当 CPU 对 state 的 4 字节存储发生时
  -> 记录命中发生在哪条指令
  -> 检查调用者、写入值和对象所有权
  -> 判断这次写入是否合法

当 CPU 即将执行 error_path 对应的机器指令时
  -> 暂停
  -> 检查参数、返回码和调用路径

目标源位置
  -> 由 ELF（Executable and Linkable Format，可执行与可链接格式）
     和 DWARF（调试信息格式）解析为一个或多个机器指令地址
  -> 调试服务器选择硬件比较器或软件断点机制
  -> CPU 取指满足条件
  -> 进入调试暂停
  -> 调试器读取 PC、寄存器、栈和应用对象

对象符号
  -> 解析运行地址、宽度和对齐
  -> 注入 read/write/access 条件
  -> CPU 发出数据访问
  -> DWT 比较器匹配
  -> 报告事件或暂停
  -> 检查命中指令、写入者、旧值/新值和所有权

精确数据观察点不可用
  -> 将所有合法写入收敛到一个函数，在入口设断点
  -> 仍过于频繁时，加入有界软件条件和事件计数
  -> 需要连续时间线时，转向 ITM/SWO/ETM trace
  -> 需要外部时序时，转向逻辑分析仪/示波器

HSI = 16 MHz
  -> PLLM = 16，PLL 输入 = 1 MHz
  -> PLLN = 336，VCO = 336 MHz
  -> PLLP = 2，SYSCLK = 168 MHz
  -> AHB HPRE = /1，HCLK = 168 MHz
  -> APB1 PPRE1 = /4，PCLK1 = 42 MHz
  -> APB1 预分频不为 1，TIM2CLK = 2 * PCLK1 = 84 MHz
  -> RCC_APB1ENR.TIM2EN = 1
  -> PSC = 8399，计数 tick = 84 MHz / (8399 + 1) = 10 kHz
  -> ARR = 9，update = 10 kHz / (9 + 1) = 1 kHz
  -> DIER.UIE = 1，NVIC 允许 TIM2_IRQn
  -> update -> UIF -> TIM2_IRQHandler -> HAL_TIM_IRQHandler
  -> HAL_TIM_PeriodElapsedCallback -> DebugTarget_RecordTim2Tick

POR/system reset
  -> HAL_Init
  -> HSI/PLL 与 Flash latency
  -> SYSCLK/HCLK/PCLK1
  -> TIM2 BSP 独占外设时，置位再释放 RCC_APB1RSTR.TIM2RST
  -> RCC_APB1ENR.TIM2EN = 1
  -> HAL_TIM_Base_Init 写 PSC/ARR/CR1 并产生更新装载
  -> 清理待决状态并启用 TIM2 IRQ
  -> HAL_TIM_Base_Start_IT 使能 update interrupt 与计数器

SWD 连接
  -> 调试服务器分配 FPB/DWT 资源
  -> 指令或数据访问命中
  -> Cortex-M4 core halt
  -> DBGMCU_APB1_FZ.DBG_TIM2_STOP 决定 TIM2 继续或冻结
  -> 恢复后处理待决事件

HAL_Init
  -> BspClock_Config168MhzFromHsi
  -> AppDebugTarget_Init
  -> BspTim2_Init
  -> 明确设置 TIM2 freeze policy
  -> 安装调试触发条件
  -> BspTim2_Start

host/
  debug_trigger_fake.h   # 声明：类型、固定宽度接口、容量
  debug_trigger_fake.c   # 实现：匹配、暂停、资源与错误路径
  test_debug_trigger.c   # 实例化、组装和使用：场景断言

#ifndef DEBUG_TRIGGER_FAKE_H
#define DEBUG_TRIGGER_FAKE_H

#include <stdint.h>

#define DEBUG_FAKE_SLOT_COUNT       2u

#define DEBUG_OK                    0u
#define DEBUG_ERR_ARGUMENT          1u
#define DEBUG_ERR_RESOURCE          2u
#define DEBUG_ERR_PAUSED            3u
#define DEBUG_ERR_SOURCE_BLOCKED    4u

#define DEBUG_TRIGGER_BREAKPOINT    1u
#define DEBUG_TRIGGER_WATCH_WRITE   2u

#define DEBUG_ACCESS_EXECUTE        1u
#define DEBUG_ACCESS_WRITE          2u

#define DEBUG_LOCATION_WORK         0x1001u
#define DEBUG_LOCATION_ERROR        0x1002u
#define DEBUG_OBJECT_DIAGNOSTIC     0x2001u
#define DEBUG_OBJECT_OTHER          0x2002u

typedef struct {
    uint32_t kind;
    uint32_t target;
    uint32_t width_bytes;
    uint32_t access;
} debug_trigger_spec_t;

typedef struct {
    uint32_t valid;
    uint32_t kind;
    uint32_t slot;
    uint32_t target;
    uint32_t access;
    uint32_t writer_id;
    uint32_t value_before;
    uint32_t value_after;
    uint32_t hit_sequence;
} debug_hit_t;

typedef struct {
    debug_trigger_spec_t slots[DEBUG_FAKE_SLOT_COUNT];
    uint8_t slot_used[DEBUG_FAKE_SLOT_COUNT];
    uint8_t paused;
    uint8_t source_ready;
    uint8_t reserved;
    uint32_t pc;
    uint32_t diagnostic_state;
    uint32_t other_state;
    uint32_t executed_steps;
    uint32_t hit_count;
    debug_hit_t last_hit;
} debug_fake_t;

void DebugFake_Init(debug_fake_t *self);
void DebugFake_SetSourceReady(debug_fake_t *self, uint32_t ready);
uint32_t DebugFake_Install(debug_fake_t *self,
                           const debug_trigger_spec_t *spec,
                           uint32_t *slot_out);
uint32_t DebugFake_Step(debug_fake_t *self, uint32_t location);
uint32_t DebugFake_Write(debug_fake_t *self,
                         uint32_t object_id,
                         uint32_t width_bytes,
                         uint32_t writer_id,
                         uint32_t value);
uint32_t DebugFake_Resume(debug_fake_t *self);

#endif

#include "debug_trigger_fake.h"

#include <stddef.h>
#include <string.h>

static uint32_t DebugFake_SpecIsValid(const debug_trigger_spec_t *spec)
{
    if ((spec == NULL) || (spec->target == 0u) ||
        (spec->width_bytes != 4u)) {
        return 0u;
    }

    if ((spec->kind == DEBUG_TRIGGER_BREAKPOINT) &&
        (spec->access == DEBUG_ACCESS_EXECUTE)) {
        return 1u;
    }

    if ((spec->kind == DEBUG_TRIGGER_WATCH_WRITE) &&
        (spec->access == DEBUG_ACCESS_WRITE)) {
        return 1u;
    }

    return 0u;
}

static void DebugFake_RecordHit(debug_fake_t *self,
                                uint32_t slot,
                                const debug_trigger_spec_t *spec,
                                uint32_t writer_id,
                                uint32_t before,
                                uint32_t after)
{
    self->hit_count++;
    self->paused = 1u;
    self->last_hit.valid = 1u;
    self->last_hit.kind = spec->kind;
    self->last_hit.slot = slot;
    self->last_hit.target = spec->target;
    self->last_hit.access = spec->access;
    self->last_hit.writer_id = writer_id;
    self->last_hit.value_before = before;
    self->last_hit.value_after = after;
    self->last_hit.hit_sequence = self->hit_count;
}

void DebugFake_Init(debug_fake_t *self)
{
    if (self != NULL) {
        (void)memset(self, 0, sizeof(*self));
    }
}

void DebugFake_SetSourceReady(debug_fake_t *self, uint32_t ready)
{
    if (self != NULL) {
        self->source_ready = (ready != 0u) ? 1u : 0u;
    }
}

uint32_t DebugFake_Install(debug_fake_t *self,
                           const debug_trigger_spec_t *spec,
                           uint32_t *slot_out)
{
    uint32_t slot;

    if ((self == NULL) || (slot_out == NULL) ||
        (DebugFake_SpecIsValid(spec) == 0u)) {
        return DEBUG_ERR_ARGUMENT;
    }

    for (slot = 0u; slot < DEBUG_FAKE_SLOT_COUNT; ++slot) {
        if (self->slot_used[slot] == 0u) {
            self->slots[slot] = *spec;
            self->slot_used[slot] = 1u;
            *slot_out = slot;
            return DEBUG_OK;
        }
    }

    return DEBUG_ERR_RESOURCE;
}

uint32_t DebugFake_Step(debug_fake_t *self, uint32_t location)
{
    uint32_t slot;

    if ((self == NULL) || (location == 0u)) {
        return DEBUG_ERR_ARGUMENT;
    }
    if (self->paused != 0u) {
        return DEBUG_ERR_PAUSED;
    }

    self->pc = location;
    self->executed_steps++;

    for (slot = 0u; slot < DEBUG_FAKE_SLOT_COUNT; ++slot) {
        const debug_trigger_spec_t *spec = &self->slots[slot];
        if ((self->slot_used[slot] != 0u) &&
            (spec->kind == DEBUG_TRIGGER_BREAKPOINT) &&
            (spec->target == location)) {
            DebugFake_RecordHit(self, slot, spec, 0u,
                                self->diagnostic_state,
                                self->diagnostic_state);
            break;
        }
    }

    return DEBUG_OK;
}

uint32_t DebugFake_Write(debug_fake_t *self,
                         uint32_t object_id,
                         uint32_t width_bytes,
                         uint32_t writer_id,
                         uint32_t value)
{
    uint32_t *object;
    uint32_t before;
    uint32_t slot;

    if ((self == NULL) || (writer_id == 0u) || (width_bytes != 4u)) {
        return DEBUG_ERR_ARGUMENT;
    }
    if (self->paused != 0u) {
        return DEBUG_ERR_PAUSED;
    }
    if (self->source_ready == 0u) {
        return DEBUG_ERR_SOURCE_BLOCKED;
    }

    if (object_id == DEBUG_OBJECT_DIAGNOSTIC) {
        object = &self->diagnostic_state;
    } else if (object_id == DEBUG_OBJECT_OTHER) {
        object = &self->other_state;
    } else {
        return DEBUG_ERR_ARGUMENT;
    }

    before = *object;
    *object = value;

    for (slot = 0u; slot < DEBUG_FAKE_SLOT_COUNT; ++slot) {
        const debug_trigger_spec_t *spec = &self->slots[slot];
        if ((self->slot_used[slot] != 0u) &&
            (spec->kind == DEBUG_TRIGGER_WATCH_WRITE) &&
            (spec->target == object_id) &&
            (spec->width_bytes == width_bytes)) {
            DebugFake_RecordHit(self, slot, spec, writer_id, before, value);
            break;
        }
    }

    return DEBUG_OK;
}

uint32_t DebugFake_Resume(debug_fake_t *self)
{
    if ((self == NULL) || (self->paused == 0u)) {
        return DEBUG_ERR_ARGUMENT;
    }
    self->paused = 0u;
    return DEBUG_OK;
}

#include "debug_trigger_fake.h"

#include <stdio.h>

static uint32_t s_checks;

#define CHECK(expr) do {                                      \
    s_checks++;                                               \
    if (!(expr)) {                                            \
        (void)printf("check failed at line %u\n",             \
                     (unsigned)__LINE__);                     \
        return 1;                                             \
    }                                                         \
} while (0)

int main(void)
{
    debug_fake_t fake;
    debug_trigger_spec_t breakpoint_spec = {
        DEBUG_TRIGGER_BREAKPOINT,
        DEBUG_LOCATION_ERROR,
        4u,
        DEBUG_ACCESS_EXECUTE
    };
    debug_trigger_spec_t watch_spec = {
        DEBUG_TRIGGER_WATCH_WRITE,
        DEBUG_OBJECT_DIAGNOSTIC,
        4u,
        DEBUG_ACCESS_WRITE
    };
    debug_trigger_spec_t extra_spec = {
        DEBUG_TRIGGER_BREAKPOINT,
        DEBUG_LOCATION_WORK,
        4u,
        DEBUG_ACCESS_EXECUTE
    };
    debug_trigger_spec_t invalid_spec = {
        DEBUG_TRIGGER_WATCH_WRITE,
        DEBUG_OBJECT_DIAGNOSTIC,
        0u,
        DEBUG_ACCESS_WRITE
    };
    uint32_t slot0 = 99u;
    uint32_t slot1 = 99u;
    uint32_t step_count_at_hit;

    DebugFake_Init(&fake);
    CHECK(DebugFake_Install(&fake, &invalid_spec, &slot0) ==
          DEBUG_ERR_ARGUMENT);
    CHECK(DebugFake_Install(&fake, &breakpoint_spec, &slot0) == DEBUG_OK);
    CHECK(DebugFake_Install(&fake, &watch_spec, &slot1) == DEBUG_OK);
    CHECK((slot0 == 0u) && (slot1 == 1u));
    CHECK(DebugFake_Install(&fake, &extra_spec, &slot0) ==
          DEBUG_ERR_RESOURCE);

    CHECK(DebugFake_Step(&fake, DEBUG_LOCATION_WORK) == DEBUG_OK);
    CHECK((fake.paused == 0u) && (fake.hit_count == 0u));
    CHECK(DebugFake_Step(&fake, DEBUG_LOCATION_ERROR) == DEBUG_OK);
    CHECK((fake.paused != 0u) &&
          (fake.last_hit.kind == DEBUG_TRIGGER_BREAKPOINT));
    CHECK(fake.last_hit.target == DEBUG_LOCATION_ERROR);

    step_count_at_hit = fake.executed_steps;
    CHECK(DebugFake_Step(&fake, DEBUG_LOCATION_WORK) == DEBUG_ERR_PAUSED);
    CHECK(fake.executed_steps == step_count_at_hit);
    CHECK(DebugFake_Resume(&fake) == DEBUG_OK);

    CHECK(DebugFake_Write(&fake, DEBUG_OBJECT_DIAGNOSTIC,
                          4u, 7u, 1u) == DEBUG_ERR_SOURCE_BLOCKED);
    CHECK(fake.diagnostic_state == 0u);
    DebugFake_SetSourceReady(&fake, 1u);

    CHECK(DebugFake_Write(&fake, DEBUG_OBJECT_OTHER,
                          4u, 8u, 10u) == DEBUG_OK);
    CHECK(fake.paused == 0u);
    CHECK(DebugFake_Write(&fake, DEBUG_OBJECT_DIAGNOSTIC,
                          4u, 7u, 1u) == DEBUG_OK);
    CHECK((fake.paused != 0u) &&
          (fake.last_hit.kind == DEBUG_TRIGGER_WATCH_WRITE));
    CHECK((fake.last_hit.writer_id == 7u) &&
          (fake.last_hit.value_before == 0u) &&
          (fake.last_hit.value_after == 1u));
    CHECK(fake.last_hit.hit_sequence == 2u);

    (void)printf("debug_trigger_fake: %u checks passed\n",
                 (unsigned)s_checks);
    return 0;
}

cc -std=c11 -Wall -Wextra -Wpedantic -Werror \
  debug_trigger_fake.c test_debug_trigger.c -o debug_trigger_fake
./debug_trigger_fake

/* app_debug_target.h */
#ifndef APP_DEBUG_TARGET_H
#define APP_DEBUG_TARGET_H

#include <stdint.h>

#define DEBUG_WRITER_NONE          0u
#define DEBUG_WRITER_TIM2_CALLBACK 1u
#define DEBUG_ERROR_NONE           0u

typedef struct {
    uint32_t tim2_ticks;
    uint32_t callback_sequence;
    uint32_t last_writer_id;
    uint32_t last_error_code;
} debug_target_state_t;

extern volatile debug_target_state_t g_debug_target_state;

void AppDebugTarget_Init(void);
void DebugTarget_RecordTim2Tick(uint32_t writer_id);
void DebugTarget_RecordError(uint32_t error_code);

#endif

/* app_debug_target.c */
#include "app_debug_target.h"

volatile debug_target_state_t g_debug_target_state;

void AppDebugTarget_Init(void)
{
    g_debug_target_state.tim2_ticks = 0u;
    g_debug_target_state.callback_sequence = 0u;
    g_debug_target_state.last_writer_id = DEBUG_WRITER_NONE;
    g_debug_target_state.last_error_code = DEBUG_ERROR_NONE;
}

void DebugTarget_RecordTim2Tick(uint32_t writer_id)
{
    g_debug_target_state.last_writer_id = writer_id;
    g_debug_target_state.tim2_ticks++;
    g_debug_target_state.callback_sequence++;
}

void DebugTarget_RecordError(uint32_t error_code)
{
    g_debug_target_state.last_error_code = error_code;
}

#include "stm32f4xx_hal.h"
#include <stdint.h>

#define BSP_OK          0u
#define BSP_ERR_CLOCK   1u

uint32_t BspClock_Config168MhzFromHsi(void)
{
    RCC_OscInitTypeDef osc = {0};
    RCC_ClkInitTypeDef clk = {0};

    __HAL_RCC_PWR_CLK_ENABLE();
    __HAL_PWR_VOLTAGESCALING_CONFIG(PWR_REGULATOR_VOLTAGE_SCALE1);

    osc.OscillatorType = RCC_OSCILLATORTYPE_HSI;
    osc.HSIState = RCC_HSI_ON;
    osc.HSICalibrationValue = RCC_HSICALIBRATION_DEFAULT;
    osc.PLL.PLLState = RCC_PLL_ON;
    osc.PLL.PLLSource = RCC_PLLSOURCE_HSI;
    osc.PLL.PLLM = 16u;
    osc.PLL.PLLN = 336u;
    osc.PLL.PLLP = RCC_PLLP_DIV2;
    osc.PLL.PLLQ = 7u;
    if (HAL_RCC_OscConfig(&osc) != HAL_OK) {
        return BSP_ERR_CLOCK;
    }

    clk.ClockType = RCC_CLOCKTYPE_SYSCLK |
                    RCC_CLOCKTYPE_HCLK |
                    RCC_CLOCKTYPE_PCLK1 |
                    RCC_CLOCKTYPE_PCLK2;
    clk.SYSCLKSource = RCC_SYSCLKSOURCE_PLLCLK;
    clk.AHBCLKDivider = RCC_SYSCLK_DIV1;
    clk.APB1CLKDivider = RCC_HCLK_DIV4;
    clk.APB2CLKDivider = RCC_HCLK_DIV2;

    if (HAL_RCC_ClockConfig(&clk, FLASH_LATENCY_5) != HAL_OK) {
        return BSP_ERR_CLOCK;
    }

    return BSP_OK;
}

/* bsp_tim2.h */
#ifndef BSP_TIM2_H
#define BSP_TIM2_H

#include <stdint.h>

#define BSP_TIM2_OK             0u
#define BSP_TIM2_ERR_INIT       1u
#define BSP_TIM2_ERR_START      2u
#define BSP_TIM2_ERR_HAL        3u

uint32_t BspTim2_Init(void);
uint32_t BspTim2_Start(void);
void BspTim2_SetFreezePolicy(uint32_t freeze_when_core_halts);
void BspTim2_IrqHandler(void);

#endif

/* bsp_tim2.c */
#include "bsp_tim2.h"
#include "app_debug_target.h"
#include "stm32f4xx_hal.h"

static TIM_HandleTypeDef s_tim2;

uint32_t BspTim2_Init(void)
{
    s_tim2.Instance = TIM2;
    s_tim2.Init.Prescaler = 8399u;
    s_tim2.Init.CounterMode = TIM_COUNTERMODE_UP;
    s_tim2.Init.Period = 9u;
    s_tim2.Init.ClockDivision = TIM_CLOCKDIVISION_DIV1;
    s_tim2.Init.AutoReloadPreload = TIM_AUTORELOAD_PRELOAD_DISABLE;

    if (HAL_TIM_Base_Init(&s_tim2) != HAL_OK) {
        return BSP_TIM2_ERR_INIT;
    }
    return BSP_TIM2_OK;
}

uint32_t BspTim2_Start(void)
{
    if (HAL_TIM_Base_Start_IT(&s_tim2) != HAL_OK) {
        return BSP_TIM2_ERR_START;
    }
    return BSP_TIM2_OK;
}

void BspTim2_SetFreezePolicy(uint32_t freeze_when_core_halts)
{
    if (freeze_when_core_halts != 0u) {
        __HAL_DBGMCU_FREEZE_TIM2();
    } else {
        __HAL_DBGMCU_UNFREEZE_TIM2();
    }
}

void BspTim2_IrqHandler(void)
{
    HAL_TIM_IRQHandler(&s_tim2);
}

void HAL_TIM_Base_MspInit(TIM_HandleTypeDef *htim)
{
    if ((htim != NULL) && (htim->Instance == TIM2)) {
        /* Startup-only: this BSP is the sole TIM2 owner. */
        __HAL_RCC_TIM2_FORCE_RESET();
        __HAL_RCC_TIM2_RELEASE_RESET();
        __HAL_RCC_TIM2_CLK_ENABLE();
        HAL_NVIC_SetPriority(TIM2_IRQn, 5u, 0u);
        HAL_NVIC_EnableIRQ(TIM2_IRQn);
    }
}

void HAL_TIM_PeriodElapsedCallback(TIM_HandleTypeDef *htim)
{
    if ((htim != NULL) && (htim->Instance == TIM2)) {
        DebugTarget_RecordTim2Tick(DEBUG_WRITER_TIM2_CALLBACK);
    }
}

void HAL_TIM_ErrorCallback(TIM_HandleTypeDef *htim)
{
    if ((htim != NULL) && (htim->Instance == TIM2)) {
        DebugTarget_RecordError((uint32_t)htim->ErrorCode);
    }
}

/* stm32f4xx_it.c */
#include "bsp_tim2.h"

void TIM2_IRQHandler(void)
{
    BspTim2_IrqHandler();
}

/* main.c */
#include "app_debug_target.h"
#include "bsp_tim2.h"
#include "stm32f4xx_hal.h"
#include <stdint.h>

#define APP_ERR_CLOCK  0x1001u
#define APP_ERR_TIM2   0x1002u
#define APP_ERR_START  0x1003u

uint32_t BspClock_Config168MhzFromHsi(void);

static void Error_Handler(uint32_t code)
{
    DebugTarget_RecordError(code);
    __disable_irq();
    for (;;) {
        /* Set an instruction breakpoint here; no blocking I/O in the path. */
    }
}

int main(void)
{
    HAL_Init();

    if (BspClock_Config168MhzFromHsi() != 0u) {
        Error_Handler(APP_ERR_CLOCK);
    }

    AppDebugTarget_Init();
    if (BspTim2_Init() != BSP_TIM2_OK) {
        Error_Handler(APP_ERR_TIM2);
    }

    /* Experiment A: 1 freezes TIM2; Experiment B: 0 lets TIM2 continue. */
    BspTim2_SetFreezePolicy(1u);

    /* Install debugger-side breakpoint/watchpoint before this call. */
    if (BspTim2_Start() != BSP_TIM2_OK) {
        Error_Handler(APP_ERR_START);
    }

    for (;;) {
        __WFI();
    }
}

void DMA2_Stream0_IRQHandler(void)
{
    HAL_DMA_IRQHandler(hadc1.DMA_Handle);
}

void HAL_ADC_ConvHalfCpltCallback(ADC_HandleTypeDef *hadc)
{
    if ((hadc != NULL) && (hadc->Instance == ADC1)) {
        DebugTarget_RecordDmaEvent(DEBUG_EVENT_DMA_HALF);
    }
}

void HAL_ADC_ConvCpltCallback(ADC_HandleTypeDef *hadc)
{
    if ((hadc != NULL) && (hadc->Instance == ADC1)) {
        DebugTarget_RecordDmaEvent(DEBUG_EVENT_DMA_FULL);
    }
}

void HAL_ADC_ErrorCallback(ADC_HandleTypeDef *hadc)
{
    if ((hadc != NULL) && (hadc->Instance == ADC1)) {
        DebugTarget_RecordError((uint32_t)HAL_ADC_GetError(hadc));
    }
}

TIM2 1 kHz update
  -> TIM2_IRQHandler
  -> HAL_TIM_IRQHandler
  -> HAL_TIM_PeriodElapsedCallback
  -> DebugTarget_RecordTim2Tick
  -> g_debug_target_state.tim2_ticks++

BP0:
  target = DebugTarget_RecordTim2Tick entry instruction
  expect caller = HAL_TIM_PeriodElapsedCallback
  allowed conclusion = control flow reached this entry once

WP0:
  target = g_debug_target_state.tim2_ticks
  size = 4 bytes
  access = write
  legal writer = DebugTarget_RecordTim2Tick
  allowed conclusion = one matching CPU write occurred

先定义问题与触发条件
  -> 从当前 ELF 解析真实地址
  -> 申请并记录有限调试资源
  -> 命中后只采集预定现场
  -> 标注核心/外设暂停边界
  -> 恢复并采集独立的自由运行证据
  -> 只作证据允许的结论