You copied the Doc URL to your clipboard.

11.4.1. Debug Breakpoint Control Registers, EL1

The DBGBCRn_EL1characteristics are:

Purpose

Holds control information for a breakpoint. Each DBGBVR_EL1 is associated with a DBGBCR_EL1 to form a Breakpoint Register Pair (BRP). DBGBVRn_EL1 is associated with DBGBCRn_EL1 to form BRPn.

Note

The range of n for DBGBCRn_EL1 is 0 to 5.

Usage constraints

These registers are accessible as follows:

EL0

EL1

(NS)

EL1

(S)

EL2

EL3

(SCR.NS = 1)

EL3

(SCR.NS = 0)

-RWRWRWRWRW
Configurations

DBGBCRn_EL1 are architecturally mapped to:

  • The AArch32 DBGBCRn registers.

  • The external DBGBCRn_EL1 registers.

Attributes

See the register summary in Table 11.3.

The debug logic reset value of a DBGBCRn_EL1 is unknown.

Figure 11.2 shows the DBGBCRn_EL1 bit assignments.

Figure 11.2. DBGBCRn_EL1 bit assignments

Figure 11.2. DBGBCR

Table 11.4 shows the DBGBCRn_EL1 bit assignments.

Table 11.4. DBGBCRn_EL1 bit assignments
BitsNameFunction
[31:24]-

Reserved, res0.

[23:20]BT

Breakpoint Type. This field controls the behavior of Breakpoint debug event generation. This includes the meaning of the value held in the associated DBGBVR, indicating whether it is an instruction address match or mismatch or a Context match. It also controls whether the breakpoint is linked to another breakpoint. The possible values are:

0b0000

Unlinked instruction address match.

0b0001

Linked instruction address match.

0b0010

Unlinked ContextIDR match.

0b0011

Linked ContextIDR match.

0b0100

Unlinked instruction address mismatch.

0b0101

Linked instruction address mismatch.

0b1000

Unlinked VMID match.

0b1001

Linked VMID match.

0b1010

Unlinked VMID + CONTEXTIDR match.

0b1011

Linked VMID + CONTEXTIDR match.

All other values are reserved.

The field break down is:

  • BT[3:1]: Base type. If the breakpoint is not context-aware, these bits are res0. Otherwise, the possible values are:

    0b000

    Match address. DBGBVRn_EL1 is the address of an instruction.

    0b001

    Match context ID. DBGBVRn_EL1[31:0] is a context ID.

    0b010

    Address mismatch. Mismatch address. Behaves as type 0b000 if either:

    • In an AArch64 translation regime.

    • Halting debug-mode is enabled and halting is allowed.

    Otherwise, DBGBVRn_EL1 is the address of an instruction to be stepped.

    0b100

    Match VMID. DBGBVRn_EL1[39:32] is a VMID.

    0b101

    Match VMID and context ID. DBGBVRn_EL1[31:0] is a context ID, and DBGBVRn_EL1[39:32] is a VMID.

  • BT[0]: Enable linking.

[19:16]LBN

Linked breakpoint number. For Linked address matching breakpoints, this specifies the index of the Context-matching breakpoint linked to.

[15:14]SSC

Security State Control. Determines the security states that a breakpoint debug event for breakpoint n is generated.

This field must be interpreted with the Higher Mode Control (HMC), and Privileged Mode Control (PMC), fields to determine the mode and security states that can be tested.

See the ARM® Architecture Reference Manual ARMv8, for ARMv8-A architecture profile for possible values of the fields.

[13]HMC

Hyp Mode Control bit. Determines the debug perspective for deciding when a breakpoint debug event for breakpoint n is generated.

This bit must be interpreted with the SSC and PMC fields to determine the mode and security states that can be tested.

See the ARM® Architecture Reference Manual ARMv8, for ARMv8-A architecture profile for possible values of the fields.

[12:9]-

Reserved, res0.

[8:5]BAS[a]

Byte Address Select. Defines which half-words a regular breakpoint matches, regardless of the instruction set and execution state. A debugger must program this field as follows:

0x3

Match the T32 instruction at DBGBVRn.

0xC

Match the T32 instruction at DBGBVRn+2.

0xF

Match the A64 or A32 instruction at DBGBVRn, or context match.

All other values are reserved.

Note

The ARMv8-A architecture does not support direct execution of Java bytecodes. BAS[3] and BAS[1] ignore writes and on reads return the values of BAS[2] and BAS[0] respectively.

[4:3]-

Reserved, res0.

[2:1]PMC

Privileged Mode Control. Determines the exception level or levels that a breakpoint debug event for breakpoint n is generated.

This field must be interpreted with the SSC and HMC fields to determine the mode and security states that can be tested.

See the ARM® Architecture Reference Manual ARMv8, for ARMv8-A architecture profile for possible values of the fields.

Note

Bits[2:1] have no effect for accesses made in Hyp mode.

[0]E

Enable breakpoint. This bit enables the BRP:

0

BRP disabled.

1

BRP enabled.

A BRP never generates a breakpoint debug event when it is disabled.

Note

The value of DBGBCR.E is unknown on reset. A debugger must ensure that DBGBCR.E has a defined value before it programs DBGDSCR.MDBGen and DBGDSCR.HDBGen to enable debug.

[a] See the ARM® Architecture Reference Manual ARMv8, for ARMv8-A architecture profile for more information on how the BAS field is interpreted by hardware.


To access the DBGBCRn_EL1 in AArch64 Execution state, read or write the register with:

MRS <Xt>, DBGBCRn_EL1; Read Debug Breakpoint Control Register n
MSR DBGBCRn_EL1, <Xt>; Write Debug Breakpoint Control Register n

To access the DBGBCRn in AArch32 Execution state, read or write the CP14 register with:

MRC p14, 0, <Rt>, c0, cn, 4; Read Debug Breakpoint Control Register n
MCR p14, 0, <Rt>, c0, cn, 4; Write Debug Breakpoint Control Register n

The DBGBCRn_EL1 can be accessed through the internal memory-mapped interface and the external debug interface, offset 0x4n8.

Was this page helpful? Yes No