(boolean,boolean) BreakpointMatch(integer n, bits(64) address, integer size) // For details of arguments and return values, see BreakpointValueMatch.
assert n <= UInt(ID_AA64DFR0_EL1.BRPs);
enabled = DBGBCR_EL1[n].E == ‘1’;
ispriv = PSTATE.EL != EL0;
linked = DBGBCR_EL1[n].BT IN ‘0x01’;
isbrkpnt32 = ELUsingAArch32(EL1);
linked_to = FALSE;
state_match = StateMatch(DBGBCR_EL1[n].SSC, DBGBCR_EL1[n].HMC, DBGBCR_EL1[n].PMC, linked, DBGBCR_EL1[n].LBN, ispriv, isbrkpnt32);
(value_match, value_mismatch) = BreakpointValueMatch(n, address, linked_to);
if size == 4 && HaveAnyAArch32() then // Check second halfword
// If the breakpoint address and BAS of an Address breakpoint match the address of the // second halfword of an instruction, but not the address of the first halfword, it is // CONSTRAINED UNPREDICTABLE whether or not this breakpoint generates a Breakpoint debug // event is generated.
(match_i, mismatch_i) = BreakpointValueMatch(n, address + 2, linked_to);
if !value_match && match_i then
value_match = ConstrainUnpredictableBool();
if value_mismatch && !mismatch_i then
value_mismatch = ConstrainUnpredictableBool();
if address<1> == ‘1’ && DBGBCR_EL1[n].BAS == ‘1111’ then
// The above notwithstanding, if DBGBCR_EL1[n].BAS == ‘1111’, it is CONSTRAINED UNPREDICTABLE // whether or not a Breakpoint debug event is generated for an instruction at the address // DBGBVR_EL1[n]+2.
if value_match then value_match = ConstrainUnpredictableBool();
if !value_mismatch then value_mismatch = ConstrainUnpredictableBool();
match = value_match && state_match && enabled;
mismatch = value_mismatch && state_match && enabled;
return (match, mismatch);
// Function 6: CheckBreakpoint // ===========================
CheckBreakpoint(bits(64) vaddress, integer size)
// Called before executing an instruction at “vaddress” of “size” bytes.
// The breakpoint can in fact be evaluated well ahead of execution, for example, at instruction // fetch. This is the simple sequential execution of the program.
if UsingAArch32() then assert size IN {2,4}; // Measured in bytes
if match && HaltOnBreakpointOrWatchpoint() then Halt(DebugHalt_Breakpoint);
elsif match && MDSCR_EL1.MDE == ‘1’ && DebugEnabledAndUnmasked() then target = DebugTarget();
TakeDebugException(target, ‘110000’ /*0x30*/, ‘1’, Zeros(19):‘100010’, ‘0001’);
3.3 Watchpoint debug event
Rationale: see Breakpoint and watchpoints on page 261.
Address watchpoints generate debug events by comparing values held in system registers with data addresses generated by load and store instructions.
A watchpoint can be programmed to match only in certain modes, Exception levels and security states.
Address watchpoints can be linked to Context breakpoints.
Watchpoints can also be programmed to match on access type; that is, match only loads, match only stores, or match both loads and stores. Watchpoints do not match against instruction fetches.
The number of watchpoints in a processor is IMPLEMENTATION DEFINED. See Numbers of resources on page 69.
3.3.1 Programming Watchpoint debug events
Each watchpoint is defined by:
A Watchpoint Value Registers, DBGWVRn_EL1 (page 74). DBGWVRn_EL1 is a 64-bit register, the bottom half of which is accessible in AArch32 state. The top half is not accessible in AArch32 state.
A Watchpoint Control Registers, DBGWCRn_EL1 (page 75).
If DBGWCRn_EL1.E == 0, the watchpoint does not generate any debug events.
If MDSCR_EL1.MDE == 0, watchpoints do not generate debug exceptions. This bit is DBGDSCR.MDBGen in AArch32 state. See Monitor Debug System Control Register, MDSCR_EL1 on page 77.
See also Constraints on programming Watchpoint debug events on page 37.
3.3.2 Watchpoint types
Watchpoints are always Address watchpoints. DBGWCRn_EL1.WT defines whether the watchpoint is Linked or Unlinked.
0
Unlinked Address Matching 1
Linked Address Matching Watchpoints
Figure 5: Watchpoint taxonomy
A Linked Address watchpoint is associated with a Linked Context breakpoint to provide a data address match that is generated only within a given context. Other watchpoints are Unlinked.
3.3.3 Address watchpoints
Address watchpoints compare the value stored in the DBGWVRn_EL1 system registers with the data virtual address.
The comparison with DBGWVRn_EL1 gives a match to the granularity of:
a word if DBGWVRn_EL1 is word aligned
a double-word if DBGWVRn_EL1 is double-word aligned.
Within this word or double-word DBGWCRn_EL1.BAS refines the granularity of a watchpoint match to individual bytes.
A programmable number of least-significant bits of the address can be masked. In this case, the granularity of the watchpoint match is two to the power of the number of masked bits bytes.
A Watchpoint debug event is generated if an instruction of the required type access any watchpointed byte.
This is the case even if the lowest address accessed by the instruction is not in the doubleword specified by DBGWVRn_EL1, as might be the case with an unaligned access or an instruction that accesses more than 8 bytes.
In an AArch64 stage 1 translation regime the eight most-significant bits of the 64-bit address are ignored when the applicable TBI bit in TCR_EL1, TCR_EL2 or TCR_EL3 is set to 1.
Note: The significant bits of DBGWVRn_EL1 system register are sign-extensions of the most-significant address bit, and watchpoints are lower priority than address faults, meaning that implementations can ignore these bits, and the TBI bit has no effect on the debug logic.
In AArch32 state in an AArch64 stage 1 translation regime, 32 bit addresses are zero-extended before comparison. AArch64 software and external debuggers programming Address watchpoints to match in AArch32 state must write zeros to DBGWVRn_EL1[63:32].
In an AArch32 stage 1 translation regime the comparators compare only bits [31:0] of the address.
Note: This is because software is not required to write the top 32 bits of DBGWVRn in AArch32 state, meaning they contain an UNKNOWN value from reset and must be ignored. Writes to DBGWVRn registers in AArch32 state update only the bottom 32-bits of the register.
3.3.4 Processor state matching
The watchpoint specifies the stage 1 translation regime(s) in which the watchpoint matches, and, for the EL1/EL0 translation regime, whether privileged accesses should be matched. The watchpoint can also be restricted by linking it to a Linked Context breakpoint, See Context breakpoints and linking on page 25.
This allows watchpoints to be masked at different Exception levels without the need for active switching between tasks.
Processor state matching is controlled by DBGWCRn_EL1.{SSC, HMC, PAC}. Table 5 lists permitted values for these fields. In this table:
Only
AA64 means the entries in that row apply only in an AArch64 stage 1 translation regime, and is reserved in an AArch32 stage 1 translation regime. In AArch32 stage 1 translation regimes:
— If the highest Exception level is using AArch64, the watchpoint is disabled.
— Otherwise these entries will behave as another row in the table, or as if the watchpoint is disabled.
No EL3
No means the entries in that row apply only if EL3 is implemented and are reserved otherwise.
These entries will behave as another row in the table, or as if the watchpoint is disabled.
No EL3 or EL2
No means the entries in that row apply only if either or both EL3 and EL2 are implemented and are reserved otherwise.
No EL2 means the entries in that row apply only if EL2 is implemented and are reserved otherwise.
These entries will behave as another row in the table, or as if the watchpoint is disabled.
Secure Exception levels and Non-secure Exception levels Indicates the access privilege for which the match occurs:
Yes means a match for an access of the specified privilege in the specified and security state.
- means no match.
AA32 means match only in an AArch32 stage 1 translation regime.
AA64 means match only in an AArch64 stage 1 translation regime.
Note: If EL3 is implemented and using AArch32, there is no Secure EL1 and the Secure EL1 column must be ignored.
The EL0 column includes both accesses from EL0 and unprivileged accesses made from EL1.
Note: PAC matches on the privilege of the access rather than the privilege of the current EL. This means that unprivileged load/store instructions, which generate unprivileged accesses at EL1, or at EL3 using AArch32, will match watchpoints programmed to match EL0 accesses.
Software must not rely on the behavior of reserved values as it might change in a future revision of the architecture.
HMC SSC PAC Secure Exception levels Non-secure Exception
levels Only No
EL3
No EL3 or EL2 [13] [15:14] [2:1] EL3a EL1 EL0 EL2a EL1 EL0
0 0 0 0 1 AA32 Yes - - Yes - - - -
0 0 0 1 0 - - Yes - - Yes - - -
0 0 0 1 1 AA32 Yes Yes - Yes Yes - - -
0 0 1 0 1 - - - - Yes - - No No
0 0 1 1 0 - - - Yes - No No
0 0 1 1 1 - - - - Yes Yes - No No
0 1 0 0 1 AA32 Yes - - - No No
0 1 0 1 0 - - Yes - - - - No No
0 1 0 1 1 AA32 Yes Yes - - - - No No
1 0 0 0 1 Yes Yes - Yes Yes - - No
1 0 0 1 1 Yes Yes Yes Yes Yes Yes - - No
1 0 1 0 1 - - - Yes Yes - - No No
1 0 1 1 1 - - - Yes Yes Yes - No No
1 1 0 0 0 AA64 - - - AA64 No No
1 1 0 0 1 Yes Yes - - - No No
1 1 0 1 1 Yes Yes Yes - - - - No No
1 1 1 0 0 - - - Yes - - - - No EL2
a. Debug exceptions are not generated at EL3 using AArch64 or at EL2 using AArch32, meaning matches at EL3 using AArch64 or EL2 using AArch32 are relevant only when EDSCR.HDE == 1 and halting is allowed. See Halting the processor on debug events on page 138. Self-hosted debuggers should aovoid configurations that match in these Exception levels.
Table 5: Watchpoint encoding (derived from StateMatch)
All other combinations are reserved. See Watchpoint Control Registers, DBGWCRn_EL1 on page 75.
3.3.5 Effect of watchpoints
The constraints on the effect of a watchpointed instruction on the registers and/or memory it accesses are the same as for an instruction that generates a Data Abort. See [v8Exception].
3.3.6 Watchpoints and Store Exclusive operations
For a store-exclusive instruction, if ExclusiveMonitorsPass() returns FALSE, meaning the memory is not accessed, but the memory address would generate Watchpoint debug event if accessed, it is IMPLEMENTATION DEFINED whether the debug event is generated.
3.3.7 Watchpoints and other operations
In AArch64 state:
DC IVAC and DC ZVA instructions generate Watchpoint debug events on a store match.
In AArch32 state:
It is IMPLEMENTATION DEFINED whether DCIMAVC instructions generate Watchpoint debug events on a store match.
For checking against watchpoints, the size of a data cache operation is defined to be:
The DC ZVA block size specified by DCZID_EL0.BS, for a DC ZVA operation
An IMPLEMENTATION DEFINED size between CTR.DminLine and 2KB for DC IVAC and DCIMVAC operations.
The lowest address accessed is the address supplied to the instruction, rounded down to the nearest multiple of this size, and the highest address accessed is (size-1) bytes above that.
Under normal operating conditions, other data cache maintenance instructions and all instruction cache maintenance, address translation, TLB maintenance, and cache preload instructions do not generate Watchpoint debug events.
However, the debug architecture allows for IMPLEMENTATION DEFINED controls, such as those in ACTLR Registers, to enable checking for Watchpoint debug events on an IMPLEMENTATION DEFINED subset of these instructions. Whether a watchpoint treats the instruction as a load or a store, and the access size of instruction cache, address translation, and TLB operations are IMPLEMENTATION DEFINED.
3.3.8 Determining the location of a watchpointed access
On taking a Watchpoint debug event, the processor records an address that can be used by the debugger to determine the location that generated the debug event:
for debug exceptions, the address is written to the FAR (FAR_EL1, FAR_EL2, DFAR or HDFAR as appropriate)
for entry to Debug state, the address is written to the External Debug Watchpoint Address Register, EDWAR (page 208).
For a watchpoint due to an operation other than a Data Cache operation or DC ZVA, the address must be an address from the inclusive range between:
the lowest address accessed by the instruction that triggered the watchpoint
the highest watchpointed address accessed by that instruction.
The address must also be within a naturally-aligned block of memory of power-of-two size no larger than the DC ZVA granule, containing a watchpointed address accessed by that location.
This address is always at or below the watchpointed location.
If there are multiple watchpoints set in that range, there is no guarantee that the watchpointed location is any particular watchpoint. In particular, it is not guaranteed to be the watchpointed location with the lowest address, as this would imply an ordering constraint that may not be valid for the instruction type and/or memory type.
Example: An A32 load multiple instruction loads 9 registers from address 0x8004 upwards. A read watchpoint is programmed on the byte at 0x8019. The watchpoint is triggered by this load. If the DC ZVA granule size is 32 bytes, then the address reported must be between 0x8004 and 0x8019 inclusive. If the DC ZVA granule size is 16 bytes, the address must be between 0x8010 and 0x8019 inclusive.
For a watchpoint due to a Data Cache operation or DC ZVA, the address is the address passed to the instruction. This might be an address might be above the watchpointed location.
3.3.9 Constraints on programming Watchpoint debug events
There are illegal configurations of watchpoints where the generation of debug events is CONSTRAINED UNPREDICTABLE if the watchpoint is enabled.
If the debug event is generated, then the behavior of the event is as defined by the architecture.
The effect is limited to the watchpoint which has been incorrectly programmed. If any other watchpoints are correctly programmed and generate a watchpoint match on that instruction, then the debug event is generated by that other watchpoint.
The watchpoint is controlled by fields in DBGWCRn_EL1. Depending on the implementation, some of these fields may be RES0 or read-only copies of other fields, meaning that they ignore writes or can be set only to certain values. See Watchpoint Control Registers, DBGWCRn_EL1 on page 75.
Note: Where this section describes such a field as being set to a value, it means after taking such considerations into account.
There are constraints on which addresses are required to match a watchpoint based on the address in DBGWVRn_EL1 and the fields in DBGWCRn_EL1:
DBGWVRn_EL1[1:0] are RES0 and ignored.
If DBGWVRn_EL1[2] == 1, DBGWCRn_EL1.BAS[7:4] are RES0 and ignored.
If DBGWCRn_EL1.{SSC,HMC,PAC} is set to a reserved combination, the watchpoint either does not generate any debug event for this watchpoint, or behaves as another combination. See the register description for more information.
If DBGWCRn_EL1.LSC == 0b00, no Watchpoint debug event is generated.
If DBGWCRn_EL1.WT == 0, the LBN field reads UNKNOWN and its value is ignored.
If DBGWCRn_EL1.WT == 1, see For breakpoints or watchpoints linked to a Context breakpoint on page 29.
If DBGWCRn_EL1.MASK is set to a reserved value, then either:
1) The processor behaves as if DBGWCRn_EL1.MASK is set to an UNKNOWN not reserved value, which might be 0.
2) The processor behaves as if the watchpoint is disabled.
If DBGWCRn_EL1.MASK is non-zero, any masked bits of DBGWVRn_EL1 are not zero, and that watchpoint is enabled, then it is CONSTRAINED UNPREDICTABLE whether or not a Watchpoint debug event is generated when the unmasked bits match.
If DBGWCRn_EL1.MASK is non-zero, DBGWCRn_EL1.BAS is not set to 0b11111111, and that watchpoint is enabled, then for each byte in the masked region, it is CONSTRAINED UNPREDICTABLE whether or not a Watchpoint debug event is generated.
If DBGWCRn_EL1.BAS specifies a non-contiguous set of bytes being watched, and that watchpoint is enabled, it is CONSTRAINED UNPREDICTABLE whether or not a Watchpoint debug event is generated for each byte in the doubleword addressed by (DBGWVRn_EL1[63:3]<<3).
Figure 6 shows the permitted values for BAS, with the column giving the offset from DBGWVRn_EL1 for the first byte being watched and the row the offset from DBGWVRn_EL1 of the last byte watched.
Offset +0 +1 +2 +3 +4 +5 +6 +7 +0 00000001
+1 00000011 00000010
+2 00000111 00000110 00000100
+3 00001111 00001110 00001100 00001000
+4 00011111 00011110 00011100 00011000 00010000
+5 00111111 00111110 00111100 00111000 00110000 00100000
+6 01111111 01111110 01111100 01111000 01110000 01100000 01000000
+7 11111111 11111110 11111100 11111000 11110000 11100000 11000000 10000000 Figure 6: Permitted values of DBGWVRn_EL1.BAS, if DBGWVRn_EL1[2] == 0
3.3.10 Pseudocode details of Watchpoint debug events
// Function 7: WatchpointByteMatch // ===============================
boolean WatchpointByteMatch(integer n, bits(64) address)
top = AddrTop(address); // Ignore high address bits in AArch32 translation regime.
bottom = if DBGWVR_EL1[n]<2> == ‘1’ then 2 else 3; // Word or doubleword byte_select_match = (byte_address_select<UInt(address<bottom-1:0>)> != ‘0’);
mask = UInt(DBGWCR_EL1[n].MASK);
// If DBGWCR_EL1[n].MASK is non-zero value and DBGWCR_EL1[n].BAS is not set to ‘11111111’, or // DBGWCR_EL1[n].BAS specifies a non-contiguous set of bytes, behavior is CONSTRAINED
// UNPREDICTABLE.
if !IsZero(DBGWCR_EL1[n].MASK) && !IsOnes(DBGWCR_EL1[n].BAS) then byte_select_match = ConstrainUnpredictableBool();
else
LSB = (DBGWCR_EL1[n].BAS AND NOT(DBGWCR_EL1[n].BAS – 1)); MSB = (DBGWCR_EL1[n].BAS + LSB);
if !IsZero(MSB AND (MSB – 1)) then
byte_select_match = ConstrainUnpredictableBool();
bottom = 3; // Always doubleword
// If the address mask is set to a reserved value, the behavior is CONSTRAINED UNPREDICTABLE.
// See Constraints on programming Watchpoint debug events.
if mask > 0 && mask <= 2 then
(c, mask) = ConstrainUnpredictableInteger(3, 31);
assert c IN {Constraint_DISABLED, Constraint_NONE, Constraint_UNKNOWN};
case c of
when Constraint_DISABLED return FALSE; // Disabled when Constraint_NONE mask = 0; // No masking
// Otherwise the value returned by ConstrainUnpredictableInteger is a not-reserved value if mask > bottom then
WVR_match = (address<top:mask> == DBGWVR_EL1[n]<top:mask>);
// If masked bits of DBGWVR_EL1[n] are not zero, the behavior is CONSTRAINED UNPREDICTABLE.
if WVR_match && !IsZero(DBGWVR_EL1[n]<mask–1:bottom>) then WVR_match = ConstrainUnpredictableBool();
else
WVR_match = address<top:bottom> == DBGWVR_EL1[n]<top:bottom>;
return WVR_match && byte_select_match;
// Function 8: WatchpointMatch // ===========================
boolean WatchpointMatch(integer n, bits(64) address, integer size, boolean ispriv, boolean iswrite) assert n <= UInt(ID_AA64DFR0_EL1.WRPs);
// “ispriv” is FALSE for LDTR/STTR (LDRT/STRT in AArch32) instructions executed at EL1 and all // load/stores at EL0, TRUE for all other load/stores. “iswrite” is TRUE for stores, FALSE for // loads. (If SWP were implemented, the function would be called twice.)
enabled = DBGWCR_EL1[n].E == ‘1’;
linked = DBGWCR_EL1[n].WT == ‘1’;
isbrkpnt32 = FALSE;
state_match = StateMatch(DBGWCR_EL1[n].SSC, DBGWCR_EL1[n].HMC, DBGWCR_EL1[n].PAC, linked, DBGWCR_EL1[n].LBN, ispriv, isbrkpnt32);
ls_match = (DBGWCR_EL1[n].LSC<(if iswrite then 1 else 0)> == ‘1’);
value_match = FALSE;
for byte = 0 to size - 1
value_match = value_match || WatchpointByteMatch(n, address + byte);
return value_match && state_match && ls_match && enabled;
// Function 9: CheckWatchpoint // ===========================
CheckWatchpoint(bits(64) address, AccType acctype, boolean iswrite, integer size)
// Called before accessing the memory location at “address”. See WatchpointMatch for details of // the other parameters. Note this code omits the setting of FAR/DFAR, which is outside the scope // of the pseudocode in this document.
match = FALSE;
ispriv = PSTATE.EL != EL0 && !(PSTATE.EL == EL1 && acctype == AccType_UNPRIV);
cache_op = (acctype == AccType_DC);
for i = 0 to UInt(ID_AA64DFR0_EL1.WRPs)
match = match || WatchpointMatch(i, address, size, ispriv, iswrite);
if match && HaltOnBreakpointOrWatchpoint() then Halt(DebugHalt_Watchpoint);
elsif match && MDSCR_EL1.MDE == ‘1’ && DebugEnabledAndUnmasked() then target = DebugTarget();
ISS = Zeros(25);
ISS<24> = ‘0’; // ISV
ISS<8> = (if cache_op then ‘1’ else ‘0’); // CM ISS<6> = (if iswrite then ‘1’ else ‘0’); // WnR ISS<5:0> = ‘100010’; // DFSC
TakeDebugException(target, ‘110100’ /*0x34*/, ‘1’, ISS, ‘1010’);