CMSIS-DAP is open-source debug firmware from ARM. It connects to a CoreSight Debug Acces Port (DAP) on a target device, via either ARM’s Serial Wire Debug (SWD) or JTAG, and relays commands between the DAP and USB.
To make installation easier on Windows, the firmware enumerates as a USB HID. The packets exchanged with it are unstructured 64 byte reports. (Microchip did exactly the same thing with their PICKit2.) The code has a somewhat curious license: it can be freely used and modified, as long as it is deployed on an ARM Cortex processor.
NOTE: You may also be interested in reading about DAPlink, which expands the capabilities of CMSIS-DAP.
It is connected like this:
Getting the source & documentation
Download the CMSIS-DAP sources and protocol documentation (an account is required, but signing up is free).
The code can only be built using Keil’s MDK software.
Getting pre-built binaries
The only prebuilt binaries I am aware of are the OpenSDA versions intended for use on Freescale’s FRDM boards. I have written instructions for fixing the FRDM firmware; essentially, by installing CMSIS-DAP on FRDM boards.
Appreciation
After carefully reading the documentation, and then even more carefully reading the C source code, and then cross-referencing five or seven different ARM documents (ARM architecture manuals, debug manuals, processor manuals), I was, in the space of a few days’ time, able to get muforth to talk to the CMSIS-DAP firmware installed on a FRDM board and lay open the guts of the KL25Z chip.
It’s a simple and well-designed protocol. And since getting it to work involves digging deeply into CoreSight, SWD, and other ARM debug arcana, I’ve developed an appreciation for the overall design. I’m impressed.
Conjecture
I can’t read ARM’s collective mind, but my conjecture is that ARM created CMSIS-DAP because they were irritated by the profusion of proprietary and undocumented debug interfaces in the so-called “ARM ecosystem”. If this is the reason, I can certainly relate, having decided to build my own BDM debug for Freescale’s S08 family of 8-bit microcontrollers. I looked at the DEMO boards available and was frustrated by the fact that P & E decided to “lock down” the debug ports on these boards. And they were undocumented, which didn’t work for me – I wanted to connect with them via muforth, and avoid using CodeWarrior.
We now have the same problem with ARM Cortex-M development boards. ST-Micro uses ST-LINK on their STM32 Discovery series. TI uses ICDI on the Stellaris Launchpad. And Freescale’s FRDM boards ship with something called OpenSDA – which isn’t open at all.
At least OpenSDA allows CMSIS-DAP to be installed on the FRDM boards. Otherwise the boards are useless!
Tips and tricks
Even though the documentation is pretty thorough, there were a few hurdles to getting connected to the target chip.
First, a “line reset” connection sequence is necessary. This involves clocking a sequence of bits into the SW-DP. ARM’s documentation – the ARM Debug Interface v5 spec and the ADI v5.1 supplement – disagreed on what this sequence should be. I settled on sending 56 ones followed by 8 zeros, and this seemed to work.
My next hurdle was to try to read the chip’s memory. But any access to AP (access port) registers failed, returning a FAULT. It turns out that it is necessary to first turn on the CSYSPWRUPREQ and CSYSDBGREQ bits in the DP.CTRLSTAT register... Once I did this, the chip was mine!