xref: /openbmc/qemu/target/arm/debug_helper.c (revision 135b03cb)
1 /*
2  * ARM debug helpers.
3  *
4  * This code is licensed under the GNU GPL v2 or later.
5  *
6  * SPDX-License-Identifier: GPL-2.0-or-later
7  */
8 #include "qemu/osdep.h"
9 #include "cpu.h"
10 #include "internals.h"
11 #include "exec/exec-all.h"
12 #include "exec/helper-proto.h"
13 
14 /* Return true if the linked breakpoint entry lbn passes its checks */
15 static bool linked_bp_matches(ARMCPU *cpu, int lbn)
16 {
17     CPUARMState *env = &cpu->env;
18     uint64_t bcr = env->cp15.dbgbcr[lbn];
19     int brps = extract32(cpu->dbgdidr, 24, 4);
20     int ctx_cmps = extract32(cpu->dbgdidr, 20, 4);
21     int bt;
22     uint32_t contextidr;
23 
24     /*
25      * Links to unimplemented or non-context aware breakpoints are
26      * CONSTRAINED UNPREDICTABLE: either behave as if disabled, or
27      * as if linked to an UNKNOWN context-aware breakpoint (in which
28      * case DBGWCR<n>_EL1.LBN must indicate that breakpoint).
29      * We choose the former.
30      */
31     if (lbn > brps || lbn < (brps - ctx_cmps)) {
32         return false;
33     }
34 
35     bcr = env->cp15.dbgbcr[lbn];
36 
37     if (extract64(bcr, 0, 1) == 0) {
38         /* Linked breakpoint disabled : generate no events */
39         return false;
40     }
41 
42     bt = extract64(bcr, 20, 4);
43 
44     /*
45      * We match the whole register even if this is AArch32 using the
46      * short descriptor format (in which case it holds both PROCID and ASID),
47      * since we don't implement the optional v7 context ID masking.
48      */
49     contextidr = extract64(env->cp15.contextidr_el[1], 0, 32);
50 
51     switch (bt) {
52     case 3: /* linked context ID match */
53         if (arm_current_el(env) > 1) {
54             /* Context matches never fire in EL2 or (AArch64) EL3 */
55             return false;
56         }
57         return (contextidr == extract64(env->cp15.dbgbvr[lbn], 0, 32));
58     case 5: /* linked address mismatch (reserved in AArch64) */
59     case 9: /* linked VMID match (reserved if no EL2) */
60     case 11: /* linked context ID and VMID match (reserved if no EL2) */
61     default:
62         /*
63          * Links to Unlinked context breakpoints must generate no
64          * events; we choose to do the same for reserved values too.
65          */
66         return false;
67     }
68 
69     return false;
70 }
71 
72 static bool bp_wp_matches(ARMCPU *cpu, int n, bool is_wp)
73 {
74     CPUARMState *env = &cpu->env;
75     uint64_t cr;
76     int pac, hmc, ssc, wt, lbn;
77     /*
78      * Note that for watchpoints the check is against the CPU security
79      * state, not the S/NS attribute on the offending data access.
80      */
81     bool is_secure = arm_is_secure(env);
82     int access_el = arm_current_el(env);
83 
84     if (is_wp) {
85         CPUWatchpoint *wp = env->cpu_watchpoint[n];
86 
87         if (!wp || !(wp->flags & BP_WATCHPOINT_HIT)) {
88             return false;
89         }
90         cr = env->cp15.dbgwcr[n];
91         if (wp->hitattrs.user) {
92             /*
93              * The LDRT/STRT/LDT/STT "unprivileged access" instructions should
94              * match watchpoints as if they were accesses done at EL0, even if
95              * the CPU is at EL1 or higher.
96              */
97             access_el = 0;
98         }
99     } else {
100         uint64_t pc = is_a64(env) ? env->pc : env->regs[15];
101 
102         if (!env->cpu_breakpoint[n] || env->cpu_breakpoint[n]->pc != pc) {
103             return false;
104         }
105         cr = env->cp15.dbgbcr[n];
106     }
107     /*
108      * The WATCHPOINT_HIT flag guarantees us that the watchpoint is
109      * enabled and that the address and access type match; for breakpoints
110      * we know the address matched; check the remaining fields, including
111      * linked breakpoints. We rely on WCR and BCR having the same layout
112      * for the LBN, SSC, HMC, PAC/PMC and is-linked fields.
113      * Note that some combinations of {PAC, HMC, SSC} are reserved and
114      * must act either like some valid combination or as if the watchpoint
115      * were disabled. We choose the former, and use this together with
116      * the fact that EL3 must always be Secure and EL2 must always be
117      * Non-Secure to simplify the code slightly compared to the full
118      * table in the ARM ARM.
119      */
120     pac = extract64(cr, 1, 2);
121     hmc = extract64(cr, 13, 1);
122     ssc = extract64(cr, 14, 2);
123 
124     switch (ssc) {
125     case 0:
126         break;
127     case 1:
128     case 3:
129         if (is_secure) {
130             return false;
131         }
132         break;
133     case 2:
134         if (!is_secure) {
135             return false;
136         }
137         break;
138     }
139 
140     switch (access_el) {
141     case 3:
142     case 2:
143         if (!hmc) {
144             return false;
145         }
146         break;
147     case 1:
148         if (extract32(pac, 0, 1) == 0) {
149             return false;
150         }
151         break;
152     case 0:
153         if (extract32(pac, 1, 1) == 0) {
154             return false;
155         }
156         break;
157     default:
158         g_assert_not_reached();
159     }
160 
161     wt = extract64(cr, 20, 1);
162     lbn = extract64(cr, 16, 4);
163 
164     if (wt && !linked_bp_matches(cpu, lbn)) {
165         return false;
166     }
167 
168     return true;
169 }
170 
171 static bool check_watchpoints(ARMCPU *cpu)
172 {
173     CPUARMState *env = &cpu->env;
174     int n;
175 
176     /*
177      * If watchpoints are disabled globally or we can't take debug
178      * exceptions here then watchpoint firings are ignored.
179      */
180     if (extract32(env->cp15.mdscr_el1, 15, 1) == 0
181         || !arm_generate_debug_exceptions(env)) {
182         return false;
183     }
184 
185     for (n = 0; n < ARRAY_SIZE(env->cpu_watchpoint); n++) {
186         if (bp_wp_matches(cpu, n, true)) {
187             return true;
188         }
189     }
190     return false;
191 }
192 
193 static bool check_breakpoints(ARMCPU *cpu)
194 {
195     CPUARMState *env = &cpu->env;
196     int n;
197 
198     /*
199      * If breakpoints are disabled globally or we can't take debug
200      * exceptions here then breakpoint firings are ignored.
201      */
202     if (extract32(env->cp15.mdscr_el1, 15, 1) == 0
203         || !arm_generate_debug_exceptions(env)) {
204         return false;
205     }
206 
207     for (n = 0; n < ARRAY_SIZE(env->cpu_breakpoint); n++) {
208         if (bp_wp_matches(cpu, n, false)) {
209             return true;
210         }
211     }
212     return false;
213 }
214 
215 void HELPER(check_breakpoints)(CPUARMState *env)
216 {
217     ARMCPU *cpu = env_archcpu(env);
218 
219     if (check_breakpoints(cpu)) {
220         HELPER(exception_internal(env, EXCP_DEBUG));
221     }
222 }
223 
224 bool arm_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp)
225 {
226     /*
227      * Called by core code when a CPU watchpoint fires; need to check if this
228      * is also an architectural watchpoint match.
229      */
230     ARMCPU *cpu = ARM_CPU(cs);
231 
232     return check_watchpoints(cpu);
233 }
234 
235 void arm_debug_excp_handler(CPUState *cs)
236 {
237     /*
238      * Called by core code when a watchpoint or breakpoint fires;
239      * need to check which one and raise the appropriate exception.
240      */
241     ARMCPU *cpu = ARM_CPU(cs);
242     CPUARMState *env = &cpu->env;
243     CPUWatchpoint *wp_hit = cs->watchpoint_hit;
244 
245     if (wp_hit) {
246         if (wp_hit->flags & BP_CPU) {
247             bool wnr = (wp_hit->flags & BP_WATCHPOINT_HIT_WRITE) != 0;
248             bool same_el = arm_debug_target_el(env) == arm_current_el(env);
249 
250             cs->watchpoint_hit = NULL;
251 
252             env->exception.fsr = arm_debug_exception_fsr(env);
253             env->exception.vaddress = wp_hit->hitaddr;
254             raise_exception(env, EXCP_DATA_ABORT,
255                     syn_watchpoint(same_el, 0, wnr),
256                     arm_debug_target_el(env));
257         }
258     } else {
259         uint64_t pc = is_a64(env) ? env->pc : env->regs[15];
260         bool same_el = (arm_debug_target_el(env) == arm_current_el(env));
261 
262         /*
263          * (1) GDB breakpoints should be handled first.
264          * (2) Do not raise a CPU exception if no CPU breakpoint has fired,
265          * since singlestep is also done by generating a debug internal
266          * exception.
267          */
268         if (cpu_breakpoint_test(cs, pc, BP_GDB)
269             || !cpu_breakpoint_test(cs, pc, BP_CPU)) {
270             return;
271         }
272 
273         env->exception.fsr = arm_debug_exception_fsr(env);
274         /*
275          * FAR is UNKNOWN: clear vaddress to avoid potentially exposing
276          * values to the guest that it shouldn't be able to see at its
277          * exception/security level.
278          */
279         env->exception.vaddress = 0;
280         raise_exception(env, EXCP_PREFETCH_ABORT,
281                         syn_breakpoint(same_el),
282                         arm_debug_target_el(env));
283     }
284 }
285 
286 #if !defined(CONFIG_USER_ONLY)
287 
288 vaddr arm_adjust_watchpoint_address(CPUState *cs, vaddr addr, int len)
289 {
290     ARMCPU *cpu = ARM_CPU(cs);
291     CPUARMState *env = &cpu->env;
292 
293     /*
294      * In BE32 system mode, target memory is stored byteswapped (on a
295      * little-endian host system), and by the time we reach here (via an
296      * opcode helper) the addresses of subword accesses have been adjusted
297      * to account for that, which means that watchpoints will not match.
298      * Undo the adjustment here.
299      */
300     if (arm_sctlr_b(env)) {
301         if (len == 1) {
302             addr ^= 3;
303         } else if (len == 2) {
304             addr ^= 2;
305         }
306     }
307 
308     return addr;
309 }
310 
311 #endif
312