diff --git a/example_soc/fpga/fpga_icebreaker.v b/example_soc/fpga/fpga_icebreaker.v
index 0b840be..a1e1c7c 100644
--- a/example_soc/fpga/fpga_icebreaker.v
+++ b/example_soc/fpga/fpga_icebreaker.v
@@ -29,10 +29,20 @@ module fpga_icebreaker (
     input  wire       tdi,
     output wire       tdo,
 
+    output wire       mirror_tck,
+    output wire       mirror_tms,
+    output wire       mirror_tdi,
+    output wire       mirror_tdo,
+
 	output wire       uart_tx,
 	input  wire       uart_rx
 );
 
+assign mirror_tck = tck;
+assign mirror_tms = tms;
+assign mirror_tdi = tdi;
+assign mirror_tdo = tdo;
+
 wire clk_sys = clk_osc;
 wire rst_n_sys;
 wire trst_n;
@@ -56,7 +66,7 @@ example_soc soc_u (
 	.rst_n   (rst_n_sys),
 
 	.tck     (tck),
-	.trst_n  (trst_n),
+	.trst_n  (rst_n_sys), //fixme!
 	.tms     (tms),
 	.tdi     (tdi),
 	.tdo     (tdo),
diff --git a/example_soc/icebreaker-openocd.cfg b/example_soc/icebreaker-openocd.cfg
new file mode 100644
index 0000000..9b46db0
--- /dev/null
+++ b/example_soc/icebreaker-openocd.cfg
@@ -0,0 +1,30 @@
+adapter driver ftdi
+
+# 30 MHz -- a bit exciting but it seems reliable
+adapter speed 30000
+ftdi_tdo_sample_edge falling
+
+# JTAG is on FTDI B channel so it doesn't inadvertently assert flash CS pin
+# (usually UART would be on the B channel).
+
+# Note TDO/TMS require two of the solder jumpers on the back of the board to
+# be bridged. On the v1.0e board these are jumpers J3/J4. To find these, look
+# for the box of 5 x 2 jumpers (with a few others hanging off the side) and
+# they are the two in the central column. They line up with the space in
+# between "Jump" and "for" in the silk text "Jump for FTDI FIFO".
+
+ftdi_device_desc "Dual RS232-HS"
+ftdi_vid_pid 0x0403 0x6010
+# Use BDBUS0-3 on iCEBreaker to avoid toggling flash chip select
+ftdi_channel 1
+
+ftdi_layout_init 0x0000 0xffff
+
+set _CHIPNAME hazard3
+jtag newtap $_CHIPNAME cpu -irlen 5
+set _TARGETNAME $_CHIPNAME.cpu
+target create $_TARGETNAME riscv -chain-position $_TARGETNAME
+
+gdb_report_data_abort enable
+init
+halt
diff --git a/example_soc/soc/example_soc.v b/example_soc/soc/example_soc.v
index 5a1199b..1c0d34f 100644
--- a/example_soc/soc/example_soc.v
+++ b/example_soc/soc/example_soc.v
@@ -196,16 +196,18 @@ wire uart_irq;
 // options like faster multiply/divide.
 
 hazard3_cpu_1port #(
-	.RESET_VECTOR    (32'h2000_00c0),
-	.MTVEC_INIT      (32'h2000_0000),
+	.RESET_VECTOR    (32'h0000_00c0),
+	.MTVEC_INIT      (32'h0000_0000),
 
 	.EXTENSION_C     (0),
-	.EXTENSION_M     (0),
+	.EXTENSION_M     (1),
 	.CSR_M_MANDATORY (1),
 	.CSR_M_TRAP      (1),
-	.CSR_COUNTER     (0), // also no counters cause they're whack
+	.CSR_COUNTER     (1),
 	.DEBUG_SUPPORT   (1),
 
+	.MUL_FAST        (1),
+
 	.NUM_IRQ         (1),
 
 	.MVENDORID_VAL   (32'h0),
@@ -256,7 +258,7 @@ hazard3_cpu_1port #(
 // ----------------------------------------------------------------------------
 // Bus fabric
 
-// - 128 kB SRAM (using SPRAMs) at 0x2000_0000
+// - 128 kB SRAM (using SPRAMs) at 0x0000_0000
 // - UART at 0x4000_0000
 
 // AHBL layer
diff --git a/example_soc/synth/Makefile b/example_soc/synth/Makefile
index 0320b99..37e2846 100644
--- a/example_soc/synth/Makefile
+++ b/example_soc/synth/Makefile
@@ -1,6 +1,6 @@
 CHIPNAME=fpga_icebreaker
 DOTF=../fpga/fpga_icebreaker.f
-SYNTH_OPT=-retime
+SYNTH_OPT=-dsp
 
 DEVICE=up5k
 PACKAGE=sg48
diff --git a/example_soc/synth/fpga_icebreaker.pcf b/example_soc/synth/fpga_icebreaker.pcf
index 83bcafa..38b2d57 100644
--- a/example_soc/synth/fpga_icebreaker.pcf
+++ b/example_soc/synth/fpga_icebreaker.pcf
@@ -2,7 +2,14 @@
 set_io clk_osc 35
 
 # JTAG is on FTDI B channel so it doesn't inadvertently assert flash CS pin
-# (usually UART would be on the B channel)
+# (usually UART would be on the B channel).
+
+# Note TDO/TMS require two of the solder jumpers on the back of the board to
+# be bridged. On the v1.0e board these are jumpers J3/J4. To find these, look
+# for the box of 5 x 2 jumpers (with a few others hanging off the side) and
+# they are the two in the central column. They line up with the space in
+# between "Jump" and "for" in the silk text "Jump for FTDI FIFO".
+
 set_io tck  6 # FTDI BDBUS0
 set_io tdi  9 # FTDI BDBUS1
 set_io tdo 18 # FTDI BDBUS2
@@ -25,6 +32,11 @@ set_io uart_tx 14 # FTDI ADBUS1, flash MOSI, iCE SO (if jumper J15 connected)
 # set_io dpad_l 10 # Main board
 # set_io dpad_r 19 # Snapoff middle
 
+set_io mirror_tck 27 # Left on snapoff   (L2)
+set_io mirror_tms 25 # Right on snapoff  (L3)
+set_io mirror_tdi 23 # Top on snapoff    (L4)
+set_io mirror_tdo 21 # Bottom on snapoff (L5)
+
 # # LEDs
 # set_io led[0] 37 # Green on main board
 # set_io led[1] 11 # Red on main board