52. Debug support (DBG)

52.1 Introduction

A comprehensive set of debug features is provided to support software development and system integration:

• • Breakpoint debugging of the CPU core
• • Code execution tracing
• • Software instrumentation
• • Cross-triggering

The debug features can be controlled via a JTAG/Serial-wire debug access port, using industry standard debugging tools. A trace port allows data to be captured for logging and analysis.

The debug features are based on Arm ^® Coresight ^™ components.

• – SWJ-DP: JTAG/Serial-wire debug port
• – AHB-AP: AHB access port
• – ROM table
• – System Control Space (SCS)
• – Breakpoint Unit (BPU)
• – Data Watchpoint and Trace Unit (DWT)
• – Instrumentation Trace Macrocell (ITM)
• – Embedded Trace Macrocell (ETM)
• – Cross Trigger Interface (CTI)
• – Trace Port Interface Unit (TPU)

The debug features are accessible by the debugger via the AHB-AP.

Additional information can be found in the Arm ^® documents referenced in Section 52.12 .

52.2 DBG functional description

52.2.1 DBG block diagram

Figure 566. Block diagram of debug support infrastructure

52.2.2 DBG pins and internal signals

Table 446. JTAG/Serial-wire debug port pins

1. TDI is hosted on the same IO as a USBPD-CC line. To avoid pull-up/down conflict, a user option allows to decide whether the pad is used as TDI or as CC.

Table 447. Trace port pins

1. 1. TRACESWO is multiplexed with JTDO. This means that single-wire trace is only available when using the Serial-wire debug interface, and not when using JTAG.

52.2.3 DBG reset and clocks

The debug port (SWJ-DP) is reset by a power-on reset and when waking up from Standby mode.

The debugger supplies the clock for the debug port via the debug interface pin JTCK/SWCLK. This clock is used to register the serial input data in both Serial-wire and JTAG modes, as well as to operate the state machines and internal logic of the debug port. It must therefore continue to toggle for several cycles after the end of an access, to ensure that the debug port returns to the idle state.

The SWJ-DP contains an asynchronous interface to the DCLK domain, which covers the rest of the SWJ-DP and the access port.

The DCLK is a gated version of the system clock.

The DCLK domain is enabled by the debugger using the CDBGPWRUPREQ bit in the debug port CTRL/STAT register. The clock must be enabled before the debugger can access any of the debug features on the device. The availability of the clock is reflected in the CDBGPWRUPACK bit in the debug port CTRL/STAT register. The DCLK is disabled at power-up, and must be disabled when the debugger is disconnected, to avoid wasting energy.

The debug and trace components included in the processor are clocked with the processor clock.

52.2.4 DBG power domains

The debug components are located in the core power domain. This means that debugger connection is not possible in shutdown or standby low-power modes. To avoid losing the connection when the device enters standby mode, it is possible to maintain the power to the core by setting a bit in the DBGMCU_CR register. This also keeps the processor clocks active, and holds off the reset, so that the debug session is maintained.

52.2.5 Debug and low-power modes

The STM32L552xx and STM32L562xx devices include power saving features that allow the core power domain to be switched off or stopped when not required. If the power is switched off, or the core is not clocked, all debug components are inaccessible to the debugger. To avoid this, power saving mode emulation has been implemented. If emulation is enabled for a domain, the domain still enters power saving mode, but its clock and power are maintained. In other words, the domain behaves as if it is in power saving mode, but the debugger does not lose the connection.

Emulation mode is programmed in the microcontroller debug (DBGMCU) unit. For more information refer to Section 52.11: Microcontroller debug unit (DBGMCU) .

52.2.6 Security

The trace and debug components allow a high degree of access to the processor and system during product development. In order to protect user code and ensure that the debug features can not be used to alter or compromise the normal operation of the finished product, these features can be disabled, or limited in scope. For example, secure software debug and trace can be disabled without preventing the debug of non-secure code.

There are four authentication signals used by the system to determine which debug features are enabled or disabled. These signals are:

• • dbggen : global enable for all debug features
  0: all debug features are disabled.
  1: debug features in non-secure state are enabled. Debug features in secure state are dependent on the state of the spiden signal.
• • spiden : enables debug in secure state when dbggen = 1
  0: debug features are disabled in secure state.
  1: debug features are enabled in secure state.
• • niden : enables trace and performance monitoring (non-invasive debug)
  0: trace generation is disabled.
  1: trace generation in non-secure state is enabled. Trace generation in secure state is dependent on the state of the spniden signal.
• • spniden : enables trace and performance monitoring in secure state when niden = 1.
  0: trace generation is disabled in secure state.
  1: trace generation is enabled in secure state.

For detailed information on the behavior of each component according to the state of the authentication signals, refer to the relevant component chapter, or to the relevant Arm ^® technical documentation.

The state of the signals are set according to the read data protection (RDP) level (see Section 6.7.2: Readout protection (RDP) ), as shown in Table 449 :

Table 449. Authentication signal states

Table 449. Authentication signal states (continued)

Note: Security features are only relevant when option bit TZEN = 1. If security features are disabled, the authentication signals are still set according to the RDP level, but since the processor and all memory are non-secure, SPNIDEN and SPIDEN are redundant.

The state of the authentication signals can be read from the DAUTHSTATUS register in the system control space (SCS) of the Cortex-M33.

Note that debugger access to secure memory (when permitted) must be performed using secure transactions on the debug AHB, that is, with the PROT[6] bit set in the AP_CSWR register.

Debugger access is disabled while the processor is booting from system flash (RSS), whatever the RDP level, if security features are enabled (TZEN = 1).

52.2.7 Serial-wire and JTAG debug port (SWJ-DP)

The SWJ-DP is a Coresight™ component that implements an external access port for connecting debugging equipment.

Two types of interface can be configured:

• • a 5-pin standard JTAG interface (JTAG-DP)
• • a 2-pin (clock + data) Serial-wire debug port (SW-DP)

The two modes are mutually exclusive, since they share the same IO pins.

By default the JTAG-DP is selected after a system or a power-on reset. The five IO pins are configured by hardware in debug alternative function mode. The SWJ-DP incorporates pull-up resistors on JTDI, JTMS/SWDIO, and nJTRST, as well as a pull-down resistor on JTCK/SWCLK.

A debugger can select the SW-DP by transmitting the following serial data sequence on JTMS/SWDIO:

... (50 or more ones) ..., 0, 1, 1, 1, 1, 0, 0, 1, 1, 1, 1, 0, 0, 1, 1, 1, ... (50 or more ones) ...

JTCK/SWCLK must be cycled for each data bit.

In SW-DP mode, the unused JTAG pins JTDI, JTDO and nJTRST can be used for other functions. Note that all SWJ port IOs can be reconfigured to other functions by software, but debugging is no longer possible.

52.2.8 JTAG debug port

The JTAG-DP implements a TAP state machine (TAPSM), shown in Figure 567 , based on IEEE Std 1149.1-1990. The state machine controls two scan chains, one associated with an instruction register (IR), and the other one with a number of data registers (DR).

Figure 567. JTAG TAP state machine

stateDiagram-v2
    [*] --> Test-Logic-Reset
    Test-Logic-Reset --> Test-Logic-Reset : JTMS=1
    Test-Logic-Reset --> Run-Test/Idle : JTMS=0
    Run-Test/Idle --> Run-Test/Idle : JTMS=0
    Run-Test/Idle --> Select-DR-Scan : JTMS=1
    Run-Test/Idle --> Select-IR-Scan : JTMS=1
    Select-DR-Scan --> Run-Test/Idle : JTMS=1
    Select-DR-Scan --> Capture-DR : JTMS=0
    Select-IR-Scan --> Run-Test/Idle : JTMS=1
    Select-IR-Scan --> Capture-IR : JTMS=0
    Capture-DR --> Shift-DR : JTMS=0
    Capture-DR --> Run-Test/Idle : JTMS=1
    Shift-DR --> Shift-DR : JTMS=0
    Shift-DR --> Exit1-DR : JTMS=1
    Exit1-DR --> Run-Test/Idle : JTMS=0
    Exit1-DR --> Pause-DR : JTMS=1
    Pause-DR --> Pause-DR : JTMS=0
    Pause-DR --> Exit2-DR : JTMS=1
    Exit2-DR --> Run-Test/Idle : JTMS=0
    Exit2-DR --> Update-DR : JTMS=1
    Update-DR --> Run-Test/Idle : JTMS=1
    Update-DR --> Shift-DR : JTMS=0
    Capture-IR --> Shift-IR : JTMS=0
    Capture-IR --> Run-Test/Idle : JTMS=1
    Shift-IR --> Shift-IR : JTMS=0
    Shift-IR --> Exit1-IR : JTMS=1
    Exit1-IR --> Run-Test/Idle : JTMS=0
    Exit1-IR --> Pause-IR : JTMS=1
    Pause-IR --> Pause-IR : JTMS=0
    Pause-IR --> Exit2-IR : JTMS=1
    Exit2-IR --> Run-Test/Idle : JTMS=0
    Exit2-IR --> Update-IR : JTMS=1
    Update-IR --> Run-Test/Idle : JTMS=1
    Update-IR --> Shift-IR : JTMS=0

MS44486V1

The operation of the JTAG-DP is as follows:

1. 1. When the TAPSM goes through the Capture-IR state, 0b0001 is transferred onto the instruction register (IR) scan chain. The IR scan chain is connected between JTDI and JTDO.
2. 2. While the TAPSM is in the Shift-IR state, the IR scan chain shifts one bit for each rising edge of JTCK. This means that on the first tick:
   • – The LSB of the IR scan chain is output on JTDO.
   • – Bit[n] of the IR scan chain is transferred to bit[n-1].
   • – The value on JTDI is transferred to the MSB of the IR scan chain.
3. 3. When the TAPSM goes through the Update-IR state, the value scanned into the IR scan chain is transferred into the instruction register.
4. 4. When the TAPSM goes through the Capture-DR state, a value is transferred from one of the data registers onto one of the DR scan chains, connected between JTDI and JTDO.
5. 5. The value held in the instruction register determines which data register, and associated DR scan chain, is selected.
6. 6. This data is then shifted while the TAPSM is in the Shift-DR state, in the same manner as the IR shift in the Shift-IR state.
7. 7. When the TAPSM goes through the Update-DR state, the value scanned into the DR scan chain is transferred into the selected data register.
8. 8. When the TAPSM is in the Run-Test/Idle state, no special actions occurs. The IDCODE instruction is loaded in IR.

When active, the nJTRST signal resets the state machine asynchronously to the test-logic-reset state.

The data registers corresponding to the 4-bit IR instructions are listed in Table 450 .

Table 450. JTAG-DP data registers

Table 450. JTAG-DP data registers (continued)

The DR registers are described in more detail in the Arm® Debug Interface Architecture Specification [1].

52.2.9 Serial-wire debug port

The Serial-wire debug protocol uses two pins:

• • SWCLK: clock from host to target
• • SWDIO: bi-directional serial data

Serial data is transferred LSB first, synchronously with the clock.

A transfer comprises three phases:

1. 1. packet request (8 bits) transmitted by the host (see Table 451 )
2. 2. acknowledge response (3 bits) transmitted by the target (see Table 452 )
3. 3. data transfer (33 bits) transmitted by the host (in case of a write) or target (in case of a read) (see Table 453 )

The data transfer only occurs if the acknowledge response is OK.

Between each phase, if the direction of the data is reversed, a single clock cycle turn-around time is inserted.

Table 451. Packet request

Table 452. ACK response

Table 453. Data transfer

In the case of a FAULT or WAIT ACK response from the target, the data transfer phase is canceled, unless overrun detection is enabled: in this case the data is ignored by the target (in the case of a write), or not driven (in the case of a read).

A line reset must be generated by the host when it is first connected, or following a protocol error. The line reset consists in 50 or more SWCLK cycles with SWDIO high, followed by two SWCLK cycles with SWDIO low.

For more details on the Serial-wire debug protocol, refer to the Arm® Debug Interface Architecture Specification [1] .

Note: The SWJ-DP implements SWD protocol version 2.

52.2.10 Debug port registers

Both the SW-DP and the JTAG-DP access the debug port (DP) registers listed in Table 454 .

The debugger can access the DP registers as follows:

1. 1. Program the A(3:2) field in the DPACC register, if using JTAG, with the register address within the bank. Program the RnW bit to select a read or write. In the case of a write, program the data field with the write data. If using SWD, the A(3:2) and RnW fields are

part of the packet request word sent to the SW-DP with the APnDP bit reset (see Table 451 ). The write data are sent in the data phase.

1. To access one of the banked DP registers at address 0x4, the register number must first be written to the DP_SELECTR register at address 0x8. Any subsequent read or write to address 0x4 access the register corresponding to the contents of the DP_SELECTR register.

DP debug port identification register (DP_PIDR)

Address offset: 0x0

Reset value: 0x0BE0 2477 (SW-DP), 0x0BE0 1477 (JTAG-DP)

Bits 31:28 REVISION[3:0] : revision code

0x0 (JTAG-DP): r0p0

0x0 (SW-DP): r0p0

Bits 27:20 PARTNO[7:0] : part number for the debug port

0xBE

Bits 19:17 Reserved, must be kept at reset value.

Bit 16 MIN : minimal debug port (MINDP) implementation

0x1: MINDP implemented (transaction counter and pushed operations are not supported)

Bits 15:12 VERSION[3:0] : debug port architecture version

0x1 (JTAG-DP): DPv1

0x2 (SW-DP): DPv2

Bits 11:1 DESIGNER[10:0] : JEDEC designer identity code

0x23B: Arm® JEDEC code

Bit 0 Reserved, must be kept at reset value.

Address offset: 0x0

Reset value: 0x0000 0000

Bits 31:5 Reserved, must be kept at reset value.

0: no effect

1: STICKYORUN bit cleared in DP_CTRL/STATR register

0: no effect

1: WDATAERR bit cleared in DP_CTRL/STATR register

0: no effect

1: STICKYERR bit cleared in DP_CTRL/STATR register

Bit 1 Reserved, must be kept at reset value.

This bit indicates that the transaction is stalled.

0: no effect

1: transaction aborted

DP control and status register (DP_CTRL/STATR)

Address offset: 0x4

Reset value: 0x0000 0000

This register is accessible when DP_SELECTR.DPBANKSEL[3:0] = 0x0.

Bits 31:30 Reserved, must be kept at reset value.

Bit 29 CDBGPWRUPACK : debug power-up acknowledge

See description in Section 52.2.5: Debug and low-power modes .

0: DCLK gated

1: DCLK enabled

Bit 28 CDBGPWRUPREQ : debug power-up request

Controls the DCLK enable request signal.

0: requests DCLK gating

1: requests DCLK enable

Bits 27:8 Reserved, must be kept at reset value.

Bit 7 WDATAERR : write data error (read-only) in SW-DP

Indicates that there is a parity or framing error on the data phase of a write or

a write accepted by the DP is then discarded without being submitted to the AP.

This bit is reset by writing 1 to the ABORT.WDERRCLR bit.

0: no error

1: an error occurred

Note: this bit is reserved in JTAG-DP.

Bit 6 READOK : AP read response (read-only) in SW-DP.

Indicates the response to the last AP read access.

0: read not OK

1: read OK

Note: this bit is reserved in JTAG-DP.

Bit 5 STICKYERR : transaction error (read-only in SW-DP, read/write in JTAG-DP)

Indicates that an error occurred in an AP transaction.

This bit is reset by writing 1 to the DP_ABORTR.STKERRCLR bit (in SW-DP and JTAG-DP)

0: no error

1: an error occurred

Bits 4:2 Reserved, must be kept at reset value.

Bit 1 STICKYORUN : overrun (read-only in SW-DP, read/write in JTAG-DP).

Indicates that an overrun occurred (new transaction received before previous transaction completed). This bit is only set if the ORUNDETECT bit is set.

This bit is reset by writing 1 to the DP_ABORTR.ORUNERRCLR bit (in SW-DP and JTAG-DP)

0: no overrun

1: an overrun occurred

Bit 0 ORUNDETECT : overrun detection mode enable.

0: disabled

1: enabled. In the event of an overrun, the STICKYORUN bit is set and subsequent transactions are blocked until the STICKYORUN bit is cleared.

DP data link control register (DP_DLCR)

Address offset: 0x4

Reset value: 0x0000 0000

This register is accessible when DP_SELECTR.DPBANKSEL[3:0] = 0x1.

Bits 31:10 Reserved, must be kept at reset value.

Bits 9:8 TURNROUND[1:0] : tristate period for SWDIO

0x0: 1 data bit period

Bits 7:6 WIREMODE[1:0] : SW-DP mode

0x0: synchronous mode

Bits 5:0 Reserved, must be kept at reset value.

Address offset: 0x4

Reset value: 0x0000 0001

This register is accessible when DP_SELECTR.DPBANKSEL[3:0] = 0x2.

0x1: revision 1

0x0472: STM32L552xx and STM32L562xx

0x020: STMicroelectronics

Bit 0 Reserved, must be kept at reset value.

Address offset: 0x4

Reset value: 0x0000 0001

This register is accessible when DP_SELECTR.DPBANKSEL[3:0] = 0x3.

Defines the instance number for the device in a multi-drop system.

0x0: instance number 0

Bits 27:4 Reserved, must be kept at reset value.

0x1: version 2

Address offset: 0x4

Reset value: 0x0000 0001

This register is accessible when DP_SELECTR.DPBANKSEL[3:0] = 0x4.

Bits 31:1 Reserved, must be kept at reset value.

0: Cortex®-M33 processor halted

1: Cortex®-M33 processor not halted

Address offset: 0x8

Reset value: 0x0000 0000

This register is used in the event of a corrupted read transfer.

Address offset: 0x8

Reset value: 0xXXXX XXXX

Bits 31:24 APSEL[7:0] : access port select

Selects the access port for the next transaction.

0x0: AP0 - Cortex ^® -M33 debug access port (AHB-AP)

others: reserved

Bits 23:8 Reserved, must be kept at reset value.

Bits 7:4 APBANKSEL[3:0] : AP register bank select.

Selects the 4-word register bank on the active AP for the next transaction.

Bits 3:0 DPBANKSEL[3:0] : DP register bank select

Selects the register at address 0x4 of the debug port.

0x0: DP_CTRL/STAT register

0x1: DP_DLCR register

0x2: DP_TARGETID register

0x3: DP_DLPIDR register

0x4: DP_EVENTSTAT register

others: reserved

DP read buffer register (DP_RDBUFR)

Address offset: 0xC

Reset value: 0x0000 0000

Bits 31:0 RDBUFF[31:0] : value returned by the last AP read access

The value returned by an AP read access can either be obtained using a second read access to the same address, that initiates a new transaction on the corresponding bus, or else it can be read from this register, in which case no new AP transaction occurs.

52.2.11 Debug port register map and reset values

These registers are not on the CPU memory bus, they are only accessed through SW-DP and JTAG-DP debug interface.

The debug port address is 2-bit wide, defined in the JTAG-DP register DPACC or SW-DP packet request A[3:2] field.

Table 454. Debug port register map and reset values

Table 454. Debug port register map and reset values (continued)

1. 1. DP_SELECTR.DPBANKSEL[3:0] = 0x0.
2. 2. DP_SELECTR.DPBANKSEL[3:0] = 0x1.
3. 3. DP_SELECTR.DPBANKSEL[3:0] = 0x2.
4. 4. DP_SELECTR.DPBANKSEL[3:0] = 0x3.
5. 5. DP_SELECTR.DPBANKSEL[3:0] = 0x4.

52.3 Access ports

There is one access port (AP) attached to the DP. It enables access to the debug and trace features integrated in the Cortex®-M33 processor core via its internal AHB bus.

52.3.1 Access port registers

The access port is of type MEM-AP, that is to say the debug and trace component registers are mapped in the address space of the AHB. The AP is seen by the debugger as a set of 32-bit registers organized in banks of four registers each. Some of these registers are used to configure or monitor the AP itself, while others are used to perform a transfer on the bus. The AP registers are listed in Table 455 .

The address of the AP registers is composed of the following fields:

• • bits [7:4]: content of the DP_SELECTR.APBANKSEL[3:0] field in the DP (see DP access port select register (DP_SELECTR) )
• • bits [3:2]: content of the A(3:2) field of the APACC data register in the JTAG-DP (see Table 450 ), or of the SW-DP packet request (see Table 451 ), depending on the debug interface used
• • bits [1:0]: always set to 0

The content of the DP_SELECTR.APSEL[3:0] field in the DP defines which MEM-AP is being accessed.

The debugger can access the AP registers as follows:

1. 1. Program the DP_SELECTR.APSEL[3:0] field in the DP to choose the AP, and the APBANKSEL[3:0] field to select the register bank to be accessed (see DP access port select register (DP_SELECTR) ).
2. 2. Program the A(3:2) field in the APACC data register, if using JTAG, with the register address within the bank. Program the RnW bit to select a read or write. In the case of a write, program the DATA field with the write data. If using SWD, the A(3:2) and RnW

fields are part of the packet request word sent to the SW-DP with the APnDP bit set (see Table 451 ). The write data is sent in the data phase.

The debugger can access the memory mapped debug component registers through the AP registers (using the above AP register access procedure) as follows:

1. 1. Program the transaction target address in the TAR register.
2. 2. Program the AP_CSWR register, if necessary, with the transfer parameters (AddrInc for example).
3. 3. Write to or read from the AP_DRWR register to initiate a bus transaction at the address held in the AP_TAR register. Alternatively, a read or write to banked data register AP_BDnR triggers an access to address TAR[31:4] + n, allowing up to four consecutive addresses to be accessed without changing the address in the AP_TAR register.

For more detailed information on the MEM-AP refer to the Arm ^® Debug Interface Architecture Specification [1] .

AP control/status word register (AP_CSWR)

Address offset: 0x0

Reset value: 0x0100 00X0

Bit 31 Reserved, must be kept at reset value.

Bit 30 PROT[6] : secure transfer request

This field sets the protection attribute HPROT[6] of the bus transfer.

0: secure transfer

1: non-secure transfer

Bits 29:28 Reserved, must be kept at reset value.

Bits 27:24 PROT[3:0] : bus transfer protection

This field sets the protection attributes HPROT[3:0] of the bus transfer.

0bXXX1: data access (bit 24 is read only)

0bXX0X: non-privilege mode

0bXX1X: privilege mode

0bX0XX: non-bufferable

0bX1XX: bufferable

0b0XXX: non-shareable, no look-up, non-modifiable

0b1XXX: shareable, look-up, modifiable

Bits 23:7 Reserved, must be kept at reset value.

Bit 6 DBGSTATUS : device enable (DEVICEEN) status

0: AHB transfers blocked

1: AHB transfers enabled

Bits 5:4 ADDRINC[1:0] : auto-increment mode

Defines whether TAR address is automatically incremented after a transaction.

0x0: no auto-increment

0x1: address incremented by the size in bytes of the transaction (SIZE field)

other: reserved

Bit 3 Reserved, must be kept at reset value.

Bits 2:0 SIZE[2:0] : size of next memory access transaction

0x0: byte (8-bit)

0x1: halfword (16-bit)

0x2: word (32-bit)

others: reserved

AP transfer address register (AP_TAR)

Address offset: 0x04

Reset value: 0xXXXX XXXX

Bits 31:0 TA[31:0] : address of current transfer

AP data read/write register (AP_DRWR)

Address offset: 0x0C

Reset value: 0xXXXX XXXX

Bits 31:0 TD[31:0] : data of current transfer

AP banked data n register (AP_BDnR)

Address offset: 0x10 + 4 * n, (n = 0 to 3)

Reset value: 0x0000 0000

Bits 31:0 TBD[31:0] : banked data of current transfer to address TAR

TA + AP_BDnR address [3:2] + 0b00.

The auto address incrementing is not performed on AP_BD0-3R. Banked transfers are only supported for word transfers.

AP configuration register (AP_CFGR)

Address offset: 0xF4

Reset value: 0x0000 0000

Bits 31:3 Reserved, must be kept at reset value.

Bit 2 LD : large data

0: data not larger than 32-bits supported

Bit 1 LA : long address

0: Physical addresses not larger than 32-bits supported

Bit 0 BE : big endian

0: only little-endian supported

AP base address register (AP_BASER)

Address offset: 0xF8
Reset value: 0xE00F E003

Bits 31:12 BASEADDR[31:12] : base address (bits 31 to 12) of the first ROM table

The 12 LSBs are zero since the ROM table must be aligned on a 4-Kbyte boundary.
0xE00FE

Bits 11:2 Reserved, must be kept at reset value.

Bit 1 FORMAT : base-address register format

1: Arm ^® debug interface v5

Bit 0 ENTRYPRESENT : debug components presence

Indicates that debug components are present on the access port bus.

1: debug components present

AP identification register (AP_IDR)

Address offset: 0xFC
Reset value: 0x1477 0015

Bits 31:28 REVISION[3:0] : revision number

0x1: r0p1

Bits 27:24 JEDECBANK[3:0] : JEDEC bank.

0x4: Arm ^®

Bits 23:17 JEDECCODE[6:0] : JEDEC code.

0x3B: Arm ^®

Bits 16:13 CLASS[3:0] :

0x8: MEM-AP

Bits 12:8 Reserved, must be kept at reset value.

Bits 7:4 VARIANT[3:0] :

0x1: Cortex ^® -M33

Bits 3:0 TYPE[3:0] :

0x5: AHB5

52.3.2 Access port register map and reset values

These registers are not on the CPU memory bus, they are only accessed through SW-DP and JTAG-DP debug interfaces.

The access port address is 8-bit wide, defined by DP_SELECTR.APBANKSEL[3:0] field and by JTAG-DP register DPACC or SW-DP packet request A[3:2] field.

Table 455. Access port register map and reset values

Table 455. Access port register map and reset values (continued)

Refer to Section 2.3 for the register boundary addresses.

52.4 ROM tables

The ROM table is a CoreSight™ component that contains the base addresses of all the CoreSight debug components accessible via the AHB-AP. These tables allow a debugger to discover the topology of the CoreSight system automatically.

There are two ROM tables in the CPU sub-system. The MCU ROM table is pointed to by the base register in the AHB-AP. It contains the base address pointer for the processor ROM table and for the TPIU registers.

The MCU ROM table (see Table 456 ) occupies a 4-Kbyte, 32-bit wide chunk of address space, from 0xE00F E000 to 0xE00F EFFC.

Table 456. MCU ROM table

The processor ROM table contains the base-address pointer for the system control space (SCS) registers, that allow the debugger to identify the CPU core, as well as for the BPU, DWT, ITM, ETM and CTI.

The processor ROM table (see Table 457 ) occupies a 4-Kbyte, 32-bit wide chunk of address space, from 0xE00F F000 to 0xE00F FFFC.

Table 457. Processor ROM table

The topology for the CoreSight components in the Cortex ^® -M33 is shown in Figure 568.

Figure 568. CoreSight topology

52.4.1 MCU ROM table registers

MCU ROM memory type register (MCUROM_MEMTYPE)

Address offset: 0xFCC

Reset value: 0x0000 0001

Bits 31:1 Reserved, must be kept at reset value.

Bit 0 SYSTEM : system memory

0x1: system memory present on this bus

MCU ROM CoreSight peripheral identity register 4 (MCUROM_PIDR4)

Address offset: 0xFD0

Reset value: 0x0000 0000

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:4 4KCOUNT[3:0] : register file size

0x0: The register file occupies a single 4-Kbyte region.

Bits 3:0 JEP106CON[3:0] : JEP106 continuation code

0x0: STMicroelectronics JEDEC continuation code

MCU ROM CoreSight peripheral identity register 0 (MCUROM_PIDR0)

Address offset: 0xFE0

Reset value: 0x0000 0072

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:0 PARTNUM[7:0] : part number bits [7:0]

0x72: STM32L552xx and STM32L562xx

MCU ROM CoreSight peripheral identity register 1 (MCUROM_PIDR1)

Address offset: 0xFE4

Reset value: 0x0000 0004

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:4 JEP106ID[3:0] : JEP106 identity code bits [3:0]

0x0: STMicroelectronics JEDEC code

Bits 3:0 PARTNUM[11:8] : part number bits [11:8]

0x4: STM32L552xx and STM32L562xx

MCU ROM CoreSight peripheral identity register 2 (MCUROM_PIDR2)

Address offset: 0xFE8

Reset value: 0x0000 000A

Bits 31:8 Reserved, must be kept at reset value.

0x0: rev r0p0

1: designer identification specified by JEDEC

0x2: STMicroelectronics JEDEC code

MCU ROM CoreSight peripheral identity register 3 (MCUROM_PIDR3)

Address offset: 0xFEC

Reset value: 0x0000 0000

Bits 31:8 Reserved, must be kept at reset value.

0x0: No metal fix

0x0: No customer modifications

MCU ROM CoreSight component identity register 0 (MCUROM_CIDR0)

Address offset: 0xFF0

Reset value: 0x0000 000D

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:0 PREAMBLE[7:0] : component identification bits [7:0]

0x0D: Common identification value

MCU ROM CoreSight peripheral identity register 1 (MCUROM_PIDR1)

Address offset: 0xFF4

Reset value: 0x0000 0010

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:4 CLASS[3:0] : Component identification bits [15:12] - component class

0x1: ROM table component

Bits 3:0 PREAMBLE[11:8] : Component identification bits [11:8]

0x0: Common identification value

MCU ROM CoreSight component identity register 2 (MCUROM_CIDR2)

Address offset: 0xFF8

Reset value: 0x0000 0005

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:0 PREAMBLE[19:12] : component identification bits [23:16]

0x05: common identification value

MCU ROM CoreSight component identity register 3 (MCUROM_CIDR3)

Address offset: 0xFFC

Reset value: 0x0000 00B1

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:0 PREAMBLE[27:20] : Component identification bits [31:24]

0xB1: Common identification value

52.4.2 MCU ROM table register map and reset values

Table 458. MCU ROM table register map and reset values

52.4.3 Processor ROM table registers

CPU ROM memory type register (CPUROM_MEMTYPE)

Address offset: 0xFCC

Reset value: 0x0000 0001

Bits 31:1 Reserved, must be kept at reset value.

Bit 0 SYSTEM : system memory

1: system memory present on this bus

CPU ROM CoreSight peripheral identity register 4 (CPUROM_PIDR4)

Address offset: 0xFD0

Reset value: 0x0000 0004

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:4 4KCOUNT[3:0] : register file size

0x0: The register file occupies a single 4-Kbyte region.

Bits 3:0 JEP106CON[3:0] : JEP106 continuation code

0x4: Arm® JEDEC continuation code

CPU ROM CoreSight peripheral identity register 0 (CPUROM_PIDR0)

Address offset: 0xFE0

Reset value: 0x0000 00C9

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:0 PARTNUM[7:0] : Part number bits [7:0]

0xC9: Cortex®-M33

CPU ROM CoreSight peripheral identity register 1 (CPUROM_PIDR1)

Address offset: 0xFE4

Reset value: 0x0000 00B4

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:4 JEP106ID[3:0] : JEP106 identity code bits [3:0]

0xB: Arm® JEDEC code

Bits 3:0 PARTNUM[11:8] : part number bits [11:8]

0x4: Cortex®-M33

CPU ROM CoreSight peripheral identity register 2 (CPUROM_PIDR2)

Address offset: 0xFE8

Reset value: 0x0000 000B

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:4 REVISION[3:0] : component revision number

0x0: rev r0p0

Bit 3 JEDEC : JEDEC assigned value

1: Designer ID specified by JEDEC

Bits 2:0 JEP106ID[6:4] : JEP106 identity code bits [6:4]

0x3: Arm ^® JEDEC code

CPU ROM CoreSight peripheral identity register 3 (CPUROM_PIDR3)

Address offset: 0xFEC

Reset value: 0x0000 0000

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:4 REVAND[3:0] : metal fix version

0x0: No metal fix

Bits 3:0 CMOD[3:0] : customer modified

0x0: no customer modifications

CPU ROM CoreSight component identity register 0 (CPUROM_CIDR0)

Address offset: 0xFF0

Reset value: 0x0000 000D

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:0 PREAMBLE[7:0] : Component identification bits [7:0]

0x0D: Common identification value

CPU ROM CoreSight peripheral identity register 1 (CPUROM_CIDR1)

Address offset: 0xFF4

Reset value: 0x0000 0010

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:4 CLASS[3:0] : Component identification bits [15:12] - component class

0x1: ROM table component

Bits 3:0 PREAMBLE[11:8] : Component identification bits [11:8]

0x0: Common identification value

Address offset: 0xFF8

Reset value: 0x0000 0005

Bits 31:8 Reserved, must be kept at reset value.

0x05: common identification value

Address offset: 0xFFC

Reset value: 0x0000 00B1

Bits 31:8 Reserved, must be kept at reset value.

0xB1: common identification value

52.4.4 Processor ROM table register map and reset values

Table 459. CPU ROM table register map and reset values

52.5 Data watchpoint and trace unit (DWT)

The DWT provides four comparators that can be used as one of the following:

• • watchpoint
• • ETM trigger
• • PC sampling trigger
• • data address sampling trigger
• • data comparator (comparator 1 only)
• • clock cycle counter comparator (comparator 0 only)

It also contains counters for:

• • clock cycles
• • folded instructions
• • load Store Unit (LSU) operations
• • sleep cycles
• • number of cycles per instruction
• • interrupt overhead

A DWT comparator compares the value held in its DWT_COMP register with one of the following:

• • a data address
• • an instruction address
• • a data value
• • the cycle count value, for comparator 0 only

For address matching, the comparator can use a mask, so it matches a range of addresses.

On a successful match, the comparator generates one of the following:

• • one or more DWT data trace packets, containing one or more of:
  • – the address of the instruction that caused a data access
  • – an address offset, bits[15:0] of the data access address
  • – the matched data value
• • a watchpoint debug event, on either the PC value or the accessed data address
• • a CMPMATCH[N] event, that signals the match outside the DWT unit

A watchpoint debug event either generates a DebugMonitor exception, or causes the processor to halt execution and enter Debug state.

For more details on how to use the DWT, refer to the Arm ^® v8-M Architecture Reference Manual [4].

52.5.1 DWT registers

The DWT registers are located at address range 0xE000 1000 to 0xE000 1FFC.

DWT control register (DWT_CTRLR)

Address offset: 0x000

Reset value: 0x4000 0000

Bits 31:28 NUMCOMP[3:0] : number of comparators implemented (read only)

0x4: four comparators

Bit 27 NOTRCPKT : trace sampling and exception tracing support (read only)

0: supported

Bit 26 NOEXTTRIG : external match signal, CMPMATCH support (read only)

0: supported

Bit 25 NOCYCCNT : cycle counter support (read only)

0: supported

Bit 24 NOPRFCNT : profiling counter support (read only)

0: supported

Bit 23 CYCDISS : cycle counter disabled secure.

Controls whether the cycle counter is disabled in secure mode.

0: no effect

1: disable incrementing of the cycle counter when the processor is in secure state

Bit 22 CYCEVTENA : enable for POSTCNT underflow event counter packet generation

0: disabled

1: enabled

Bit 21 FOLDEVENA : enable for folded instruction counter overflow event generation

0: disabled

1: enabled

Bit 20 LSUEVTENA : enable for LSU counter overflow event generation

0: disabled

1: enabled

• Bit 19 SLEEPEVTENA : enable for sleep counter overflow event generation
  • 0: disabled
  • 1: enabled
• Bit 18 EXCEVTENA : enable for exception overhead counter overflow event generation
  • 0: disabled
  • 1: enabled
• Bit 17 CPIEVTENA : enable for CPI counter overflow event generation
  • 0: disabled
  • 1: enabled
• Bit 16 EXCTRCENA : enable for exception trace generation
  • 0: disabled
  • 1: enabled
• Bits 15:13 Reserved, must be kept at reset value.
• Bit 12 PCSAMPLENA : enable for POSTCNT counter to be used as a timer for periodic PC sample packet generation
  • 0: disabled
  • 1: enabled
• Bits 11:10 SYNCTAP[1:0] : position of the synchronization packet counter tap on the CYCCNT counter
  • This field determines the synchronization packet rate.
  • 00: disabled, no synchronization packets
  • 01: Tap at CYCCNT[24]
  • 10: Tap at CYCCNT[26]
  • 11: Tap at CYCCNT[28]
• Bit 9 CYCTAP : Selects the position of the POSTCNT tap on the CYCCNT counter.
  • 0: Tap at CYCCNT[6]
  • 1: Tap at CYCCNT[10]
• Bits 8:5 POSTINIT[3:0] : initial value of the POSTCNT counter
  • Writes to this field are ignored if POSTCNT counter is enabled. CYCEVTENA or PCSAMPLENA bits must be reset prior to writing POSTINIT.
• Bits 4:1 POSTRESET[3:0] : reload value of the POSTCNT counter
• Bit 0 CYCCNTENA : enable CYCCNT counter
  • 0: disabled
  • 1: enabled

DWT cycle count register (DWT_CYCCNTR)

Address offset: 0x004

Reset value: 0x0000 0000

Bits 31:0 CYCCNT[31:0] : processor clock-cycle counter

DWT CPI count register (DWT_CPICNTR)

Address offset: 0x008

Reset value: 0xXXXX XXXX

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:0 CPICNT[7:0] : CPI counter

Counts additional cycles required to execute multi-cycle instructions, except those recorded by DWT_LSUCNTR, and counts any instruction fetch stalls.

DWT exception count register (DWT_EXCCNTR)

Address offset: 0x00C

Reset value: 0xXXXX XXXX

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:0 EXCCNT[7:0] : exception overhead cycle counter

Counts the number of cycles spent in exception processing.

Address offset: 0x010

Reset value: 0xXXXX XXXX

Bits 31:8 Reserved, must be kept at reset value.

Counts the number of cycles spent in sleep mode (WFI, WFE, sleep-on-exit).

Address offset: 0x014

Reset value: 0xXXXX XXXX

Bits 31:8 Reserved, must be kept at reset value.

Counts additional cycles required to execute load and store instructions.

Address offset: 0x018

Reset value: 0xXXXX XXXX

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:0 FOLDCNT[7:0] : folded instruction counter
Increments on each instruction that takes 0 cycles.

DWT program counter sample register (DWT_PCSR)

Address offset: 0x01C

Reset value: 0xXXXX XXXX

Bits 31:0 EIASAMPLE[31:0] : executed instruction address sample value.
Samples the current value of the program counter.

DWT comparator x register (DWT_COMPxR)

Address offset: 0x020 + 0x010 * x, (x = 0 to 3)

Reset value: 0xXXXX XXXX

Bits 31:0 COMP[31:0] : reference value for comparison

Address offset: 0x028

Reset value: 0x5800 0000

Identifies the capability for match for comparator 0.

0b01011: Cycle Counter, Instruction Address, Data Address and Data Address With Value

Bits 26:25 Reserved, must be kept at reset value.

Indicates if a comparator match has occurred since the register was last read.

0: no match

1: a match occurred

Bits 23:12 Reserved, must be kept at reset value.

Defines the size of the object being watched for by Data Value and Data Address comparators.

0x0: 1 byte

0x1: 2 bytes

0x2: 4 bytes

0x3: reserved

Bits 9:6 Reserved, must be kept at reset value.

0x0: trigger only

0x1: generate debug event

0x2: For a Cycle Counter, Instruction Address, Data Address, Data Value or Linked Data Value comparator, generate a Data Trace Match packet. For a Data Address With Value comparator, generate a Data Trace Data Value packet.

0x3: For a Data Address Limit comparator, generate a Data Trace Data Address packet. For a Cycle Counter, Instruction Address Limit, or Data Address comparator, generate a Data Trace PC Value packet. For a Data Address With Value comparator, generate both a Data Trace PC Value packet and a Data Trace Data Value packet.

Controls the type of match generated by comparator 0.

For possible values of this field, refer to [4].

DWT function register 1 (DWT_FUNCTR1)

Address offset: 0x038

Reset value: 0xD000 0000

Bits 31:27 ID[4:0] : capability identification

Identifies the capability for match for comparator 1.

0b11010: Instruction Address, Instruction Address Limit, Data Address, Data Address Limit, and Data Address With Value

Bits 26:25 Reserved, must be kept at reset value.

Bit 24 MATCHED : Comparator match

Indicates if a comparator match has occurred since the register was last read.

0: no match

1: a match occurred

Bits 23:12 Reserved, must be kept at reset value.

Bits 11:10 DATAVSIZE[1:0] : data value size

Defines the size of the object being watched for by Data Value and Data Address comparators.

0x0: 1 byte

0x1: 2 bytes

0x2: 4 bytes

0x3: reserved

Bits 9:6 Reserved, must be kept at reset value.

Bits 5:4 ACTION[1:0] : action on match

0x0: trigger only

0x1: generate debug event

0x2: For a Cycle Counter, Instruction Address, Data Address, Data Value or Linked Data Value comparator, generate a Data Trace Match packet. For a Data Address With Value comparator, generate a Data Trace Data Value packet.

0x3: For a Data Address Limit comparator, generate a Data Trace Data Address packet. For a Cycle Counter, Instruction Address Limit, or Data Address comparator, generate a Data Trace PC Value packet. For a Data Address With Value comparator, generate both a Data Trace PC Value packet and a Data Trace Data Value packet.

Bits 3:0 MATCH[3:0] : match type

Controls the type of match generated by comparator 1.

For possible values of this field, refer to [4].

Address offset: 0x048

Reset value: 0x5000 0000

Identifies the capability for MATCH for comparator 2

0b01010: Instruction Address, Data Address, and Data Address With Value

Bits 26:25 Reserved, must be kept at reset value.

Indicates if a comparator match has occurred since the register was last read.

0: no match

1: a match occurred

Bits 23:12 Reserved, must be kept at reset value.

Defines the size of the object being watched for by Data Value and Data Address comparators.

0x0: 1 byte

0x1: 2 bytes

0x2: 4 bytes

0x3: reserved

Bits 9:6 Reserved, must be kept at reset value.

0x0: trigger only

0x1: Generate debug event

0x2: For a Cycle Counter, Instruction Address, Data Address, Data Value or Linked Data Value comparator, generate a Data Trace Match packet. For a Data Address With Value comparator, generate a Data Trace Data Value packet.

0x3: For a Data Address Limit comparator, generate a Data Trace Data Address packet. For a Cycle Counter, Instruction Address Limit, or Data Address comparator, generate a Data Trace PC Value packet. For a Data Address With Value comparator, generate both a Data Trace PC Value packet and a Data Trace Data Value packet.

Controls the type of match generated by comparator 2.

For possible values of this field, refer to [4]

DWT function register 3 (DWT_FUNCTR3)

Address offset: 0x058

Reset value: 0xF000 0000