target/arm/debug_helper.c

   1 /*
   2  * ARM debug helpers.
   3  *
   4  * This code is licensed under the GNU GPL v2 or later.
   5  *
   6  * SPDX-License-Identifier: GPL-2.0-or-later
   7  */
   8 #include "qemu/osdep.h"
   9 #include "cpu.h"
  10 #include "internals.h"
  11 #include "exec/exec-all.h"
  12 #include "exec/helper-proto.h"
  13
  14 /* Return true if the linked breakpoint entry lbn passes its checks */
  15 static bool linked_bp_matches(ARMCPU *cpu, int lbn)
  16 {
  17     CPUARMState *env = &cpu->env;
  18     uint64_t bcr = env->cp15.dbgbcr[lbn];
  19     int brps = extract32(cpu->dbgdidr, 24, 4);
  20     int ctx_cmps = extract32(cpu->dbgdidr, 20, 4);
  21     int bt;
  22     uint32_t contextidr;
  23
  24     /*
  25      * Links to unimplemented or non-context aware breakpoints are
  26      * CONSTRAINED UNPREDICTABLE: either behave as if disabled, or
  27      * as if linked to an UNKNOWN context-aware breakpoint (in which
  28      * case DBGWCR<n>_EL1.LBN must indicate that breakpoint).
  29      * We choose the former.
  30      */
  31     if (lbn > brps || lbn < (brps - ctx_cmps)) {
  32         return false;
  33     }
  34
  35     bcr = env->cp15.dbgbcr[lbn];
  36
  37     if (extract64(bcr, 0, 1) == 0) {
  38         /* Linked breakpoint disabled : generate no events */
  39         return false;
  40     }
  41
  42     bt = extract64(bcr, 20, 4);
  43
  44     /*
  45      * We match the whole register even if this is AArch32 using the
  46      * short descriptor format (in which case it holds both PROCID and ASID),
  47      * since we don't implement the optional v7 context ID masking.
  48      */
  49     contextidr = extract64(env->cp15.contextidr_el[1], 0, 32);
  50
  51     switch (bt) {
  52     case 3: /* linked context ID match */
  53         if (arm_current_el(env) > 1) {
  54             /* Context matches never fire in EL2 or (AArch64) EL3 */
  55             return false;
  56         }
  57         return (contextidr == extract64(env->cp15.dbgbvr[lbn], 0, 32));
  58     case 5: /* linked address mismatch (reserved in AArch64) */
  59     case 9: /* linked VMID match (reserved if no EL2) */
  60     case 11: /* linked context ID and VMID match (reserved if no EL2) */
  61     default:
  62         /*
  63          * Links to Unlinked context breakpoints must generate no
  64          * events; we choose to do the same for reserved values too.
  65          */
  66         return false;
  67     }
  68
  69     return false;
  70 }
  71
  72 static bool bp_wp_matches(ARMCPU *cpu, int n, bool is_wp)
  73 {
  74     CPUARMState *env = &cpu->env;
  75     uint64_t cr;
  76     int pac, hmc, ssc, wt, lbn;
  77     /*
  78      * Note that for watchpoints the check is against the CPU security
  79      * state, not the S/NS attribute on the offending data access.
  80      */
  81     bool is_secure = arm_is_secure(env);
  82     int access_el = arm_current_el(env);
  83
  84     if (is_wp) {
  85         CPUWatchpoint *wp = env->cpu_watchpoint[n];
  86
  87         if (!wp || !(wp->flags & BP_WATCHPOINT_HIT)) {
  88             return false;
  89         }
  90         cr = env->cp15.dbgwcr[n];
  91         if (wp->hitattrs.user) {
  92             /*
  93              * The LDRT/STRT/LDT/STT "unprivileged access" instructions should
  94              * match watchpoints as if they were accesses done at EL0, even if
  95              * the CPU is at EL1 or higher.
  96              */
  97             access_el = 0;
  98         }
  99     } else {
 100         uint64_t pc = is_a64(env) ? env->pc : env->regs[15];
 101
 102         if (!env->cpu_breakpoint[n] || env->cpu_breakpoint[n]->pc != pc) {
 103             return false;
 104         }
 105         cr = env->cp15.dbgbcr[n];
 106     }
 107     /*
 108      * The WATCHPOINT_HIT flag guarantees us that the watchpoint is
 109      * enabled and that the address and access type match; for breakpoints
 110      * we know the address matched; check the remaining fields, including
 111      * linked breakpoints. We rely on WCR and BCR having the same layout
 112      * for the LBN, SSC, HMC, PAC/PMC and is-linked fields.
 113      * Note that some combinations of {PAC, HMC, SSC} are reserved and
 114      * must act either like some valid combination or as if the watchpoint
 115      * were disabled. We choose the former, and use this together with
 116      * the fact that EL3 must always be Secure and EL2 must always be
 117      * Non-Secure to simplify the code slightly compared to the full
 118      * table in the ARM ARM.
 119      */
 120     pac = extract64(cr, 1, 2);
 121     hmc = extract64(cr, 13, 1);
 122     ssc = extract64(cr, 14, 2);
 123
 124     switch (ssc) {
 125     case 0:
 126         break;
 127     case 1:
 128     case 3:
 129         if (is_secure) {
 130             return false;
 131         }
 132         break;
 133     case 2:
 134         if (!is_secure) {
 135             return false;
 136         }
 137         break;
 138     }
 139
 140     switch (access_el) {
 141     case 3:
 142     case 2:
 143         if (!hmc) {
 144             return false;
 145         }
 146         break;
 147     case 1:
 148         if (extract32(pac, 0, 1) == 0) {
 149             return false;
 150         }
 151         break;
 152     case 0:
 153         if (extract32(pac, 1, 1) == 0) {
 154             return false;
 155         }
 156         break;
 157     default:
 158         g_assert_not_reached();
 159     }
 160
 161     wt = extract64(cr, 20, 1);
 162     lbn = extract64(cr, 16, 4);
 163
 164     if (wt && !linked_bp_matches(cpu, lbn)) {
 165         return false;
 166     }
 167
 168     return true;
 169 }
 170
 171 static bool check_watchpoints(ARMCPU *cpu)
 172 {
 173     CPUARMState *env = &cpu->env;
 174     int n;
 175
 176     /*
 177      * If watchpoints are disabled globally or we can't take debug
 178      * exceptions here then watchpoint firings are ignored.
 179      */
 180     if (extract32(env->cp15.mdscr_el1, 15, 1) == 0
 181         || !arm_generate_debug_exceptions(env)) {
 182         return false;
 183     }
 184
 185     for (n = 0; n < ARRAY_SIZE(env->cpu_watchpoint); n++) {
 186         if (bp_wp_matches(cpu, n, true)) {
 187             return true;
 188         }
 189     }
 190     return false;
 191 }
 192
 193 static bool check_breakpoints(ARMCPU *cpu)
 194 {
 195     CPUARMState *env = &cpu->env;
 196     int n;
 197
 198     /*
 199      * If breakpoints are disabled globally or we can't take debug
 200      * exceptions here then breakpoint firings are ignored.
 201      */
 202     if (extract32(env->cp15.mdscr_el1, 15, 1) == 0
 203         || !arm_generate_debug_exceptions(env)) {
 204         return false;
 205     }
 206
 207     for (n = 0; n < ARRAY_SIZE(env->cpu_breakpoint); n++) {
 208         if (bp_wp_matches(cpu, n, false)) {
 209             return true;
 210         }
 211     }
 212     return false;
 213 }
 214
 215 void HELPER(check_breakpoints)(CPUARMState *env)
 216 {
 217     ARMCPU *cpu = env_archcpu(env);
 218
 219     if (check_breakpoints(cpu)) {
 220         HELPER(exception_internal(env, EXCP_DEBUG));
 221     }
 222 }
 223
 224 bool arm_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp)
 225 {
 226     /*
 227      * Called by core code when a CPU watchpoint fires; need to check if this
 228      * is also an architectural watchpoint match.
 229      */
 230     ARMCPU *cpu = ARM_CPU(cs);
 231
 232     return check_watchpoints(cpu);
 233 }
 234
 235 void arm_debug_excp_handler(CPUState *cs)
 236 {
 237     /*
 238      * Called by core code when a watchpoint or breakpoint fires;
 239      * need to check which one and raise the appropriate exception.
 240      */
 241     ARMCPU *cpu = ARM_CPU(cs);
 242     CPUARMState *env = &cpu->env;
 243     CPUWatchpoint *wp_hit = cs->watchpoint_hit;
 244
 245     if (wp_hit) {
 246         if (wp_hit->flags & BP_CPU) {
 247             bool wnr = (wp_hit->flags & BP_WATCHPOINT_HIT_WRITE) != 0;
 248             bool same_el = arm_debug_target_el(env) == arm_current_el(env);
 249
 250             cs->watchpoint_hit = NULL;
 251
 252             env->exception.fsr = arm_debug_exception_fsr(env);
 253             env->exception.vaddress = wp_hit->hitaddr;
 254             raise_exception(env, EXCP_DATA_ABORT,
 255                     syn_watchpoint(same_el, 0, wnr),
 256                     arm_debug_target_el(env));
 257         }
 258     } else {
 259         uint64_t pc = is_a64(env) ? env->pc : env->regs[15];
 260         bool same_el = (arm_debug_target_el(env) == arm_current_el(env));
 261
 262         /*
 263          * (1) GDB breakpoints should be handled first.
 264          * (2) Do not raise a CPU exception if no CPU breakpoint has fired,
 265          * since singlestep is also done by generating a debug internal
 266          * exception.
 267          */
 268         if (cpu_breakpoint_test(cs, pc, BP_GDB)
 269             || !cpu_breakpoint_test(cs, pc, BP_CPU)) {
 270             return;
 271         }
 272
 273         env->exception.fsr = arm_debug_exception_fsr(env);
 274         /*
 275          * FAR is UNKNOWN: clear vaddress to avoid potentially exposing
 276          * values to the guest that it shouldn't be able to see at its
 277          * exception/security level.
 278          */
 279         env->exception.vaddress = 0;
 280         raise_exception(env, EXCP_PREFETCH_ABORT,
 281                         syn_breakpoint(same_el),
 282                         arm_debug_target_el(env));
 283     }
 284 }
 285
 286 #if !defined(CONFIG_USER_ONLY)
 287
 288 vaddr arm_adjust_watchpoint_address(CPUState *cs, vaddr addr, int len)
 289 {
 290     ARMCPU *cpu = ARM_CPU(cs);
 291     CPUARMState *env = &cpu->env;
 292
 293     /*
 294      * In BE32 system mode, target memory is stored byteswapped (on a
 295      * little-endian host system), and by the time we reach here (via an
 296      * opcode helper) the addresses of subword accesses have been adjusted
 297      * to account for that, which means that watchpoints will not match.
 298      * Undo the adjustment here.
 299      */
 300     if (arm_sctlr_b(env)) {
 301         if (len == 1) {
 302             addr ^= 3;
 303         } else if (len == 2) {
 304             addr ^= 2;
 305         }
 306     }
 307
 308     return addr;
 309 }
 310
 311 #endif