Nordic's nRF54LM20 hides a RISC-V core behind a debug access port
What's on That Access Port?
Daniel Mangum digs into the debug architecture of Nordic Semiconductor's nRF54LM20, which pairs a Cortex-M33 application core with a RISC-V FLPR coprocessor. Using J-Link's low-level ReadDP and WriteDP commands, he manually walks the Debug Access Port map, decoding each AP's identification register: two AHB-APs and a Nordic CTRL-AP, with a fourth read returning zero. The exercise shows how debuggers quietly discover cores, and why the J-Link skips the scan for the RISC-V side.
If there is no AP with the ID APSEL, all AP transactions return zero on reads and are ignored on writes.