topic Re: JTAG / SWD Documentation in LPC Microcontrollers

JTAG / SWD Documentation

lpcware — Wed, 15 Jun 2016 18:36:34 GMT

Content originally posted in LPCWare by v0ynich on Thu Nov 13 11:50:17 MST 2014
Hello,

I'm looking for documentation regarding JTAG or SWD for programming an LPC4337. I wish to program this device using another microcontroller. In my case, USART0 and USART3 are not available for IAP. If you could send me in the right direction I would appreciate.

Thank you

Re: JTAG / SWD Documentation

lpcware — Wed, 15 Jun 2016 18:36:35 GMT

Content originally posted in LPCWare by mysepp on Thu Nov 13 13:25:23 MST 2014
I don't know if there is something ready to use, it is no easy task.
Have a look here for more detailed information (go down the tree on left side):

Google for "ddi0314h" (complete link is not accepted by spam filter, sorry)

Re: JTAG / SWD Documentation

lpcware — Wed, 15 Jun 2016 18:36:36 GMT

Content originally posted in LPCWare by v0ynich on Thu Nov 13 15:00:31 MST 2014
Thank you!

That's a start point. However I'm still struggling to find the commands for flash segment erasing, programming, reading, etc..
As far as I understand, this "Coresight" is the module responsible for handling the JTAG and SWD functions, right?

Re: JTAG / SWD Documentation

lpcware — Wed, 15 Jun 2016 18:36:36 GMT

Content originally posted in LPCWare by lpcxpresso-support on Thu Nov 13 15:48:23 MST 2014
The only way to program internal flash is through the IAP. There is nothing available through the Debug interface. So, to do this, you are going to need to download an application that then runs to program the flash. This is exactly how a debugger programs flash.

If you really want to go ahead with this, and it is not recommended and is a lot of work, you could start by looking at ARMs CMSIS-DAP. I understand that you can also get an implementation from ARM via mbed and the HDK.

Re: JTAG / SWD Documentation

lpcware — Wed, 15 Jun 2016 18:36:37 GMT

Content originally posted in LPCWare by v0ynich on Fri Nov 14 03:15:32 MST 2014

Quote: lpcxpresso-support
So, to do this, you are going to need to download an application that then runs to program the flash. This is exactly how a debugger programs flash.

Ok, perhaps I'm confused with the nomenclature. How does the debugger downloads the application ? In other words, what I'm trying to achieve is to mimic the flashing function of the debugger. I have the pins that I use to program the LPC4337 with the debugger also connected to another micro controller. This micro controller should be able to re-program the LPC4337 with new firmware.

Thank you

Re: JTAG / SWD Documentation

lpcware — Wed, 15 Jun 2016 18:36:38 GMT

Content originally posted in LPCWare by lpcxpresso-support on Fri Nov 14 03:48:29 MST 2014
It downloads via SWD or JTAG.

Assuming that you really do want to try to download a program into flash via SWD or JTAG, then you are basically going to have to implement most of the functionality of a debugger (gain control of the CPU, download data into RAM, setup the registers, start executing the program). Then you are going to need to communicate with that program to send it data and tell it to program the flash with the data that you send it.

Or, you might want to rethink what you are trying to do here...

Re: JTAG / SWD Documentation

lpcware — Wed, 15 Jun 2016 18:36:38 GMT

Content originally posted in LPCWare by R2D2 on Fri Nov 14 03:48:38 MST 2014

Quote: v0ynich
How does the debugger downloads the application ?

http://www.lpcware.com/content/blog/introduction-cortex-serial-wire-debugging-part-one

Re: JTAG / SWD Documentation

lpcware — Wed, 15 Jun 2016 18:36:39 GMT

Content originally posted in LPCWare by v0ynich on Wed Nov 19 03:49:59 MST 2014
Hello,

I understand that it is not an easy task. Could you please forward me to some documentation ragarding this?

Thank you

Re: JTAG / SWD Documentation

lpcware — Wed, 15 Jun 2016 18:36:39 GMT

Content originally posted in LPCWare by lpcxpresso-support on Wed Nov 19 04:54:08 MST 2014
The place to start is to read the ARM 'Coresight' documentation for the Cortex-M4. This is provided by ARM on their website. And, as mentioned previously, (subject to license) you may be able to use the mbed HDK.

Re: JTAG / SWD Documentation

lpcware — Wed, 15 Jun 2016 18:36:40 GMT

Content originally posted in LPCWare by v0ynich on Mon Nov 24 05:05:43 MST 2014
Thank you for the info.

At this moment I'm not being able to find which register I should access (using TAR and DRW) to erase the flash in the LPC4337.

Thank you

Re: JTAG / SWD Documentation

lpcware — Wed, 15 Jun 2016 18:36:40 GMT

Content originally posted in LPCWare by bavarian on Mon Nov 24 05:55:04 MST 2014
I think this requires some clarification:

[list]
[*] The internal flash is not connected in any way to the JTAG or SWD debug logic
[*] The debug logic itself also has no hardwired functionality to do operations on the flash
[/list]

As already pointed out:

[list]
[*] The only way to program the flash is to use the code which resides in the ROM of the LPC4300.
[*] The bootloader also uses this flash programming API to program the data it gets from one of the boot interfaces, for example from UART or USB.
[*] If you connect with JTAG, then you can use this interface to download an executable code to the ARM, which is then running this code, in order to stream some data over the JTAG channel and provide it to the flash programming API.
[*] So whatever you do, you always let the Cortex-M4 do the job, whatever type of interface you use for getting the data in.
[/list]

The hints to look into the specs from ARM are totally right, it's the only way to start. Then you could also look into this thread:

http://www.lpcware.com/content/forum/lpc1857-jtag-host-not-slave

Regards,
NXP Support Team.

Re: JTAG / SWD Documentation

lpcware — Wed, 15 Jun 2016 18:36:41 GMT

Content originally posted in LPCWare by v0ynich on Mon Nov 24 06:27:53 MST 2014
Thank you for the clarification. This kind of detailed information is really appreciated.

Quote:
The debug logic itself also has no hardwired functionality to do operations on the flash

But it can read/write to RAM, right?

Then let's assume that I want to use this approach:

Quote:
If you connect with JTAG, then you can use this interface to download an executable code to the ARM, which is then running this code, in order to stream some data over the JTAG channel and provide it to the flash programming API.

Please check if this is what I need to do:

1- "Allocate" RAM space for the iap_cmd and iap_res arrays
2- Write on R0 and R1 the addresses of iap_cmd and iap_res arrays
3- Call IAP with ERASE_SECTOR command
4- Check erasing progress (wait for return)
5- "Allocate" and write to RAM segments of the code that I want to flash
6- Call IAP with COPY_RAM_TO_FLASH command
7- Check flashing progress (wait for return)

Thank you

Re: JTAG / SWD Documentation

lpcware — Wed, 15 Jun 2016 18:36:42 GMT

Content originally posted in LPCWare by lpcxpresso-support on Mon Nov 24 07:25:49 MST 2014
Yes, you can read and write to RAM.

This sequence *may* work but it depends on how you are going to trap the return from the IAP routine(s). You are going to need a stack setup (and therefore the SP) and push a return address so that the IAP can return to something.

You may find it easier to download a small piece of ram-based code that actually makes the IAP calls for you. It can spin in a while(1) loop on completion enabling you to either set (and handle) a breakpoint on the return, or you could repeatedly read the PC to see if it returned to your while loop. This also has the advantage that you can debug the code (using a conventional debugger) before attempting to debug your JTAG/SWD code.

Re: JTAG / SWD Documentation

lpcware — Wed, 15 Jun 2016 18:36:42 GMT

Content originally posted in LPCWare by v0ynich on Thu Nov 27 16:48:12 MST 2014
Hello!

Thank you for your support!

New update:

At this moment and after initialized the SW-DP I'm able to read and write the RAM without any issue. All replies are the expected ones.

However I'm facing some problem when I try to read or write the DHCSR register to halt the core. The target answers "FAULT". By checking the CTRL/STAT register the Overrun flag is set after the read or write of DHCSR. I couldn't find any explanation in the literature for this behaviour.
I'm reading the DHCSR register as if it was normal RAM at address 0xE000EDF0. Do I need to take any special measure before this?

The command sequence:

-> Set reset state
-> JTAG to SWD sequence
-> Set reset state
-> Read IDCODE
-> Write CTRL/STAT with CTRLSTAT_CDBGPWRUPREQ and CTRLSTAT_CSYSPWRUPREQ
-> Read CTRL/STAT
-> Write SELECT with bank pointing to IDR
-> Read IDR
-> Write SELECT with bank that points to CSW, TAR and DRW
-> Write CSW with 0x02 (32bits)
-> Write to RAM
-> Read to RAM
-> Read DHCSR ---> FAULT

Any tips?

Thank you

Re: JTAG / SWD Documentation

lpcware — Wed, 15 Jun 2016 18:36:43 GMT

Content originally posted in LPCWare by MikeSimmonds on Thu Nov 27 21:37:47 MST 2014
Did you read the blog linked in post 5? It and the next three are very informative.

Initializing SWD.

The SWD protocol allows full control of an LPC microcontroller. Because of this, it is critical that the port be insensitive to noise under a wide range of design conditions. To make the SWD port insensitive to noise, an unlock or connection sequence must be executed before the port can be used. The unlock sequence consists of several different steps.

SWD Unlock Sequence Steps

step numberdescription
1The Host needs to switch the target from JTAG to SWD mode by clocking 0xE79E onto SWDCLK/SWDIO
2SWD connection sequence- clock out more than 50 binary 1s
3Must read the Debug Port IDCODE register (address 0)
4Turn on Debug Port by settings bits 28 and 30 at DP address 4
5Write AP select (debug port address 8) to 0xF0 (to prep for AP read of 0xFC)
6Unlock Access Port by reading AP ID register (AP address 0xFC)

From your description (code not shown), you may have missed steps 5 and 6.

There are actually 4 parts to this blog, the 4th, here, has code for an LPC1100 'adapter'
that you could take code sequences from.

HTH, Mike

Re: JTAG / SWD Documentation

lpcware — Wed, 15 Jun 2016 18:36:43 GMT

Content originally posted in LPCWare by v0ynich on Fri Nov 28 05:47:00 MST 2014
Hello,

Yes, I'm aware of those blog entries. I'm actually doing the steps 5 and 6 which are (in my description):

-> Write SELECT with bank pointing to IDR
-> Read IDR

Any attempt of write/read to the ARM private bus (0xE000 0000 to 0xE010 0000) where the DHCSR and other registers are results in FAULT.
Any write or read to the SRAM memory segment works perfectly.

=(

EDIT: Maybe something to do with the Memory Protection Unit (MPU) ?

EDIT2: Maybe this helps to ring a bell

here goes the description of read attempts in several memory segments

32kb local SRAM...................(0x1000 0000 - 0x1000 7FFF) -> OK
Reserved...............................(0x1000 8000 - 0x1007 FFFF) -> FAULT
32+8kb SRAM.......................(0x1008 0000 - 0x1008 9FFF) -> OK
64kb ROM.............................(0x1040 0000 - 0x1040 FFFF) -> OK
Flash Bank A.........................(0x1A00 0000 - 0x1A03 FFFF) -> OK
Flash Bank B.........................(0x1B00 0000 - 0x1A07 FFFF) -> OK
4x16kb AHB SRAM...............(0x2000 0000 - 0x2000 FFFF) -> OK
16kb EEPROM......................(0x2004 0000 - 0x2004 3FFF) -> OK
AHB Peripherals....................(0x4000 0000 - 0x4001 1FFF) -> OK
Clocking/Reset Peripherals...(0x4005 0000 - 0x4005 FFFF) -> OK
APB Peripherals #0...............(0x4008 0000 - 0x4008 FFFF) -> OK
High-speed GPIO..................(0x400F 4000 - 0x400F 7FFF) -> OK

ARM Private Bus...................(0xE000 0000 - 0xE000 0FFF) -> OK
ARM Private Bus...................(0xE000 1000 - 0xE009 FFFF) -> FAULT

This last one, is what I want to read/write in order to halt and run the processor and change the program counter.

Thank you

Re: JTAG / SWD Documentation

lpcware — Wed, 15 Jun 2016 18:36:44 GMT

Content originally posted in LPCWare by lpcxpresso-support on Fri Nov 28 18:26:56 MST 2014

I understand you've got low-level access to SW-DP, but you didn't make it clear what that is. Are you using CMSIS-DAP, or something else? To save time and trouble, our recommendation is to use an existing probe firmware (like CMSIS-DAP). I'd also recommend you not use overrun detection (if indeed it's enabled). We don't believe it's used by CMSIS-DAP. You can determine the success/fail status of the transaction when you read out the 3 bits of ACK. More information on this is found in the ARM documentation.

To halt the part requires you write a DBGKEY value in addition to the C_HALT and C_DEBUGEN bits. If you combine these, the halt "word" you write to DHCSR (0xE000EDF0) is 0xA05F0003. Has this been done?

Regards,
LPCXpresso Support

Re: JTAG / SWD Documentation

lpcware — Wed, 15 Jun 2016 18:36:45 GMT

Content originally posted in LPCWare by MikeSimmonds on Mon Dec 01 08:04:23 MST 2014
V0ynich, did you resolve your issue with the debug registers?
If you did, can you share the 'trick' or 'step' required for access?

Regards, Mike

Re: JTAG / SWD Documentation

lpcware — Wed, 15 Jun 2016 18:36:45 GMT

Content originally posted in LPCWare by v0ynich on Mon Dec 01 08:41:16 MST 2014
Hello,

Yes, I solved it. I needed to set the DBSTATUS, MASTERTYPE and HPROT bits also in the CSW register to be able to access the addresses that were giving me the error. No idea which one made the trick.

lpcxpresso-support: The FAULT and OK "responses" in my last post were the 3-bit ACK. Yes, I'm using a customized CMSIS-DAP

At this moment I'm able to run, halt and reset the CPU. A flashloader was loaded to RAM and the program counter set to 0x100002F9 (which is the ResetISR -> entry point according to the .map file) However, I'm facing two problems:

- I'm only able to change the state of the program counter when the CPU is running. If I do it with the CPU halted it has no effect. The previous value remains.

- The program counter stays still (@ 0x100002F9 ResetISR). I have ensured that the CPU is not halted and it is not in sleep mode. The interrupt requests are disabled. If a read the CYCCNT register I can notice that it is being incremented.

Ideas?

Thank you

Re: JTAG / SWD Documentation

lpcware — Wed, 15 Jun 2016 18:36:46 GMT

Content originally posted in LPCWare by lpcxpresso-support on Mon Dec 01 11:44:54 MST 2014
ResetISR implementations usually require a stack. Have you provided one? Also, is the VTOR register initialized to your RAM vector table address?

LPCXpresso Support