How to use the external debugging interface in Juno board?

Hi all,

I am trying to use one Cortex-A57 (debugger) core to debug a Cortex-A53 core (target) on Juno board. According to the armv8 architecture manual, i may halt the the target and use EDITR instruction to force the target execute instructions. So, what i did looks like the following,

1. Power up the debug power domain of the target.

2. In the target, lock the OS lock by setting OSLAR_EL1.OSLK bit and then set the MDSCR_EL1.HDE bit to enable halting debug

3. In the target, unlock the OS lock by clearing OSLAR_EL1.OSLK, and unlock the OS double lock by clearing OSDLR_EL1.DLK. Then, execute a "hlt" instruction.

4. In the host, i use memory-mapped access to access the EDSCR register of the target, and ensure that EDSCR.ITE bit is set. Also, the EDSCR.STATUS bits show that the target is halted by hlt instruction.

5. Finally, in the host, i use memory mapped access to access the EDITR register of the target, and store an instruction "0xaa0103e3" (mov x3, x1) to the EDITR.

However, during the whole process, i met two problems.

Firstly, in step 1, I actually attempted to use the SCPI implemented in the ARM Trusted Firmware to power up the debug power domain of all cores. Specifically, i used the "Set Device Power State" command to set the power state of all devices (device id 0-5) to 0. However, only the setting of the first two devices which are the two Cortex-A57 cores succeed. While the device id is 2-5, the SCPI returns a error showing that value out of range. 

Secondly, in step 5, after I send the instruction, I expected that the value in the x1 and x3 register of the target are the same. However, when I connect DS5 to the board, I found that the target is halt, but the values in the x1 and x3 registers are not the same. So I guess the instruction in the EDITR register is not actually executed.

Did I miss some important steps? Or am I misusing the EDITR register?

Thanks for any help and discussion!

Best Regards,

Zhenyu