38. Debug support (DBG)

38.1 Introduction

A limited set of debug features is provided to support software development and system integration:

• • Breakpoint debugging of the CPU core

The debug features can be controlled via a serial-wire debug access port, using industry standard debugging tools. The debug features are based on Arm® CoreSight™ components:

• • SWJ-DP: JTAG/Serial-wire debug port
• • AHB-AP: AHB access port
• • APB-AP: APB access port
• • ROM table
• • System control space (SCS)
• • Breakpoint unit (BPU)
• • Data watchpoint and trace unit (DWT)

The debug features are accessible by the debugger via the access ports.

Additional information can be found in the Arm documents referenced in Section 38.10: Reference documents .

Note: Only nonsecure memory access is supported in this product.

38.2 DBG functional description

38.2.1 DBG block diagram

Figure 386. Block diagram of debug support infrastructure

MSV72603V1

38.2.2 DBG pins and internal signals

SWD port pins

Two pins are used as outputs for the SW-DP as alternate functions of general purpose I/Os. These pins are available on all packages.

Table 239. SW debug port pins

SW-DP pin assignment

After reset (SYSRESETn or PORESETn), the pins used for the SW-DP are assigned as dedicated pins, which are immediately usable by the debugger host.

However, the MCU offers the possibility to disable the SWD port, and can then release the associated pins for general-purpose I/O (GPIO) usage. For more details on how to disable SW-DP port pins, refer to Section 7.3.2: I/O pin alternate function multiplexer and mapping on page 228 .

Internal pull-up and pull-down on SWD pins

Once the SWD port is released by the user software, the GPIO controller takes control of these pins. The reset state of the GPIO control registers puts the I/Os in the following states:

• • SWDIO: input pull-up
• • SWCLK: input pull-down

Note: Having embedded pull-up and pull-down resistors removes the need to add external resistors.

38.2.3 ID codes and locking mechanism

There are several ID codes inside the MCU. ST strongly recommends tool manufacturers to lock their debugger using the MCU device ID located in the DBGMCU (see Section : DBGMCU device ID code register (DBGMCU_IDCODE) ).

Only the DEV_ID[11:0] field should be used for identification by the debugger/programmer tools (the REV_ID[15:0] field must not be taken into account).

38.2.4 DBG reset and clocks

The debug port (SW-DP) is reset by a power-on reset and when waking up from standby mode.

The debugger supplies the clock for the debug port via the debug interface pin SWCLK. This clock is used to register the serial input data in, as well as to operate the state machines and internal logic of the debug port. This clock must therefore continue to toggle for several cycles after the end of an access, to ensure that the debug port returns to the idle state.

The SW-DP contains an asynchronous interface to the system clock domain that covers the rest of the SW-DP and the access port.

The debug clock domain is enabled by the debugger using the CDBGPWRUPREQ bit in the DP control and status register (DP_CTRLSTAT) . The clock must be enabled before the debugger can access any of the debug features on the device. The availability of the clock is reflected in the CDBGPWRUPACK bit in DP_CTRLSTAT. The debug clock is disabled at power-up, and should be disabled before the debugger is disconnected, to avoid wasting energy.

The debug and trace components included in the processor are clocked with the processor clock.

38.2.5 DBG power domains

The debug components are located in the core power domain. This means that the debugger connection is not possible in standby low-power mode. To avoid losing the connection when the device enters standby mode, the power can be maintained to the core by setting a bit in the DBGMCU configuration register (DBGMCU_CR) . This also keeps the processor clocks active, and holds off the reset, so that the debug session is maintained.

38.2.6 Debug in low-power modes

The devices include power saving features that allow the core power domain to be switched off or stopped when not required. If the power is switched off or if the core is not clocked, all debug components are inaccessible to the debugger. To avoid this, power-saving mode emulation is implemented. If the emulation is enabled for a domain, the domain still enters power-saving mode, but its clock and power are maintained. In other words, the domain behaves as if it is in power-saving mode, but the debugger does not lose the connection.

The emulation mode is programmed in the microcontroller debug (DBGMCU) unit. For more information, refer to Section 38.9: Microcontroller debug unit (DBGMCU) .

38.2.7 Security

The trace and debug components allow a high degree of access to the processor and system during product development. In order to protect user code and ensure that the debug features cannot be used to alter or compromise the normal operation of the finished product, these features can be disabled or limited in scope. Debugger access is disabled while the processor is booting from system flash memory.

The following authentication signal is used by the system to determine which debug features are enabled or disabled:

• • dbgen : global enable for all debug features
  • 0: All debug features are disabled.
  • 1: Debug features are enabled.

For detailed information on the behavior of each component according to the state of the authentication signals, refer to the relevant component chapter or to the relevant Arm® technical documentation.

The state of the signals is set according to the debug state as shown in Table 240 .

Table 240. Authentication signal states

The debug state depends on the flash memory readout protection state (see Section 3.5.1: FLASH read protection (RDP) ).

Table 241. Life cycle state and debug states

1. On new products, the readout protection mechanism is named “product life cycle”.

38.3 Serial-wire debug port (SW-DP)

The SW-DP is a CoreSight™ component that implements a two-pin (clock + data) serial-wire debug port for connecting debugging equipment.

A debugger must first select the SW-DP by transmitting the following serial data sequence on SWDIO:

... (50 or more ones) ..., 0, 1, 1, 1, 1, 0, 0, 1, 1, 1, 1, 0, 0, 1, 1, 1, ... (50 or more ones) ...

SWCLK must be cycled for each data bit.

38.3.1 Serial-wire debug port

The serial-wire debug protocol uses the following pins:

• • SWCLK: clock from host to target
• • SWDIO: bidirectional serial data

Serial data is transferred LSB first, synchronously with the clock.

A transfer comprises three phases:

1. 1. Packet request (8 bits) transmitted by the host (see Table 242 ).
2. 2. Acknowledge response (3 bits) transmitted by the target (see Table 243 ).
3. 3. Data transfer (33 bits) transmitted by the host (in case of a write) or target (in case of a read) (see Table 244 ).

The data transfer only occurs if the acknowledge response is OK.

Between each phase, if the direction of the data is reversed, a single clock-cycle turn-around time is inserted.

Table 242. Packet request

Table 243. ACK response

Table 244. Data transfer

In the case of a FAULT or WAIT ACK response from the target, the data transfer phase is canceled, unless overrun detection is enabled: in this case, the data is ignored by the target (in the case of a write), or not driven (in the case of a read).

A line reset must be generated by the host when it is first connected, or following a protocol error. The line reset consists in 50 or more SWCLK cycles with SWDIO high, followed by two SWCLK cycles with SWDIO low.

For more details on the serial-wire debug protocol, refer to the Arm® Debug Interface Architecture Specification [ 11 ].

Note: The SWJ-DP implements SWD protocol version 2.

38.3.2 Debug port registers

The SW-DP accesses the debug port (DP) registers listed in Table 246 .

The debugger can access the DP registers as follows:

1. 1. The A(3:2) and RnW fields are part of the packet request word sent to the SW-DP with the APnDP bit reset (see Table 242 ). Program the A(3:2) field with the register address (two most significant bits, the two LSBs are implicitly zero). Program the RnW bit to

select a read or write. In the case of a write, program the data field with the write data. The write data are sent in the data phase.

1. To access one of the banked DP registers at address 0x4, the register number must first be written to the DPBANKSEL[3:0] field of the DP_SELECT register at address 0x8. Any subsequent read or write to address 0x4 accesses the register corresponding to the contents of DPBANKSEL.

Table 245. Debug port registers

38.3.3 DEBUG port registers

DP debug port identification register (DP_DPIDR)

Address offset: 0x0

Reset value: 0x6BA0 2477

• Bits 31:28 REVISION[3:0] : revision code
  0x6: Rev 6
• Bits 27:20 PARTNO[7:0] : part number for the debug port
  0xBA
• Bits 19:17 Reserved, must be kept at reset value.
  • Bit 16 MIN : minimal debug port (MINDP) implementation
    0x0: MINDP not implemented
• Bits 15:12 VERSION[3:0] : debug port architecture version
  0x2: DPv2
• Bits 11:1 DESIGNER[10:0] : JEDEC designer identity code
  0x23B: Arm® JEDEC code
• Bit 0 Reserved, must be kept at reset value.

DP abort register (DP_ABORT)

Address offset: 0x0

Reset value: 0x0000 0000

• Bits 31:5 Reserved, must be kept at reset value.
• Bit 4 ORUNERRCLR : overrun error clear
  • 0: no effect
  • 1: STICKYORUN bit cleared in DP_CTRLSTAT register
• Bit 3 WDERRCLR : write data error clear
  • 0: no effect
  • 1: WDATAERR bit cleared in DP_CTRLSTAT register
• Bit 2 STKERRCLR : sticky error clear
  • 0: no effect
  • 1: STICKYERR bit cleared in DP_CTRLSTAT register
• Bit 1 Reserved, must be kept at reset value.
• Bit 0 DAPABORT : current AP transaction aborted if excessive number of WAIT responses returned
  This bit indicates that the transaction is stalled.
  • 0: no effect
  • 1: transaction aborted

DP control and status register (DP_CTRLSTAT)

Address offset: 0x4

Reset value: 0x0000 0000

This register is accessible when DP_SELECT.DPBANKSEL[3:0] = 0x0.

Bits 31:30 Reserved, must be kept at reset value.

Bit 29 CDBGPWRUPACK : debug power-up acknowledge

See description in Section 38.2.6: Debug in low-power modes .

0: debug clock gated

1: debug clock enabled

Bit 28 CDBGPWRUPREQ : debug power-up request

This bit controls the debug clock enable.

0: requests debug clock gating

1: requests debug clock enable

Bits 27:8 Reserved, must be kept at reset value.

Bit 7 WDATAERR : write data error (read-only)

This bit indicates that there is a parity or framing error on the data phase of a write, or a write accepted by the DP is then discarded without being submitted to the AP.

This bit is reset by writing 1 to the DP_ABORT.WDERRCLR bit.

0: no error

1: an error occurred

Bit 6 READOK : AP read response (read-only)

This bit indicates the response to the last AP read access.

0: read not OK

1: read OK

Bit 5 STICKYERR : transaction error

This bit indicates that an error occurred in an AP transaction. It is reset by writing 1 to the DP_ABORT.STKERRCLR bit

0: no error

1: an error occurred

Bits 4:2 Reserved, must be kept at reset value.

Bit 1 STICKYORUN : overrun (read-only).

This bit indicates that an overrun occurred (new transaction received before previous transaction completed). This bit is only set if the ORUNDETECT bit is set. It is reset by writing 1 to the DP_ABORT.ORUNERRCLR bit.

0: no overrun

1: an overrun occurred

Bit 0 ORUNDETECT : overrun detection mode enable.

0: disabled

1: enabled. In the event of an overrun, the STICKYORUN bit is set and subsequent transactions are blocked until the STICKYORUN bit is cleared.

DP data link control register (DP_DLCR)

Address offset: 0x4

Reset value: 0x0000 0000

This register is accessible when DP_SELECT.DPBANKSEL[3:0] = 0x1.

Bits 31:10 Reserved, must be kept at reset value.

Bits 9:8 TURNROUND[1:0] : tristate period for SWDIO
0x0: 1 data bit period

Bits 7:6 WIREMODE[1:0] : SW-DP mode
0x0: synchronous mode

Bits 5:0 Reserved, must be kept at reset value.

DP target identification register (DP_TARGETID)

Address offset: 0x4

Reset value: 0xXXXX 0041

This register is accessible when DP_SELECT.DPBANKSEL[3:0] = 0x2.

Bits 31:28 TREVISION[3:0] : target revision

Bits 27:12 TPARTNO[15:0] : target part number

0x4890: STM32U073/083x

0x4590: STM32U031x

Bits 11:1 TDESIGNER[10:0] : target designer JEDEC code

0x020: STMicroelectronics

Bit 0 Reserved, must be kept at reset value.

DP data link protocol identification register (DP_DLPIDR)

Address offset: 0x4

Reset value: 0x0000 0001

This register is accessible when DP_SELECTR.DPBANKSEL[3:0] = 0x3.

Bits 31:28 TINSTANCE[3:0] : target instance number

This field defines the instance number for the device in a multi-drop system.

0x0: instance number 0

Bits 27:4 Reserved, must be kept at reset value.

Bits 3:0 PROTSVN[3:0] : Serial-wire debug protocol version

0x1: version 2

DP event status register (DP_RESEND)

Address offset: 0x8

Reset value: 0x0000 0000

Bits 31:0 RESEND[31:0] : value returned by the last AP read or DP_RDBUFF read

This register is used in the event of a corrupted read transfer.

DP access port select register (DP_SELECT)

Address offset: 0x8

Reset value: 0xXXXX XXXX

Bits 31:24 APSEL[7:0] : access port select

This field selects the access port for the next transaction.

0x00: AP0 - System debug access port (APB-AP)

0x01: AP1 - Cortex ^® -M0+ debug access port (AHB-AP)

others: reserved, must not be used

Bits 23:8 Reserved, must be kept at reset value.

Bits 7:4 APBANKSEL[3:0] : AP register bank select

This field selects the 4-word register bank on the active AP for the next transaction.

Bits 3:0 DPBANKSEL[3:0] : DP register bank select

This field selects the register at address 0x4 of the debug port.

0x0: DP_CTRLSTAT register

0x1: DP_DLCR register

0x2: DP_TARGETID register

0x3: DP_DLPIDR register

others: reserved, must not be used

DP read buffer register (DP_RDBUFF)

Address offset: 0xC

Reset value: 0x0000 0000

Bits 31:0 RDBUFF[31:0] : value returned by the last AP read access

The value returned by an AP read access can either be obtained using a second read access to the same address that initiates a new transaction on the corresponding bus, or else it can be read from this register, in which case no new AP transaction occurs.

38.3.4 Debug port register map and reset values

These registers are not on the CPU memory bus. They are only accessed through the SW-DP debug interface.

The debug port address offset is four-bit wide, where the two most significant bits are defined by the SW-DP packet request A[3:2] field. The two least significant bits are 00.

Table 246. Debug port register map and reset values

1. DP_SELECT.DPBANKSEL[3:0] = 0x0.

1. 2. DP_SELECT.DPBANKSEL[3:0] = 0x1.
2. 3. DP_SELECT.DPBANKSEL[3:0] = 0x2.
3. 4. DP_SELECT.DPBANKSEL[3:0] = 0x3.

38.4 Access ports

There are two access ports (AP) attached to the DP:

• • System debug access port (AP1): it enables the access to the DBGMCU and the system ROM table via an APB.
• • Cortex ^® -M0+ debug access port (AP0): it enables the access to the debug and trace features integrated in the Cortex-M0+ processor core via a dedicated AHB.

38.4.1 Access port registers

The access ports are of type MEM-AP: the debug and trace component registers are mapped in the address space of the AHB or APB. The AP is seen by the debugger as a set of 32-bit registers organized in banks of four registers each. Some of these registers are used to configure or monitor the AP itself, while others are used to perform a transfer on the bus. The AP registers are listed in Table 248 .

The address of the AP registers is composed of the following fields:

• • bits [7:4]: content of the APBANKSEL[3:0] field in the DP access port select register (DP_SELECT)
• • bits [3:2]: content of the A(3:2) field of the SW-DP packet request (see Table 242 ), depending on the debug interface used
• • bits [1:0]: always cleared

The content of the APSEL[3:0] field of the DP_SELECT register defines which MEM-AP is being accessed. Some register fields differ between the APB and AHB access ports.

Table 247. MEM-AP registers

Table 247. MEM-AP registers (continued)

The debugger can access the AP registers as follows:

1. 1. Program the APSEL[3:0] field in the DP access port select register (DP_SELECT) to choose the AP, and the APBANKSEL[3:0] field in DP_SELECT to select the register bank to be accessed.
2. 2. The A(3:2) and RnW fields are part of the packet request word sent to the SW-DP with the APnDP bit set (see Table 242 ). Program the A(3:2) field with the register address within the bank. Program the RnW bit to select a read or write. In the case of a write, program the DATA field with the write data. The write data is sent in the data phase.

The debugger can access the memory mapped debug component registers through the AP registers (using the above AP register access procedure) as follows:

1. 1. Program the transaction target address in the APx transfer address register (APx_TAR) ( x = 0, 1 ).
2. 2. Program the AP0 control/status word register (AP0_CSW) , if necessary, with the transfer parameters (AddrInc for example).
3. 3. Write to or read from the APx data read/write register (APx_DRW) ( x = 0, 1 ) to initiate a bus transaction at the address held in AP_TAR. Alternatively, a read or write to the APx banked data n register (APx_BDn) ( x = 0, 1 ) triggers access to the TAR[31:4] + n address, allowing up to four consecutive addresses to be accessed without changing the address in the AP_TAR register.

For more detailed information on the MEM-AP, refer to the Arm ^® Debug Interface Architecture Specification [1].

AP1 control/status word register (AP1_CSW)

Address offset: 0x0

Reset value: 0x8000 0042

Bit 31 DBGSWEN : software access enable

Enables or disables software access to the APB bus.

0: disable software access

1: enable software access

Bits 30:12 Reserved, must be kept at reset value.

Bits 11:8 MODE[3:0] : mode of operation

0b0000: normal download or upload

other: reserved, must not be used

Bit 7 TRINPROG : transfer in progress (read only)

This field indicates whether a transfer is currently in progress on the APB master port.

0: no APB transfer in progress

1: APB transfer in progress

Bit 6 DEVICEEN : device enable status (read only)

1: APB transfers always enabled

Bits 5:4 ADDRINC[1:0] : auto-increment mode

This field defines whether the TAR address is automatically incremented after a transaction.

0x0: no auto-increment

0x1: address incremented by the size in bytes of the transaction (SIZE field)

other: reserved, must not be used

Bit 3 Reserved, must be kept at reset value.

Bits 2:0 SIZE[2:0] : size of next memory access transaction

0x2: word (32-bit)

AP0 control/status word register (AP0_CSW)

Address offset: 0x0

Reset value: 0x43X0 00X2

Bit 31 Reserved, must be kept at reset value.

Bit 30 SPROT : secure transfer request

This field sets the protection attribute HPROT[6] of the bus transfer.0: reserved, must not be used

1: nonsecure transfer, HPROT[6] = high

Bits 29:28 Reserved, must be kept at reset value.

Bits 27:24 PROT[3:0] : bus transfer protection

This field sets the protection attributes HPROT[3:0] of the bus transfer.

bit 0 = 0: instruction access

bit 0 = 1: data access

bit 1 = 0: user mode

bit 1 = 1: privilege mode

bit 2 = 0: non-bufferable

bit 2 = 1: bufferable

bit 3 = 0: non-shareable, no look-up, non-modifiable

bit 3 = 1: shareable, look-up, modifiable

Bit 23 SPSTATUS : secure debug authentication status

This field indicates the state of the SPIDEN signal

0: No secure AHB transfers allowed

Bits 22:8 Reserved, must be kept at reset value.

Bit 7 TRINPROG : transfer in progress (read only)

This field indicates whether a transfer is currently in progress on the APB master port.

0: No AHB transfer in progress

1: AHB transfer in progress

Bit 6 DBGSTATUS : debug enable (DBGEN) status

0: AHB transfers blocked

1: AHB transfers enabled

Bits 5:4 ADDRINC[1:0] : auto-increment mode

This field defines whether the TAR address is automatically incremented after a transaction.

0x0: no auto-increment

0x1: address incremented by the size in bytes of the transaction (SIZE field). Single transfer.

0x2: address incremented by the size in bytes of the transaction (SIZE field). Packs four 8-bit transfers or two 16-bit transfers into a 32-bit DAP transfer. Multiple transactions are carried out on the AHB interface.

other: reserved, must not be used

Bit 3 Reserved, must be kept at reset value.

Bits 2:0 SIZE[2:0] : size of next memory access transaction

0x0: byte (8-bit)

0x1: halfword (16-bit)

0x2: word (32-bit)

others: reserved, must not be used

APx transfer address register (APx_TAR) (x = 0, 1)

Address offset: 0x04

Reset value: 0xXXXX XXXX

Bits 31:0 TA[31:0] : address of current transfer. In AP1, TA[1:0] are fixed at 0.

APx data read/write register (APx_DRW) (x = 0, 1)

Address offset: 0x0C

Reset value: 0xXXXX XXXX

Bits 31:0 TD[31:0] : data of current transfer

APx banked data n register (APx_BDn) (x = 0, 1)

Address offset: \( 0x10 + 0x4 * n \) , ( \( n = 0 \) to \( 3 \) )

Reset value: 0x0000 0000

Bits 31:0 DATA[31:0] : banked data of current transfer to address \( TA[31:4] + 4 * n \) .

Auto address incrementing is not performed on APx_BD0-3. Banked transfers are only supported for word transfers.

APx base address register (APx_BASE) (x = 0, 1)

Address offset: 0xF8

Reset value: AP 0: 0xF000 0003

Reset value: AP 1: 0xF000 0003

Bits 31:12 BASEADDR[31:12] : base address (bits 31 to 12) of the first ROM table

The 12 LSBs are zero since the ROM table must be aligned on a 4-Kbyte boundary.

0xF0000: AP0

0xF0000: AP1

Bits 11:2 Reserved, must be kept at reset value.

Bit 1 FORMAT : base-address register format

1: Arm® debug interface v5

Bit 0 ENTRYPRESENT : debug components presence

This bit indicates that debug components are present on the access port bus.

1: debug components present

APx identification register (APx_IDR) (x = 0, 1)

Address offset: 0xFC

Reset value: AP 1: 0x5477 0002

Reset value: AP 0: 0x8477 0001

Bits 31:28 REVISION[3:0] : revision number

0x5: r1p0

0x8: r0p9

Bits 27:24 JEDECBANK[3:0] : JEDEC bank

0x4: Arm ^®

Bits 23:17 JEDECCODE[6:0] : JEDEC code

0x3B: Arm ^®

Bits 16:13 CLASS[3:0] :

0x1: MEM-AP

Bits 12:8 Reserved, must be kept at reset value.

Bits 7:0 IDENTITY[7:0] :

0x1: AHB-AP

0x2: APB-AP

38.4.2 Access port register map

These registers are not on the CPU memory bus. They are only accessed through SW-DP debug interface.

The access port address is 8-bit wide, defined by DP_SELECT.APBANKSEL[3:0] field and by the SW-DP packet request A[3:2] field. The two least significant bits are 00.

Table 248. Access port register map and reset values

Table 248. Access port register map and reset values (continued)

38.5 ROM tables

The ROM table is a CoreSight™ component that contains the base addresses of the CoreSight debug components accessible via the access port to which it is attached. These tables allow a debugger to discover the topology of the CoreSight system automatically.

There is one top level ROM table behind each access port, APn. The base address of this ROM table can be obtained by reading the APn_BASE register of the access port. The top level ROM table may point in turn to other ROM tables.

The system ROM table is pointed to by the AP1 base register, AP1_BASE. It contains the base address pointer for the DBGMCU.

The system ROM table occupies a 4-Kbyte, 32-bit wide chunk of the AP1 address space, from 0xF000 0000 to 0xF000 0FFC. It can be accessed by the debugger.

Table 249. System ROM table

There are two ROM tables in the CPU subsystem. The MCU ROM table is pointed to by the AP0 base register, AP0_BASE. It contains the base-address pointer for the processor ROM table.

The MCU ROM table (see the table below) occupies a 4-Kbyte, 32-bit wide chunk of the AP0 address space, from 0xF000 0000 to 0xF000 0FFC. It is not accessible by software.

Table 250. MCU ROM table

The processor ROM table contains the base-address pointer for the system control space (SCS) registers that allow the debugger to identify the CPU core, as well as for the BPU, DWT.

The processor ROM table (see the table below) occupies a 4-Kbyte, 32-bit wide chunk of AP0 address space, from 0xE00F F000 to 0xE00F FFFC. It is not accessible by software.

Table 251. Processor ROM table

The topology for the CoreSight components is shown in Figure 387 .

Figure 387. CoreSight topology

MSV72604V1

38.5.1 System ROM table registers

System ROM memory type register (SYSROM_MEMTYPER)

Address offset: 0xFCC

Reset value: 0x0000 0001

Bits 31:1 Reserved, must be kept at reset value.

Bit 0 SYSTEM : system memory

0x1: system memory present on this bus

System ROM CoreSight peripheral identity register 4 (SYSROM_PIDR4)

Address offset: 0xFD0

Reset value: 0x0000 0000

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:4 SIZE[3:0] : register file size

0x0: The register file occupies a single 4-Kbyte region.

Bits 3:0 JEP106CON[3:0] : JEP106 continuation code

0x0: STMicroelectronics JEDEC continuation code

System ROM CoreSight peripheral identity register 0 (SYSROM_PIDR0)

Address offset: 0xFE0

Reset value: 0x0000 0000

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:0 PARTNUM[7:0] : part number bits [7:0]

0x00: STM32U0 series

System ROM CoreSight peripheral identity register 1 (SYSROM_PIDR1)

Address offset: 0xFE4

Reset value: 0x0000 0000

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:4 JEP106ID[3:0] : JEP106 identity code bits [3:0]

0x0: STMicroelectronics JEDEC code

Bits 3:0 PARTNUM[11:8] : part number bits [11:8]

0x0: STM32U0 series

System ROM CoreSight peripheral identity register 2 (SYSROM_PIDR2)

Address offset: 0xFE8

Reset value: 0x0000 000A

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:4 REVISION[3:0] : component revision number

0x0: rev r0p0

Bit 3 JEDEC : JEDEC assigned value

1: designer identification specified by JEDEC

Bits 2:0 JEP106ID[6:4] : JEP106 identity code bits [6:4]

0x2: STMicroelectronics JEDEC code

System ROM CoreSight peripheral identity register 3 (SYSROM_PIDR3)

Address offset: 0xFEC

Reset value: 0x0000 0000

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:4 REVAND[3:0] : metal fix version

0x0: No metal fix

Bits 3:0 CMOD[3:0] : customer modified

0x0: No customer modifications

System ROM CoreSight component identity register 0 (SYSROM_CIDR0)

Address offset: 0xFF0

Reset value: 0x0000 000D

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:0 PREAMBLE[7:0] : component identification bits [7:0]

0x0D: Common identification value

System ROM CoreSight peripheral identity register 1 (SYSROM_CIDR1)

Address offset: 0xFF4

Reset value: 0x0000 0010

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:4 CLASS[3:0] : Component identification bits [15:12] - component class

0x1: ROM table component

Bits 3:0 PREAMBLE[11:8] : Component identification bits [11:8]

0x0: Common identification value

System ROM CoreSight component identity register 2 (SYSROM_CIDR2)

Address offset: 0xFF8

Reset value: 0x0000 0005

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:0 PREAMBLE[19:12] : component identification bits [23:16]

0x05: common identification value

System ROM CoreSight component identity register 3 (SYSROM_CIDR3)

Address offset: 0xFFC

Reset value: 0x0000 00B1

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:0 PREAMBLE[27:20] : Component identification bits [31:24]

0xB1: Common identification value

38.5.2 System ROM table register map

Table 252. System ROM table register map and reset values

Refer to Table 249: System ROM table for register boundary addresses.

38.5.3 MCU ROM table registers

MCU ROM memory type register (MCUROM_MEMTYPER)

Address offset: 0xFCC

Reset value: 0x0000 0001

Bits 31:1 Reserved, must be kept at reset value.

Bit 0 SYSTEM : system memory

0x1: system memory present on this bus

MCU ROM CoreSight peripheral identity register 4 (MCUROM_PIDR4)

Address offset: 0xFD0

Reset value: 0x0000 0000

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:4 SIZE[3:0] : register file size

0x0: The register file occupies a single 4-Kbyte region.

Bits 3:0 JEP106CON[3:0] : JEP106 continuation code

0x0: STMicroelectronics JEDEC continuation code

MCU ROM CoreSight peripheral identity register 0 (MCUROM_PIDR0)

Address offset: 0xFE0

Reset value: 0x0000 0089

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:0 PARTNUM[7:0] : part number bits [7:0]

0x89: STM32U0 series

MCU ROM CoreSight peripheral identity register 1(MCUROM_PIDR1)

Address offset: 0xFE4

Reset value: 0x0000 0004

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:4 JEP106ID[3:0] : JEP106 identity code bits [3:0]

0x0: STMicroelectronics JEDEC code

Bits 3:0 PARTNUM[11:8] : part number bits [11:8]

0x4: STM32U0 series

MCU ROM CoreSight peripheral identity register 2 (MCUROM_PIDR2)

Address offset: 0xFE8

Reset value: 0x0000 000A

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:4 REVISION[3:0] : component revision number
0x0: rev r0p0

Bit 3 JEDEC : JEDEC assigned value
1: designer identification specified by JEDEC

Bits 2:0 JEP106ID[6:4] : JEP106 identity code bits [6:4]
0x2: STMicroelectronics JEDEC code

MCU ROM CoreSight peripheral identity register 3 (MCUROM_PIDR3)

Address offset: 0xFEC

Reset value: 0x0000 0000

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:4 REVAND[3:0] : metal fix version
0x0: No metal fix

Bits 3:0 CMOD[3:0] : customer modified
0x0: No customer modifications

MCU ROM CoreSight component identity register 0 (MCUROM_CIDR0)

Address offset: 0xFF0

Reset value: 0x0000 000D

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:0 PREAMBLE[7:0] : component identification bits [7:0]
0x0D: Common identification value

MCU ROM CoreSight peripheral identity register 1 (MCUROM_CIDR1)

Address offset: 0xFF4

Reset value: 0x0000 0010

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:4 CLASS[3:0] : Component identification bits [15:12] - component class
0x1: ROM table component

Bits 3:0 PREAMBLE[11:8] : Component identification bits [11:8]
0x0: Common identification value

MCU ROM CoreSight component identity register 2 (MCUROM_CIDR2)

Address offset: 0xFF8

Reset value: 0x0000 0005

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:0 PREAMBLE[19:12] : component identification bits [23:16]
0x05: common identification value

MCU ROM CoreSight component identity register 3 (MCUROM_CIDR3)

Address offset: 0xFFC

Reset value: 0x0000 00B1

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:0 PREAMBLE[27:20] : Component identification bits [31:24]

0xB1: Common identification value

38.5.4 MCU ROM table register map

Table 253. MCU ROM table register map and reset values

Refer to Table 250: MCU ROM table for register boundary addresses.

38.5.5 Processor ROM table registers

CPU ROM memory type register (CPUROM_MEMTYPER)

Address offset: 0xFCC

Reset value: 0x0000 0001

Bits 31:1 Reserved, must be kept at reset value.

Bit 0 SYSTEM : system memory

1: system memory present on this bus

CPU ROM CoreSight peripheral identity register 4 (CPUROM_PIDR4)

Address offset: 0xFD0

Reset value: 0x0000 0004

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:4 SIZE[3:0] : register file size

0x0: The register file occupies a single 4-Kbyte region.

Bits 3:0 JEP106CON[3:0] : JEP106 continuation code

0x4: ARM JEDEC continuation code

CPU ROM CoreSight peripheral identity register 0 (CPUROM_PIDR0)

Address offset: 0xFE0

Reset value: 0x0000 00C0

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:0 PARTNUM[7:0] : Part number bits [7:0]

0xC0: Cortex ^® -M0+

CPU ROM CoreSight peripheral identity register 1 (CPUROM_PIDR1)

Address offset: 0xFE4

Reset value: 0x0000 00B4

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:4 JEP106ID[3:0] : JEP106 identity code bits [3:0]

0xB: ARM ^® JEDEC code

Bits 3:0 PARTNUM[11:8] : part number bits [11:8]

0x4: Cortex ^® -M0+

CPU ROM CoreSight peripheral identity register 2 (CPUROM_PIDR2)

Address offset: 0xFE8

Reset value: 0x0000 000B

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:4 REVISION[3:0] : component revision number
0x0: rev r0p0

Bit 3 JEDEC : JEDEC assigned value
1: Designer ID specified by JEDEC

Bits 2:0 JEP106ID[6:4] : JEP106 identity code bits [6:4]
0x3: Arm® JEDEC code

CPU ROM CoreSight peripheral identity register 3 (CPUROM_PIDR3)

Address offset: 0xFEC

Reset value: 0x0000 0000

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:4 REVAND[3:0] : metal fix version
0x0: No metal fix

Bits 3:0 CMOD[3:0] : customer modified
0x0: no customer modifications

CPU ROM CoreSight component identity register 0 (CPUROM_CIDR0)

Address offset: 0xFF0

Reset value: 0x0000 000D

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:0 PREAMBLE[7:0] : Component identification bits [7:0]
0x0D: Common identification value

CPU ROM CoreSight peripheral identity register 1 (CPUROM_CIDR1)

Address offset: 0xFF4

Reset value: 0x0000 0010

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:4 CLASS[3:0] : Component identification bits [15:12] - component class

0x1: ROM table component

Bits 3:0 PREAMBLE[11:8] : Component identification bits [11:8]

0x0: Common identification value

CPU ROM CoreSight component identity register 2 (CPUROM_CIDR2)

Address offset: 0xFF8

Reset value: 0x0000 0005

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:0 PREAMBLE[19:12] : component identification bits [23:16]

0x05: common identification value

CPU ROM CoreSight component identity register 3 (CPUROM_CIDR3)

Address offset: 0xFFC

Reset value: 0x0000 00B1

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:0 PREAMBLE[27:20] : component identification bits [31:24]

0xB1: common identification value

38.5.6 Processor ROM table register map

Table 254. CPU ROM table register map and reset values