19.6.9 Debugger Security

The DSU provides Debug Access Level (DAL) mechanism which disable or limit the debugger access into the device. The DAL settings are programed through the fuse configuration bits provided by the device.

The DSU DAL feature provides three levels of access as provided in the table below:

Table 19-1. Debugger Access Level Through DAP
DAL Setting	DSU Address Space		System Memory Regions ⁽¹⁾		Hot Plugging⁽³⁾	Cold Plugging
DAL Setting	External	Internal	Secure⁽²⁾	Non-Secure	Hot Plugging⁽³⁾	Cold Plugging
DAL 0	X	-	-	-	-	X
DAL 1⁽¹⁾⁽²⁾	X	-	-	X	X	X
DAL 2	X	X	X	X	X	X
Note: Only available on SG devices. Secure requests are converted to non-secure request in the CPU. Only available on TrustZone devices. Refer to the section on hot-plugging for further restrictions on availability of hot-plugging.

If the debugger attempts to access a device region which is not permitted by the current DAL setting, a bus error is returned to the CoreSight AP hardware which results in the assertion of the Arm DP sticky error bit.

In DAL0 mode, debugger breakpoints are disabled.