38. Debug support (DBG)

38.1 DBG introduction and main features

A comprehensive set of debug features is provided to support software development and system integration:

• • Independent breakpoint debugging of each CPU core in the system
• • Code execution tracing
• • Software instrumentation
• • Cross-triggering

The debug features can be controlled via a JTAG/Serial-wire debug access port, using industry standard debugging tools. A trace port allows data to be captured for logging and analysis.

The debug features are based on Arm CoreSight™ components.

• • General features:
  • – SWJ-DP: JTAG/Serial-wire debug port
  • – AHB-AP: AHB access port
• • CPU1 debug features
  • – ROM table (see Section 38.8 )
  • – System control space (SCS)
  • – Breakpoint unit (FPB) (see Section 38.9 )
  • – Data watchpoint and trace unit (DWT) (see Section 38.6 )
  • – Instrumentation trace macrocell (ITM) (see Section 38.10 )
  • – Trace port interface unit (TPIU) (see Section 38.11 )
  • – Cross trigger interface (CTI) (see Section 38.7 )
• • CPU2 debug features:
  • – ROM tables (see Section 38.13 )
  • – System control space (SCS)
  • – Breakpoint unit (BPU) (see Section 38.14 )
  • – Data watchpoint and trace unit (DWT) (see Section 38.6 )
  • – Cross trigger interface (CTI) (see Section 38.7 )

CPU1 debug features are accessible by the debugger via the CPU1 AHB-AP.

CPU2 debug features are accessible by the debugger via the CPU2 AHB-AP and its associated AHB bus.

Additional information can be found in the Arm® documents referenced in Section 38.15 .

Device level debug features are controlled in the DBGMCU (see Section 38.12 ), only accessible by the CPU1.

38.2 DBG use cases

The trace and debug system is designed to support a variety of typical use cases:

• • Low-cost trace

Limited trace capability is available over the single-wire debug output. This supports code instrumentation using printf , tracing of data and address watchpoints, interrupt detection and program counter sampling. Single-wire trace can be maintained even when one or both processors are switched off or clock-stopped.

• • Breakpoint debugging of each core independently

Both processor cores can be simultaneously and independently debugged using equipment connected to the JTAG/SWD debug port. This enables, among others, breakpoint and watchpoint setting, code stepping and memory access.

• • Synchronous debugging of both cores

When one core stops due to a breakpoint or a debugger stop command, the other core can be stopped as well. Similarly, the cores can be restarted at the same time. This allows the user to debug loosely coupled applications, which require the processors to remain synchronized.

• • Tracing code execution via the trace port

Trace information from the CPU1 (Cortex-M4) is combined into a single trace stream and sent to a trace port analyzer in real time. An ID embedded in the trace allows the analyzer to identify the source of each information packet.

38.3 DBG functional description

38.3.1 DBG block diagram

Figure 384. Block diagram of debug support infrastructure

38.3.2 DBG pins and internal signals

Table 265. JTAG/Serial-wire debug port pins

1. Debug access port JTDO and Trace port TRACESWO are multiplexed on a single device GPIO pin.

Table 266. Single-wire trace port pins

1. TRACESWO is multiplexed with JTDO. This means that single-wire trace is only available when using the Serial-wire debug interface, and not when using JTAG.

38.3.3 DBG interface control

Device debug access is controlled from the following parameters:

• • User option RDP level, as described in Section 4.6.1: Readout protection (RDP)
• • User option DDS, as described in Section 4: Embedded flash memory (FLASH)
• • User option HDPAD (Hide protection access disable), as described in Section 4: Embedded flash memory (FLASH)
• • Flash register bit C2SWDBGEN as described in Section 4: Embedded flash memory (FLASH)

Debug access control is independent from ESE.

Debug access to the CPUs is shown in the table below.

Table 267. Debug access control overview

38.3.4 DBG reset and clocks

The debug port (SWJ-DP) is reset by a power-on reset or an OBL (option byte loading) reset, and when waking up from Standby mode.

The debugger supplies the clock for the debug port via the debug interface pin JTCK/SWCLK. This clock is used to register the serial input data in both Serial-wire and JTAG modes, as well as to operate the state machines and internal logic of the debug port. It must therefore continue to toggle for several cycles after the end of an access, to ensure that the debug port returns to the idle state.

The SWJ-DP contains an asynchronous interface to the DAPCLK domain, which covers the rest of the SWJ-DP and the CPU2 access port.

The DAPCLK is a gated version of the system HCLK3.

The DAPCLK domain is enabled by the debugger using the CDBGPWRUPREQ bit in the DP_CTRLSTATR register. The clock must be enabled before the debugger can access any of the debug features on the device. The availability of the clock is reflected in the CDBGPWRUPACK bit in the DP_CTRLSTATR register. DAPCLK is disabled at power up, after OBL, and after a wake-up from Standby. DAPCLK must be disabled when the debugger is disconnected to avoid wasting energy.

The debug components included in the processors (such as ITM, DWG, FPB) are clocked with the corresponding core clock.

38.3.5 DBG power domains

The debug components are located in the core power domain. This means that debugger connection is not possible in Shutdown or Standby low-power modes. To avoid losing the connection when the device enters Standby mode, it is possible to maintain the power to the core by setting a bit in the microcontroller debug unit (DBGMCU). This also keeps the processor clocks active and hold off the reset, so that the debug session is maintained.

38.3.6 DBG low-power modes

The STM32WL5x devices include power saving features that allow the core power domain to be switched off or stopped when not required. If the power is switched off, or the core is not clocked, all debug components are inaccessible to the debugger. To avoid this, power saving mode emulation has been implemented. If emulation is enabled for a domain, the domain still enters power saving mode, but its clock and power are maintained. In other words, the domain behaves as if it is in power saving mode, but the debugger does not lose the connection.

Emulation mode is programmed in the DBGMCU. For more information refer to Section 38.12: Microcontroller debug unit (DBGMCU) .

38.3.7 Serial-wire and JTAG debug port

The Serial-wire and JTAG debug port (SWJ-DP) is a CoreSight component that implements an external access port for connecting debugging equipment.

The two following types of interface can be configured:

• • a 5-pin standard JTAG interface (JTAG-DP)
• • a 2-pin (clock + data) Serial-wire debug port (SW-DP)

The two modes are mutually exclusive since they share the same I/O pins.

By default the JTAG-DP is selected after a system or a power-on reset. The five I/O pins are configured by hardware in debug alternative function mode.

The SWJ-DP incorporates pull-up resistors on JTDI, JTMS/SWDIO and nJTRST, as well as a pull-down resistor on JTCK/SWCLK.

A debugger can select the SW-DP by transmitting the following serial data sequence on JTMS/SWDIO:

... (50 or more ones) ..., 0, 1, 1, 1, 1, 0, 0, 1, 1, 1, 1, 0, 0, 1, 1, 1, ... (50 or more ones) ...

JTCK/SWCLK must be cycled for each data bit.

In SW-DP mode, the unused JTAG pins JTDI, JTDO and nJTRST can be used for other functions.

Note: All SWJ port I/Os can be reconfigured to other functions by software but debugging is no longer possible.

38.3.8 JTAG debug port

The JTAG debug port (JTAG-DP) implements a TAP state machine (TAPSM) shown in Figure 385 , based on IEEE Std 1149.1-1990. The state machine controls two scan chains, one associated with an instruction register (IR) and the other one with a number of data registers (DR).

Figure 385. JTAG TAP state machine

stateDiagram-v2
    [*] --> Test-Logic-Reset: JTMS=1
    Test-Logic-Reset --> Run-Test/Idle: JTMS=0
    Run-Test/Idle --> Select-DR-Scan: JTMS=1
    Run-Test/Idle --> Select-IR-Scan: JTMS=1
    Select-DR-Scan --> Capture-DR: JTMS=0
    Select-IR-Scan --> Capture-IR: JTMS=0
    Capture-DR --> Shift-DR: JTMS=0
    Capture-IR --> Shift-IR: JTMS=0
    Shift-DR --> Shift-DR: JTMS=0
    Shift-DR --> Exit1-DR: JTMS=1
    Shift-IR --> Shift-IR: JTMS=0
    Shift-IR --> Exit1-IR: JTMS=1
    Exit1-DR --> Pause-DR: JTMS=0
    Exit1-IR --> Pause-IR: JTMS=0
    Pause-DR --> Pause-DR: JTMS=0
    Pause-DR --> Exit2-DR: JTMS=1
    Pause-IR --> Pause-IR: JTMS=0
    Pause-IR --> Exit2-IR: JTMS=1
    Exit2-DR --> Update-DR: JTMS=1
    Exit2-IR --> Update-IR: JTMS=1
    Update-DR --> Run-Test/Idle: JTMS=0
    Update-IR --> Run-Test/Idle: JTMS=0
  

MSV60366V1

The operation of the JTAG-DP is as follows:

• • When the TAPSM goes through the Capture-IR state, 0b0001 is transferred onto the instruction register (IR) scan chain. The IR scan chain is connected between JTDI and JTDO.
• • While the TAPSM is in the Shift-IR state, the IR scan chain shifts one bit for each rising edge of JTCK. This means that, on the first tick:
  • – The LSB of the IR scan chain is output on JTDO.
  • – Bit[n] of the IR scan chain is transferred to bit[n-1].
  • – The value on JTDI is transferred to the MSB of the IR scan chain.
• • When the TAPSM goes through the Update-IR state, the value scanned into the IR scan chain is transferred into the instruction register.
• • When the TAPSM goes through the Capture-DR state, a value is transferred from one of the data registers onto one of the DR scan chains, connected between JTDI and JTDO.
• • The value held in the instruction register determines which data register and associated DR scan chain are selected.

• • This data is then shifted while the TAPSM is in the Shift-DR state, in the same manner as the IR shift in the Shift-IR state.
• • When the TAPSM goes through the Update-DR state, the value scanned into the DR scan chain is transferred into the selected data register.
• • When the TAPSM is in the Run-Test/Idle state, no special actions occur. The IDCODE instruction is loaded in the instruction register.

When active, the nJTRST signal resets the state machine asynchronously to the Test-Logic-Reset state.

The data registers corresponding to the 4-bit IR instructions are listed in Table 268 .

Table 268. JTAG-DP data registers

Table 268. JTAG-DP data registers (continued)

Data registers are described in more detail in the Arm® Debug Interface Architecture Specification [1].

38.3.9 Serial-wire debug port

The Serial-wire debug (SWD) protocol uses the two following pins:

• • SWCLK: clock from host to target
• • SWDIO: bi-directional serial data (100 kΩ pull-up required)

Serial data is transferred LSB first, synchronously with the clock.

Each transfer comprises the three phases listed below:

1. 1. a packet request (8 bits) transmitted by the host (see Table 269 )
2. 2. an acknowledge response (3 bits) transmitted by the target (see Table 270 )
3. 3. data transfer (33 bits) transmitted by the host (in case of a write) or by the target (in case of a read) (see Table 271 )

The data transfer only occurs if the acknowledge response is OK.

Between each phase, if the direction of the data is reversed, a single clock cycle turn-around time is inserted.

Table 269. Packet request

Table 270. ACK response

Table 271. Data transfer

In the case of a FAULT or WAIT ACK response from the target, the data transfer phase is canceled, unless overrun detection is enabled: in this case the data is ignored by the target (in the case of a write), or not driven (in the case of a read).

A line reset must be generated by the host when it is first connected, or following a protocol error. The line reset consists in 50 or more SWCLK cycles with SWDIO high, followed by two SWCLK cycles with SWDIO low.

For more details on the Serial-wire debug protocol, refer to the Arm® Debug Interface Architecture Specification [1].

Note: The SWJ-DP implements SWD protocol version 2.

38.4 Debug port (DP) registers

Both SW-DP and JTAG-DP access the DP registers listed in Table 273: DP register map and reset values .

The debugger accesses the DP registers as follows:

• • Program the A(3:2) field in the DPACC register, if using JTAG, with the register address within the bank. Program the RnW bit to select a read or write. In the case of a write, program the DATA field with the write data. If using SWD, the A(3:2) and RnW fields are part of the packet request word sent to the SW-DP with the APnDP bit reset (see Table 269 ). The write data are sent in the data phase.
• • To access one of the banked DP registers at address 0x4, the register number must first be written to the DP_SELECTR register at address 0x8. Any subsequent read or write to address 0x4 accesses the register corresponding to the content of the DP_SELECTR register.

Table 272. Debug port registers

1. Access to the DP_ABORTR register from the JTAG-DP is done using the ABORT instruction.

2. Only accessible via SW-DP. Register is “reserved” via JTAG-DP.

38.4.1 DP identification register (DP_PIDR)

Address offset: 0x00

Reset value: 0x5BA0 2477

Read only

Bits 31:28 REVISION[3:0] : revision code

0x5

Bits 27:20 PARTNO[7:0] : part number for the debug port

0xBA

Bits 19:17 Reserved, must be kept at reset value.

Bit 16 MIN : minimal debug port (MINDP) implementation

0x0: MINDP not implemented (transaction counter and pushed operations are supported)

Bits 15:12 VERSION[3:0] : DP architecture version

0x2: DPv2

Bits 11:1 DESIGNER[10:0] : JEDEC designer identity code

0x23B: Arm® JEDEC code

Bit 0 Reserved, must be kept at reset value.

38.4.2 DP abort register (DP_ABORTR)

Address offset: 0x00

Reset value: 0x0000 0000

Write only

Bits 31:5 Reserved, must be kept at reset value.

Bit 4 ORUNERRCLR : overrun error clear

0: No effect

1: Clears DP_CTRLSTATR.STICKYORUN bit.

Bit 3 WDERRCLR : write data error clear

0: No effect

1: Clears DP_CTRLSTATR.WDATAERR bit.

Bit 2 STKERRCLR : sticky error clear

0: No effect

1: Clears DP_CTRLSTATR.STICKYERR bit.

Bit 1 STKMPCLR : sticky compare clear

0: No effect

1: Clears DP_CTRLSTATR.STICKYCMP bit

Bit 0 DAPABORT : data AP abort

Aborts current AP transaction if an excessive number of WAIT responses are returned, indicating that the transaction is stalled.

0: No effect

1: Aborts the transaction.

38.4.3 DP control and status register (DP_CTRLSTATR)

Address offset: 0x04

and DP_SELECTR.DPBANKSEL = 0

Reset value: 0x0000 0000

Bits 31:30 Reserved, must be kept at reset value.

Bit 29 CDBGPWRUPACK : see description in Section 38.3.7

0 = DAPCLK gated

1 = DAPCLK enabled

Bit 28 CDBGPWRUPREQ : control of DAPCLK enable request signal

0 = Requests DAPCLK gating

1 = Requests DAPCLK enabled

Bits 27:24 Reserved, must be kept at reset value.

Bits 23:12 TRNCNT[11:0] : transaction counter

To program a sequence of transactions to incremental addresses via an AP, TRNCNT is loaded with the number of transactions to perform. It is decremented at the successful completion of each transaction.

Indicates the bytes to be masked in pushed-compare and pushed-verify operations (DP_CTRLSTATR.TRNMODE = 1 or 2). In the pushed operations, the word supplied in an AP write transaction is compared with the current value at the target AP address.

1XXX = includes byte lane 3 in comparisons.

X1XX = includes byte lane 2 in comparisons.

XX1X = includes byte lane 1 in comparisons.

XXX1 = includes byte lane 0 in comparisons.

There is a parity or framing error on the data phase of a write, or a write that has been accepted by the DP is then discarded without being submitted to the AP.

This bit is reset by writing 1 to the DP_ABORTR.WDERRCLR bit.

0: No error

1: An error occurred.

Reserved in JTAG-DP.

Indicates the response to the last AP read access.

0: Read not OK

1: Read OK

Reserved in JTAG-DP.

Indicates that an error occurred in an AP transaction.

0: No error

1: An error occurred.

In SW-DP, STICKYERR bit is read only, reset by writing 1 to the DP_ABORTR.STKERRCLR bit.

In JTAG-DP, STICKYERR bit is read, cleared by writing a 1 to it.

Indicates that a match occurred in a pushed operation.

0: match if TRNMODE = 0x1; no match if TRNMODE = 0x2

1: no match if TRNMODE = 0x1; match if TRNMODE = 0x2

In SW-DP, STICKYCMP bit is read only, reset by writing 1 to the DP_ABORTR.STKCMPCLR bit.

In JTAG-DP, STICKYCMP bit is read, cleared by writing a 1 to it.

Bits 3:2 TRNMODE[1:0] : transfer mode for AP write operations

For read operations, this field must be set to 0x0.

0x0: Normal operation

• – AP transactions are passed directly to the AP.

0x1: Pushed-verify operation

• – The DP stores the write data and performs a read transaction at the target AP address.
• – The result of the read is compared with the stored data and if they do not match, the STICKYCMP bit is set.

0x2: Pushed-compare operation

• – The DP stores the write data and performs a read transaction at the target AP address.
• – The result of the read is compared with the stored data and if they match, the STICKYCMP bit is set.

0x3: reserved

In pushed operation, only the data bytes indicated by the MASKLANE field are included in the compare.

Bit 1 STICKYORUN : overrun (read only in SW-DP, R/W in JTAG-DP)

Indicates that an overrun occurred (new transaction received before previous transaction completed). This bit is only set if the ORUNDETECT bit is set.

0: No overrun

1: An overrun occurred.

In SW-DP, STICKYORUN bit is read only, reset by writing 1 to the DP_ABORTR.ORUNERRCLR bit.

In JTAG-DP, STICKYORUN bit is read, cleared by writing a 1 to it.

Bit 0 ORUNDETECT : overrun detection mode enable

0: Overrun detection disabled

1: Overrun detection enabled

In the event of an overrun, the STICKYORUN bit is set and subsequent transactions are blocked until the STICKYORUN bit is cleared.

38.4.4 DP data link control register (DP_DLCR)

Address offset: 0x04

and DP_SELECTR.DPBANKSEL = 1

Reset value: 0x0000 0040

Bits 31:10 Reserved, must be kept at reset value.

Bits 9:8 TURNROUND[1:0] : tristate period for SWDIO

0x0: 1 data bit period

0x1: 2 data bit periods

0x2: 3 data bit periods

0x3: 4 data bit periods

Bits 7:0 Reserved, must be kept at reset value.

38.4.5 DP target identification register (DP_TARGETIDR)

Address offset: 0x04

and DP_SELECTR.DPBANKSEL = 2

Reset value: 0x0497 0041

Bits 31:28 TREVSION[3:0] : target revision

0x0: revision 1

Bits 27:12 TPARTNO[15:0] : target part number

0x4970: STM32WL5x

Bits 11:1 TDESIGNER[10:0] : target designer JEDEC code.

0x020: STMicroelectronics

Bit 0 Reserved, must be kept at reset value.

38.4.6 DP data link protocol identification register (DP_DLPIDR)

Address offset: 0x04

and DP_SELECTR.DPBANKSEL = 3

Reset value: 0x0000 0001

Bits 31:28 TINSTANCE[3:0] : target instance number

Defines the instance number for this device in a multi-drop system.

0x0: Instance number 0

Bits 27:4 Reserved, must be kept at reset value.

Bits 3:0 PROTSVN[3:0] : Serial-wire debug protocol version
0x1: Version 2

38.4.7 DP resend register (DP_RESENR)

Address offset: 0x08

Reset value: 0x0000 0000

Bits 31:0 RESEND[31:0] : Returns the value that was returned by the last AP read or DP_RDBUFR read.

Used in the event of a corrupted read transfer.

38.4.8 DP access port select register (DP_SELECTR)

Address offset: 0x08

Reset value: 0xXXXX XXXX

Bits 31:28 APSEL[3:0] : access port selection

Selects the access port for the next transaction.

0x0: AP0 - CPU1 (Cortex-M4) debug access port (AHB-AP)

0x1: AP1 - CPU2 (Cortex-M0+) debug access port (AHB-AP)

0x2 to 0xF: reserved

Bits 27:8 Reserved, must be kept at reset value.

Bits 7:4 APBANKSEL[3:0] : AP register bank selection

Selects the 4-word register bank on the active AP for the next transaction.

Bits 3:0 DPBANKSEL[3:0] : DP register bank selection

Selects the register at address 0x4 of the debug port.

0x0: DP_CTRLSTATR

0x1: DP_DLCR

0x2: DP_TARGETIDR

0x3: DP_DLPIDR

0x4 to 0xF: reserved

38.4.9 DP read buffer register (DP_BUFFR)

Address offset: 0x0C

Reset value: 0x0000 0000

Bits 31:0 RDBUFF[31:0] : Contains the value returned by the last AP read access.

The value returned by an AP read access can either be obtained using a second read access to the same address, which initiates a new transaction on the corresponding bus, or else it can be read from this register, in which case no new AP transaction occurs.

38.4.10 DP target identification register (DP_TARGETSELR)

Address offset: 0x0C

Reset value: 0xXXXX XXXX

Bits 31:28 TINSTANCE[3:0] : target instance number

Defines the instance number for the target device in a multi-drop system. These bits must be written with the same value used for DP_DLPIDR.TINSTANCE to select this device.

Bits 27:12 TPARTNO[15:0] : target part number

Defines the part number for the target device. These bits must be written with the same value used for DP_TARGETIDR.TPARTNO to select this device.

Bits 11:1 TDESIGNER[10:0] : target designer JEDEC code

Defines the JEDEC code for the target device. These bits must be written with the same value used for DP_TARGETIDR.TDESIGNER to select this device.

Bit 0 Reserved, must be kept at reset value.

38.4.11 DP register map and reset values

These registers are not on the CPU memory bus and are only accessed through SW-DP and JTAG-DP debug interface.

The debug port address is 2-bit wide, defined in the JTAG-DP register DPACC or SW-DP packet request A[3:2] field.

Table 273. DP register map and reset values

Table 273. DP register map and reset values (continued)

1. 1. DP_SELECTR.DPBANKSEL = 0.
2. 2. DP_SELECTR.DPBANKSEL = 1.
3. 3. DP_SELECTR.DPBANKSEL = 2.
4. 4. DP_SELECTR.DPBANKSEL = 3.

38.5 Access ports

As shown in Figure 386 , there are two access ports (AP) attached to the DP:

• • AP0 , CPU1 (Cortex-M4) access port (AHB-AP): enables access to the debug and trace features integrated in the core via its internal AHB bus.
• • AP1 , CPU2 (Cortex-M0+) access port (AHB-AP): enables access to the debug and trace features integrated in the core via its internal AHB bus.

The access ports are of MEM-AP type, that is to say the debug and trace component registers are mapped in the address space of the associated debug bus.

AP is seen by the debugger as a set of 32-bit registers organized in banks of four registers each. Some of these registers are used to configure or monitor the AP itself, while others are used to perform a transfer on the bus.

The AP registers are listed in Table 275: AP register map and reset values .

Figure 386. Debug and access port connections

graph LR
    JTAG_SWD[JTAG/SWD] <--> SWJ_DP[SWJ-DP]
    SWJ_DP <--> DAPBUS[DAPBUS]
    DAPBUS --> AP0[AP0
(AHB-AP)]
    DAPBUS --> AP1[AP1
(AHB-AP)]
    AP0 <--> CPU1[CPU1 Cortex-M4]
    AP1 <--> CPU2[CPU2 Cortex-M0+]
  

The address of the AP registers is composed as follows:

• • Bits [7:4]: content of the APBANKSEL[3:0] field in the DP_SELECTR register (see Section 38.4.8 )
• • Bits [3:2]: content of the A(3:2) field of the APACC data register in the JTAG-DP (see Table 273: DP register map and reset values ) or of the SW-DP packet request (see Table 269: Packet request ), depending on the debug interface used
• • Bits [1:0]: always set to 0

The content of the APSEL[3:0] field of the DP_SELECTR register defines which MEM-AP is being accessed.

Table 274. MEM-AP registers

The debugger can access the AP registers as follows:

1. 1. Program in the DP_SELECTR register, the APSEL(3:0) field to choose one of the APs and the APBANKSEL[3:0] field to select the register bank to be accessed (see Section 38.4.8 ).
2. 2. Program the A(3:2) field in the APACC register, if using JTAG, with the register address within the bank. Program the RnW bit to select a read or write. In the case of a write, program the DATA field with the write data. If using SWD, the A(3:2) and RnW fields are part of the packet request word sent to the SW-DP with the APnDP bit set (see Table 269: Packet request ). The write data is sent in the data phase.

The debugger can access the memory mapped debug component registers through the MEM-AP registers (using the above AP register access procedure) as follows:

1. 1. Program the transaction target address in the AP_TAR register.
2. 2. Program the AP_CSWR register, if necessary, with the transfer parameters (AddrInc for example).
3. 3. Write to or read from the AP_DRWR register to initiate a bus transaction at the address held in the AP_TAR register. Alternatively, a read or write to the AP_BDxR register triggers an access to address \( AP\_TAR[31:4] + x \) (allowing up to four consecutive addresses to be accessed without changing the address in the AP_TAR register).

Figure 387 shows how the MEM-AP is used to connect the debug port to the debug components (in this example a processor and a ROM table).

For more detailed information on the MEM-AP, refer to the Arm® Debug Interface Architecture Specification [1] .

Figure 387. Debugger connection to debug components

38.5.1 AP control/status word register (AP_CSWR)

Address offset: 0x00

Reset value: 0x2300 0040

Bit 31 Reserved, must be kept at reset value.

Bit 30 SPROT : secure transfer request

In the AHB-APs, this field sets the protection attribute HPROT[6] of the bus transfer.

0: If SPIDEN is high, secure transfer. If SPIDEN is low, non-secure transfer

1: Non-secure transfer

Bit 29 Reserved, must be kept at reset value.

Bits 28:24 PROT[4:0] : bus transfer protection

In the AHB-APs, this field sets the protection attributes HPROT[4:0] of the bus transfer.

XXXX0: Instruction fetch

XXXX1: Data access

XXX0X: User mode

XXX1X: Privileged mode

XX0XX: Non-bufferable

XX1XX: Bufferable

X0XXX: Non-cacheable

X1XXX: Cacheable

0XXXX: Non-exclusive

1XXXX: Exclusive

Bit 23 SPISTATUS : status of SPIDEN option bit (read only)

This signal determines whether the debugger can access secure memory.

0: Secure AHB transfers blocked

1: Secure AHB transfers allowed

Bits 22:12 Reserved, must be kept at reset value.

Bits 11:8 MODE[3:0] : barrier support enabled

Defines if memory barrier operation is supported.

0x0: Not supported

Bit 7 TRINPROG : transfer in progress (read only)

Indicates if a bus transfer is in progress on the AP.

0x0: No transfer in progress

0x1: Bus transfer in progress

Bit 6 DEVICEEN : device enabled (read only)

Defines whether the AP can be accessed.

0x1: AP access enabled

Bits 5:4 ADDRINC[1:0] : auto-increment mode

Defines whether AP_TAR address is automatically incremented after a transaction.

0x0: No auto-increment

0x1: Address is incremented by the size in bytes of the transaction (SIZE field).

0x2: Packed transfers enabled

• – A 32-bit AP access gives rise to 1 x 32-bit, 2 x 16-bit or 4 x 8-bit bus transactions corresponding to the programmed transaction size.
• – The data is packed or unpacked accordingly.

0x3: reserved

Bit 3 Reserved, must be kept at reset value.

Bits 2:0 SIZE[2:0] : size of next memory access transaction

0x0: Byte (8-bit)

0x1: Halfword (16-bit)

0x2: Word (32-bit)

0x3-0x7: reserved

38.5.2 AP transfer address register (AP_TAR)

Address offset: 0x04

Reset value: 0x0000 0000

Bits 31:0 TA[31:0] : address of current transfer

38.5.3 AP data read/write register (AP_DRWR)

Address offset: 0x0C

Reset value: 0x0000 0000

Bits 31:0 TD[31:0] : data of current transfer

38.5.4 AP banked data registers x (AP_BDxR)

Address offset: \( 0x10 + 0x04 * x \) , ( \( x=0 \) to \( 3 \) )

Reset value: 0x0000 0000

Bits 31:0 TBD[31:0] : banked data of current transfer to address AP_TAR.TA
\( TA + AP\_BDnR\ address\ [3:2] + 0b00 \)
Auto address incrementing is not performed on AP_BD[3:0]R.
Banked transfers are only supported for word transfers.

38.5.5 AP base address register (AP_BASER)

Address offset: 0xF8

Reset value: 0xE00F F003 (AP0)

Reset value: 0xF000 0003 (AP1)

Bits 31:12 BASEADDR[19:0] : base address (bits 31 to 12) of ROM table for the AP
The 12 LSBs are zero since the ROM table must be aligned on a 4-Kbyte boundary.
AP0 CPU1 (Cortex-M4) AHB-AP: 0xE00FF
AP1 CPU2 (Cortex-M0+) AHB-AP: 0xF0000

Bits 11:2 Reserved, must be kept at reset value.

Bit 1 FORMAT : base address register format
1: Arm debug interface v5

Bit 0 ENTRYPRESENT : Indicates that debug components are present on the access port bus.
1: Debug components are present

38.5.6 AP identification register (AP_IDR)

Address offset: 0xFC

Reset value: 0x2477 0011 (AP0)

Reset value: 0x6477 0001 (AP1)

Bits 31:28 REVISION[3:0] : revision
0x2: CPU1 Cortex-M4 r0p3
0x6: CPU2 Cortex-M0+ r0p7

Bits 27:24 JEDECBANK[3:0] : JEDEC bank
0x4: Arm

Bits 23:17 JEDECCODE[6:0] : JEDEC code
0x3B: Arm

Bit 16 MEMAP : memory access port
0x1: Standard register map

Bits 15:8 Reserved, must be kept at reset value.

Bits 7:0 IDENTITY[7:0] : AP type
0x11: CPU1 (Cortex-M4) AHB-AP (AP0)
0x01: CPU2 (Cortex-M0+) AHB-AP (AP1)
Others: reserved

38.5.7 AP register map and reset values

These registers are not on the CPU memory bus and are only accessed through SW-DP and JTAG-DP debug interface.

The access port address is 8-bit wide, defined by debug port register DP_SELECTR.APBANKSEL[3:0] field and by JTAG-DP register DPACC or SW-DP packet request A[3:2] field.

Table 275. AP register map and reset values

Table 275. AP register map and reset values (continued)

38.6 Data watchpoint and trace unit (DWT)

The DWT provides four comparators that can be used as one of the following function:

• • watchpoint
• • PC sampling trigger
• • data address sampling trigger
• • data comparator (comparator 1 only)
• • clock cycle counter comparator (comparator 0 only)

It also contains counters for:

• • clock cycles
• • folded instructions
• • load store unit (LSU) operations
• • sleep cycles
• • number of cycles per instruction
• • interrupt overhead

A DWT comparator compares the value held in its DWT_COMPxR registers with one of the following:

• • a data address
• • an instruction address
• • a data value
• • the cycle count value, for comparator 0 only.

For address matching, the comparator can use a mask, so it matches a range of addresses.

On a successful match, the comparator generates one of the following:

• • one or more DWT data trace packets, containing one or more of:
  • – the address of the instruction that caused a data access
  • – an address offset, bits[15:0] of the data access address
  • – the matched data value
• • a watchpoint debug event, on either the PC value or the accessed data address
• • a CMPMATCH[N] event that signals the match outside the DWT unit

A watchpoint debug event either generates a DebugMonitor exception or causes the processor to halt execution and enter Debug state.

For more details on how to use the DWT, refer to the Arm ^® v7-M Architecture Reference Manual [5].

38.6.1 DWT control register (DWT_CTRLR)

Address offset: 0x000

Reset value: 0x4000 0000

Bits 31:28 NUMCOMP[3:0] : number of comparators implemented (read only)

0x4: Four comparators

Bit 27 NOTRCPKT : trace sampling and exception tracing support (read only)

0: Supported

Bit 26 NOEXTTRIG : external match signal, CMPMATCH support (read only)

0: Supported

Bit 25 NOCYCCNT : cycle counter support (read only)

0: Supported

Bit 24 NOPRFCNT : profiling counter support (read only)

0: Supported

1. Bit 23 Reserved, must be kept at reset value.
2. Bit 22 CYCEVTENA : enable for POSTCNT underflow event counter packet generation
   0: Disabled
   1: Enabled
3. Bit 21 FOLDEVVTENA : enable for folded instruction counter overflow event generation
   0: Disabled
   1: Enabled
4. Bit 20 LSUEVTENA : enable for LSU counter overflow event generation
   0: Disabled
   1: Enabled
5. Bit 19 SLEEPEVTENA : enable for sleep counter overflow event generation
   0: Disabled
   1: Enabled
6. Bit 18 EXCEVTENA : enable for exception overhead counter overflow event generation
   0: Disabled
   1: Enabled
7. Bit 17 CPIEVVTENA : enable for CPI counter overflow event generation
   0: Disabled
   1: Enabled
8. Bit 16 EXCTRCENA : enable for exception trace generation
   0: Disabled
   1: Enabled
9. Bits 15:13 Reserved, must be kept at reset value.
10. Bit 12 PCSAMPLENA : enable for POSTCNT counter used as a timer for periodic PC sample packet generation
    0: Disabled
    1: Enabled
11. Bits 11:10 SYNCTAP[1:0] : synchronization packet counter tap
    Selects the position of the synchronization packet counter tap on the CYCCNT counter. This determines the synchronization packet rate.
    0x0: Disabled. No synchronization packets
    0x1: Tap at CYCCNT[24]
    0x2: Tap at CYCCNT[26]
    0x3: Tap at CYCCNT[28]
12. Bit 9 CYCTAP : Selects the position of the POSTCNT tap on the CYCCNT counter.
    0: Tap at CYCCNT[6]
    1: Tap at CYCCNT[10]
13. Bits 8:5 POSTINIT[3:0] : initial value of the POSTCNT counter
    Writes to this field are ignored if POSTCNT counter is enabled (CYCEVTENA or PCSAMPLENA must be reset prior to writing POSTINIT).
14. Bits 4:1 POSTPRESET[3:0] : Reloads value of the POSTCNT counter.
15. Bit 0 CYCCNTENA : enable for CYCCNT counter
    0: Disabled
    1: Enabled

38.6.2 DWT cycle count register (DWT_CYCCNTR)

Address offset: 0x004

Reset value: 0x0000 0000

Bits 31:0 CYCCNT[31:0] : processor clock cycle counter

38.6.3 DWT CPI count register (DWT_CPICNTR)

Address offset: 0x008

Reset value: 0x0000 0000

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:0 CPICNT[7:0] : CPI counter

Counts additional cycles required to execute multi-cycle instructions (except those recorded by DWT_LSUCNTR) and counts any instruction fetch stalls.

38.6.4 DWT exception count register (DWT_EXCCNTR)

Address offset: 0x00C

Reset value: 0x0000 0000

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:0 EXCCNT[7:0] : exception overhead cycle counter

Counts the number of cycles spent in exception processing.

38.6.5 DWT sleep count register (DWT_SLP CNTR)

Address offset: 0x010

Reset value: 0x0000 0000

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:0 SLEEP CNT[7:0] : sleep cycle counter

Counts the number of cycles spent in sleep mode (WFI, WFE, sleep-on-exit).

38.6.6 DWT LSU count register (DWT_LSUCNTR)

Address offset: 0x014

Reset value: 0x0000 0000

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:0 LSUCNT[7:0] : load store counter

Counts additional cycles required to execute load and store instructions.

38.6.7 DWT fold count register (DWT_FOLDCNTR)

Address offset: 0x018

Reset value: 0x0000 0000

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:0 FOLDCNT[7:0] : folded instruction counter

Increments on each instruction that takes 0 cycles.

38.6.8 DWT program counter sample register (DWT_PCSR)

Address offset: 0x01C

Reset value: 0x0000 0000

Bits 31:0 EIASAMPLE[31:0] : executed Instruction Address sample value
Samples the current value of the program counter.

38.6.9 DWT comparator register x (DWT_COMPxR)

Address offset: 0x020 + 0x010 * x, (x = 0 to 3)

Reset value: 0x0000 0000

Bits 31:0 COMP[31:0] : reference value for comparison

38.6.10 DWT mask register x (DWT_MASKxR)

Address offset: 0x024 + 0x010 * x, (x = 0 to 3)

Reset value: 0x0000 0000

Bits 31:5 Reserved, must be kept at reset value.

Bits 4:0 MASK[4:0] : comparator mask size

Provides the size of the ignore mask applied to the access address for address range matching by comparator n. A debugger can write 0b11111 to this field and then read the register back to determine the maximum mask size supported.

38.6.11 DWT function register x (DWT_FUNCTxR)

Address offset: 0x028 + 0x010 * x, (x = 0 to 3)

Reset value: 0x0000 0000

Bits 31:25 Reserved, must be kept at reset value.

Bit 24 MATCHED : comparator match (read only)

Indicates if a comparator match has occurred since the register was last read.

0: No match

1: Match occurred

Bits 23:20 Reserved, must be kept at reset value.

Bits 19:16 DATAVADDR1[3:0] : When the DATAVMATCH and LNK1ENA bits are both 1, this field can hold the comparator number of a second comparator to use for linked address comparison.

Bits 15:12 DATAVADDR0[3:0] : When the DATAVMATCH and LNK1ENA bits are both 1, this field can hold the comparator number of a comparator to use for linked address comparison.

Bits 11:10 DATAVSIZE[1:0] : For data value matching, specifies the size of the required data comparison.

0x0: Byte

0x1: Half word

0x2: Word

0x3: reserved

Bit 9 LNK1ENA : enable for a second linked comparator

Indicates whether use of a second linked comparator is supported (read only).

0x1: Supported

Bit 8 DATAVMATCH : enable for cycle comparison.

0x0: Address comparison

0x1: Data value comparison

Bit 7 CYCMATCH : enable for cycle count comparison on comparator 0

This field is reserved for other comparators.

0x0: No cycle count comparison

0x1: Compares DWT_COMP0R with the cycle counter, DWT_CYCCNTR.

Bit 6 Reserved, must be kept at reset value.

Bit 5 EMITRANGE : Enables generation of data trace address offset packets (containing data address bits 0 to 15).

0x0: Disabled

0x1: Enabled

Bit 4 Reserved, must be kept at reset value.

Bits 3:0 FUNCTION[3:0] : Selection of action to take on comparator match

The meaning of this bit field depends on the setting of the DATAVMATCH and CYCMATCH fields. See [5].

38.6.12 DWT CoreSight peripheral identity register 4 (DWT_PIDR4)

Address offset: 0xFD0

Reset value: 0x0000 0004

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:4 F4KCOUNT[3:0] : register file size

0x0: Register file occupies a single 4-Kbyte region.

Bits 3:0 JEP106CON[3:0] : JEP106 continuation code

0x4: Arm® JEDEC code

38.6.13 DWT CoreSight peripheral identity register 0 (DWT_PIDR0)

Address offset: 0xFE0

Reset value: 0x0000 0002

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:0 PARTNUM[7:0] : part number bits [7:0]

0x02: DWT part number

38.6.14 DWT CoreSight peripheral identity register 1 (DWT_PIDR1)

Address offset: 0xFE4

Reset value: 0x0000 00B0

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:4 JEP106ID[3:0] : JEP106 identity code bits [3:0]

0xB: Arm® JEDEC code

Bits 3:0 PARTNUM[11:8] : part number bits [11:8]

0x0: DWT part number

38.6.15 DWT CoreSight peripheral identity register 2 (DWT_PIDR2)

Address offset: 0xFE8

Reset value: 0x0000 003B

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:4 REVISION[3:0] : component revision number

0x3: r0p4

Bit 3 JEDEC : JEDEC assigned value

0x1: Designer ID specified by JEDEC

Bits 2:0 JEP106ID[6:4] : JEP106 identity code bits [6:4]

0x3: Arm® JEDEC code

38.6.16 DWT CoreSight peripheral identity register 3 (DWT_PIDR3)

Address offset: 0xFEC

Reset value: 0x0000 0000

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:4 REVAND[3:0] : metal fix version

0x0: No metal fix

Bits 3:0 CMOD[3:0] : customer modified

0x0: No customer modifications

38.6.17 DWT CoreSight component identity register 0 (DWT_CIDR0)

Address offset: 0xFF0

Reset value: 0x0000 000D

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:0 PREAMBLE[7:0] : component ID bits [7:0]

0x0D: Common ID value

38.6.18 DWT CoreSight peripheral identity register 1 (DWT_CIDR1)

Address offset: 0xFF4

Reset value: 0x0000 00E0

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:4 CLASS[3:0] : component ID bits [15:12] - component class
0xE: Trace generator component

Bits 3:0 PREAMBLE[11:8] : component ID bits [11:8]
0x0: Common ID value

38.6.19 DWT CoreSight component identity register 2 (DWT_CIDR2)

Address offset: 0xFF8

Reset value: 0x0000 0005

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:0 PREAMBLE[19:12] : component ID bits [23:16]
0x05: Common ID value

38.6.20 DWT CoreSight component identity register 3 (DWT_CIDR3)

Address offset: 0xFFC

Reset value: 0x0000 00B1

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:0 PREAMBLE[27:20] : component ID bits [31:24]
0xB1: Common ID value

38.6.21 DWT register map

Table 276. DWT register map and reset values

Table 276. DWT register map and reset values (continued)

Table 276. DWT register map and reset values (continued)

Refer to Section 38.8: CPU1 ROM table and Section 38.13: CPU2 ROM tables for the register boundary addresses.

38.7 Cross trigger interface (CTI) and cross trigger matrix (CTM)

CTI and CTM taken together form the CoreSight embedded cross trigger (see Figure 388 ).

There are two CTI components, one dedicated to the CPU2 and one dedicated to the CPU1. The CTIs are connected to each other via the CTM. The CTI registers are accessible to the debugger via the corresponding access port and associated AHB.

Figure 388. Embedded cross trigger

The CTIs enable events from various sources to trigger debug activity. For example, a breakpoint reached in one of the processor cores can stop the other processor.

Each CTI has up to eight trigger inputs and eight trigger outputs. Any input can be connected to any output, on the same CTI or on another CTI via the CTM.

The trigger input and output signals for each CTI are listed in Table 277 to Table 280 .

Table 277. CPU2 CTI inputs

Table 277. CPU2 CTI inputs (continued)

Table 278. CPU2 CTI outputs

Table 279. CPU1 CTI inputs

Table 280. CPU1 CTI outputs

Table 280. CPU1 CTI outputs (continued)

There are four event channels in the CTM, thus enabling up to four, parallel, bidirectional connections between trigger inputs and outputs on different CTIs. To connect input number m on CTIx to output number n on CTIy, the input must be connected to an event channel p using the CTI_INENR m register of CTIx. The same channel p must be connected to the output using the CTI_OUTENR n register of CTIy.

Note: This applies even if the input and output belong to the same CTI.

An input can be connected to more than one channel (up to four), so an input can be routed to several outputs. Similarly, an output can be connected to several inputs. It is also possible to connect several inputs/outputs to the same channel.

Figure 389. Mapping trigger inputs to outputs

Example configurations

When either CPU core hits a breakpoint, the other core is stopped. Restart the two cores synchronously.

To stop both cores when one of them stops, the HALTED output of each core must be connected to the EDBGREQ input of the opposite core.

As shown in Table 277 and Table 279 , the HALTED signal from the CPU2 is connected to input 0 of the CPU2 CTI and the same signal from the CPU1 is connected to the same input on the CPU1 CTI. Hence the CTI_IENR0 register is programmed on each CTI to connect these inputs to a CTM channel (such as channel 0).

As shown in Table 278 and Table 280 , the EDBGREQ signals to the CPUs are connected to output 0 of the respective CTIs. The CTI_OUTENR0 register is then programmed on each CTI to connect these outputs to the same CTM channel.

To restart both cores simultaneously the debugger must use the CTI_APPPULSER register in one of the CTIs. This allows the debugger to generate a pulse on any of the four CTM channels. The channel must be connected to the DBGRESTART signal of both cores.

As shown in Table 278 and Table 280 , the DBGRESTART signals to the CPUs are connected to output 1 of the respective CTIs. The CTI_OUTENR1 register is then programmed on each CTI to connect these outputs to an unused CTM channel (such as channel 1).

The above configuration is illustrated in Figure 390 .

Figure 390. Cross trigger configuration example

MSv60371V1

The steps detailed below force the processors to restart simultaneously:

1. 1. Clear the debug request by writing 0x01, then 0x00, to the CTI_INTACKR register in each CTI.
2. 2. Cause a pulse on channel 1 by writing 0x02 to the CTI_APPPULSER register in either CTI. This generates a restart request to both processors.

Note: The debugger can also force both cores to stop simultaneously by writing 0x01 to the CTI_APPPULSER register in either CTI, which generates a pulse on channel 0.

For more information on the CTI CoreSight component, refer to the Arm® CoreSight SoC-400 Technical Reference Manual [2] .

38.7.1 CTI registers

The register file base addresses are 0xE0043000 for CPU1 CTI and 0xF0001000 for CPU2 CTI (not an issue as the CTIs are accessed via different access ports). The registers are the same for each CTI.

CTI control register (CTI_CONTROLR)

Address offset: 0x000

Reset value: 0x0000 0000

Bits 31:1 Reserved, must be kept at reset value.

Bit 0 GLBEN : global enable

0: Cross-triggering disabled

1: Cross-triggering enabled

CTI trigger acknowledge register (CTI_INTACKR)

Address offset: 0x010

Reset value: 0x0000 0000

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:0 INTACK[7:0] : trigger acknowledge

There is one bit of the register for each CTITRIGOUT output. When a 1 is written to a bit in this register, the corresponding CTITRIGOUT output is acknowledged, causing it to be cleared.

CTI application trigger set register (CTI_APPSETR)

Address offset: 0x014

Reset value: 0x0000 0000