Im learning the debug progress to access memory system in a mcu
now i know how to read/write a register with a specific address
：write TAR and DRW in the AHB-AP
but how does AHB-AP read/write a core register like pc or sp which have no address
Take a look at the debug system registers in the ARMv7-M or ARMv8-M Architecture Reference Manual.
DCRSR (Debug Core Register Selector Register)
DCRDR (Debug Core Register Data Register)
Basically you select the register and operation (read/write) and start the transfer by writing to DCRSR. DCRDR holds the data to write or data read.
This was the first AP type to be introduced and was first used on Cortex-M based MCUs. The AHB-AP acts like a second memory interface to the system memory and debug registers of the CPU core. In this setup, the AHB-AP and the CPU core share the same 4 GB address space. This means, the debug registers are accessible via the debug interface as well as from the CPU core itself. official site