From 72371a13fd3c0176b7ab3e232b1a379d0d1528cb Mon Sep 17 00:00:00 2001
From: sys64738 <sys64738@hellsite.site>
Date: Wed, 20 Apr 2022 00:21:22 +0200
Subject: [PATCH] rl78/g10,g1m,g1n stuff: impl sfp&ocd; also have different
 pinout configs

---
 CMakeLists.txt                           |   1 +
 src/bsp/breadboard.h                     |  34 ++
 src/bsp/pinout.h                         |  77 +++++
 src/cli/cli.c                            |   6 +
 src/cli/msp430.c                         |   2 +
 src/cli/rl78-glitch.c                    |  35 ++-
 src/cli/rl78.c                           | 184 ++++++++++-
 src/glitch/glitch.c                      |  19 +-
 src/msp430/pio_sbw.c                     |   2 +
 src/msp430/pio_sbw.h                     |   4 -
 src/swim/swim_hw.c                       |   5 +-
 src/test/piodump.c                       |   2 +-
 src/tool78/tool78.pio                    |  10 +-
 src/tool78/tool78_cmds.c                 | 379 +++++++++++++++++------
 src/tool78/tool78_cmds.h                 |   2 +-
 src/tool78/tool78_defs.h                 |  25 +-
 src/tool78/tool78_hw_78k0_spi.c          |   2 +
 src/tool78/tool78_hw_78k0_uart2.c        |   4 +-
 src/tool78/tool78_hw_78k0_uart2_extclk.c |   4 +-
 src/tool78/tool78_hw_78k0r_uart1.c       |   4 +-
 src/tool78/tool78_hw_helpers.c           |   2 +
 src/tool78/tool78_hw_rl78_uart1.c        |  22 +-
 src/tool78/tool78_hw_rl78_uart2.c        |   4 +-
 src/tool78/tool78_hw_test_uart2.c        |   4 +-
 src/zap/zap_crowbar.c                    |   3 +
 src/zap/zap_dac.c                        |   1 +
 src/zap/zap_dac.h                        |   1 +
 test/rl78g10/.gitignore                  |   7 +
 test/rl78g10/Makefile                    |  27 ++
 test/rl78g10/hw.S                        |  37 +++
 test/rl78g10/link-dbg.ld                 |  33 ++
 test/rl78g10/link-rom.ld                 | 166 ++++++++++
 test/rl78g10/romhdr.S                    |  35 +++
 test/rl78g10/test.S                      | 254 +++++++++++++++
 34 files changed, 1238 insertions(+), 159 deletions(-)
 create mode 100644 src/bsp/breadboard.h
 create mode 100644 src/bsp/pinout.h
 create mode 100644 test/rl78g10/.gitignore
 create mode 100644 test/rl78g10/Makefile
 create mode 100644 test/rl78g10/hw.S
 create mode 100644 test/rl78g10/link-dbg.ld
 create mode 100644 test/rl78g10/link-rom.ld
 create mode 100644 test/rl78g10/romhdr.S
 create mode 100644 test/rl78g10/test.S

diff --git a/CMakeLists.txt b/CMakeLists.txt
index d8cda2c..7ef1fb9 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -65,6 +65,7 @@ if(FAMILY STREQUAL "rp2040")
   # Example include
   target_include_directories(${PROJECT} PUBLIC
     ${CMAKE_CURRENT_SOURCE_DIR}/src/
+    ${CMAKE_CURRENT_SOURCE_DIR}/src/bsp/
     ${CMAKE_CURRENT_SOURCE_DIR}/src/msp430/
     ${CMAKE_CURRENT_SOURCE_DIR}/src/swim/
     ${CMAKE_CURRENT_SOURCE_DIR}/src/tool78/
diff --git a/src/bsp/breadboard.h b/src/bsp/breadboard.h
new file mode 100644
index 0000000..aae5e9c
--- /dev/null
+++ b/src/bsp/breadboard.h
@@ -0,0 +1,34 @@
+
+#ifndef BREADBOARD_H_
+#define BREADBOARD_H_
+
+#define BREADBOARD_TRIG_IN    14
+#define BREADBOARD_GLITCH_OUT 15
+
+#define BREADBOARD_SBW_PIO pio0
+#define BREADBOARD_SBW_TCK  8
+#define BREADBOARD_SBW_TDIO 9
+
+#define BREADBOARD_SWIM_PIO pio0
+#define BREADBOARD_SWIM_PIN 22
+
+#define BREADBOARD_TOOL78_PIO pio1
+
+#define BREADBOARD_TOOL78_nRESET      16
+
+#define BREADBOARD_TOOL78_78K0_FLMD0  17
+#define BREADBOARD_TOOL78_78K0_TXMOSI 18
+#define BREADBOARD_TOOL78_78K0_RXMISO 19
+#define BREADBOARD_TOOL78_78K0_CLOCK  20
+
+#define BREADBOARD_TOOL78_78K0R_FLMD0 17
+#define BREADBOARD_TOOL78_78K0R_TOOL0 18
+
+#define BREADBOARD_TOOL78_RL78_TOOL0  17
+#define BREADBOARD_TOOL78_RL78_TX     18
+#define BREADBOARD_TOOL78_RL78_RX     19
+
+inline static void breadboard_init(void) { }
+
+#endif
+
diff --git a/src/bsp/pinout.h b/src/bsp/pinout.h
new file mode 100644
index 0000000..9837c77
--- /dev/null
+++ b/src/bsp/pinout.h
@@ -0,0 +1,77 @@
+
+#ifndef PINOUT_H_
+#define PINOUT_H_
+
+#include "breadboard.h"
+#include "zap.h"
+
+#define PINOUT_USE_DRAGONZAP 1
+
+#if PINOUT_USE_DRAGONZAP
+
+#define TRIGGER_IN_PIN ZAP_TRIG_IN
+// use CROWBAR_1 / CROWBAR_2 / GLITCH_OUT to select glitching method
+#define GLITCH_OUT_PIN ZAP_CROWBAR_1
+
+#define PINOUT_SBW_PIO  BREADBOARD_SBW_PIO
+#define PINOUT_SBW_TCK  (ZAP_GPIO_BASE+0)
+#define PINOUT_SBW_TDIO (ZAP_GPIO_BASE+1)
+
+#define PINOUT_SWIM_PIO BREADBOARD_SWIM_PIO
+#define PINOUT_SWIM     ZAP_GPIO_BASE
+
+#define PINOUT_TOOL78_PIO BREADBOARD_TOOL78_PIO
+
+#define PINOUT_TOOL78_nRESET      (ZAP_GPIO_BASE+0)
+
+#define PINOUT_TOOL78_78K0_FLMD0  (ZAP_GPIO_BASE+1)
+#define PINOUT_TOOL78_78K0_TXMOSI (ZAP_GPIO_BASE+2)
+#define PINOUT_TOOL78_78K0_RXMISO (ZAP_GPIO_BASE+3)
+#define PINOUT_TOOL78_78K0_CLOCK  (ZAP_GPIO_BASE+4)
+
+#define PINOUT_TOOL78_78K0R_FLMD0 (ZAP_GPIO_BASE+1)
+#define PINOUT_TOOL78_78K0R_TOOL0 (ZAP_GPIO_BASE+2)
+
+#define PINOUT_TOOL78_RL78_TOOL0  (ZAP_GPIO_BASE+1)
+#define PINOUT_TOOL78_RL78_TX     (ZAP_GPIO_BASE+2)
+#define PINOUT_TOOL78_RL78_RX     (ZAP_GPIO_BASE+3)
+
+inline static void bsp_init_stuff(void) {
+	zap_init_default();
+}
+
+#else /***********************************************************************/
+
+#define TRIGGER_IN_PIN BREADBOARD_TRIG_IN
+#define GLITCH_OUT_PIN BREADBOARD_GLITCH_OUT
+
+#define PINOUT_SBW_PIO  BREADBOARD_SBW_PIO
+#define PINOUT_SBW_TCK  BREADBOARD_SBW_TCK
+#define PINOUT_SBW_TDIO BREADBOARD_SBW_TDIO
+
+#define PINOUT_SWIM_PIO BREADBOARD_SWIM_PIO
+#define PINOUT_SWIM     BREADBOARD_SWIM_PIN
+
+#define PINOUT_TOOL78_PIO BREADBOARD_TOOL78_PIO
+
+#define PINOUT_TOOL78_nRESET      BREADBOARD_TOOL78_nRESET
+
+#define PINOUT_TOOL78_78K0_FLMD0  BREADBOARD_TOOL78_78K0_FLMD0
+#define PINOUT_TOOL78_78K0_TXMOSI BREADBOARD_TOOL78_78K0_TXMOSI
+#define PINOUT_TOOL78_78K0_RXMISO BREADBOARD_TOOL78_78K0_RXMISO
+#define PINOUT_TOOL78_78K0_CLOCK  BREADBOARD_TOOL78_78K0_CLOCK
+
+#define PINOUT_TOOL78_78K0R_FLMD0 BREADBOARD_TOOL78_78K0R_FLMD0
+#define PINOUT_TOOL78_78K0R_TOOL0 BREADBOARD_TOOL78_78K0R_TOOL0
+
+#define PINOUT_TOOL78_RL78_TOOL0  BREADBOARD_TOOL78_RL78_TOOL0
+#define PINOUT_TOOL78_RL78_TX     BREADBOARD_TOOL78_RL78_TX
+#define PINOUT_TOOL78_RL78_RX     BREADBOARD_TOOL78_RL78_RX
+
+inline static void bsp_init_stuff(void) {
+	breadboard_init();
+}
+
+#endif
+
+#endif
diff --git a/src/cli/cli.c b/src/cli/cli.c
index 53905cc..d530a7b 100644
--- a/src/cli/cli.c
+++ b/src/cli/cli.c
@@ -12,6 +12,7 @@
 #include <pico/stdio_usb.h>
 #include <pico/binary_info.h>
 
+#include "pinout.h"
 
 #include "cli.h"
 
@@ -28,6 +29,8 @@ void cli_msp430_flash(void);
 void cli_tool78_testtest(void);
 void cli_tool78_prototest(void);
 void cli_tool78_ocdtest(void);
+void cli_tool78_g10_prototest(void);
+void cli_tool78_g10_ocdtest(void);
 
 void cli_tool78_glitch_dump(void);
 void cli_tool78_glitch_paramsearch(void);
@@ -71,6 +74,8 @@ static struct cli_cmd cmds[] = {
 	{ "rl78phy", cli_tool78_testtest },
 	{ "rl78sfp", cli_tool78_prototest },
 	{ "rl78ocd", cli_tool78_ocdtest },
+	{ "rl10sfp", cli_tool78_g10_prototest },
+	{ "rl10ocd", cli_tool78_g10_ocdtest },
 
 	{ "g78dump", cli_tool78_glitch_dump },
 	{ "g78param", cli_tool78_glitch_paramsearch },
@@ -83,6 +88,7 @@ static struct cli_cmd cmds[] = {
 
 void cli_init(void) {
 	stdio_usb_init();
+	bsp_init_stuff();
 	while (!stdio_usb_connected()) ;
 	printf("Hi! Run a command, or 'help' for help.\n");
 }
diff --git a/src/cli/msp430.c b/src/cli/msp430.c
index 5031c8b..8dcca74 100644
--- a/src/cli/msp430.c
+++ b/src/cli/msp430.c
@@ -5,6 +5,8 @@
 #include <hardware/gpio.h>
 #include <pico/stdlib.h>
 
+#include "pinout.h"
+
 #include "pio_sbw.h"
 #include "tap.h"
 #include "msp430dbg.h"
diff --git a/src/cli/rl78-glitch.c b/src/cli/rl78-glitch.c
index 58a9e82..1ee3186 100644
--- a/src/cli/rl78-glitch.c
+++ b/src/cli/rl78-glitch.c
@@ -9,19 +9,18 @@
 #include <pico/stdlib.h>
 #include <pico/binary_info.h>
 
+#include "pinout.h"
+
 #include "tool78_hw.h"
 #include "tool78_cmds.h"
 #include "glitch.h"
 
-#define TRIGGER_IN_PIN (14/*-1*/)
-#define GLITCH_OUT_PIN 15
-
 void cli_tool78_glitch_dump(void);
 void cli_tool78_glitch_paramsearch(void);
 void cli_tool78_glitch_ocd_dump(void);
 
 #define DUMP_OFFSET 0/*0xef000*/
-#define DUMP_SIZE 65536
+#define DUMP_SIZE 1024/*65536*/
 
 // test with decoupling caps: length in 20..500(..1500) -> ok
 // testing on ocd lock: length: 5..35
@@ -46,12 +45,17 @@ static uint8_t databuf[DUMP_SIZE];
 static struct glitch_param_randrange offset;
 static struct glitch_param_adc length;
 
-static void glitch_init_core1_stuff(bool exttrig) {
+static bool glitch_init_core1_stuff(bool exttrig) {
 	offset.min = 10*1000;
 	offset.max = 35433*1000;
-	length.min = 10;
-	length.max = 10*1000;
+	length.min = 100;
+	length.max = 50/*26*/*1000;
+#if PINOUT_USE_DRAGONZAP
+	length.adc_index = 0;//999;
+#else
+#error "a"
 	length.adc_index = 999;
+#endif
 
 	glitch_param_randrange_init(&offset);
 	glitch_param_adc_init(&length);
@@ -91,7 +95,7 @@ static void glitch_init_core1_stuff(bool exttrig) {
 		.getter = glitch_param_adc_fn
 	};
 	gparam.trigger_in_pin = exttrig ? TRIGGER_IN_PIN : (-1);
-	glitch_ready(&gparam);
+	return glitch_ready(&gparam);
 }
 static void glitch_init_pwm_stuff(void) {
 	const float dutycycle = (2.1f + 0.00f) / 3.3f + 0.0125f;//25f /* calibration (more) */;
@@ -202,7 +206,10 @@ deinit_bad:
 }
 
 void cli_tool78_glitch_paramsearch(void) {
-	glitch_init_core1_stuff(true);
+	if (!glitch_init_core1_stuff(true)) {
+		printf("bad glitcher params!\n");
+		while (1) asm volatile("");
+	}
 
 	uint8_t passwd[10] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
 	uint16_t ver;
@@ -354,7 +361,10 @@ do_reset_stuff:
 }
 
 void cli_tool78_glitch_ocd_dump(void) {
-	glitch_init_core1_stuff(false);
+	if (!glitch_init_core1_stuff(false)) {
+		printf("bad glitcher params!\n");
+		while (1) asm volatile("");
+	}
 
 	gpio_set_function(2, GPIO_FUNC_SIO);
 	gpio_set_dir(2, GPIO_OUT);
@@ -416,7 +426,8 @@ restart:
 	//tool78_hw_rl78_uart1.rx_set_stop_bit(false);
 	glitch_arm();
 	for (size_t i = 0; i < 16; ++i) {
-		glitch_trigger_sw_core1();
+		//glitch_trigger_sw_core1();
+		glitch_trigger_sw_pio();
 		rr = tool78_hw_rl78_uart1.recv(1, checkbuf, 12*1000);
 		if (rr != 1) {
 			busy_wait_ms(1); // leave time to recharge
@@ -468,7 +479,7 @@ success:;
 	}
 	printf("got ver! %04x\n", ver);
 
-	printf("glitch len: %lu us\n", *(volatile uint32_t*)&glitch_param_cur.length_ns.cur);
+	printf("glitch len: %lu ns\n", *(volatile uint32_t*)&glitch_param_cur.length_ns.cur);
 	/*goto do_reset_stuff;*/
 
 	st = tool78_ocd_connect(&tool78_hw_rl78_uart1, passwd);
diff --git a/src/cli/rl78.c b/src/cli/rl78.c
index 5468bbc..5760e52 100644
--- a/src/cli/rl78.c
+++ b/src/cli/rl78.c
@@ -1,6 +1,7 @@
 
 #include <stdio.h>
 #include <string.h>
+#include <pico/time.h>
 
 #include "tool78_hw.h"
 #include "tool78_cmds.h"
@@ -10,10 +11,15 @@
 void cli_tool78_testtest(void);
 void cli_tool78_prototest(void);
 void cli_tool78_ocdtest(void);
+void cli_tool78_g10_prototest(void);
+void cli_tool78_g10_ocdtest(void);
 
 static uint8_t DATA_main_dbgpad[1024];
 static uint8_t DATA_main_nodbg [1024];
 
+static uint8_t DATA_G1M_dbgpad[];
+static uint8_t DATA_G1M_nodbg [];
+
 static uint8_t shellcode_test[] = {
 	0x51, 0x61,             // mov a, #'a'
 	0xfc, 0xa1, 0xff, 0x0e, // call !!effa1
@@ -60,7 +66,7 @@ void cli_tool78_prototest(void) {
 
 	tool78_silicon_sig_t sig;
 	memset(&sig, 0, sizeof sig);
-	enum tool78_stat st = tool78_init_sfp(&tool78_hw_rl78_uart1, &sig);
+	enum tool78_stat st = tool78_init_sfp(hw, &sig);
 	printf("result: 0x%02x. sig:\n", st);
 	for (size_t i = 0; i < sizeof(struct tool78_silicon_sig_rl78); ++i)
 		printf("0x%02x ", ((const uint8_t*)&sig)[i]);
@@ -89,11 +95,11 @@ sec: flg=fe bot=03  fsws=0000 fswe=003f
 	// NOTE: RL78 ONLY
 	struct tool78_security sec;
 	memset(&sec, 0, sizeof sec);
-	st = tool78_do_security_get(&tool78_hw_rl78_uart1, &sec);
+	st = tool78_do_security_get(hw, &sec);
 	printf("secget: 0x%02x\n", st);
 	printf("sec: flg=%02x bot=%02x  fsws=%04x fswe=%04x\n", sec.flg, sec.bot, sec.fsws, sec.fswe);
 
-	/*//st = tool78_do_security_release(&tool78_hw_rl78_uart1);
+	//st = tool78_do_security_release(&tool78_hw_rl78_uart1);
 	//printf("sec rel: 0x%02x\n", st);
 	// one block = 0x400 = 1k
 	st = tool78_do_block_erase(hw, 0, -1);
@@ -104,14 +110,14 @@ sec: flg=fe bot=03  fsws=0000 fswe=003f
 	printf("programming: 0x%02x\n", st);
 
 	st = tool78_do_verify(hw, 0, 0x3ff, datatoflash);
-	printf("verify: 0x%02x\n", st);*/
+	printf("verify: 0x%02x\n", st);
 
 	/*for (size_t iii = 0; iii < 65536; iii += 0x400) {
 		st = tool78_do_verify(hw, iii+0, iii+0x3ff, &DATA_wfum_flash[iii]);
 		printf("verify 0x%04zx: 0x%02x\n", iii, st);
 	}*/
 
-	tool78_hw_rl78_uart1.deinit();
+	hw->deinit();
 }
 
 void cli_tool78_ocdtest(void) {
@@ -170,6 +176,48 @@ deinit_bad:
 	return;
 }
 
+void cli_tool78_g10_prototest(void) {
+	struct tool78_hw* hw = &tool78_hw_rl78g10_uart1;
+
+	enum tool78_stat st = tool78_init_sfp(hw, NULL);
+	printf("init: %02x\n", st);
+
+	const uint8_t* datatoflash = false ? DATA_G1M_nodbg : DATA_G1M_dbgpad;
+
+	enum tool78_g10_flash_size fsz = 0x1f;
+	st = tool78_do_g10_get_flash_size(hw, &fsz);
+	printf("get flash size: stat %02x size %02x\n", st, fsz);
+
+	hw->deinit();
+	st = tool78_init_sfp(hw, NULL);
+
+	uint16_t crc=0;
+	st = tool78_do_g10_check_crc(hw, fsz, &crc);
+	printf("get crc: stat %02x crc %04x\n", st, crc);
+
+	hw->deinit();
+	/*st = tool78_init_sfp(hw, NULL);
+
+	st = tool78_do_g10_erase_then_write(hw, fsz, datatoflash, 768);
+	printf("erase-then-write: stat %02x\n", st);
+
+	hw->deinit();*/
+}
+void cli_tool78_g10_ocdtest(void) {
+	uint8_t passwd[10] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+	struct tool78_hw* hw = &tool78_hw_rl78g10_uart1;
+
+	int st = tool78_init_ocd(hw, NULL, passwd);
+	printf("init: %02x\n", st);
+
+	uint8_t val = 0;
+	st = tool78_ocd_read(hw, 0x0080, 1, &val);
+	printf("read: st=%d val=%02x\n", st, val);
+
+	hw->deinit();
+}
+
+
 static uint8_t DATA_main_dbgpad[1024] = {
     0xda, 0x00, 0x00, 0x00, 0x43, 0x01, 0x4f, 0x01, 0x5b, 0x01, 0x67, 0x01, 0x73,
     0x01, 0x7f, 0x01, 0x8b, 0x01, 0x97, 0x01, 0xa3, 0x01, 0xaf, 0x01, 0xbb, 0x01,
@@ -334,3 +382,129 @@ static uint8_t DATA_main_nodbg[1024] = {
     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
 };
 
+static uint8_t DATA_G1M_dbgpad[768] = {
+    0xce, 0x00, 0xff, 0xff, 0xce, 0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xee, 0xf7, 0xfd,
+    0x85, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xcb, 0xf8,
+    0xd0, 0xfe, 0xfd, 0x29, 0x02, 0xfd, 0x42, 0x02, 0xfd, 0x16, 0x01, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0xd7, 0x71, 0x0b, 0x00, 0xfd, 0xdb, 0x00, 0x52, 0x08, 0x31, 0x05, 0x07,
+    0x00, 0x00, 0x71, 0x0a, 0x00, 0xef, 0x06, 0x71, 0x0b, 0x00, 0x00, 0x00, 0x00,
+    0xfd, 0xea, 0x00, 0x31, 0x1a, 0x92, 0xdf, 0xe8, 0x71, 0x0a, 0x00, 0xfd, 0xdb,
+    0x00, 0xfd, 0xdb, 0x00, 0xd7, 0x71, 0x0a, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb,
+    0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00,
+    0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd,
+    0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb,
+    0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00,
+    0xfd, 0xdb, 0x00, 0x41, 0x0e, 0x52, 0x00, 0x36, 0x00, 0xfe, 0x11, 0x8b, 0xc1,
+    0xc3, 0xfd, 0xec, 0x00, 0xc2, 0xc0, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd,
+    0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb,
+    0x00, 0xa7, 0x92, 0xd2, 0xdf, 0xdd, 0x52, 0x00, 0x11, 0x8b, 0xc1, 0xc3, 0xfd,
+    0xec, 0x00, 0xc2, 0xc0, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00,
+    0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xa7,
+    0x92, 0xd2, 0xdf, 0xdd, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00,
+    0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd,
+    0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb,
+    0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00,
+    0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0x51,
+    0x45, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0x51, 0x4e, 0xfd, 0xdb, 0x00, 0xfd,
+    0xdb, 0x00, 0x51, 0x44, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0x51, 0x20, 0xfd,
+    0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xed, 0x55, 0x01, 0x51, 0x20, 0xfd, 0xec, 0x00,
+    0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd,
+    0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb,
+    0x00, 0xfd, 0xdb, 0x00, 0xed, 0x55, 0x01, 0xcf, 0x77, 0x00, 0x00, 0xcf, 0x00,
+    0xff, 0x00, 0xcf, 0x30, 0x00, 0x00, 0xcf, 0x50, 0x00, 0x00, 0xcf, 0x60, 0x00,
+    0x7f, 0xcf, 0x20, 0xff, 0x00, 0xd7, 0xcf, 0xf0, 0x00, 0xe5, 0xcf, 0xf3, 0x00,
+    0x10, 0xd7, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff
+};
+
+static uint8_t DATA_G1M_nodbg[768] = {
+    0xce, 0x00, 0xff, 0xff, 0xce, 0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xee, 0xf7, 0xfd,
+    0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xcb, 0xf8,
+    0xd0, 0xfe, 0xfd, 0x29, 0x02, 0xfd, 0x42, 0x02, 0xfd, 0x16, 0x01, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0xd7, 0x71, 0x0b, 0x00, 0xfd, 0xdb, 0x00, 0x52, 0x08, 0x31, 0x05, 0x07,
+    0x00, 0x00, 0x71, 0x0a, 0x00, 0xef, 0x06, 0x71, 0x0b, 0x00, 0x00, 0x00, 0x00,
+    0xfd, 0xea, 0x00, 0x31, 0x1a, 0x92, 0xdf, 0xe8, 0x71, 0x0a, 0x00, 0xfd, 0xdb,
+    0x00, 0xfd, 0xdb, 0x00, 0xd7, 0x71, 0x0a, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb,
+    0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00,
+    0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd,
+    0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb,
+    0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00,
+    0xfd, 0xdb, 0x00, 0x41, 0x0e, 0x52, 0x00, 0x36, 0x00, 0xfe, 0x11, 0x8b, 0xc1,
+    0xc3, 0xfd, 0xec, 0x00, 0xc2, 0xc0, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd,
+    0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb,
+    0x00, 0xa7, 0x92, 0xd2, 0xdf, 0xdd, 0x52, 0x00, 0x11, 0x8b, 0xc1, 0xc3, 0xfd,
+    0xec, 0x00, 0xc2, 0xc0, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00,
+    0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xa7,
+    0x92, 0xd2, 0xdf, 0xdd, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00,
+    0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd,
+    0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb,
+    0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00,
+    0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0x51,
+    0x45, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0x51, 0x4e, 0xfd, 0xdb, 0x00, 0xfd,
+    0xdb, 0x00, 0x51, 0x44, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0x51, 0x20, 0xfd,
+    0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xed, 0x55, 0x01, 0x51, 0x20, 0xfd, 0xec, 0x00,
+    0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd,
+    0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb, 0x00, 0xfd, 0xdb,
+    0x00, 0xfd, 0xdb, 0x00, 0xed, 0x55, 0x01, 0xcf, 0x77, 0x00, 0x00, 0xcf, 0x00,
+    0xff, 0x00, 0xcf, 0x30, 0x00, 0x00, 0xcf, 0x50, 0x00, 0x00, 0xcf, 0x60, 0x00,
+    0x7f, 0xcf, 0x20, 0xff, 0x00, 0xd7, 0xcf, 0xf0, 0x00, 0xe5, 0xcf, 0xf3, 0x00,
+    0x10, 0xd7, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff
+};
+
diff --git a/src/glitch/glitch.c b/src/glitch/glitch.c
index 9007666..0f2c750 100644
--- a/src/glitch/glitch.c
+++ b/src/glitch/glitch.c
@@ -127,6 +127,7 @@ static void CORE1_FUNC(glitch_core1_thread_core1_fifoirq)(void) {
 		CORE1_DO_GLITCH();
 		multicore_fifo_drain();
 		multicore_fifo_clear_irq();
+		gpio_put(25, true);
 	continue_:
 		irq_set_enabled(irq, true);
 	}
@@ -185,6 +186,7 @@ static void CORE1_FUNC(glitch_core1_thread_pio)(void) {
 
 		trigctl_wait_glitch_irq(trigctl_pio, trigctl_sm, true);
 		trigctl_ack_glitch_irq(trigctl_pio, trigctl_sm);
+		gpio_put(25, true);
 	}
 }
 
@@ -252,6 +254,13 @@ static void CORE0_FUNC(glitch_stop_no_clock_chg)(void) {
 }
 
 bool CORE0_FUNC(glitch_ready)(const struct glitch_params* params) {
+	/*printf("params: off = %p %p ; len = %p %p\n",
+			params->offset_ns.getter, params->offset_ns.ud,
+			params->length_ns.getter, params->length_ns.ud);
+	printf("trigger in = %d pol %d ; glitch out = %d pol %d\n",
+			params->trigger_in_pin, params->trigger_in_polarity,
+			params->glitch_out_pin, params->glitch_out_polarity);
+	printf("impl: %d\n", params->impl);*/
 	// check params values
 	if (!params->offset_ns.getter || !params->offset_ns.ud) return false;
 	if (!params->length_ns.getter || !params->length_ns.ud) return false;
@@ -271,7 +280,10 @@ bool CORE0_FUNC(glitch_ready)(const struct glitch_params* params) {
 	int r = 0x99990;
 	if (params->impl == glitch_impl_pio) {
 		r = trigctl_pio_can_init();
-		if (r < 0) return false;
+		if (r < 0) {
+			printf("no pio!\n");
+			return false;
+		}
 	}
 
 	glitch_stop();
@@ -281,6 +293,10 @@ bool CORE0_FUNC(glitch_ready)(const struct glitch_params* params) {
 	param_cur.length_ns.cur = 0;
 	param_cur.armed = false;
 
+	gpio_init(25);
+	gpio_set_dir(25, GPIO_OUT);
+	gpio_put(25, false);
+
 	// let's not care about impl and always use core1 for now
 	// TODO: if pio: check SM availability etc (& clear param_cur if fails)
 
@@ -356,6 +372,7 @@ bool CORE0_FUNC(glitch_ready)(const struct glitch_params* params) {
 			: GPIO_OVERRIDE_NORMAL) << IO_BANK0_GPIO0_CTRL_OUTOVER_LSB)
 		, IO_BANK0_GPIO0_CTRL_FUNCSEL_BITS | IO_BANK0_GPIO0_CTRL_OUTOVER_BITS
 	);
+	printf("glitch out init: func %d on pin %d\n", func, param_cur.glitch_out_pin);
 
 	multicore_launch_core1(glitch_core1_thread);
 
diff --git a/src/msp430/pio_sbw.c b/src/msp430/pio_sbw.c
index 34b3291..a206efc 100644
--- a/src/msp430/pio_sbw.c
+++ b/src/msp430/pio_sbw.c
@@ -8,6 +8,8 @@
 #include <hardware/pio_instructions.h>
 #include <hardware/timer.h>
 
+#include "pinout.h"
+
 #include "pio_sbw.h"
 
 #include "sbw.pio.h"
diff --git a/src/msp430/pio_sbw.h b/src/msp430/pio_sbw.h
index 36ce0a4..bb1939a 100644
--- a/src/msp430/pio_sbw.h
+++ b/src/msp430/pio_sbw.h
@@ -10,10 +10,6 @@
 #include <stdbool.h>
 /*#include <hardware/pio.h>*/
 
-#define PINOUT_SBW_PIO pio0
-#define PINOUT_SBW_TCK  8
-#define PINOUT_SBW_TDIO 9
-
 extern int sbw_piosm, sbw_offset;
 
 // does the debug handshake/SBW setup thingy, call before sbw_init()
diff --git a/src/swim/swim_hw.c b/src/swim/swim_hw.c
index c553420..0722ec5 100644
--- a/src/swim/swim_hw.c
+++ b/src/swim/swim_hw.c
@@ -4,13 +4,12 @@
 #include <hardware/pio.h>
 #include <hardware/timer.h>
 
+#include "pinout.h"
+
 #include "swim_hw.h"
 
 #include "swim.pio.h"
 
-#define PINOUT_SWIM_PIO pio0
-#define PINOUT_SWIM     22
-
 int swim_tx_sm = -1, swim_rx_sm = -1, swim_tx_off = -1, swim_rx_off = -1;
 
 void swim_preinit(void) {
diff --git a/src/test/piodump.c b/src/test/piodump.c
index 19eb508..2758bc9 100644
--- a/src/test/piodump.c
+++ b/src/test/piodump.c
@@ -109,7 +109,7 @@ void piodump_main(void) {
 
 	uint16_t stuff[32];
 	for (uint32_t i = 0; i < 32; ++i) {
-		stuff[i] = /*pio_get_one*/pio_read_one(PINOUT_SBW_PIO, (uint)sbw_piosm, i, 8);
+		stuff[i] = /*pio_get_one*/pio_read_one(pio0, (uint)sbw_piosm, i, 8);
 		bool good = stuff[i] == sbw_program_instructions[i];
 		printf("PIO_INSN[0x%02lx] = 0x%04x (%s)\n", i, stuff[i],
 				good ? "correct" : "wrong");
diff --git a/src/tool78/tool78.pio b/src/tool78/tool78.pio
index 03d9d8c..8506832 100644
--- a/src/tool78/tool78.pio
+++ b/src/tool78/tool78.pio
@@ -107,7 +107,7 @@ public stop_ok:
 % c-sdk {
 
 static inline void tool78_uart_rx_program_init(PIO pio, uint sm, uint offset,
-		uint pin, uint baudrate, bool en) {
+		uint pin, uint baudrate, bool en, bool check_stop_bit) {
 	//const int PIN_DBG = 4;
 
 	pio_sm_set_consecutive_pindirs(pio, sm, pin, 1, false); // pin is input now
@@ -117,6 +117,14 @@ static inline void tool78_uart_rx_program_init(PIO pio, uint sm, uint offset,
 	//pio_sm_set_consecutive_pindirs(pio, sm, PIN_DBG, 1, true);
 	//pio_gpio_init(pio, PIN_DBG);
 
+	if (!check_stop_bit) {
+		pio->instr_mem[offset + tool78_uart_rx_offset_stopbit_magic]
+			= pio_encode_jmp(offset + tool78_uart_rx_offset_stop_ok);
+	} else {
+		pio->instr_mem[offset + tool78_uart_rx_offset_stopbit_magic]
+			= pio_encode_jmp_pin(offset + tool78_uart_rx_offset_stop_ok);
+	}
+
 	pio_sm_config c = tool78_uart_rx_program_get_default_config(offset);
 	sm_config_set_in_pins(&c, pin);
 	sm_config_set_jmp_pin(&c, pin);
diff --git a/src/tool78/tool78_cmds.c b/src/tool78/tool78_cmds.c
index 059afb4..3280dbd 100644
--- a/src/tool78/tool78_cmds.c
+++ b/src/tool78/tool78_cmds.c
@@ -105,13 +105,13 @@ static const struct delayvalues delays[23] = {
 #define tG23 (1000*1000) /* RL78/G23 datasheet just says "everything 1ms lol" */
 
 // G10 proto
-#define tDTR 1
-#define tDRT 1
+#define tDTR (3*1000)
+#define tDRT    20
 #define tCRC  1000
 #define tPRO  1000
 #define tVER 20000
 #define tERA (350*1000)
-#define tDT  1
+#define tDT      1
 /*#define tDR  1*/
 
 
@@ -917,26 +917,28 @@ enum tool78_stat tool78_do_g10_get_flash_size(struct tool78_hw* hw,
 	busy_wait_us_32(tDTR);
 
 	// start crc calc cmd
-	uint8_t data[2];
+	uint8_t data[3];
 	data[0] = tool78_cmd_crc_check;
 	int rr = hw->send(1, data, -1);
 	if (rr != 1) return tool78_stat_internal_error;
 
-	enum tool78_stat st = tool78_data_recv(hw, data, 2, tDT+tDRT);
-	if (st != tool78_stat_ack) return st;
+	data[1] = data[2] = 0;
+	rr = hw->recv(3, data, (tDT+tDRT)*100); // cmd is echoed back
+	//printf("gfsz rr=%d data=%02x %02x %02x\n", rr, data[0], data[1], data[2]);
+	if (rr != 3) return tool78_stat_timeout_error;
+	if (data[1] != tool78_stat_ack) return data[1];
 
-	if (data[0] != tool78_stat_ack) return data[0];
-
-	*fsz = data[1];
+	*fsz = data[2];
 
 	busy_wait_us_32(tDTR);
 	data[0] = tool78_stat_nak; // should send ack here, but send nak to stop crc calc
 	rr = hw->send(1, data, -1);
+	//printf("send nak: rr=%d data=%02x\n", rr, data[0]);
 	if (rr != 1) return tool78_stat_internal_error;
 
-	/*st =*/ tool78_data_recv(hw, data, 1, tCRC);
-	// ignore status of this stuff
-	//if (st != tool78_stat_ack) return st;
+	rr = hw->recv(3, data, tCRC);
+	//printf("recv rr=%d data=%02x %02x %02x\n", rr, data[0], data[1], data[2]);
+	// should answer with 0x04 but let's not care here
 
 	return tool78_stat_ack;
 }
@@ -944,25 +946,23 @@ enum tool78_stat tool78_do_g10_check_crc(struct tool78_hw* hw,
 		enum tool78_g10_flash_size fsz, uint16_t* crc) {
 	busy_wait_us_32(tDTR);
 
-	uint8_t data[2];
+	uint8_t data[3];
 	data[0] = tool78_cmd_crc_check;
 	int rr = hw->send(1, data, -1);
 	if (rr != 1) return tool78_stat_internal_error;
 
-	enum tool78_stat st = tool78_data_recv(hw, data, 2, tDT+tDRT);
-	if (st != tool78_stat_ack) return st;
-
-	if (data[0] != tool78_stat_ack) return data[0];
+	rr = hw->recv(3, data, (tDT+tDRT)*100);
+	if (rr != 3) return tool78_stat_timeout_error;
+	if (data[1] != tool78_stat_ack) return data[1];
 
 	busy_wait_us_32(tDTR);
-	if (data[1] != fsz) {
+	if (data[2] != fsz) {
 		data[0] = tool78_stat_nak; // should send ack here, but send nak to stop crc calc
 		rr = hw->send(1, data, -1);
 		if (rr != 1) return tool78_stat_internal_error;
 
-		/*st =*/ tool78_data_recv(hw, data, 1, tCRC);
-		// ignore status of this stuff
-		//if (st != tool78_stat_ack) return st;
+		rr = hw->recv(3, data, tCRC);
+		// should answer with 0x04 but let's not care here
 
 		return tool78_stat_bad_flash_size;
 	} else {
@@ -970,13 +970,26 @@ enum tool78_stat tool78_do_g10_check_crc(struct tool78_hw* hw,
 		rr = hw->send(1, data, -1);
 		if (rr != 1) return tool78_stat_internal_error;
 
-		st = tool78_data_recv(hw, data, 1, tCRC);
-		if (st != tool78_stat_ack) return st;
-		st = data[0];
+		rr = hw->recv(2, data, tCRC*2);
+		if (rr != 2) return tool78_stat_timeout_error;
+		if (data[0] == 0xff) { // framing error bullshit
+			data[0] = data[1];
+			rr = hw->recv(1, &data[1], tCRC);
+			if (rr != 1) return tool78_stat_timeout_error;
+		}
+		//printf("recv1 rr=%d data=%02x %02x\n", rr, data[0], data[1]);
+		enum tool78_stat st = data[1];
 		if (st != tool78_stat_ack) return st;
 
-		st = tool78_data_recv(hw, data, 2, tDT*2);
-		if (st != tool78_stat_ack) return st;
+		rr = hw->recv(2, data, tDT*1000);
+		//printf("recv2 rr=%d data=%02x %02x %02x\n", rr, data[0], data[1], data[2]);
+		if (rr != 2) return tool78_stat_timeout_error;
+		if (data[0] == 0xff) {
+			data[0] = data[1];
+			rr = hw->recv(1, &data[1], tDT*500);
+			if (rr != 1) return tool78_stat_timeout_error;
+		}
+		//printf("recv2 rr=%d data=%02x %02x %02x\n", rr, data[0], data[1], data[2]);
 
 		*crc = data[0] | ((uint16_t)data[1] << 8);
 
@@ -984,28 +997,27 @@ enum tool78_stat tool78_do_g10_check_crc(struct tool78_hw* hw,
 	}
 }
 enum tool78_stat tool78_do_g10_erase_then_write(struct tool78_hw* hw,
-		enum tool78_g10_flash_size fsz, const uint8_t* data_to_wr) {
+		enum tool78_g10_flash_size fsz, const uint8_t* data_to_wr, size_t datalen) {
 	busy_wait_us_32(tDTR);
 
-	uint8_t data[4];
+	uint8_t data[5];
 	data[0] = tool78_cmd_write_after_erase;
 	int rr = hw->send(1, data, -1);
 	if (rr != 1) return tool78_stat_internal_error;
 
-	enum tool78_stat st = tool78_data_recv(hw, data, 2, tDT+tDRT);
-	if (st != tool78_stat_ack) return st;
-
-	if (data[0] != tool78_stat_ack) return data[0];
+	rr = hw->recv(3, data, (tDT+tDRT)*100);
+	printf("recv1 rr=%d data=%02x %02x %02x\n", rr, data[0], data[1], data[2]);
+	if (rr != 3) return tool78_stat_timeout_error;
+	if (data[1] != tool78_stat_ack) return data[1];
 
 	busy_wait_us_32(tDTR);
-	if (data[1] != fsz) {
+	if (data[2] != fsz) {
 		data[0] = tool78_stat_nak; // should send ack here, but send nak to stop crc calc
 		rr = hw->send(1, data, -1);
 		if (rr != 1) return tool78_stat_internal_error;
 
-		/*st =*/ tool78_data_recv(hw, data, 1, tERA);
-		// ignore status of this stuff
-		//if (st != tool78_stat_ack) return st;
+		rr = hw->recv(3, data, tERA);
+		// should answer with 0x04 but let's not care here
 
 		return tool78_stat_bad_flash_size;
 	} else {
@@ -1013,41 +1025,59 @@ enum tool78_stat tool78_do_g10_erase_then_write(struct tool78_hw* hw,
 		rr = hw->send(1, data, -1);
 		if (rr != 1) return tool78_stat_internal_error;
 
-		st = tool78_data_recv(hw, data, 1, tERA);
-		if (st != tool78_stat_ack) return st;
-		st = data[0];
+		rr = hw->recv(2, data, tERA);
+		if (rr != 2) return tool78_stat_timeout_error;
+		if (data[0] == 0xff) { // framing error bullshit
+			data[0] = data[1];
+			rr = hw->recv(1, &data[1], tERA);
+			if (rr != 1) return tool78_stat_timeout_error;
+		}
+		printf("recv2 rr=%d data=%02x %02x\n", rr, data[0], data[1]);
+		enum tool78_stat st = data[1];
 		if (st != tool78_stat_ack) return st;
 
 		size_t flash_sz = (fsz + 1) * 256;
 		for (size_t i = 0; i < flash_sz; i += 4) {
+			data[0] = ((i+0) < datalen) ? data_to_wr[i+0] : 0xff;
+			data[1] = ((i+1) < datalen) ? data_to_wr[i+1] : 0xff;
+			data[2] = ((i+2) < datalen) ? data_to_wr[i+2] : 0xff;
+			data[3] = ((i+3) < datalen) ? data_to_wr[i+3] : 0xff;
+
 			busy_wait_us_32(tDTR);
-			rr = hw->send(1, &data_to_wr[i+0], -1);
+			rr = hw->send(1, &data[0], -1);
 			if (rr != 1) return tool78_stat_internal_error;
-			busy_wait_us_32(tDRT);
-			rr = hw->send(1, &data_to_wr[i+1], -1);
+			busy_wait_us_32(tDRT*20);
+			rr = hw->send(1, &data[1], -1);
 			if (rr != 1) return tool78_stat_internal_error;
-			busy_wait_us_32(tDRT);
-			rr = hw->send(1, &data_to_wr[i+2], -1);
+			busy_wait_us_32(tDRT*20);
+			rr = hw->send(1, &data[2], -1);
 			if (rr != 1) return tool78_stat_internal_error;
-			busy_wait_us_32(tDRT);
-			rr = hw->send(1, &data_to_wr[i+3], -1);
+			busy_wait_us_32(tDRT*20);
+			rr = hw->send(1, &data[3], -1);
 			if (rr != 1) return tool78_stat_internal_error;
 
-			st = tool78_data_recv(hw, data, 1, tPRO);
-			if (st != tool78_stat_ack) return st;
-			st = data[0];
+			rr = hw->recv(5, data, tPRO);
+			printf("recv3 i=%04zx rr=%d data=%02x %02x %02x %02x %02x\n", i, rr, data[0],
+					data[1], data[2], data[3], data[4]);
+			if (rr != 5) return tool78_stat_timeout_error;
+			st = data[4];
 			if (st != tool78_stat_ack) return st;
 		}
 
-		st = tool78_data_recv(hw, data, 1, tVER);
-		if (st != tool78_stat_ack) return st;
+		rr = hw->recv(2, data, tVER*100);
+		printf("recv4 rr=%d data=%02x %02x\n", rr, data[0], data[1]);
+		if (rr != 2) return tool78_stat_timeout_error;
+		st = data[1];
 
-		return tool78_stat_ack;
+		return st;
 	}
 }
 // ----
 
 int tool78_ocd_version(struct tool78_hw* hw, uint16_t* ver) {
+	bool is_g10 = (hw->target & tool78_mcu_mask) == tool78_mcu_rl78g10;
+	if (is_g10) return -5;
+
 	busy_wait_ms(1);
 
 	uint8_t bytes[3];
@@ -1075,8 +1105,9 @@ int tool78_ocd_version(struct tool78_hw* hw, uint16_t* ver) {
 int tool78_ocd_connect(struct tool78_hw* hw, const uint8_t passwd[10]) {
 	busy_wait_ms(1);
 	uint8_t stuff[11];
-	uint8_t connst, cksum;
-	stuff[0] = tool78ocd_cmd_connect;
+	uint8_t connst;
+	bool is_g10 = (hw->target & tool78_mcu_mask) == tool78_mcu_rl78g10;
+	stuff[0] = is_g10 ? tool78ocd_cmdg10_connect : tool78ocd_cmd_connect;
 	int rr = hw->send(1, &stuff[0], -1);
 
 	// stuff[1] is tool78ocd_cmd_connect echoed back
@@ -1086,20 +1117,29 @@ int tool78_ocd_connect(struct tool78_hw* hw, const uint8_t passwd[10]) {
 		for (int iii = 0; iii < rr; ++iii) {
 			printf("0x%02x%c", stuff[1+iii], (iii==rr-1)?'\n':' ');
 		}*/
-		//return -1;
+		return -1;
 	}
 	connst=stuff[2];
+	printf("connst 1=%02x\n", connst);
+	if (connst == 0xff) {
+		rr = hw->recv(1, &connst, 1000);
+		if (rr != 1) return -1;
+	}
+	printf("connst 2=%02x\n", connst);
 	if (connst == 0xf0 || connst == 0xf4) return connst;
 	// connst==0xf1
 
 	memcpy(stuff, passwd, 10);
-	cksum = stuff[10] = tool78_calc_ocd_checksum8(10, passwd);
+	if (!is_g10) {
+		stuff[10] = tool78_calc_ocd_checksum8(10, passwd);
+	}
 
 	busy_wait_ms(1);
-	rr = hw->send(11, stuff, -1);
+	rr = hw->send(is_g10 ? 10 : 11, stuff, -1);
 
 	// stuff[9] is the checksum byte echoed back
 	rr = hw->recv(2, &stuff[9], 100000);
+	printf("ocdpw 2 = %02x %02x\n", stuff[9], stuff[10]);
 	if (rr != 2) {
 		/*printf("OCDconn2 rr: %d\n", rr);
 		for (int iii = 0; iii < rr; ++iii) {
@@ -1107,7 +1147,17 @@ int tool78_ocd_connect(struct tool78_hw* hw, const uint8_t passwd[10]) {
 		}*/
 		return -2;
 	}
-
+	if (stuff[9] == 0xff) { // framing error bullshit
+		stuff[9] = stuff[10];
+		rr = hw->recv(1, &stuff[10], 100000);
+		if (rr != 1) return -2;
+	}
+	printf("ocdpw 3 = %02x %02x\n", stuff[9], stuff[10]);
+	while (stuff[10] == 0) {
+		rr = hw->recv(1, &stuff[10], 100000);
+		if (rr != 1) return -2;
+	}
+	printf("ocdpw 4 = %02x %02x\n", stuff[9], stuff[10]);
 
 	/*printf("cksum=0x%02x conn=%02x pw=%02x\n",
 			cksum, connst, stuff[10]);*/
@@ -1117,52 +1167,155 @@ int tool78_ocd_connect(struct tool78_hw* hw, const uint8_t passwd[10]) {
 }
 int tool78_ocd_read(struct tool78_hw* hw, uint16_t off, uint8_t len,
 		uint8_t* data) {
-	busy_wait_ms(1);
+	busy_wait_us(300);//busy_wait_ms(1);
+
+	bool is_g10 = (hw->target & tool78_mcu_mask) == tool78_mcu_rl78g10;
 
 	uint8_t hdr[4];
-	hdr[0] = tool78ocd_cmd_read;
-	hdr[2] = off >> 8;
-	hdr[1] = off & 0xff;
-	hdr[3] = len;
-	//printf("rd len=%u\n", len);
+	int rr;
 
-	int rr = hw->send(sizeof hdr, hdr, -1);
-	rr = hw->recv(1, &hdr[2], 1000);
-	// last byte of header sent echoed back
-	if (rr != 1 || hdr[2] != hdr[3]) {
-		//printf("rd recv=%02x\n", hdr[2]);
-		return -2;
+	if (is_g10) {
+		if (len == 2) {
+			hdr[0] = tool78ocd_cmdg10_setptr;
+			hdr[1] = off & 0xff; // l
+			hdr[2] = off >> 8; // h
+			hdr[3] = 1; // b
+			rr = hw->send(sizeof hdr, hdr, -1);
+			if (rr != sizeof hdr) return -1;
+
+			rr = hw->recv(2, data, 1000);
+			if (rr != 2) return -2;
+			if (data[1] != 0x00) return -3;
+
+			hdr[0] = tool78ocd_cmdg10_read_word;
+			rr = hw->send(1, hdr, -1);
+			if (rr != 1) return -1;
+
+			rr = hw->recv(2, data, 1000*len);
+			if (rr != 2) return -2;
+			return 0;
+		} else {
+			hdr[0] = tool78ocd_cmdg10_setptr;
+			hdr[1] = off & 0xff; // l
+			hdr[2] = off >> 8; // h
+			hdr[3] = len; // b
+			rr = hw->send(sizeof hdr, hdr, -1);
+			if (rr != sizeof hdr) return -1;
+			printf("sent hdr\n");
+
+			rr = hw->recv(2, data, 1000);
+			printf("stat rr=%d data=%02x %02x\n", rr, data[0], data[1]);
+			if (rr != 2) return -2;
+			if (data[1] != 0x00) return -3;
+
+			hdr[0] = tool78ocd_cmdg10_read_raw;
+			rr = hw->send(1, hdr, -1);
+			if (rr != 1) return -1;
+			printf("sent rdcmd\n");
+
+			rr = hw->recv(len, data, 1000*len);
+			printf("got data rr=%d data=%02x\n", rr, data[0]);
+			if (rr != len) return -2;
+			return 0;
+		}
+	} else {
+		hdr[0] = tool78ocd_cmd_read;
+		hdr[2] = off >> 8;
+		hdr[1] = off & 0xff;
+		hdr[3] = len;
+		//printf("rd len=%u\n", len);
+
+		int rr = hw->send(sizeof hdr, hdr, -1);
+		if (rr != sizeof hdr) return -1;
+		rr = hw->recv(1, &hdr[2], 1000);
+		// last byte of header sent echoed back
+		if (rr != 1 || hdr[2] != hdr[3]) {
+			//printf("rd recv=%02x\n", hdr[2]);
+			return -2;
+		}
+
+		rr = hw->recv(len, data, 1000*len);
+		//printf("ocd read %d\n", rr);
+		return (rr == len) ? 0 : -1;
 	}
-
-	rr = hw->recv(len, data, 1000*len);
-	//printf("ocd read %d\n", rr);
-	return (rr == len) ? 0 : -1;
 }
 int tool78_ocd_write(struct tool78_hw* hw, uint16_t addr, uint8_t len,
 		const uint8_t* data) {
 	if (len == 0) return -1;
 	busy_wait_ms(1);
 
+	bool is_g10 = (hw->target & tool78_mcu_mask) == tool78_mcu_rl78g10;
+
 	uint8_t hdr[4];
-	hdr[0] = tool78ocd_cmd_write;
-	hdr[1] = addr & 0xff;
-	hdr[2] = addr >> 8;
-	hdr[3] = len;
+	int rr;
 
-	int rr = hw->send(sizeof hdr, hdr, -1);
-	rr = hw->send(len, data, -1);
+	if (is_g10) {
+		if (len == 2) {
+			hdr[0] = tool78ocd_cmdg10_setptr;
+			hdr[1] = addr & 0xff; // l
+			hdr[2] = addr >> 8; // h
+			hdr[3] = data[1]; // b
 
-	// last data byte echoed back
-	rr = hw->recv(2, hdr, 1000*len);
-	if (rr != 2) return -1;
-	///printf("ocd write 0x%02x\n", hdr[1]);
-	return (hdr[1] == tool78ocd_cmd_write) ? 0 : -2;
+			rr = hw->send(sizeof hdr, hdr, -1);
+			if (rr != sizeof hdr) return -1;
+
+			hdr[0] = tool78ocd_cmdg10_write_word;
+			hdr[1] = data[0]; // a
+
+			rr = hw->send(2, hdr, -1);
+			if (rr != 2) return -1;
+
+			rr = hw->recv(2, hdr, 1000*len);
+			if (rr != 2) return -1;
+
+			return (hdr[1] == 0) ? 0 : -2;
+		} else {
+			hdr[0] = tool78ocd_cmdg10_setptr;
+			hdr[1] = addr & 0xff; // l
+			hdr[2] = addr >> 8; // h
+			hdr[3] = len; // b
+
+			rr = hw->send(sizeof hdr, hdr, -1);
+			if (rr != sizeof hdr) return -1;
+
+			hdr[0] = tool78ocd_cmdg10_write_raw;
+
+			rr = hw->send(1, hdr, -1);
+			if (rr != 1) return -1;
+
+			rr = hw->send(len, data, -1);
+			if (rr != len) return -1;
+
+			rr = hw->recv(2, hdr, 1000*len);
+			if (rr != 2) return -1;
+
+			return (hdr[1] == 0) ? 0 : -2;
+		}
+	} else {
+		hdr[0] = tool78ocd_cmd_write;
+		hdr[1] = addr & 0xff;
+		hdr[2] = addr >> 8;
+		hdr[3] = len;
+
+		int rr = hw->send(sizeof hdr, hdr, -1);
+		if (rr != sizeof hdr) return -1;
+		rr = hw->send(len, data, -1);
+		if (rr != len) return -1;
+
+		// last data byte echoed back
+		rr = hw->recv(2, hdr, 1000*len);
+		if (rr != 2) return -1;
+		///printf("ocd write 0x%02x\n", hdr[1]);
+		return (hdr[1] == tool78ocd_cmd_write) ? 0 : -2;
+	}
 }
 int tool78_ocd_exec(struct tool78_hw* hw) {
 	busy_wait_ms(1);
 
-	uint8_t hdr[2];
-	hdr[0] = tool78ocd_cmd_exec;
+	bool is_g10 = (hw->target & tool78_mcu_mask) == tool78_mcu_rl78g10;
+
+	uint8_t hdr[2], cmd;
+	cmd = hdr[0] = is_g10 ? tool78ocd_cmdg10_exec : tool78ocd_cmd_exec;
 
 	int rr = hw->send(1, hdr, -1);
 
@@ -1170,27 +1323,45 @@ int tool78_ocd_exec(struct tool78_hw* hw) {
 	if (rr != 1 && rr != 2) return -1;
 	//printf("h[0]=0x%02x, h[1]=0x%02x\n", hdr[0], hdr[1]);
 
-	return (hdr[0] == tool78ocd_cmd_exec) ? 0 : -2;
+	return (hdr[0] == cmd) ? 0 : -2;
 }
 int tool78_ocd_leave(struct tool78_hw* hw, bool exit_to_ram) {
 	busy_wait_ms(1);
 
+	bool is_g10 = (hw->target & tool78_mcu_mask) == tool78_mcu_rl78g10;
+
 	uint8_t hdr[2];
-	hdr[0] = exit_to_ram ? tool78ocd_cmd_exit_ram : tool78ocd_cmd_exit_reti;
+
+	if (is_g10) {
+		hdr[0] = tool78ocd_cmdg10_exit_reti;
+	} else {
+		hdr[0] = exit_to_ram ? tool78ocd_cmd_exit_ram : tool78ocd_cmd_exit_reti;
+	}
 
 	int rr = hw->send(1, hdr, -1);
 
-	rr = hw->recv(1, &hdr[1], 1000);
-	if (rr != 1) return -1;
+	if (is_g10) {
+		rr = hw->recv(2, &hdr[0], 1000);
+		if (rr != 2) return -1;
 
-	return (hdr[0] == hdr[1]) ? 0 : -2;
+		return 0;
+	} else {
+		rr = hw->recv(1, &hdr[1], 1000);
+		if (rr != 1) return -1;
+
+		return (hdr[0] == hdr[1]) ? 0 : -2;
+	}
 }
 
 // ----
 
 static enum tool78_stat tool78_init_common(struct tool78_hw* hw) {
 	if (!hw) return tool78_stat_internal_error;
-	hw->flags &= ~tool78_hw_flag_done_reset;
+	if ((hw->target & tool78_mcu_mask) != tool78_mcu_rl78g10) {
+		hw->flags &= ~tool78_hw_flag_done_reset;
+	} else {
+		hw->flags |=  tool78_hw_flag_done_reset;
+	}
 
 	enum tool78_stat st = tool78_stat_ack;
 	for (size_t i = 0; i < 16; ++i) {
@@ -1216,10 +1387,16 @@ static enum tool78_stat tool78_init_common(struct tool78_hw* hw) {
 		//printf("baudrate result=0x%02x\n", st);
 		if (st != tool78_stat_ack) return st;
 	} else {
-		enum tool78_stat st2;
-		st = tool78_data_recv(hw, &st2, 1, 1000);
-		if (st != tool78_stat_ack) return st;
-		st = st2;
+		// 0x3a/0xc5 is echoed back as well
+		uint8_t data[5];
+		int rr = hw->recv(2, data, 1000);
+		st = data[1];
+		//printf("init rr:%d st=%02x\n", rr, st);
+		if (rr != 2) return tool78_stat_timeout_error;
+
+		// should be 5 zero bytes, but let's not check
+		rr = hw->recv(5, data, 1000*1000);
+		if (rr != 5) return tool78_stat_timeout_error;
 	}
 
 	return st;
@@ -1247,9 +1424,11 @@ enum tool78_stat tool78_init_ocd(struct tool78_hw* hw, uint16_t* ver,
 	//printf("common st=%d\n", st);
 	if (st != tool78_stat_ack) return st;
 
-	st = tool78_ocd_version(hw, ver);
-	//printf("ocdver st=%d\n", st);
-	if (st) return st;
+	if ((hw->target & tool78_mcu_mask) != tool78_mcu_rl78g10) {
+		st = tool78_ocd_version(hw, ver);
+		//printf("ocdver st=%d\n", st);
+		if (st) return st;
+	}
 
 	st = tool78_ocd_connect(hw, passwd);
 	//printf("conn st=%d\n", st);
diff --git a/src/tool78/tool78_cmds.h b/src/tool78/tool78_cmds.h
index afdf03c..cb0a673 100644
--- a/src/tool78/tool78_cmds.h
+++ b/src/tool78/tool78_cmds.h
@@ -46,7 +46,7 @@ enum tool78_stat tool78_do_g10_get_flash_size(struct tool78_hw*,
 enum tool78_stat tool78_do_g10_check_crc(struct tool78_hw*,
 		enum tool78_g10_flash_size fsz, uint16_t* crc);
 enum tool78_stat tool78_do_g10_erase_then_write(struct tool78_hw*,
-		enum tool78_g10_flash_size fsz, const uint8_t* data);
+		enum tool78_g10_flash_size fsz, const uint8_t* data, size_t datalen);
 
 // new commands from the RL78/G23 (Proto C)
 
diff --git a/src/tool78/tool78_defs.h b/src/tool78/tool78_defs.h
index d1772cb..fd37ad1 100644
--- a/src/tool78/tool78_defs.h
+++ b/src/tool78/tool78_defs.h
@@ -5,22 +5,6 @@
 #include <stddef.h>
 #include <stdint.h>
 
-#define PINOUT_TOOL78_PIO pio1
-
-#define PINOUT_TOOL78_nRESET      16
-
-#define PINOUT_TOOL78_78K0_FLMD0  17
-#define PINOUT_TOOL78_78K0_TXMOSI 18
-#define PINOUT_TOOL78_78K0_RXMISO 19
-#define PINOUT_TOOL78_78K0_CLOCK  20
-
-#define PINOUT_TOOL78_78K0R_FLMD0 17
-#define PINOUT_TOOL78_78K0R_TOOL0 18
-
-#define PINOUT_TOOL78_RL78_TOOL0  17
-#define PINOUT_TOOL78_RL78_TX     18
-#define PINOUT_TOOL78_RL78_RX     19
-
 enum tool78_target {
 	tool78k0_uart2        = 0x12,
 	tool78k0_spi          = 0x13,
@@ -157,6 +141,15 @@ enum tool78ocd_cmd {
 	tool78ocd_cmd_exec = 0x94,
 	tool78ocd_cmd_exit_reti = 0x95, // TODO: what is this?
 	tool78ocd_cmd_exit_ram = 0x97, // TODO: what is this?
+
+	tool78ocd_cmdg10_connect   = 0x55,
+	tool78ocd_cmdg10_setptr    = 0x56,
+	tool78ocd_cmdg10_read_raw  = 0x57,
+	tool78ocd_cmdg10_write_raw = 0x58,
+	tool78ocd_cmdg10_read_word = 0x59,
+	tool78ocd_cmdg10_write_word= 0x5a,
+	tool78ocd_cmdg10_exec      = 0x5b,
+	tool78ocd_cmdg10_exit_reti = 0x5c,
 };
 
 enum tool78_frame {
diff --git a/src/tool78/tool78_hw_78k0_spi.c b/src/tool78/tool78_hw_78k0_spi.c
index ad74396..093123e 100644
--- a/src/tool78/tool78_hw_78k0_spi.c
+++ b/src/tool78/tool78_hw_78k0_spi.c
@@ -4,6 +4,8 @@
 #include <pico/time.h>
 #include <pico/timeout_helper.h>
 
+#include "pinout.h"
+
 #include "tool78_defs.h"
 #include "tool78_hw_helpers.h"
 
diff --git a/src/tool78/tool78_hw_78k0_uart2.c b/src/tool78/tool78_hw_78k0_uart2.c
index 17abf43..0c1b203 100644
--- a/src/tool78/tool78_hw_78k0_uart2.c
+++ b/src/tool78/tool78_hw_78k0_uart2.c
@@ -3,6 +3,8 @@
 #include <hardware/pio.h>
 #include <pico/time.h>
 
+#include "pinout.h"
+
 #include "tool78_defs.h"
 #include "tool78_hw_helpers.h"
 
@@ -29,7 +31,7 @@ static bool t78k0_uart2_init(void) {
 	tool78_uart_tx_program_init(PINOUT_TOOL78_PIO, vars.smtx, vars.txoff,
 			PINOUT_TOOL78_78K0_TXMOSI, 9600, true);
 	tool78_uart_rx_program_init(PINOUT_TOOL78_PIO, vars.smrx, vars.rxoff,
-			PINOUT_TOOL78_78K0_RXMISO, 9600, true);
+			PINOUT_TOOL78_78K0_RXMISO, 9600, true, true);
 
 	// magic initial not-really-commands
 	// wait tCOM or tR1 (unclear) (>445k/8M s + (2^16)/2M s)
diff --git a/src/tool78/tool78_hw_78k0_uart2_extclk.c b/src/tool78/tool78_hw_78k0_uart2_extclk.c
index 262e517..0b66464 100644
--- a/src/tool78/tool78_hw_78k0_uart2_extclk.c
+++ b/src/tool78/tool78_hw_78k0_uart2_extclk.c
@@ -4,6 +4,8 @@
 #include <hardware/pwm.h>
 #include <pico/time.h>
 
+#include "pinout.h"
+
 #include "tool78_defs.h"
 #include "tool78_hw_helpers.h"
 
@@ -35,7 +37,7 @@ static bool t78k0_uart2_extclk_init(void) {
 	tool78_uart_tx_program_init(PINOUT_TOOL78_PIO, vars.smtx, vars.txoff,
 			PINOUT_TOOL78_78K0_TXMOSI, 9600, true);
 	tool78_uart_rx_program_init(PINOUT_TOOL78_PIO, vars.smrx, vars.rxoff,
-			PINOUT_TOOL78_78K0_RXMISO, 9600, true);
+			PINOUT_TOOL78_78K0_RXMISO, 9600, true, true);
 
 	// magic initial not-really-commands
 	// wait tCOM or tR1 (unclear) (>445k/8M s + (2^16)/2M s)
diff --git a/src/tool78/tool78_hw_78k0r_uart1.c b/src/tool78/tool78_hw_78k0r_uart1.c
index 31ca5b7..33f772f 100644
--- a/src/tool78/tool78_hw_78k0r_uart1.c
+++ b/src/tool78/tool78_hw_78k0r_uart1.c
@@ -3,6 +3,8 @@
 #include <hardware/pio.h>
 #include <pico/time.h>
 
+#include "pinout.h"
+
 #include "tool78_defs.h"
 #include "tool78_hw_helpers.h"
 
@@ -28,7 +30,7 @@ static bool t78k0r_uart1_init(void) {
 	tool78_entryseq_78k0r(tool78_entry_78k0r_uart1);
 
 	tool78_uart_rx_program_init(PINOUT_TOOL78_PIO, vars.smrx, vars.rxoff,
-			PINOUT_TOOL78_78K0R_TOOL0, 9600, true);
+			PINOUT_TOOL78_78K0R_TOOL0, 9600, true, true);
 	tool78_uart_tx_program_init(PINOUT_TOOL78_PIO, vars.smtx, vars.txoff,
 			PINOUT_TOOL78_78K0R_TOOL0, 9600, true);
 
diff --git a/src/tool78/tool78_hw_helpers.c b/src/tool78/tool78_hw_helpers.c
index ce801c5..b62519c 100644
--- a/src/tool78/tool78_hw_helpers.c
+++ b/src/tool78/tool78_hw_helpers.c
@@ -6,6 +6,8 @@
 #include <pico/time.h>
 #include <pico/timeout_helper.h>
 
+#include "pinout.h"
+
 #include "tool78_defs.h"
 #include "tool78_hw.h"
 
diff --git a/src/tool78/tool78_hw_rl78_uart1.c b/src/tool78/tool78_hw_rl78_uart1.c
index 440e3b1..f8c2433 100644
--- a/src/tool78/tool78_hw_rl78_uart1.c
+++ b/src/tool78/tool78_hw_rl78_uart1.c
@@ -3,6 +3,8 @@
 #include <hardware/pio.h>
 #include <pico/time.h>
 
+#include "pinout.h"
+
 #include "tool78_defs.h"
 #include "tool78_hw_helpers.h"
 
@@ -13,6 +15,7 @@
 static struct tool78_pio_vars vars;
 
 static int trl78_uart1_send(int len, const uint8_t* data, int32_t timeout_us);
+static int trl78g10_uart1_send(int len, const uint8_t* data, int32_t timeout_us);
 
 static bool trl78_uart1_init(void) {
 	if (!tool78_hw_init_help(&tool78_uart_tx_program, &tool78_uart_rx_program,
@@ -27,7 +30,7 @@ static bool trl78_uart1_init(void) {
 	tool78_entryseq_rl78(typ);
 
 	tool78_uart_rx_program_init(PINOUT_TOOL78_PIO, vars.smrx, vars.rxoff,
-			PINOUT_TOOL78_RL78_TOOL0, 115200, true);
+			PINOUT_TOOL78_RL78_TOOL0, 115200, true, true);
 	tool78_uart_tx_program_init(PINOUT_TOOL78_PIO, vars.smtx, vars.txoff,
 			PINOUT_TOOL78_RL78_TOOL0, 115200, true);
 
@@ -50,24 +53,23 @@ static bool trl78g10_uart1_init(void) {
 	vars.exclusive = true;
 	vars.bitswap = true;
 
-	enum tool78_entry typ = tool78_entry_rl78_uart1;
+	//enum tool78_entry typ = tool78_entry_rl78_uart1;
+	enum tool78_entry typ = (tool78_hw_rl78g10_uart1.flags & tool78_hw_flag_do_ocd)
+			? tool78_entry_rl78_ocd : tool78_entry_rl78_uart1;
 
 	tool78_entryseq_rl78(typ);
 
 	tool78_uart_rx_program_init(PINOUT_TOOL78_PIO, vars.smrx, vars.rxoff,
-			PINOUT_TOOL78_RL78_TOOL0, 115200, true);
+			PINOUT_TOOL78_RL78_TOOL0, 115200, true, false);
 	tool78_uart_tx_program_init(PINOUT_TOOL78_PIO, vars.smtx, vars.txoff,
 			PINOUT_TOOL78_RL78_TOOL0, 115200, true);
 
 	uint8_t byte = (uint8_t)typ;
-	trl78_uart1_send(1, &byte, -1);
+	trl78g10_uart1_send(1, &byte, -1);
 
-	//busy_wait_us_32(70); // tMB
-	busy_wait_ms(4);
+	//busy_wait_ms(4);
 
-	// now a baudrate set command needs to be sent, but we leave that to the
-	// upper (command processing) layer as it has to know about those timings
-	// anyway
+	// the device will reply with 0x06
 
 	return true; // all is well!
 }
@@ -130,7 +132,7 @@ struct tool78_hw tool78_hw_rl78_uart1 = {
 struct tool78_hw tool78_hw_rl78g10_uart1 = {
 	.target = tool78rlg10_uart1,
 
-	.init = trl78_uart1_init,
+	.init = trl78g10_uart1_init,
 	.deinit = trl78_uart1_deinit,
 
 	.set_baudrate = trl78_uart1_set_baudrate,
diff --git a/src/tool78/tool78_hw_rl78_uart2.c b/src/tool78/tool78_hw_rl78_uart2.c
index b955fd1..257fbc5 100644
--- a/src/tool78/tool78_hw_rl78_uart2.c
+++ b/src/tool78/tool78_hw_rl78_uart2.c
@@ -3,6 +3,8 @@
 #include <hardware/pio.h>
 #include <pico/time.h>
 
+#include "pinout.h"
+
 #include "tool78_defs.h"
 #include "tool78_hw_helpers.h"
 
@@ -39,7 +41,7 @@ static bool trl78_uart2_init(void) {
 	tool78_uart_tx_program_init(PINOUT_TOOL78_PIO, vars.smtx, vars.txoff,
 			PINOUT_TOOL78_RL78_TX, 115200, true);
 	tool78_uart_rx_program_init(PINOUT_TOOL78_PIO, vars.smrx, vars.rxoff,
-			PINOUT_TOOL78_RL78_RX, 115200, true);
+			PINOUT_TOOL78_RL78_RX, 115200, true, true);
 	gpio_set_function(PINOUT_TOOL78_RL78_TOOL0, GPIO_FUNC_SIO);
 
 	// now a baudrate set command needs to be sent, but we leave that to the
diff --git a/src/tool78/tool78_hw_test_uart2.c b/src/tool78/tool78_hw_test_uart2.c
index dc029ca..d3c65bc 100644
--- a/src/tool78/tool78_hw_test_uart2.c
+++ b/src/tool78/tool78_hw_test_uart2.c
@@ -6,6 +6,8 @@
 #include <pico/time.h>
 #include <pico/timeout_helper.h>
 
+#include "pinout.h"
+
 #include "tool78_defs.h"
 #include "tool78_hw_helpers.h"
 
@@ -27,7 +29,7 @@ static bool test_init(void) {
 	tool78_uart_tx_program_init(PINOUT_TOOL78_PIO, vars.smtx, vars.txoff,
 			PINOUT_TOOL78_RL78_TX, 115200, true);
 	tool78_uart_rx_program_init(PINOUT_TOOL78_PIO, vars.smrx, vars.rxoff,
-			PINOUT_TOOL78_RL78_RX, 115200, true);
+			PINOUT_TOOL78_RL78_RX, 115200, true, true);
 
 	// TODO: magic initial not-really-commands
 
diff --git a/src/zap/zap_crowbar.c b/src/zap/zap_crowbar.c
index fd56cc9..91d41be 100644
--- a/src/zap/zap_crowbar.c
+++ b/src/zap/zap_crowbar.c
@@ -1,7 +1,10 @@
 
+#include <stdio.h>
+
 #include "zap_crowbar.h"
 
 void zap_crowbar_init(void) {
+	printf("zap crowbar init\n");
 	const io_rw_32 pinmask = (1u << ZAP_CROWBAR_1) | (1u << ZAP_CROWBAR_2);
 
 	sio_hw->gpio_clr = pinmask; // default to low -> hiZ by default
diff --git a/src/zap/zap_dac.c b/src/zap/zap_dac.c
index 0f71cd4..ff51883 100644
--- a/src/zap/zap_dac.c
+++ b/src/zap/zap_dac.c
@@ -17,6 +17,7 @@ void zap_dac_init(bool shdn) {
 	spi_init(ZAP_DAC_SPI, 1*1000*1000); // TODO: can we go higher?
 	spi_set_format(ZAP_DAC_SPI, 16, SPI_CPOL_0, SPI_CPHA_0, SPI_MSB_FIRST);
 
+	(void)shdn;
 	gpio_put(ZAP_DAC_NLATCH, true);
 	gpio_put(ZAP_DAC_CS    , true);
 	//gpio_put(ZAP_DAC_NSHDN , !shdn);
diff --git a/src/zap/zap_dac.h b/src/zap/zap_dac.h
index 2f798ea..bdc1585 100644
--- a/src/zap/zap_dac.h
+++ b/src/zap/zap_dac.h
@@ -28,6 +28,7 @@ void zap_dac_set_b(uint16_t b);
 
 // only relevant for MCP49x2
 static inline void zap_dac_set_shutdown(bool shdn) {
+	(void)shdn;
 	//gpio_put(ZAP_DAC_NSHDN, !shdn);
 }
 
diff --git a/test/rl78g10/.gitignore b/test/rl78g10/.gitignore
new file mode 100644
index 0000000..7a2c29e
--- /dev/null
+++ b/test/rl78g10/.gitignore
@@ -0,0 +1,7 @@
+trace.log
+*.bin
+*.h
+*.elf
+*.map
+*.o
+*.srec
diff --git a/test/rl78g10/Makefile b/test/rl78g10/Makefile
new file mode 100644
index 0000000..253551e
--- /dev/null
+++ b/test/rl78g10/Makefile
@@ -0,0 +1,27 @@
+
+AS := rl78-elf-gcc
+LD := rl78-elf-gcc
+OBJCOPY := rl78-elf-objcopy
+
+all: test-rom.srec test-dbg.srec test-rom.bin test-dbg.bin
+
+test.S.o: test.S
+	$(AS) -c -o "$@" "$<"
+romhdr.S.o: romhdr.S
+	$(AS) -c -o "$@" "$<"
+
+OBJFILES := test.S.o romhdr.S.o
+
+test-%.elf test-%.elf.map: $(OBJFILES) link-%.ld
+	$(LD) -o "$@" $(OBJFILES) -T link-$*.ld -Wl,-Map="$@.map" -nostdlib -nostartfiles
+
+test-%.bin: test-%.elf
+	$(OBJCOPY) -O binary "$<" "$@"
+
+%.srec: %.elf
+	$(OBJCOPY) -O srec "$<" "$@"
+
+clean:
+	@$(RM) -v test-*.bin test-*.bin.h test-*.elf test-*.elf.map test.S.o
+.KEEP: test-rom.elf test-dbg.elf
+
diff --git a/test/rl78g10/hw.S b/test/rl78g10/hw.S
new file mode 100644
index 0000000..ddac3e6
--- /dev/null
+++ b/test/rl78g10/hw.S
@@ -0,0 +1,37 @@
+
+/*#define SSR00 #0x0100*/
+
+#define P0  0xfff00
+#define P1  0xfff01
+#define PM0 0xfff20
+#define PM1 0xfff21
+
+#define PER0 0xf00f0
+#define OSMC 0xf00f3
+
+#define PU0  0xf0030
+#define PU1  0xf0031
+#define POM0 0xf0050
+#define POM1 0xf0051
+#define PMC0 0xf0060
+#define PMC1 0xf0061
+/*#define PD1  0x0075*/
+#define PIOR 0xf0077
+
+/*#define CMC 0xfffa0
+#define CSC 0xfffa1
+#define CKC 0xfffa4*/
+#define HOCODIV 0xf00a8
+
+
+/*#define STMK0 
+SRMK0
+SREMK0
+SAUEN
+#define ST0 0x0124
+#define SPS0 0x0126
+SMR00H
+SMR00L
+SCR00H
+SCR00L*/
+
diff --git a/test/rl78g10/link-dbg.ld b/test/rl78g10/link-dbg.ld
new file mode 100644
index 0000000..4aa6ec0
--- /dev/null
+++ b/test/rl78g10/link-dbg.ld
@@ -0,0 +1,33 @@
+OUTPUT_FORMAT("elf32-rl78","elf32-rl78","elf32-rl78")
+OUTPUT_ARCH(rl78)
+ENTRY(_start)
+
+MEMORY
+{
+  ram (rwx) : ORIGIN = 0xff900, LENGTH = 0x5e0/*idk*/
+}
+
+SECTIONS {
+  /*.hdr :
+  {
+    BYTE(0xe0); BYTE(0x07); / * address * /
+    BYTE(SIZEOF(.text));
+  } > ram*/
+  .text :
+  {
+    *(.text* .rodata* .data*)
+  } > ram
+  .bss :
+  {
+    *(.bss)
+  } > ram =0x00
+
+  /DISCARD/ :
+  {
+    *(.vectors)
+    *(.callt)
+    *(.option)
+    *(.password)
+    *(.plt)
+  }
+}
diff --git a/test/rl78g10/link-rom.ld b/test/rl78g10/link-rom.ld
new file mode 100644
index 0000000..b262cb7
--- /dev/null
+++ b/test/rl78g10/link-rom.ld
@@ -0,0 +1,166 @@
+OUTPUT_FORMAT("elf32-rl78","elf32-rl78","elf32-rl78")
+OUTPUT_ARCH(rl78)
+ENTRY(_start)
+
+MEMORY
+{
+  /*data    (rwx)     : ORIGIN = 0x0200,  LENGTH = 0x100
+  text    (rx)      : ORIGIN = 0xf800,  LENGTH = 0x800 - 0x20
+  vectors (rw)      : ORIGIN = 0xffe0,  LENGTH = 0x20*/
+
+  rom (rx)  : ORIGIN = 0x00000, LENGTH = 0x01000
+  /* vectors, boot clusters, etc.: part of ^ */
+  ram (rwx) : ORIGIN = 0xffae0, LENGTH = 0x00400
+
+  /*
+   * 16k code flash: 00000..03FFF
+   * 2k data flash: F1000..F17FF
+   * 1.5k ram: FF900..FFEDF
+   *
+   * boot clusters: +00000; +01000
+   * 	vectors: 00000..0007F
+   * 	callt: 00080..000BF
+   * 	option byte: 000C0..000C3
+   * 	debugpasswd: 000C4..000CD
+   *
+   * flash block = 0x400 bytes => 0x10 blocks
+   *
+   * vectors:
+   * 	000: RESET/POR/WDT/TRAP/RPE/...
+   * 	004: INTWDTI/INTSRO
+   * 	006: INTLVI
+   * 	008: INTP0
+   * 	00A: INTP1
+   * 	...
+   * 	.14: INTP6
+   * 	016: INTST0/INTCSI00/INTIIC00
+   * 	018: INTSR0/INTCSI01/INTIIC01
+   * 	01e: INTSRE0
+   * 	020: INTTM00
+   * 	022: INTST1/INTCSI10/INTIIC10
+   * 	024: INTSR1/INTCSI11/INTIIC11
+   * 	026: INTSRE1
+   * bluh bluh not really interesting
+   * 	07E: BRK
+   *
+   * 02000..03FFF mirrored to F2000..F3FFF (if enabmed in PMC)
+   *
+   * IO regs:
+   * serial data reg 00: TXD0/SIO00/SDR00 = 0xfff10
+   * serial data reg 01: RXD0/SIO01/SDR01 = 0xfff12
+   * serial data reg 02: TXD1/SIO10/SDR02 = 0xfff44
+   * serial data reg 03: RXD1/SIO11/SDR03 = 0xfff42
+   *
+   * port mode reg? PMx = 0xFFF2x
+   *
+   * port input mode PIMx = 0xF004x
+   * port output mode POMx = 0xF005x
+   * port mode control PMCx = 0xF006x
+   * port mode select PMS = 0xF007B
+   * peripheral io redirection regs?
+   * flash operating mode FLMODE = 0xF00AA
+   * serial status reg SSR0x = F010(x*2)
+   * serial mode reg SMR0x = F011(x*2)
+   * serial comm ops setting SCR0x = F011(8+x*2)
+   * + channel enable, start stop, clocksel, output, output enable, output level, standby control
+   * interrupt stuff at 0xF0441+...
+   *
+   * F0090: rom enable flag etc : DFLCTL bit 0 (enable dataflash access?)
+   * F0800: request data etc (not interesting here)
+   * 	F0803=1
+   * 	F0880=4
+   * F0880: also rom enable bit?
+   * FLMODE (voltages stuff, bluh), FLMWRP(?) (enable prev reg), PMMC (also voltages)
+   *
+   * TXD1 enable = PMC20=0 PM20=0 P20=1
+   * RXD1 enable = PMC31=0 PM31=1
+   *
+   * WDT: WDTE (enable reg) + option byte C0: set WDTON bit to 0 (bit 4)
+   *
+   * serial: UART1: ch2
+   * 8n1 lsbfirst
+   * PER0: bit 2 hi
+   * PRR0: bit 2 lo
+   * SPSm: 0b0100<<4 (125kbaud?)
+   * SMRmn: 
+   * SEm SSm STm SOEm SOm SOLm SSCm ISC
+   *
+   * opt C1: 0b00000010 // 0x1a?
+   * opt C2: 0b11101001 // 0x2d?
+   * opt C3: 0b10000101 == 0x85
+   * C4..CD: 00 ...
+   */
+}
+
+SECTIONS {
+  .btc0 :
+  {
+    . = 0x00000;
+    KEEP(*(.vectors))
+    . = 0x00080;
+    KEEP(*(.callt))
+    . = 0x000c0;
+    KEEP(*(.option))
+    . = 0x000c4;
+    KEEP(*(.password))
+    . = 0x000ce;
+    *(.text.btc0)
+  } > rom =0xff
+  /* TODO: btc1? */
+  .text :
+  {
+    . = ALIGN(2);
+    *(.text .rodata* .eh_frame_hdr)
+    . = ALIGN(256);
+    /*KEEP(*(.eh_frame) *(.gcc_except_table*))
+    PROVIDE (__preinit_array_start = .);
+    KEEP (*(.preinit_array))
+    PROVIDE (__preinit_array_end = .);
+    PROVIDE (__init_array_start = .);
+    KEEP (*(SORT(.init_array.*)))
+    KEEP (*(.init_array))
+    PROVIDE (__init_array_end = .);
+    PROVIDE (__fini_array_start = .);
+    KEEP (*(.fini_array))
+    KEEP (*(SORT(.fini_array.*)))
+    PROVIDE (__fini_array_end = .);
+    LONG(0);*/ /* Sentinel.  */
+    /* gcc uses crtbegin.o to find the start of the constructors, so
+       we make sure it is first.  Because this is a wildcard, it
+       doesn't matter if the user does not actually link against
+       crtbegin.o; the linker won't look for a file to match a
+       wildcard.  The wildcard also means that it doesn't matter which
+       directory crtbegin.o is in.  */
+    /*KEEP (*crtbegin*.o(.ctors))*/
+    /* We don't want to include the .ctor section from from the
+       crtend.o file until after the sorted ctors.  The .ctor section
+       from the crtend file contains the end of ctors marker and it
+       must be last */
+    /*KEEP (*(EXCLUDE_FILE (*crtend*.o ) .ctors))
+    KEEP (*(SORT(.ctors.*)))
+    KEEP (*(.ctors))
+    KEEP (*crtbegin*.o(.dtors))
+    KEEP (*(EXCLUDE_FILE (*crtend*.o ) .dtors))
+    KEEP (*(SORT(.dtors.*)))
+    KEEP (*(.dtors))*/
+  } > rom =0xff
+
+  .data :
+  {
+    __data_vma_start = ABSOLUTE(.);
+    __data_lma_start = SIZEOF(.text);
+    *(.data)
+  }
+  __data_size = SIZEOF(.data);
+  .bss :
+  {
+    __bss_start = ABSOLUTE(.);
+    *(.bss .sbss)
+  } >ram
+  __bss_size = SIZEOF(.bss);
+
+  /DISCARD/ :
+  {
+    *(.plt)
+  }
+}
diff --git a/test/rl78g10/romhdr.S b/test/rl78g10/romhdr.S
new file mode 100644
index 0000000..daba5dc
--- /dev/null
+++ b/test/rl78g10/romhdr.S
@@ -0,0 +1,35 @@
+
+.section .vectors, "a", %progbits
+
+_VECTORS:
+_vtor_RST:
+	.2byte _start
+	/* other vectors... */
+	.2byte 0xffff
+	.2byte _start /* wdt -> shrug */
+	.2byte 0xffff
+
+.section .callt, "a", %progbits
+
+_CALLT:
+	.2byte 0xffff
+
+.section .option, "a", %progbits
+
+	/* option bytes */
+_OPTION:
+	/* 0x000C0: wdt settings */
+	.byte 0xee /* wdt disable */
+	/* 0x000C1:  */
+	.byte 0xf7 /* LVD reset, 2.84V */
+	/* 0x000C2:  */
+	.byte 0xfd /* HSmode, HOCO@20MHz */
+	/* 0x000C3: debug settings */
+	.byte 0x85 /* enabled */
+
+.section .password, "a", %progbits
+
+	/* debugger password: ten 0xff bytes */
+_PASSWORD:
+	.byte 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
+
diff --git a/test/rl78g10/test.S b/test/rl78g10/test.S
new file mode 100644
index 0000000..a5924fb
--- /dev/null
+++ b/test/rl78g10/test.S
@@ -0,0 +1,254 @@
+
+#include "hw.S"
+
+.global _start
+_start:
+	/*mov es, #0*/
+	movw sp, #0xfed0
+
+	; IAWCTL = 0 -> none?
+
+
+	call !siniport
+	call !siniclk
+	;call !sinitau
+	;call !siniuart0
+	call !main
+
+delay_long:
+	nop
+	nop
+	nop
+	nop
+	nop
+	nop
+	nop
+	nop
+	nop
+	nop
+	nop
+	nop
+	nop
+	nop
+	nop
+delay_data:
+	nop
+	ret
+
+
+tx_byte:
+	; start condition
+	clr1 P0.0
+	call !delay_long                    ;27 cyc =    4 cyc + 16 cyc + 7 cyc
+
+	; data bits
+	mov c, #8                           ; 1 cyc
+.Lbitloop:
+
+	; set 1 bit
+	bf a.0, $.Lsetlo                    ; 3 cyc hi // 5 cyc lo
+.Lsethi:
+	nop                                 ; 1 cyc hi //
+	nop                                 ; 1 cyc hi //
+	set1 P0.0                           ; 2 cyc hi //
+	br $.Lafterset                      ; 3 cyc hi //
+.Lsetlo:
+	clr1 P0.0                           ;          // 2 cyc lo
+	nop                                 ;          // 1 cyc lo
+	nop                                 ;          // 1 cyc lo
+	nop                                 ;          // 1 cyc lo
+.Lafterset:
+	; delay
+	call !delay_data                    ;12 cyc
+
+	; next bit
+	shr a, 1                            ; 1 cyc
+	dec c                               ; 1 cyc
+	bnz $.Lbitloop                      ; 4 cyc
+
+	; stop condition
+	set1 P0.0
+	call !delay_long
+	call !delay_long
+
+	ret
+
+
+main:
+	set1 P0.0
+
+	call !delay_long
+	call !delay_long
+	call !delay_long
+	call !delay_long
+	call !delay_long
+
+	call !delay_long
+	call !delay_long
+	call !delay_long
+	call !delay_long
+	call !delay_long
+
+	call !delay_long
+	call !delay_long
+	call !delay_long
+	call !delay_long
+	call !delay_long
+
+	call !delay_long
+	call !delay_long
+	call !delay_long
+	call !delay_long
+	call !delay_long
+
+loop:
+	mov es, #0xe
+
+	;movw bc, #0x0200
+	mov c, #0
+	movw hl, #0xfe00
+innerloop:
+	mov a, es:[hl]
+	push ax
+	push bc
+	call !tx_byte
+	pop bc
+	pop ax
+
+	call !delay_long
+	call !delay_long
+	call !delay_long
+	call !delay_long
+	call !delay_long
+	call !delay_long
+	call !delay_long
+
+	incw hl
+	;decw bc
+	;cmpw bc, #0
+	dec c
+	cmp0 c
+	bnz $innerloop
+
+	;movw bc, #0x0200
+	mov c, #0
+	;movw hl, #0xfe00
+innerloop2:
+	mov a, es:[hl]
+	push ax
+	push bc
+	call !tx_byte
+	pop bc
+	pop ax
+
+	call !delay_long
+	call !delay_long
+	call !delay_long
+	call !delay_long
+	call !delay_long
+	call !delay_long
+	call !delay_long
+
+	incw hl
+	;decw bc
+	;cmpw bc, #0
+	dec c
+	cmp0 c
+	bnz $innerloop2
+
+
+	call !delay_long
+	call !delay_long
+	call !delay_long
+	call !delay_long
+	call !delay_long
+
+	call !delay_long
+	call !delay_long
+	call !delay_long
+	call !delay_long
+	call !delay_long
+
+	call !delay_long
+	call !delay_long
+	call !delay_long
+	call !delay_long
+	call !delay_long
+
+	call !delay_long
+	call !delay_long
+	call !delay_long
+	call !delay_long
+	call !delay_long
+
+	mov a, #'E'
+	call !delay_long
+	call !delay_long
+	mov a, #'N'
+	call !delay_long
+	call !delay_long
+	mov a, #'D'
+	call !delay_long
+	call !delay_long
+	mov a, #' '
+	call !delay_long
+	call !delay_long
+
+	br !loop
+
+
+
+
+
+	mov a, #' '
+	call !tx_byte
+
+	call !delay_long
+	call !delay_long
+	call !delay_long
+	call !delay_long
+	call !delay_long
+
+	call !delay_long
+	call !delay_long
+	call !delay_long
+	call !delay_long
+	call !delay_long
+	;set1 P0.0
+
+	br !loop
+
+
+
+
+
+siniport:
+	; P00 GPIO
+	; P06 TxD0
+	mov !PIOR, #0
+
+	; set P0 as output
+	mov !P0, #0
+
+	; disable pullups
+	mov !PU0, #0
+
+	; push-pull output
+	mov !POM0, #0
+
+	; not analog in
+	mov !PMC0, #0x7f
+
+	; set port modes
+	;mov !PM0, #0x0f ; P00 GPIO ; P06 TxD0
+	mov !PM0, #0
+
+	ret
+
+
+siniclk:
+	mov !PER0, #0xe5 ; enable many peripherals
+	mov !OSMC, #0x10
+	;mov !HOCODIV, #1
+	ret
+