Programming internal SRAM over SWD

Programming internal SRAM over SWD

1. Introduction

This documentation describe how to programming ARM Cortex M3 internal SRAM over SWD(Serial Wire Debug) interface. For this purpose, something we too know.

• SWD communication protocol.
  We need to know Low level timing requirement, that is foundation to exchange command and data between debugger and target MCU.
• Read/write data from/to internal SRAM.
  We need to know how to program firmware into desired address, like SRAM(0x20000000). That needs us to know SW-DAP registers usage. Pass address and data over those registers and then into internal SRAM.
• Make code running from SRAM.
  We need to change vector table entry from internal flash to SRAM; And SP and PC also needed change to SRAM location. That need us to know the cortex M3 debug and system registers usage.

We choose Silabs SiM3U167 as target MCU in this implementation. We implement a high level protocol with python script, it calls Silabs provided DLL file interface to access Silabs USB Debug Adapter. Also, we provide a firmware running from C8051F380, it contains a full implementation on both low level communicating timing and high level programming SRAM protocol.

2. Serial Wire Debug overview

Serial Wire Debug (SWD) is a 2-pin (SWDIO/SWCLK) electrical alternative JTAG interface that has the same JTAG protocol on top. SWD uses an ARM CPU standard bi-directional wire protocol, defined in the ARM Debug Interface v5. This enables the debugger to become another AMBA bus master for access to system memory and peripheral or debug registers.

The Debug Access Port(DAP) is split into two main control units. the Debug Port (DP) and the Access Port (AP), and the physical connection to the debugger is part of the DP. The DAP supports two types of access, Debug Port (DP) accesses and Access Port (AP)accesses. External device to communicate directly with Serial Wire Debug Port(SW-DP) over SWDIO/SCLK pins. And SW-DP in turn can access one or several Access Ports(APs) the give access to the rest of the system. The MEM-AP is important AP which provide a way to access all memory and peripheral registers residing on the internal AHB/APB buses.

Figure 1 ARM Debug Interface MEM-AP Implementation

One of the four registers within the DP is the AP Select Register, SELECT. This register specifies a particular Access Port, and a bank of four 32-bit words within the register map of that AP. It enables up to 256 Access Ports to be implemented, and gives access to any one of 16 four-word banks of registers on the selected AP.

3. SWD protocol

This section gives an overview of the bi-directional operation of the protocol. It illustrates each of the possible sequences of operations on the Serial Wire Debug interface data connection.

3.1. Connection and line reset sequence

The SW-DP must use connection sequence of 50 clock cycles with data = 1. And this sequence is also used as a line reset sequence which requires 50 consecutive 1s on the data input.

JTAG to SWD switching

SWJ-DP enables either an SWD or JTAG protocol to be used on the debug port. To do
this, it implements a watcher circuit that detects a specific 16-bit selection sequence on the SWDIOTMSpin:

The 16-bit JTAG-to-SWD select sequence is defined to be 0b0111100111100111, MSB first. This can be represented as 16’h79E7 if transmitted MSB first or 16’hE79E if transmitted LSB first.

The host must read IDCODE register after line request sequence. This requirement gives confirmation that correct packet frame alignment has been achieved.

3.2. Successful transaction operation

A successful transaction contains three phases.

• Host sending an eight-bit write packet request to target.
• Target response with a three-bit OK acknowledge to host.
• A 33-bit data phase, either from host or target depends on write/read operation.

Figure 2 Serial Wire Debug successful write operation

3.2.1. Packet request phase

The request phase consists of 8 bits. The meaning of each bit in the request is illustrated below.

• Start – A single start bit, with value 1.
• APnDP – A single bit, indicating whether the Debug Port or the Access Port Access Register is to be accessed. 1 for accessing AP.
• RnW – A single bit, this bit is 0 for an write access, or 1 for a read access.
• A[2:3] – Two bits, giving the A[3:2] address field for the DP or AP register address.
• Parity – A single odd parity bit is made over the APnDP, RnW and A[2:3] bits. The number of bits set to 1 is odd, then the parity bit is set to 1.
• Stop – A single stop bit. In the synchronousSWD protocol this is always 0.
• Park – A single bit, with value 1.

3.2.2. Acknowledge response phase

ACK phase is a three-bit(LSB-first) target to host response. Three type ACK response.

• OK Response – It indicates successful operation, value is b001.
• WAIT response – The host must retry the operation later, value is b010.
• FAULT response – If the target responds with FAULT, an error has occurred
  and one of the sticky bits in CTRL/STAT is set. The host can check the sticky error bits to see what kind of error has occurred. It must clear the sticky bits in ABORT register before using any AP commands, because the target will always respon