halted
1196 target halted in ARM state due to single-step, current mode: Abort
1197 cpsr: 0x00000097 pc: 0x00000010
1198 System and User mode registers
1199       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1200       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1201       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1202      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1203     cpsr: 00000097
1204
1205 FIQ mode shadow registers
1206   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1207  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1208
1209 Supervisor mode shadow registers
1210   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1211
1212 Abort mode shadow registers
1213   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1214
1215 IRQ mode shadow registers
1216   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1217
1218 Undefined instruction mode shadow registers
1219   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1220 > step;arm reg
1221 target state: halted
1222 target halted in ARM state due to single-step, current mode: Abort
1223 cpsr: 0x00000097 pc: 0x00000010
1224 System and User mode registers
1225       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1226       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1227       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1228      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1229     cpsr: 00000097
1230
1231 FIQ mode shadow registers
1232   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1233  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1234
1235 Supervisor mode shadow registers
1236   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1237
1238 Abort mode shadow registers
1239   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1240
1241 IRQ mode shadow registers
1242   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1243
1244 Undefined instruction mode shadow registers
1245   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1246 > step;arm reg
1247 target state: halted
1248 target halted in ARM state due to single-step, current mode: Abort
1249 cpsr: 0x00000097 pc: 0x00000010
1250 System and User mode registers
1251       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1252       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1253       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1254      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1255     cpsr: 00000097
1256
1257 FIQ mode shadow registers
1258   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1259  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1260
1261 Supervisor mode shadow registers
1262   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1263
1264 Abort mode shadow registers
1265   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1266
1267 IRQ mode shadow registers
1268   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1269
1270 Undefined instruction mode shadow registers
1271   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1272 >
1273 */