| 1 | /* |
| 2 | * i386 breakpoint helpers - system code |
| 3 | * |
| 4 | * Copyright (c) 2003 Fabrice Bellard |
| 5 | * |
| 6 | * This library is free software; you can redistribute it and/or |
| 7 | * modify it under the terms of the GNU Lesser General Public |
| 8 | * License as published by the Free Software Foundation; either |
| 9 | * version 2.1 of the License, or (at your option) any later version. |
| 10 | * |
| 11 | * This library is distributed in the hope that it will be useful, |
| 12 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 13 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
| 14 | * Lesser General Public License for more details. |
| 15 | * |
| 16 | * You should have received a copy of the GNU Lesser General Public |
| 17 | * License along with this library; if not, see <http://www.gnu.org/licenses/>. |
| 18 | */ |
| 19 | |
| 20 | #include "qemu/osdep.h" |
| 21 | #include "accel/tcg/cpu-loop.h" |
| 22 | #include "cpu.h" |
| 23 | #include "exec/helper-proto.h" |
| 24 | #include "exec/watchpoint.h" |
| 25 | #include "tcg/helper-tcg.h" |
| 26 | |
| 27 | |
| 28 | static inline bool hw_local_breakpoint_enabled(unsigned long dr7, int index) |
| 29 | { |
| 30 | return (dr7 >> (index * 2)) & 1; |
| 31 | } |
| 32 | |
| 33 | static inline bool hw_global_breakpoint_enabled(unsigned long dr7, int index) |
| 34 | { |
| 35 | return (dr7 >> (index * 2)) & 2; |
| 36 | |
| 37 | } |
| 38 | static inline bool hw_breakpoint_enabled(unsigned long dr7, int index) |
| 39 | { |
| 40 | return hw_global_breakpoint_enabled(dr7, index) || |
| 41 | hw_local_breakpoint_enabled(dr7, index); |
| 42 | } |
| 43 | |
| 44 | static inline int hw_breakpoint_type(unsigned long dr7, int index) |
| 45 | { |
| 46 | return (dr7 >> (DR7_TYPE_SHIFT + (index * 4))) & 3; |
| 47 | } |
| 48 | |
| 49 | static inline int hw_breakpoint_len(unsigned long dr7, int index) |
| 50 | { |
| 51 | int len = ((dr7 >> (DR7_LEN_SHIFT + (index * 4))) & 3); |
| 52 | return (len == 2) ? 8 : len + 1; |
| 53 | } |
| 54 | |
| 55 | static int hw_breakpoint_insert(CPUX86State *env, int index) |
| 56 | { |
| 57 | CPUState *cs = env_cpu(env); |
| 58 | target_ulong dr7 = env->dr[7]; |
| 59 | target_ulong drN = env->dr[index]; |
| 60 | int err = 0; |
| 61 | |
| 62 | switch (hw_breakpoint_type(dr7, index)) { |
| 63 | case DR7_TYPE_BP_INST: |
| 64 | if (hw_breakpoint_enabled(dr7, index)) { |
| 65 | err = cpu_breakpoint_insert(cs, drN, BP_CPU, |
| 66 | &env->cpu_breakpoint[index]); |
| 67 | } |
| 68 | break; |
| 69 | |
| 70 | case DR7_TYPE_IO_RW: |
| 71 | /* Notice when we should enable calls to bpt_io. */ |
| 72 | return hw_breakpoint_enabled(env->dr[7], index) |
| 73 | ? HF_IOBPT_MASK : 0; |
| 74 | |
| 75 | case DR7_TYPE_DATA_WR: |
| 76 | if (hw_breakpoint_enabled(dr7, index)) { |
| 77 | err = cpu_watchpoint_insert(cs, drN, |
| 78 | hw_breakpoint_len(dr7, index), |
| 79 | BP_CPU | BP_MEM_WRITE, |
| 80 | &env->cpu_watchpoint[index]); |
| 81 | } |
| 82 | break; |
| 83 | |
| 84 | case DR7_TYPE_DATA_RW: |
| 85 | if (hw_breakpoint_enabled(dr7, index)) { |
| 86 | err = cpu_watchpoint_insert(cs, drN, |
| 87 | hw_breakpoint_len(dr7, index), |
| 88 | BP_CPU | BP_MEM_ACCESS, |
| 89 | &env->cpu_watchpoint[index]); |
| 90 | } |
| 91 | break; |
| 92 | } |
| 93 | if (err) { |
| 94 | env->cpu_breakpoint[index] = NULL; |
| 95 | } |
| 96 | return 0; |
| 97 | } |
| 98 | |
| 99 | static void hw_breakpoint_remove(CPUX86State *env, int index) |
| 100 | { |
| 101 | CPUState *cs = env_cpu(env); |
| 102 | |
| 103 | switch (hw_breakpoint_type(env->dr[7], index)) { |
| 104 | case DR7_TYPE_BP_INST: |
| 105 | if (env->cpu_breakpoint[index]) { |
| 106 | cpu_breakpoint_remove_by_ref(cs, env->cpu_breakpoint[index]); |
| 107 | env->cpu_breakpoint[index] = NULL; |
| 108 | } |
| 109 | break; |
| 110 | |
| 111 | case DR7_TYPE_DATA_WR: |
| 112 | case DR7_TYPE_DATA_RW: |
| 113 | if (env->cpu_watchpoint[index]) { |
| 114 | cpu_watchpoint_remove_by_ref(cs, env->cpu_watchpoint[index]); |
| 115 | env->cpu_watchpoint[index] = NULL; |
| 116 | } |
| 117 | break; |
| 118 | |
| 119 | case DR7_TYPE_IO_RW: |
| 120 | /* HF_IOBPT_MASK cleared elsewhere. */ |
| 121 | break; |
| 122 | } |
| 123 | } |
| 124 | |
| 125 | void cpu_x86_update_dr7(CPUX86State *env, uint32_t new_dr7) |
| 126 | { |
| 127 | target_ulong old_dr7 = env->dr[7]; |
| 128 | int iobpt = 0; |
| 129 | int i; |
| 130 | |
| 131 | new_dr7 |= DR7_FIXED_1; |
| 132 | |
| 133 | /* If nothing is changing except the global/local enable bits, |
| 134 | then we can make the change more efficient. */ |
| 135 | if (((old_dr7 ^ new_dr7) & ~0xff) == 0) { |
| 136 | /* Fold the global and local enable bits together into the |
| 137 | global fields, then xor to show which registers have |
| 138 | changed collective enable state. */ |
| 139 | int mod = ((old_dr7 | old_dr7 * 2) ^ (new_dr7 | new_dr7 * 2)) & 0xff; |
| 140 | |
| 141 | for (i = 0; i < DR7_MAX_BP; i++) { |
| 142 | if ((mod & (2 << i * 2)) && !hw_breakpoint_enabled(new_dr7, i)) { |
| 143 | hw_breakpoint_remove(env, i); |
| 144 | } |
| 145 | } |
| 146 | env->dr[7] = new_dr7; |
| 147 | for (i = 0; i < DR7_MAX_BP; i++) { |
| 148 | if (mod & (2 << i * 2) && hw_breakpoint_enabled(new_dr7, i)) { |
| 149 | iobpt |= hw_breakpoint_insert(env, i); |
| 150 | } else if (hw_breakpoint_type(new_dr7, i) == DR7_TYPE_IO_RW |
| 151 | && hw_breakpoint_enabled(new_dr7, i)) { |
| 152 | iobpt |= HF_IOBPT_MASK; |
| 153 | } |
| 154 | } |
| 155 | } else { |
| 156 | for (i = 0; i < DR7_MAX_BP; i++) { |
| 157 | hw_breakpoint_remove(env, i); |
| 158 | } |
| 159 | env->dr[7] = new_dr7; |
| 160 | for (i = 0; i < DR7_MAX_BP; i++) { |
| 161 | iobpt |= hw_breakpoint_insert(env, i); |
| 162 | } |
| 163 | } |
| 164 | |
| 165 | env->hflags = (env->hflags & ~HF_IOBPT_MASK) | iobpt; |
| 166 | } |
| 167 | |
| 168 | bool check_hw_breakpoints(CPUX86State *env, bool force_dr6_update) |
| 169 | { |
| 170 | target_ulong dr6; |
| 171 | int reg; |
| 172 | bool hit_enabled = false; |
| 173 | |
| 174 | dr6 = env->dr[6] & ~0xf; |
| 175 | for (reg = 0; reg < DR7_MAX_BP; reg++) { |
| 176 | bool bp_match = false; |
| 177 | bool wp_match = false; |
| 178 | |
| 179 | switch (hw_breakpoint_type(env->dr[7], reg)) { |
| 180 | case DR7_TYPE_BP_INST: |
| 181 | if (env->dr[reg] == env->eip) { |
| 182 | bp_match = true; |
| 183 | } |
| 184 | break; |
| 185 | case DR7_TYPE_DATA_WR: |
| 186 | case DR7_TYPE_DATA_RW: |
| 187 | if (env->cpu_watchpoint[reg] && |
| 188 | env->cpu_watchpoint[reg]->flags & BP_WATCHPOINT_HIT) { |
| 189 | wp_match = true; |
| 190 | } |
| 191 | break; |
| 192 | case DR7_TYPE_IO_RW: |
| 193 | break; |
| 194 | } |
| 195 | if (bp_match || wp_match) { |
| 196 | dr6 |= 1 << reg; |
| 197 | if (hw_breakpoint_enabled(env->dr[7], reg)) { |
| 198 | hit_enabled = true; |
| 199 | } |
| 200 | } |
| 201 | } |
| 202 | |
| 203 | if (hit_enabled || force_dr6_update) { |
| 204 | env->dr[6] = dr6; |
| 205 | } |
| 206 | |
| 207 | return hit_enabled; |
| 208 | } |
| 209 | |
| 210 | void breakpoint_handler(CPUState *cs) |
| 211 | { |
| 212 | X86CPU *cpu = X86_CPU(cs); |
| 213 | CPUX86State *env = &cpu->env; |
| 214 | |
| 215 | if (cs->watchpoint_hit) { |
| 216 | if (cs->watchpoint_hit->flags & BP_CPU) { |
| 217 | cs->watchpoint_hit = NULL; |
| 218 | if (check_hw_breakpoints(env, false)) { |
| 219 | /* |
| 220 | * FIXME: #DB should be delayed by one instruction if |
| 221 | * INHIBIT_IRQ is set (STI cannot trigger a watchpoint). |
| 222 | * The delayed #DB should also fuse with one generated |
| 223 | * by ICEBP (aka INT1). |
| 224 | */ |
| 225 | raise_exception(env, EXCP01_DB); |
| 226 | } else { |
| 227 | cpu_loop_exit_noexc(cs); |
| 228 | } |
| 229 | } |
| 230 | } else { |
| 231 | if (cpu_breakpoint_test(cs, env->eip, BP_CPU)) { |
| 232 | check_hw_breakpoints(env, true); |
| 233 | raise_exception(env, EXCP01_DB); |
| 234 | } |
| 235 | } |
| 236 | } |
| 237 | |
| 238 | target_ulong helper_get_dr(CPUX86State *env, int reg) |
| 239 | { |
| 240 | if (reg >= 4 && reg < 6) { |
| 241 | if (env->cr[4] & CR4_DE_MASK) { |
| 242 | raise_exception_ra(env, EXCP06_ILLOP, GETPC()); |
| 243 | } else { |
| 244 | reg += 2; |
| 245 | } |
| 246 | } |
| 247 | |
| 248 | if (env->dr[7] & DR7_GD) { |
| 249 | env->dr[7] &= ~DR7_GD; |
| 250 | env->dr[6] |= DR6_BD; |
| 251 | raise_exception_ra(env, EXCP01_DB, GETPC()); |
| 252 | } |
| 253 | |
| 254 | return env->dr[reg]; |
| 255 | } |
| 256 | |
| 257 | void helper_set_dr(CPUX86State *env, int reg, target_ulong t0) |
| 258 | { |
| 259 | if (reg >= 4 && reg < 6) { |
| 260 | if (env->cr[4] & CR4_DE_MASK) { |
| 261 | raise_exception_ra(env, EXCP06_ILLOP, GETPC()); |
| 262 | } else { |
| 263 | reg += 2; |
| 264 | } |
| 265 | } |
| 266 | |
| 267 | if (env->dr[7] & DR7_GD) { |
| 268 | env->dr[7] &= ~DR7_GD; |
| 269 | env->dr[6] |= DR6_BD; |
| 270 | raise_exception_ra(env, EXCP01_DB, GETPC()); |
| 271 | } |
| 272 | |
| 273 | if (reg < 4) { |
| 274 | if (hw_breakpoint_enabled(env->dr[7], reg) |
| 275 | && hw_breakpoint_type(env->dr[7], reg) != DR7_TYPE_IO_RW) { |
| 276 | hw_breakpoint_remove(env, reg); |
| 277 | env->dr[reg] = t0; |
| 278 | hw_breakpoint_insert(env, reg); |
| 279 | } else { |
| 280 | env->dr[reg] = t0; |
| 281 | } |
| 282 | } else { |
| 283 | if (t0 & DR_RESERVED_MASK) { |
| 284 | raise_exception_err_ra(env, EXCP0D_GPF, 0, GETPC()); |
| 285 | } |
| 286 | if (reg == 6) { |
| 287 | env->dr[6] = t0 | DR6_FIXED_1; |
| 288 | } else { |
| 289 | cpu_x86_update_dr7(env, t0); |
| 290 | } |
| 291 | } |
| 292 | } |
| 293 | |
| 294 | /* Check if Port I/O is trapped by a breakpoint. */ |
| 295 | void helper_bpt_io(CPUX86State *env, uint32_t port, |
| 296 | uint32_t size, target_ulong next_eip) |
| 297 | { |
| 298 | target_ulong dr7 = env->dr[7]; |
| 299 | int i, hit = 0; |
| 300 | |
| 301 | for (i = 0; i < DR7_MAX_BP; ++i) { |
| 302 | if (hw_breakpoint_type(dr7, i) == DR7_TYPE_IO_RW |
| 303 | && hw_breakpoint_enabled(dr7, i)) { |
| 304 | int bpt_len = hw_breakpoint_len(dr7, i); |
| 305 | if (port + size - 1 >= env->dr[i] |
| 306 | && port <= env->dr[i] + bpt_len - 1) { |
| 307 | hit |= 1 << i; |
| 308 | } |
| 309 | } |
| 310 | } |
| 311 | |
| 312 | if (hit) { |
| 313 | env->dr[6] = (env->dr[6] & ~0xf) | hit; |
| 314 | env->eip = next_eip; |
| 315 | raise_exception(env, EXCP01_DB); |
| 316 | } |
| 317 | } |