Description

The DBGPCSR register format is not correct, but the debug tools can calculate the expected PC value and instruction state.

Solution

The ARM Architecture specifies the DBGPCSR register as:

• DBGPCSR[31:2] contain the sampled value of bits [31:2] of the PC. The sampled value is an instruction address plus an offset that depends on the processor instruction set state.
• DBGPCSR[1:0] contain the meaning of PC Sample Value, with the following permitted values:
  • 0b00 ((DBGPCSR[31:2] << 2) - 8) references an ARM state instruction
  • 0bx1 ((DBGPCSR[31:1] << 1) - 4) references a Thumb/ThumbEE state instruction
  • 0b10 IMPLEMENTATION DEFINED.

This field encodes the processor instruction set state, so that the profiling tool can calculate the true instruction address by subtracting the appropriate offset from the value sampled in bits [31:2] of the register.

In Cortex-A9, the DBGPCSR samples the target address of executed branches (but possibly still speculative to data aborts), with the following encodings:

• DBGPCSR[31:2] contains address of target branch instruction with no offset
• DBGPCSR[1:0] contains the execution state of the target branch instruction:
  • 0xb00 for an ARM state instruction
  • 0xb01 for a Thumb2 state instruction
  • 0xb10 for a Jazelle state instruction
  • 0xb11 for a Thumb2EE state instruction

Impact Details

The impact is minor. The implication of this issue is that the debugger tools must not rely on the specified value of DBGPCSR[1:0] or remove any offset from DBGPCSR[31:2] to obtain the expected PC value. Subtracting 4 or 8 from the DBGPCSR[31:2] value would lead to an area of code which is unlikely to have been recently executed or could even not contain any executable code.

The same might be true for Thumb instructions at half-word boundaries, in which case PC[1]=1 but DBGPCSR[1]=0, or ThumbEE instructions at word boundaries, with PC[1]=0 and DBGPCSR[1]=1.

In Cortex-A9, because the DBGPCSR is always a branch target (= start of a basic block to the tool), the debugger should be able to spot many of these cases and attribute the sample to the right basic block.