Theory of Operation

Memory Maps

TL-UL device

The memory map accessible over the TL-UL device interface is documented in the Debug Memory section of the PULP RISC-V Debug System Documentation. Note this contains a mixture of read only and read-write regions and which is which isn’t documented. The read-write regions are:

  • 0x100 - 0x10c: Halted, Going, Resuming, Exception
  • 0x380 - 0x382: DataAddr (0x383 - 0x338 are not implemented and will read undefined data)

All other regions are read only.

Debug Module Registers

The Debug Module Registers are only accessible via the Debug Module Interface (DMI) accessed via JTAG. There is no access to these via the TL-UL device interface.

Late Debug Enable Mechanism

The RV_DM is gated by life cycle so that it is only usable during TEST_UNLOCKED*, DEV and RMA life cycle states where the LC_HW_DEBUG_EN signal is asserted. In the DEV life cycle state, this gating mechanism supports “late enablement” via firmware in order to implement a debug policy where ROM or ROM_EXT first secures and locks critical regions, assets and mechanisms in the device before ungating the RV_DM completely.

The following truth table summarizes the behavior of this mechanism

LC StateDIS_RV_DM_LATE_DEBUG (OTP Fuse)LATE_DEBUG_ENABLE (CSR)RV_DM reachable via TAPRV_DM fully ungated
PROD*, RAW or invalid statesxxnono
DEVnot kMuBi8Truenot kMuBi32Trueyesno
DEVnot kMuBi8TruekMuBi32Trueyesyes

Non-debug Module Reset Support

The life cycle gating mechanism explained in the previous section severs the connection between the RV_DM and a JTAG attached debugger whenever the device is reset. In order to prevent this from happening during a non-debug-module (NDM) reset request, the TAP/JTAG-side gating logic is modulated using a separate hardware debug enable signal that comes from the strap sampling module inside the pinmux. The pinmux basically ensures that that signal is latched and kept stable while an NDM reset is taking place. See also pinmux documentation.