| 1 | /* |
| 2 | * ARM debug helpers used by TCG |
| 3 | * |
| 4 | * This code is licensed under the GNU GPL v2 or later. |
| 5 | * |
| 6 | * SPDX-License-Identifier: GPL-2.0-or-later |
| 7 | */ |
| 8 | #include "qemu/osdep.h" |
| 9 | #include "qemu/log.h" |
| 10 | #include "cpu.h" |
| 11 | #include "helper.h" |
| 12 | #include "internals.h" |
| 13 | #include "cpu-features.h" |
| 14 | #include "cpregs.h" |
| 15 | #include "exec/watchpoint.h" |
| 16 | #include "system/tcg.h" |
| 17 | |
| 18 | /* Return the Exception Level targeted by debug exceptions. */ |
| 19 | static int arm_debug_target_el(CPUARMState *env) |
| 20 | { |
| 21 | bool secure = arm_is_secure(env); |
| 22 | bool route_to_el2 = false; |
| 23 | |
| 24 | if (arm_feature(env, ARM_FEATURE_M)) { |
| 25 | return 1; |
| 26 | } |
| 27 | |
| 28 | if (arm_is_el2_enabled(env)) { |
| 29 | route_to_el2 = env->cp15.hcr_el2 & HCR_TGE || |
| 30 | env->cp15.mdcr_el2 & MDCR_TDE; |
| 31 | } |
| 32 | |
| 33 | if (route_to_el2) { |
| 34 | return 2; |
| 35 | } else if (arm_feature(env, ARM_FEATURE_EL3) && |
| 36 | !arm_el_is_aa64(env, 3) && secure) { |
| 37 | return 3; |
| 38 | } else { |
| 39 | return 1; |
| 40 | } |
| 41 | } |
| 42 | |
| 43 | /* |
| 44 | * Raise an exception to the debug target el. |
| 45 | * Modify syndrome to indicate when origin and target EL are the same. |
| 46 | */ |
| 47 | static G_NORETURN void |
| 48 | raise_exception_debug(CPUARMState *env, uint32_t excp, uint32_t syndrome) |
| 49 | { |
| 50 | int debug_el = arm_debug_target_el(env); |
| 51 | int cur_el = arm_current_el(env); |
| 52 | |
| 53 | /* |
| 54 | * If singlestep is targeting a lower EL than the current one, then |
| 55 | * DisasContext.ss_active must be false and we can never get here. |
| 56 | * Similarly for watchpoint and breakpoint matches. |
| 57 | */ |
| 58 | assert(debug_el >= cur_el); |
| 59 | syndrome |= (debug_el == cur_el) << R_SYNDROME_EC_SHIFT; |
| 60 | raise_exception(env, excp, syndrome, debug_el); |
| 61 | } |
| 62 | |
| 63 | /* See AArch64.GenerateDebugExceptionsFrom() in ARM ARM pseudocode */ |
| 64 | static bool aa64_generate_debug_exceptions(CPUARMState *env) |
| 65 | { |
| 66 | int cur_el = arm_current_el(env); |
| 67 | int debug_el; |
| 68 | |
| 69 | if (cur_el == 3) { |
| 70 | return false; |
| 71 | } |
| 72 | |
| 73 | /* MDCR_EL3.SDD disables debug events from Secure state */ |
| 74 | if (arm_is_secure_below_el3(env) |
| 75 | && extract32(env->cp15.mdcr_el3, 16, 1)) { |
| 76 | return false; |
| 77 | } |
| 78 | |
| 79 | /* |
| 80 | * Same EL to same EL debug exceptions need MDSCR_KDE enabled |
| 81 | * while not masking the (D)ebug bit in DAIF. |
| 82 | */ |
| 83 | debug_el = arm_debug_target_el(env); |
| 84 | |
| 85 | if (cur_el == debug_el) { |
| 86 | return extract32(env->cp15.mdscr_el1, 13, 1) |
| 87 | && !(env->daif & PSTATE_D); |
| 88 | } |
| 89 | |
| 90 | /* Otherwise the debug target needs to be a higher EL */ |
| 91 | return debug_el > cur_el; |
| 92 | } |
| 93 | |
| 94 | static bool aa32_generate_debug_exceptions(CPUARMState *env) |
| 95 | { |
| 96 | int el = arm_current_el(env); |
| 97 | |
| 98 | if (el == 0 && arm_el_is_aa64(env, 1)) { |
| 99 | return aa64_generate_debug_exceptions(env); |
| 100 | } |
| 101 | |
| 102 | if (arm_is_secure(env)) { |
| 103 | int spd; |
| 104 | |
| 105 | if (el == 0 && (env->cp15.sder & 1)) { |
| 106 | /* |
| 107 | * SDER.SUIDEN means debug exceptions from Secure EL0 |
| 108 | * are always enabled. Otherwise they are controlled by |
| 109 | * SDCR.SPD like those from other Secure ELs. |
| 110 | */ |
| 111 | return true; |
| 112 | } |
| 113 | |
| 114 | spd = extract32(env->cp15.mdcr_el3, 14, 2); |
| 115 | switch (spd) { |
| 116 | case 1: |
| 117 | /* SPD == 0b01 is reserved, but behaves as 0b00. */ |
| 118 | case 0: |
| 119 | /* |
| 120 | * For 0b00 we return true if external secure invasive debug |
| 121 | * is enabled. On real hardware this is controlled by external |
| 122 | * signals to the core. QEMU always permits debug, and behaves |
| 123 | * as if DBGEN, SPIDEN, NIDEN and SPNIDEN are all tied high. |
| 124 | */ |
| 125 | return true; |
| 126 | case 2: |
| 127 | return false; |
| 128 | case 3: |
| 129 | return true; |
| 130 | } |
| 131 | } |
| 132 | |
| 133 | return el != 2; |
| 134 | } |
| 135 | |
| 136 | /* |
| 137 | * Return true if debugging exceptions are currently enabled. |
| 138 | * This corresponds to what in ARM ARM pseudocode would be |
| 139 | * if UsingAArch32() then |
| 140 | * return AArch32.GenerateDebugExceptions() |
| 141 | * else |
| 142 | * return AArch64.GenerateDebugExceptions() |
| 143 | * We choose to push the if() down into this function for clarity, |
| 144 | * since the pseudocode has it at all callsites except for the one in |
| 145 | * CheckSoftwareStep(), where it is elided because both branches would |
| 146 | * always return the same value. |
| 147 | */ |
| 148 | bool arm_generate_debug_exceptions(CPUARMState *env) |
| 149 | { |
| 150 | if ((env->cp15.oslsr_el1 & 1) || (env->cp15.osdlr_el1 & 1)) { |
| 151 | return false; |
| 152 | } |
| 153 | if (is_a64(env)) { |
| 154 | return aa64_generate_debug_exceptions(env); |
| 155 | } else { |
| 156 | return aa32_generate_debug_exceptions(env); |
| 157 | } |
| 158 | } |
| 159 | |
| 160 | /* |
| 161 | * Is single-stepping active? (Note that the "is EL_D AArch64?" check |
| 162 | * implicitly means this always returns false in pre-v8 CPUs.) |
| 163 | */ |
| 164 | bool arm_singlestep_active(CPUARMState *env) |
| 165 | { |
| 166 | return extract32(env->cp15.mdscr_el1, 0, 1) |
| 167 | && arm_el_is_aa64(env, arm_debug_target_el(env)) |
| 168 | && arm_generate_debug_exceptions(env); |
| 169 | } |
| 170 | |
| 171 | /* Return true if the linked breakpoint entry lbn passes its checks */ |
| 172 | static bool linked_bp_matches(ARMCPU *cpu, int lbn) |
| 173 | { |
| 174 | CPUARMState *env = &cpu->env; |
| 175 | uint64_t bcr = env->cp15.dbgbcr[lbn]; |
| 176 | int brps = arm_num_brps(cpu); |
| 177 | int ctx_cmps = arm_num_ctx_cmps(cpu); |
| 178 | int bt; |
| 179 | uint32_t contextidr; |
| 180 | uint64_t hcr_el2; |
| 181 | |
| 182 | /* |
| 183 | * Links to unimplemented or non-context aware breakpoints are |
| 184 | * CONSTRAINED UNPREDICTABLE: either behave as if disabled, or |
| 185 | * as if linked to an UNKNOWN context-aware breakpoint (in which |
| 186 | * case DBGWCR<n>_EL1.LBN must indicate that breakpoint). |
| 187 | * We choose the former. |
| 188 | */ |
| 189 | if (lbn >= brps || lbn < (brps - ctx_cmps)) { |
| 190 | return false; |
| 191 | } |
| 192 | |
| 193 | bcr = env->cp15.dbgbcr[lbn]; |
| 194 | |
| 195 | if (extract64(bcr, 0, 1) == 0) { |
| 196 | /* Linked breakpoint disabled : generate no events */ |
| 197 | return false; |
| 198 | } |
| 199 | |
| 200 | bt = extract64(bcr, 20, 4); |
| 201 | hcr_el2 = arm_hcr_el2_eff(env); |
| 202 | |
| 203 | switch (bt) { |
| 204 | case 3: /* linked context ID match */ |
| 205 | switch (arm_current_el(env)) { |
| 206 | default: |
| 207 | /* Context matches never fire in AArch64 EL3 */ |
| 208 | return false; |
| 209 | case 2: |
| 210 | if (!(hcr_el2 & HCR_E2H)) { |
| 211 | /* Context matches never fire in EL2 without E2H enabled. */ |
| 212 | return false; |
| 213 | } |
| 214 | contextidr = env->cp15.contextidr_el[2]; |
| 215 | break; |
| 216 | case 1: |
| 217 | contextidr = env->cp15.contextidr_el[1]; |
| 218 | break; |
| 219 | case 0: |
| 220 | if ((hcr_el2 & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) { |
| 221 | contextidr = env->cp15.contextidr_el[2]; |
| 222 | } else { |
| 223 | contextidr = env->cp15.contextidr_el[1]; |
| 224 | } |
| 225 | break; |
| 226 | } |
| 227 | break; |
| 228 | |
| 229 | case 7: /* linked contextidr_el1 match */ |
| 230 | contextidr = env->cp15.contextidr_el[1]; |
| 231 | break; |
| 232 | case 13: /* linked contextidr_el2 match */ |
| 233 | contextidr = env->cp15.contextidr_el[2]; |
| 234 | break; |
| 235 | |
| 236 | case 9: /* linked VMID match (reserved if no EL2) */ |
| 237 | case 11: /* linked context ID and VMID match (reserved if no EL2) */ |
| 238 | case 15: /* linked full context ID match */ |
| 239 | default: |
| 240 | /* |
| 241 | * Links to Unlinked context breakpoints must generate no |
| 242 | * events; we choose to do the same for reserved values too. |
| 243 | */ |
| 244 | return false; |
| 245 | } |
| 246 | |
| 247 | /* |
| 248 | * We match the whole register even if this is AArch32 using the |
| 249 | * short descriptor format (in which case it holds both PROCID and ASID), |
| 250 | * since we don't implement the optional v7 context ID masking. |
| 251 | */ |
| 252 | return contextidr == (uint32_t)env->cp15.dbgbvr[lbn]; |
| 253 | } |
| 254 | |
| 255 | static bool bp_wp_matches(ARMCPU *cpu, int n, bool is_wp) |
| 256 | { |
| 257 | CPUARMState *env = &cpu->env; |
| 258 | uint64_t cr; |
| 259 | int pac, hmc, ssc, wt, lbn; |
| 260 | /* |
| 261 | * Note that for watchpoints the check is against the CPU security |
| 262 | * state, not the S/NS attribute on the offending data access. |
| 263 | */ |
| 264 | bool is_secure = arm_is_secure(env); |
| 265 | int access_el = arm_current_el(env); |
| 266 | |
| 267 | if (is_wp) { |
| 268 | CPUWatchpoint *wp = env->cpu_watchpoint[n]; |
| 269 | |
| 270 | if (!wp || !(wp->flags & BP_WATCHPOINT_HIT)) { |
| 271 | return false; |
| 272 | } |
| 273 | cr = env->cp15.dbgwcr[n]; |
| 274 | if (wp->hitattrs.user) { |
| 275 | /* |
| 276 | * The LDRT/STRT/LDT/STT "unprivileged access" instructions should |
| 277 | * match watchpoints as if they were accesses done at EL0, even if |
| 278 | * the CPU is at EL1 or higher. |
| 279 | */ |
| 280 | access_el = 0; |
| 281 | } |
| 282 | } else { |
| 283 | uint64_t pc = is_a64(env) ? env->pc : env->regs[15]; |
| 284 | |
| 285 | if (!env->cpu_breakpoint[n] || env->cpu_breakpoint[n]->pc != pc) { |
| 286 | return false; |
| 287 | } |
| 288 | cr = env->cp15.dbgbcr[n]; |
| 289 | } |
| 290 | /* |
| 291 | * The WATCHPOINT_HIT flag guarantees us that the watchpoint is |
| 292 | * enabled and that the address and access type match; for breakpoints |
| 293 | * we know the address matched; check the remaining fields, including |
| 294 | * linked breakpoints. We rely on WCR and BCR having the same layout |
| 295 | * for the LBN, SSC, HMC, PAC/PMC and is-linked fields. |
| 296 | * Note that some combinations of {PAC, HMC, SSC} are reserved and |
| 297 | * must act either like some valid combination or as if the watchpoint |
| 298 | * were disabled. We choose the former, and use this together with |
| 299 | * the fact that EL3 must always be Secure and EL2 must always be |
| 300 | * Non-Secure to simplify the code slightly compared to the full |
| 301 | * table in the ARM ARM. |
| 302 | */ |
| 303 | pac = FIELD_EX64(cr, DBGWCR, PAC); |
| 304 | hmc = FIELD_EX64(cr, DBGWCR, HMC); |
| 305 | ssc = FIELD_EX64(cr, DBGWCR, SSC); |
| 306 | |
| 307 | switch (ssc) { |
| 308 | case 0: |
| 309 | break; |
| 310 | case 1: |
| 311 | case 3: |
| 312 | if (is_secure) { |
| 313 | return false; |
| 314 | } |
| 315 | break; |
| 316 | case 2: |
| 317 | if (!is_secure) { |
| 318 | return false; |
| 319 | } |
| 320 | break; |
| 321 | } |
| 322 | |
| 323 | switch (access_el) { |
| 324 | case 3: |
| 325 | case 2: |
| 326 | if (!hmc) { |
| 327 | return false; |
| 328 | } |
| 329 | break; |
| 330 | case 1: |
| 331 | if (extract32(pac, 0, 1) == 0) { |
| 332 | return false; |
| 333 | } |
| 334 | break; |
| 335 | case 0: |
| 336 | if (extract32(pac, 1, 1) == 0) { |
| 337 | return false; |
| 338 | } |
| 339 | break; |
| 340 | default: |
| 341 | g_assert_not_reached(); |
| 342 | } |
| 343 | |
| 344 | wt = FIELD_EX64(cr, DBGWCR, WT); |
| 345 | lbn = FIELD_EX64(cr, DBGWCR, LBN); |
| 346 | |
| 347 | if (wt && !linked_bp_matches(cpu, lbn)) { |
| 348 | return false; |
| 349 | } |
| 350 | |
| 351 | return true; |
| 352 | } |
| 353 | |
| 354 | bool arm_debug_check_breakpoint(CPUState *cs) |
| 355 | { |
| 356 | ARMCPU *cpu = ARM_CPU(cs); |
| 357 | CPUARMState *env = &cpu->env; |
| 358 | vaddr pc; |
| 359 | int n; |
| 360 | |
| 361 | /* |
| 362 | * If breakpoints are disabled globally or we can't take debug |
| 363 | * exceptions here then breakpoint firings are ignored. |
| 364 | */ |
| 365 | if (extract32(env->cp15.mdscr_el1, 15, 1) == 0 |
| 366 | || !arm_generate_debug_exceptions(env)) { |
| 367 | return false; |
| 368 | } |
| 369 | |
| 370 | /* |
| 371 | * Single-step exceptions have priority over breakpoint exceptions. |
| 372 | * If single-step state is active-pending, suppress the bp. |
| 373 | */ |
| 374 | if (arm_singlestep_active(env) && !(env->pstate & PSTATE_SS)) { |
| 375 | return false; |
| 376 | } |
| 377 | |
| 378 | /* |
| 379 | * PC alignment faults have priority over breakpoint exceptions. |
| 380 | */ |
| 381 | pc = is_a64(env) ? env->pc : env->regs[15]; |
| 382 | if ((is_a64(env) || !env->thumb) && (pc & 3) != 0) { |
| 383 | return false; |
| 384 | } |
| 385 | |
| 386 | /* |
| 387 | * Instruction aborts have priority over breakpoint exceptions. |
| 388 | * TODO: We would need to look up the page for PC and verify that |
| 389 | * it is present and executable. |
| 390 | */ |
| 391 | |
| 392 | for (n = 0; n < ARRAY_SIZE(env->cpu_breakpoint); n++) { |
| 393 | if (bp_wp_matches(cpu, n, false)) { |
| 394 | return true; |
| 395 | } |
| 396 | } |
| 397 | return false; |
| 398 | } |
| 399 | |
| 400 | bool arm_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp) |
| 401 | { |
| 402 | /* |
| 403 | * Called by core code when a CPU watchpoint fires; need to check if this |
| 404 | * is also an architectural watchpoint match. |
| 405 | */ |
| 406 | ARMCPU *cpu = ARM_CPU(cs); |
| 407 | CPUARMState *env = &cpu->env; |
| 408 | int n; |
| 409 | |
| 410 | /* |
| 411 | * If watchpoints are disabled globally or we can't take debug |
| 412 | * exceptions here then watchpoint firings are ignored. |
| 413 | */ |
| 414 | if (extract32(env->cp15.mdscr_el1, 15, 1) == 0 |
| 415 | || !arm_generate_debug_exceptions(env)) { |
| 416 | return false; |
| 417 | } |
| 418 | |
| 419 | for (n = 0; n < ARRAY_SIZE(env->cpu_watchpoint); n++) { |
| 420 | if (bp_wp_matches(cpu, n, true)) { |
| 421 | return true; |
| 422 | } |
| 423 | } |
| 424 | return false; |
| 425 | } |
| 426 | |
| 427 | /* |
| 428 | * Return the FSR value for a debug exception (watchpoint, hardware |
| 429 | * breakpoint or BKPT insn) targeting the specified exception level. |
| 430 | */ |
| 431 | static uint32_t arm_debug_exception_fsr(CPUARMState *env) |
| 432 | { |
| 433 | ARMMMUFaultInfo fi = { .type = ARMFault_Debug }; |
| 434 | int target_el = arm_debug_target_el(env); |
| 435 | bool using_lpae; |
| 436 | |
| 437 | if (arm_feature(env, ARM_FEATURE_M)) { |
| 438 | using_lpae = false; |
| 439 | } else if (target_el == 2 || arm_el_is_aa64(env, target_el)) { |
| 440 | using_lpae = true; |
| 441 | } else if (arm_feature(env, ARM_FEATURE_PMSA) && |
| 442 | arm_feature(env, ARM_FEATURE_V8)) { |
| 443 | using_lpae = true; |
| 444 | } else if (arm_feature(env, ARM_FEATURE_LPAE) && |
| 445 | (env->cp15.tcr_el[target_el] & TTBCR_EAE)) { |
| 446 | using_lpae = true; |
| 447 | } else { |
| 448 | using_lpae = false; |
| 449 | } |
| 450 | |
| 451 | if (using_lpae) { |
| 452 | return arm_fi_to_lfsc(&fi); |
| 453 | } else { |
| 454 | return arm_fi_to_sfsc(&fi); |
| 455 | } |
| 456 | } |
| 457 | |
| 458 | void arm_debug_excp_handler(CPUState *cs) |
| 459 | { |
| 460 | /* |
| 461 | * Called by core code when a watchpoint or breakpoint fires; |
| 462 | * need to check which one and raise the appropriate exception. |
| 463 | */ |
| 464 | ARMCPU *cpu = ARM_CPU(cs); |
| 465 | CPUARMState *env = &cpu->env; |
| 466 | CPUWatchpoint *wp_hit = cs->watchpoint_hit; |
| 467 | |
| 468 | if (wp_hit) { |
| 469 | if (wp_hit->flags & BP_CPU) { |
| 470 | bool wnr = (wp_hit->flags & BP_WATCHPOINT_HIT_WRITE) != 0; |
| 471 | |
| 472 | cs->watchpoint_hit = NULL; |
| 473 | |
| 474 | env->exception.fsr = arm_debug_exception_fsr(env); |
| 475 | env->exception.vaddress = wp_hit->hitaddr; |
| 476 | raise_exception_debug(env, EXCP_DATA_ABORT, |
| 477 | syn_watchpoint(0, 0, wnr)); |
| 478 | } |
| 479 | } else { |
| 480 | uint64_t pc = is_a64(env) ? env->pc : env->regs[15]; |
| 481 | |
| 482 | /* |
| 483 | * (1) GDB breakpoints should be handled first. |
| 484 | * (2) Do not raise a CPU exception if no CPU breakpoint has fired, |
| 485 | * since singlestep is also done by generating a debug internal |
| 486 | * exception. |
| 487 | */ |
| 488 | if (cpu_breakpoint_test(cs, pc, BP_GDB) |
| 489 | || !cpu_breakpoint_test(cs, pc, BP_CPU)) { |
| 490 | return; |
| 491 | } |
| 492 | |
| 493 | env->exception.fsr = arm_debug_exception_fsr(env); |
| 494 | /* |
| 495 | * FAR is UNKNOWN: clear vaddress to avoid potentially exposing |
| 496 | * values to the guest that it shouldn't be able to see at its |
| 497 | * exception/security level. |
| 498 | */ |
| 499 | env->exception.vaddress = 0; |
| 500 | raise_exception_debug(env, EXCP_PREFETCH_ABORT, syn_breakpoint(0)); |
| 501 | } |
| 502 | } |
| 503 | |
| 504 | /* |
| 505 | * Raise an EXCP_BKPT with the specified syndrome register value, |
| 506 | * targeting the correct exception level for debug exceptions. |
| 507 | */ |
| 508 | void HELPER(exception_bkpt_insn)(CPUARMState *env, uint32_t syndrome) |
| 509 | { |
| 510 | int debug_el = arm_debug_target_el(env); |
| 511 | int cur_el = arm_current_el(env); |
| 512 | |
| 513 | /* FSR will only be used if the debug target EL is AArch32. */ |
| 514 | env->exception.fsr = arm_debug_exception_fsr(env); |
| 515 | /* |
| 516 | * FAR is UNKNOWN: clear vaddress to avoid potentially exposing |
| 517 | * values to the guest that it shouldn't be able to see at its |
| 518 | * exception/security level. |
| 519 | */ |
| 520 | env->exception.vaddress = 0; |
| 521 | /* |
| 522 | * Other kinds of architectural debug exception are ignored if |
| 523 | * they target an exception level below the current one (in QEMU |
| 524 | * this is checked by arm_generate_debug_exceptions()). Breakpoint |
| 525 | * instructions are special because they always generate an exception |
| 526 | * to somewhere: if they can't go to the configured debug exception |
| 527 | * level they are taken to the current exception level. |
| 528 | */ |
| 529 | if (debug_el < cur_el) { |
| 530 | debug_el = cur_el; |
| 531 | } |
| 532 | raise_exception(env, EXCP_BKPT, syndrome, debug_el); |
| 533 | } |
| 534 | |
| 535 | void HELPER(exception_swstep)(CPUARMState *env, uint32_t syndrome) |
| 536 | { |
| 537 | raise_exception_debug(env, EXCP_UDEF, syndrome); |
| 538 | } |
| 539 | |
| 540 | void hw_watchpoint_update(ARMCPU *cpu, int n) |
| 541 | { |
| 542 | CPUARMState *env = &cpu->env; |
| 543 | vaddr len = 0; |
| 544 | vaddr wvr = env->cp15.dbgwvr[n]; |
| 545 | uint64_t wcr = env->cp15.dbgwcr[n]; |
| 546 | int mask; |
| 547 | int flags = BP_CPU | BP_STOP_BEFORE_ACCESS; |
| 548 | |
| 549 | if (env->cpu_watchpoint[n]) { |
| 550 | cpu_watchpoint_remove_by_ref(CPU(cpu), env->cpu_watchpoint[n]); |
| 551 | env->cpu_watchpoint[n] = NULL; |
| 552 | } |
| 553 | |
| 554 | if (!FIELD_EX64(wcr, DBGWCR, E)) { |
| 555 | /* E bit clear : watchpoint disabled */ |
| 556 | return; |
| 557 | } |
| 558 | |
| 559 | switch (FIELD_EX64(wcr, DBGWCR, LSC)) { |
| 560 | case 0: |
| 561 | /* LSC 00 is reserved and must behave as if the wp is disabled */ |
| 562 | return; |
| 563 | case 1: |
| 564 | flags |= BP_MEM_READ; |
| 565 | break; |
| 566 | case 2: |
| 567 | flags |= BP_MEM_WRITE; |
| 568 | break; |
| 569 | case 3: |
| 570 | flags |= BP_MEM_ACCESS; |
| 571 | break; |
| 572 | } |
| 573 | |
| 574 | /* |
| 575 | * Attempts to use both MASK and BAS fields simultaneously are |
| 576 | * CONSTRAINED UNPREDICTABLE; we opt to ignore BAS in this case, |
| 577 | * thus generating a watchpoint for every byte in the masked region. |
| 578 | */ |
| 579 | mask = FIELD_EX64(wcr, DBGWCR, MASK); |
| 580 | if (mask == 1 || mask == 2) { |
| 581 | /* |
| 582 | * Reserved values of MASK; we must act as if the mask value was |
| 583 | * some non-reserved value, or as if the watchpoint were disabled. |
| 584 | * We choose the latter. |
| 585 | */ |
| 586 | return; |
| 587 | } else if (mask) { |
| 588 | /* Watchpoint covers an aligned area up to 2GB in size */ |
| 589 | len = 1ULL << mask; |
| 590 | /* |
| 591 | * If masked bits in WVR are not zero it's CONSTRAINED UNPREDICTABLE |
| 592 | * whether the watchpoint fires when the unmasked bits match; we opt |
| 593 | * to generate the exceptions. |
| 594 | */ |
| 595 | wvr &= ~(len - 1); |
| 596 | } else { |
| 597 | /* Watchpoint covers bytes defined by the byte address select bits */ |
| 598 | int bas = FIELD_EX64(wcr, DBGWCR, BAS); |
| 599 | int basstart; |
| 600 | |
| 601 | if (extract64(wvr, 2, 1)) { |
| 602 | /* |
| 603 | * Deprecated case of an only 4-aligned address. BAS[7:4] are |
| 604 | * ignored, and BAS[3:0] define which bytes to watch. |
| 605 | */ |
| 606 | bas &= 0xf; |
| 607 | } |
| 608 | |
| 609 | if (bas == 0) { |
| 610 | /* This must act as if the watchpoint is disabled */ |
| 611 | return; |
| 612 | } |
| 613 | |
| 614 | /* |
| 615 | * The BAS bits are supposed to be programmed to indicate a contiguous |
| 616 | * range of bytes. Otherwise it is CONSTRAINED UNPREDICTABLE whether |
| 617 | * we fire for each byte in the word/doubleword addressed by the WVR. |
| 618 | * We choose to ignore any non-zero bits after the first range of 1s. |
| 619 | */ |
| 620 | basstart = ctz32(bas); |
| 621 | len = cto32(bas >> basstart); |
| 622 | wvr += basstart; |
| 623 | } |
| 624 | |
| 625 | cpu_watchpoint_insert(CPU(cpu), wvr, len, flags, |
| 626 | &env->cpu_watchpoint[n]); |
| 627 | } |
| 628 | |
| 629 | void hw_watchpoint_update_all(ARMCPU *cpu) |
| 630 | { |
| 631 | int i; |
| 632 | CPUARMState *env = &cpu->env; |
| 633 | |
| 634 | /* |
| 635 | * Completely clear out existing QEMU watchpoints and our array, to |
| 636 | * avoid possible stale entries following migration load. |
| 637 | */ |
| 638 | cpu_watchpoint_remove_all(CPU(cpu), BP_CPU); |
| 639 | memset(env->cpu_watchpoint, 0, sizeof(env->cpu_watchpoint)); |
| 640 | |
| 641 | for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_watchpoint); i++) { |
| 642 | hw_watchpoint_update(cpu, i); |
| 643 | } |
| 644 | } |
| 645 | |
| 646 | void hw_breakpoint_update(ARMCPU *cpu, int n) |
| 647 | { |
| 648 | CPUARMState *env = &cpu->env; |
| 649 | uint64_t bvr = env->cp15.dbgbvr[n]; |
| 650 | uint64_t bcr = env->cp15.dbgbcr[n]; |
| 651 | vaddr addr; |
| 652 | int bt; |
| 653 | int flags = BP_CPU; |
| 654 | |
| 655 | if (env->cpu_breakpoint[n]) { |
| 656 | cpu_breakpoint_remove_by_ref(CPU(cpu), env->cpu_breakpoint[n]); |
| 657 | env->cpu_breakpoint[n] = NULL; |
| 658 | } |
| 659 | |
| 660 | if (!extract64(bcr, 0, 1)) { |
| 661 | /* E bit clear : watchpoint disabled */ |
| 662 | return; |
| 663 | } |
| 664 | |
| 665 | bt = extract64(bcr, 20, 4); |
| 666 | |
| 667 | switch (bt) { |
| 668 | case 4: /* unlinked address mismatch (reserved if AArch64) */ |
| 669 | case 5: /* linked address mismatch (reserved if AArch64) */ |
| 670 | qemu_log_mask(LOG_UNIMP, |
| 671 | "arm: address mismatch breakpoint types not implemented\n"); |
| 672 | return; |
| 673 | case 0: /* unlinked address match */ |
| 674 | case 1: /* linked address match */ |
| 675 | { |
| 676 | /* |
| 677 | * Bits [1:0] are RES0. |
| 678 | * |
| 679 | * It is IMPLEMENTATION DEFINED whether bits [63:49] |
| 680 | * ([63:53] for FEAT_LVA) are hardwired to a copy of the sign bit |
| 681 | * of the VA field ([48] or [52] for FEAT_LVA), or whether the |
| 682 | * value is read as written. It is CONSTRAINED UNPREDICTABLE |
| 683 | * whether the RESS bits are ignored when comparing an address. |
| 684 | * Therefore we are allowed to compare the entire register, which |
| 685 | * lets us avoid considering whether FEAT_LVA is actually enabled. |
| 686 | * |
| 687 | * The BAS field is used to allow setting breakpoints on 16-bit |
| 688 | * wide instructions; it is CONSTRAINED UNPREDICTABLE whether |
| 689 | * a bp will fire if the addresses covered by the bp and the addresses |
| 690 | * covered by the insn overlap but the insn doesn't start at the |
| 691 | * start of the bp address range. We choose to require the insn and |
| 692 | * the bp to have the same address. The constraints on writing to |
| 693 | * BAS enforced in dbgbcr_write mean we have only four cases: |
| 694 | * 0b0000 => no breakpoint |
| 695 | * 0b0011 => breakpoint on addr |
| 696 | * 0b1100 => breakpoint on addr + 2 |
| 697 | * 0b1111 => breakpoint on addr |
| 698 | * See also figure D2-3 in the v8 ARM ARM (DDI0487A.c). |
| 699 | */ |
| 700 | int bas = extract64(bcr, 5, 4); |
| 701 | addr = bvr & ~3ULL; |
| 702 | if (bas == 0) { |
| 703 | return; |
| 704 | } |
| 705 | if (bas == 0xc) { |
| 706 | addr += 2; |
| 707 | } |
| 708 | break; |
| 709 | } |
| 710 | case 2: /* unlinked context ID match */ |
| 711 | case 8: /* unlinked VMID match (reserved if no EL2) */ |
| 712 | case 10: /* unlinked context ID and VMID match (reserved if no EL2) */ |
| 713 | qemu_log_mask(LOG_UNIMP, |
| 714 | "arm: unlinked context breakpoint types not implemented\n"); |
| 715 | return; |
| 716 | case 9: /* linked VMID match (reserved if no EL2) */ |
| 717 | case 11: /* linked context ID and VMID match (reserved if no EL2) */ |
| 718 | case 3: /* linked context ID match */ |
| 719 | default: |
| 720 | /* |
| 721 | * We must generate no events for Linked context matches (unless |
| 722 | * they are linked to by some other bp/wp, which is handled in |
| 723 | * updates for the linking bp/wp). We choose to also generate no events |
| 724 | * for reserved values. |
| 725 | */ |
| 726 | return; |
| 727 | } |
| 728 | |
| 729 | cpu_breakpoint_insert(CPU(cpu), addr, flags, &env->cpu_breakpoint[n]); |
| 730 | } |
| 731 | |
| 732 | void hw_breakpoint_update_all(ARMCPU *cpu) |
| 733 | { |
| 734 | int i; |
| 735 | CPUARMState *env = &cpu->env; |
| 736 | |
| 737 | /* |
| 738 | * Completely clear out existing QEMU breakpoints and our array, to |
| 739 | * avoid possible stale entries following migration load. |
| 740 | */ |
| 741 | cpu_breakpoint_remove_all(CPU(cpu), BP_CPU); |
| 742 | memset(env->cpu_breakpoint, 0, sizeof(env->cpu_breakpoint)); |
| 743 | |
| 744 | for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_breakpoint); i++) { |
| 745 | hw_breakpoint_update(cpu, i); |
| 746 | } |
| 747 | } |
| 748 | |
| 749 | #if !defined(CONFIG_USER_ONLY) |
| 750 | |
| 751 | vaddr arm_adjust_watchpoint_address(CPUState *cs, vaddr addr, int len) |
| 752 | { |
| 753 | ARMCPU *cpu = ARM_CPU(cs); |
| 754 | CPUARMState *env = &cpu->env; |
| 755 | |
| 756 | /* |
| 757 | * In BE32 system mode, target memory is stored byteswapped (on a |
| 758 | * little-endian host system), and by the time we reach here (via an |
| 759 | * opcode helper) the addresses of subword accesses have been adjusted |
| 760 | * to account for that, which means that watchpoints will not match. |
| 761 | * Undo the adjustment here. |
| 762 | */ |
| 763 | if (arm_sctlr_b(env)) { |
| 764 | if (len == 1) { |
| 765 | addr ^= 3; |
| 766 | } else if (len == 2) { |
| 767 | addr ^= 2; |
| 768 | } |
| 769 | } |
| 770 | |
| 771 | return addr; |
| 772 | } |
| 773 | |
| 774 | #endif /* !CONFIG_USER_ONLY */ |