How to use ft2232h adapter and openocd to debug the SWD interface of arm cortex M Series MCU

Because our company needs to develop its own burning tool , I passed google Search related documents and see ARM The company's technical documentation , Finally realized this function . Because it involves a lot of content and knowledge , I plan to 5 This is a detailed introduction . The main purpose is to record the work results in the form of work log . This article introduces How to use FT2232H Adapters and open source mode tools OpenOCD Yes ARM Cortex M series MCU Conduct SWD Interface debugging ？

Why did I choose FT2232HL/CMSIS-DAP Debugger tools ？

There are many debugging tools on the market, such as Segger-JLINK,ARM Keil ULINK,ST-LINK,CMSIS-DAP/DAP-LINK wait .

 J-Link

J-Link Is the most famous ARM Develop debugging tools ,J-Link from SEGGER The company produces . It's available for almost all of the ARM Kernel chip support . The latest version of J-Link The products are J-LINK PRO,J-LINK ULTRA+,J-LINK WiFi,J-LINK PLUS,J-LINK BASE,J-LINK EDU,J-LINK OB wait ,PRO/ULTRA+/WiFi/PLUS/BASE Support JTAG and SWD Pattern . And for the main IDE The environment is like KEIL、IAR All have good support . There are many advantages , So it's also the preferred debugging tool . The new version J-LINK The stronger the function, the higher the official price ,J-LINK PRO The price is about €798.00. For more details, please see SEGGER J-Link Product details . There used to be a lot of piracy on Taobao , Now? JLINK Self protection is safe , Once you want to support more advanced version features , Upgrade online because license Problems make it impossible to continue to use , Now in Taobao basic rarely see piracy J-LINK.

ULINK

ULINK yes ARM The official debugging tool ,KEIL Produce .ULINK It can also support most of the ARM chip , Yes KEIL Our support is very good , yes KEIL The default debugging tool for . The disadvantage is that it doesn't support IAR, Affected ULINK Promotion of .ULINK The government provides circuit diagrams and other information , It's semi open , You can do it yourself .
UNLINK The product description link is as follows ULINK debug and trace adapters.ULINK The more powerful a product is, the more expensive it is .ULINKpro The price is about $1,250.00. The key Keil Compile and debug environment (Microcontroller Development Kit) MDK-Professional Now it's basically sold every year License. One License The price of a year is$4,560.00. 

ST-LINK

ST-LINK You can buy... Separately , It can also be done through ST The company's development board comes with ,Discovery The lowest price of the development board is less than ￥100. On board ST-LINK Can simulate ST All of the company ARM chip .ST-LINK Except support ST The company's ARM MCU（M3 Kernel STM32F1、F2,M4 Kernel F4、F3 as well as M0 Kernel F0）, And support STM8 series .ST-LINK The current version of is ST-LINK V2. Although the information is basically open , But since the cost is not high , There's no need to be self-made . and ST Company supporting development environment STM32CubeIDE and STM32CubeProg It's all free . Why? ST It's now Cortex M The best reason to sell is also because ST-LINK Cheap and the corresponding development and debugging software is free and rich .

CMSIS DAP/DAP-Link

CMSIS-DAP Debugger Now it's very common in the market . What is? CMSIS? What is? CMSIS-DAP？
CMSIS： Cortex Microcontroller Software Interface Standard, namely Cortex Microcontroller software interface standard
CMSIS-DAP is a specification and a implementation of a Firmware that supports access to the CoreSight Debug Access Port (DAP). CMSIS-DAP Support a wide variety of Cortex processor CoreSight Debug and trace .CMSIS-DAP Provide a standardized interface for debuggers , Support 5 Line JTAG or 2 Line SWD, Its firmware is provided as source code .CMSIS DAP V2.0.0 ,CMSIS V5 Open source and For more details ...
CMSIS-DAP benefits , Hardware design is open source , Open source .STM32 CMSIS DAP Open source resources and IBDAP-CMSIS-DAP-JTAG-SWD-Debug-Adapter Open source resources .
DAP-Link yes CMSIS-DAP Upgraded version . advantage ： Drag burn 、 Update Firmware . It includes CMSIS-DAP The advantages of ： Open source + Virtual serial port + No drive . It's on sale on Taobao Muse Lab CMSIS DAP/DAPLink Emulator STM32 Debugger downloader Keil JTAG/SWD/ A serial port

CJMCU-2232 FT2232

CJMCU-2232 FT2232 It's actually a USB to UART FIFO SPI I2C JTAG RS232 Development board . The advantage is that it doesn't need firmware support , It only needs USB Drive support . There is no risk of firmware update or loss . The price is also suitable for Taobao RMB 60 about 【 You Xin Electronics 】FT2232HL Two channels USB turn UART/FIFO/SPI/I2C/JTAG/RS232. Software support without support , however OPENCOD Support , Debugging access and online source debugging are completely realized by scripts .

Advantages and disadvantages ：

J-LINK and U-LINK For big companies with a lot of money , This cost is nothing , But it involves tens of thousands of employees, and the cost of using it is quite a lot .
ST-LINK There are some limitations , Only applicable to ST The company's STM32 chip .
CJMCU-2232 FT2232 It's suitable for those who have a certain ARM Embedded development foundation , And for the ARM Debugging interface is more familiar with the advanced program . Big / It's suitable for small companies, but it needs professionals to develop .
CMSIS-DAP Debugger For companies with less capital , Some start-ups or colleges are the best choice for college students , Because both hardware and software are open source , You can do it yourself , Because it's cheap, you can buy it directly from Taobao .

Why did I choose CJMCU-2232 FT2232 It's also forced to be helpless , Our company has been using our own blue box tool for a long time , The chip inside is FT2232D. Almost all employees around the world use . Must develop the corresponding debugging and burning tools .

How to connect FT2232HL Debuger Adapter And the target board Of SWD Debug interface ？

from OPENOCD Open source code https://sourceforge.net/p/openocd/code/ci/master/tree/tcl/interface/ftdi/swd-resistor-hack.cfg describe ：

The line connection is very clear .FTDI FT2232D Chip side TDI and TDO Connect a (220~470 Ohm resistance ), And then TDO Connected to the target board SWDIO The signal , TCK Connect... On the target board SWCLK The signal .

We from FT2232D Of PIN The definition shows the reality PIN The foot connections are as follows ：

   VCC                                           --> VCC
   (AD0) ADBUS0 (PIN #16)  TCK  --> SWCLK
   (AD2) ADBUS2 (PIN #18)  TDO --> SWDIO
   GND                                          --> GND

Debuger Adapter After connecting with the target board , Next we can use OPENOCD Connect the target board .OPENOCD We can refer to the environment construction How to build OpenOCD The environment is based on Window10+Cygwin？

How to understand Debuger Adapter And target board CPU The configuration file ？

In use OPENOCD Before connecting to the target board , We have to prepare two profiles , One is FT2232D Debuger Adapter The configuration file , One is the configuration file of the target board . You can also make a configuration file . It'll be better to make two OPENOCD Use .Debuger Adapter Generally placed on ..\scripts\interface\ftdi\ Catalog . The configuration file of the target board is usually placed in ..\scripts\target\ Catalog .

 

#
# Connect TDI to SWDIO via a suitable series resistor (220-470 Ohm or
# so depending on the drive capability of the target and adapter);
# connect TDO directly to SWDIO.
#
# You also need to have reliable GND connection between the target and
# adapter. Vref of the adapter should be supplied with a voltage equal
# to the target's (preferrably connect it to Vcc). You can also
# optionally connect nSRST. Leave everything else unconnected.
#
# FTDI                          Target
# ----                          ------
# 1  - Vref   ----------------- Vcc
# 3  - nTRST  -
# 4  - GND    ----------------- GND
# 5  - TDI    ---/\470 Ohm/\--- SWDIO
# 7  - TMS    -
# 9  - TCK    ----------------- SWCLK
# 11 - RTCK   -
# 13 - TDO    ----------------- SWDIO
# 15 - nSRST  - - - - - - - - - nRESET
#
#
# FTDI FT2232HL
#
# https://ftdichip.com/products/ft2232hl/
#

adapter driver ftdi

# select swd interface protocol 
transport select swd

# FT2232D has two USB Serial Converter A/B VendorID (0x0403)  DeviceID (0x6010)
# USB Serial Converter A ADBUS
# USB Serial Converter B ACBUS

ftdi_vid_pid 0x0403 0x6010

# ftdi_device_desc description
#  Specifies the descriptor of the debugger .

# ftdi_serial serial-number
#  Specifies the debugger's Serial Number.

# ftdi_channel channel
#  Appoint FTDI The equipment Channel. Corresponding FT232H Come on , Only Channel 0（ Default ）,FT2232H/FT4232H yes Channel 0 and Channel 1.

adapter speed 1000

# ftdi_layout_init [data] [direction]
#  Appoint FTDI GPIO The initial data and direction of ,16bit Data width .
#  Parameters data in 1 High level ,0 Indicates low level , And the parameters direction in 1 Indicative output ,0 Indicates input （ Note that this is different from the normal setting ）
ftdi_layout_init 0x0018 0x05fb
# This means:              ADBUS(bit7~bit0)
# Low output data = 0x18 // 0001  1000
# Low direction   = 0xfb // 1111  1011
# High direction  = 0x05 // 0000  0101

#  By default JTAG, If you want to use SWD, You need to configure SWD_EN.
ftdi_layout_signal SWD_EN -data 0
# ftdi_layout_signal name [-data|-ndata data_mask] [-input|-ninput input_mask] [-oe|-noe oe_mask] [-alias|-nalias name]
#  Create a name for name The signal of .
# [-data|-ndata data_mask] 
# data_mask:pin mask ndata:invert -data:normal bit
# data_mask It's corresponding to pin The mask of the foot ,-ndata Indicates that the input data is reversed ,-data The reverse is not true .
# [-input|-ninput input_mask] 
# input_mask:pin mask -input:input pin enable -ninput:input pin disable
# input_mask： Indicates correspondence pin Whether the foot is input ,-input Indicates input ,-ninput Represents a non input .
# [-oe|-noe oe_mask]  
# oe_mask:pin mask -oe:output pin enable noe:output pin disable
# oe_mask： Indicates correspondence pin Whether the foot is output ,-oe Indicative output ,-noe Represents a non output .
# [-alias|-nalias name] 
# -alias:Normal logic -nalias:Opposite logic
#  If you use -alias（ or -nalias）, The signal created is the same （ Or data inversion ） To the specified signal name .

ftdi_layout_signal nSRST -data 0x0010

# ftdi_set_signal name 0|1|z
#  The output signal 
# -0： Low output 
# -1： High output 
# -z： Set to high resistance state 

# ftdi_get_signal name
#  Read the signal 

# ftdi_tdo_sample_edge rising|falling
# -rising, TCK Rising edge sampling TDO, Default 
# -falling, TCK Falling edge sampling TDO

stay ftdi_ft2232d.cfg The notes in the document have clearly described each of them for debuger adatper Configuration command of .

 Here is the configuration file of the target board I wrote nxp_s32k3x4.cfg
# script for s32k3xx family
#
# s32k3xx devices support both JTAG and SWD transports.
#  The following two files are required because they involve JTAG  and  SWD  The interface is universal , Even if you are SWD Instead of JTAG It's supported in the same way as scripts 
source [find target/swj-dp.tcl]
source [find mem_helper.tcl]

#  If the chip name does not exist, use s32k3xx Name the chip 
if { [info exists CHIPNAME] } {
   set _CHIPNAME $CHIPNAME
} else {
   set _CHIPNAME s32k3xx
}

#  Set the chip size format 
   set _ENDIAN little

#  To load RAM BIOS ELF file , Set up 256KB Of RAM Space and ready to clear 
# Work-area is a space in RAM used for flash programming
# By default use 256kB
if { [info exists WORKAREASIZE] } {
   set _WORKAREASIZE $WORKAREASIZE
} else {
   set _WORKAREASIZE 0x40000
}

#  Check the chip's DAP/TAP Of ID Whether it is 0x6ba00477, Cortex M7 Of DAP ID Uniform for 0x6ba00477
#jtag scan chain
if { [info exists CPUTAPID] } {
   set _CPUTAPID $CPUTAPID
} else {
   if { [using_jtag] } {
      # See STM Document RM0385
      # Section 40.6.3 - corresponds to Cortex-M7 with FPU r1p2
      set _CPUTAPID 0x6ba00477
   } {
      set _CPUTAPID 0x6ba02477
   }
}

#  testing _CPUTAPID Is it right? 0x6ba02477, If the chip was created DAP, establish DAP After the interface, you can go through DAP Access all the chips AP Interface register .
swj_newdap $_CHIPNAME armv7m -irlen 4 -ircapture 0x1 -irmask 0xf -expected-id $_CPUTAPID
dap create $_CHIPNAME.dap -chain-position $_CHIPNAME.armv7m

if {[using_jtag]} {
   jtag newtap $_CHIPNAME bs -irlen 5
}

global TARGET

set TARGET       $_CHIPNAME.armv7m
set TARGET_MEMAP $_CHIPNAME.memap

#  Create chips  Target, In the process, through DAP Interface search all AP.
#  because NXP S32K344 There are many cortex_m  Kernel interconnection MEM AP. It can lead to target_examine Failure .
#  Because I know S32K344 Of Cortex M7 core 0 Of MEM AP by 4, So I specify the search -ap-num 4
target create ${TARGET}.cm7_0    cortex_m -endian $_ENDIAN -dap $_CHIPNAME.dap -ap-num 4 -coreid 0

#  must init target dependent dap mmw mdw  Before the script is successfully called , No, and then report an error .
init

#  I am here ftdi_ft2232d.cfg in , I set up ADBUS4 The pins are the hardware of the target board RST
#  Hardware reset 
ftdi_set_signal nSRST 0
#  Time delay 100ms
adapter srst delay 100
#  Hardware reset 
ftdi_set_signal nSRST 1

#  Be careful ： because S32K344 Of debug  Mode is not on by default , Need to pass through DAP visit SDA-AP Can make Debug Pattern 
#  If not enabled DAP It's not accessible Cortex M7 core 0 Of MEM AP
# Enable Cortex-M7 Core0 debug request
s32k3xx.dap  apreg 7 0x80 0x300000f0

#  Reset Cortex-M7 Core0 Internal register configuration 
cortex_m reset_config sysresetreq
cortex_m reset_config vectreset

#  Start debug mode , Give Way Cortex-M7 Core0 halt Wait for the next load command .
halt

#  To load RAM BIOS ELF file , Set up 256KB Of RAM Space and ready to clear 
${TARGET}.cm7_0 configure -work-area-phys 0x20400000 -work-area-size $_WORKAREASIZE -work-area-backup 0	
#  Here is the loading I specially prepared to achieve the burning function RAM ELF file . The RAM ELF By debugging the serial port UART Realization FLASH File burning .
#  Pay attention to load_image You have to put target halt.
load_image D:/Work_Data/my_projects/S32K344_EVB/xpack-openocd-0.10.0-15-win32-x64/xpack-openocd-0.10.0-15/bin/Dio_example_DS.elf
#  Here I am RAM ELF The starting address is 0x20400010, It is specified here that from 0x20400010 recovery .resume  It's a PC Pointer to 0x20400010, The release of the debug  Pattern .
resume 0x20400010

# Here is Target event , In fact, it has to be implemented in a way similar to the function hook in our code .
#  Because every chip has to Target Events The treatment is different . These events need special treatment 

#  because S32K3 The particularity of the chip , If not enabled DAP It's not accessible Cortex M7 core 0 Of MEM AP.
#  So I added SDA AP Enable in examine-start, Make sure that the target_examine Before, the physical pathway was open .
${TARGET}.cm7_0 configure -event examine-start {
	# Enable Cortex-M7 Core0 debug request
	s32k3xx.dap  apreg 7 0x80 0x300000f0
}

#  In order to be in Telnel perhaps gdb Launch during debugging reset init/halt
${TARGET}.cm7_0 configure -event reset-init {
	# Keep the old DEMCR value.
	set old [mrw 0xE000EDFC]
    mww 0xE000ED08 0x20430000
	# Enable vector catch on reset.
	mww 0xE000EDFC 0x01000001

	# Issue local reset via AIRCR.
	mww 0xE000ED0C 0x05FA0001

	# Restore old DEMCR value.
	mww 0xE000EDFC $old

	cortex_m reset_config sysresetreq
	cortex_m reset_config vectreset

	mww 0x402DC140 0x00000001 1
	mww 0x402DC144 0x00000001 1
	
	mww 0x402DC134 0x0000F7DF 1
	mww 0x402DC100 0x00000001 1
	mww 0x402DC104 0x00000001 1
	mww 0x402DC000 0x00005AF0 1
	mww 0x402DC000 0x0000A50F 1
	
	mww 0x402DC330 0xB1E0FFF8 1
	mww 0x402DC334 0x812AA407 1
	mww 0x402DC338 0xBBF3FE7E 1
	mww 0x402DC33C 0x00000141 1
	mww 0x402DC300 0x00000001 1
	mww 0x402DC304 0x00000001 1
	mww 0x402DC000 0x00005AF0 1
	mww 0x402DC000 0x0000A50F 1
	
	mww 0x402DC530 0x29FFFFF0 1
	mww 0x402DC534 0xC48987F9 1
	mww 0x402DC500 0x00000001 1
	mww 0x402DC504 0x00000001 1
	mww 0x402DC000 0x00005AF0 1
	mww 0x402DC000 0x0000A50F 1
	
	# Disable WATCHDOG
	mwb 0x40280003 0x80 1
	mww 0x40210020 0x00400000 1
	mww 0x40210024 0x03030000 1
	mww 0x40210028 0x00050000 1
	mww 0x4021002C 0x00000000 1
	
	mww 0x40210030 0x20400000 1
	mww 0x40210034 0x00080008 1
	mww 0x40210038 0xFFFB0000 1
	mww 0x4021003C 0x00000001 1
}

Running OPENOCD It has to be installed before SysProgs USB Driver Tool.
Processing is used for OpenOCD Of USB Drivers can be cumbersome , Especially in Windows On . SysProgs USB Driver tools simplify a lot of operations ：
• from https://visualgdb.com/UsbDriverTool Download the tool and install （ actually , It just unzips the file into the folder of your choice ）
• Run the tool

notice USB Serial Converter A/B Vendor ID 0403 Device ID 6010 Of the two USB equipment .

choice USB Serial Converter A, Put it's USB The driver is installed into WinUSB.

hold ftdi_ft2232d.cfg and nxp_s32k3x4.cfg Copy to the directory you want to run . My catalog here is D:\cygwin64\home\$user

$ openocd.exe  -f ftdi_ft2232d.cfg -f nxp_s32k3x4.cfg
Open On-Chip Debugger 0.11.0 (2021-03-23-12:47)
Licensed under GNU GPL v2
For bug reports, read
        http://openocd.org/doc/doxygen/bugs.html
Info : FTDI SWD mode enabled
Error: libusb_open() failed with LIBUSB_ERROR_NOT_SUPPORTED  # Ignore these two mistakes 
Error: libusb_open() failed with LIBUSB_ERROR_NOT_SUPPORTED
Info : clock speed 1000 kHz
Info : SWD DPIDR 0x6ba02477
Info : s32k3xx.armv7m.cm7_0: hardware has 8 breakpoints, 4 watchpoints
Info : starting gdb server for s32k3xx.armv7m.cm7_0 on 3333
Info : Listening on port 3333 for gdb connections
Info : Listening on port 6666 for tcl connections
Info : Listening on port 4444 for telnet connections

OPENOCD The default debug information level is 2, If you want to see more debugging information, the command is as follows ：

$ openocd.exe  -f ftdi_ft2232d.cfg -f nxp_s32k3x4.cfg -d3
Open On-Chip Debugger 0.11.0 (2021-03-23-12:47)
Licensed under GNU GPL v2
For bug reports, read
        http://openocd.org/doc/doxygen/bugs.html
User : 13 3 options.c:63 configuration_output_handler(): debug_level: 3
User : 14 5 options.c:63 configuration_output_handler():
Debug: 15 7 options.c:244 add_default_dirs(): bindir=/usr/local/bin
Debug: 16 8 options.c:245 add_default_dirs(): pkgdatadir=/usr/local/share/openocd
Debug: 17 10 options.c:246 add_default_dirs(): exepath=/usr/local/bin
Debug: 18 12 options.c:247 add_default_dirs(): bin2data=../share/openocd
Debug: 19 14 configuration.c:42 add_script_search_dir(): adding C:/Users/wezhu/AppData/Roaming/OpenOCD
Debug: 20 16 configuration.c:42 add_script_search_dir(): adding /home/WeZhu/.config/openocd
Debug: 21 18 configuration.c:42 add_script_search_dir(): adding /home/WeZhu/.openocd
Debug: 22 20 configuration.c:42 add_script_search_dir(): adding /usr/local/bin/../share/openocd/site
Debug: 23 23 configuration.c:42 add_script_search_dir(): adding /usr/local/bin/../share/openocd/scripts
Debug: 24 25 configuration.c:97 find_file(): found ftdi_ft2232d.cfg
Debug: 25 26 command.c:146 script_debug(): command - adapter driver ftdi
Debug: 27 28 command.c:146 script_debug(): command - transport select swd
Info : 28 30 ftdi.c:1035 ftdi_swd_init(): FTDI SWD mode enabled
Debug: 29 31 command.c:146 script_debug(): command - ftdi_vid_pid 0x0403 0x6010
Debug: 31 33 command.c:146 script_debug(): command - adapter speed 1000
Debug: 33 35 core.c:1822 jtag_config_khz(): handle jtag khz
Debug: 34 37 core.c:1785 adapter_khz_to_speed(): convert khz to interface specific speed value
Debug: 35 39 core.c:1785 adapter_khz_to_speed(): convert khz to interface specific speed value
Debug: 36 41 command.c:146 script_debug(): command - ftdi_layout_init 0x0018 0x05fb
Debug: 38 42 command.c:146 script_debug(): command - ftdi_layout_signal SWD_EN -data 0
Debug: 40 44 command.c:146 script_debug(): command - ftdi_layout_signal nSRST -data 0x0010
……
……
Debug: 206 1311 ftdi.c:648 ftdi_initialize(): ftdi interface using shortest path jtag state transitions
Debug: 207 1363 mpsse.c:422 mpsse_purge(): -
Debug: 208 1366 mpsse.c:703 mpsse_loopback_config(): off
Debug: 209 1369 mpsse.c:748 mpsse_set_frequency(): target 1000000 Hz
Debug: 210 1372 mpsse.c:740 mpsse_rtck_config(): off
Debug: 211 1376 mpsse.c:729 mpsse_divide_by_5_config(): off
Debug: 212 1379 mpsse.c:709 mpsse_set_divisor(): 29
Debug: 213 1388 mpsse.c:772 mpsse_set_frequency(): actually 1000000 Hz
Debug: 214 1395 core.c:1785 adapter_khz_to_speed(): convert khz to interface specific speed value
Debug: 215 1399 core.c:1789 adapter_khz_to_speed(): have interface set up
Debug: 216 1406 mpsse.c:748 mpsse_set_frequency(): target 1000000 Hz
Debug: 217 1410 mpsse.c:740 mpsse_rtck_config(): off
Debug: 218 1418 mpsse.c:729 mpsse_divide_by_5_config(): off
Debug: 219 1430 mpsse.c:709 mpsse_set_divisor(): 29
Debug: 220 1432 mpsse.c:772 mpsse_set_frequency(): actually 1000000 Hz
Debug: 221 1441 core.c:1785 adapter_khz_to_speed(): convert khz to interface specific speed value
Debug: 222 1446 core.c:1789 adapter_khz_to_speed(): have interface set up
Info : 223 1452 core.c:1565 adapter_init(): clock speed 1000 kHz
Debug: 224 1462 openocd.c:157 handle_init_command(): Debug Adapter init complete
Debug: 225 1466 command.c:146 script_debug(): command - transport init
Debug: 227 1475 transport.c:239 handle_transport_init(): handle_transport_init
Debug: 228 1480 command.c:146 script_debug(): command - dap init
Debug: 230 1486 arm_dap.c:106 dap_init_all(): Initializing all DAPs ...
Debug: 231 1497 ftdi.c:1209 ftdi_swd_switch_seq(): JTAG-to-SWD
Info : 233 1500 adi_v5_swd.c:136 swd_connect(): SWD DPIDR 0x6ba02477
Debug: 234 1510 arm_adi_v5.c:653 dap_dp_init(): s32k3xx.dap
Debug: 235 1514 arm_adi_v5.c:698 dap_dp_init(): DAP: wait CDBGPWRUPACK
Debug: 236 1521 arm_adi_v5.h:506 dap_dp_poll_register(): DAP: poll 4, mask 0x20000000, value 0x20000000
Debug: 237 1532 arm_adi_v5.c:706 dap_dp_init(): DAP: wait CSYSPWRUPACK
Debug: 238 1538 arm_adi_v5.h:506 dap_dp_poll_register(): DAP: poll 4, mask 0x80000000, value 0x80000000
Debug: 239 1552 openocd.c:174 handle_init_command(): Examining targets...
Debug: 240 1563 target.c:1644 target_call_event_callbacks(): target event 19 (examine-start) for core s32k3xx.armv7m.cm7_0
Debug: 241 1569 arm_adi_v5.c:776 mem_ap_init(): MEM_AP Packed Transfers: enabled
Debug: 242 1576 arm_adi_v5.c:787 mem_ap_init(): MEM_AP CFG: large data 0, long address 0, big-endian 0
Debug: 243 1584 target.c:2406 target_read_u32(): address: 0xe000ed00, value: 0x411fc272
Debug: 244 1587 cortex_m.c:2194 cortex_m_examine(): Cortex-M7 r1p2 processor detected
Debug: 245 1596 cortex_m.c:2206 cortex_m_examine(): cpuid: 0x411fc272
Debug: 246 1600 target.c:2406 target_read_u32(): address: 0xe000ef40, value: 0x10110021
Debug: 247 1611 target.c:2406 target_read_u32(): address: 0xe000ef44, value: 0x11000011
Debug: 248 1619 cortex_m.c:2226 cortex_m_examine(): Cortex-M7 floating point feature FPv5_SP found
Debug: 249 1629 target.c:2406 target_read_u32(): address: 0xe000edf0, value: 0x01010001
Debug: 250 1633 target.c:2494 target_write_u32(): address: 0xe000edfc, value: 0x01000000
Debug: 251 1643 target.c:2406 target_read_u32(): address: 0xe0002000, value: 0x10000081
Debug: 252 1646 target.c:2494 target_write_u32(): address: 0xe0002008, value: 0x00000000
Debug: 253 1654 target.c:2494 target_write_u32(): address: 0xe000200c, value: 0x00000000
Debug: 254 1664 target.c:2494 target_write_u32(): address: 0xe0002010, value: 0x00000000
Debug: 255 1669 target.c:2494 target_write_u32(): address: 0xe0002014, value: 0x00000000
Debug: 256 1678 target.c:2494 target_write_u32(): address: 0xe0002018, value: 0x00000000
Debug: 257 1683 target.c:2494 target_write_u32(): address: 0xe000201c, value: 0x00000000
Debug: 258 1690 target.c:2494 target_write_u32(): address: 0xe0002020, value: 0x00000000
Debug: 259 1694 target.c:2494 target_write_u32(): address: 0xe0002024, value: 0x00000000
Debug: 260 1700 cortex_m.c:2308 cortex_m_examine(): FPB fpcr 0x10000081, numcode 8, numlit 0
Debug: 261 1708 target.c:2406 target_read_u32(): address: 0xe0001000, value: 0x40000000
Debug: 262 1712 cortex_m.c:2024 cortex_m_dwt_setup(): DWT_CTRL: 0x40000000
Debug: 263 1719 target.c:2406 target_read_u32(): address: 0xe0001fbc, value: 0x00000000
Debug: 264 1730 cortex_m.c:2031 cortex_m_dwt_setup(): DWT_DEVARCH: 0x0
Debug: 265 1733 target.c:2494 target_write_u32(): address: 0xe0001028, value: 0x00000000
Debug: 266 1743 target.c:2494 target_write_u32(): address: 0xe0001038, value: 0x00000000
Debug: 267 1751 target.c:2494 target_write_u32(): address: 0xe0001048, value: 0x00000000
Debug: 268 1763 target.c:2494 target_write_u32(): address: 0xe0001058, value: 0x00000000
Debug: 269 1767 cortex_m.c:2078 cortex_m_dwt_setup(): DWT dwtcr 0x40000000, comp 4, watch/trigger
Info : 270 1776 cortex_m.c:2318 cortex_m_examine(): s32k3xx.armv7m.cm7_0: hardware has 8 breakpoints, 4 watchpoints
Debug: 271 1784 target.c:1644 target_call_event_callbacks(): target event 21 (examine-end) for core s32k3xx.armv7m.cm7_0
Debug: 272 1799 command.c:146 script_debug(): command - flash init
Debug: 274 1806 tcl.c:1324 handle_flash_init_command(): Initializing flash devices...
Debug: 275 1818 command.c:146 script_debug(): command - nand init
Debug: 277 1822 tcl.c:498 handle_nand_init_command(): Initializing NAND devices...
Debug: 278 1827 command.c:146 script_debug(): command - pld init
Debug: 280 1832 pld.c:206 handle_pld_init_command(): Initializing PLDs...
Info : 281 1841 gdb_server.c:3503 gdb_target_start(): starting gdb server for s32k3xx.armv7m.cm7_0 on 3333
Info : 282 1850 server.c:310 add_service(): Listening on port 3333 for gdb connections
Debug: 283 1858 command.c:146 script_debug(): command - s32k3xx.dap apreg 7 0x80 0x300000f0
Info : 285 1864 server.c:310 add_service(): Listening on port 6666 for tcl connections
Info : 286 1870 server.c:310 add_service(): Listening on port 4444 for telnet connections
Debug: 287 1879 command.c:146 script_debug(): command - init

You can see the response to almost every command in every configuration file , It can help you understand the whole access process .

Now I can go through Telent port 4444 Log in to the target board kernel Cortex-M7 Internal view response DAP Information about .
Windows10 System comes with Telnet Client installation . Because my system is in English , So I will use English directly here ：

1. Click Start.
2. Select Control Panel.
3. Choose Programs and Features.
4. Click Turn Windows features on or off.
5. Select the Telnet Client option.
Click OK. A dialog box appears to confirm installation. The telnet command should now be available.

installed Telnet After the client , We're going to knock directly in the run cmd Get into windows Command line . Go to the command line and execute telnet localhost 4444

Open On-Chip Debugger
> dap
adapter
  adapter assert |deassert [srst|trst [assert|deassert srst|trst]]
  adapter deassert |assert [srst|trst [deassert|assert srst|trst]]
  adapter driver driver_name
  adapter list
  adapter name
  adapter speed [khz]
  adapter srst
    adapter srst delay [milliseconds]
    adapter srst pulse_width [milliseconds]
  adapter transports transport ...
  adapter usb
    adapter usb location [<bus>-port[.port]...]
dap
  dap create name '-chain-position' name
  dap info [ap_num]
  dap init
  dap names
reset_config [none|trst_only|srst_only|trst_and_srst]
          [srst_pulls_trst|trst_pulls_srst|combined|separate]
          [srst_gates_jtag|srst_nogate] [trst_push_pull|trst_open_drain]
          [srst_push_pull|srst_open_drain]
          [connect_deassert_srst|connect_assert_srst]
s32k3xx.dap
  s32k3xx.dap apcsw [value [mask]]
  s32k3xx.dap apid [ap_num]
  s32k3xx.dap apreg ap_num reg [value]
  s32k3xx.dap apsel [ap_num]
  s32k3xx.dap baseaddr [ap_num]
  s32k3xx.dap dpreg reg [value]
  s32k3xx.dap info [ap_num]
  s32k3xx.dap memaccess [cycles]
  s32k3xx.dap ti_be_32_quirks [enable]
  swd newdap
dap: command requires more arguments

adopt dap info [ap_num] You can see how many AP Connect to SWD On

> dap info 1
SWD DPIDR 0x6ba02477
AP ID register 0x54770002
        Type is MEM-AP APB
MEM-AP BASE 0x80000003
        Valid ROM table present
                Component base address 0x80000000
                Peripheral ID 0x000008e995
                Designer is 0x08e, Freescale (Motorola)
                Part is 0x995, Unrecognized
                Component class is 0x1, ROM table
                MEMTYPE system memory not present: dedicated debug bus
        ROMTABLE[0x0] = 0x1003
                Component base address 0x80001000
                Peripheral ID 0x04003bb908
                Designer is 0x4bb, ARM Ltd
                Part is 0x908, CoreSight CSTF (Trace Funnel)
                Component class is 0x9, CoreSight component
                Type is 0x12, Trace Link, Funnel, router
        ROMTABLE[0x4] = 0x2003
                Component base address 0x80002000
                Peripheral ID 0x04003bb908
                Designer is 0x4bb, ARM Ltd
                Part is 0x908, CoreSight CSTF (Trace Funnel)
                Component class is 0x9, CoreSight component
                Type is 0x12, Trace Link, Funnel, router
        ROMTABLE[0x8] = 0x3003
                Component base address 0x80003000
                Peripheral ID 0x04003bb908
                Designer is 0x4bb, ARM Ltd
                Part is 0x908, CoreSight CSTF (Trace Funnel)
                Component class is 0x9, CoreSight component
                Type is 0x12, Trace Link, Funnel, router
        ROMTABLE[0xc] = 0x4003
                Component base address 0x80004000
                Peripheral ID 0x04001bb961
                Designer is 0x4bb, ARM Ltd
                Part is 0x961, CoreSight TMC (Trace Memory Controller)
                Component class is 0x9, CoreSight component
                Type is 0x32, Trace Link, FIFO, buffer
        ROMTABLE[0x10] = 0x5003
                Component base address 0x80005000
                Peripheral ID 0x04001bb961
                Designer is 0x4bb, ARM Ltd
                Part is 0x961, CoreSight TMC (Trace Memory Controller)
                Component class is 0x9, CoreSight component
                Type is 0x32, Trace Link, FIFO, buffer
        ROMTABLE[0x14] = 0x6003
                Component base address 0x80006000
                Peripheral ID 0x04001bb961
                Designer is 0x4bb, ARM Ltd
                Part is 0x961, CoreSight TMC (Trace Memory Controller)
                Component class is 0x9, CoreSight component
                Type is 0x32, Trace Link, FIFO, buffer
        ROMTABLE[0x18] = 0x7003
                Component base address 0x80007000
                Peripheral ID 0x04001bb961
                Designer is 0x4bb, ARM Ltd
                Part is 0x961, CoreSight TMC (Trace Memory Controller)
                Component class is 0x9, CoreSight component
                Type is 0x32, Trace Link, FIFO, buffer
        ROMTABLE[0x1c] = 0x8003
                Component base address 0x80008000
                Peripheral ID 0x04004bb917
                Designer is 0x4bb, ARM Ltd
                Part is 0x917, CoreSight HTM (AHB Trace Macrocell)
                Component class is 0x9, CoreSight component
                Type is 0x43, Trace Source, Bus
        ROMTABLE[0x20] = 0x9003
                Component base address 0x80009000
                Peripheral ID 0x04005bb906
                Designer is 0x4bb, ARM Ltd
                Part is 0x906, CoreSight CTI (Cross Trigger)
                Component class is 0x9, CoreSight component
                Type is 0x14, Debug Control, Trigger Matrix
        ROMTABLE[0x24] = 0xa003
                Component base address 0x8000a000
                Can't read component, the corresponding core might be turned off
> dap info 2
AP ID register 0x84770001
        Type is MEM-AP AHB3
MEM-AP BASE 0xf0000003
        Valid ROM table present
                Component base address 0xf0000000
                Can't read component, the corresponding core might be turned off

> dap info 4
AP ID register 0x84770001
        Type is MEM-AP AHB3
MEM-AP BASE 0xe00fe003
        Valid ROM table present
                Component base address 0xe00fe000
                Peripheral ID 0x04000bb4c8
                Designer is 0x4bb, ARM Ltd
                Part is 0x4c8, Cortex-M7 ROM (ROM Table)
                Component class is 0x1, ROM table
                MEMTYPE system memory present on bus
        ROMTABLE[0x0] = 0x1003
                Component base address 0xe00ff000
                Peripheral ID 0x04000bb4c7
                Designer is 0x4bb, ARM Ltd
                Part is 0x4c7, Cortex-M7 PPB ROM (Private Peripheral Bus ROM Table)
                Component class is 0x1, ROM table
                MEMTYPE system memory present on bus
        [L01] ROMTABLE[0x0] = 0xfff0f003
                Component base address 0xe000e000
                Peripheral ID 0x04000bb00c
                Designer is 0x4bb, ARM Ltd
                Part is 0xc, Cortex-M4 SCS (System Control Space)
                Component class is 0xe, Generic IP component
        [L01] ROMTABLE[0x4] = 0xfff02003
                Component base address 0xe0001000
                Peripheral ID 0x04000bb002
                Designer is 0x4bb, ARM Ltd
                Part is 0x2, Cortex-M3 DWT (Data Watchpoint and Trace)
                Component class is 0xe, Generic IP component
        [L01] ROMTABLE[0x8] = 0xfff03003
                Component base address 0xe0002000
                Peripheral ID 0x04000bb00e
                Designer is 0x4bb, ARM Ltd
                Part is 0xe, Cortex-M7 FPB (Flash Patch and Breakpoint)
                Component class is 0xe, Generic IP component
        [L01] ROMTABLE[0xc] = 0xfff01003
                Component base address 0xe0000000
                Peripheral ID 0x04000bb001
                Designer is 0x4bb, ARM Ltd
                Part is 0x1, Cortex-M3 ITM (Instrumentation Trace Module)
                Component class is 0xe, Generic IP component
        [L01] ROMTABLE[0x10] = 0xfff41002
                Component not present
        [L01] ROMTABLE[0x14] = 0xfff42002
                Component not present
        [L01] ROMTABLE[0x18] = 0x0
        [L01]   End of ROM table
        ROMTABLE[0x4] = 0xfff43003
                Component base address 0xe0041000
                Peripheral ID 0x04001bb975
                Designer is 0x4bb, ARM Ltd
                Part is 0x975, Cortex-M7 ETM (Embedded Trace)
                Component class is 0x9, CoreSight component
                Type is 0x13, Trace Source, Processor
        ROMTABLE[0x8] = 0xfff44003
                Component base address 0xe0042000
                Peripheral ID 0x04004bb906
                Designer is 0x4bb, ARM Ltd
                Part is 0x906, CoreSight CTI (Cross Trigger)
                Component class is 0x9, CoreSight component
                Type is 0x14, Debug Control, Trigger Matrix
        ROMTABLE[0xc] = 0x1ff02002
                Component not present
        ROMTABLE[0x10] = 0x0
                End of ROM table

> dap info 6
AP ID register 0x001c0030
        Unknown AP type

> dap info 7
AP ID register 0x001c0040
        Unknown AP type

Basically, the corresponding relationship is as follows ：

dap info I don't want to expand the content of the display anymore , The corresponding contents can be found in Arm CoreSight SoC-400 Technical Reference Manual , CoreSight Components Technical Reference Manual ,ARM Debug Interface Architecture Specification ADIv5.0 to ADIv5.2 and Arm Cortex-M7 Processor Technical Reference Manual Find correspondence and explanation .

You can also pass s32k3xx.dap apreg ap_num reg [value] Visit all you can see AP The register contents of .

We choose AP4 MEM-AP AHB AP Reference documents ARM Debug Interface Architecture Specification ADIv5.0 to ADIv5.2 chapter 7.The Memory Access Port (MEM-AP)  Table 7-6 Summary of Memory Access Port (MEM-AP) registers

Read 0xFC IDR, Identification Register

> s32k3xx.dap apreg 4 0xFC
0x84770001

Read 0xF8 BASE, Debug Base Address register

> s32k3xx.dap apreg 4 0xF8
0xe00fe003

If you want to get Cortex M7 Access to internal registers ,

> s32k3xx.armv7m.cm7_0    # This is what we give in the target board configuration file Target The name of 
s32k3xx.armv7m.cm7_0
  s32k3xx.armv7m.cm7_0 arm
    s32k3xx.armv7m.cm7_0 arm core_state ['arm'|'thumb']
    s32k3xx.armv7m.cm7_0 arm disassemble address [count ['thumb']]
    s32k3xx.armv7m.cm7_0 arm mcr cpnum op1 CRn CRm op2 value
    s32k3xx.armv7m.cm7_0 arm mrc cpnum op1 CRn CRm op2
    s32k3xx.armv7m.cm7_0 arm reg
    s32k3xx.armv7m.cm7_0 arm semihosting ['enable'|'disable']
    s32k3xx.armv7m.cm7_0 arm semihosting_cmdline arguments
    s32k3xx.armv7m.cm7_0 arm semihosting_fileio ['enable'|'disable']
    s32k3xx.armv7m.cm7_0 arm semihosting_resexit ['enable'|'disable']
  s32k3xx.armv7m.cm7_0 arp_examine ['allow-defer']
  s32k3xx.armv7m.cm7_0 arp_halt
  s32k3xx.armv7m.cm7_0 arp_halt_gdb
  s32k3xx.armv7m.cm7_0 arp_poll
  s32k3xx.armv7m.cm7_0 arp_reset
  s32k3xx.armv7m.cm7_0 arp_waitstate
  s32k3xx.armv7m.cm7_0 array2mem arrayname bitwidth address count
  s32k3xx.armv7m.cm7_0 cget target_attribute
  s32k3xx.armv7m.cm7_0 configure [target_attribute ...]
  s32k3xx.armv7m.cm7_0 cortex_m
    s32k3xx.armv7m.cm7_0 cortex_m maskisr ['auto'|'on'|'off'|'steponly']
    s32k3xx.armv7m.cm7_0 cortex_m reset_config ['sysresetreq'|'vectreset']
    s32k3xx.armv7m.cm7_0 cortex_m vector_catch ['all'|'none'|('bus_err'|'chk_err'|...)*]
  s32k3xx.armv7m.cm7_0 curstate
  s32k3xx.armv7m.cm7_0 eventlist
  s32k3xx.armv7m.cm7_0 examine_deferred
  s32k3xx.armv7m.cm7_0 invoke-event event_name
  s32k3xx.armv7m.cm7_0 itm
    s32k3xx.armv7m.cm7_0 itm port <port> (0|1|on|off)
    s32k3xx.armv7m.cm7_0 itm ports (0|1|on|off)
  s32k3xx.armv7m.cm7_0 mdb address [count]
  s32k3xx.armv7m.cm7_0 mdd address [count]
  s32k3xx.armv7m.cm7_0 mdh address [count]
  s32k3xx.armv7m.cm7_0 mdw address [count]            # Double byte read 
  s32k3xx.armv7m.cm7_0 mem2array arrayname bitwidth address count
  s32k3xx.armv7m.cm7_0 mwb address data [count]
  s32k3xx.armv7m.cm7_0 mwd address data [count]
  s32k3xx.armv7m.cm7_0 mwh address data [count]
  s32k3xx.armv7m.cm7_0 mww address data [count]        # Double byte write 
  s32k3xx.armv7m.cm7_0 rtt
    s32k3xx.armv7m.cm7_0 rtt channellist
    s32k3xx.armv7m.cm7_0 rtt channels
    s32k3xx.armv7m.cm7_0 rtt polling_interval [interval]
    s32k3xx.armv7m.cm7_0 rtt setup <address> <size> <ID>
    s32k3xx.armv7m.cm7_0 rtt start
    s32k3xx.armv7m.cm7_0 rtt stop
  s32k3xx.armv7m.cm7_0 tpiu
    s32k3xx.armv7m.cm7_0 tpiu config (disable | ((external | internal (<filename> | <:port> | -)) (sync <port
              width> | ((manchester | uart) <formatter enable>))
              <TRACECLKIN freq> [<trace freq>]))
  s32k3xx.armv7m.cm7_0 was_examined
s32k3xx.armv7m.cm7_0: command requires more arguments

Or you can use it directly mww and mdw Orders are ok . because OpenOCD By default s32k3xx.armv7m.cm7_0 mww and s32k3xx.armv7m.cm7_0 mdw Replace .

give an example ： To register 0x402DC000 , write in 0x0000A50F

> mww 0x402DC000 0x0000A50F 1

Read register 0x402DC000

> mdw 0x402DC000 1
0x402dc000: 00005af0

We can use arm-none-eabi-gdb Tool for breakpoint debugging .GDB Login port 3333

arm-none-eabi-gdb There are lots of software resources Windows10 Our resources are as follows ：

• xPack GNU Arm Embedded GCC v10.2.1-1.1 released 
• gcc-arm-none-eabi-10-2020-q4-major-win32.exe

D:\Program Files (x86)\GNU Arm Embedded Toolchain\10 2020-q4-major\bin>arm-none-eabi-gdb.exe D:\Work_Data\my_projects\S32K344_EVB\xpack-openocd-0.10.0-15-win32-x64\xpack-openocd-0.10.0-15\bin\Dio_example_DS.elf
D:\Program Files (x86)\GNU Arm Embedded Toolchain\10 2020-q4-major\bin\arm-none-eabi-gdb.exe: warning: Couldn't determine a path for the index cache directory.
GNU gdb (GNU Arm Embedded Toolchain 10-2020-q4-major) 10.1.90.20201028-git
Copyright (C) 2020 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "--host=i686-w64-mingw32 --target=arm-none-eabi".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from D:\Work_Data\my_projects\S32K344_EVB\xpack-openocd-0.10.0-15-win32-x64\xpack-openocd-0.10.0-15\bin\Dio_example_DS.elf...
(gdb) target remote 127.0.0.1:3333
Remote debugging using 127.0.0.1:3333
main () at ../src/main.c:74
74                      DelayCount++;
(gdb) bt
#0  main () at ../src/main.c:74
(gdb) b main
Breakpoint 1 at 0x204002a0: file ../src/main.c, line 55.
(gdb) c
Continuing.

Program received signal SIGINT, Interrupt.
0x204002d8 in main () at ../src/main.c:74
74                      DelayCount++;
(gdb) bt
#0  0x204002d8 in main () at ../src/main.c:74
(gdb) list
69                  /* Dio_WriteChannel(DioConf_DioChannel_Digital_Output_LED_D78, STD_LOW); */
70                  Siul2_Dio_Ip_WritePin(PTB_L_HALF, LED_PIN_PIN, 0U);
71                  /*delay*/
72                  while(DelayCount<10000)
73                  {
74                      DelayCount++;
75                  }
76                  DelayCount = 0;
77          }
78
(gdb) print
The history is empty.
(gdb) print DelayCount
$1 = 0
(gdb) set step-mode
(gdb) si
72                  while(DelayCount<10000)
(gdb) si
0x204002ce      72                  while(DelayCount<10000)
(gdb) si
74                      DelayCount++;
(gdb) c
Continuing.

Program received signal SIGINT, Interrupt.
main () at ../src/main.c:74
74                      DelayCount++;
(gdb) list
69                  /* Dio_WriteChannel(DioConf_DioChannel_Digital_Output_LED_D78, STD_LOW); */
70                  Siul2_Dio_Ip_WritePin(PTB_L_HALF, LED_PIN_PIN, 0U);
71                  /*delay*/
72                  while(DelayCount<10000)
73                  {
74                      DelayCount++;
75                  }
76                  DelayCount = 0;
77          }
78
(gdb)

GDB Command guide and GDB GUI Tools Eclipse I will introduce... In another article .