The access port protection mechanisms can be temporarily disabled to debug the device.
The disabling of the access port protection is done through a combination of UICR and CTRL-AP registers.
Disabling non-secure access port protection
If UICR.APPROTECT has been enabled from UICR, the device access port is protected.
If UICR.APPROTECT has not been enabled from UICR, both the debugger and on-chip firmware must write the same non-zero 32-bit KEY value into their respective registers CTRLAP.APPROTECT.DISABLE (CPU-side) and CTRLAP.APPROTECT.DISABLE (debugger-side) to disable the access port protection to non-secure mode.
The write-once register APPROTECT.LOCK should be set to Locked as early as possible in the start-up sequence. Once written, it will not be possible to remove the non-secure mode access port protection until next reset.
Disabling secure access port protection
If UICR.APPROTECT has been enabled from UICR, the device access port is protected.
If UICR.SECUREAPPROTECT has not been enabled from UICR, both the debugger and on-chip firmware must write the same non-zero 32-bit KEY value into their respective registers CTRLAP.SECUREAPPROTECT.DISABLE (CPU-side) and CTRLAP.SECUREAPPROTECT.DISABLE (debugger-side) to disable the access port protection to secure mode.
The write-once register SECUREAPPROTECT.LOCK should be set to Locked as early as possible in the start-up sequence, preferably as soon as on-chip firmware has determined it does not need to communicate with a debugger over the CTRL-AP mailbox interface. Once written, it will not be possible to remove the secure mode access port protection until next reset.
The CTRLAP.APPROTECT.DISABLE and CTRLAP.SECUREAPPROTECT.DISABLE registers are only reset by pin reset, brown-out reset, or watchdog timer reset. This allows keeping the debug session active through soft resets.
After an ERASEALL sequence has completed, the access port protection of the core's AHB-AP is disabled until the next pin reset, power-on reset, brown-out reset, or watchdog timer reset. This will allow initial firmware to be written. For more details on ERASEALL, see Erase all.
Access port protection status
The debugger can read the access port protection status in the core's AHB-AP, using the Arm® AHB-AP Control/Status Word register (CSW), defined in the Arm CoreSight™ SoC-400 Technical Reference Manual, Revision r3p2. The DbgStatus field indicates that the AHB-AP can perform AHB transfers, while the SPIStatus indicates if secure AHB transfers are permitted. For a list of all debug access ports, see DAP — Debug access port.