A.3 Armv8 Debug UNPREDICTABLE behaviors

This section describes the behavior that the Cortex®‑A76 core implements when:

  • A topic has multiple options.
  • The behavior differs from either or both of the Options and Preferences behaviors.

Note:

This section does not describe the behavior when a topic only has a single option and the core implements the preferred behavior.

Table A-1 Armv8 Debug unpredictable behaviors

Scenario Behavior
A32 BKPT instruction with condition code not AL

The core implements the following preferred option:

  • Executed unconditionally.
Address match breakpoint match only on second halfword of an instruction The core generates a breakpoint on the instruction if CPSR.IL=0. In the case of CPSR.IL=1, the core does not generate a breakpoint exception.
Address matching breakpoint on A32 instruction with DBGBCRn.BAS=1100

The core implements the following option:

  • Does match if CPSR.IL=0.
Address match breakpoint match on T32 instruction at DBGBCRn+2 with DBGBCRn.BAS=1111

The core implements the following option:

  • Does match.
Link to non-existent breakpoint or breakpoint that is not context-aware

The core implements the following option:

  • No Breakpoint or Watchpoint debug event is generated, and the LBN field of the linker reads unknown.
DBGWCRn_EL1.MASK!=00000 and DBGWCRn_EL1.BAS!=11111111

The core behaves as indicated in the sole Preference:

  • DBGWCRn_EL1.BAS is ignored and treated as if 0x11111111.
Address match breakpoint with DBGBCRn_EL1.BAS=0000

The core implements the following option:

  • As if disabled.
DBGWCRn_EL1.BAS specifies a non-contiguous set of bytes within a double-word

The core implements the following option:

  • A Watchpoint debug event is generated for each byte.
A32 HLT instruction with condition code not AL

The core implements the following option:

  • Executed unconditionally.
Execute instruction at a given EL when the corresponding EDECCR bit is 1 and Halting is allowed

The core behaves as follows:

  • Generates debug event and Halt no later than the instruction following the next Context Synchronization operation (CSO) excluding ISB instruction.
H > N or H = 0 at Non-secure EL1 and EL0, including value read from PMCR_EL0.N

The core implements:

  • A simple implementation where all of HPMN[4:0] are implemented, and In Non-secure EL1 and EL0:

    • If H > N then M = N.
    • If H = 0 then M = 0.
H > N or H = 0: value read back in MDCR_EL2.HPMN

The core implements:

  • A simple implementation where all of HPMN[4:0] are implemented and for reads of MDCR_EL2.HPMN, return H.
P ≥ M and P ≠ 31: reads and writes of PM XEVTYPER_EL0 and PMXEVCNTR_EL0

The core implements:

  • A simple implementation where all of SEL[4:0] are implemented, and if P ≥ M and P ≠ 31 then the register is res0.
P ≥ M and P ≠ 31: value read in PMSELR_EL0.SEL

The core implements:

  • A simple implementation where all of SEL[4:0] are implemented, and if P ≥ M and P ≠ 31 then the register is res0.
P = 31: reads and writes of PMXEVCNTR_EL0

The core implements:

  • res0.
n ≥ M: Direct access to PMEVCNTRn_EL0 and PMEVTYPERn_EL0

The core implements:

  • If n ≥ N, then the instruction is unallocated.
  • Otherwise if n ≥ M, then the register is res0.
Exiting Debug state while instruction issued through EDITR is in flight

The core implements the following option:

  • The instruction completes in Debug state before executing the restart.
Using memory-access mode with a non-word-aligned address

The core behaves as indicated in the sole Preference:

  • Does unaligned accesses, faulting if these are not permitted for the memory type.
Access to memory-mapped registers mapped to Normal memory

The core behaves as indicated in the sole Preference:

  • The access is generated, and accesses might be repeated, gathered, split or resized, in accordance with the rules for Normal memory, meaning the effect is unpredictable.

Not word-sized accesses or (AArch64 only) doubleword-sized accesses

>

The core behaves as indicated in the sole Preference:

  • Reads occur and return unknown data.
  • Writes set the accessed register(s) to unknown.
External debug write to register that is being reset

The core behaves as indicated in the sole Preference:

  • Takes reset value.
Accessing reserved debug registers

The core deviates from preferred behavior because the hardware cost to decode some of these addresses in debug power domain is significantly high.

The actual behavior is:

  1. For reserved debug registers in the address range 0x000-0xCFC and Performance Monitors registers in the address range 0x000, the response is either constrained unpredictable Error or res0 when any of the following errors occurs:
    Off
    The core power domain is either completely off or in a low-power state where the core power domain registers cannot be accessed.
    DLK
    DoubleLockStatus() is TRUE and OS double-lock is locked (EDPRSR.DLK is 1).
    OSLK
    OS lock is locked (OSLSR_EL1.OSLK is 1).
  2. For reserved debug registers in the address ranges 0x400-0x4FC and 0x800-0x8FC, the response is constrained unpredictable Error or res0 when the conditions in 1 do not apply and the following error occurs:
    EDAD
    AllowExternalDebugAccess() is FALSE. External debug access is disabled.
  3. For reserved Performance Monitor registers in the address ranges 0x000-0x0FC and 0x400-0x47C, the response is either constrained unpredictable Error, or res0 when the conditions in 1 and 2 do not apply, and the following error occurs:
    EPMAD
    AllowExternalPMUAccess() is FALSE. External Performance Monitors access is disabled.
Clearing the clear-after-read EDPRSR bits when Core power domain is on, and DoubleLockStatus() is TRUE

The core behaves as indicated in the sole Preference:

  • Bits are not cleared to zero.

Non-ConfidentialPDF file icon PDF version100798_0400_00_en
Copyright © 2016–2019 Arm Limited or its affiliates. All rights reserved.