Okay, here is the abstract and summary for the provided transcript in the requested format.
Abstract:
This talk by Sean Cross (Sutekus) demystifies common microcontroller debug protocols, aiming to explain the low-level communication happening between debugger software (like GDB) and the target hardware via debug probes. It covers the fundamental requirements for any debugger (memory/register access, CPU control). The presentation delves into the JTAG protocol, explaining its state machine, signaling, and the inherent coupling of read/write operations. It then details ARM's ADI v5 architecture, focusing on the Debug Port (DP) and Access Port (AP), particularly the Memory Access Port (MEM-AP) used for accessing memory, registers, and controlling the CPU over JTAG or the simpler, faster Serial Wire Debug (SWD) protocol. Flash programming techniques (direct driver vs. RAM-based algorithms) are briefly discussed. The talk contrasts this with the RISC-V debug specification, highlighting its Debug Module Interface (DMI), the multiple optional methods for memory and Control/Status Register (CSR) access (Program Buffer, Abstract Access, System Bus Access), and the separate CSR address space. Finally, it showcases an innovative implementation in the RP2350, which maps the RISC-V DMI onto the ARM ADI MEM-AP structure, enabling RISC-V debugging over standard SWD interfaces.
Demystifying Microcontroller Debugging: From JTAG to RISC-V
00:01:01 Introduction & Goal: Sean Cross explains the motivation: understanding the "gulf" between high-level debug software (GDB) and low-level hardware debug interfaces.
00:02:11 Scope: The talk covers minimum debug requirements, JTAG, ARM ADI v5/MEM-AP, and RISC-V debug, excluding specific hardware/software tool details but mentioning CMSIS-DAP as a unifying probe protocol.
00:03:47 Minimum Viable Debugger: Defines the essential hardware capabilities: Peek/Poke memory, Read/Write CPU registers, and Control CPU (Halt, Step, Reset, Breakpoint).
00:04:11 Example: VexRISC-V: Demonstrates achieving full debug capability with just two registers in a soft-core CPU: one for control signals and one for injecting instructions to manipulate registers and memory.
00:07:05 Exposing Debug via USB (Fomu): Shows how the VexRISC-V debug interface was exposed over USB on the Fomu FPGA board, enabling direct memory access and features like RTT (Real-Time Transfer).
00:08:04 JTAG Basics: Introduces the Joint Test Action Group standard, its 4 primary signals (TCK, TMS, TDI, TDO), the state machine controlling operations, and its function based on shifting into Instruction (IR) and Data (DR) registers.
00:10:41 JTAG Read/Write Limitation: Key takeaway: JTAG inherently cannot perform a read without also writing, and vice-versa. Protocols built on JTAG must work around this.
00:10:58 JTAG Registers: Explains mandatory (Bypass) and common (ID Code) registers, noting that most data registers are target-specific.
00:12:52 ARM ADI v5 Introduction: Transitions to ARM's Debug Access Port Interface standard (version 5), commonly used in Cortex MCUs.
00:13:30 ARM DPACC & APACC: Details the JTAG registers used by ADI v5: Debug Port Access (DPACC) and Access Port (APACC). Explains the 35-bit transaction structure (R/W, Addr, Data).
00:15:47 ARM Read Buffer & Select Register: Explains the DPACC Read Buffer (address 3) as the workaround for JTAG's read/write coupling and the Select Register (address 2) used to choose the target Access Port (AP) and its internal register bank.
00:17:37 ARM MEM-AP (Memory Access Port): Describes the standard memory-mapped interface within an Access Port. Key registers: TAR (Target Address), DRW (Data Read/Write), CSW (Control/Status Word). This allows accessing the target's memory map.
00:20:15 MEM-AP Enables Full Debug: Key takeaway: Once MEM-AP access is established (via DPACC/APACC), all other debug functions (register R/W, halt, step, reset, breakpoints) are achieved by accessing specific memory-mapped addresses within the MEM-AP space. Crucially, MEM-AP allows memory access while the CPU is running.
00:23:43 SWD (Serial Wire Debug): Explains SWD as a 2-wire alternative to JTAG. It uses the same underlying ADI v5 DP/AP structure but packages commands more efficiently, often resulting in faster and more reliable communication.
00:25:01 Flash Programming Methods: Briefly covers two main ways to program flash via debug: 1) Debug software contains specific drivers for the target's flash controller. 2) A generic "Flash Algorithm" (code) is downloaded to the target's RAM and executed via the debugger.
00:26:38 RISC-V Debug Standard: Introduces the RISC-V approach, also often layered over JTAG. Uses DTMCS (Debug Transport Module Control/Status) and DMI (Debug Module Interface) JTAG registers.
00:27:55 RISC-V DMI Access: Details the DMI protocol over JTAG, using opcodes (Read/Write/Nop) within the JTAG data field to interact with the DMI address space. Nop (opcode 0) addresses the JTAG read/write limitation.
00:29:42 RISC-V Register Access (Abstract Command): Explains accessing General Purpose Registers (GPRs) using the Abstract Command, requiring a specific register encoding (ORed with 0x1000).
00:30:52 RISC-V Memory Access (Multiple Options): Key takeaway: RISC-V requires implementing at least one of three methods: Program Buffer (executing small code snippets), Abstract Access Memory (similar to register access but for RAM), or System Bus Access (SBA, allows access while CPU runs, similar to ARM MEM-AP, but optional). This optionality adds complexity for debugger implementers.
00:35:26 RISC-V Control & Status (CSRs): Explains that core debug status/control (halt, step, cause) resides in Control/Status Registers (CSRs), a separate address space accessed via Abstract Commands without the 0x1000 offset.
00:37:35 RISC-V CSR Access Optionality: Key takeaway: Direct CSR access via Abstract Commands is also optional. If not present, Program Buffer must be used instead (e.g., on Hazard3 core in RP2350).
00:39:18 RP2350 Innovation: RISC-V over SWD: Highlights the Raspberry Pi RP2350's clever use of ARM ADI v6. It maps the RISC-V DMI address space onto an ADI MEM-AP, allowing standard SWD probes and ARM debug protocols to communicate with the RISC-V debug module.
00:41:27 Further Learning & Conclusion: Mentions advanced topics not covered (hardware breakpoints, multi-drop SWD, protocol init/recovery, other protocols, tracing) and reiterates the goal of demystifying the wire-level communication.