APPENDIX G

CortexÒ-M3/M4 Debug
Components Programmer’s
Model

G.1 Processor core debug registers

Table G.1 Summary of Processor Core Debug Registers

Reset
Address Name Type Value Description

0xE000EDF0 CoreDebug- R/W 0x00000000 Debug Halting Control

>DHCSR Status Register
0xE000EDF4 CoreDebug- W – Debug Core Register
>DCRSR Selector Register
0xE000EDF8 CoreDebug- R/W – Debug Core Register
>DCRDR Data Register
0xE000EDFC CoreDebug- R/W 0x00000000 Debug Exception and
>DEMCR Monitor Control
Register

Table G.2 Debug Halting Control and Status Register (CoreDebug->DHCSR,

0xE000EDF0)
Reset
Bits Name Type Value Description

31:16 KEY W d Debug key; value of 0xA05F

must be written to this field
to write to this register,
otherwise the write will be
ignored
25 S_RESET_ST R d Core has been reset or
being reset; this bit is
cleared on read
(Continued)

e149
e150 APPENDIX G

Table G.2 Debug Halting Control and Status Register (CoreDebug->DHCSR,

0xE000EDF0)dCont’d
Reset
Bits Name Type Value Description
24 S_RETIRE_ST R d Instruction is completed
since last read; this bit is
cleared on read
19 S_LOCKUP R d When this bit is 1, the core is
in a locked-up state
18 S_SLEEP R d When this bit is 1, the core is
in sleep mode
17 S_HALT R d When this bit is 1, the core is
halted
16 S_REGRDY R d Register read/write
operation is completed
15:6 Reserved d d Reserved
5 C_SNAPSTALL R/W 0* Use to break a stalled
memory access
4 Reserved d d Reserved
3 C_MASKINTS R/W 0* Mask interrupts while
stepping; can only be
modified when the
processor is halted
2 C_STEP R/W 0* Single step the processor;
valid only if C_DEBUGEN is
set
1 C_HALT R/W 0 Halt the processor core;
valid only if C_DEBUGEN is
set
0 C_DEBUGEN R/W 0* Enable halt mode debug
*
These control bits in DHCSR are reset by power on reset and not by system reset.

Table G.3 Debug Core Register Selector Register (CoreDebug->DCRSR,

0xE000EDF4)

Bits Name Type Reset Value Description

16 REGWnR W d Direction of data transfer:

Write ¼ 1, Read ¼ 0
15:7 Reserved d d –
6:0 REGSEL W d Register to be accessed:
0000000 ¼ R0
0000001 ¼ R1
.
0001111 ¼ R15
 Appendix G e151

Table G.3 Debug Core Register Selector Register (CoreDebug->DCRSR,

0xE000EDF4)dCont’d

Bits Name Type Reset Value Description

0010000 ¼ xPSR/flags
0010001 ¼ MSP (Main
Stack Pointer)
0010010 ¼ PSP (Process
Stack Pointer)
0010100 ¼ Special
registers:
[31:24] Control
[23:16] FAULTMASK
[15:8] BASEPRI
[7:0] PRIMASK
0100001 ¼ Floating Point
Status & Control Register
(FPSCR)
1000000 ¼ Floating point
register S0
.
1011111 ¼ Floating point
register S31
Other values are reserved

Table G.4 Debug Core Register Data Register (CoreDebug->DCRDR, 0xE000EDF8)

Reset
Bits Name Type Value Description

31:0 Data R/W d Data register to hold register

read result or to write data into
selected register

Table G.5 Debug Exception and Monitor Control Register (CoreDebug->DEMCR,

0xE000EDFC)

Bits Name Type Reset Value Description

24 TRCENA R/W 0* Trace system enable; to

use DWT, ETM, ITM and
TPIU, this bit must be set to
1
23:20 Reserved d d Reserved
(Continued)
e152 APPENDIX G

Table G.5 Debug Exception and Monitor Control Register (CoreDebug->DEMCR,

0xE000EDFC)dCont’d

Bits Name Type Reset Value Description

19 MON_REQ R/W 0 Indication that the debug
monitor is caused by a
manual pending request
rather than hardware
debug events
18 MON_STEP R/W 0 Single step the processor;
valid only if MON_EN is set
17 MON_PEND R/W 0 Pend the monitor exception
request; the core will enter
monitor exceptions when
priority allows
16 MON_EN R/W 0 Enable the debug monitor
exception
15:11 Reserved d d Reserved
10 VC_HARDERR R/W 0* Debug trap on hard faults
9 VC_INTERR R/W 0* Debug trap on interrupt/
exception service errors
8 VC_BUSERR R/W 0* Debug trap on bus faults
7 VC_STATERR R/W 0* Debug trap on usage fault
state errors
6 VC_CHKERR R/W 0* Debug trap on usage fault-
enabled checking errors
(e.g., unaligned, divide by
zero)
5 VC_NOCPERR R/W 0* Debug trap on usage fault,
no coprocessor errors
4 VC_MMERR R/W 0* Debug trap on memory
management fault
3:1 Reserved – – Reserved
0 VC_CORERESET R/W 0* Debug trap on core reset
*
These control bits in DEMCR are reset by power on reset and not by system reset.
 Appendix G e153

G.2 Flash patch and breakpoint unit

Table G.6 Summary of FPB Registers

Address Name Type Reset Value Description

0xE0002000 FP_CTRL R/W 0x00000–0 Flash Patch Control

Register
0xE0002004 FP_REMAP R/W 0x20000000 Flash Patch Remap
Register
0xE0002008 FP_COMP0 R/W 0x00000000 Flash Patch Comparator
Register #0
0xE000200C FP_COMP1 R/W 0x00000000 Flash Patch Comparator
Register #1
0xE0002010 FP_COMP2 R/W 0x00000000 Flash Patch Comparator
Register #2
0xE0002014 FP_COMP3 R/W 0x00000000 Flash Patch Comparator
Register #3
0xE0002018 FP_COMP4 R/W 0x00000000 Flash Patch Comparator
Register #4
0xE000201C FP_COMP5 R/W 0x00000000 Flash Patch Comparator
Register #5
0xE0002020 FP_COMP6 R/W 0x00000000 Flash Patch Comparator
Register #6
0xE0002024 FP_COMP7 R/W 0x00000000 Flash Patch Comparator
Register #7
0xE0002FD0 PID4 RO 0x04 Peripheral ID4
0xE0002FD4 PID5 RO 0x00 Peripheral ID5
0xE0002FD8 PID6 RO 0x00 Peripheral ID6
0xE0002FDC PID7 RO 0x00 Peripheral ID7
0xE0002FE0 PID0 RO 0x03 Peripheral ID0
0xE0002FE4 PID1 RO 0xB0 Peripheral ID1
0xE0002FE8 PID2 RO 0x-B Peripheral ID2
0xE0002FEC PID3 RO 0x00 Peripheral ID3
0xE0002FF0 CID0 RO 0x0D Components ID0
0xE0002FF4 CID1 RO 0xE0 Components ID1
0xE0002FF8 CID2 RO 0x05 Components ID2
0xE0002FFC CID3 RO 0xB1 Components ID3
e154 APPENDIX G

Table G.7 Flash Patch Control Register (0xE0002000)

Bits Name Type Reset Value Description

31:15 – – d Reserved. Read as zero,

write ignore
14:12 NUM_CODE2 RO 3’b000 Number of full banks of
code comparators, sixteen
comparators per bank.
Where less than sixteen
code comparators are
provided, the bank count is
zero, and the number
present indicated by
NUM_CODE. This read
only field contains 3’b000
to indicate 0 banks for
Cortex-M3/M4 processor.
11:8 NUM_LIT RO 0/2 Number of literal
comparators field. This
read only field contains
either 4’b0000 to indicate
there are no literal slots or
4’b0010 to indicate that
there are two literal slots.
7:4 NUM_CODE1 RO 0 /2 /6 Number of code
comparators field. This
read only field contains
either b0000 to indicate
that there are no code slots,
b0010 to indicate that there
are two code slots or b0110
to indicate that there are six
code slots.
3:2 – – d Reserved. Read as zero,
write ignore
1 KEY W – Key field. To write to the
Flash Patch Control
Register, you must write a
1 to this write-only bit
0 ENABLE R/W 0 Flash Patch Unit Enable bit.
(0 ¼ disabled, 1 ¼ enabled)
 Appendix G e155

Table G.8 Flash Patch Remap Register (0xE0002004)

Bits Name Type Reset Value Description

31:29 – – 3’b001 Hardwires the remapped

access to SRAM region
28:5 REMAP R/W 0 8 word aligned remapped
address
4:0 – – – Reserved

Table G.9 Flash Patch Comparator Register #0 to #7 (0xE0002008 to 0xE0002024)

Bits Name Type Reset Value Description

31:30 REPLACE R/W 2’b00 This selects what happens

when the COMP address is
matched.
00 – remap to remap
address. See FP_REMAP.
01 – Set breakpoint on lower
half word, upper half word is
unaffected.
10 – Set breakpoint on upper
half word, lower half word is
unaffected.
11 – Set breakpoint on both
lower and upper half words.
Setting of 01, 10 and 11 are
available for comparators #0
to #5 only. Comparators #6
and #7 ignore this bit field and
always function as remap.
29 – – – Reserved
28:2 COMP R/W – Comparison address
1 – – – Reserved
0 ENABLE R/W 0 Compare and remap enable
for comparator register #n:
1 ¼ Comparator Register #n
compare / remap enabled.
0 ¼ Comparator Register #n
compare / remap disabled.
The ENABLE bit of FP_CTRL
must also be set to enable
comparisons.
e156 APPENDIX G

G.3 Data watchpoint and trace unit

Table G.10 Summary of DWT Registers

Reset
Address CMSIS Name Type Value Description

0xE0001000 DWT->CTRL R/W 0x4-000000 DWT Control Register

0xE0001004 DWT->CYCCNT R/W 0x0 Cycle Count Register
0xE0001008 DWT->CPICNT R/W – CPI Count Register
0xE000100C DWT->EXCCNT R/W – Exception Overhead
Count Register
0xE0001010 DWT- R/W – Sleep Counter Register
>SLEEPCNT
0xE0001014 DWT->LSUCNT R/W – Load-Store-Unit
Counter Register
0xE0001018 DWT- R/W – Fold Counter Register
>FOLDCNT
0xE000101C DWT->PCSR R – Program Counter
Sample Register
0xE0001020 DWT->COMP0 R/W – DWT Comparator
Register #0
0xE0001024 DWT->MASK0 R/W – DWT Mask Register #0
0xE0001028 DWT- R/W 0x0 DWT Function Register
>FUNCTION0 #0
0xE0001030 DWT->COMP1 R/W – DWT Comparator
Register #1
0xE0001034 DWT->MASK1 R/W – DWT Mask Register #1
0xE0001038 DWT- R/W 0x0 DWT Function Register
>FUNCTION1 #1
0xE0001040 DWT->COMP2 R/W – DWT Comparator
Register #2
0xE0001044 DWT->MASK2 R/W – DWT Mask Register #2
0xE0001048 DWT- R/W 0x0 DWT Function Register
>FUNCTION2 #2
0xE0001050 DWT->COMP3 R/W – DWT Comparator
Register #3
0xE0001054 DWT->MASK3 R/W – DWT Mask Register #3
0xE0001058 DWT- R/W 0x0 DWT Function Register
>FUNCTION3 #3
0xE0001FD0 PID4 RO 0x04 Peripheral ID4
0xE0001FD4 PID5 RO 0x00 Peripheral ID5
0xE0001FD8 PID6 RO 0x00 Peripheral ID6
0xE0001FDC PID7 RO 0x00 Peripheral ID7
 Appendix G e157

Table G.10 Summary of DWT RegistersdCont’d

Reset
Address CMSIS Name Type Value Description
0xE0001FE0 PID0 RO 0x02 Peripheral ID0
0xE0001FE4 PID1 RO 0xB0 Peripheral ID1
0xE0001FE8 PID2 RO 0x-B Peripheral ID2
0xE0001FEC PID3 RO 0x00 Peripheral ID3
0xE0001FF0 CID0 RO 0x0D Components ID0
0xE0001FF4 CID1 RO 0xE0 Components ID1
0xE0001FF8 CID2 RO 0x05 Components ID2
0xE0001FFC CID3 RO 0xB1 Components ID3

Table G.11 DWT Control Register

Reset
Bits Name Type Value Description

31:28 NUM_COMP RO 0/1/4 Number of comparators

27 NOTRCPKT RO 0/1 Config info – when set,
tracing are not supported
26 NOEXTRIG RO 0/1 Config info – when set,
external match signals
(external trigger) is not
supported
25 NOCYCCNT RO 0/1 Config info – when set,
DWT_CYCCNT is not
supported
24 NOPRFCNT RO 0/1 Config info – when set,
profiling counters are not
supported
23 Reserved – – –
22 CYCEVTENA R/W 0 Enable Cycle count event
(emit cycle count profiling
packet when the 4-bit
POSTCNT counter
underflow). If
PCSAMPLENA (bit 12) is
set, this bit is disabled.
21 FOLDEVTENA R/W 0 Enable Folded instruction
count event (emit fold
count profiling packet
when FOLDCNT counter
underflow).
(Continued)
e158 APPENDIX G

Table G.11 DWT Control RegisterdCont’d

Reset
Bits Name Type Value Description
20 LSUEVTENA R/W 0 Enable LSU (Load Store
Unit) count event (emit LSU
count profiling packet
when LSUCNT counter
underflow).
19 SLEEPEVTENA R/W 0 Enable Sleep count event
(emit Sleep count profiling
packet when Sleep
counter underflow).
18 EXCEVTENA R/W 0 Enable Exception
overhead count event (emit
Exception overhead count
profiling packet when
Sleep counter underflow).
17 CPIEVTENA R/W 0 Enable CPI count event
(emit CPI count profiling
packet when CPI counter
underflow).
16 EXCTRCENA R/W 0 Enable Interrupt event
tracing
15:13 Reserved – – –
12 PCSAMPLEENA R/W 0 Enable PC sampling event.
When enable, a PC
sampling trace packet is
emit when POSTCNT
underflow. Also see
CYCTAP (bit 9) and
POSTPRESET (bit [4:1])
11:10 SYNTAP R/W 00 Select rate of ITM
synchronization packets
(see SYNCENA bit in ITM
Trace Control register). To
generate periodic ITM
synchronization packets,
ITM’s SYNCCENA must
be set to 1, CYCCNTENA
(bit 0) must be 1, and
SYNCTAP must be set to
one of the following values:
2’b00 – Disable. No ITM
sync packet.
2’b01 – Tap at CYCCNT
bit 24
2’b10 – Tap at CYCCNT
 Appendix G e159

Table G.11 DWT Control RegisterdCont’d

Reset
Bits Name Type Value Description
bit 26
2’b11 – Tap at CYCCNT
bit 28
9 CYCTAP R/W 0 Select a tap for the 4-bit
POSTCNT event using
DWT_CYCCNT.
0 – Select DWT_CYCCNT
bit 6 to trigger POSTCNT
(processor clock/64)
1 – Select DWT_CYCCNT
bit 10 to trigger POSTCNT
(processor clock/1024)
8:5 POSTCNT R/W 0 Post-scalar counter. It
decrements when the tap
bit (see CYCTAP, bit 9)
toggles. When this counter
reach 0, it trigger PC
sampling trace packet
(if PCSAMPLEENA is 1), or
cycle count profiling
packet (if CYCEVTENA
is 1).
4:1 POSTPRESET R/W 0 Reload value for
POSTCNT, bits [8:5], post-
scalar counter.
If this value is 0, events are
triggered on each tap
change (a power of 2, such
as 1<<6 or 1<<10).
If this field has a non-
0 value, this forms a count-
down value, to be reloaded
into POSTCNT each time it
reaches 0.
For example, a value 1 in
this register means an
event is formed every other
tap change.
0 CYCCNTENA R/W 0 Enable the CYCCNT
(DWT_CYCCNT) counter.
Debugger/software should
initialize CYCCNT before
enabling CYCCNT.
e160 APPENDIX G

Table G.12 DWT Cycle Counter Register (DWT->CYCCNT, 0xE0001004)

Bits Name Type Reset Value Description

31:0 CYCCNT R/W – Current PC Sampler / Cycle

Counter count value. When
enable, it counts upwards
every clock cycle.
Debugger/software should
initialize CYCCNT before
enabling CYCCNT.

Table G.13 DWT CPI Counter Register (DWT->CPICNT, 0xE0001008)

Reset
Bits Name Type Value Description

31:8 – – – Reserved
7:0 CPICNT R/W – Current CPI counter value.
Increments on the additional
cycles (the first cycle is not
counted) required to execute
all instructions except those
recorded by DWT_LSUCNT.
This counter also increments
on all instruction fetch stalls.
If CPIEVTENA is set, an
event is emitted when the
counter overflows.

Table G.14 DWT Exception Overhead Register (DWT->EXCCNT, 0xE000100C)

Reset
Bits Name Type Value Description

31:8 – – – Reserved
7:0 EXCCNT R/W – Current interrupt overhead
counter value. Counts the total
cycles spent in interrupt
processing (for example entry
stacking, return unstacking,
pre-emption). An event is
emitted on counter overflow
(every 256 cycles).
 Appendix G e161

Table G.15 DWT Sleep Counter Register (DWT->SLEEPCNT, 0xE0001010)

Bits Name Type Reset Value Description

31:8 – – – Reserved
7:0 SLEEPCNT R/W – Sleep counter. Counts the
number of cycles during
which the processor is
sleeping. An event is
emitted on counter overflow
(every 256 cycles).

Table G.16 DWT Load-Store-Unit Counter Register (DWT->LSUCNT, 0xE0001014)

Bits Name Type Reset Value Description

31:8 – – – Reserved
7:0 LSUCNT R/W – LSU counter. This counts the
total number of cycles that the
processor is processing an
LSU operation. The initial
execution cost of the
instruction is not counted. For
example, an LDR that takes
two cycles to complete
increments this counter one
cycle. Equivalently, an LDR
that stalls for two cycles (and
so takes four cycles),
increments this counter three
times. An event is emitted on
counter overflow (every 256
cycles).

Table G.17 DWT Fold Counter Register (DWT->FOLDCNT, 0xE0001018)

Bits Name Type Reset Value Description

31:8 – – – Reserved
7:0 FOLDCNT R/W – This counts the total
number folded instructions.
e162 APPENDIX G

Table G.18 DWT PC Sampling Register (DWT->PCSR, 0xE000101C)

Bits Name Type Reset Value Description

31:0 EIASAMPLE RO – Execution instruction

address sample. If the
processor is halted, it return
0xFFFFFFFF

Table G.19 DWT COMPx Registers (DWT->COMPn, 0xE0001020/0xE0001030/

0xE0001040/0xE0001050)

Bits Name Type Reset Value Description

31:0 COMP R/W – Data values to compare

against data address / PC
value / DWT_CYCCNT
(comparator #0 only, see
CYCMATCH bit) / data value
(comparator #1 only, see
DATAVMATCH bit).

Table G.20 DWT MASKx Registers (DWT->MASKn, 0xE0001024/0xE0001034/

0xE0001044/0xE0001054)

Bits Name Type Reset Value Description

31:4 – – – Reserved
3:0 MASK R/W – Mask on data during
comparison. This is the size
of the ignore mask (aligned to
LSB). 0 ¼ all bits are
compared, 1 ¼ bits 1 to bit 31
are compared, .. and 15 ¼
bit 15 to bit 31 are compared.

Note for DWT FUNCTION register (table G.21) and FUNCTION values (in table G.22):
• Functions 4’b1100 to 4’b1111 are not available in CortexÒ -M3 r0p0 to r1p1
• Data value is only sampled for accesses that do not fault (MPU or bus fault).
The PC is sampled irrespective of any faults. The PC is only sampled for the first
address of a burst.
 Appendix G e163

Table G.21 DWT FUNCTIONx Registers (DWT->FUNCTIONn, 0xE0001028/

0xE0001038/0xE0001048/0xE0001058)

Bits Name Type Reset Value Description

31:25 – – – Reserved
24 MATCHED RO 0 This bit is set when the
comparator matches, and
indicates that the operation
defined by FUNCTION has
occurred since this bit was last
read. This bit is cleared on
read.
23:20 – – – Reserved
19:16 DATAVADDR1 R/W – Identity of a second linked
address comparator for data
value matching when
DATAVMATCH ¼¼ 1 and
LNK1ENA ¼¼ 1.
15:12 DATAVADDR0 R/W – Identity of a linked address
comparator for data value
matching when
DATAVMATCH ¼¼ 1.
11:10 DATAVSIZE R/W – Defines the size of the data in
the COMP register is to be
matched.
00 ¼ byte
01 ¼ half-word
10 ¼ word
11 ¼ Unpredicatable
9 LNK1ENA RO 0 Read only configure
information:
0 ¼ DATAVADDR1 not
supported
1 ¼ DATAVADDR1 supported
8 DATAVMATCH R/W – This bit is only available in
comparator 1. When
DATAVMATCH is set, this
comparator performs data
value compares.
The comparators given by
DATAVADDR0 and
DATAVADDR1 provide the
address for the data
comparison. If DATAVMATCH
is set in DWT_FUNCTION1,
the FUNCTION setting for the
comparators given by
DATAVADDR0 and

(Continued)
e164 APPENDIX G

Table G.21 DWT FUNCTIONx Registers (DWT->FUNCTIONn, 0xE0001028/

0xE0001038/0xE0001048/0xE0001058)dCont’d

Bits Name Type Reset Value Description

DATAVADDR1 are overridden
and those comparators only
provide the address match for
the data comparison.
7 CYCMATCH R/W – Only available in
comparator #0. When set, this
comparator compares against
the clock cycle counter.
6 – – – Reserved
5 EMITRANGE Emit range field. Reserved to
permit emitting offset when
range match occurs. Reset
clears the EMITRANGE bit. PC
sampling is not supported
when EMITRANGE is enabled.
EMITRANGE only applies for:
FUNCTION ¼ 0001, 0010,
0011, 1100, 1101, 1110, and
1111.
4 – – – Reserved
3:0 FUNCTION R/W 0 Function of the comparator.
See Table G.20.

Table G.22 Settings for DWT FUNCTION Registers

FUNCTION Value Descriptions

4’b0000 Disabled
4’b0001 EMITRANGE ¼ 0, sample and emit PC through ITM
EMITRANGE ¼ 1, emit address offset through ITM
4’b0010 EMITRANGE ¼ 0, emit data through ITM on read and write.
EMITRANGE ¼ 1, emit data and address offset through ITM on
read or write.
4’b0011 EMITRANGE ¼ 0, sample PC and data value through ITM on
read or write.
EMITRANGE ¼ 1, emit address offset and data value through
ITM on read or write.
4’b0100 Watchpoint on PC match
4’b0101 Watchpoint on data read
4’b0110 Watchpoint on data write
 Appendix G e165

Table G.22 Settings for DWT FUNCTION RegistersdCont’d

FUNCTION Value Descriptions
4’b0111 Watchpoint on data read or write
4’b1000 ETM trigger on PC match (only if ETM is present)
4’b1001 ETM trigger on data read (only if ETM is present)
4’b1010 ETM trigger on data write (only if ETM is present)
4’b1011 ETM trigger on data read or write (only if ETM is present)
4’b1100 EMITRANGE ¼ 0, sample data for read transfers
EMITRANGE ¼ 1, sample Daddr[15:0] (address offset) for read
transfers
4’b1101 EMITRANGE ¼ 0, sample data for write transfers
EMITRANGE ¼ 1, sample Daddr[15:0] (address offset) for write
transfers
4’b1110 EMITRANGE ¼ 0, sample PCþdata for read transfers
EMITRANGE ¼ 1, sample Daddr[15:0] (address offset) þ data
value for read transfers
4’b1111 EMITRANGE ¼ 0, sample PCþdata for write transfers
EMITRANGE ¼ 1, sample Daddr[15:0] (address offset) þ data
value for write transfers

• FUNCTION is overridden for comparators given by DATAVADDR0 and

DATAVADDR1 in DWT_FUNCTION1if DATAVMATCH is also set in
DWT_FUNCTION1. The comparators given by DATAVADDR0 and DATA-
VADDR1 can then only perform address comparator matches for comparator 1
data matches.
• If the data matching functionality is not included during implementation it is not
possible to set DATAVADDR0, DATAVADDR1, or DATAVMATCH in
DWT_FUNCTION1. This means that the data matching functionality is not
available in the implementation. Test the availability of data matching by writing
and reading the DATAVMATCH bit in DWT_FUNCTION1. If it is not settable
then data matching is unavailable.
• PC match is different from breakpoint. Watchpoint events stop the processor
after the instruction executed, and by the time the processor stop it could have
executed another instruction. It is mainly used for triggering the ETM. So for
breakpoint usage it is less preferable than using breakpoint comparators. How-
ever, since the breakpoint comparators can only handle breakpoints in the CODE
region, PC match can be used as an alternatively solution for breakpoint in other
memory regions.
e166 APPENDIX G

G.4 Instrumentation trace macrocell

Note: Integration test registers are for on-chip connectivity testings and is intended
to be used by chip designers. Do not use these registers in normal usage.

Table G.23 Summary of ITM Registers

Address CMSIS Name Type Reset Value Description

0xE0000000 ITM->PORT[0] R/W – ITM Stimulus Ports 0

0xE0000004 ITM->PORT[1] R/W – ITM Stimulus Ports 1
. . R/W – .
0xE000007C ITM->PORT R/W – ITM Stimulus Ports 31
[31]
0xE0000E00 ITM->TER R/W 0x00000000 ITM Trace Enable
Register
0xE0000E40 ITM->TPR R/W 0x00000000 ITM Trace Privileged
Register
0xE0000E80 ITM->TCR R/W 0x00000000 ITM Trace Control
Register
0xE0000EF8 ITM->IWR W 0x00000000 ITM Integration Write
Register
0xE0000EFC ITM->IRR R/W 0x00000000 ITM Integration Read
Register
0xE0000F00 ITM->IMCR R/W 0x00000000 ITM Integration Mode
Control Register
0xE0000FB0 ITM->LAR R/W 0x00000000 ITM Lock Access
Register
0xE0000FB4 ITM->LSR R/W 0x00000003 ITM Lock Status Register
0xE0001FD0 PID4 RO 0x04 Peripheral ID4
0xE0001FD4 PID5 RO 0x00 Peripheral ID5
0xE0001FD8 PID6 RO 0x00 Peripheral ID6
0xE0001FDC PID7 RO 0x00 Peripheral ID7
0xE0001FE0 PID0 RO 0x01 Peripheral ID0
0xE0001FE4 PID1 RO 0xB0 Peripheral ID1
0xE0001FE8 PID2 RO 0x-B Peripheral ID2
0xE0001FEC PID3 RO 0x00 Peripheral ID3
0xE0001FF0 CID0 RO 0x0D Components ID0
0xE0001FF4 CID1 RO 0xE0 Components ID1
0xE0001FF8 CID2 RO 0x05 Components ID2
0xE0001FFC CID3 RO 0xB1 Components ID3
 Appendix G e167

Table G.24 ITM Stimulus Port Registers 0 to 31 (0xE0000000 to 0xE000007C)

Bits Name Type Reset Value Description

31:0 ITM->PORT[n] R/W – Write: data to be output.

You can write data of byte,
half-word or word to this
register. Before writing you
must first check the FIFO
status to ensure that the
buffer is not full by reading
this register.
Read: Buffer status
0 ¼ full
1 ¼ not full

Table G.25 ITM Trace Enable Register (ITM->TER, 0xE0000E00)

Bits Name Type Reset Value Description

31:0 STIMENA R/W 0x00000000 Bit mask to enable ITM

Stimulus Ports. One bit per
port.
Unprivileged write to this
register can be accepted if
the Trace Privileged
Register (ITM->TPR) is
setup.

Table G.26 ITM Trace Privileged Register (ITM->TPR, 0xE0000E40, privileged

access only)

Bits Name Type Reset Value Description

31:4 – – – Reserved
3 PRIVMASK[3] R/W 0 If set to 1, enable
unprivileged code to access
port 24 to 31, and byte 3 of
the ITM Trace Enable
Register
2 PRIVMASK[2] R/W 0 If set to 1, enable
unprivileged code to access
port 16 to 23, and byte 2 of

(Continued)
e168 APPENDIX G

Table G.26 ITM Trace Privileged Register (ITM->TPR, 0xE0000E40, privileged access
only)dCont’d

Bits Name Type Reset Value Description

the ITM Trace Enable
Register
1 PRIVMASK[1] R/W 0 If set to 1, enable
unprivileged code to access
port 8 to 15, and byte 1 of the
ITM Trace Enable Register
0 PRIVMASK[0] R/W 0 If set to 1, enable
unprivileged code to access
port 0 to 7, and byte 0 of the
ITM Trace Enable Register

Table G.27 ITM Trace Control Register (ITM->TCR, 0xE0000E80, privileged access
only)

Bits Name Type Reset Value Description

31:24 – – – Reserved
23 BUSY RO –
22:16 TraceBusID R/W 0 ID used by the Advanced Trace
Bus (ATB) interface
15:12 – – – Reserved
11:10 GTSFREQ R/W 0 Global Timestamp frequency
(available on Cortex-M3 r2p1 or
after, and on Cortex-M4).
00 ¼ Disable global timestamp
01 ¼ Generate timestamp
request when the ITM defect a
change in bit[47:7] of a global
timestamp counter. (Approx
every 128 cycles)
10 ¼ Generate timestamp
request when the ITM defect a
change in bit[47:13] of a global
timestamp counter. (Approx
every 8192 cycles)
11 ¼ Generate timestamp after
every packet if the FIFO is
empty.
 Appendix G e169

Table G.27 ITM Trace Control Register (ITM->TCR, 0xE0000E80, privileged access
only)dCont’d

Bits Name Type Reset Value Description

9:8 TSPrescale R/W 0 Local Timestamp (delta)
prescaler (does not affect global
timestamp)
00 ¼ no prescaling
01 ¼ divide by 4
10 ¼ divide by 16
11 ¼ divide by 64
7:5 – – – Reserved
4 SWOENA R/W 0 Enable timestamp counting
using SWV activity.
0 ¼ use the processor clock.
1 ¼ use TPIU activity to trigger
timestamp clock.
3 DWTENA R/W 0 Enable DWT packets
2 SYNCENA R/W 0 Enable synchronization packets
for TPIU
1 TSENA R/W 0 Enable differential timestamps
(local timestamp using time
delta). Timestamp packet is
generated when:
1. A packet is emitted, and
2. Timestamp counter overflow
(2 million clock cycles, un-
less when SWOENA is set)
0 ITMENA R/W 0 Enable ITM. This must be set to
1 before ITM Stimulus and
Trace Enable registers are
written.

Table G.28 ITM Integration Write Register (ITM->IWR, 0xE0000EF8, privileged

access only)

Bits Name Type Reset Value Description

31:1 – – – Reserved
0 ATVALIDM WO – Only use with integration test
(on-chip connectivity test).
Do not use in normal
applications.
When in integration test
mode, i.e., bit 0 of ITM-
>IMCR is set, this bit is used
to control the ATVALIDM
output of the ATB (trace bus)
e170 APPENDIX G

Table G.29 ITM Integration Read Register (ITM->IRR, 0xE0000EFC, privileged

access only)

Bits Name Type Reset Value Description

31:1 – – – Reserved
0 ATREADYM RO – Only use with integration test
(on-chip connectivity test).
Do not use in normal
applications.
When in integration test
mode, i.e. bit 0 of ITM-
>IMCR is set, this bit is used
to read the ATREADYM
input of the ATB (trace bus)

Table G.30 ITM Integration Mode Control Register (ITM->IMCR, 0xE0000F00,

privileged access only)

Bits Name Type Reset Value Description

31:1 – – – Reserved
0 INTEGRATION R/W 0 Only use with integration
test (on-chip connectivity
test). Do not use in normal
applications.
Set to 1 to enable
integration test mode.

Table G.31 ITM Lock Access Register (ITM->LAR, 0xE0000FB0, privileged access
only)

Bits Name Type Reset Value Description

31:0 Lock Access WO – A privileged write of

0xC5ACCE55 unlock and
enable write access to Trace
Control Register. A write of
any other value set the lock
and disable write.
 Appendix G e171

Table G.32 ITM Lock Status Register (ITM->LSR, 0xE0000FB4, privileged access
only)

Bits Name Type Reset Value Description

31:3 – – – Reserved
2 ByteAcc RO 0 Always 0 to indicate that the
unlocking write has to be
done with word size transfers.
Byte size transfer unlocking
sequence is not supported.
1 Access RO 1 When 1, it indicates that write
access to the component is
blocked.
When 0, it indicates that write
accesses are allowed.
0 Present RO 1 Always 1, indicates that a lock
mechanism is present.

G.5 Trace port interface unit (TPIU)

Note: Integration test registers are for on-chip connectivity testings and is intended
to be used by chip designers. Do not use these registers in normal usage.

Table G.33 Summary of TPIU Registers

Reset
Address CMSIS Name Type Value Description

0xE0040000 TPI->SSPSR RO – Supported Sync Port

Size Register
0xE0040004 TPI->CSPSR R/W 0x1 Current Sync Port Size
Register
0xE0040010 TPI->ACPR R/W 0x0000 Async Clock Prescaler
Register
0xE00400F0 TPI->SPPR R/W 0x01 Selected Pin Protocol
Register
0xE0040300 TPI->FFSR RO 0x08 Formatter and Flush
Status Register
0xE0040304 TPI->FFCR R/W 0x102 Formatter and Flush
Control Register
(Continued)
e172 APPENDIX G

Table G.33 Summary of TPIU RegistersdCont’d

Reset
Address CMSIS Name Type Value Description
0xE0040308 TPI->FSCR RO 0x00 Formatter
Synchronisation Counter
Register (not
implemented because
synchronization control is
handled by ITM and
DWT)
0xE0040EE8 TPI->TRIGGER RO 0 Integration test register:
TRIGGER
0xE0040EEC TPI->FIFO0 RO – Integration test register
for FIFO data 0
0xE0040EF0 TPI- R/W 0 Integration test register:
>ITATBCTR2 ITATBCTR2
0xE0040EF8 TPI- RO 0 Integration test register:
>ITATBCTR0 ITATBCTR0
0xE0040EFC TPI->FIFO1 RO – Integration test register
for FIFO data 1
0xE0040F00 TPI->ITCTRL R/W 0 Integration test Mode
Control Register
0xE0040FA0 TPI- R/W 0xF Claim tag set register
>CLAIMSET
0xE0040FA4 TPI- R/W 0x0 Claim tag clear register
>CLAIMCLR
0xE0040FC8 TPI->DEVID RO 0x4C0/ CoreSight Device ID
0x4C1
0xE0040FCC TPI->DEVTYPE RO 0x11 CoreSight Device Type
0xE0040FD0 PID4 RO 0x04 Peripheral ID4
0xE0040FD4 PID5 RO 0x00 Peripheral ID5
0xE0040FD8 PID6 RO 0x00 Peripheral ID6
0xE0040FDC PID7 RO 0x00 Peripheral ID7
0xE0040FE0 PID0 RO 0x23 Peripheral ID0
0xE0040FE4 PID1 RO 0xB9 Peripheral ID1
0xE0040FE8 PID2 RO 0x-B Peripheral ID2
0xE0040FEC PID3 RO 0x00 Peripheral ID3
0xE0040FF0 CID0 RO 0x0D Components ID0
0xE0040FF4 CID1 RO 0x90 Components ID1
0xE0040FF8 CID2 RO 0x05 Components ID2
0xE0040FFC CID3 RO 0xB1 Components ID3
 Appendix G e173

Table G.34 TPIU Support Sync Port Size Register (TPI->SSPSR, 0xE0040000)
Reset
Bits Name Type Value Description

31:4 – – – Reserved
3 4BIT RO – If set to 1, the Trace Port can
operate in 4 bit mode (device-
specific)
2 3BIT RO 0 Always 0 because the Trace
Port cannot run with 3 bit width
1 2BIT RO – If set to 1, the Trace Port can
operate in 2 bit mode (device-
specific)
0 1BIT RO – If set to 1, the Trace Port can
operate in 1 bit mode (device-
specific)

Table G.35 TPIU Current Sync Port Size Register (TPI->CSPSR, 0xE0040004)
Bits Name Type Reset Value Description

31:4 – – – Reserved
3:0 PORTSIZE R/W 1 Port size. It can be one of the
following:
0x8 ¼ 4 bit mode.
0x2 ¼ 2 bit mode.
0x1 ¼ 1 bit mode. Set to 1
when using SWV mode.

Table G.36 TPIU Async Clock Prescaler Register (TPI->ACPR, 0xE0040010)

Bits Name Type Reset Value Description

31:13 – – – Reserved
12:0 PRESCALER R/W 0 Divisor for Trace Clock is
Prescaler þ 1
e174 APPENDIX G

Table G.37 TPIU Selected Pin Protocol Register (TPI->SPPR, 0xE00400F0)

Bits Name Type Reset Value Description

31:2 – – – Reserved
1:0 PROTOCOL R/W 1 Trace port protocol
00 ¼ Trace port mode
(parallel pins)
01 ¼ Serial Wire Viewer
mode (Manchester).
(default setting)
10 ¼ Serial Wire Viewer
mode (NRZ).
11 ¼ Reserved

Table G.38 TPIU Formatter and Flush Status Register (TPI->FFSR, 0xE0040300)
Bits Name Type Reset Value Description

31:4 – – – Reserved
3 FtNonStop RO 1 Formatter cannot be
stopped.
2 TCPresent RO 0 TRACECTRL pin not present.
1 FtStopped RO 0 Formatter stopped. This is
always 0 because formatter
start stop is not supported.
0 FlInProg RO 0 Flush in progress (Trace bus
buffer flush). The Cortex-M3/
M4 TPIU always output trace
data if a data is in the buffer
and flush control is not
supported.

Table G.39 TPIU Formatter and Flush Control Register (TPI->FFCR, 0xE0040304)
Bits Name Type Reset Value Description

31:9 – – – Reserved
8 TrigIN RO 1 Indicate a trigger on TRIGIN
being asserted
7:2 – – – Reserved
1 EnFCont R/W 1 Formatter enable
0 – – – Reserved
 Appendix G e175

Table G.40 TPIU Integration Test Register: TRIGGER (TPI->TRIGGER, 0xE0040EE8)

Bits Name Type Reset Value Description

31:1 – – – Reserved
0 TRIGGER RO 0 TRIGGER input value

Table G.41 TPIU Integration Test Register: FIFO0 (TPI->FIFO0, 0xE0040EEC)

Reset
Bits Name Type Value Description

31:30 – – – Reserved
29 ITM ATVALID RO – Value of ATVALID signal on
the ATB (trace bus)
connected to the ITM
28:27 Byte count RO – Number of bytes of ITM trace
data since last read of
Integration ITM Data
Register.
26 ETM ATVALID RO – Value of ATVALID signal on
the ATB (trace bus)
connected to the ETM
25:24 Byte count RO – Number of bytes of ETM
trace data since last read of
Integration ETM Data
Register.
23:16 ETM Data 2 RO – ETM trace data. The TPIU
15:8 ETM Data 1 RO – FIFO discard the data when
7:0 ETM Data 0 RO – this register is read.

Table G.42 TPIU Integration Test Register: ITATBCTR2 (TPI-> ITATBCTR2,

0xE0040EF0)
Reset
Bits Name Type Value Description

31:1 – – – Reserved
0 ATREADY R/W 0 ATREADY output(s) of ATB
interface
e176 APPENDIX G

Table G.43 TPIU Integration Test Register: ITATBCTR0 (TPI-> ITATBCTR0,

0xE0040EF8)
Reset
Bits Name Type Value Description

31:1 – – – Reserved
0 ATVALID RO 0 Read the OR result of
ATVALID from upstream ATB
sources

Table G.44 TPIU Integration Test Register: FIFO1 (TPI->FIFO1, 0xE0040EFC)

Bits Name Type Reset Value Description

31:30 – – – Reserved
29 ITM ATVALID RO – Value of ATVALID signal on
the ATB (trace bus)
connected to the ITM
28:27 Byte count RO – Number of bytes of ITM
trace data since last read of
Integration ITM Data
Register.
26 ETM ATVALID RO – Value of ATVALID signal on
the ATB (trace bus)
connected to the ETM
25:24 Byte count RO – Number of bytes of ETM
trace data since last read of
Integration ETM Data
Register.
23:16 ITM Data 2 RO – ITM trace data. The TPIU
15:8 ITM Data 1 RO – FIFO discard the data when
7:0 ITM Data 0 RO – this register is read.

Table G.45 TPIU Integration Test Mode Control Register (ITM->ITCTRL,

0xE0000F00)

Bits Name Type Reset Value Description

31:1 – – – Reserved
1:0 Mode R/W 0 Only use with integration
test (on-chip connectivity
test). Do not use in normal
applications.
00 ¼ Normal operation
01 ¼ Integration test mode
10 ¼ Integration data test
mode
11 ¼ reserved.
 Appendix G e177

Table G.46 TPIU Device ID Register (ITM->DEVID, 0xE0000FC8)

Reset
Bits Name Type Value Description

31:12 – – – Reserved
11 Asynchronous Serial RO 1 Set to 1, indicates that
Wire Output (NRZ) Asynchronous Serial
Wire Output (NRZ) is
supported.
10 Asynchronous Serial RO 1 Set to 1, indicates that
Wire Output Asynchronous Serial
(Manchester) Wire Output (NRZ) is
supported.
9 Parallel Trace Port mode RO 1 Set to 1, indicates that
Trace Port mode is
supported.
8:6 Minimum buffer size RO 3’b010 Indicate 4 bytes FIFO
5 Asynchronous RO 1 Indicates Trace Port can
TRACECLKIN run asynchronously to
the processor’s clock
4:0 Number of inputs RO 0/1 Number of trace input:
0x0 ¼ 1 input (Cortex-
M3/M4 device without
ETM)
0x1 ¼ 2 inputs (Cortex-
M3/M4 device with ETM)

Table G.47 TPIU Device Type Register (ITM->DEVTYPE, 0xE0000FCC)

Bits Name Type Reset Value Description

31:8 – – – Reserved
7:4 SubType RO 1 The Device Type reads as
3:0 Major Type RO 1 0x11 and indicates this
device is a trace sink and
specifically a TPIU
e178 APPENDIX G

G.6 AHB-AP (AHB access port)

Note: the registers listed in this part are only visible via debug connection, and is not
visible for software running on the processor.

Table G.48 Summary of AHB-AP Registers

Address Reset
Offset Name Type Value Description

0x00 Control and Status R/W –

Word
0x04 Transfer Address R/W – AHB Address value
0x0C Data Read/Write R/W – Data
0x10 Banked Data 0 R/W –
0x14 Banked Data 1 R/W –
0x18 Banked Data 2 R/W –
0x1C Banked Data 3 R/W –
0xF8 Debug ROM RO 0xE00FF003 Address of the
Address primary ROM table
0xFC ID Register RO 0x-4770011

Table G.49 AHB-AP Control and Status Word (CSW)

Reset
Bits Name Type Value Description

31:30 – – 0 Reserved
29 MasterType R/W 1 Controls the HMASTER signal
on the AHB which indicate the
transfer source.
0 ¼ core
1 ¼ debug
This can be overridden by
chip design configuration
(FIXMASTERTYPE signal)
28:26 – – 0 Reserved
25 HPROT R/W 1 AHB HPROT[1]: Privileged (0)
and unprivileged (1) control
24 – – 1 Reserved
23:12 – – 0 Reserved
11:8 Mode R/W 0 Mode of operation bits:
0 ¼ normal download/upload
mode
Other values are reserved.
 Appendix G e179

Table G.49 AHB-AP Control and Status Word (CSW)dCont’d

Reset
Bits Name Type Value Description
7 TransINProg RO 0 Transfer in progress
6 DbgStatus RO 0/1 Indicate the status of DAPEN
input:
1 ¼ AHB transfer permitted
0 ¼ AHB transfer not
permitted (device-specific;
could be caused by firmware
protection feature in the
processor)
5:4 AddrInc R/W 0 Auto address increment and
pack mode on Read or Write
data access. Only increments
if the current transaction
completes with no error.
Auto address incrementing
and packed transfers are not
performed on access to
Banked Data registers 0x10 -
0x1C. The status of these bits
is ignored in these cases.
Increments and wraps within
a 4-KB address boundary, for
example for word
incrementing from 0x1000 to
0x1FFC. If the start is at
0x14A0, then the counter
increments to 0x1FFC, wraps
to 0x1000, then continues
incrementing to 0x149C.
2’b00 ¼ auto increment off.
2’b01 ¼ increment single.
Single transfer from
corresponding byte lane.
2’b10 ¼ increment packed.
2’b11 ¼ reserved. No
transfer.
Size of address increment is
defined by the Size field [2:0].
3 – – 0 Reserved
2:0 SIZE R/W 0 Size of access field
3’b000 ¼ byte
3’b001 ¼ half-word
3’b010 ¼ word
Other values are reserved
e180 APPENDIX G

Table G.50 AHB-AP Transfer Address Register (TAR)

Bits Name Type Reset Value Description

31:0 ADDRESS R/W – Current Transfer Access

Table G.51 AHB-AP Data Read/Write Register (DRW)

Bits Name Type Reset Value Description

31:0 DATA R/W – Write: data value to write for

the current transfer
address.
Read: data value to read for
the current transfer address

Table G.52 AHB-AP Banked Data Registers 0 to 3

Bits Name Type Reset Value Description

31:0 DATA R/W – BD0-BD3 provide a

mechanism for directly
mapping through DAP
accesses to AHB transfers
without having to rewrite the
TAR within a four location
boundary, so for example BD0
reads/write from TAR,BD1
from TARþ4.
For example, by setting TAR to
0xE00EDF0 (DHCSR
address), you can access all 4
core debug registers without
reprogramming the TAR each
time:
BD0 – DHCSR (0xE00EDF0)
BD1 – DCRSR (0xE00EDF4)
BD2 – DCRDR (0xE00EDF8)
BD3 – DEMCR (0xE00EDFC)
Banked transfers are only
supported for word transfers.
Non-word banked transfer size
is currently ignored, assumed
word access.
 Appendix G e181

Table G.53 AHB-AP Debug ROM Address Register

Reset
Bits Name Type Value Description

31:0 ADDRESS RO 0xE00FF003 Base address of the

primary ROM table, with bit
[1:0] indicates if the device
is present.

Table G.54 AHB-AP ID Register

Reset
Bits Name Type Value Description

31:28 Revision RO – Revision of the AHB-AP

design
27:24 JEP-106 continuation RO 0x4 For an ARM-designed
code AP, this field has value
0b0100, 0x4.
23:17 JEP-106 identity code RO 0x3B For an ARM-designed
AP, this field has value
0b0111011, 0x3B.
16 Class RO 1 Memory Access Port
15:8 – – 0 Reserved
7:4 AP Variant RO 1 Cortex-M3/M4 variant
3:0 AP Type RO 1 AMBA AHB bus