- external documentation
- ARM Debug Interface (ADI)
- protocol definition
- opening a connection
- DP access
- Versions
- Registers
- ABORT
- CTRL/STAT
- DLCR (Data Link Control)
- DLPIDR (Data Link Protocol Identification register)
- DPIDR (Debug Port Identification register)
- EVENTSTAT (Event Status register)
- RDBUFF (Read Buffer register)
- RESEND (Read Resend register)
- SELECT (AP Select register)
- TARGETID (Target Identification register)
- TARGETSEL (Target Selection register)
- MinDP
- AP access
- Versions
- Registers
- Memory Access Port
- CSW (Control/Status Word register, Offset: 0x0, RW)
- TAR (Transfer Address Register, Offset: 0x04 ( Large Address Extension : also 0x08), RW)
- DRW (Data Read/Write register, Offset: 0x0C, RW)
- BD0 - BD3 (Banked Data Registers, Offset: 0x10-0x1C, RW)
- CFG (Configuration register, Offset: 0xF4, RO)
- CFG1 (Configuration register 1, Offset: 0xE0, RO)
- BASE (Debug Base Address register, Offset: 0xF8( Large Memory Extension : also 0xF0), RO)
- MBT (Memory Barrier Transfer register, Offset : 0x20, impl. def)
- T0TR (Tag 0 Transfer register, Offset : 0x30, RW)
- JTAG Access Port
- Dictionary
-
most recent is ADIv6
-
ARM recommends ADIv4 for Armv6 architecture (Cortex-M0, Cortex-M0+)
-
ADIv6 introduces new DPv3 and APv2
The Debug system consists of the physical connection (SWD) that logically ends at the Debug Port (DP) in the target. The DP then can talk to the Access Port (AP). There are different kinds of AP. The MEM-AP can access the memory of the target.
When the target samples SWDIO, sampling is performed on the rising edge of SWCLK.
When the target drives SWDIO, or stops driving it, signal changes are performed on the rising edge of SWCLK.
100k Ohm pull up is required at the target.
LSB first! For example, the OK response of 0b001 appears on the wire as 1, followed by 0, followed by 0, as shown in
Even parity!
The parity check is made over the four bits APnDP, RnW and A[2:3]: * If the number of bits with a value of 0b1 is odd, the parity bit is set to 0b1. * If the number of bits with a value of 0b1 is even, the parity bit is set to 0b0.
The parity check is made over the 32 data bits WDATA[0:31] or RDATA[0:31]: * If the number of bits with a value of 0b1 is odd, the parity bit is set to 0b1. * If the number of bits with a value of 0b1 is even, the parity bit is set to 0b0.
An operation on the wire consists of two or three phases: * Packet request * Acknowledge response * Data transfer phase
When the target samples SWDIO, sampling is performed on the rising edge of SWCLK. When the target drives SWDIO, or stops driving it, signal changes are performed on the rising edge of SWCLK.
Target has a 100k pull up on SWDIO.
To ensure that the transfer can be clocked through the SW-DP, after the data transfer phase the host must do one of the following: * Immediately start a new SWD operation with the start bit of a new packet request. * Continue to drive the SWD interface with idle cycles until the host starts a new SWD operation. * If the host is driving the SWD clock, continue to clock the SWD interface with at least eight idle cycles. After completing this sequence, the host can stop the clock.
Bit |
Description |
Start |
value 1 |
APnDP |
0 = DP; 1 = AP |
RnW |
0 = write; 1 = read |
A2 |
second bit of Address |
A3 |
third Bit of Address |
Parity |
parity bit (even parity) |
Stop |
value 0 |
Park |
value 1 - line is not driven |
Trn |
Turnaround - line is not driven |
Bit |
Description |
Trn |
value undefined - line is floting, weak pull up |
ACK0 |
0/1 |
ACK1 |
0/1 |
ACK2 |
0/1 |
Trn (only on Write(Host → Target)) |
value undefined - line is floting, weak pull up |
ACK0 |
ACK1 |
ACK2 |
Description |
1 |
0 |
0 |
OK |
0 |
1 |
0 |
Wait |
0 |
0 |
1 |
Fault |
Only one Debug Port. Direct interface to Debugger. Debug Port allows Access to Access Ports - JTAG debug port (JTAG-DP). (IEEE 1149.1 (since DPv0) - Serial Wire Debug Port (SW-DP). (since DPv1, since DPv2 also SWDv2) - Serial Wire JTAG debug port (SWJ-DP). (Combination of JTAG and SWD on the same pins. Debuger decides which to use)
Version |
description |
DPv0 |
ADIv5 JTAG only, APv1 |
DPv1 |
ADIv5 JTAG + SWDv1, APv1 |
DPv2 |
ADIV5.1 SWDv2 (now with Multidrop), APv1 |
DPv3 |
ADIv6, APv2 |
Name |
DPv0 |
DPv1 |
DPv2 |
DPv3 |
access |
address |
DPBANKSEL |
notes |
ABORT |
yes |
yes |
yes |
yes |
WO |
0 |
x |
optional and implementation defined |
BASEPTR0 |
no |
no |
no |
yes |
RO |
0 |
2 |
address aligned to 4KB boundary (bits[11:0] = 0) |
BASEPTR1 |
no |
no |
no |
yes |
RO |
0 |
3 |
|
CTRL/STAT |
yes |
yes |
yes |
yes |
RW |
4 |
0 |
|
DLCR |
no |
yes |
yes |
yes |
RW |
4 |
1 |
WCR in DPv0 |
DLPIDR |
no |
no |
yes |
yes |
RO |
4 |
3 |
|
DPIDR |
no |
yes |
yes |
yes |
RO |
0 |
0 |
IDCODE on DPv0 |
DPIDR1 |
no |
no |
no |
yes |
RO |
0 |
1 |
|
EVENTSTAT |
no |
no |
yes |
yes |
RO |
4 |
4 |
|
RDBUFF |
yes |
yes |
yes |
yes |
RO |
0xc |
x |
|
RESEND |
no |
yes |
yes |
yes |
RO |
8 |
x |
|
SELECT |
yes |
yes |
yes |
yes |
WO |
8 |
not applicable |
|
SELECT1 |
no |
no |
no |
yes |
WO |
4 |
5 |
|
TARGETID |
no |
no |
yes |
yes |
RO |
4 |
2 |
|
TARGETSEL |
no |
no |
yes |
yes |
WO |
0xc |
x |
The SELECT.DPBANKSEL field determines which register is accessed at addresses 0x0 and 0x4.
A0 and A1 = 0 !
Bit |
Name |
Access |
description |
5..31 |
Reserved |
write as 0 |
|
4 |
ORUNERRCLR |
WO |
writing 1 clears the CTRL/STAT.STICKYORUN (overrun error) bit (since DPv1) |
3 |
WDERRCLR |
WO |
writing 1 clears the CTRL/STAT.WDATAERR (write data error) bit (since DPv1) |
2 |
STKERRCLR |
WO |
writing 1 clears the CTRL/STAT.STICKYERR (stiky error) bit (since DPv1) |
1 |
STKCMPCLR |
WO |
writing 1 clears the CTRL/STAT.STICKYCMP (stiky compare) )bit (since DPv1) |
0 |
DAPABORT |
WO |
write 1 to create a DAP abort (in DPv0 this bit was called SBO) do this only after several WAIT responses |
Bit |
Name |
Access |
description |
31 |
CSYSPWRUPACK |
RO |
System powerup acknowledge |
30 |
CSYSPWRUPREQ |
RW |
System powerup request. |
29 |
CDBGPWRUPACK |
RO |
Debug powerup acknowledge. |
28 |
CDBGPWRUPREQ |
RW |
Debug powerup request. |
27 |
CDBGRSTACK |
RO |
Debug reset acknowledge. |
26 |
CDBGRSTREQ |
imp.def. |
Debug reset request. |
24-25 |
RES0 |
Reserved |
|
12-23 |
TRNCNT |
RW |
Transaction counter. |
11 |
MASKLANE |
RW |
Include byte lane 3 in comparisons. (bit 24-31) |
10 |
MASKLANE |
RW |
Include byte lane 2 in comparisons. (bit 16-23) |
9 |
MASKLANE |
RW |
Include byte lane 1 in comparisons. (bit 8-15) |
8 |
MASKLANE |
RW |
Include byte lane 0 in comparisons. (bit 0-7) |
7 |
WDATAERR |
RO* |
set to 0b1 if : A parity or framing error on the data phase of a write. or A write that has been accepted by the DP is then discarded without being submitted to the AP. |
6 |
READOK |
RO* |
If the response to the previous AP read or RDBUFF read was OK, the bit is set to 0b1 . If the response was not OK, it is cleared to 0b0. |
5 |
STICKYWERR |
RO* |
This bit is set to 0b1 if an error is returned by an AP transaction. |
4 |
STICKYCMP |
RO* |
This bit is set to 0b1 when a mismatch occurs during a pushed-compare peration or a match occurs during a pushed-verify operation. |
2-3 |
TRNMODE |
RW |
TRNMODE can have one of the following values:(0b00 Normal operation) (0b01 Pushed-verify mode.) (0b10 Pushed-compare mode.) (0b11 Reserved.) |
1 |
STICKYORUN |
RO* |
If overrun detection is enabled, this bit is set to 0b1 when an overrun occurs. |
0 |
ORUNDETECT |
RW |
0 = overrun detection disabled; 1 = overrun detection enabled |
Bit |
Name |
Access |
description |
8-9 |
TURNROUND |
RW |
defines the turnaround tristate period. (00 = 1 periode; 01 = 2 periodes; 10 = 3 periodes, 11 = 4 periodes) |
Bit |
Name |
Access |
description |
28-31 |
TINSTANCE |
RO |
imp.def. Instance number. Defines an instance number for this device. This value must be unique for all devices with identical TARGETID.TPARTNO and TARGETID.TDESIGNER fields that are connected together in a multi-drop system. |
4-27 |
Reserved |
RO |
Reserved |
0-3 |
PROTVSN |
RO |
0x1 = SWDv2 |
Bit |
Name |
Access |
description |
28-31 |
REVISION |
RO |
Revision code |
20-27 |
PARTNO |
RO |
Part Number for the Debug Port. |
17-19 |
Res0 |
RO |
Reserved |
16 |
MIN |
RO |
1 = Minimal Debug Port (MINDP) → Transaction counter, pushed-verify and pushed-find not implemented! |
12-15 |
VESRION |
RO |
0 = Reserved; 1 = DPv1; 2 = DPv2 |
8-11 |
DESIGNER |
RO |
indicates the designer of the DP and not the implementer, JEP106, number of times 0x7f appears at start of JEP-106 code ARM Limited is 0x4 |
1-7 |
DESIGNER |
RO |
indicates the designer of the DP and not the implementer, JEP106, last 7 bits of JEP106 code ARM Limited is 0x3B |
0 |
RAO |
RO |
= 1 |
ARM Limited JEP106 Code is : 0x7F 0x7F 0x7F 0x7F 0x3B
Bit |
Name |
Access |
description |
1-31 |
Res0 |
RO |
Reserved |
0 |
EA |
RO |
0 = An event requires attention; 1 = no Event pending |
presents data that was captured during the previous AP read, enabling repeatedly returning the value without generating a new AP access.
After reading the DP Read Buffer, its contents are no longer valid. The result of a second read of the DP Read Buffer is UNKNOWN .
Data for previous AP read.
Performing a read to RESEND does not capture new data from the AP, but returns the value that was returned by the last AP read or DP RDBUFF read. RESEND enables the debugger to recover read data from a corrupted SW-DP transfer without having to re-issue the original read request, or generate a new access to the connected debug memory system. RESEND can be accessed multiple times, and always returns the same value until a new access is made to an AP register or the DP RDBUFF register.
Bit |
Name |
Access |
description |
24-31 |
APSEL |
WO |
Selects the AP with the ID number APSEL. |
8-23 |
RES0 |
WO |
Reserved |
4-7 |
APBANKSEL |
WO |
Selects the active four-word register bank on the current AP. |
0-3 |
DPBANKSEL |
WO |
Debug Port address bank select. |
Bit |
Name |
Access |
description |
28-31 |
TREVISION |
RO |
Target Revision |
12-27 |
TPARTNO |
RO |
The value is assigned by the designer of the part. |
1-11 |
TDESIGNER |
RO |
his field indicates the designer of the part, If the designer of the part is ARM, then the value of this field is 0x23B. |
0 |
RAO |
RO |
= 0 |
Bit |
Name |
Access |
description |
28-31 |
TINSTANCE |
WO |
The instance number for this device. |
12-27 |
TPARTNO |
WO |
The value that is assigned by the designer of the part. |
1-11 |
TDESIGNER |
WO |
The 11-bit code that is formed from the JEDEC JEP106 continuation code and identity code. |
0 |
SBO |
WO |
write as 1 |
The minimal DP is a bit different: MINDP implementations must omit the following DP features: * Pushed-verify operation. * Pushed-compare operation. * The transaction counter.
MINDP implementations must observe the following conventions: * The DPIDR.MIN field is RAO. * The following fields of the CTRL/STAT register are RES0:
— TRNCNT.
— MASKLANE.
— STICKYCMP.
— TRNMODE.
See also CTRL/STAT.
-
The ABORT.STKCMPCLR field is SBZ(Should be Zero). Writing 0b1 to this bit is UNPREDICTABLE.
Version |
description |
APv1 |
ADIv5.2 or earlier |
APv2 |
ADIv6 |
More than one Access Port possible. Each access port has separate resources that it makes available. - Memory Access Port(MEM-AP) - JTAG Access Port (JTAG-AP)
To address Register in AP: - The SELECT.APSEL bits define whch AP gets addressed - The SELECT.APBANKSEL difines which bank (bank = 4 Registers) is accessed. = A[7:4] - Which of the 4 Registers in the Bank is addresse is defined by the A2, A3 bits from packet request. - A0 and A1= 0 ! - If it is a read or a write to the AP Register is defined by the packet Request RnW bit.
An APv1 AP is a Class 0x8.
An APv2 AP is a Class 0x9 CoreSight component with a register map of 4KB.
All Access Ports must have a IDR Register!
Offset |
Type |
Name |
Description |
0x00 |
RW |
CSW |
holds control and status information for the MEM-AP. |
0x04 (- 0x08) |
RW |
TAR |
0x04 are least significant bits, if Large Physical Address Extension is supported the 0x08 presents the most significant bits. |
0x0c |
RW |
DRW |
|
0x10 |
RW |
BD0 |
|
0x14 |
RW |
BD1 |
|
0x18 |
RW |
BD2 |
|
0x1c |
RW |
BD3 |
|
0x20 |
implementation defined |
MBT |
|
0x24 - 0x2c |
na |
Res0 |
reserved for future use |
0x30 |
RW |
TOTR |
|
0x34 - 0xdc |
na |
Res0 |
reserved for future use |
0xe0 |
RO |
CFG1 |
|
0xe4 - 0xec |
na |
Res0 |
reserved for future use |
0xf0 |
RO |
BASE1 |
only valid with Large Physical Address Extention then most significant bits otherwise Res0 |
0xf4 |
RO |
CFG |
|
0xf8 |
RO |
BASE0 |
least significant bits |
0xfc |
RO |
IDR |
must be implemented in all AP ! |
Bit |
Name |
Access |
description |
28-31 |
REVISION |
RO |
starts at 0, increases by 1 on each revision |
17-27 |
DESIGNER |
RO |
Code that identifies the designer of the AP. |
13-16 |
CLASS |
RO |
0x0 = no defined class, 0x1 COM Access Port, 0x8 Memory Access Port |
8-12 |
RES0 |
RO |
Reserved must be 0 ! |
4-7 |
VARIANT |
RO |
Together with the TYPE field, this field identifies the AP implementation. |
0-3 |
TYPE |
RO |
Indicates the type of bus, or other connection, that connects to the AP. |
ARM Access Ports:
Type |
CLASS |
BUS |
0 |
0x0 |
JTAG / COM-AP |
1 |
0x8 |
MEM-AP: AMBA AHB3 bus |
2 |
0x8 |
MEM-AP: AMBA APB2 or APB3 bus |
4 |
0x8 |
MEM-AP: AMBA AXI3 or AXI4 bus, with optional ACE-Lite support |
5 |
0x8 |
MEM-AP: AMBA AHB5 bus |
6 |
0x8 |
MEM-AP: AMBA APB4 and APB5 bus |
7 |
0x8 |
MEM-AP: AMBA AX15 bus |
8 |
0x8 |
MEM-AP: AMBA AHB5 with enhanced HPROT |
holds control and status information for the MEM-AP.
Bit |
Name |
Access |
description |
31 |
DbgSwEnable |
RW |
Debug software access enable. (optional:RAZ)(0 = Debug software access is disabled) (1 = Debug software access is enabled) |
28-30 |
PROT |
RW |
bus access protection control This field is optional and impl. def. If not implemented, it is RES0 |
24-27 |
CACHE |
RW |
This field is optional and impl. def. If not implemented, it is RES0 |
23 |
SPIDEN |
RW |
Secure Privileged Debug Enabled. (0 = Secure access is disabled) (1 = Secure access is enabled) |
16-22 |
RES0 |
RW |
Reserved |
15 |
MTE |
RW |
0 = memory tagging access disabled, 1 = memory tagging access enabled |
12-14 |
Type |
RW |
bus access protection control, This field is optional. If not implemented, it is RES0. |
8-11 |
Mode |
RW |
Mode of operation ( 0 = Basic Mode) (1 = Barrier support enabled) |
7 |
TrInProg |
RW |
Transfer in progress (0 = idle) (1 = a trasfere is in progess) |
6 |
DeviceEn |
RO |
Device enabled. (0 = MEM-AP not enabled) (1 = MEM-AP enabled and can be used) |
4-5 |
AddrInc |
RW |
Address auto-increment and packing mode. 0 = auto increment disabled, 1 = address increment single, 2 = addres increment packed |
3 |
RES0 |
RW |
Reserved |
0-2 |
SIZE |
RW |
Data Size (0 = 8bit) (1 = 16Bit) (2 = 32Bit) (3 = 64Bit) (4 = 128Bit) (5 = 256Bit) |
The TAR holds the address for the next access to the memory system, or set of debug resources, which are connected to the MEM-AP. The MEM-AP can be configured so that the TAR is incremented automatically after each memory access. Reading or writing to the TAR does not cause a memory access.
The DRW is used for memory accesses: - Writing to the DRW initiates a write to the address specified by the TAR. - Reading from the DRW initiates a read from the address that is specified by the TAR. When the read access completes, the value is returned from the DRW.
The Banked Data Registers, BD0-BD3, provide direct read or write access to a block of four words of memory, starting at the address that is specified in the TA R: - Accessing BD0 accesses (TA R[31:4] << 4) in memory. - Accessing BD1 accesses ((TA R[31:4] << 4) + 0x4) in memory. - Accessing BD2 accesses ((TA R[31:4] << 4) + 0x8) in memory. - Accessing BD3 accesses ((TA R[31:4] << 4) + 0xC) in memory.
The value in TA R[3:0] is ignored in constructing the access address: - The values of bits[3:2] of the access address depend solely on which of the four banked data registers is being accessed. - Bits[1:0] of the access are always zero.
Bit |
Name |
Access |
description |
0-31 |
banked data |
RW |
Data values for the current transfer. |
The CFG register hold information about the configuration of the MEM-AP.
Bit |
Name |
Access |
description |
3-31 |
RES0 |
RO |
Reserved |
2 |
LD |
RO |
Large Data (0 = max size = 32bit) (1 = larger than 32 bit is supported) |
1 |
LA |
RO |
Long Address (0 = addresses max length = 32bit) (1 = Addresses can be 64bit long) |
0 |
BE |
RO |
Big Endian Obsolete! RAZ |
Bit |
Name |
Access |
description |
9-31 |
RES0 |
RO |
Reserved |
4-8 |
TAG0RAN |
RO |
4 = memory tagging granule is 16 bytes, else Res0 |
0-3 |
TAG0SIZE |
RO |
0 = memory tagging, T0RT and CSW.MTE not implemented, 4 = tag size is 4 bit, memory tagging,T0TR and CSW.MTE implemented |
The BASE register is a pointer into the connected memory system. It points to one of: - The start of a set of debug registers for the single connected debug component. - The start of a ROM Table that describes the connected debug components.
Bit |
Name |
Access |
description |
12-31 |
BASEADDR[31:12] |
RO |
most significant bits of the base address |
2-11 |
RES0 |
RO |
Reserved |
1 |
Format |
RO |
1= new format, 0 = legacy format |
0 |
P |
RO |
0 = No debug Entry; 1 = debug Entry for this MEM-AP (legacy format = 0) |
Base at 0xf0:
Bit |
Name |
Access |
description |
0-31 |
BASEADDR[63:32] |
RO |
most significant bits of the base address (32bit = Res0) |
MBT generates a barrier operation on the bus.
stores tag values for transfers.
Bit |
Name |
Access |
description |
28-31 |
T7 |
RW |
allocation tag value. |
24-27 |
T6 |
RW |
allocation tag value. |
20-23 |
T5 |
RW |
allocation tag value. |
16-19 |
T4 |
RW |
allocation tag value. |
12-15 |
T3 |
RW |
allocation tag value. |
8-11 |
T2 |
RW |
allocation tag value. |
4-7 |
T1 |
RW |
allocation tag value. |
0-3 |
T0 |
RW |
allocation tag value. |
There are some SWD specific words used that only make sense in the SWD contet. These words are defined here.
Word |
Meaning |
ADI |
ARM Debug Interface Version 5 or 5.1 or 5.2 or 6 … |
AP or APACC |
Access Port (connects to device Registsres,..) |
BPU |
Breakpoint Unit |
CSW |
Control and Status Word |
DAP |
Debug Access Port (implementation of ADI) |
DP or DPACC |
Debug Port (connects external Debug Hardware to chip) |
DRW |
Data Read/Write |
DTR |
Data Transfer Register |
DWT |
Data Watchpoint and Trace unit |
IDR |
Identification Register |
ITR |
Instruction Transfer Register |
JTAG |
IEEE 1149.1 JTAG - IEEE Standard Test Access Port and Boundary Scan Architecture |
JTAG-AP |
JTAG Access Port |
MEM-AP |
Memory-mapped Access Port |
PE |
Processing Element (CPU) |
RAO |
Read as One |
RAZ |
Read as Zero |
SCS |
System Control Space |
SBO |
Should be One - Write as 1 |
SBZ |
Should be Zero - Write as 0 |
SWD |
Serial Wire Debug |
TAP |
Test Access Port |
TAR |
Transfer Address Register |
TRNCNT |
Transaction counter |