10.4.2. Debug Watchpoint Control Registers, EL1

The DBGWCRn_EL1characteristics are:

Purpose

Holds control information for a watchpoint. Each DBGWCR_EL1 is associated with a DBGWVR_EL1 to form a Watchpoint Register Pair (WRP). DBGWCRn_EL1 is associated with DBGWVRn_EL1 to form WRPn.

Note

The range of n for DBGBCRn_EL1is 0 to 3.

Usage constraints

The accessibility to the DBGWCRn_EL1 by Exception level is:

EL0EL1(NS)EL1(S)EL2EL3(SCR.NS = 1)EL3(SCR.NS = 0)
-RWRWRWRWRW

The external debug accessibility to the DBGWCRn_EL1 by condition code is:

OffDLKOSLKEDADSLKDefault
ErrorErrorErrorErrorRORW

Table 10.1 describes the access conditions.

Configurations

The DBGWCRn_EL1 is Common to Secure and Non-secure states and architecturally mapped to:

  • The AArch32 DBGWCRn registers.

  • The external DBGWCRn_EL1 registers.

Attributes

See the register summary in Table 10.3.

The debug logic reset value of a DBGWCR_EL1 is unknown.

Figure 10.3 shows the DBGWCRn_EL1 bit assignments.

Figure 10.3. DBGWCRn_EL1 bit assignments

To view this graphic, your browser must support the SVG format. Either install a browser with native support, or install an appropriate plugin such as Adobe SVG Viewer.


Table 10.5 shows the DBGWCRn_EL1 bit assignments.

Table 10.5. DBGWCRn_EL1 bit assignments

BitsNameFunction
[31:29]-

Reserved, res0.

[28:24]MASK

Address range mask. The processor supports watchpoint address range masking. This field can set a watchpoint on a range of addresses by masking lower order address bits out of the watchpoint comparison. The value of this field is the number of low order bits of the address that are masked off, except that values of 1 and 2 are reserved.

See the ARM® Architecture Reference Manual ARMv8 for the meanings of watchpoint address range mask values.

[23:21]-

Reserved, res0.

[20]WT

Watchpoint Type. This bit is set to 1 to link the watchpoint to a breakpoint to create a linked watchpoint that requires both data address matching and Context matching:

0

Unlinked data address match.

1

Linked data address match.

When this bit is set to 1 the linked BRP number field indicates the BRP that this WRP is linked. See the ARM® Architecture Reference Manual ARMv8 for more information.

[19:16]LBN

Linked Breakpoint Number. If this watchpoint is programmed with the watchpoint type set to linked, then this field must be programmed with the number of the breakpoint that defines the Context match to be combined with data address comparison. Otherwise, this field must be programmed to 0b0000.

Reading this register returns an unknown value for this field, and the generation of Watchpoint debug events is unpredictable, if either:

  • This watchpoint does not have linking enabled and this field is not programmed to 0x0.

  • This watchpoint has linking enabled and the breakpoint indicated by this field does not support Context matching, is not programmed for Context matching, or does not exist.

See the ARM® Architecture Reference Manual ARMv8 for more information.

[15:14]SSC

Security State Control. This field enables the watchpoint to be conditional on the Security state of the processor. This field is used with the Hyp Mode Control (HMC) and Privileged Access Control (PAC) fields.

See the ARM® Architecture Reference Manual ARMv8 for possible values of the fields, and the access modes and Security states that can be tested.

[13]HMC

Hyp Mode Control. This field is used with the Security State Control (SSC) and PAC fields. The value of DBGWCR.PAC has no effect for accesses made in Hyp mode.

See the ARM® Architecture Reference Manual ARMv8 for possible values of the fields, and the access modes and Security states that can be tested.

[12:5]BAS

Byte Address Select. The processor implements an 8-bit Byte address select field, DBGWCR[12:5].

A DBGWVR is programmed with a word-aligned address. This field enables the watchpoint to hit only if certain bytes of the addressed word are accessed. The watchpoint hits if an access hits any byte being watched, even if:

  • The access size is larger than the size of the region being watched.

  • The access is unaligned, and the base address of the access is not in the same word of memory as the address in the DBGWVR.

  • The access size is smaller than the size of region being watched.

See the ARM® Architecture Reference Manual ARMv8 for more information.

[4:3]LSC

Load/store access control. This field enables watchpoint matching for the type of access. The possible values are:

0b00

Reserved.

0b01

Match on any load, Load-Exclusive, or swap.

0b10

Match on any store, Store-Exclusive, or swap.

0b11

Match on all type of access.

[2:1]PAC

Privileged Access Control. This field enables watchpoint matching conditional on the mode of the processor. This field is used with the SSC and PAC fields.

See the ARM® Architecture Reference Manual ARMv8 for possible values of the fields, and the access modes and Security states that can be tested.

Note

  • For all cases the match refers to the privilege level of the access, not the mode of the processor. For example, if the watchpoint is configured to match only accesses at PL1 or higher, and the processor executes an LDRT instruction in a PL1 mode, the watchpoint does not match.

  • Permitted values of this field are not identical to those for the DBGBCR. In the DBGBCR the value 0b00 permitted.

[0]E

Watchpoint Enable. This bit enables the watchpoint:

0

Watchpoint disabled.

1

Watchpoint enabled.

A watchpoint never generates a Watchpoint debug event when it is disabled.

Note

The value of DBGWCR.E is unknown on reset. A debugger must ensure that DBGWCR.E has a defined value before it programs DBGDSCR[15:14] to enable debug.


To access the DBGWCRn in AArch32 state, read or write the CP14 register with:

MRC p14, 0, <Rt>, c0, cn, 7; Read Debug Watchpoint Control Register n
MCR p14, 0, <Rt>, c0, cn, 7; Write Debug Watchpoint Control Register n

To access the DBGWCRn_EL1 in AArch64 state, read or write the register with:

MRS <Xt>, DBGWCRn_EL1; Read Debug Watchpoint Control Register n
MSR DBGWCRn_EL1, <Xt>; Write Debug Watchpoint Control Register n

The DBGWCRn_EL1 can be accessed through the internal memory-mapped interface and the external debug interface, offset 0x8n8. The range of n for DBGWCRn_EL1 is 0 to 3.

Copyright © 2013, 2014 ARM. All rights reserved.ARM DDI 0488D
Non-ConfidentialID012914