git.rot13.org Git - goodfet/blob - firmware/apps/jtag/jtagarm7tdmi.c

   1 /*! \file jtagarm7tdmi.c
   2   \brief ARM7TDMI JTAG (AT91R40008)
   3 */
   4
   5 #include "platform.h"
   6 #include "command.h"
   7 #include "jtag.h"
   8 #include "jtagarm7tdmi.h"
   9
  10
  11 /**** 20-pin Connection Information (pin1 is on top-right for both connectors)****
  12 GoodFET  ->  7TDMI 20-pin connector (HE-10 connector)
  13   1               13 (TDO)
  14   2               1  (Vdd)
  15   3               5  (TDI)
  16   5               7  (TMS)
  17   7               9  (TCK)
  18   8               15 (nRST)
  19   9               4,6,8,10,12,14,16,18,20 (GND)
  20   11              17/3 (nTRST)  (different sources suggest 17 or 3 alternately)
  21 ********************************/
  22
  23 /**** 14-pin Connection Information (pin1 is on top-right for both connectors)****
  24 GoodFET  ->  7TDMI 14-pin connector
  25   1               11 (TDO)
  26   2               1  (Vdd)
  27   3               5  (TDI)
  28   5               7  (TMS)
  29   7               9  (TCK)
  30   8               12 (nRST)
  31   9               2,4,6,8,10,14 (GND)
  32   11              3 (nTRST)
  33
  34 http://hri.sourceforge.net/tools/jtag_faq_org.html
  35 ********************************/
  36
  37
  38
  39
  40
  41
  42 /****************************************************************
  43 Enabling jtag likely differs with most platforms.  We will attempt to enable most from here.  Override jtagarm7tdmi_start() to extend for other implementations
  44 ARM7TDMI enables three different scan chains:
  45     * Chain0 - "entire periphery" including data bus
  46     * Chain1 - core data bus (subset of Chain0)  - Instruction Pipeline
  47     * Chain2 - EmbeddedICE Logic Registers - This is our way into the fun stuff.
  48
  49
  50 ---
  51 You can disable EmbeddedICE-RT by setting the DBGEN input LOW.
  52 Caution
  53 Hard wiring the DBGEN input LOW permanently disables all debug functionality.
  54 When DBGEN is LOW, it inhibits DBGDEWPT, DBGIEBKPT, and EDBGRQ to
  55 the core, and DBGACK from the ARM9E-S core is always LOW.
  56 ---
  57
  58
  59 ---
  60 When the ARM9E-S core is in debug state, you can examine the core and system state
  61 by forcing the load and store multiples into the instruction pipeline.
  62 Before you can examine the core and system state, the debugger must determine
  63 whether the processor entered debug from Thumb state or ARM state, by examining
  64 bit 4 of the EmbeddedICE-RT debug status register. If bit 4 is HIGH, the core has
  65 entered debug from Thumb state.
  66 For more details about determining the core state, see Determining the core and system
  67 state on page B-18.
  68 ---
  69
  70
  71 --- olimex - http://www.olimex.com/dev/pdf/arm-jtag.pdf
  72 JTAG signals description:
  73 PIN.1 (VTREF) Target voltage sense. Used to indicate the target’s operating voltage to thedebug tool.
  74 PIN.2 (VTARGET) Target voltage. May be used to supply power to the debug tool.
  75 PIN.3 (nTRST) JTAG TAP reset, this signal should be pulled up to Vcc in target board.
  76 PIN4,6, 8, 10,12,14,16,18,20 Ground. The Gnd-Signal-Gnd-Signal strategy implemented on the 20-way connection scheme improves noiseimmunity on the target connect cable.
  77 *PIN.5 (TDI) JTAG serial data in, should be pulled up to Vcc on target board.
  78 *PIN.7 (TMS) JTAG TAP Mode Select, should be pulled up to Vcc on target board.
  79 *PIN.9 (TCK) JTAG clock.
  80 PIN.11 (RTCK) JTAG retimed clock.Implemented on certain ASIC ARM implementations the host ASIC may need to synchronize external inputs (such as JTAG inputs) with its own internal clock.
  81 *PIN.13 (TDO) JTAG serial data out.
  82 *PIN.15 (nSRST) Target system reset.
  83 *PIN.17 (DBGRQ) Asynchronous debug request.  DBGRQ allows an external signal to force the ARM core into debug mode, should be pull down to GND.
  84 PIN.19 (DBGACK) Debug acknowledge. The ARM core acknowledges debug-mode inresponse to a DBGRQ input.
  85
  86
  87 -----------  SAMPLE TIMES  -----------
  88
  89 TDI and TMS are sampled on the rising edge of TCK and TDO transitions appear on the falling edge of TCK. Therefore, TDI and TMS must be written after the falling edge of TCK and TDO must be read after the rising edge of TCK.
  90
  91 for this module, we keep tck high for all changes/sampling, and then bounce it.
  92 ****************************************************************/
  93
  94
  95
  96 /************************** JTAGARM7TDMI Primitives ****************************/
  97 void jtag_goto_shift_ir() {
  98   SETTMS;
  99   jtag_arm_tcktock();
 100   jtag_arm_tcktock();
 101   CLRTMS;
 102   jtag_arm_tcktock();
 103   jtag_arm_tcktock();
 104
 105 }
 106
 107 void jtag_goto_shift_dr() {
 108   SETTMS;
 109   jtag_arm_tcktock();
 110   CLRTMS;
 111   jtag_arm_tcktock();
 112   jtag_arm_tcktock();
 113 }
 114
 115 void jtag_reset_to_runtest_idle() {
 116   SETTMS;
 117   jtag_arm_tcktock();
 118   jtag_arm_tcktock();
 119   jtag_arm_tcktock();
 120   jtag_arm_tcktock();
 121   jtag_arm_tcktock();
 122   jtag_arm_tcktock();
 123   jtag_arm_tcktock();
 124   jtag_arm_tcktock();  // now in Reset state
 125   CLRTMS;
 126   jtag_arm_tcktock();  // now in Run-Test/Idle state
 127 }
 128
 129 void jtag_arm_tcktock() {
 130   CLRTCK;
 131   PLEDOUT^=PLEDPIN;
 132   SETTCK;
 133   PLEDOUT^=PLEDPIN;
 134 }
 135
 136
 137 // ! Start JTAG, setup pins, reset TAP and return IDCODE
 138 unsigned long jtagarm7tdmi_start() {
 139   jtagsetup();
 140   //Known-good starting position.
 141   //Might be unnecessary.
 142   //SETTST;
 143   //SETRST;
 144
 145   //delay(0x2);
 146
 147   //CLRRST;
 148   //delay(2);
 149   //CLRTST;
 150
 151   //msdelay(10);
 152   //SETRST;
 153   /*
 154   P5DIR &=~RST;
 155   */
 156   //delay(0x2);
 157   jtagarm7tdmi_resettap();
 158   return jtagarm7tdmi_idcode();
 159 }
 160
 161
 162 //! Reset TAP State Machine
 163 void jtagarm7tdmi_resettap(){               // PROVEN
 164   current_chain = -1;
 165   jtag_reset_to_runtest_idle();
 166 }
 167
 168
 169 //  NOTE: important: THIS MODULE REVOLVES AROUND RETURNING TO RUNTEST/IDLE, OR THE FUNCTIONAL EQUIVALENT
 170
 171
 172 //! Shift N bits over TDI/TDO.  May choose LSB or MSB, and select whether to terminate (TMS-high on last bit) and whether to return to RUNTEST/IDLE
 173 unsigned long jtagarmtransn(unsigned long word, unsigned char bitcount, unsigned char lsb, unsigned char end, unsigned char retidle){               // PROVEN
 174   unsigned int bit;
 175   unsigned long high = 1;
 176   unsigned long mask;
 177
 178   for (bit=(bitcount-1)/8; bit>0; bit--)
 179     high <<= 8;
 180   high <<= ((bitcount-1)%8);
 181
 182   mask = high-1;
 183
 184   if (lsb) {
 185     for (bit = bitcount; bit > 0; bit--) {
 186       /* write MOSI on trailing edge of previous clock */
 187       if (word & 1)
 188         {SETMOSI;}
 189       else
 190         {CLRMOSI;}
 191       word >>= 1;
 192
 193       if (bit==1 && end)
 194         SETTMS;//TMS high on last bit to exit.
 195
 196       jtag_arm_tcktock();
 197
 198       /* read MISO on trailing edge */
 199       if (READMISO){
 200         word += (high);
 201       }
 202     }
 203   } else {
 204     for (bit = bitcount; bit > 0; bit--) {
 205       /* write MOSI on trailing edge of previous clock */
 206       if (word & high)
 207         {SETMOSI;}
 208       else
 209         {CLRMOSI;}
 210       word = (word & mask) << 1;
 211
 212       if (bit==1 && end)
 213         SETTMS;//TMS high on last bit to exit.
 214
 215       jtag_arm_tcktock();
 216
 217       /* read MISO on trailing edge */
 218       word |= (READMISO);
 219     }
 220   }
 221
 222
 223   SETMOSI;
 224
 225   if (end){
 226     // exit state
 227     jtag_arm_tcktock();
 228     // update state
 229     if (retidle){
 230       CLRTMS;
 231       jtag_arm_tcktock();
 232     }
 233   }
 234   return word;
 235 }
 236
 237
 238
 239 /************************************************************************
 240 * ARM7TDMI core has 6 primary registers to be connected between TDI/TDO
 241 *   * Bypass Register
 242 *   * ID Code Register
 243 *   * Scan Chain Select Register    (4 bits_lsb)
 244 *   * Scan Chain 0                  (64+* bits: 32_databits_lsb + ctrlbits + 32_addrbits_msb)
 245 *   * Scan Chain 1                  (33 bits: 32_bits + BREAKPT)
 246 *   * Scan Chain 2                  (38 bits: rw + 5_regbits_msb + 32_databits_msb)
 247 ************************************************************************/
 248
 249
 250
 251 /************************** Basic JTAG Verb Commands *******************************/
 252 //! Grab the core ID.
 253 unsigned long jtagarm7tdmi_idcode(){               // PROVEN
 254   jtagarm7tdmi_resettap();
 255   SHIFT_IR;
 256   jtagarmtransn(ARM7TDMI_IR_IDCODE, 4, LSB, END, RETIDLE);
 257   SHIFT_DR;
 258   return jtagarmtransn(0,32, LSB, END, RETIDLE);
 259 }
 260
 261 //!  Connect Bypass Register to TDO/TDI
 262 unsigned char jtagarm7tdmi_bypass(){               // PROVEN
 263   //jtagarm7tdmi_resettap();
 264   SHIFT_IR;
 265   return jtagarmtransn(ARM7TDMI_IR_BYPASS, 4, LSB, END, NORETIDLE);
 266 }
 267 //!  INTEST verb - do internal test
 268 unsigned char jtagarm7tdmi_intest() {
 269   //jtagarm7tdmi_resettap();
 270   SHIFT_IR;
 271   return jtagarmtransn(ARM7TDMI_IR_INTEST, 4, LSB, END, NORETIDLE);
 272 }
 273
 274 //!  EXTEST verb
 275 unsigned char jtagarm7tdmi_extest() {
 276   //jtagarm7tdmi_resettap();
 277   SHIFT_IR;
 278   return jtagarmtransn(ARM7TDMI_IR_EXTEST, 4, LSB, END, NORETIDLE);
 279 }
 280
 281 //!  SAMPLE verb
 282 //unsigned long jtagarm7tdmi_sample() {
 283 //  jtagarm7tdmi_ir_shift4(ARM7TDMI_IR_SAMPLE);        // ???? same here.
 284 //  return jtagtransn(0,32);
 285 //}
 286
 287 //!  RESTART verb
 288 unsigned char jtagarm7tdmi_restart() {
 289   //jtagarm7tdmi_resettap();
 290   SHIFT_IR;
 291   return jtagarmtransn(ARM7TDMI_IR_RESTART, 4, LSB, END, RETIDLE);
 292 }
 293
 294 //!  ARM7TDMI_IR_CLAMP               0x5
 295 //unsigned long jtagarm7tdmi_clamp() {
 296 //  jtagarm7tdmi_resettap();
 297 //  SHIFT_IR;
 298 //  jtagarmtransn(ARM7TDMI_IR_CLAMP, 4, LSB, END, NORETIDLE);
 299 //  SHIFT_DR;
 300 //  return jtagarmtransn(0, 32, LSB, END, RETIDLE);
 301 //}
 302
 303 //!  ARM7TDMI_IR_HIGHZ               0x7
 304 //unsigned char jtagarm7tdmi_highz() {
 305 //  jtagarm7tdmi_resettap();
 306 //  SHIFT_IR;
 307 //  return jtagarmtransn(ARM7TDMI_IR_HIGHZ, 4, LSB, END, NORETIDLE);
 308 //}
 309
 310 //! define ARM7TDMI_IR_CLAMPZ              0x9
 311 //unsigned char jtagarm7tdmi_clampz() {
 312 //  jtagarm7tdmi_resettap();
 313 //  SHIFT_IR;
 314 //  return jtagarmtransn(ARM7TDMI_IR_CLAMPZ, 4, LSB, END, NORETIDLE);
 315 //}
 316
 317
 318 //!  Connect the appropriate scan chain to TDO/TDI.  SCAN_N, INTEST, ENDS IN SHIFT_DR!!!!!
 319 unsigned long jtagarm7tdmi_scan(int chain, int testmode) {               // PROVEN
 320 /*
 321 When selecting a scan chain the “Run Test/Idle” state should never be reached, other-
 322 wise, when in debug state, the core will not be correctly isolated and intrusive
 323 commands occur. Therefore, it is recommended to pass directly from the “Update”
 324 state” to the “Select DR” state each time the “Update” state is reached.
 325 */
 326   unsigned long retval;
 327   if (current_chain != chain) {     // breaks shit when going from idcode back to scan chain
 328     SHIFT_IR;
 329     jtagarmtransn(ARM7TDMI_IR_SCAN_N, 4, LSB, END, NORETIDLE);
 330     SHIFT_DR;
 331     retval = jtagarmtransn(chain, 4, LSB, END, NORETIDLE);
 332     current_chain = chain;
 333   }    else
 334     retval = current_chain;
 335   // put in test mode...
 336   SHIFT_IR;
 337   jtagarmtransn(testmode, 4, LSB, END, RETIDLE);
 338   return(retval);
 339 }
 340
 341
 342 //!  Connect the appropriate scan chain to TDO/TDI.  SCAN_N, INTEST, ENDS IN SHIFT_DR!!!!!
 343 unsigned long jtagarm7tdmi_scan_intest(int chain) {               // PROVEN
 344   return jtagarm7tdmi_scan(chain, ARM7TDMI_IR_INTEST);
 345 }
 346
 347
 348
 349
 350 //! push an instruction into the pipeline
 351 unsigned long jtagarm7tdmi_instr_primitive(unsigned long instr, char breakpt){
 352   unsigned long retval;
 353   //jtagarm7tdmi_resettap();                  // FIXME: DEBUG: seems necessary for some reason.  ugh.
 354   jtagarm7tdmi_scan_intest(1);
 355
 356   SHIFT_DR;
 357   // if the next instruction is to run using MCLK (master clock), set TDI
 358   if (breakpt)
 359     {
 360     SETMOSI;
 361     count_sysspd_instr_since_debug++;
 362     }
 363   else
 364     {
 365     CLRMOSI;
 366     count_dbgspd_instr_since_debug++;
 367     }
 368   jtag_arm_tcktock();
 369
 370   // Now shift in the 32 bits
 371   retval = jtagarmtransn(instr, 32, MSB, END, RETIDLE);    // Must return to RUN-TEST/IDLE state for instruction to enter pipeline, and causes debug clock.
 372   //jtag_arm_tcktock();
 373   return(retval);
 374
 375 }
 376
 377
 378 unsigned long jtagarm7tdmi_nop(char breakpt){
 379   return jtagarm7tdmi_instr_primitive(ARM_INSTR_NOP, breakpt);
 380 }
 381
 382 /*    stolen from ARM DDI0029G documentation, translated using ARM Architecture Reference Manual (14128.pdf)
 383 STR R0, [R0]; Save R0 before use
 384 MOV R0, PC ; Copy PC into R0
 385 STR R0, [R0]; Now save the PC in R0
 386 BX PC ; Jump into ARM state
 387 MOV R8, R8 ;
 388 MOV R8, R8 ;
 389 NOP
 390 NOP
 391
 392 */
 393 //! set the current mode to ARM, returns PC (FIXME).  Should be used by haltcpu(), which should also store PC and the THUMB state, for use by releasecpu();
 394 unsigned long jtagarm7tdmi_setMode_ARM(){               // PROVEN
 395   unsigned long retval = 0xff;
 396   while ((jtagarm7tdmi_get_dbgstate() & JTAG_ARM7TDMI_DBG_TBIT)&& retval-- > 0){
 397     cmddataword[6] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_NOP,0);
 398     cmddataword[1] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_STR_R0_r0,0);
 399     cmddataword[2] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_MOV_R0_PC,0);
 400     cmddataword[3] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_STR_R0_r0,0);
 401     cmddataword[4] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_BX_PC,0);
 402     cmddataword[5] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_NOP,0);
 403     cmddataword[6] = jtagarm7tdmi_instr_primitive(THUMB_INSTR_NOP,0);
 404     jtagarm7tdmi_resettap();                  // seems necessary for some reason.  ugh.
 405   }
 406   return(retval);
 407 }
 408
 409
 410
 411
 412 /************************* EmbeddedICE Primitives ****************************/
 413 //! shifter for writing to chain2 (EmbeddedICE).
 414 unsigned long eice_write(unsigned char reg, unsigned long data){
 415   unsigned long retval, temp;
 416   jtagarm7tdmi_scan_intest(2);
 417   // Now shift in the 32 bits
 418   SHIFT_DR;
 419   retval = jtagarmtransn(data, 32, LSB, NOEND, NORETIDLE);          // send in the data - 32-bits lsb
 420   temp = jtagarmtransn(reg, 5, LSB, NOEND, NORETIDLE);              // send in the register address - 5 bits lsb
 421   jtagarmtransn(1, 1, LSB, END, RETIDLE);                           // send in the WRITE bit
 422
 423   //SETTMS;   // Last Bit - Exit UPDATE_DR
 424   //// is this update a read/write or just read?
 425   //SETMOSI;
 426   //jtag_arm_tcktock();
 427
 428   return(retval);
 429 }
 430
 431 //! shifter for reading from chain2 (EmbeddedICE).
 432 unsigned long eice_read(unsigned char reg){               // PROVEN
 433   unsigned long temp;
 434   jtagarm7tdmi_scan_intest(2);
 435
 436   // send in the register address - 5 bits LSB
 437   SHIFT_DR;
 438   temp = jtagarmtransn(reg, 5, LSB, NOEND, NORETIDLE);
 439
 440   // clear TDI to select "read only"
 441   jtagarmtransn(0, 1, LSB, END, RETIDLE);
 442
 443   SHIFT_DR;
 444   // Now shift out the 32 bits
 445   return(jtagarmtransn(0, 32, LSB, END, RETIDLE));   // atmel arm jtag docs pp.10-11: LSB first
 446
 447 }
 448
 449
 450
 451
 452 /************************* ICEBreaker/EmbeddedICE Stuff ******************************/
 453 //! Grab debug register
 454 unsigned long jtagarm7tdmi_get_dbgstate() {       // ICE Debug register, *NOT* ARM register DSCR    //    PROVEN
 455   //jtagarm7tdmi_resettap();
 456   return eice_read(EICE_DBGSTATUS);
 457 }
 458
 459 //! Grab debug register
 460 unsigned long jtagarm7tdmi_get_dbgctrl() {
 461   return eice_read(EICE_DBGCTRL);
 462 }
 463
 464 //! Update debug register
 465 unsigned long jtagarm7tdmi_set_dbgctrl(unsigned long bits) {
 466   return eice_write(EICE_DBGCTRL, bits);
 467 }
 468
 469
 470
 471 //!  Set and Enable Watchpoint 0
 472 void jtagarm7tdmi_set_watchpoint0(unsigned long addr, unsigned long addrmask, unsigned long data, unsigned long datamask, unsigned long ctrl, unsigned long ctrlmask){
 473   // store watchpoint info?  - not right now
 474     // FIXME: store info
 475
 476   eice_write(EICE_WP0ADDR, addr);           // write 0 in watchpoint 0 address
 477   eice_write(EICE_WP0ADDRMASK, addrmask);   // write 0xffffffff in watchpoint 0 address mask
 478   eice_write(EICE_WP0DATA, data);           // write 0 in watchpoint 0 data
 479   eice_write(EICE_WP0DATAMASK, datamask);   // write 0xffffffff in watchpoint 0 data mask
 480   eice_write(EICE_WP0CTRL, ctrlmask);       // write 0x00000100 in watchpoint 0 control value register (enables watchpoint)
 481   eice_write(EICE_WP0CTRLMASK, ctrlmask);   // write 0xfffffff7 in watchpoint 0 control mask - only detect the fetch instruction
 482 }
 483
 484 //!  Set and Enable Watchpoint 1
 485 void jtagarm7tdmi_set_watchpoint1(unsigned long addr, unsigned long addrmask, unsigned long data, unsigned long datamask, unsigned long ctrl, unsigned long ctrlmask){
 486   // store watchpoint info?  - not right now
 487     // FIXME: store info
 488
 489   eice_write(EICE_WP1ADDR, addr);           // write 0 in watchpoint 1 address
 490   eice_write(EICE_WP1ADDRMASK, addrmask);   // write 0xffffffff in watchpoint 1 address mask
 491   eice_write(EICE_WP1DATA, data);           // write 0 in watchpoint 1 data
 492   eice_write(EICE_WP1DATAMASK, datamask);   // write 0xffffffff in watchpoint 1 data mask
 493   eice_write(EICE_WP1CTRL, ctrl);           // write 0x00000100 in watchpoint 1 control value register (enables watchpoint)
 494   eice_write(EICE_WP1CTRLMASK, ctrlmask);   // write 0xfffffff7 in watchpoint 1 control mask - only detect the fetch instruction
 495 }
 496
 497 //!  Disable Watchpoint 0
 498 void jtagarm7tdmi_disable_watchpoint0(){
 499   eice_write(EICE_WP0CTRL, 0x0); // write 0 in watchpoint 0 control value - disables watchpoint 0
 500 }
 501
 502 //!  Disable Watchpoint 1
 503 void jtagarm7tdmi_disable_watchpoint1(){
 504   eice_write(EICE_WP1CTRL, 0x0);            // write 0 in watchpoint 0 control value - disables watchpoint 0
 505 }
 506
 507
 508
 509 /******************** Complex Commands **************************/
 510
 511 //! Push an instruction into the CPU pipeline
 512 //  NOTE!  Must provide EXECNOPARM for parameter if no parm is required.
 513 unsigned long jtagarm7tdmi_exec(unsigned long instr, unsigned long parameter, unsigned char systemspeed) {
 514   unsigned long retval;
 515
 516   debughex32(jtagarm7tdmi_nop( 0));
 517   debughex32(jtagarm7tdmi_nop(systemspeed));
 518   debughex32(jtagarm7tdmi_instr_primitive(instr, 0));      // write 32-bit instruction code into DR
 519   debughex32(jtagarm7tdmi_nop( 0));
 520   debughex32(jtagarm7tdmi_nop( 0));
 521   debughex32(jtagarm7tdmi_instr_primitive(parameter, 0));  // inject long
 522   retval = jtagarm7tdmi_nop( 0);
 523   debughex32(retval);
 524   debughex32(jtagarm7tdmi_nop( 0));
 525   debughex32(jtagarm7tdmi_nop( 0));
 526
 527   return(retval);
 528 }
 529
 530 //! Retrieve a 32-bit Register value
 531 unsigned long jtagarm7tdmi_get_register(unsigned long reg) {
 532   unsigned long retval = 0, instr;
 533   // push nop into pipeline - clean out the pipeline...
 534   instr = (unsigned long)(reg<<12) | (unsigned long)ARM_READ_REG;   // STR Rx, [R14]
 535   //instr = (unsigned long)(((unsigned long)reg<<12) | ARM_READ_REG);
 536   debughex32(instr);
 537
 538   jtagarm7tdmi_nop( 0);
 539   jtagarm7tdmi_instr_primitive(instr, 0);
 540   jtagarm7tdmi_nop( 0);                // push nop into pipeline - fetched
 541   jtagarm7tdmi_nop( 0);                // push nop into pipeline - decoded
 542   jtagarm7tdmi_nop( 0);                // push nop into pipeline - executed
 543   retval = jtagarm7tdmi_nop( 0);                        // recover 32-bit word
 544   debughex32(retval);
 545   jtagarm7tdmi_nop( 0);
 546   jtagarm7tdmi_nop( 0);
 547   jtagarm7tdmi_nop( 0);
 548   return retval;
 549 }
 550
 551 //! Set a 32-bit Register value
 552 void jtagarm7tdmi_set_register(unsigned long reg, unsigned long val) {
 553   unsigned long instr;
 554   instr = (unsigned long)(((unsigned long)reg<<12) | ARM_WRITE_REG); //  LDR Rx, [R14]
 555   debugstr("Writing:");
 556   debughex32(instr);
 557   debughex32(val);
 558   jtagarm7tdmi_nop( 0);            // push nop into pipeline - clean out the pipeline...
 559   jtagarm7tdmi_instr_primitive(instr, 0); // push instr into pipeline - fetch
 560   jtagarm7tdmi_nop( 0);            // push nop into pipeline - decode
 561   jtagarm7tdmi_nop( 0);            // push nop into pipeline - execute
 562
 563   //debughex32(jtagarm7tdmi_instr_primitive(val, 0)); // push 32-bit word on data bus
 564   jtagarm7tdmi_instr_primitive(val, 0); // push 32-bit word on data bus
 565   jtagarm7tdmi_nop( 0);            // push nop into pipeline - executed
 566
 567   //if (reg == ARM_REG_PC){
 568     jtagarm7tdmi_nop( 0);
 569     jtagarm7tdmi_nop( 0);
 570   //}
 571   jtagarm7tdmi_nop( 0);
 572 }
 573
 574
 575
 576 //! Get all registers, placing them into cmddatalong[0-15]
 577 void jtagarm7tdmi_get_registers() {
 578   debughex32(ARM_INSTR_SKANKREGS1);
 579   debughex32(jtagarm7tdmi_nop( 0));
 580   debughex32(jtagarm7tdmi_instr_primitive(ARM_INSTR_SKANKREGS1,0));
 581   debughex32(jtagarm7tdmi_nop( 0));
 582   debughex32(jtagarm7tdmi_nop( 0));
 583   cmddatalong[ 0] = jtagarm7tdmi_nop( 0);
 584   cmddatalong[ 1] = jtagarm7tdmi_nop( 0);
 585   cmddatalong[ 2] = jtagarm7tdmi_nop( 0);
 586   cmddatalong[ 3] = jtagarm7tdmi_nop( 0);
 587   cmddatalong[ 4] = jtagarm7tdmi_nop( 0);
 588   cmddatalong[ 5] = jtagarm7tdmi_nop( 0);
 589   cmddatalong[ 6] = jtagarm7tdmi_nop( 0);
 590   cmddatalong[ 7] = jtagarm7tdmi_nop( 0);
 591   debughex32(ARM_INSTR_SKANKREGS2);
 592   debughex32(jtagarm7tdmi_nop( 0));
 593   //jtagarm7tdmi_nop( 0);
 594   debughex32(jtagarm7tdmi_instr_primitive(ARM_INSTR_SKANKREGS2,0));
 595   debughex32(jtagarm7tdmi_nop( 0));
 596   debughex32(jtagarm7tdmi_nop( 0));
 597   //jtagarm7tdmi_nop( 0);
 598   //jtagarm7tdmi_nop( 0);
 599   cmddatalong[ 8] = jtagarm7tdmi_nop( 0);
 600   cmddatalong[ 9] = jtagarm7tdmi_nop( 0);
 601   cmddatalong[10] = jtagarm7tdmi_nop( 0);
 602   cmddatalong[11] = jtagarm7tdmi_nop( 0);
 603   cmddatalong[12] = jtagarm7tdmi_nop( 0);
 604   cmddatalong[13] = jtagarm7tdmi_nop( 0);
 605   cmddatalong[14] = jtagarm7tdmi_nop( 0);
 606   cmddatalong[15] = jtagarm7tdmi_nop( 0);
 607   jtagarm7tdmi_nop( 0);
 608 }
 609
 610 //! Set all registers from cmddatalong[0-15]
 611 void jtagarm7tdmi_set_registers() {   //FIXME: BORKEN... TOTALLY TRYING TO BUY A VOWEL
 612   debughex32(ARM_INSTR_CLOBBEREGS);
 613   jtagarm7tdmi_nop( 0);
 614   debughex32(jtagarm7tdmi_instr_primitive(ARM_INSTR_CLOBBEREGS,0));
 615   jtagarm7tdmi_nop( 0);
 616   jtagarm7tdmi_nop( 0);
 617   debughex32(jtagarm7tdmi_instr_primitive(0x40,0));
 618   debughex32(jtagarm7tdmi_instr_primitive(0x41,0));
 619   debughex32(jtagarm7tdmi_instr_primitive(0x42,0));
 620   debughex32(jtagarm7tdmi_instr_primitive(0x43,0));
 621   debughex32(jtagarm7tdmi_instr_primitive(0x44,0));
 622   debughex32(jtagarm7tdmi_instr_primitive(0x45,0));
 623   debughex32(jtagarm7tdmi_instr_primitive(0x46,0));
 624   debughex32(jtagarm7tdmi_instr_primitive(0x47,0));
 625   debughex32(jtagarm7tdmi_instr_primitive(0x48,0));
 626   debughex32(jtagarm7tdmi_instr_primitive(0x49,0));
 627   debughex32(jtagarm7tdmi_instr_primitive(0x4a,0));
 628   debughex32(jtagarm7tdmi_instr_primitive(0x4b,0));
 629   debughex32(jtagarm7tdmi_instr_primitive(0x4c,0));
 630   debughex32(jtagarm7tdmi_instr_primitive(0x4d,0));
 631   debughex32(jtagarm7tdmi_instr_primitive(0x4e,0));
 632   debughex32(jtagarm7tdmi_instr_primitive(0x4f,0));
 633 }
 634
 635 //! Retrieve the CPSR Register value
 636 unsigned long jtagarm7tdmi_get_regCPSR() {
 637   unsigned long retval = 0;
 638
 639   debughex32(jtagarm7tdmi_nop( 0)); // push nop into pipeline - clean out the pipeline...
 640   debughex32(jtagarm7tdmi_instr_primitive(ARM_INSTR_MRS_R0_CPSR, 0)); // push MRS_R0, CPSR into pipeline
 641   debughex32(jtagarm7tdmi_nop( 0)); // push nop into pipeline - fetched
 642   debughex32(jtagarm7tdmi_nop( 0)); // push nop into pipeline - decoded
 643   debughex32(jtagarm7tdmi_nop( 0)); // push nop into pipeline - executed
 644   retval = jtagarm7tdmi_nop( 0);        // recover 32-bit word
 645   debughex32(retval);
 646   return retval;
 647 }
 648
 649 //! Retrieve the CPSR Register value
 650 unsigned long jtagarm7tdmi_set_regCPSR(unsigned long val) {
 651   unsigned long retval = 0;
 652
 653   debughex32(jtagarm7tdmi_nop( 0));        // push nop into pipeline - clean out the pipeline...
 654   debughex32(jtagarm7tdmi_instr_primitive(ARM_INSTR_MSR_cpsr_cxsf_R0, 0)); // push MSR cpsr_cxsf, R0 into pipeline
 655   debughex32(jtagarm7tdmi_nop( 0));        // push nop into pipeline - fetched
 656   debughex32(jtagarm7tdmi_nop( 0));        // push nop into pipeline - decoded
 657
 658   retval = jtagarm7tdmi_instr_primitive(val, 0);// push 32-bit word on data bus
 659   debughex32(jtagarm7tdmi_nop( 0));        // push nop into pipeline - executed
 660   debughex32(retval);
 661   return(retval);
 662 }
 663
 664 //! Write data to address - Assume TAP in run-test/idle state
 665 unsigned long jtagarm7tdmi_writemem(unsigned long adr, unsigned long data){
 666   unsigned long r0=0, r1=-1;
 667
 668   r0 = jtagarm7tdmi_get_register(0);        // store R0 and R1
 669   r1 = jtagarm7tdmi_get_register(1);
 670   jtagarm7tdmi_set_register(0, adr);        // write address into R0
 671   jtagarm7tdmi_set_register(1, data);       // write data in R1
 672   jtagarm7tdmi_nop( 0);                     // push nop into pipeline to "clean" it ???
 673   jtagarm7tdmi_nop( 1);                     // push nop into pipeline with BREAKPT set
 674   jtagarm7tdmi_instr_primitive(ARM_INSTR_LDR_R1_r0_4, 0); // push LDR R1, R0, #4 into instruction pipeline
 675   jtagarm7tdmi_nop( 0);                     // push nop into pipeline
 676   jtagarm7tdmi_set_register(1, r1);         // restore R0 and R1
 677   jtagarm7tdmi_set_register(0, r0);
 678   return(-1);
 679 }
 680
 681
 682
 683
 684 //! Read data from address
 685 unsigned long jtagarm7tdmi_readmem(unsigned long adr){
 686   unsigned long retval = 0;
 687   unsigned long r0=0, r1=-1;
 688   int waitcount = 0xfff;
 689
 690   r0 = jtagarm7tdmi_get_register(0);        // store R0 and R1
 691   r1 = jtagarm7tdmi_get_register(1);
 692   jtagarm7tdmi_set_register(0, adr);        // write address into R0
 693   jtagarm7tdmi_nop( 0);                     // push nop into pipeline to "clean" it ???
 694   jtagarm7tdmi_nop( 1);                     // push nop into pipeline with BREAKPT set
 695   jtagarm7tdmi_instr_primitive(ARM_INSTR_LDR_R1_r0_4, 0); // push LDR R1, R0, #4 into instruction pipeline
 696   jtagarm7tdmi_nop( 0);                     // push nop into pipeline
 697   jtagarm7tdmi_restart();                   // SHIFT_IR with RESTART instruction
 698
 699   // Poll the Debug Status Register for DBGACK and nMREQ to be HIGH
 700   while ((jtagarm7tdmi_get_dbgstate() & 9) == 0  && waitcount > 0){
 701     delay(1);
 702     waitcount --;
 703   }
 704   if (waitcount == 0){
 705     return (-1);
 706   } else {
 707     retval = jtagarm7tdmi_get_register(1);  // read memory value from R1 register
 708     jtagarm7tdmi_set_register(1, r1);         // restore R0 and R1
 709     jtagarm7tdmi_set_register(0, r0);
 710   }
 711   return retval;
 712 }
 713
 714
 715 //! Read Program Counter
 716 unsigned long jtagarm7tdmi_getpc(){
 717   return jtagarm7tdmi_get_register(ARM_REG_PC);
 718 }
 719
 720 //! Set Program Counter
 721 void jtagarm7tdmi_setpc(unsigned long adr){
 722   jtagarm7tdmi_set_register(ARM_REG_PC, adr);
 723 }
 724
 725 //! Halt CPU - returns 0xffff if the operation fails to complete within
 726 unsigned long jtagarm7tdmi_haltcpu(){                   //  PROVEN
 727   int waitcount = 0xfff;
 728
 729   // store watchpoint info?  - not right now
 730   eice_write(EICE_WP1ADDR, 0);              // write 0 in watchpoint 1 address
 731   eice_write(EICE_WP1ADDRMASK, 0xffffffff); // write 0xffffffff in watchpoint 1 address mask
 732   eice_write(EICE_WP1DATA, 0);              // write 0 in watchpoint 1 data
 733   eice_write(EICE_WP1DATAMASK, 0xffffffff); // write 0xffffffff in watchpoint 1 data mask
 734   eice_write(EICE_WP1CTRL, 0x100);          //!!!!! WTF!  THIS IS SUPPOSED TO BE 9 bits wide?!?  // write 0x00000100 in watchpoint 1 control value register (enables watchpoint)
 735   eice_write(EICE_WP1CTRLMASK, 0xfffffff7); //!!!!! WTF!  THIS IS SUPPOSED TO BE 8 bits wide?!?  // write 0xfffffff7 in watchpoint 1 control mask - only detect the fetch instruction
 736
 737   // poll until debug status says the cpu is in debug mode
 738   while (!(jtagarm7tdmi_get_dbgstate() & 0x1)   && waitcount-- > 0){
 739     delay(1);
 740   }
 741   eice_write(EICE_WP1CTRL, 0x0);            // write 0 in watchpoint 0 control value - disables watchpoint 0
 742
 743   // store the debug state
 744   last_halt_debug_state = jtagarm7tdmi_get_dbgstate();
 745   last_halt_pc = jtagarm7tdmi_getpc() - 4;  // assume -4 for entering debug mode via watchpoint.
 746   count_dbgspd_instr_since_debug = 0;
 747   count_sysspd_instr_since_debug = 0;
 748
 749   // get into ARM mode if the T flag is set (Thumb mode)
 750   while (jtagarm7tdmi_get_dbgstate() & JTAG_ARM7TDMI_DBG_TBIT && waitcount-- > 0) {
 751     jtagarm7tdmi_setMode_ARM();
 752   }
 753   jtagarm7tdmi_resettap();
 754   return waitcount;
 755 }
 756
 757 unsigned long jtagarm7tdmi_releasecpu(){
 758   int waitcount = 0xfff;
 759   unsigned long instr;
 760   // somehow determine what PC should be (a couple ways possible, calculations required)
 761   jtagarm7tdmi_nop(0);                          // NOP
 762   jtagarm7tdmi_nop(1);                          // NOP/BREAKPT
 763
 764   if (last_halt_debug_state & JTAG_ARM7TDMI_DBG_TBIT){      // FIXME:  FORNICATED!  BX requires register, thus more instrs... could we get away with the same instruction but +1 to offset?
 765     instr = ARM_INSTR_B_PC + 0x1000001 - (count_dbgspd_instr_since_debug) - (count_sysspd_instr_since_debug*3);  //FIXME: make this right  - can't we just do an a7solute b/bx?
 766     jtagarm7tdmi_instr_primitive(instr,0);
 767   } else {
 768     instr = ARM_INSTR_B_PC + 0x1000000 - (count_dbgspd_instr_since_debug*4) - (count_sysspd_instr_since_debug*12);
 769     jtagarm7tdmi_instr_primitive(instr,0);
 770   }
 771
 772   SHIFT_IR;
 773   jtagarmtransn(ARM7TDMI_IR_RESTART,4,LSB,END,RETIDLE); // VERB_RESTART
 774
 775   // wait until restart-bit set in debug state register
 776   while ((jtagarm7tdmi_get_dbgstate() & JTAG_ARM7TDMI_DBG_DBGACK) && waitcount > 0){
 777     msdelay(1);
 778     waitcount --;
 779   }
 780   last_halt_debug_state = -1;
 781   last_halt_pc = -1;
 782   return 0;
 783 }
 784
 785
 786
 787
 788 ///////////////////////////////////////////////////////////////////////////////////////////////////
 789 //! Handles ARM7TDMI JTAG commands.  Forwards others to JTAG.
 790 void jtagarm7tdmihandle(unsigned char app, unsigned char verb, unsigned long len){
 791   register char blocks;
 792
 793   unsigned int i,val;
 794   unsigned long at;
 795
 796   jtagarm7tdmi_resettap();
 797
 798   switch(verb){
 799   case START:
 800     //Enter JTAG mode.
 801     debughex32(jtagarm7tdmi_start());
 802     debughex32(jtagarm7tdmi_haltcpu());
 803     //jtagarm7tdmi_resettap();
 804     debughex32(jtagarm7tdmi_get_dbgstate());
 805
 806     // DEBUG: FIXME: NOT PART OF OPERATIONAL CODE
 807     //for (mlop=2;mlop<4;mlop++){
 808     //  jtagarm7tdmi_set_register(mlop, 0x43424140);
 809     //}
 810     /////////////////////////////////////////////
 811     txdata(app,verb,0x4);
 812     break;
 813   case JTAGARM7TDMI_READMEM:
 814   case PEEK:
 815     blocks=(len>4?cmddata[4]:1);
 816     at=cmddatalong[0];
 817
 818     len=0x80;
 819     txhead(app,verb,len);
 820
 821     while(blocks--){
 822       for(i=0;i<len;i+=2){
 823         jtagarm7tdmi_resettap();
 824         delay(10);
 825
 826         val=jtagarm7tdmi_readmem(at);
 827
 828         at+=2;
 829         serial_tx(val&0xFF);
 830         serial_tx((val&0xFF00)>>8);
 831       }
 832     }
 833
 834     break;
 835   case JTAGARM7TDMI_GET_CHIP_ID:
 836         jtagarm7tdmi_resettap();
 837     cmddatalong[0] = jtagarm7tdmi_idcode();
 838     txdata(app,verb,4);
 839     break;
 840
 841
 842   case JTAGARM7TDMI_WRITEMEM:
 843   case POKE:
 844         jtagarm7tdmi_resettap();
 845     jtagarm7tdmi_writemem(cmddatalong[0],
 846                        cmddataword[2]);
 847     cmddataword[0]=jtagarm7tdmi_readmem(cmddatalong[0]);
 848     txdata(app,verb,2);
 849     break;
 850
 851   case JTAGARM7TDMI_HALTCPU:
 852     cmddatalong[0] = jtagarm7tdmi_haltcpu();
 853     txdata(app,verb,4);
 854     break;
 855   case JTAGARM7TDMI_RELEASECPU:
 856         jtagarm7tdmi_resettap();
 857     cmddatalong[0] = jtagarm7tdmi_releasecpu();
 858     txdata(app,verb,4);
 859     break;
 860   //unimplemented functions
 861   //case JTAGARM7TDMI_SETINSTRFETCH:
 862   //case JTAGARM7TDMI_WRITEFLASH:
 863   //case JTAGARM7TDMI_ERASEFLASH:
 864   case JTAGARM7TDMI_SET_PC:
 865     jtagarm7tdmi_setpc(cmddatalong[0]);
 866     txdata(app,verb,0);
 867     break;
 868   case JTAGARM7TDMI_GET_DEBUG_CTRL:
 869     cmddatalong[0] = jtagarm7tdmi_get_dbgctrl();
 870     txdata(app,verb,1);
 871     break;
 872   case JTAGARM7TDMI_SET_DEBUG_CTRL:
 873     cmddatalong[0] = jtagarm7tdmi_set_dbgctrl(cmddata[0]);
 874     txdata(app,verb,4);
 875     break;
 876   case JTAGARM7TDMI_GET_PC:
 877     cmddatalong[0] = jtagarm7tdmi_getpc();
 878     txdata(app,verb,4);
 879     break;
 880   case JTAGARM7TDMI_GET_DEBUG_STATE:
 881     //jtagarm7tdmi_resettap();            // Shouldn't need this, but currently do.  FIXME!
 882     cmddatalong[0] = jtagarm7tdmi_get_dbgstate();
 883     txdata(app,verb,4);
 884     break;
 885   //case JTAGARM7TDMI_GET_WATCHPOINT:
 886   //case JTAGARM7TDMI_SET_WATCHPOINT:
 887   case JTAGARM7TDMI_GET_REGISTER:
 888         jtagarm7tdmi_resettap();
 889     val = cmddata[0];
 890     cmddatalong[0] = jtagarm7tdmi_get_register(val);
 891     txdata(app,verb,4);
 892     break;
 893   case JTAGARM7TDMI_SET_REGISTER:           // FIXME: NOT AT ALL CORRECT, THIS IS TESTING CODE ONLY
 894         jtagarm7tdmi_resettap();
 895     jtagarm7tdmi_set_register(cmddata[0], cmddatalong[1]);
 896     cmddatalong[0] = cmddatalong[1];
 897     txdata(app,verb,4);
 898     break;
 899   case JTAGARM7TDMI_GET_REGISTERS:
 900         jtagarm7tdmi_resettap();
 901     jtagarm7tdmi_get_registers();
 902     txdata(app,verb,64);
 903     break;
 904   case JTAGARM7TDMI_SET_REGISTERS:
 905         jtagarm7tdmi_resettap();
 906     jtagarm7tdmi_set_registers();
 907     txdata(app,verb,64);
 908     break;
 909   case JTAGARM7TDMI_DEBUG_INSTR:
 910         jtagarm7tdmi_resettap();
 911     cmddataword[0] = jtagarm7tdmi_exec(cmddataword[0], cmddataword[1], cmddata[9]);
 912     txdata(app,verb,80);
 913     break;
 914   //case JTAGARM7TDMI_STEP_INSTR:
 915 /*  case JTAGARM7TDMI_READ_CODE_MEMORY:
 916   case JTAGARM7TDMI_WRITE_FLASH_PAGE:
 917   case JTAGARM7TDMI_READ_FLASH_PAGE:
 918   case JTAGARM7TDMI_MASS_ERASE_FLASH:
 919   case JTAGARM7TDMI_PROGRAM_FLASH:
 920   case JTAGARM7TDMI_LOCKCHIP:
 921   case JTAGARM7TDMI_CHIP_ERASE:
 922   */
 923 // Really ARM specific stuff
 924   case JTAGARM7TDMI_GET_CPSR:
 925         jtagarm7tdmi_resettap();
 926     cmddatalong[0] = jtagarm7tdmi_get_regCPSR();
 927     txdata(app,verb,4);
 928     break;
 929   case JTAGARM7TDMI_SET_CPSR:
 930         jtagarm7tdmi_resettap();
 931     cmddatalong[0] = jtagarm7tdmi_set_regCPSR(cmddatalong[0]);
 932     txdata(app,verb,4);
 933     break;
 934   case JTAGARM7TDMI_GET_SPSR:           // FIXME: NOT CORRECT
 935         jtagarm7tdmi_resettap();
 936     cmddatalong[0] = jtagarm7tdmi_get_regCPSR();
 937     txdata(app,verb,4);
 938     break;
 939   case JTAGARM7TDMI_SET_SPSR:           // FIXME: NOT CORRECT
 940         jtagarm7tdmi_resettap();
 941     cmddatalong[0] = jtagarm7tdmi_set_regCPSR(cmddatalong[0]);
 942     txdata(app,verb,4);
 943     break;
 944   case JTAGARM7TDMI_SET_MODE_THUMB:
 945   case JTAGARM7TDMI_SET_MODE_ARM:
 946         jtagarm7tdmi_resettap();
 947     cmddataword[0] = jtagarm7tdmi_setMode_ARM();
 948     txdata(app,verb,4);
 949     break;
 950
 951   case 0xD0:          // loopback test
 952     jtagarm7tdmi_resettap();
 953     cmddatalong[0] = jtagarm7tdmi_bypass(cmddatalong[0]);
 954     txdata(app,verb,4);
 955     break;
 956   case 0xD8:          // EICE_READ
 957     jtagarm7tdmi_resettap();
 958     cmddatalong[0] = eice_read(cmddatalong[0]);
 959     txdata(app,verb,4);
 960     break;
 961   case 0xD9:          // EICE_WRITE
 962     jtagarm7tdmi_resettap();
 963     cmddatalong[0] = eice_write(cmddatalong[0], cmddatalong[1]);
 964     txdata(app,verb,4);
 965     break;
 966   case 0xDA:          // TEST MSB THROUGH CHAIN0 and CHAIN1
 967     jtagarm7tdmi_resettap();
 968     jtagarm7tdmi_scan_intest(0);
 969     cmddatalong[0] = jtagarmtransn(0x41414141, 32, LSB, NOEND, NORETIDLE);
 970     cmddatalong[1] = jtagarmtransn(0x42424242, 32, MSB, NOEND, NORETIDLE);
 971     cmddatalong[2] = jtagarmtransn(0x43434343,  9, MSB, NOEND, NORETIDLE);
 972     cmddatalong[3] = jtagarmtransn(0x44444444, 32, MSB, NOEND, NORETIDLE);
 973     cmddatalong[4] = jtagarmtransn(cmddatalong[0], 32, LSB, NOEND, NORETIDLE);
 974     cmddatalong[5] = jtagarmtransn(cmddatalong[1], 32, MSB, NOEND, NORETIDLE);
 975     cmddatalong[6] = jtagarmtransn(cmddatalong[2],  9, MSB, NOEND, NORETIDLE);
 976     cmddatalong[7] = jtagarmtransn(cmddatalong[3], 32, MSB, END, RETIDLE);
 977     jtagarm7tdmi_resettap();
 978     jtagarm7tdmi_scan_intest(1);
 979     cmddatalong[8] = jtagarmtransn(0x41414141, 32, MSB, NOEND, NORETIDLE);
 980     cmddatalong[9] = jtagarmtransn(0x44444444,  1, MSB, NOEND, NORETIDLE);
 981     cmddatalong[10] = jtagarmtransn(cmddatalong[8], 32, MSB, NOEND, NORETIDLE);
 982     cmddatalong[11] = jtagarmtransn(cmddatalong[9],  1, MSB, END, RETIDLE);
 983     jtagarm7tdmi_resettap();
 984     txdata(app,verb,48);
 985     break;
 986
 987   default:
 988     jtaghandle(app,verb,len);
 989   }
 990 }
 991
 992
 993
 994
 995 /*****************************
 996 Captured from FlySwatter against AT91SAM7S, to be used by me for testing.  ignore
 997
 998 > arm reg
 999 System and User mode registers
1000       r0: 300000df       r1: 00000000       r2: 58000000       r3: 00200a75
1001       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1002       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1003      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 000000fc
1004     cpsr: 00000093
1005
1006 FIQ mode shadow registers
1007   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1008  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1009
1010 Supervisor mode shadow registers
1011   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1012
1013 Abort mode shadow registers
1014   sp_abt: 00000000   lr_abt: 00000000 spsr_abt: e00000ff
1015
1016 IRQ mode shadow registers
1017   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1018
1019 Undefined instruction mode shadow registers
1020   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1021 >
1022 > step;arm reg
1023 target state: halted
1024 target halted in ARM state due to single-step, current mode: Supervisor
1025 cpsr: 0x00000093 pc: 0x00000100
1026 System and User mode registers
1027       r0: 300000df       r1: 00000000       r2: 00200000       r3: 00200a75
1028       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1029       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1030      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000100
1031     cpsr: 00000093
1032
1033 FIQ mode shadow registers
1034   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1035  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1036
1037 Supervisor mode shadow registers
1038   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1039
1040 Abort mode shadow registers
1041   sp_abt: 00000000   lr_abt: 00000000 spsr_abt: e00000ff
1042
1043 IRQ mode shadow registers
1044   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1045
1046 Undefined instruction mode shadow registers
1047   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1048 >
1049  step;arm reg
1050 target state: halted
1051 target halted in ARM state due to single-step, current mode: Abort
1052 cpsr: 0x00000097 pc: 0x00000010
1053 System and User mode registers
1054       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1055       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1056       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1057      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1058     cpsr: 00000097
1059
1060 FIQ mode shadow registers
1061   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1062  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1063
1064 Supervisor mode shadow registers
1065   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1066
1067 Abort mode shadow registers
1068   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1069
1070 IRQ mode shadow registers
1071   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1072
1073 Undefined instruction mode shadow registers
1074   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1075 > step;arm reg
1076 target state: halted
1077 target halted in ARM state due to single-step, current mode: Abort
1078 cpsr: 0x00000097 pc: 0x00000010
1079 System and User mode registers
1080       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1081       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1082       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1083      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1084     cpsr: 00000097
1085
1086 FIQ mode shadow registers
1087   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1088  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1089
1090 Supervisor mode shadow registers
1091   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1092
1093 Abort mode shadow registers
1094   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1095
1096 IRQ mode shadow registers
1097   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1098
1099 Undefined instruction mode shadow registers
1100   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1101 > step;arm reg
1102 target state: halted
1103 target halted in ARM state due to single-step, current mode: Abort
1104 cpsr: 0x00000097 pc: 0x00000010
1105 System and User mode registers
1106       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1107       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1108       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1109      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1110     cpsr: 00000097
1111
1112 FIQ mode shadow registers
1113   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1114  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1115
1116 Supervisor mode shadow registers
1117   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1118
1119 Abort mode shadow registers
1120   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1121
1122 IRQ mode shadow registers
1123   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1124
1125 Undefined instruction mode shadow registers
1126   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1127 > step;arm reg
1128 target state: halted
1129 target halted in ARM state due to single-step, current mode: Abort
1130 cpsr: 0x00000097 pc: 0x00000010
1131 System and User mode registers
1132       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1133       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1134       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1135      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1136     cpsr: 00000097
1137
1138 FIQ mode shadow registers
1139   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1140  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1141
1142 Supervisor mode shadow registers
1143   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1144
1145 Abort mode shadow registers
1146   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1147
1148 IRQ mode shadow registers
1149   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1150
1151 Undefined instruction mode shadow registers
1152   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1153 > step;arm reg
1154 target state: halted
1155 target halted in ARM state due to single-step, current mode: Abort
1156 cpsr: 0x00000097 pc: 0x00000010
1157 System and User mode registers
1158       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1159       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1160       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1161      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1162     cpsr: 00000097
1163
1164 FIQ mode shadow registers
1165   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1166  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1167
1168 Supervisor mode shadow registers
1169   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1170
1171 Abort mode shadow registers
1172   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1173
1174 IRQ mode shadow registers
1175   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1176
1177 Undefined instruction mode shadow registers
1178   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1179 > step;arm reg
1180 target state: halted
1181 target halted in ARM state due to single-step, current mode: Abort
1182 cpsr: 0x00000097 pc: 0x00000010
1183 System and User mode registers
1184       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1185       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1186       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1187      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1188     cpsr: 00000097
1189
1190 FIQ mode shadow registers
1191   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1192  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1193
1194 Supervisor mode shadow registers
1195   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1196
1197 Abort mode shadow registers
1198   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1199
1200 IRQ mode shadow registers
1201   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1202
1203 Undefined instruction mode shadow registers
1204   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1205 > step;arm reg
1206 target state: halted
1207 target halted in ARM state due to single-step, current mode: Abort
1208 cpsr: 0x00000097 pc: 0x00000010
1209 System and User mode registers
1210       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1211       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1212       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1213      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1214     cpsr: 00000097
1215
1216 FIQ mode shadow registers
1217   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1218  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1219
1220 Supervisor mode shadow registers
1221   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1222
1223 Abort mode shadow registers
1224   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1225
1226 IRQ mode shadow registers
1227   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1228
1229 Undefined instruction mode shadow registers
1230   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1231 > step;arm reg
1232 target state: halted
1233 target halted in ARM state due to single-step, current mode: Abort
1234 cpsr: 0x00000097 pc: 0x00000010
1235 System and User mode registers
1236       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1237       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1238       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1239      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1240     cpsr: 00000097
1241
1242 FIQ mode shadow registers
1243   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1244  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1245
1246 Supervisor mode shadow registers
1247   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1248
1249 Abort mode shadow registers
1250   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1251
1252 IRQ mode shadow registers
1253   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1254
1255 Undefined instruction mode shadow registers
1256   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1257 > step;arm reg
1258 target state: halted
1259 target halted in ARM state due to single-step, current mode: Abort
1260 cpsr: 0x00000097 pc: 0x00000010
1261 System and User mode registers
1262       r0: 300000e3       r1: 00000000       r2: 00200000       r3: 00200a75
1263       r4: fffb0000       r5: 00000002       r6: 00000000       r7: 00200f6c
1264       r8: 00000000       r9: 00000000      r10: ffffffff      r11: 00000000
1265      r12: 00000009   sp_usr: 00000000   lr_usr: 00000000       pc: 00000010
1266     cpsr: 00000097
1267
1268 FIQ mode shadow registers
1269   r8_fiq: 00000000   r9_fiq: fffcc000  r10_fiq: fffff400  r11_fiq: fffff000
1270  r12_fiq: 00200f44   sp_fiq: 00000000   lr_fiq: 00000000 spsr_fiq: f00000fb
1271
1272 Supervisor mode shadow registers
1273   sp_svc: 00201f78   lr_svc: 00200a75 spsr_svc: 400000b3
1274
1275 Abort mode shadow registers
1276   sp_abt: 00000000   lr_abt: 00000108 spsr_abt: 00000093
1277
1278 IRQ mode shadow registers
1279   sp_irq: 00000000   lr_irq: 00000000 spsr_irq: f000003b
1280
1281 Undefined instruction mode shadow registers
1282   sp_und: 00000000   lr_und: 00000000 spsr_und: 300000df
1283 >
1284 */