Now that the funny PABT-behaviour is found to be (probably) caused ny debug state, I'd like to exit debug state before return from PABT exception. The ARM v7-A/R ARM says that I should write RRQ to DBGDRCR, but it seems that in Cortex-A7 it's not accessible via CP14.
It should be accessible via memory-mapped registers, and the manual gives the offset, but offset from what?
I understood that the register offset is the register number multiplied by four, so for DBGDRCR the offset would be 36*4 = 144 (0x90).
In the TRM it says:
Table 10-26 Address mapping for debug trace components Address range Componenta 0x00000 - 0x00FFF ROM table 0x01000 - 0x0FFFF Reserved 0x10000 - 0x10FFF CPU 0 Debug 0x11000 - 0x11FFF CPU 0 PMU 0x12000 - 0x12FFF CPU 1 Debug 0x13000 - 0x13FFF CPU 1 PMU 0x14000 - 0x14FFF CPU 2 Debug 0x15000 - 0x15FFF CPU 2 PMU 0x16000 - 0x16FFF CPU 3 debug
Table 10-26 Address mapping for debug trace components
Address range Componenta
0x00000 - 0x00FFF ROM table
0x01000 - 0x0FFFF Reserved
0x10000 - 0x10FFF CPU 0 Debug
0x11000 - 0x11FFF CPU 0 PMU
0x12000 - 0x12FFF CPU 1 Debug
0x13000 - 0x13FFF CPU 1 PMU
0x14000 - 0x14FFF CPU 2 Debug
0x15000 - 0x15FFF CPU 2 PMU
0x16000 - 0x16FFF CPU 3 debug
Are these too offsets from somewhere, or absolute addresses?
Do I write to DBGDRCR by just writing the value into address 0x100090 (core 0, assuming not locked)?
Or do I need to calculate the register address from the contents of DBGDRAR?
And what's the ROM table?
Thanks. I started hunting for the info, and found out that the thing should start with reading the DBGDRAR (Debug ROM Address Register) then
Read the ROM Table entry for the component, and extract the Address offset for the component. The Address offset is bits [31:12] of the ROM Table entry
Read the ROM Table entry for the component, and extract the Address offset for the component. The Address
offset is bits [31:12] of the ROM Table entry
Now the thing is figuring out how to identify the right component. I haven't found any explanations of what kind of things are the 'components'. Is core 0 a component? And core 1 another component? How about peripherals? And Devices?
I guess I should find '0x9' (CoreSight compliant debug component) in the 'class'-field of component ID register of the right component?
And 'continuation code' (used as designer ID) 0x4 and identity code of 3B in the JEP-106 field of the 'conceptual 64-bit peripheral ID register'? And DBGDIDR version-field should be 0b0101 (ARMv7, v7.1 Debug architecture)?
Quite a mess just to exit the debug state.
Are there descriptions for other possible values in those fields and their meanings?