target/arm/debug_helper.c

   1 /*
   2  * ARM debug helpers.
   3  *
   4  * This code is licensed under the GNU GPL v2 or later.
   5  *
   6  * SPDX-License-Identifier: GPL-2.0-or-later
   7  */
   8 #include "qemu/osdep.h"
   9 #include "cpu.h"
  10 #include "internals.h"
  11 #include "exec/exec-all.h"
  12 #include "exec/helper-proto.h"
  13
  14 /* Return true if the linked breakpoint entry lbn passes its checks */
  15 static bool linked_bp_matches(ARMCPU *cpu, int lbn)
  16 {
  17     CPUARMState *env = &cpu->env;
  18     uint64_t bcr = env->cp15.dbgbcr[lbn];
  19     int brps = arm_num_brps(cpu);
  20     int ctx_cmps = arm_num_ctx_cmps(cpu);
  21     int bt;
  22     uint32_t contextidr;
  23     uint64_t hcr_el2;
  24
  25     /*
  26      * Links to unimplemented or non-context aware breakpoints are
  27      * CONSTRAINED UNPREDICTABLE: either behave as if disabled, or
  28      * as if linked to an UNKNOWN context-aware breakpoint (in which
  29      * case DBGWCR<n>_EL1.LBN must indicate that breakpoint).
  30      * We choose the former.
  31      */
  32     if (lbn >= brps || lbn < (brps - ctx_cmps)) {
  33         return false;
  34     }
  35
  36     bcr = env->cp15.dbgbcr[lbn];
  37
  38     if (extract64(bcr, 0, 1) == 0) {
  39         /* Linked breakpoint disabled : generate no events */
  40         return false;
  41     }
  42
  43     bt = extract64(bcr, 20, 4);
  44     hcr_el2 = arm_hcr_el2_eff(env);
  45
  46     switch (bt) {
  47     case 3: /* linked context ID match */
  48         switch (arm_current_el(env)) {
  49         default:
  50             /* Context matches never fire in AArch64 EL3 */
  51             return false;
  52         case 2:
  53             if (!(hcr_el2 & HCR_E2H)) {
  54                 /* Context matches never fire in EL2 without E2H enabled. */
  55                 return false;
  56             }
  57             contextidr = env->cp15.contextidr_el[2];
  58             break;
  59         case 1:
  60             contextidr = env->cp15.contextidr_el[1];
  61             break;
  62         case 0:
  63             if ((hcr_el2 & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) {
  64                 contextidr = env->cp15.contextidr_el[2];
  65             } else {
  66                 contextidr = env->cp15.contextidr_el[1];
  67             }
  68             break;
  69         }
  70         break;
  71
  72     case 7:  /* linked contextidr_el1 match */
  73         contextidr = env->cp15.contextidr_el[1];
  74         break;
  75     case 13: /* linked contextidr_el2 match */
  76         contextidr = env->cp15.contextidr_el[2];
  77         break;
  78
  79     case 9: /* linked VMID match (reserved if no EL2) */
  80     case 11: /* linked context ID and VMID match (reserved if no EL2) */
  81     case 15: /* linked full context ID match */
  82     default:
  83         /*
  84          * Links to Unlinked context breakpoints must generate no
  85          * events; we choose to do the same for reserved values too.
  86          */
  87         return false;
  88     }
  89
  90     /*
  91      * We match the whole register even if this is AArch32 using the
  92      * short descriptor format (in which case it holds both PROCID and ASID),
  93      * since we don't implement the optional v7 context ID masking.
  94      */
  95     return contextidr == (uint32_t)env->cp15.dbgbvr[lbn];
  96 }
  97
  98 static bool bp_wp_matches(ARMCPU *cpu, int n, bool is_wp)
  99 {
 100     CPUARMState *env = &cpu->env;
 101     uint64_t cr;
 102     int pac, hmc, ssc, wt, lbn;
 103     /*
 104      * Note that for watchpoints the check is against the CPU security
 105      * state, not the S/NS attribute on the offending data access.
 106      */
 107     bool is_secure = arm_is_secure(env);
 108     int access_el = arm_current_el(env);
 109
 110     if (is_wp) {
 111         CPUWatchpoint *wp = env->cpu_watchpoint[n];
 112
 113         if (!wp || !(wp->flags & BP_WATCHPOINT_HIT)) {
 114             return false;
 115         }
 116         cr = env->cp15.dbgwcr[n];
 117         if (wp->hitattrs.user) {
 118             /*
 119              * The LDRT/STRT/LDT/STT "unprivileged access" instructions should
 120              * match watchpoints as if they were accesses done at EL0, even if
 121              * the CPU is at EL1 or higher.
 122              */
 123             access_el = 0;
 124         }
 125     } else {
 126         uint64_t pc = is_a64(env) ? env->pc : env->regs[15];
 127
 128         if (!env->cpu_breakpoint[n] || env->cpu_breakpoint[n]->pc != pc) {
 129             return false;
 130         }
 131         cr = env->cp15.dbgbcr[n];
 132     }
 133     /*
 134      * The WATCHPOINT_HIT flag guarantees us that the watchpoint is
 135      * enabled and that the address and access type match; for breakpoints
 136      * we know the address matched; check the remaining fields, including
 137      * linked breakpoints. We rely on WCR and BCR having the same layout
 138      * for the LBN, SSC, HMC, PAC/PMC and is-linked fields.
 139      * Note that some combinations of {PAC, HMC, SSC} are reserved and
 140      * must act either like some valid combination or as if the watchpoint
 141      * were disabled. We choose the former, and use this together with
 142      * the fact that EL3 must always be Secure and EL2 must always be
 143      * Non-Secure to simplify the code slightly compared to the full
 144      * table in the ARM ARM.
 145      */
 146     pac = FIELD_EX64(cr, DBGWCR, PAC);
 147     hmc = FIELD_EX64(cr, DBGWCR, HMC);
 148     ssc = FIELD_EX64(cr, DBGWCR, SSC);
 149
 150     switch (ssc) {
 151     case 0:
 152         break;
 153     case 1:
 154     case 3:
 155         if (is_secure) {
 156             return false;
 157         }
 158         break;
 159     case 2:
 160         if (!is_secure) {
 161             return false;
 162         }
 163         break;
 164     }
 165
 166     switch (access_el) {
 167     case 3:
 168     case 2:
 169         if (!hmc) {
 170             return false;
 171         }
 172         break;
 173     case 1:
 174         if (extract32(pac, 0, 1) == 0) {
 175             return false;
 176         }
 177         break;
 178     case 0:
 179         if (extract32(pac, 1, 1) == 0) {
 180             return false;
 181         }
 182         break;
 183     default:
 184         g_assert_not_reached();
 185     }
 186
 187     wt = FIELD_EX64(cr, DBGWCR, WT);
 188     lbn = FIELD_EX64(cr, DBGWCR, LBN);
 189
 190     if (wt && !linked_bp_matches(cpu, lbn)) {
 191         return false;
 192     }
 193
 194     return true;
 195 }
 196
 197 static bool check_watchpoints(ARMCPU *cpu)
 198 {
 199     CPUARMState *env = &cpu->env;
 200     int n;
 201
 202     /*
 203      * If watchpoints are disabled globally or we can't take debug
 204      * exceptions here then watchpoint firings are ignored.
 205      */
 206     if (extract32(env->cp15.mdscr_el1, 15, 1) == 0
 207         || !arm_generate_debug_exceptions(env)) {
 208         return false;
 209     }
 210
 211     for (n = 0; n < ARRAY_SIZE(env->cpu_watchpoint); n++) {
 212         if (bp_wp_matches(cpu, n, true)) {
 213             return true;
 214         }
 215     }
 216     return false;
 217 }
 218
 219 bool arm_debug_check_breakpoint(CPUState *cs)
 220 {
 221     ARMCPU *cpu = ARM_CPU(cs);
 222     CPUARMState *env = &cpu->env;
 223     target_ulong pc;
 224     int n;
 225
 226     /*
 227      * If breakpoints are disabled globally or we can't take debug
 228      * exceptions here then breakpoint firings are ignored.
 229      */
 230     if (extract32(env->cp15.mdscr_el1, 15, 1) == 0
 231         || !arm_generate_debug_exceptions(env)) {
 232         return false;
 233     }
 234
 235     /*
 236      * Single-step exceptions have priority over breakpoint exceptions.
 237      * If single-step state is active-pending, suppress the bp.
 238      */
 239     if (arm_singlestep_active(env) && !(env->pstate & PSTATE_SS)) {
 240         return false;
 241     }
 242
 243     /*
 244      * PC alignment faults have priority over breakpoint exceptions.
 245      */
 246     pc = is_a64(env) ? env->pc : env->regs[15];
 247     if ((is_a64(env) || !env->thumb) && (pc & 3) != 0) {
 248         return false;
 249     }
 250
 251     /*
 252      * Instruction aborts have priority over breakpoint exceptions.
 253      * TODO: We would need to look up the page for PC and verify that
 254      * it is present and executable.
 255      */
 256
 257     for (n = 0; n < ARRAY_SIZE(env->cpu_breakpoint); n++) {
 258         if (bp_wp_matches(cpu, n, false)) {
 259             return true;
 260         }
 261     }
 262     return false;
 263 }
 264
 265 bool arm_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp)
 266 {
 267     /*
 268      * Called by core code when a CPU watchpoint fires; need to check if this
 269      * is also an architectural watchpoint match.
 270      */
 271     ARMCPU *cpu = ARM_CPU(cs);
 272
 273     return check_watchpoints(cpu);
 274 }
 275
 276 void arm_debug_excp_handler(CPUState *cs)
 277 {
 278     /*
 279      * Called by core code when a watchpoint or breakpoint fires;
 280      * need to check which one and raise the appropriate exception.
 281      */
 282     ARMCPU *cpu = ARM_CPU(cs);
 283     CPUARMState *env = &cpu->env;
 284     CPUWatchpoint *wp_hit = cs->watchpoint_hit;
 285
 286     if (wp_hit) {
 287         if (wp_hit->flags & BP_CPU) {
 288             bool wnr = (wp_hit->flags & BP_WATCHPOINT_HIT_WRITE) != 0;
 289             bool same_el = arm_debug_target_el(env) == arm_current_el(env);
 290
 291             cs->watchpoint_hit = NULL;
 292
 293             env->exception.fsr = arm_debug_exception_fsr(env);
 294             env->exception.vaddress = wp_hit->hitaddr;
 295             raise_exception(env, EXCP_DATA_ABORT,
 296                     syn_watchpoint(same_el, 0, wnr),
 297                     arm_debug_target_el(env));
 298         }
 299     } else {
 300         uint64_t pc = is_a64(env) ? env->pc : env->regs[15];
 301         bool same_el = (arm_debug_target_el(env) == arm_current_el(env));
 302
 303         /*
 304          * (1) GDB breakpoints should be handled first.
 305          * (2) Do not raise a CPU exception if no CPU breakpoint has fired,
 306          * since singlestep is also done by generating a debug internal
 307          * exception.
 308          */
 309         if (cpu_breakpoint_test(cs, pc, BP_GDB)
 310             || !cpu_breakpoint_test(cs, pc, BP_CPU)) {
 311             return;
 312         }
 313
 314         env->exception.fsr = arm_debug_exception_fsr(env);
 315         /*
 316          * FAR is UNKNOWN: clear vaddress to avoid potentially exposing
 317          * values to the guest that it shouldn't be able to see at its
 318          * exception/security level.
 319          */
 320         env->exception.vaddress = 0;
 321         raise_exception(env, EXCP_PREFETCH_ABORT,
 322                         syn_breakpoint(same_el),
 323                         arm_debug_target_el(env));
 324     }
 325 }
 326
 327 #if !defined(CONFIG_USER_ONLY)
 328
 329 vaddr arm_adjust_watchpoint_address(CPUState *cs, vaddr addr, int len)
 330 {
 331     ARMCPU *cpu = ARM_CPU(cs);
 332     CPUARMState *env = &cpu->env;
 333
 334     /*
 335      * In BE32 system mode, target memory is stored byteswapped (on a
 336      * little-endian host system), and by the time we reach here (via an
 337      * opcode helper) the addresses of subword accesses have been adjusted
 338      * to account for that, which means that watchpoints will not match.
 339      * Undo the adjustment here.
 340      */
 341     if (arm_sctlr_b(env)) {
 342         if (len == 1) {
 343             addr ^= 3;
 344         } else if (len == 2) {
 345             addr ^= 2;
 346         }
 347     }
 348
 349     return addr;
 350 }
 351
 352 #endif