4 * This code is licensed under the GNU GPL v2 or later.
6 * SPDX-License-Identifier: GPL-2.0-or-later
8 #include "qemu/osdep.h"
11 #include "internals.h"
13 #include "exec/exec-all.h"
14 #include "exec/helper-proto.h"
17 /* Return the Exception Level targeted by debug exceptions. */
18 static int arm_debug_target_el(CPUARMState
*env
)
20 bool secure
= arm_is_secure(env
);
21 bool route_to_el2
= false;
23 if (arm_is_el2_enabled(env
)) {
24 route_to_el2
= env
->cp15
.hcr_el2
& HCR_TGE
||
25 env
->cp15
.mdcr_el2
& MDCR_TDE
;
30 } else if (arm_feature(env
, ARM_FEATURE_EL3
) &&
31 !arm_el_is_aa64(env
, 3) && secure
) {
39 * Raise an exception to the debug target el.
40 * Modify syndrome to indicate when origin and target EL are the same.
42 G_NORETURN
static void
43 raise_exception_debug(CPUARMState
*env
, uint32_t excp
, uint32_t syndrome
)
45 int debug_el
= arm_debug_target_el(env
);
46 int cur_el
= arm_current_el(env
);
49 * If singlestep is targeting a lower EL than the current one, then
50 * DisasContext.ss_active must be false and we can never get here.
51 * Similarly for watchpoint and breakpoint matches.
53 assert(debug_el
>= cur_el
);
54 syndrome
|= (debug_el
== cur_el
) << ARM_EL_EC_SHIFT
;
55 raise_exception(env
, excp
, syndrome
, debug_el
);
58 /* See AArch64.GenerateDebugExceptionsFrom() in ARM ARM pseudocode */
59 static bool aa64_generate_debug_exceptions(CPUARMState
*env
)
61 int cur_el
= arm_current_el(env
);
68 /* MDCR_EL3.SDD disables debug events from Secure state */
69 if (arm_is_secure_below_el3(env
)
70 && extract32(env
->cp15
.mdcr_el3
, 16, 1)) {
75 * Same EL to same EL debug exceptions need MDSCR_KDE enabled
76 * while not masking the (D)ebug bit in DAIF.
78 debug_el
= arm_debug_target_el(env
);
80 if (cur_el
== debug_el
) {
81 return extract32(env
->cp15
.mdscr_el1
, 13, 1)
82 && !(env
->daif
& PSTATE_D
);
85 /* Otherwise the debug target needs to be a higher EL */
86 return debug_el
> cur_el
;
89 static bool aa32_generate_debug_exceptions(CPUARMState
*env
)
91 int el
= arm_current_el(env
);
93 if (el
== 0 && arm_el_is_aa64(env
, 1)) {
94 return aa64_generate_debug_exceptions(env
);
97 if (arm_is_secure(env
)) {
100 if (el
== 0 && (env
->cp15
.sder
& 1)) {
102 * SDER.SUIDEN means debug exceptions from Secure EL0
103 * are always enabled. Otherwise they are controlled by
104 * SDCR.SPD like those from other Secure ELs.
109 spd
= extract32(env
->cp15
.mdcr_el3
, 14, 2);
112 /* SPD == 0b01 is reserved, but behaves as 0b00. */
115 * For 0b00 we return true if external secure invasive debug
116 * is enabled. On real hardware this is controlled by external
117 * signals to the core. QEMU always permits debug, and behaves
118 * as if DBGEN, SPIDEN, NIDEN and SPNIDEN are all tied high.
132 * Return true if debugging exceptions are currently enabled.
133 * This corresponds to what in ARM ARM pseudocode would be
134 * if UsingAArch32() then
135 * return AArch32.GenerateDebugExceptions()
137 * return AArch64.GenerateDebugExceptions()
138 * We choose to push the if() down into this function for clarity,
139 * since the pseudocode has it at all callsites except for the one in
140 * CheckSoftwareStep(), where it is elided because both branches would
141 * always return the same value.
143 bool arm_generate_debug_exceptions(CPUARMState
*env
)
145 if (env
->cp15
.oslsr_el1
& 1) {
149 return aa64_generate_debug_exceptions(env
);
151 return aa32_generate_debug_exceptions(env
);
156 * Is single-stepping active? (Note that the "is EL_D AArch64?" check
157 * implicitly means this always returns false in pre-v8 CPUs.)
159 bool arm_singlestep_active(CPUARMState
*env
)
161 return extract32(env
->cp15
.mdscr_el1
, 0, 1)
162 && arm_el_is_aa64(env
, arm_debug_target_el(env
))
163 && arm_generate_debug_exceptions(env
);
166 /* Return true if the linked breakpoint entry lbn passes its checks */
167 static bool linked_bp_matches(ARMCPU
*cpu
, int lbn
)
169 CPUARMState
*env
= &cpu
->env
;
170 uint64_t bcr
= env
->cp15
.dbgbcr
[lbn
];
171 int brps
= arm_num_brps(cpu
);
172 int ctx_cmps
= arm_num_ctx_cmps(cpu
);
178 * Links to unimplemented or non-context aware breakpoints are
179 * CONSTRAINED UNPREDICTABLE: either behave as if disabled, or
180 * as if linked to an UNKNOWN context-aware breakpoint (in which
181 * case DBGWCR<n>_EL1.LBN must indicate that breakpoint).
182 * We choose the former.
184 if (lbn
>= brps
|| lbn
< (brps
- ctx_cmps
)) {
188 bcr
= env
->cp15
.dbgbcr
[lbn
];
190 if (extract64(bcr
, 0, 1) == 0) {
191 /* Linked breakpoint disabled : generate no events */
195 bt
= extract64(bcr
, 20, 4);
196 hcr_el2
= arm_hcr_el2_eff(env
);
199 case 3: /* linked context ID match */
200 switch (arm_current_el(env
)) {
202 /* Context matches never fire in AArch64 EL3 */
205 if (!(hcr_el2
& HCR_E2H
)) {
206 /* Context matches never fire in EL2 without E2H enabled. */
209 contextidr
= env
->cp15
.contextidr_el
[2];
212 contextidr
= env
->cp15
.contextidr_el
[1];
215 if ((hcr_el2
& (HCR_E2H
| HCR_TGE
)) == (HCR_E2H
| HCR_TGE
)) {
216 contextidr
= env
->cp15
.contextidr_el
[2];
218 contextidr
= env
->cp15
.contextidr_el
[1];
224 case 7: /* linked contextidr_el1 match */
225 contextidr
= env
->cp15
.contextidr_el
[1];
227 case 13: /* linked contextidr_el2 match */
228 contextidr
= env
->cp15
.contextidr_el
[2];
231 case 9: /* linked VMID match (reserved if no EL2) */
232 case 11: /* linked context ID and VMID match (reserved if no EL2) */
233 case 15: /* linked full context ID match */
236 * Links to Unlinked context breakpoints must generate no
237 * events; we choose to do the same for reserved values too.
243 * We match the whole register even if this is AArch32 using the
244 * short descriptor format (in which case it holds both PROCID and ASID),
245 * since we don't implement the optional v7 context ID masking.
247 return contextidr
== (uint32_t)env
->cp15
.dbgbvr
[lbn
];
250 static bool bp_wp_matches(ARMCPU
*cpu
, int n
, bool is_wp
)
252 CPUARMState
*env
= &cpu
->env
;
254 int pac
, hmc
, ssc
, wt
, lbn
;
256 * Note that for watchpoints the check is against the CPU security
257 * state, not the S/NS attribute on the offending data access.
259 bool is_secure
= arm_is_secure(env
);
260 int access_el
= arm_current_el(env
);
263 CPUWatchpoint
*wp
= env
->cpu_watchpoint
[n
];
265 if (!wp
|| !(wp
->flags
& BP_WATCHPOINT_HIT
)) {
268 cr
= env
->cp15
.dbgwcr
[n
];
269 if (wp
->hitattrs
.user
) {
271 * The LDRT/STRT/LDT/STT "unprivileged access" instructions should
272 * match watchpoints as if they were accesses done at EL0, even if
273 * the CPU is at EL1 or higher.
278 uint64_t pc
= is_a64(env
) ? env
->pc
: env
->regs
[15];
280 if (!env
->cpu_breakpoint
[n
] || env
->cpu_breakpoint
[n
]->pc
!= pc
) {
283 cr
= env
->cp15
.dbgbcr
[n
];
286 * The WATCHPOINT_HIT flag guarantees us that the watchpoint is
287 * enabled and that the address and access type match; for breakpoints
288 * we know the address matched; check the remaining fields, including
289 * linked breakpoints. We rely on WCR and BCR having the same layout
290 * for the LBN, SSC, HMC, PAC/PMC and is-linked fields.
291 * Note that some combinations of {PAC, HMC, SSC} are reserved and
292 * must act either like some valid combination or as if the watchpoint
293 * were disabled. We choose the former, and use this together with
294 * the fact that EL3 must always be Secure and EL2 must always be
295 * Non-Secure to simplify the code slightly compared to the full
296 * table in the ARM ARM.
298 pac
= FIELD_EX64(cr
, DBGWCR
, PAC
);
299 hmc
= FIELD_EX64(cr
, DBGWCR
, HMC
);
300 ssc
= FIELD_EX64(cr
, DBGWCR
, SSC
);
326 if (extract32(pac
, 0, 1) == 0) {
331 if (extract32(pac
, 1, 1) == 0) {
336 g_assert_not_reached();
339 wt
= FIELD_EX64(cr
, DBGWCR
, WT
);
340 lbn
= FIELD_EX64(cr
, DBGWCR
, LBN
);
342 if (wt
&& !linked_bp_matches(cpu
, lbn
)) {
349 static bool check_watchpoints(ARMCPU
*cpu
)
351 CPUARMState
*env
= &cpu
->env
;
355 * If watchpoints are disabled globally or we can't take debug
356 * exceptions here then watchpoint firings are ignored.
358 if (extract32(env
->cp15
.mdscr_el1
, 15, 1) == 0
359 || !arm_generate_debug_exceptions(env
)) {
363 for (n
= 0; n
< ARRAY_SIZE(env
->cpu_watchpoint
); n
++) {
364 if (bp_wp_matches(cpu
, n
, true)) {
371 bool arm_debug_check_breakpoint(CPUState
*cs
)
373 ARMCPU
*cpu
= ARM_CPU(cs
);
374 CPUARMState
*env
= &cpu
->env
;
379 * If breakpoints are disabled globally or we can't take debug
380 * exceptions here then breakpoint firings are ignored.
382 if (extract32(env
->cp15
.mdscr_el1
, 15, 1) == 0
383 || !arm_generate_debug_exceptions(env
)) {
388 * Single-step exceptions have priority over breakpoint exceptions.
389 * If single-step state is active-pending, suppress the bp.
391 if (arm_singlestep_active(env
) && !(env
->pstate
& PSTATE_SS
)) {
396 * PC alignment faults have priority over breakpoint exceptions.
398 pc
= is_a64(env
) ? env
->pc
: env
->regs
[15];
399 if ((is_a64(env
) || !env
->thumb
) && (pc
& 3) != 0) {
404 * Instruction aborts have priority over breakpoint exceptions.
405 * TODO: We would need to look up the page for PC and verify that
406 * it is present and executable.
409 for (n
= 0; n
< ARRAY_SIZE(env
->cpu_breakpoint
); n
++) {
410 if (bp_wp_matches(cpu
, n
, false)) {
417 bool arm_debug_check_watchpoint(CPUState
*cs
, CPUWatchpoint
*wp
)
420 * Called by core code when a CPU watchpoint fires; need to check if this
421 * is also an architectural watchpoint match.
423 ARMCPU
*cpu
= ARM_CPU(cs
);
425 return check_watchpoints(cpu
);
429 * Return the FSR value for a debug exception (watchpoint, hardware
430 * breakpoint or BKPT insn) targeting the specified exception level.
432 static uint32_t arm_debug_exception_fsr(CPUARMState
*env
)
434 ARMMMUFaultInfo fi
= { .type
= ARMFault_Debug
};
435 int target_el
= arm_debug_target_el(env
);
436 bool using_lpae
= false;
438 if (target_el
== 2 || arm_el_is_aa64(env
, target_el
)) {
441 if (arm_feature(env
, ARM_FEATURE_LPAE
) &&
442 (env
->cp15
.tcr_el
[target_el
].raw_tcr
& TTBCR_EAE
)) {
448 return arm_fi_to_lfsc(&fi
);
450 return arm_fi_to_sfsc(&fi
);
454 void arm_debug_excp_handler(CPUState
*cs
)
457 * Called by core code when a watchpoint or breakpoint fires;
458 * need to check which one and raise the appropriate exception.
460 ARMCPU
*cpu
= ARM_CPU(cs
);
461 CPUARMState
*env
= &cpu
->env
;
462 CPUWatchpoint
*wp_hit
= cs
->watchpoint_hit
;
465 if (wp_hit
->flags
& BP_CPU
) {
466 bool wnr
= (wp_hit
->flags
& BP_WATCHPOINT_HIT_WRITE
) != 0;
468 cs
->watchpoint_hit
= NULL
;
470 env
->exception
.fsr
= arm_debug_exception_fsr(env
);
471 env
->exception
.vaddress
= wp_hit
->hitaddr
;
472 raise_exception_debug(env
, EXCP_DATA_ABORT
,
473 syn_watchpoint(0, 0, wnr
));
476 uint64_t pc
= is_a64(env
) ? env
->pc
: env
->regs
[15];
479 * (1) GDB breakpoints should be handled first.
480 * (2) Do not raise a CPU exception if no CPU breakpoint has fired,
481 * since singlestep is also done by generating a debug internal
484 if (cpu_breakpoint_test(cs
, pc
, BP_GDB
)
485 || !cpu_breakpoint_test(cs
, pc
, BP_CPU
)) {
489 env
->exception
.fsr
= arm_debug_exception_fsr(env
);
491 * FAR is UNKNOWN: clear vaddress to avoid potentially exposing
492 * values to the guest that it shouldn't be able to see at its
493 * exception/security level.
495 env
->exception
.vaddress
= 0;
496 raise_exception_debug(env
, EXCP_PREFETCH_ABORT
, syn_breakpoint(0));
501 * Raise an EXCP_BKPT with the specified syndrome register value,
502 * targeting the correct exception level for debug exceptions.
504 void HELPER(exception_bkpt_insn
)(CPUARMState
*env
, uint32_t syndrome
)
506 int debug_el
= arm_debug_target_el(env
);
507 int cur_el
= arm_current_el(env
);
509 /* FSR will only be used if the debug target EL is AArch32. */
510 env
->exception
.fsr
= arm_debug_exception_fsr(env
);
512 * FAR is UNKNOWN: clear vaddress to avoid potentially exposing
513 * values to the guest that it shouldn't be able to see at its
514 * exception/security level.
516 env
->exception
.vaddress
= 0;
518 * Other kinds of architectural debug exception are ignored if
519 * they target an exception level below the current one (in QEMU
520 * this is checked by arm_generate_debug_exceptions()). Breakpoint
521 * instructions are special because they always generate an exception
522 * to somewhere: if they can't go to the configured debug exception
523 * level they are taken to the current exception level.
525 if (debug_el
< cur_el
) {
528 raise_exception(env
, EXCP_BKPT
, syndrome
, debug_el
);
531 void HELPER(exception_swstep
)(CPUARMState
*env
, uint32_t syndrome
)
533 raise_exception_debug(env
, EXCP_UDEF
, syndrome
);
537 * Check for traps to "powerdown debug" registers, which are controlled
540 static CPAccessResult
access_tdosa(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
543 int el
= arm_current_el(env
);
544 uint64_t mdcr_el2
= arm_mdcr_el2_eff(env
);
545 bool mdcr_el2_tdosa
= (mdcr_el2
& MDCR_TDOSA
) || (mdcr_el2
& MDCR_TDE
) ||
546 (arm_hcr_el2_eff(env
) & HCR_TGE
);
548 if (el
< 2 && mdcr_el2_tdosa
) {
549 return CP_ACCESS_TRAP_EL2
;
551 if (el
< 3 && (env
->cp15
.mdcr_el3
& MDCR_TDOSA
)) {
552 return CP_ACCESS_TRAP_EL3
;
558 * Check for traps to "debug ROM" registers, which are controlled
559 * by MDCR_EL2.TDRA for EL2 but by the more general MDCR_EL3.TDA for EL3.
561 static CPAccessResult
access_tdra(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
564 int el
= arm_current_el(env
);
565 uint64_t mdcr_el2
= arm_mdcr_el2_eff(env
);
566 bool mdcr_el2_tdra
= (mdcr_el2
& MDCR_TDRA
) || (mdcr_el2
& MDCR_TDE
) ||
567 (arm_hcr_el2_eff(env
) & HCR_TGE
);
569 if (el
< 2 && mdcr_el2_tdra
) {
570 return CP_ACCESS_TRAP_EL2
;
572 if (el
< 3 && (env
->cp15
.mdcr_el3
& MDCR_TDA
)) {
573 return CP_ACCESS_TRAP_EL3
;
579 * Check for traps to general debug registers, which are controlled
580 * by MDCR_EL2.TDA for EL2 and MDCR_EL3.TDA for EL3.
582 static CPAccessResult
access_tda(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
585 int el
= arm_current_el(env
);
586 uint64_t mdcr_el2
= arm_mdcr_el2_eff(env
);
587 bool mdcr_el2_tda
= (mdcr_el2
& MDCR_TDA
) || (mdcr_el2
& MDCR_TDE
) ||
588 (arm_hcr_el2_eff(env
) & HCR_TGE
);
590 if (el
< 2 && mdcr_el2_tda
) {
591 return CP_ACCESS_TRAP_EL2
;
593 if (el
< 3 && (env
->cp15
.mdcr_el3
& MDCR_TDA
)) {
594 return CP_ACCESS_TRAP_EL3
;
599 static void oslar_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
603 * Writes to OSLAR_EL1 may update the OS lock status, which can be
604 * read via a bit in OSLSR_EL1.
608 if (ri
->state
== ARM_CP_STATE_AA32
) {
609 oslock
= (value
== 0xC5ACCE55);
614 env
->cp15
.oslsr_el1
= deposit32(env
->cp15
.oslsr_el1
, 1, 1, oslock
);
617 static const ARMCPRegInfo debug_cp_reginfo
[] = {
619 * DBGDRAR, DBGDSAR: always RAZ since we don't implement memory mapped
620 * debug components. The AArch64 version of DBGDRAR is named MDRAR_EL1;
621 * unlike DBGDRAR it is never accessible from EL0.
622 * DBGDSAR is deprecated and must RAZ from v8 anyway, so it has no AArch64
625 { .name
= "DBGDRAR", .cp
= 14, .crn
= 1, .crm
= 0, .opc1
= 0, .opc2
= 0,
626 .access
= PL0_R
, .accessfn
= access_tdra
,
627 .type
= ARM_CP_CONST
, .resetvalue
= 0 },
628 { .name
= "MDRAR_EL1", .state
= ARM_CP_STATE_AA64
,
629 .opc0
= 2, .opc1
= 0, .crn
= 1, .crm
= 0, .opc2
= 0,
630 .access
= PL1_R
, .accessfn
= access_tdra
,
631 .type
= ARM_CP_CONST
, .resetvalue
= 0 },
632 { .name
= "DBGDSAR", .cp
= 14, .crn
= 2, .crm
= 0, .opc1
= 0, .opc2
= 0,
633 .access
= PL0_R
, .accessfn
= access_tdra
,
634 .type
= ARM_CP_CONST
, .resetvalue
= 0 },
635 /* Monitor debug system control register; the 32-bit alias is DBGDSCRext. */
636 { .name
= "MDSCR_EL1", .state
= ARM_CP_STATE_BOTH
,
637 .cp
= 14, .opc0
= 2, .opc1
= 0, .crn
= 0, .crm
= 2, .opc2
= 2,
638 .access
= PL1_RW
, .accessfn
= access_tda
,
639 .fieldoffset
= offsetof(CPUARMState
, cp15
.mdscr_el1
),
642 * MDCCSR_EL0[30:29] map to EDSCR[30:29]. Simply RAZ as the external
643 * Debug Communication Channel is not implemented.
645 { .name
= "MDCCSR_EL0", .state
= ARM_CP_STATE_AA64
,
646 .opc0
= 2, .opc1
= 3, .crn
= 0, .crm
= 1, .opc2
= 0,
647 .access
= PL0_R
, .accessfn
= access_tda
,
648 .type
= ARM_CP_CONST
, .resetvalue
= 0 },
650 * DBGDSCRint[15,12,5:2] map to MDSCR_EL1[15,12,5:2]. Map all bits as
651 * it is unlikely a guest will care.
652 * We don't implement the configurable EL0 access.
654 { .name
= "DBGDSCRint", .state
= ARM_CP_STATE_AA32
,
655 .cp
= 14, .opc1
= 0, .crn
= 0, .crm
= 1, .opc2
= 0,
656 .type
= ARM_CP_ALIAS
,
657 .access
= PL1_R
, .accessfn
= access_tda
,
658 .fieldoffset
= offsetof(CPUARMState
, cp15
.mdscr_el1
), },
659 { .name
= "OSLAR_EL1", .state
= ARM_CP_STATE_BOTH
,
660 .cp
= 14, .opc0
= 2, .opc1
= 0, .crn
= 1, .crm
= 0, .opc2
= 4,
661 .access
= PL1_W
, .type
= ARM_CP_NO_RAW
,
662 .accessfn
= access_tdosa
,
663 .writefn
= oslar_write
},
664 { .name
= "OSLSR_EL1", .state
= ARM_CP_STATE_BOTH
,
665 .cp
= 14, .opc0
= 2, .opc1
= 0, .crn
= 1, .crm
= 1, .opc2
= 4,
666 .access
= PL1_R
, .resetvalue
= 10,
667 .accessfn
= access_tdosa
,
668 .fieldoffset
= offsetof(CPUARMState
, cp15
.oslsr_el1
) },
669 /* Dummy OSDLR_EL1: 32-bit Linux will read this */
670 { .name
= "OSDLR_EL1", .state
= ARM_CP_STATE_BOTH
,
671 .cp
= 14, .opc0
= 2, .opc1
= 0, .crn
= 1, .crm
= 3, .opc2
= 4,
672 .access
= PL1_RW
, .accessfn
= access_tdosa
,
673 .type
= ARM_CP_NOP
},
675 * Dummy DBGVCR: Linux wants to clear this on startup, but we don't
676 * implement vector catch debug events yet.
679 .cp
= 14, .opc1
= 0, .crn
= 0, .crm
= 7, .opc2
= 0,
680 .access
= PL1_RW
, .accessfn
= access_tda
,
681 .type
= ARM_CP_NOP
},
683 * Dummy DBGVCR32_EL2 (which is only for a 64-bit hypervisor
684 * to save and restore a 32-bit guest's DBGVCR)
686 { .name
= "DBGVCR32_EL2", .state
= ARM_CP_STATE_AA64
,
687 .opc0
= 2, .opc1
= 4, .crn
= 0, .crm
= 7, .opc2
= 0,
688 .access
= PL2_RW
, .accessfn
= access_tda
,
689 .type
= ARM_CP_NOP
| ARM_CP_EL3_NO_EL2_KEEP
},
691 * Dummy MDCCINT_EL1, since we don't implement the Debug Communications
692 * Channel but Linux may try to access this register. The 32-bit
693 * alias is DBGDCCINT.
695 { .name
= "MDCCINT_EL1", .state
= ARM_CP_STATE_BOTH
,
696 .cp
= 14, .opc0
= 2, .opc1
= 0, .crn
= 0, .crm
= 2, .opc2
= 0,
697 .access
= PL1_RW
, .accessfn
= access_tda
,
698 .type
= ARM_CP_NOP
},
701 static const ARMCPRegInfo debug_lpae_cp_reginfo
[] = {
702 /* 64 bit access versions of the (dummy) debug registers */
703 { .name
= "DBGDRAR", .cp
= 14, .crm
= 1, .opc1
= 0,
704 .access
= PL0_R
, .type
= ARM_CP_CONST
| ARM_CP_64BIT
, .resetvalue
= 0 },
705 { .name
= "DBGDSAR", .cp
= 14, .crm
= 2, .opc1
= 0,
706 .access
= PL0_R
, .type
= ARM_CP_CONST
| ARM_CP_64BIT
, .resetvalue
= 0 },
709 void hw_watchpoint_update(ARMCPU
*cpu
, int n
)
711 CPUARMState
*env
= &cpu
->env
;
713 vaddr wvr
= env
->cp15
.dbgwvr
[n
];
714 uint64_t wcr
= env
->cp15
.dbgwcr
[n
];
716 int flags
= BP_CPU
| BP_STOP_BEFORE_ACCESS
;
718 if (env
->cpu_watchpoint
[n
]) {
719 cpu_watchpoint_remove_by_ref(CPU(cpu
), env
->cpu_watchpoint
[n
]);
720 env
->cpu_watchpoint
[n
] = NULL
;
723 if (!FIELD_EX64(wcr
, DBGWCR
, E
)) {
724 /* E bit clear : watchpoint disabled */
728 switch (FIELD_EX64(wcr
, DBGWCR
, LSC
)) {
730 /* LSC 00 is reserved and must behave as if the wp is disabled */
733 flags
|= BP_MEM_READ
;
736 flags
|= BP_MEM_WRITE
;
739 flags
|= BP_MEM_ACCESS
;
744 * Attempts to use both MASK and BAS fields simultaneously are
745 * CONSTRAINED UNPREDICTABLE; we opt to ignore BAS in this case,
746 * thus generating a watchpoint for every byte in the masked region.
748 mask
= FIELD_EX64(wcr
, DBGWCR
, MASK
);
749 if (mask
== 1 || mask
== 2) {
751 * Reserved values of MASK; we must act as if the mask value was
752 * some non-reserved value, or as if the watchpoint were disabled.
753 * We choose the latter.
757 /* Watchpoint covers an aligned area up to 2GB in size */
760 * If masked bits in WVR are not zero it's CONSTRAINED UNPREDICTABLE
761 * whether the watchpoint fires when the unmasked bits match; we opt
762 * to generate the exceptions.
766 /* Watchpoint covers bytes defined by the byte address select bits */
767 int bas
= FIELD_EX64(wcr
, DBGWCR
, BAS
);
770 if (extract64(wvr
, 2, 1)) {
772 * Deprecated case of an only 4-aligned address. BAS[7:4] are
773 * ignored, and BAS[3:0] define which bytes to watch.
779 /* This must act as if the watchpoint is disabled */
784 * The BAS bits are supposed to be programmed to indicate a contiguous
785 * range of bytes. Otherwise it is CONSTRAINED UNPREDICTABLE whether
786 * we fire for each byte in the word/doubleword addressed by the WVR.
787 * We choose to ignore any non-zero bits after the first range of 1s.
789 basstart
= ctz32(bas
);
790 len
= cto32(bas
>> basstart
);
794 cpu_watchpoint_insert(CPU(cpu
), wvr
, len
, flags
,
795 &env
->cpu_watchpoint
[n
]);
798 void hw_watchpoint_update_all(ARMCPU
*cpu
)
801 CPUARMState
*env
= &cpu
->env
;
804 * Completely clear out existing QEMU watchpoints and our array, to
805 * avoid possible stale entries following migration load.
807 cpu_watchpoint_remove_all(CPU(cpu
), BP_CPU
);
808 memset(env
->cpu_watchpoint
, 0, sizeof(env
->cpu_watchpoint
));
810 for (i
= 0; i
< ARRAY_SIZE(cpu
->env
.cpu_watchpoint
); i
++) {
811 hw_watchpoint_update(cpu
, i
);
815 static void dbgwvr_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
818 ARMCPU
*cpu
= env_archcpu(env
);
822 * Bits [1:0] are RES0.
824 * It is IMPLEMENTATION DEFINED whether [63:49] ([63:53] with FEAT_LVA)
825 * are hardwired to the value of bit [48] ([52] with FEAT_LVA), or if
826 * they contain the value written. It is CONSTRAINED UNPREDICTABLE
827 * whether the RESS bits are ignored when comparing an address.
829 * Therefore we are allowed to compare the entire register, which lets
830 * us avoid considering whether or not FEAT_LVA is actually enabled.
834 raw_write(env
, ri
, value
);
835 hw_watchpoint_update(cpu
, i
);
838 static void dbgwcr_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
841 ARMCPU
*cpu
= env_archcpu(env
);
844 raw_write(env
, ri
, value
);
845 hw_watchpoint_update(cpu
, i
);
848 void hw_breakpoint_update(ARMCPU
*cpu
, int n
)
850 CPUARMState
*env
= &cpu
->env
;
851 uint64_t bvr
= env
->cp15
.dbgbvr
[n
];
852 uint64_t bcr
= env
->cp15
.dbgbcr
[n
];
857 if (env
->cpu_breakpoint
[n
]) {
858 cpu_breakpoint_remove_by_ref(CPU(cpu
), env
->cpu_breakpoint
[n
]);
859 env
->cpu_breakpoint
[n
] = NULL
;
862 if (!extract64(bcr
, 0, 1)) {
863 /* E bit clear : watchpoint disabled */
867 bt
= extract64(bcr
, 20, 4);
870 case 4: /* unlinked address mismatch (reserved if AArch64) */
871 case 5: /* linked address mismatch (reserved if AArch64) */
872 qemu_log_mask(LOG_UNIMP
,
873 "arm: address mismatch breakpoint types not implemented\n");
875 case 0: /* unlinked address match */
876 case 1: /* linked address match */
879 * Bits [1:0] are RES0.
881 * It is IMPLEMENTATION DEFINED whether bits [63:49]
882 * ([63:53] for FEAT_LVA) are hardwired to a copy of the sign bit
883 * of the VA field ([48] or [52] for FEAT_LVA), or whether the
884 * value is read as written. It is CONSTRAINED UNPREDICTABLE
885 * whether the RESS bits are ignored when comparing an address.
886 * Therefore we are allowed to compare the entire register, which
887 * lets us avoid considering whether FEAT_LVA is actually enabled.
889 * The BAS field is used to allow setting breakpoints on 16-bit
890 * wide instructions; it is CONSTRAINED UNPREDICTABLE whether
891 * a bp will fire if the addresses covered by the bp and the addresses
892 * covered by the insn overlap but the insn doesn't start at the
893 * start of the bp address range. We choose to require the insn and
894 * the bp to have the same address. The constraints on writing to
895 * BAS enforced in dbgbcr_write mean we have only four cases:
896 * 0b0000 => no breakpoint
897 * 0b0011 => breakpoint on addr
898 * 0b1100 => breakpoint on addr + 2
899 * 0b1111 => breakpoint on addr
900 * See also figure D2-3 in the v8 ARM ARM (DDI0487A.c).
902 int bas
= extract64(bcr
, 5, 4);
912 case 2: /* unlinked context ID match */
913 case 8: /* unlinked VMID match (reserved if no EL2) */
914 case 10: /* unlinked context ID and VMID match (reserved if no EL2) */
915 qemu_log_mask(LOG_UNIMP
,
916 "arm: unlinked context breakpoint types not implemented\n");
918 case 9: /* linked VMID match (reserved if no EL2) */
919 case 11: /* linked context ID and VMID match (reserved if no EL2) */
920 case 3: /* linked context ID match */
923 * We must generate no events for Linked context matches (unless
924 * they are linked to by some other bp/wp, which is handled in
925 * updates for the linking bp/wp). We choose to also generate no events
926 * for reserved values.
931 cpu_breakpoint_insert(CPU(cpu
), addr
, flags
, &env
->cpu_breakpoint
[n
]);
934 void hw_breakpoint_update_all(ARMCPU
*cpu
)
937 CPUARMState
*env
= &cpu
->env
;
940 * Completely clear out existing QEMU breakpoints and our array, to
941 * avoid possible stale entries following migration load.
943 cpu_breakpoint_remove_all(CPU(cpu
), BP_CPU
);
944 memset(env
->cpu_breakpoint
, 0, sizeof(env
->cpu_breakpoint
));
946 for (i
= 0; i
< ARRAY_SIZE(cpu
->env
.cpu_breakpoint
); i
++) {
947 hw_breakpoint_update(cpu
, i
);
951 static void dbgbvr_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
954 ARMCPU
*cpu
= env_archcpu(env
);
957 raw_write(env
, ri
, value
);
958 hw_breakpoint_update(cpu
, i
);
961 static void dbgbcr_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
964 ARMCPU
*cpu
= env_archcpu(env
);
968 * BAS[3] is a read-only copy of BAS[2], and BAS[1] a read-only
971 value
= deposit64(value
, 6, 1, extract64(value
, 5, 1));
972 value
= deposit64(value
, 8, 1, extract64(value
, 7, 1));
974 raw_write(env
, ri
, value
);
975 hw_breakpoint_update(cpu
, i
);
978 void define_debug_regs(ARMCPU
*cpu
)
981 * Define v7 and v8 architectural debug registers.
982 * These are just dummy implementations for now.
985 int wrps
, brps
, ctx_cmps
;
988 * The Arm ARM says DBGDIDR is optional and deprecated if EL1 cannot
989 * use AArch32. Given that bit 15 is RES1, if the value is 0 then
990 * the register must not exist for this cpu.
992 if (cpu
->isar
.dbgdidr
!= 0) {
993 ARMCPRegInfo dbgdidr
= {
994 .name
= "DBGDIDR", .cp
= 14, .crn
= 0, .crm
= 0,
995 .opc1
= 0, .opc2
= 0,
996 .access
= PL0_R
, .accessfn
= access_tda
,
997 .type
= ARM_CP_CONST
, .resetvalue
= cpu
->isar
.dbgdidr
,
999 define_one_arm_cp_reg(cpu
, &dbgdidr
);
1002 brps
= arm_num_brps(cpu
);
1003 wrps
= arm_num_wrps(cpu
);
1004 ctx_cmps
= arm_num_ctx_cmps(cpu
);
1006 assert(ctx_cmps
<= brps
);
1008 define_arm_cp_regs(cpu
, debug_cp_reginfo
);
1010 if (arm_feature(&cpu
->env
, ARM_FEATURE_LPAE
)) {
1011 define_arm_cp_regs(cpu
, debug_lpae_cp_reginfo
);
1014 for (i
= 0; i
< brps
; i
++) {
1015 char *dbgbvr_el1_name
= g_strdup_printf("DBGBVR%d_EL1", i
);
1016 char *dbgbcr_el1_name
= g_strdup_printf("DBGBCR%d_EL1", i
);
1017 ARMCPRegInfo dbgregs
[] = {
1018 { .name
= dbgbvr_el1_name
, .state
= ARM_CP_STATE_BOTH
,
1019 .cp
= 14, .opc0
= 2, .opc1
= 0, .crn
= 0, .crm
= i
, .opc2
= 4,
1020 .access
= PL1_RW
, .accessfn
= access_tda
,
1021 .fieldoffset
= offsetof(CPUARMState
, cp15
.dbgbvr
[i
]),
1022 .writefn
= dbgbvr_write
, .raw_writefn
= raw_write
1024 { .name
= dbgbcr_el1_name
, .state
= ARM_CP_STATE_BOTH
,
1025 .cp
= 14, .opc0
= 2, .opc1
= 0, .crn
= 0, .crm
= i
, .opc2
= 5,
1026 .access
= PL1_RW
, .accessfn
= access_tda
,
1027 .fieldoffset
= offsetof(CPUARMState
, cp15
.dbgbcr
[i
]),
1028 .writefn
= dbgbcr_write
, .raw_writefn
= raw_write
1031 define_arm_cp_regs(cpu
, dbgregs
);
1032 g_free(dbgbvr_el1_name
);
1033 g_free(dbgbcr_el1_name
);
1036 for (i
= 0; i
< wrps
; i
++) {
1037 char *dbgwvr_el1_name
= g_strdup_printf("DBGWVR%d_EL1", i
);
1038 char *dbgwcr_el1_name
= g_strdup_printf("DBGWCR%d_EL1", i
);
1039 ARMCPRegInfo dbgregs
[] = {
1040 { .name
= dbgwvr_el1_name
, .state
= ARM_CP_STATE_BOTH
,
1041 .cp
= 14, .opc0
= 2, .opc1
= 0, .crn
= 0, .crm
= i
, .opc2
= 6,
1042 .access
= PL1_RW
, .accessfn
= access_tda
,
1043 .fieldoffset
= offsetof(CPUARMState
, cp15
.dbgwvr
[i
]),
1044 .writefn
= dbgwvr_write
, .raw_writefn
= raw_write
1046 { .name
= dbgwcr_el1_name
, .state
= ARM_CP_STATE_BOTH
,
1047 .cp
= 14, .opc0
= 2, .opc1
= 0, .crn
= 0, .crm
= i
, .opc2
= 7,
1048 .access
= PL1_RW
, .accessfn
= access_tda
,
1049 .fieldoffset
= offsetof(CPUARMState
, cp15
.dbgwcr
[i
]),
1050 .writefn
= dbgwcr_write
, .raw_writefn
= raw_write
1053 define_arm_cp_regs(cpu
, dbgregs
);
1054 g_free(dbgwvr_el1_name
);
1055 g_free(dbgwcr_el1_name
);
1059 #if !defined(CONFIG_USER_ONLY)
1061 vaddr
arm_adjust_watchpoint_address(CPUState
*cs
, vaddr addr
, int len
)
1063 ARMCPU
*cpu
= ARM_CPU(cs
);
1064 CPUARMState
*env
= &cpu
->env
;
1067 * In BE32 system mode, target memory is stored byteswapped (on a
1068 * little-endian host system), and by the time we reach here (via an
1069 * opcode helper) the addresses of subword accesses have been adjusted
1070 * to account for that, which means that watchpoints will not match.
1071 * Undo the adjustment here.
1073 if (arm_sctlr_b(env
)) {
1076 } else if (len
== 2) {