Updates to ARM7TDMI JTAG app and optimizations for debughex() and added debughex32...
[goodfet] / firmware / apps / jtag / jtagarm7tdmi.c
1 /*! \file jtagarm7tdmi.c
2   \brief ARM7TDMI JTAG (AT91R40008)
3 */
4
5 #include "platform.h"
6 #include "command.h"
7 #include "jtag.h"
8 #include "jtagarm7tdmi.h"
9
10
11 /**** 20-pin Connection Information (pin1 is on top-right for both connectors)****
12 GoodFET  ->  7TDMI 20-pin connector (HE-10 connector)
13   1               13 (TDO)
14   2               1  (Vdd)
15   3               5  (TDI)
16   5               7  (TMS)
17   7               9  (TCK)
18   8               15 (nRST)
19   9               4,6,8,10,12,14,16,18,20 (GND)
20   11              17/3 (nTRST)  (different sources suggest 17 or 3 alternately)
21 ********************************/
22
23 /**** 14-pin Connection Information (pin1 is on top-right for both connectors)****
24 GoodFET  ->  7TDMI 14-pin connector
25   1               11 (TDO)
26   2               1  (Vdd)
27   3               5  (TDI)
28   5               7  (TMS)
29   7               9  (TCK)
30   8               12 (nRST)
31   9               2,4,6,8,10,14 (GND)
32   11              3 (nTRST)
33
34 http://hri.sourceforge.net/tools/jtag_faq_org.html
35 ********************************/
36
37
38
39
40
41
42 /****************************************************************
43 Enabling jtag likely differs with most platforms.  We will attempt to enable most from here.  Override jtagarm7tdmi_start() to extend for other implementations
44 ARM7TDMI enables three different scan chains:
45     * Chain0 - "entire periphery" including data bus
46     * Chain1 - core data bus (subset of Chain0)  - Instruction Pipeline
47     * Chain2 - EmbeddedICE Logic Registers - This is our way into the fun stuff.
48     
49
50 ---
51 You can disable EmbeddedICE-RT by setting the DBGEN input LOW.
52 Caution
53 Hard wiring the DBGEN input LOW permanently disables all debug functionality.
54 When DBGEN is LOW, it inhibits DBGDEWPT, DBGIEBKPT, and EDBGRQ to
55 the core, and DBGACK from the ARM9E-S core is always LOW.
56 ---
57
58
59 ---
60 When the ARM9E-S core is in debug state, you can examine the core and system state
61 by forcing the load and store multiples into the instruction pipeline.
62 Before you can examine the core and system state, the debugger must determine
63 whether the processor entered debug from Thumb state or ARM state, by examining
64 bit 4 of the EmbeddedICE-RT debug status register. If bit 4 is HIGH, the core has
65 entered debug from Thumb state.
66 For more details about determining the core state, see Determining the core and system
67 state on page B-18.
68 ---
69
70
71 --- olimex - http://www.olimex.com/dev/pdf/arm-jtag.pdf
72 JTAG signals description:
73 PIN.1 (VTREF) Target voltage sense. Used to indicate the target’s operating voltage to thedebug tool.
74 PIN.2 (VTARGET) Target voltage. May be used to supply power to the debug tool.
75 PIN.3 (nTRST) JTAG TAP reset, this signal should be pulled up to Vcc in target board.
76 PIN4,6, 8, 10,12,14,16,18,20 Ground. The Gnd-Signal-Gnd-Signal strategy implemented on the 20-way connection scheme improves noiseimmunity on the target connect cable.
77 *PIN.5 (TDI) JTAG serial data in, should be pulled up to Vcc on target board.
78 *PIN.7 (TMS) JTAG TAP Mode Select, should be pulled up to Vcc on target board.
79 *PIN.9 (TCK) JTAG clock.
80 PIN.11 (RTCK) JTAG retimed clock.Implemented on certain ASIC ARM implementations the host ASIC may need to synchronize external inputs (such as JTAG inputs) with its own internal clock.
81 *PIN.13 (TDO) JTAG serial data out.
82 *PIN.15 (nSRST) Target system reset.
83 *PIN.17 (DBGRQ) Asynchronous debug request.  DBGRQ allows an external signal to force the ARM core into debug mode, should be pull down to GND.
84 PIN.19 (DBGACK) Debug acknowledge. The ARM core acknowledges debug-mode inresponse to a DBGRQ input.
85
86
87 -----------  SAMPLE TIMES  -----------
88
89 TDI and TMS are sampled on the rising edge of TCK and TDO transitions appear on the falling edge of TCK. Therefore, TDI and TMS must be written after the falling edge of TCK and TDO must be read after the rising edge of TCK.
90
91 for this module, we keep tck high for all changes/sampling, and then bounce it.
92 ****************************************************************/
93
94
95
96 /************************** JTAGARM7TDMI Primitives ****************************/
97 void jtag_goto_shift_ir() {
98   SETTMS;
99   jtag_arm_tcktock();
100   jtag_arm_tcktock();
101   CLRTMS;
102   jtag_arm_tcktock();
103   jtag_arm_tcktock();
104
105 }
106
107 void jtag_goto_shift_dr() {
108   SETTMS;
109   jtag_arm_tcktock();
110   CLRTMS;
111   jtag_arm_tcktock();
112   jtag_arm_tcktock();
113 }
114
115 void jtag_reset_to_runtest_idle() {
116   SETTMS;
117   jtag_arm_tcktock();
118   jtag_arm_tcktock();
119   jtag_arm_tcktock();
120   jtag_arm_tcktock();
121   jtag_arm_tcktock();
122   jtag_arm_tcktock();
123   jtag_arm_tcktock();
124   jtag_arm_tcktock();  // now in Reset state
125   CLRTMS;
126   jtag_arm_tcktock();  // now in Run-Test/Idle state
127 }
128
129 void jtag_arm_tcktock() {
130   CLRTCK; 
131   PLEDOUT^=PLEDPIN; 
132   SETTCK; 
133   PLEDOUT^=PLEDPIN;
134 }
135
136
137 // ! Start JTAG, setup pins, reset TAP and return IDCODE
138 unsigned long jtagarm7tdmi_start() {
139   jtagsetup();
140   //Known-good starting position.
141   //Might be unnecessary.
142   //SETTST;
143   //SETRST;
144   
145   //delay(0x2);
146   
147   //CLRRST;
148   //delay(2);
149   //CLRTST;
150
151   //msdelay(10);
152   //SETRST;
153   /*
154   P5DIR &=~RST;
155   */
156   //delay(0x2);
157   jtagarm7tdmi_resettap();
158   return jtagarm7tdmi_idcode();
159 }
160
161
162 //! Reset TAP State Machine       
163 void jtagarm7tdmi_resettap(){               // PROVEN
164   current_chain = -1;
165   jtag_reset_to_runtest_idle();
166 }
167
168
169 //  NOTE: important: THIS MODULE REVOLVES AROUND RETURNING TO RUNTEST/IDLE, OR THE FUNCTIONAL EQUIVALENT
170
171
172 //! Shift N bits over TDI/TDO.  May choose LSB or MSB, and select whether to terminate (TMS-high on last bit) and whether to return to RUNTEST/IDLE
173 unsigned long jtagarmtransn(unsigned long word, unsigned char bitcount, unsigned char lsb, unsigned char end, unsigned char retidle){               // PROVEN
174   unsigned int bit;
175   unsigned long high = 1;
176   unsigned long mask;
177
178   for (bit=(bitcount-1)/8; bit>0; bit--)
179     high <<= 8;
180   high <<= ((bitcount-1)%8);
181
182   mask = high-1;
183
184   if (lsb) {
185     for (bit = bitcount; bit > 0; bit--) {
186       /* write MOSI on trailing edge of previous clock */
187       if (word & 1)
188         {SETMOSI;}
189       else
190         {CLRMOSI;}
191       word >>= 1;
192
193       if (bit==1 && end)
194         SETTMS;//TMS high on last bit to exit.
195        
196       jtag_arm_tcktock();
197
198       /* read MISO on trailing edge */
199       if (READMISO){
200         word += (high);
201       }
202     }
203   } else {
204     for (bit = bitcount; bit > 0; bit--) {
205       /* write MOSI on trailing edge of previous clock */
206       if (word & high)
207         {SETMOSI;}
208       else
209         {CLRMOSI;}
210       word = (word & mask) << 1;
211
212       if (bit==1 && end)
213         SETTMS;//TMS high on last bit to exit.
214
215       jtag_arm_tcktock();
216
217       /* read MISO on trailing edge */
218       word |= (READMISO);
219     }
220   }
221  
222
223   SETMOSI;
224
225   if (end){
226     // exit state
227     jtag_arm_tcktock();
228     // update state
229     if (retidle){
230       CLRTMS;
231       jtag_arm_tcktock();
232     }
233   }
234   return word;
235 }
236
237
238
239 /************************************************************************
240 * ARM7TDMI core has 6 primary registers to be connected between TDI/TDO
241 *   * Bypass Register
242 *   * ID Code Register
243 *   * Scan Chain Select Register    (4 bits_lsb)
244 *   * Scan Chain 0                  (64+* bits: 32_databits_lsb + ctrlbits + 32_addrbits_msb)
245 *   * Scan Chain 1                  (33 bits: 32_bits + BREAKPT)
246 *   * Scan Chain 2                  (38 bits: rw + 5_regbits_msb + 32_databits_msb)
247 ************************************************************************/
248
249
250
251 /************************** Basic JTAG Verb Commands *******************************/
252 //! Grab the core ID.
253 unsigned long jtagarm7tdmi_idcode(){               // PROVEN
254   jtagarm7tdmi_resettap();
255   SHIFT_IR;
256   jtagarmtransn(ARM7TDMI_IR_IDCODE, 4, LSB, END, RETIDLE);
257   SHIFT_DR;
258   return jtagarmtransn(0,32, LSB, END, RETIDLE);
259 }
260
261 //!  Connect Bypass Register to TDO/TDI
262 unsigned char jtagarm7tdmi_bypass(){               // PROVEN
263   //jtagarm7tdmi_resettap();
264   SHIFT_IR;
265   return jtagarmtransn(ARM7TDMI_IR_BYPASS, 4, LSB, END, NORETIDLE);
266 }
267 //!  INTEST verb - do internal test
268 unsigned char jtagarm7tdmi_intest() { 
269   //jtagarm7tdmi_resettap();
270   SHIFT_IR;
271   return jtagarmtransn(ARM7TDMI_IR_INTEST, 4, LSB, END, NORETIDLE); 
272 }
273
274 //!  EXTEST verb
275 unsigned char jtagarm7tdmi_extest() { 
276   //jtagarm7tdmi_resettap();
277   SHIFT_IR;
278   return jtagarmtransn(ARM7TDMI_IR_EXTEST, 4, LSB, END, NORETIDLE);
279 }
280
281 //!  SAMPLE verb
282 //unsigned long jtagarm7tdmi_sample() { 
283 //  jtagarm7tdmi_ir_shift4(ARM7TDMI_IR_SAMPLE);        // ???? same here.
284 //  return jtagtransn(0,32);
285 //}
286
287 //!  RESTART verb
288 unsigned char jtagarm7tdmi_restart() { 
289   //jtagarm7tdmi_resettap();
290   SHIFT_IR;
291   return jtagarmtransn(ARM7TDMI_IR_RESTART, 4, LSB, END, RETIDLE); 
292 }
293
294 //!  ARM7TDMI_IR_CLAMP               0x5
295 //unsigned long jtagarm7tdmi_clamp() { 
296 //  jtagarm7tdmi_resettap();
297 //  SHIFT_IR;
298 //  jtagarmtransn(ARM7TDMI_IR_CLAMP, 4, LSB, END, NORETIDLE);
299 //  SHIFT_DR;
300 //  return jtagarmtransn(0, 32, LSB, END, RETIDLE);
301 //}
302
303 //!  ARM7TDMI_IR_HIGHZ               0x7
304 //unsigned char jtagarm7tdmi_highz() { 
305 //  jtagarm7tdmi_resettap();
306 //  SHIFT_IR;
307 //  return jtagarmtransn(ARM7TDMI_IR_HIGHZ, 4, LSB, END, NORETIDLE);
308 //}
309
310 //! define ARM7TDMI_IR_CLAMPZ              0x9
311 //unsigned char jtagarm7tdmi_clampz() { 
312 //  jtagarm7tdmi_resettap();
313 //  SHIFT_IR;
314 //  return jtagarmtransn(ARM7TDMI_IR_CLAMPZ, 4, LSB, END, NORETIDLE);
315 //}
316
317
318 //!  Connect the appropriate scan chain to TDO/TDI.  SCAN_N, INTEST, ENDS IN SHIFT_DR!!!!!
319 unsigned long jtagarm7tdmi_scan(int chain, int testmode) {               // PROVEN
320 /*
321 When selecting a scan chain the “Run Test/Idle” state should never be reached, other-
322 wise, when in debug state, the core will not be correctly isolated and intrusive
323 commands occur. Therefore, it is recommended to pass directly from the “Update”
324 state” to the “Select DR” state each time the “Update” state is reached.
325 */
326   unsigned long retval;
327   if (current_chain != chain) {     // breaks shit when going from idcode back to scan chain
328     SHIFT_IR;
329     jtagarmtransn(ARM7TDMI_IR_SCAN_N, 4, LSB, END, NORETIDLE);
330     SHIFT_DR;
331     retval = jtagarmtransn(chain, 4, LSB, END, NORETIDLE);
332     current_chain = chain;
333   }    else
334     retval = current_chain;
335   // put in test mode...
336   SHIFT_IR;
337   jtagarmtransn(testmode, 4, LSB, END, RETIDLE); 
338   return(retval);
339 }
340
341
342 //!  Connect the appropriate scan chain to TDO/TDI.  SCAN_N, INTEST, ENDS IN SHIFT_DR!!!!!
343 unsigned long jtagarm7tdmi_scan_intest(int chain) {               // PROVEN
344   return jtagarm7tdmi_scan(chain, ARM7TDMI_IR_INTEST);
345 }
346
347
348
349
350 //! push an instruction into the pipeline
351 unsigned long jtagarm7tdmi_instr_primitive(unsigned long instr, char breakpt){
352   unsigned long retval;
353   //jtagarm7tdmi_resettap();                  // FIXME: DEBUG: seems necessary for some reason.  ugh.
354   jtagarm7tdmi_scan_intest(1);
355
356   SHIFT_DR;
357   // if the next instruction is to run using MCLK (master clock), set TDI
358   if (breakpt)
359     {
360     SETMOSI;
361     count_sysspd_instr_since_debug++;
362     } 
363   else
364     {
365     CLRMOSI; 
366     count_dbgspd_instr_since_debug++;
367     }
368   jtag_arm_tcktock();
369   
370   // Now shift in the 32 bits
371   retval = jtagarmtransn(instr, 32, MSB, END, RETIDLE);    // Must return to RUN-TEST/IDLE state for instruction to enter pipeline, and causes debug clock.
372   //jtag_arm_tcktock();
373   return(retval);
374   
375 }
376
377
378 unsigned long jtagarm7tdmi_nop(char breakpt){
379   return jtagarm7tdmi_instr_primitive(ARM_INSTR_NOP, breakpt);
380 }
381
382 /*    stolen from ARM DDI0029G documentation, translated using ARM Architecture Reference Manual (14128.pdf)
383 STR R0, [R0]; Save R0 before use
384 MOV R0, PC ; Copy PC into R0
385 STR R0, [R0]; Now save the PC in R0
386 BX PC ; Jump into ARM state
387 MOV R8, R8 ;
388 MOV R8, R8 ;
389 NOP
390 NOP
391
392 */
393 //! set the current mode to ARM, returns PC (FIXME).  Should be used by haltcpu(), which should also store PC and the THUMB state, for use by releasecpu();
394 unsigned long jtagarm7tdmi_setMode_ARM(){               // PROVEN
395   unsigned long retval = 0xff;
396   while ((jtagarm7tdmi_get_dbgstate() & JTAG_ARM7TDMI_DBG_TBIT)&& retval-- > 0){
397     cmddataword[6] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_NOP,0);
398     cmddataword[1] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_STR_R0_r0,0);
399     cmddataword[2] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_MOV_R0_PC,0);
400     cmddataword[3] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_STR_R0_r0,0);
401     cmddataword[4] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_BX_PC,0);
402     cmddataword[5] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_NOP,0);
403     cmddataword[6] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_NOP,0);
404     jtagarm7tdmi_resettap();                  // seems necessary for some reason.  ugh.
405   }
406   return(retval);
407 }
408
409
410
411
412 /************************* EmbeddedICE Primitives ****************************/
413 //! shifter for writing to chain2 (EmbeddedICE). 
414 unsigned long eice_write(unsigned char reg, unsigned long data){
415   unsigned long retval, temp;
416   jtagarm7tdmi_scan_intest(2);
417   // Now shift in the 32 bits
418   SHIFT_DR;
419   retval = jtagarmtransn(data, 32, LSB, NOEND, NORETIDLE);          // send in the data - 32-bits lsb
420   temp = jtagarmtransn(reg, 5, LSB, NOEND, NORETIDLE);              // send in the register address - 5 bits lsb
421   jtagarmtransn(1, 1, LSB, END, RETIDLE);                           // send in the WRITE bit
422   
423   //SETTMS;   // Last Bit - Exit UPDATE_DR
424   //// is this update a read/write or just read?
425   //SETMOSI;
426   //jtag_arm_tcktock();
427   
428   return(retval); 
429 }
430
431 //! shifter for reading from chain2 (EmbeddedICE).
432 unsigned long eice_read(unsigned char reg){               // PROVEN
433   unsigned long temp;
434   jtagarm7tdmi_scan_intest(2);
435
436   // send in the register address - 5 bits LSB
437   SHIFT_DR;
438   temp = jtagarmtransn(reg, 5, LSB, NOEND, NORETIDLE);
439   
440   // clear TDI to select "read only"
441   jtagarmtransn(0, 1, LSB, END, RETIDLE);
442   
443   SHIFT_DR;
444   // Now shift out the 32 bits
445   return(jtagarmtransn(0, 32, LSB, END, RETIDLE));   // atmel arm jtag docs pp.10-11: LSB first
446   
447 }
448
449
450
451
452 /************************* ICEBreaker/EmbeddedICE Stuff ******************************/
453 //! Grab debug register
454 unsigned long jtagarm7tdmi_get_dbgstate() {       // ICE Debug register, *NOT* ARM register DSCR    //    PROVEN
455   //jtagarm7tdmi_resettap();
456   return eice_read(EICE_DBGSTATUS);
457 }
458
459 //! Grab debug register
460 unsigned long jtagarm7tdmi_get_dbgctrl() {
461   return eice_read(EICE_DBGCTRL);
462 }
463
464 //! Update debug register
465 unsigned long jtagarm7tdmi_set_dbgctrl(unsigned long bits) {
466   return eice_write(EICE_DBGCTRL, bits);
467 }
468
469
470
471 //!  Set and Enable Watchpoint 0
472 void jtagarm7tdmi_set_watchpoint0(unsigned long addr, unsigned long addrmask, unsigned long data, unsigned long datamask, unsigned long ctrl, unsigned long ctrlmask){
473   // store watchpoint info?  - not right now
474     // FIXME: store info
475
476   eice_write(EICE_WP0ADDR, addr);           // write 0 in watchpoint 0 address
477   eice_write(EICE_WP0ADDRMASK, addrmask);   // write 0xffffffff in watchpoint 0 address mask
478   eice_write(EICE_WP0DATA, data);           // write 0 in watchpoint 0 data
479   eice_write(EICE_WP0DATAMASK, datamask);   // write 0xffffffff in watchpoint 0 data mask
480   eice_write(EICE_WP0CTRL, ctrlmask);       // write 0x00000100 in watchpoint 0 control value register (enables watchpoint)
481   eice_write(EICE_WP0CTRLMASK, ctrlmask);   // write 0xfffffff7 in watchpoint 0 control mask - only detect the fetch instruction
482 }
483
484 //!  Set and Enable Watchpoint 1
485 void jtagarm7tdmi_set_watchpoint1(unsigned long addr, unsigned long addrmask, unsigned long data, unsigned long datamask, unsigned long ctrl, unsigned long ctrlmask){
486   // store watchpoint info?  - not right now
487     // FIXME: store info
488
489   eice_write(EICE_WP1ADDR, addr);           // write 0 in watchpoint 1 address
490   eice_write(EICE_WP1ADDRMASK, addrmask);   // write 0xffffffff in watchpoint 1 address mask
491   eice_write(EICE_WP1DATA, data);           // write 0 in watchpoint 1 data
492   eice_write(EICE_WP1DATAMASK, datamask);   // write 0xffffffff in watchpoint 1 data mask
493   eice_write(EICE_WP1CTRL, ctrl);           // write 0x00000100 in watchpoint 1 control value register (enables watchpoint)
494   eice_write(EICE_WP1CTRLMASK, ctrlmask);   // write 0xfffffff7 in watchpoint 1 control mask - only detect the fetch instruction
495 }
496
497 //!  Disable Watchpoint 0
498 void jtagarm7tdmi_disable_watchpoint0(){
499   eice_write(EICE_WP0CTRL, 0x0); // write 0 in watchpoint 0 control value - disables watchpoint 0
500 }
501   
502 //!  Disable Watchpoint 1
503 void jtagarm7tdmi_disable_watchpoint1(){
504   eice_write(EICE_WP1CTRL, 0x0);            // write 0 in watchpoint 0 control value - disables watchpoint 0
505 }
506
507
508
509 /******************** Complex Commands **************************/
510
511 //! Push an instruction into the CPU pipeline
512 //  NOTE!  Must provide EXECNOPARM for parameter if no parm is required.
513 unsigned long jtagarm7tdmi_exec(unsigned long instr, unsigned long parameter, unsigned char systemspeed) {
514   unsigned long retval;
515
516   debughex32(jtagarm7tdmi_nop( 0));
517   debughex32(jtagarm7tdmi_nop(systemspeed));
518   debughex32(jtagarm7tdmi_instr_primitive(instr, 0));      // write 32-bit instruction code into DR
519   debughex32(jtagarm7tdmi_nop( 0));
520   debughex32(jtagarm7tdmi_nop( 0));
521   debughex32(jtagarm7tdmi_instr_primitive(parameter, 0));  // inject long
522   debughex32(jtagarm7tdmi_nop( 0));
523   retval = jtagarm7tdmi_nop( 0);
524   debughex32(retval);
525   debughex32(jtagarm7tdmi_nop( 0));
526
527   return(retval);
528 }
529
530 //! Retrieve a 32-bit Register value
531 unsigned long jtagarm7tdmi_get_register(unsigned char reg) {
532   unsigned long retval = 0, instr;
533   // push nop into pipeline - clean out the pipeline...
534   instr = ARM_READ_REG | (reg<<12);                     // push STR Rx, [R14] into pipeline
535
536   debughex32(jtagarm7tdmi_nop( 0));
537   debughex32(jtagarm7tdmi_instr_primitive(instr, 0));
538   debughex32(jtagarm7tdmi_nop( 0));                // push nop into pipeline - fetched
539   debughex32(jtagarm7tdmi_nop( 0));                // push nop into pipeline - decoded
540   jtagarm7tdmi_nop( 0);                // push nop into pipeline - executed 
541   retval = jtagarm7tdmi_nop( 0);                        // recover 32-bit word
542   debughex32(retval);
543   debughex32(jtagarm7tdmi_nop( 0));
544   debughex32(jtagarm7tdmi_nop( 0));
545   debughex32(jtagarm7tdmi_nop( 0));
546   return retval;
547 }
548
549 //! Set a 32-bit Register value
550 unsigned long jtagarm7tdmi_set_register(unsigned char reg, unsigned long val) {
551   unsigned long retval = 0, instr;
552   instr = ARM_WRITE_REG | (reg<<12);                // push LDR Rx, [R14] into pipeline
553
554   debughex32(jtagarm7tdmi_nop( 0));            // push nop into pipeline - clean out the pipeline...
555   debughex32(jtagarm7tdmi_instr_primitive(instr, 0)); // push nop into pipeline - fetch
556   debughex32(jtagarm7tdmi_nop( 0));            // push nop into pipeline - decode
557   debughex32(jtagarm7tdmi_nop( 0));            // push nop into pipeline - execute
558   
559   debughex32(jtagarm7tdmi_instr_primitive(val, 0)); // push 32-bit word on data bus
560   debughex32(jtagarm7tdmi_nop( 0));            // push nop into pipeline - executed 
561
562   //if (reg == ARM_REG_PC){
563     debughex32(jtagarm7tdmi_nop( 0));
564     debughex32(jtagarm7tdmi_nop( 0));
565   //}
566   debughex32(jtagarm7tdmi_nop( 0));
567
568   retval = cmddatalong[5];
569   return(retval);
570 }
571
572
573
574 //! Get all registers.  Return an array
575 unsigned long* jtagarm7tdmi_get_registers() {
576   debughex32(jtagarm7tdmi_instr_primitive(ARM_INSTR_SKANKREGS,0));
577   debughex32(jtagarm7tdmi_nop( 0));
578   debughex32(jtagarm7tdmi_nop( 0));
579   debughex32(jtagarm7tdmi_nop( 0));
580   debughex32(jtagarm7tdmi_nop( 0));
581   debughex32(jtagarm7tdmi_nop( 0));
582   debughex32(jtagarm7tdmi_nop( 0));
583   debughex32(jtagarm7tdmi_nop( 0));
584   debughex32(jtagarm7tdmi_nop( 0));
585   debughex32(jtagarm7tdmi_nop( 0));
586   debughex32(jtagarm7tdmi_nop( 0));
587   debughex32(jtagarm7tdmi_nop( 0));
588   debughex32(jtagarm7tdmi_nop( 0));
589   debughex32(jtagarm7tdmi_nop( 0));
590   debughex32(jtagarm7tdmi_nop( 0));
591   debughex32(jtagarm7tdmi_nop( 0));
592   debughex32(jtagarm7tdmi_nop( 0));
593   debughex32(jtagarm7tdmi_nop( 0));
594   debughex32(jtagarm7tdmi_nop( 0));
595   debughex32(jtagarm7tdmi_nop( 0));
596   return registers;
597 }
598
599 //! Get all registers.  Return an array
600 unsigned long* jtagarm7tdmi_set_registers() {   //FIXME: BORKEN... TOTALLY TRYING TO BUY A VOWEL
601   debughex32(jtagarm7tdmi_instr_primitive(ARM_INSTR_SKANKREGS,0));
602   debughex32(jtagarm7tdmi_nop( 0));
603   debughex32(jtagarm7tdmi_nop( 0));
604   debughex32(jtagarm7tdmi_instr_primitive(0x40,0));
605   debughex32(jtagarm7tdmi_instr_primitive(0x41,0));
606   debughex32(jtagarm7tdmi_instr_primitive(0x42,0));
607   debughex32(jtagarm7tdmi_instr_primitive(0x43,0));
608   debughex32(jtagarm7tdmi_instr_primitive(0x44,0));
609   debughex32(jtagarm7tdmi_instr_primitive(0x45,0));
610   debughex32(jtagarm7tdmi_instr_primitive(0x46,0));
611   debughex32(jtagarm7tdmi_instr_primitive(0x47,0));
612   debughex32(jtagarm7tdmi_instr_primitive(0x48,0));
613   debughex32(jtagarm7tdmi_instr_primitive(0x49,0));
614   debughex32(jtagarm7tdmi_instr_primitive(0x4a,0));
615   debughex32(jtagarm7tdmi_instr_primitive(0x4b,0));
616   debughex32(jtagarm7tdmi_instr_primitive(0x4c,0));
617   debughex32(jtagarm7tdmi_instr_primitive(0x4d,0));
618   debughex32(jtagarm7tdmi_instr_primitive(0x4e,0));
619   debughex32(jtagarm7tdmi_instr_primitive(0x4f,0));
620   return registers;
621 }
622
623 //! Retrieve the CPSR Register value
624 unsigned long jtagarm7tdmi_get_regCPSR() {
625   unsigned long retval = 0;
626
627   cmddatalong[1] = jtagarm7tdmi_nop( 0); // push nop into pipeline - clean out the pipeline...
628   cmddatalong[2] = jtagarm7tdmi_instr_primitive(ARM_INSTR_MRS_R0_CPSR, 0); // push MRS_R0, CPSR into pipeline
629   cmddatalong[3] = jtagarm7tdmi_nop( 0); // push nop into pipeline - fetched
630   cmddatalong[4] = jtagarm7tdmi_nop( 0); // push nop into pipeline - decoded
631   cmddatalong[5] = jtagarm7tdmi_nop( 0); // push nop into pipeline - executed 
632   retval = jtagarm7tdmi_nop( 0);        // recover 32-bit word
633   cmddatalong[6] = retval;
634   return retval;
635 }
636
637 //! Retrieve the CPSR Register value
638 unsigned long jtagarm7tdmi_set_regCPSR(unsigned long val) {
639   unsigned long retval = 0;
640
641   cmddatalong[1] = jtagarm7tdmi_nop( 0);        // push nop into pipeline - clean out the pipeline...
642   cmddatalong[1] = jtagarm7tdmi_instr_primitive(ARM_INSTR_MSR_cpsr_cxsf_R0, 0); // push MSR cpsr_cxsf, R0 into pipeline
643   cmddatalong[2] = jtagarm7tdmi_nop( 0);        // push nop into pipeline - fetched
644   cmddatalong[3] = jtagarm7tdmi_nop( 0);        // push nop into pipeline - decoded
645   
646   retval = jtagarm7tdmi_instr_primitive(val, 0);// push 32-bit word on data bus
647   cmddatalong[5] = jtagarm7tdmi_nop( 0);        // push nop into pipeline - executed 
648   cmddatalong[4] = retval;
649   return(retval);
650 }
651
652 //! Write data to address - Assume TAP in run-test/idle state
653 unsigned long jtagarm7tdmi_writemem(unsigned long adr, unsigned long data){
654   unsigned long r0=0, r1=-1;
655
656   r0 = jtagarm7tdmi_get_register(0);        // store R0 and R1
657   r1 = jtagarm7tdmi_get_register(1);
658   jtagarm7tdmi_set_register(0, adr);        // write address into R0
659   jtagarm7tdmi_set_register(1, data);       // write data in R1
660   jtagarm7tdmi_nop( 0);                     // push nop into pipeline to "clean" it ???
661   jtagarm7tdmi_nop( 1);                     // push nop into pipeline with BREAKPT set
662   jtagarm7tdmi_instr_primitive(ARM_INSTR_LDR_R1_r0_4, 0); // push LDR R1, R0, #4 into instruction pipeline
663   jtagarm7tdmi_nop( 0);                     // push nop into pipeline
664   jtagarm7tdmi_set_register(1, r1);         // restore R0 and R1 
665   jtagarm7tdmi_set_register(0, r0);
666   return(-1);
667 }
668
669
670
671
672 //! Read data from address
673 unsigned long jtagarm7tdmi_readmem(unsigned long adr){
674   unsigned long retval = 0;
675   unsigned long r0=0, r1=-1;
676   int waitcount = 0xfff;
677
678   r0 = jtagarm7tdmi_get_register(0);        // store R0 and R1
679   r1 = jtagarm7tdmi_get_register(1);
680   jtagarm7tdmi_set_register(0, adr);        // write address into R0
681   jtagarm7tdmi_nop( 0);                     // push nop into pipeline to "clean" it ???
682   jtagarm7tdmi_nop( 1);                     // push nop into pipeline with BREAKPT set
683   jtagarm7tdmi_instr_primitive(ARM_INSTR_LDR_R1_r0_4, 0); // push LDR R1, R0, #4 into instruction pipeline
684   jtagarm7tdmi_nop( 0);                     // push nop into pipeline
685   jtagarm7tdmi_restart();                   // SHIFT_IR with RESTART instruction
686
687   // Poll the Debug Status Register for DBGACK and nMREQ to be HIGH
688   while ((jtagarm7tdmi_get_dbgstate() & 9) == 0  && waitcount > 0){
689     delay(1);
690     waitcount --;
691   }
692   if (waitcount == 0){
693     return (-1);
694   } else {
695     retval = jtagarm7tdmi_get_register(1);  // read memory value from R1 register
696     jtagarm7tdmi_set_register(1, r1);         // restore R0 and R1 
697     jtagarm7tdmi_set_register(0, r0);
698   }
699   return retval;
700 }
701
702
703 //! Read Program Counter
704 unsigned long jtagarm7tdmi_getpc(){
705   return jtagarm7tdmi_get_register(ARM_REG_PC);
706 }
707
708 //! Set Program Counter
709 unsigned long jtagarm7tdmi_setpc(unsigned long adr){
710   return jtagarm7tdmi_set_register(ARM_REG_PC, adr);
711 }
712
713 //! Halt CPU - returns 0xffff if the operation fails to complete within 
714 unsigned long jtagarm7tdmi_haltcpu(){                   //  PROVEN
715   int waitcount = 0xfff;
716
717   // store watchpoint info?  - not right now
718   eice_write(EICE_WP1ADDR, 0);              // write 0 in watchpoint 1 address
719   eice_write(EICE_WP1ADDRMASK, 0xffffffff); // write 0xffffffff in watchpoint 1 address mask
720   eice_write(EICE_WP1DATA, 0);              // write 0 in watchpoint 1 data
721   eice_write(EICE_WP1DATAMASK, 0xffffffff); // write 0xffffffff in watchpoint 1 data mask
722   eice_write(EICE_WP1CTRL, 0x100);          //!!!!! WTF!  THIS IS SUPPOSED TO BE 9 bits wide?!?  // write 0x00000100 in watchpoint 1 control value register (enables watchpoint)
723   eice_write(EICE_WP1CTRLMASK, 0xfffffff7); //!!!!! WTF!  THIS IS SUPPOSED TO BE 8 bits wide?!?  // write 0xfffffff7 in watchpoint 1 control mask - only detect the fetch instruction
724
725   // poll until debug status says the cpu is in debug mode
726   while (!(jtagarm7tdmi_get_dbgstate() & 0x1)   && waitcount-- > 0){
727     delay(1);
728   }
729   eice_write(EICE_WP1CTRL, 0x0);            // write 0 in watchpoint 0 control value - disables watchpoint 0
730
731   // store the debug state
732   last_halt_debug_state = jtagarm7tdmi_get_dbgstate();
733   last_halt_pc = jtagarm7tdmi_getpc() - 4;  // assume -4 for entering debug mode via watchpoint.
734   count_dbgspd_instr_since_debug = 0;
735   count_sysspd_instr_since_debug = 0;
736
737   // get into ARM mode if the T flag is set (Thumb mode)
738   while (jtagarm7tdmi_get_dbgstate() & JTAG_ARM7TDMI_DBG_TBIT && waitcount-- > 0) {
739     jtagarm7tdmi_setMode_ARM();
740   }
741   jtagarm7tdmi_resettap();
742   return waitcount;
743 }
744
745 unsigned long jtagarm7tdmi_releasecpu(){
746   int waitcount = 0xfff;
747   unsigned long instr;
748   // somehow determine what PC should be (a couple ways possible, calculations required)
749   jtagarm7tdmi_nop(0);                          // NOP
750   jtagarm7tdmi_nop(1);                          // NOP/BREAKPT
751
752   if (last_halt_debug_state & JTAG_ARM7TDMI_DBG_TBIT){      // FIXME:  FORNICATED!  BX requires register, thus more instrs... could we get away with the same instruction but +1 to offset?
753     instr = ARM_INSTR_B_PC + 0x1000001 - (count_dbgspd_instr_since_debug) - (count_sysspd_instr_since_debug*3);  //FIXME: make this right  - can't we just do an a7solute b/bx?
754     jtagarm7tdmi_instr_primitive(instr,0);
755   } else {
756     instr = ARM_INSTR_B_PC + 0x1000000 - (count_dbgspd_instr_since_debug*4) - (count_sysspd_instr_since_debug*12);
757     jtagarm7tdmi_instr_primitive(instr,0);
758   }
759
760   SHIFT_IR;
761   jtagarmtransn(ARM7TDMI_IR_RESTART,4,LSB,END,RETIDLE); // VERB_RESTART
762
763   // wait until restart-bit set in debug state register
764   while ((jtagarm7tdmi_get_dbgstate() & JTAG_ARM7TDMI_DBG_DBGACK) && waitcount > 0){
765     msdelay(1);
766     waitcount --;
767   }
768   last_halt_debug_state = -1;
769   last_halt_pc = -1;
770   return 0;
771 }
772  
773
774
775
776 ///////////////////////////////////////////////////////////////////////////////////////////////////
777 //! Handles ARM7TDMI JTAG commands.  Forwards others to JTAG.
778 void jtagarm7tdmihandle(unsigned char app, unsigned char verb, unsigned long len){
779   register char blocks;
780   
781   unsigned int i,val,mlop;
782   unsigned long at;
783   
784   jtagarm7tdmi_resettap();
785  
786   switch(verb){
787   case START:
788     //Enter JTAG mode.
789     cmddatalong[0] = jtagarm7tdmi_start();
790     cmddatalong[2] = jtagarm7tdmi_haltcpu();
791     //jtagarm7tdmi_resettap();
792     cmddatalong[1] = jtagarm7tdmi_get_dbgstate();
793     
794     // DEBUG: FIXME: NOT PART OF OPERATIONAL CODE
795     //for (mlop=2;mlop<4;mlop++){
796     //  jtagarm7tdmi_set_register(mlop, 0x43424140);
797     //} 
798     /////////////////////////////////////////////
799     txdata(app,verb,0xc);
800     break;
801   case JTAGARM7TDMI_READMEM:
802   case PEEK:
803     blocks=(len>4?cmddata[4]:1);
804     at=cmddatalong[0];
805     
806     len=0x80;
807     txhead(app,verb,len);
808     
809     while(blocks--){
810       for(i=0;i<len;i+=2){
811         jtagarm7tdmi_resettap();
812         delay(10);
813         
814         val=jtagarm7tdmi_readmem(at);
815                 
816         at+=2;
817         serial_tx(val&0xFF);
818         serial_tx((val&0xFF00)>>8);
819       }
820     }
821     
822     break;
823   case JTAGARM7TDMI_GET_CHIP_ID:
824         jtagarm7tdmi_resettap();
825     cmddatalong[0] = jtagarm7tdmi_idcode();
826     txdata(app,verb,4);
827     break;
828
829
830   case JTAGARM7TDMI_WRITEMEM:
831   case POKE:
832         jtagarm7tdmi_resettap();
833     jtagarm7tdmi_writemem(cmddatalong[0],
834                        cmddataword[2]);
835     cmddataword[0]=jtagarm7tdmi_readmem(cmddatalong[0]);
836     txdata(app,verb,2);
837     break;
838
839   case JTAGARM7TDMI_HALTCPU:  
840     cmddatalong[0] = jtagarm7tdmi_haltcpu();
841     txdata(app,verb,4);
842     break;
843   case JTAGARM7TDMI_RELEASECPU:
844         jtagarm7tdmi_resettap();
845     cmddatalong[0] = jtagarm7tdmi_releasecpu();
846     txdata(app,verb,4);
847     break;
848   //unimplemented functions
849   //case JTAGARM7TDMI_SETINSTRFETCH:
850   //case JTAGARM7TDMI_WRITEFLASH:
851   //case JTAGARM7TDMI_ERASEFLASH:
852   case JTAGARM7TDMI_SET_PC:
853     cmddatalong[0] = jtagarm7tdmi_setpc(cmddatalong[0]);
854     txdata(app,verb,4);
855     break;
856   case JTAGARM7TDMI_GET_DEBUG_CTRL:
857     cmddatalong[0] = jtagarm7tdmi_get_dbgctrl();
858     txdata(app,verb,1);
859     break;
860   case JTAGARM7TDMI_SET_DEBUG_CTRL:
861     cmddatalong[0] = jtagarm7tdmi_set_dbgctrl(cmddata[0]);
862     txdata(app,verb,4);
863     break;
864   case JTAGARM7TDMI_GET_PC:
865     cmddatalong[0] = jtagarm7tdmi_getpc();
866     txdata(app,verb,4);
867     break;
868   case JTAGARM7TDMI_GET_DEBUG_STATE:
869     //jtagarm7tdmi_resettap();            // Shouldn't need this, but currently do.  FIXME!
870     cmddatalong[0] = jtagarm7tdmi_get_dbgstate();
871     txdata(app,verb,4);
872     break;
873   //case JTAGARM7TDMI_GET_WATCHPOINT:
874   //case JTAGARM7TDMI_SET_WATCHPOINT:
875   case JTAGARM7TDMI_GET_REGISTER:
876         jtagarm7tdmi_resettap();
877     cmddatalong[0] = jtagarm7tdmi_get_register(cmddata[0]);
878     //cmddatalong[0] = test_get_register(cmddata[0]);
879     txdata(app,verb,96);
880     break;
881   case JTAGARM7TDMI_SET_REGISTER:           // FIXME: NOT AT ALL CORRECT, THIS IS TESTING CODE ONLY
882         jtagarm7tdmi_resettap();
883     cmddatalong[0] = cmddatalong[1];
884     jtagarm7tdmi_set_register(cmddata[0], cmddatalong[1]);
885     //test_set_register(cmddata[0], cmddatalong[1]);
886     txdata(app,verb,96);
887     break;
888   case JTAGARM7TDMI_GET_REGISTERS:
889         jtagarm7tdmi_resettap();
890     jtagarm7tdmi_get_registers();
891     txdata(app,verb,200);
892     break;
893   case JTAGARM7TDMI_SET_REGISTERS:
894         jtagarm7tdmi_resettap();
895     jtagarm7tdmi_set_registers();
896     txdata(app,verb,200);
897     break;
898   case JTAGARM7TDMI_DEBUG_INSTR:
899         jtagarm7tdmi_resettap();
900     cmddataword[0] = jtagarm7tdmi_exec(cmddataword[0], cmddataword[1], cmddata[9]);
901     txdata(app,verb,80);
902     break;
903   //case JTAGARM7TDMI_STEP_INSTR:
904 /*  case JTAGARM7TDMI_READ_CODE_MEMORY:
905   case JTAGARM7TDMI_WRITE_FLASH_PAGE:
906   case JTAGARM7TDMI_READ_FLASH_PAGE:
907   case JTAGARM7TDMI_MASS_ERASE_FLASH:
908   case JTAGARM7TDMI_PROGRAM_FLASH:
909   case JTAGARM7TDMI_LOCKCHIP:
910   case JTAGARM7TDMI_CHIP_ERASE:
911   */
912 // Really ARM specific stuff
913   case JTAGARM7TDMI_GET_CPSR:
914         jtagarm7tdmi_resettap();
915     cmddatalong[0] = jtagarm7tdmi_get_regCPSR();
916     txdata(app,verb,4);
917     break;
918   case JTAGARM7TDMI_SET_CPSR:
919         jtagarm7tdmi_resettap();
920     cmddatalong[0] = jtagarm7tdmi_set_regCPSR(cmddatalong[0]);
921     txdata(app,verb,4);
922     break;
923   case JTAGARM7TDMI_GET_SPSR:           // FIXME: NOT CORRECT
924         jtagarm7tdmi_resettap();
925     cmddatalong[0] = jtagarm7tdmi_get_regCPSR();
926     txdata(app,verb,4);
927     break;
928   case JTAGARM7TDMI_SET_SPSR:           // FIXME: NOT CORRECT
929         jtagarm7tdmi_resettap();
930     cmddatalong[0] = jtagarm7tdmi_set_regCPSR(cmddatalong[0]);
931     txdata(app,verb,4);
932     break;
933   case JTAGARM7TDMI_SET_MODE_THUMB:
934   case JTAGARM7TDMI_SET_MODE_ARM:
935         jtagarm7tdmi_resettap();
936     cmddataword[0] = jtagarm7tdmi_setMode_ARM();
937     txdata(app,verb,4);
938     break;
939     
940   case 0xD0:          // loopback test
941     jtagarm7tdmi_resettap();
942     cmddatalong[0] = jtagarm7tdmi_bypass(cmddatalong[0]);
943     txdata(app,verb,4);
944     break;
945   case 0xD8:          // EICE_READ
946     jtagarm7tdmi_resettap();
947     cmddatalong[0] = eice_read(cmddatalong[0]);
948     txdata(app,verb,4);
949     break;
950   case 0xD9:          // EICE_WRITE
951     jtagarm7tdmi_resettap();
952     cmddatalong[0] = eice_write(cmddatalong[0], cmddatalong[1]);
953     txdata(app,verb,4);
954     break;
955   case 0xDA:          // TEST MSB THROUGH CHAIN0 and CHAIN1
956     jtagarm7tdmi_resettap();
957     jtagarm7tdmi_scan_intest(0);
958     cmddatalong[0] = jtagarmtransn(0x41414141, 32, LSB, NOEND, NORETIDLE);
959     cmddatalong[1] = jtagarmtransn(0x42424242, 32, MSB, NOEND, NORETIDLE);
960     cmddatalong[2] = jtagarmtransn(0x43434343,  9, MSB, NOEND, NORETIDLE);
961     cmddatalong[3] = jtagarmtransn(0x44444444, 32, MSB, NOEND, NORETIDLE);
962     cmddatalong[4] = jtagarmtransn(cmddatalong[0], 32, LSB, NOEND, NORETIDLE);
963     cmddatalong[5] = jtagarmtransn(cmddatalong[1], 32, MSB, NOEND, NORETIDLE);
964     cmddatalong[6] = jtagarmtransn(cmddatalong[2],  9, MSB, NOEND, NORETIDLE);
965     cmddatalong[7] = jtagarmtransn(cmddatalong[3], 32, MSB, END, RETIDLE);
966     jtagarm7tdmi_resettap();
967     jtagarm7tdmi_scan_intest(1);
968     cmddatalong[8] = jtagarmtransn(0x41414141, 32, MSB, NOEND, NORETIDLE);
969     cmddatalong[9] = jtagarmtransn(0x44444444,  1, MSB, NOEND, NORETIDLE);
970     cmddatalong[10] = jtagarmtransn(cmddatalong[8], 32, MSB, NOEND, NORETIDLE);
971     cmddatalong[11] = jtagarmtransn(cmddatalong[9],  1, MSB, END, RETIDLE);
972     jtagarm7tdmi_resettap();
973     txdata(app,verb,48);
974     break;
975     
976   default:
977     jtaghandle(app,verb,len);
978   }
979 }
980
981
982
983
984 /*****************************
985 Captured from FlySwatter against AT91SAM7S, to be used by me for testing.  ignore
986
987 > arm reg
988 System and User mode registers
989       r0: 300000df       r1: 00000000       r2: 58000000       r3: 00200a75
990       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
991       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
992      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 000000fc
993     cpsr: 00000093
994
995 FIQ mode shadow registers
996   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
997  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
998
999 Supervisor mode shadow registers
1000   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1001
1002 Abort mode shadow registers
1003   sp_abt: 00000000   lr_abt: 00000000 spsr_abt: e00000ff
1004
1005 IRQ mode shadow registers
1006   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1007
1008 Undefined instruction mode shadow registers
1009   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1010
1011 > step;arm reg
1012 target state: halted
1013 target halted in ARM state due to single-step, current mode: Supervisor
1014 cpsr: 0x00000093 pc: 0x00000100
1015 System and User mode registers
1016       r0: 300000df       r1: 00000000       r2: 00200000       r3: 00200a75 
1017       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c 
1018       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000 
1019      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000100 
1020     cpsr: 00000093 
1021
1022 FIQ mode shadow registers
1023   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000 
1024  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb 
1025
1026 Supervisor mode shadow registers
1027   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3 
1028
1029 Abort mode shadow registers
1030   sp_abt: 00000000   lr_abt: 00000000 spsr_abt: e00000ff 
1031
1032 IRQ mode shadow registers
1033   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b 
1034
1035 Undefined instruction mode shadow registers
1036   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df 
1037
1038  step;arm reg
1039 target state: halted
1040 target halted in ARM state due to single-step, current mode: Abort
1041 cpsr: 0x00000097 pc: 0x00000010
1042 System and User mode registers
1043       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75 
1044       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c 
1045       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000 
1046      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010 
1047     cpsr: 00000097 
1048
1049 FIQ mode shadow registers
1050   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000 
1051  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb 
1052
1053 Supervisor mode shadow registers
1054   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3 
1055
1056 Abort mode shadow registers
1057   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093 
1058
1059 IRQ mode shadow registers
1060   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b 
1061
1062 Undefined instruction mode shadow registers
1063   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df 
1064 > step;arm reg
1065 target state: halted
1066 target halted in ARM state due to single-step, current mode: Abort
1067 cpsr: 0x00000097 pc: 0x00000010
1068 System and User mode registers
1069       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75 
1070       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c 
1071       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000 
1072      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010 
1073     cpsr: 00000097 
1074
1075 FIQ mode shadow registers
1076   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000 
1077  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb 
1078
1079 Supervisor mode shadow registers
1080   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3 
1081
1082 Abort mode shadow registers
1083   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093 
1084
1085 IRQ mode shadow registers
1086   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b 
1087
1088 Undefined instruction mode shadow registers
1089   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df 
1090 > step;arm reg
1091 target state: halted
1092 target halted in ARM state due to single-step, current mode: Abort
1093 cpsr: 0x00000097 pc: 0x00000010
1094 System and User mode registers
1095       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1096       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1097       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1098      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1099     cpsr: 00000097
1100
1101 FIQ mode shadow registers
1102   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1103  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1104
1105 Supervisor mode shadow registers
1106   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1107
1108 Abort mode shadow registers
1109   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1110
1111 IRQ mode shadow registers
1112   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1113
1114 Undefined instruction mode shadow registers
1115   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1116 > step;arm reg
1117 target state: halted
1118 target halted in ARM state due to single-step, current mode: Abort
1119 cpsr: 0x00000097 pc: 0x00000010
1120 System and User mode registers
1121       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1122       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1123       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1124      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1125     cpsr: 00000097
1126
1127 FIQ mode shadow registers
1128   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1129  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1130
1131 Supervisor mode shadow registers
1132   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1133
1134 Abort mode shadow registers
1135   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1136
1137 IRQ mode shadow registers
1138   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1139
1140 Undefined instruction mode shadow registers
1141   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1142 > step;arm reg
1143 target state: halted
1144 target halted in ARM state due to single-step, current mode: Abort
1145 cpsr: 0x00000097 pc: 0x00000010
1146 System and User mode registers
1147       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1148       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1149       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1150      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1151     cpsr: 00000097
1152
1153 FIQ mode shadow registers
1154   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1155  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1156
1157 Supervisor mode shadow registers
1158   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1159
1160 Abort mode shadow registers
1161   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1162
1163 IRQ mode shadow registers
1164   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1165
1166 Undefined instruction mode shadow registers
1167   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1168 > step;arm reg
1169 target state: halted
1170 target halted in ARM state due to single-step, current mode: Abort
1171 cpsr: 0x00000097 pc: 0x00000010
1172 System and User mode registers
1173       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1174       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1175       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1176      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1177     cpsr: 00000097
1178
1179 FIQ mode shadow registers
1180   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1181  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1182
1183 Supervisor mode shadow registers
1184   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1185
1186 Abort mode shadow registers
1187   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1188
1189 IRQ mode shadow registers
1190   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1191
1192 Undefined instruction mode shadow registers
1193   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1194 > step;arm reg
1195 target state: halted
1196 target halted in ARM state due to single-step, current mode: Abort
1197 cpsr: 0x00000097 pc: 0x00000010
1198 System and User mode registers
1199       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1200       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1201       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1202      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1203     cpsr: 00000097
1204
1205 FIQ mode shadow registers
1206   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1207  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1208
1209 Supervisor mode shadow registers
1210   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1211
1212 Abort mode shadow registers
1213   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1214
1215 IRQ mode shadow registers
1216   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1217
1218 Undefined instruction mode shadow registers
1219   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1220 > step;arm reg
1221 target state: halted
1222 target halted in ARM state due to single-step, current mode: Abort
1223 cpsr: 0x00000097 pc: 0x00000010
1224 System and User mode registers
1225       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1226       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1227       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1228      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1229     cpsr: 00000097
1230
1231 FIQ mode shadow registers
1232   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1233  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1234
1235 Supervisor mode shadow registers
1236   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1237
1238 Abort mode shadow registers
1239   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1240
1241 IRQ mode shadow registers
1242   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1243
1244 Undefined instruction mode shadow registers
1245   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1246 > step;arm reg
1247 target state: halted
1248 target halted in ARM state due to single-step, current mode: Abort
1249 cpsr: 0x00000097 pc: 0x00000010
1250 System and User mode registers
1251       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1252       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1253       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1254      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1255     cpsr: 00000097
1256
1257 FIQ mode shadow registers
1258   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1259  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1260
1261 Supervisor mode shadow registers
1262   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1263
1264 Abort mode shadow registers
1265   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1266
1267 IRQ mode shadow registers
1268   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1269
1270 Undefined instruction mode shadow registers
1271   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1272 >
1273 */