nRF54L AUX-AP access port description and usage

RE: nRF54L AUX-AP access port description and usage

ketiljo — Wed, 12 Feb 2025 08:28:48 GMT

Great!

The secure and non-secure domain works differently, so you have to use different addresses depending on what you use.

RE: nRF54L AUX-AP access port description and usage

Tomas Vanek — Tue, 11 Feb 2025 16:18:31 GMT

Its a pity that DM is not mapped on AUX-AP from address 0. Both 0.13.2 and 1.0 RISC-V debug specifications in chapter 3.15 Debug Module Registers clearly require

Each DM has a base address (which is 0 for the first DM).

Also the different base 0x4004c400 or 0x5004c400 depending on security setting in SPU complicates the debugger setup.

RE: nRF54L AUX-AP access port description and usage

Tomas Vanek — Tue, 11 Feb 2025 15:32:14 GMT

Setting CSW Prot[0] (bit 24) does the trick and DM registers are accessible.

Thanks!

RE: nRF54L AUX-AP access port description and usage

Tomas Vanek — Tue, 11 Feb 2025 14:50:14 GMT

And real values read from CSW are

> nrf54l.dap apreg 0 0
0x02800052
> nrf54l.dap apreg 1 0
0x43800042

RE: nRF54L AUX-AP access port description and usage

Tomas Vanek — Tue, 11 Feb 2025 14:33:27 GMT

Both AP0 and AP1 use OpenOCD default csw 0xa2000000

RE: nRF54L AUX-AP access port description and usage

ketiljo — Tue, 11 Feb 2025 14:28:02 GMT

The issue is possibly related to access violations. Could you share with us the AHB-AP CSW register configuration for both AP0 and AP1?

RE: nRF54L AUX-AP access port description and usage

Tomas Vanek — Thu, 06 Feb 2025 15:38:25 GMT

I rechecked it again. The registers are accessible on AP0 but NOT on AP1.

All ok on AP0:

> # UICR.AUXAPPROTECT[0].PROTECT0 and PROTECT1
> nrf54l.cpu mdw 0x00FFD040
0x00ffd040: ffffffff
> nrf54l.cpu mdw 0x00FFD05c
0x00ffd05c: ffffffff

> # TAMPC.PROTECT.AP[0].DBGEN.CTRL
> nrf54l.cpu mdw 0x500DC700
0x500dc700: 00000011

> # VPR.DEBUGIF.DMSTATUS
> nrf54l.cpu mdw 0x5004C444
0x5004c444: 00430c82

Just SWD FAULT responses on AP1:

> nrf54l.aux mdw 0x5004C444
Failed to read memory at 0x5004c444
> nrf54l.aux mdw 0x4004C444
Failed to read memory at 0x4004c444
> nrf54l.aux mdw 0x444
Failed to read memory at 0x00000444
> nrf54l.aux mdw 0x44
Failed to read memory at 0x00000044

It not of any help for me if you just repeat what I read several times. There must be an issue! But where?

RE: nRF54L AUX-AP access port description and usage

ketiljo — Thu, 06 Feb 2025 14:55:59 GMT

As far as VPR is concerned, it is accessed exactly same way in both AP0 and AP1, the RISC-V debugging registers are memory mapped to the address pointed above.

[quote user="Tomas Vanek"]In the AUX-AP address space there is no DMSTATUS neither @ 0x44 nor @ 0x4004c444[/quote]

See the link in the last post, https://docs.nordicsemi.com/bundle/ps_nrf54L15/page/vpr.html#ariaid-title14

RE: nRF54L AUX-AP access port description and usage

Tomas Vanek — Tue, 04 Feb 2025 14:27:24 GMT

Sorry, I'm not asking about AP0 (APP CPU AP) address space. Yes, the RISC-V DM is mapped there. I quoted it in my first question

[quote userid="140797" url="~/f/nordic-q-a/118258/nrf54l-aux-ap-access-port-description-and-usage"]FLPR/VPR RISC-V coprocessor DM (debug module) registers are exposed @ 0x4004C000 / 0x5004C000 of APP-AP (AP ID 0) address space as described
in 8.26.1 Registers[/quote]

and you replied

[quote userid="2125" url="~/f/nordic-q-a/118258/nrf54l-aux-ap-access-port-description-and-usage/520330"]The main reason to have AP0 and AP1 (AUX-AP) to debug CM33 and VPR simultaneously using the corresponding APs. So the primary usage for AUX-AP is to use with RISC-V DM access as pointed in the question.[/quote]

My question is how to use AP1 (AUX-AP) for RISC-V debugging? In the AUX-AP address space there is no DMSTATUS neither @ 0x44 nor @ 0x4004c444. And AFAIK no relevant info in the datasheet.

RE: nRF54L AUX-AP access port description and usage

ketiljo — Tue, 04 Feb 2025 12:56:53 GMT

[quote user="Tomas Vanek"]I believe that AUX-AP DBGEN signal should be enabled in this device state[/quote]

Yes, the signal at TAMPC.PROTECT.AP[0].DBGEN.CTRL register must be set as well (in addition to the UICR PROTECT0/1 state)

[quote user="Tomas Vanek"]Where is RISC-V DM mapped on AUX-AP?[/quote]

You can find it here:

https://docs.nordicsemi.com/bundle/ps_nrf54L15/page/vpr.html#ariaid-title14

RE: nRF54L AUX-AP access port description and usage

Tomas Vanek — Mon, 03 Feb 2025 14:26:59 GMT

I have the blinky app with egpio sdp overlay loaded. The app calls nrf54l_handle_approtect() which enables NRF_TAMPC->PROTECT.AP[0].DBGEN.CTRL

Both UICR.AUXAPPROTECT[0].PROTECT0 and PROTECT1 are 0xffffffff thus unprotected.

I believe that AUX-AP DBGEN signal should be enabled in this device state. However I see no readable memory accessed trough AUX-AP on standard RISC-V DM locations (e.g. 0x44 for .DMSTATUS)

Where is RISC-V DM mapped on AUX-AP?

RE: nRF54L AUX-AP access port description and usage

ketiljo — Wed, 29 Jan 2025 09:44:54 GMT

That is correct. There are protection on both AP0 and AP1. So, in addition to writing non-volatile UICR.AUXPROTECT register, you also need to enable DBGEN signal using TAMPC.PROTECT.AP[0].DBGEN register during runtime (after a reset). The TAMPC registers can be written by the fw running on CM33.

Both the AP0 and AP1 uses same protection mechanism, however uses different registers.

RE: nRF54L AUX-AP access port description and usage

Tomas Vanek — Tue, 28 Jan 2025 11:09:05 GMT

Thanks for the reply.

Could you please go into details about accessing RISC-V DM over AUX-AP?

I would expect DM registers at RISC-V debug spec conforming addresses of AUX-AP. But there is no access from SWD DAP.

Datasheet, page 751 reads:

UICR.AUXAPROTECT,
TAMPC.PROTECT.AP[0].DBGEN

These registers control the generation of the AHB-AP DBGEN signal,
which controls debug access to the VPR AHB-AP. This is used to
provide debug capability for VPR.

and

UICR and TAMPC are combined to enable or disable the access port protection. The access port is normally
protected, and is opened when the following conditions are met:
1. UICR.APPROTECT must be Unprotected.
2. The corresponding TAMPC.PROTECT register must be written by firmware. See TAMPC signal protector
for details on the procedure.

Does it mean that AUX-AP access cannot be enabled by a debugger only without running some code on nRF54L?

RE: nRF54L AUX-AP access port description and usage

ketiljo — Tue, 28 Jan 2025 09:59:07 GMT

The debug diagram in trace and debug chapter in PS is not very accurate, the AHB-AP (AP0) can also access the VPR registers. The VPR debug registers are memory mapped on APB00, so they can be accessed through either AP0 and AP1. However, the AUX-AP can access only APB00 space on AMBIX0, a shown below:

The main reason to have AP0 and AP1 (AUX-AP) to debug CM33 and VPR simultaneously using the corresponding APs. So the primary usage for AUX-AP is to use with RISC-V DM access as pointed in the question.