SPRUJF2A March 2026 – March 2026 AM13E23019
The DEBUGSS supports several methods for restricting access to the device through the SWD/JTAG interface. The debug access policy is determined by the user configuration specified in the NONMAIN flash region.
There are 4 levels of access control, given in Table 33-5. By default, products shipped from TI arrive in a "Debug Enabled" state where the device is fully open. This state is not recommended for production. For production, TI recommends changing the debug configuration to password protected, debug disabled, or SWD/JTAG disabled.
| DEBUGSS Function | Debug Configuration | |||
|---|---|---|---|---|
| Debug Enabled (default) | Debug Enabled with Password | Debug Disabled | SWD/JTAG Disabled | |
| SWJ-DP (debug port) | EN | EN | EN | DIS |
| CFG-AP | EN | EN | EN | DIS |
| SEC-AP | EN | EN | EN | DIS |
| ET-AP | EN | EN w/ Password | DIS | DIS |
| AHB-AP (CPU Debug) | EN | EN w/ Password | DIS | DIS |
The debug access control can be configured by writing predefined values into the NONMAIN BOOTCFG0.
| Debug Configuration | SWJDP_MODE | DEBUGACCESS |
|---|---|---|
| Debug Enabled (default) | AABBh | AABBh |
| Debug Enabled with Password | AABBh | CCDDh |
| Debug Disabled | AABBh | 5566h |
| SWD Disabled | 5566h | 5566h |
When debug is set to enabled with password, the debug access command together with the user-specified debug access password must be provided to the DEBUGSS mailbox, and a BOOTRST must be issued. The password for access control is stored in NONMAIN utilizing the PWDDEBUGLOCK registers. On AM13E230x devices, the password can either be:
When debug is disabled, the SWJ-DP is disabled during the boot process and any commands previously sent to the mailbox are ignored during boot. Following boot, any attempt to connect to the SWJ-DP is ignored.
Permanently lock debug access to the device by configuring the NONMAIN flash region to disable debug access while also configuring the NONMAIN flash region as statically write protected (locked). Locking the NONMAIN configuration has the added security of preventing the bootstrap loader (BSL) and application code from changing the debug security policy.
| Debug Function | Debug Access Control | Factory Reset | Mass Erase |
|---|---|---|---|
| Register Name | PWDDEBUGLOCK | PWDFACTORYRESET | PWDMASSERASE |
To enable a password on a debug function write a 128-bit hex value split into four 32-bit words into the respective password register.
Example: Factory Reset Password Configuration