Not watchpoint support.
Backtrace ? I only can find LR (Address of current function caller.)
I've created shellcode that save R0-R12, LR into stack. Then copy the stack address into my allocated region, so i can read it with script.
ROM:00000000 STMFD SP!, {R0-R12,LR}
ROM:00000004 LDR R0, =0xBBBBBBBB
ROM:00000008 STR SP, [R0]
ROM:0000000C
ROM:0000000C isLocked ; CODE XREF: ROM:00000014↓j
ROM:0000000C LDR R0, =0
ROM:00000010 CMP R0, #1
ROM:00000014 BNE isLocked
ROM:00000018 LDMFD SP!, {R0-R12,LR}
ROM:0000001C LDR PC, =0xAAAAAAAA
ROM:0000001C ; ---------------------------------------------------------------------------
ROM:00000020 _returnaddress DCD 0xAAAAAAAA ; DATA XREF: ROM:0000001C↑r
ROM:00000024 _stackaddress DCD 0xBBBBBBBB ; DATA XREF: ROM:00000004↑r
ROM:00000028 _spinlockctl DCD 0 ; DATA XREF: ROM:isLocked↑r
It work like this,
Firstly, i hooked an address that contain interesting info.
Then, i make it jump into this shellcode, After it jump..
Shellcode will save R0-R12, LR into stack. then write the stack address at _stackaddress.
this shellcode will wait for spinlock before continuing execution.