1 /* 2 * ARM debug helpers. 3 * 4 * This code is licensed under the GNU GPL v2 or later. 5 * 6 * SPDX-License-Identifier: GPL-2.0-or-later 7 */ 8 #include "qemu/osdep.h" 9 #include "qemu/log.h" 10 #include "cpu.h" 11 #include "internals.h" 12 #include "cpu-features.h" 13 #include "cpregs.h" 14 #include "exec/exec-all.h" 15 #include "exec/helper-proto.h" 16 #include "sysemu/tcg.h" 17 18 #ifdef CONFIG_TCG 19 /* Return the Exception Level targeted by debug exceptions. */ 20 static int arm_debug_target_el(CPUARMState *env) 21 { 22 bool secure = arm_is_secure(env); 23 bool route_to_el2 = false; 24 25 if (arm_feature(env, ARM_FEATURE_M)) { 26 return 1; 27 } 28 29 if (arm_is_el2_enabled(env)) { 30 route_to_el2 = env->cp15.hcr_el2 & HCR_TGE || 31 env->cp15.mdcr_el2 & MDCR_TDE; 32 } 33 34 if (route_to_el2) { 35 return 2; 36 } else if (arm_feature(env, ARM_FEATURE_EL3) && 37 !arm_el_is_aa64(env, 3) && secure) { 38 return 3; 39 } else { 40 return 1; 41 } 42 } 43 44 /* 45 * Raise an exception to the debug target el. 46 * Modify syndrome to indicate when origin and target EL are the same. 47 */ 48 G_NORETURN static void 49 raise_exception_debug(CPUARMState *env, uint32_t excp, uint32_t syndrome) 50 { 51 int debug_el = arm_debug_target_el(env); 52 int cur_el = arm_current_el(env); 53 54 /* 55 * If singlestep is targeting a lower EL than the current one, then 56 * DisasContext.ss_active must be false and we can never get here. 57 * Similarly for watchpoint and breakpoint matches. 58 */ 59 assert(debug_el >= cur_el); 60 syndrome |= (debug_el == cur_el) << ARM_EL_EC_SHIFT; 61 raise_exception(env, excp, syndrome, debug_el); 62 } 63 64 /* See AArch64.GenerateDebugExceptionsFrom() in ARM ARM pseudocode */ 65 static bool aa64_generate_debug_exceptions(CPUARMState *env) 66 { 67 int cur_el = arm_current_el(env); 68 int debug_el; 69 70 if (cur_el == 3) { 71 return false; 72 } 73 74 /* MDCR_EL3.SDD disables debug events from Secure state */ 75 if (arm_is_secure_below_el3(env) 76 && extract32(env->cp15.mdcr_el3, 16, 1)) { 77 return false; 78 } 79 80 /* 81 * Same EL to same EL debug exceptions need MDSCR_KDE enabled 82 * while not masking the (D)ebug bit in DAIF. 83 */ 84 debug_el = arm_debug_target_el(env); 85 86 if (cur_el == debug_el) { 87 return extract32(env->cp15.mdscr_el1, 13, 1) 88 && !(env->daif & PSTATE_D); 89 } 90 91 /* Otherwise the debug target needs to be a higher EL */ 92 return debug_el > cur_el; 93 } 94 95 static bool aa32_generate_debug_exceptions(CPUARMState *env) 96 { 97 int el = arm_current_el(env); 98 99 if (el == 0 && arm_el_is_aa64(env, 1)) { 100 return aa64_generate_debug_exceptions(env); 101 } 102 103 if (arm_is_secure(env)) { 104 int spd; 105 106 if (el == 0 && (env->cp15.sder & 1)) { 107 /* 108 * SDER.SUIDEN means debug exceptions from Secure EL0 109 * are always enabled. Otherwise they are controlled by 110 * SDCR.SPD like those from other Secure ELs. 111 */ 112 return true; 113 } 114 115 spd = extract32(env->cp15.mdcr_el3, 14, 2); 116 switch (spd) { 117 case 1: 118 /* SPD == 0b01 is reserved, but behaves as 0b00. */ 119 case 0: 120 /* 121 * For 0b00 we return true if external secure invasive debug 122 * is enabled. On real hardware this is controlled by external 123 * signals to the core. QEMU always permits debug, and behaves 124 * as if DBGEN, SPIDEN, NIDEN and SPNIDEN are all tied high. 125 */ 126 return true; 127 case 2: 128 return false; 129 case 3: 130 return true; 131 } 132 } 133 134 return el != 2; 135 } 136 137 /* 138 * Return true if debugging exceptions are currently enabled. 139 * This corresponds to what in ARM ARM pseudocode would be 140 * if UsingAArch32() then 141 * return AArch32.GenerateDebugExceptions() 142 * else 143 * return AArch64.GenerateDebugExceptions() 144 * We choose to push the if() down into this function for clarity, 145 * since the pseudocode has it at all callsites except for the one in 146 * CheckSoftwareStep(), where it is elided because both branches would 147 * always return the same value. 148 */ 149 bool arm_generate_debug_exceptions(CPUARMState *env) 150 { 151 if ((env->cp15.oslsr_el1 & 1) || (env->cp15.osdlr_el1 & 1)) { 152 return false; 153 } 154 if (is_a64(env)) { 155 return aa64_generate_debug_exceptions(env); 156 } else { 157 return aa32_generate_debug_exceptions(env); 158 } 159 } 160 161 /* 162 * Is single-stepping active? (Note that the "is EL_D AArch64?" check 163 * implicitly means this always returns false in pre-v8 CPUs.) 164 */ 165 bool arm_singlestep_active(CPUARMState *env) 166 { 167 return extract32(env->cp15.mdscr_el1, 0, 1) 168 && arm_el_is_aa64(env, arm_debug_target_el(env)) 169 && arm_generate_debug_exceptions(env); 170 } 171 172 /* Return true if the linked breakpoint entry lbn passes its checks */ 173 static bool linked_bp_matches(ARMCPU *cpu, int lbn) 174 { 175 CPUARMState *env = &cpu->env; 176 uint64_t bcr = env->cp15.dbgbcr[lbn]; 177 int brps = arm_num_brps(cpu); 178 int ctx_cmps = arm_num_ctx_cmps(cpu); 179 int bt; 180 uint32_t contextidr; 181 uint64_t hcr_el2; 182 183 /* 184 * Links to unimplemented or non-context aware breakpoints are 185 * CONSTRAINED UNPREDICTABLE: either behave as if disabled, or 186 * as if linked to an UNKNOWN context-aware breakpoint (in which 187 * case DBGWCR<n>_EL1.LBN must indicate that breakpoint). 188 * We choose the former. 189 */ 190 if (lbn >= brps || lbn < (brps - ctx_cmps)) { 191 return false; 192 } 193 194 bcr = env->cp15.dbgbcr[lbn]; 195 196 if (extract64(bcr, 0, 1) == 0) { 197 /* Linked breakpoint disabled : generate no events */ 198 return false; 199 } 200 201 bt = extract64(bcr, 20, 4); 202 hcr_el2 = arm_hcr_el2_eff(env); 203 204 switch (bt) { 205 case 3: /* linked context ID match */ 206 switch (arm_current_el(env)) { 207 default: 208 /* Context matches never fire in AArch64 EL3 */ 209 return false; 210 case 2: 211 if (!(hcr_el2 & HCR_E2H)) { 212 /* Context matches never fire in EL2 without E2H enabled. */ 213 return false; 214 } 215 contextidr = env->cp15.contextidr_el[2]; 216 break; 217 case 1: 218 contextidr = env->cp15.contextidr_el[1]; 219 break; 220 case 0: 221 if ((hcr_el2 & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) { 222 contextidr = env->cp15.contextidr_el[2]; 223 } else { 224 contextidr = env->cp15.contextidr_el[1]; 225 } 226 break; 227 } 228 break; 229 230 case 7: /* linked contextidr_el1 match */ 231 contextidr = env->cp15.contextidr_el[1]; 232 break; 233 case 13: /* linked contextidr_el2 match */ 234 contextidr = env->cp15.contextidr_el[2]; 235 break; 236 237 case 9: /* linked VMID match (reserved if no EL2) */ 238 case 11: /* linked context ID and VMID match (reserved if no EL2) */ 239 case 15: /* linked full context ID match */ 240 default: 241 /* 242 * Links to Unlinked context breakpoints must generate no 243 * events; we choose to do the same for reserved values too. 244 */ 245 return false; 246 } 247 248 /* 249 * We match the whole register even if this is AArch32 using the 250 * short descriptor format (in which case it holds both PROCID and ASID), 251 * since we don't implement the optional v7 context ID masking. 252 */ 253 return contextidr == (uint32_t)env->cp15.dbgbvr[lbn]; 254 } 255 256 static bool bp_wp_matches(ARMCPU *cpu, int n, bool is_wp) 257 { 258 CPUARMState *env = &cpu->env; 259 uint64_t cr; 260 int pac, hmc, ssc, wt, lbn; 261 /* 262 * Note that for watchpoints the check is against the CPU security 263 * state, not the S/NS attribute on the offending data access. 264 */ 265 bool is_secure = arm_is_secure(env); 266 int access_el = arm_current_el(env); 267 268 if (is_wp) { 269 CPUWatchpoint *wp = env->cpu_watchpoint[n]; 270 271 if (!wp || !(wp->flags & BP_WATCHPOINT_HIT)) { 272 return false; 273 } 274 cr = env->cp15.dbgwcr[n]; 275 if (wp->hitattrs.user) { 276 /* 277 * The LDRT/STRT/LDT/STT "unprivileged access" instructions should 278 * match watchpoints as if they were accesses done at EL0, even if 279 * the CPU is at EL1 or higher. 280 */ 281 access_el = 0; 282 } 283 } else { 284 uint64_t pc = is_a64(env) ? env->pc : env->regs[15]; 285 286 if (!env->cpu_breakpoint[n] || env->cpu_breakpoint[n]->pc != pc) { 287 return false; 288 } 289 cr = env->cp15.dbgbcr[n]; 290 } 291 /* 292 * The WATCHPOINT_HIT flag guarantees us that the watchpoint is 293 * enabled and that the address and access type match; for breakpoints 294 * we know the address matched; check the remaining fields, including 295 * linked breakpoints. We rely on WCR and BCR having the same layout 296 * for the LBN, SSC, HMC, PAC/PMC and is-linked fields. 297 * Note that some combinations of {PAC, HMC, SSC} are reserved and 298 * must act either like some valid combination or as if the watchpoint 299 * were disabled. We choose the former, and use this together with 300 * the fact that EL3 must always be Secure and EL2 must always be 301 * Non-Secure to simplify the code slightly compared to the full 302 * table in the ARM ARM. 303 */ 304 pac = FIELD_EX64(cr, DBGWCR, PAC); 305 hmc = FIELD_EX64(cr, DBGWCR, HMC); 306 ssc = FIELD_EX64(cr, DBGWCR, SSC); 307 308 switch (ssc) { 309 case 0: 310 break; 311 case 1: 312 case 3: 313 if (is_secure) { 314 return false; 315 } 316 break; 317 case 2: 318 if (!is_secure) { 319 return false; 320 } 321 break; 322 } 323 324 switch (access_el) { 325 case 3: 326 case 2: 327 if (!hmc) { 328 return false; 329 } 330 break; 331 case 1: 332 if (extract32(pac, 0, 1) == 0) { 333 return false; 334 } 335 break; 336 case 0: 337 if (extract32(pac, 1, 1) == 0) { 338 return false; 339 } 340 break; 341 default: 342 g_assert_not_reached(); 343 } 344 345 wt = FIELD_EX64(cr, DBGWCR, WT); 346 lbn = FIELD_EX64(cr, DBGWCR, LBN); 347 348 if (wt && !linked_bp_matches(cpu, lbn)) { 349 return false; 350 } 351 352 return true; 353 } 354 355 static bool check_watchpoints(ARMCPU *cpu) 356 { 357 CPUARMState *env = &cpu->env; 358 int n; 359 360 /* 361 * If watchpoints are disabled globally or we can't take debug 362 * exceptions here then watchpoint firings are ignored. 363 */ 364 if (extract32(env->cp15.mdscr_el1, 15, 1) == 0 365 || !arm_generate_debug_exceptions(env)) { 366 return false; 367 } 368 369 for (n = 0; n < ARRAY_SIZE(env->cpu_watchpoint); n++) { 370 if (bp_wp_matches(cpu, n, true)) { 371 return true; 372 } 373 } 374 return false; 375 } 376 377 bool arm_debug_check_breakpoint(CPUState *cs) 378 { 379 ARMCPU *cpu = ARM_CPU(cs); 380 CPUARMState *env = &cpu->env; 381 target_ulong pc; 382 int n; 383 384 /* 385 * If breakpoints are disabled globally or we can't take debug 386 * exceptions here then breakpoint firings are ignored. 387 */ 388 if (extract32(env->cp15.mdscr_el1, 15, 1) == 0 389 || !arm_generate_debug_exceptions(env)) { 390 return false; 391 } 392 393 /* 394 * Single-step exceptions have priority over breakpoint exceptions. 395 * If single-step state is active-pending, suppress the bp. 396 */ 397 if (arm_singlestep_active(env) && !(env->pstate & PSTATE_SS)) { 398 return false; 399 } 400 401 /* 402 * PC alignment faults have priority over breakpoint exceptions. 403 */ 404 pc = is_a64(env) ? env->pc : env->regs[15]; 405 if ((is_a64(env) || !env->thumb) && (pc & 3) != 0) { 406 return false; 407 } 408 409 /* 410 * Instruction aborts have priority over breakpoint exceptions. 411 * TODO: We would need to look up the page for PC and verify that 412 * it is present and executable. 413 */ 414 415 for (n = 0; n < ARRAY_SIZE(env->cpu_breakpoint); n++) { 416 if (bp_wp_matches(cpu, n, false)) { 417 return true; 418 } 419 } 420 return false; 421 } 422 423 bool arm_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp) 424 { 425 /* 426 * Called by core code when a CPU watchpoint fires; need to check if this 427 * is also an architectural watchpoint match. 428 */ 429 ARMCPU *cpu = ARM_CPU(cs); 430 431 return check_watchpoints(cpu); 432 } 433 434 /* 435 * Return the FSR value for a debug exception (watchpoint, hardware 436 * breakpoint or BKPT insn) targeting the specified exception level. 437 */ 438 static uint32_t arm_debug_exception_fsr(CPUARMState *env) 439 { 440 ARMMMUFaultInfo fi = { .type = ARMFault_Debug }; 441 int target_el = arm_debug_target_el(env); 442 bool using_lpae; 443 444 if (arm_feature(env, ARM_FEATURE_M)) { 445 using_lpae = false; 446 } else if (target_el == 2 || arm_el_is_aa64(env, target_el)) { 447 using_lpae = true; 448 } else if (arm_feature(env, ARM_FEATURE_PMSA) && 449 arm_feature(env, ARM_FEATURE_V8)) { 450 using_lpae = true; 451 } else if (arm_feature(env, ARM_FEATURE_LPAE) && 452 (env->cp15.tcr_el[target_el] & TTBCR_EAE)) { 453 using_lpae = true; 454 } else { 455 using_lpae = false; 456 } 457 458 if (using_lpae) { 459 return arm_fi_to_lfsc(&fi); 460 } else { 461 return arm_fi_to_sfsc(&fi); 462 } 463 } 464 465 void arm_debug_excp_handler(CPUState *cs) 466 { 467 /* 468 * Called by core code when a watchpoint or breakpoint fires; 469 * need to check which one and raise the appropriate exception. 470 */ 471 ARMCPU *cpu = ARM_CPU(cs); 472 CPUARMState *env = &cpu->env; 473 CPUWatchpoint *wp_hit = cs->watchpoint_hit; 474 475 if (wp_hit) { 476 if (wp_hit->flags & BP_CPU) { 477 bool wnr = (wp_hit->flags & BP_WATCHPOINT_HIT_WRITE) != 0; 478 479 cs->watchpoint_hit = NULL; 480 481 env->exception.fsr = arm_debug_exception_fsr(env); 482 env->exception.vaddress = wp_hit->hitaddr; 483 raise_exception_debug(env, EXCP_DATA_ABORT, 484 syn_watchpoint(0, 0, wnr)); 485 } 486 } else { 487 uint64_t pc = is_a64(env) ? env->pc : env->regs[15]; 488 489 /* 490 * (1) GDB breakpoints should be handled first. 491 * (2) Do not raise a CPU exception if no CPU breakpoint has fired, 492 * since singlestep is also done by generating a debug internal 493 * exception. 494 */ 495 if (cpu_breakpoint_test(cs, pc, BP_GDB) 496 || !cpu_breakpoint_test(cs, pc, BP_CPU)) { 497 return; 498 } 499 500 env->exception.fsr = arm_debug_exception_fsr(env); 501 /* 502 * FAR is UNKNOWN: clear vaddress to avoid potentially exposing 503 * values to the guest that it shouldn't be able to see at its 504 * exception/security level. 505 */ 506 env->exception.vaddress = 0; 507 raise_exception_debug(env, EXCP_PREFETCH_ABORT, syn_breakpoint(0)); 508 } 509 } 510 511 /* 512 * Raise an EXCP_BKPT with the specified syndrome register value, 513 * targeting the correct exception level for debug exceptions. 514 */ 515 void HELPER(exception_bkpt_insn)(CPUARMState *env, uint32_t syndrome) 516 { 517 int debug_el = arm_debug_target_el(env); 518 int cur_el = arm_current_el(env); 519 520 /* FSR will only be used if the debug target EL is AArch32. */ 521 env->exception.fsr = arm_debug_exception_fsr(env); 522 /* 523 * FAR is UNKNOWN: clear vaddress to avoid potentially exposing 524 * values to the guest that it shouldn't be able to see at its 525 * exception/security level. 526 */ 527 env->exception.vaddress = 0; 528 /* 529 * Other kinds of architectural debug exception are ignored if 530 * they target an exception level below the current one (in QEMU 531 * this is checked by arm_generate_debug_exceptions()). Breakpoint 532 * instructions are special because they always generate an exception 533 * to somewhere: if they can't go to the configured debug exception 534 * level they are taken to the current exception level. 535 */ 536 if (debug_el < cur_el) { 537 debug_el = cur_el; 538 } 539 raise_exception(env, EXCP_BKPT, syndrome, debug_el); 540 } 541 542 void HELPER(exception_swstep)(CPUARMState *env, uint32_t syndrome) 543 { 544 raise_exception_debug(env, EXCP_UDEF, syndrome); 545 } 546 547 void hw_watchpoint_update(ARMCPU *cpu, int n) 548 { 549 CPUARMState *env = &cpu->env; 550 vaddr len = 0; 551 vaddr wvr = env->cp15.dbgwvr[n]; 552 uint64_t wcr = env->cp15.dbgwcr[n]; 553 int mask; 554 int flags = BP_CPU | BP_STOP_BEFORE_ACCESS; 555 556 if (env->cpu_watchpoint[n]) { 557 cpu_watchpoint_remove_by_ref(CPU(cpu), env->cpu_watchpoint[n]); 558 env->cpu_watchpoint[n] = NULL; 559 } 560 561 if (!FIELD_EX64(wcr, DBGWCR, E)) { 562 /* E bit clear : watchpoint disabled */ 563 return; 564 } 565 566 switch (FIELD_EX64(wcr, DBGWCR, LSC)) { 567 case 0: 568 /* LSC 00 is reserved and must behave as if the wp is disabled */ 569 return; 570 case 1: 571 flags |= BP_MEM_READ; 572 break; 573 case 2: 574 flags |= BP_MEM_WRITE; 575 break; 576 case 3: 577 flags |= BP_MEM_ACCESS; 578 break; 579 } 580 581 /* 582 * Attempts to use both MASK and BAS fields simultaneously are 583 * CONSTRAINED UNPREDICTABLE; we opt to ignore BAS in this case, 584 * thus generating a watchpoint for every byte in the masked region. 585 */ 586 mask = FIELD_EX64(wcr, DBGWCR, MASK); 587 if (mask == 1 || mask == 2) { 588 /* 589 * Reserved values of MASK; we must act as if the mask value was 590 * some non-reserved value, or as if the watchpoint were disabled. 591 * We choose the latter. 592 */ 593 return; 594 } else if (mask) { 595 /* Watchpoint covers an aligned area up to 2GB in size */ 596 len = 1ULL << mask; 597 /* 598 * If masked bits in WVR are not zero it's CONSTRAINED UNPREDICTABLE 599 * whether the watchpoint fires when the unmasked bits match; we opt 600 * to generate the exceptions. 601 */ 602 wvr &= ~(len - 1); 603 } else { 604 /* Watchpoint covers bytes defined by the byte address select bits */ 605 int bas = FIELD_EX64(wcr, DBGWCR, BAS); 606 int basstart; 607 608 if (extract64(wvr, 2, 1)) { 609 /* 610 * Deprecated case of an only 4-aligned address. BAS[7:4] are 611 * ignored, and BAS[3:0] define which bytes to watch. 612 */ 613 bas &= 0xf; 614 } 615 616 if (bas == 0) { 617 /* This must act as if the watchpoint is disabled */ 618 return; 619 } 620 621 /* 622 * The BAS bits are supposed to be programmed to indicate a contiguous 623 * range of bytes. Otherwise it is CONSTRAINED UNPREDICTABLE whether 624 * we fire for each byte in the word/doubleword addressed by the WVR. 625 * We choose to ignore any non-zero bits after the first range of 1s. 626 */ 627 basstart = ctz32(bas); 628 len = cto32(bas >> basstart); 629 wvr += basstart; 630 } 631 632 cpu_watchpoint_insert(CPU(cpu), wvr, len, flags, 633 &env->cpu_watchpoint[n]); 634 } 635 636 void hw_watchpoint_update_all(ARMCPU *cpu) 637 { 638 int i; 639 CPUARMState *env = &cpu->env; 640 641 /* 642 * Completely clear out existing QEMU watchpoints and our array, to 643 * avoid possible stale entries following migration load. 644 */ 645 cpu_watchpoint_remove_all(CPU(cpu), BP_CPU); 646 memset(env->cpu_watchpoint, 0, sizeof(env->cpu_watchpoint)); 647 648 for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_watchpoint); i++) { 649 hw_watchpoint_update(cpu, i); 650 } 651 } 652 653 void hw_breakpoint_update(ARMCPU *cpu, int n) 654 { 655 CPUARMState *env = &cpu->env; 656 uint64_t bvr = env->cp15.dbgbvr[n]; 657 uint64_t bcr = env->cp15.dbgbcr[n]; 658 vaddr addr; 659 int bt; 660 int flags = BP_CPU; 661 662 if (env->cpu_breakpoint[n]) { 663 cpu_breakpoint_remove_by_ref(CPU(cpu), env->cpu_breakpoint[n]); 664 env->cpu_breakpoint[n] = NULL; 665 } 666 667 if (!extract64(bcr, 0, 1)) { 668 /* E bit clear : watchpoint disabled */ 669 return; 670 } 671 672 bt = extract64(bcr, 20, 4); 673 674 switch (bt) { 675 case 4: /* unlinked address mismatch (reserved if AArch64) */ 676 case 5: /* linked address mismatch (reserved if AArch64) */ 677 qemu_log_mask(LOG_UNIMP, 678 "arm: address mismatch breakpoint types not implemented\n"); 679 return; 680 case 0: /* unlinked address match */ 681 case 1: /* linked address match */ 682 { 683 /* 684 * Bits [1:0] are RES0. 685 * 686 * It is IMPLEMENTATION DEFINED whether bits [63:49] 687 * ([63:53] for FEAT_LVA) are hardwired to a copy of the sign bit 688 * of the VA field ([48] or [52] for FEAT_LVA), or whether the 689 * value is read as written. It is CONSTRAINED UNPREDICTABLE 690 * whether the RESS bits are ignored when comparing an address. 691 * Therefore we are allowed to compare the entire register, which 692 * lets us avoid considering whether FEAT_LVA is actually enabled. 693 * 694 * The BAS field is used to allow setting breakpoints on 16-bit 695 * wide instructions; it is CONSTRAINED UNPREDICTABLE whether 696 * a bp will fire if the addresses covered by the bp and the addresses 697 * covered by the insn overlap but the insn doesn't start at the 698 * start of the bp address range. We choose to require the insn and 699 * the bp to have the same address. The constraints on writing to 700 * BAS enforced in dbgbcr_write mean we have only four cases: 701 * 0b0000 => no breakpoint 702 * 0b0011 => breakpoint on addr 703 * 0b1100 => breakpoint on addr + 2 704 * 0b1111 => breakpoint on addr 705 * See also figure D2-3 in the v8 ARM ARM (DDI0487A.c). 706 */ 707 int bas = extract64(bcr, 5, 4); 708 addr = bvr & ~3ULL; 709 if (bas == 0) { 710 return; 711 } 712 if (bas == 0xc) { 713 addr += 2; 714 } 715 break; 716 } 717 case 2: /* unlinked context ID match */ 718 case 8: /* unlinked VMID match (reserved if no EL2) */ 719 case 10: /* unlinked context ID and VMID match (reserved if no EL2) */ 720 qemu_log_mask(LOG_UNIMP, 721 "arm: unlinked context breakpoint types not implemented\n"); 722 return; 723 case 9: /* linked VMID match (reserved if no EL2) */ 724 case 11: /* linked context ID and VMID match (reserved if no EL2) */ 725 case 3: /* linked context ID match */ 726 default: 727 /* 728 * We must generate no events for Linked context matches (unless 729 * they are linked to by some other bp/wp, which is handled in 730 * updates for the linking bp/wp). We choose to also generate no events 731 * for reserved values. 732 */ 733 return; 734 } 735 736 cpu_breakpoint_insert(CPU(cpu), addr, flags, &env->cpu_breakpoint[n]); 737 } 738 739 void hw_breakpoint_update_all(ARMCPU *cpu) 740 { 741 int i; 742 CPUARMState *env = &cpu->env; 743 744 /* 745 * Completely clear out existing QEMU breakpoints and our array, to 746 * avoid possible stale entries following migration load. 747 */ 748 cpu_breakpoint_remove_all(CPU(cpu), BP_CPU); 749 memset(env->cpu_breakpoint, 0, sizeof(env->cpu_breakpoint)); 750 751 for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_breakpoint); i++) { 752 hw_breakpoint_update(cpu, i); 753 } 754 } 755 756 #if !defined(CONFIG_USER_ONLY) 757 758 vaddr arm_adjust_watchpoint_address(CPUState *cs, vaddr addr, int len) 759 { 760 ARMCPU *cpu = ARM_CPU(cs); 761 CPUARMState *env = &cpu->env; 762 763 /* 764 * In BE32 system mode, target memory is stored byteswapped (on a 765 * little-endian host system), and by the time we reach here (via an 766 * opcode helper) the addresses of subword accesses have been adjusted 767 * to account for that, which means that watchpoints will not match. 768 * Undo the adjustment here. 769 */ 770 if (arm_sctlr_b(env)) { 771 if (len == 1) { 772 addr ^= 3; 773 } else if (len == 2) { 774 addr ^= 2; 775 } 776 } 777 778 return addr; 779 } 780 781 #endif /* !CONFIG_USER_ONLY */ 782 #endif /* CONFIG_TCG */ 783 784 /* 785 * Check for traps to "powerdown debug" registers, which are controlled 786 * by MDCR.TDOSA 787 */ 788 static CPAccessResult access_tdosa(CPUARMState *env, const ARMCPRegInfo *ri, 789 bool isread) 790 { 791 int el = arm_current_el(env); 792 uint64_t mdcr_el2 = arm_mdcr_el2_eff(env); 793 bool mdcr_el2_tdosa = (mdcr_el2 & MDCR_TDOSA) || (mdcr_el2 & MDCR_TDE) || 794 (arm_hcr_el2_eff(env) & HCR_TGE); 795 796 if (el < 2 && mdcr_el2_tdosa) { 797 return CP_ACCESS_TRAP_EL2; 798 } 799 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDOSA)) { 800 return CP_ACCESS_TRAP_EL3; 801 } 802 return CP_ACCESS_OK; 803 } 804 805 /* 806 * Check for traps to "debug ROM" registers, which are controlled 807 * by MDCR_EL2.TDRA for EL2 but by the more general MDCR_EL3.TDA for EL3. 808 */ 809 static CPAccessResult access_tdra(CPUARMState *env, const ARMCPRegInfo *ri, 810 bool isread) 811 { 812 int el = arm_current_el(env); 813 uint64_t mdcr_el2 = arm_mdcr_el2_eff(env); 814 bool mdcr_el2_tdra = (mdcr_el2 & MDCR_TDRA) || (mdcr_el2 & MDCR_TDE) || 815 (arm_hcr_el2_eff(env) & HCR_TGE); 816 817 if (el < 2 && mdcr_el2_tdra) { 818 return CP_ACCESS_TRAP_EL2; 819 } 820 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) { 821 return CP_ACCESS_TRAP_EL3; 822 } 823 return CP_ACCESS_OK; 824 } 825 826 /* 827 * Check for traps to general debug registers, which are controlled 828 * by MDCR_EL2.TDA for EL2 and MDCR_EL3.TDA for EL3. 829 */ 830 static CPAccessResult access_tda(CPUARMState *env, const ARMCPRegInfo *ri, 831 bool isread) 832 { 833 int el = arm_current_el(env); 834 uint64_t mdcr_el2 = arm_mdcr_el2_eff(env); 835 bool mdcr_el2_tda = (mdcr_el2 & MDCR_TDA) || (mdcr_el2 & MDCR_TDE) || 836 (arm_hcr_el2_eff(env) & HCR_TGE); 837 838 if (el < 2 && mdcr_el2_tda) { 839 return CP_ACCESS_TRAP_EL2; 840 } 841 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) { 842 return CP_ACCESS_TRAP_EL3; 843 } 844 return CP_ACCESS_OK; 845 } 846 847 /* 848 * Check for traps to Debug Comms Channel registers. If FEAT_FGT 849 * is implemented then these are controlled by MDCR_EL2.TDCC for 850 * EL2 and MDCR_EL3.TDCC for EL3. They are also controlled by 851 * the general debug access trap bits MDCR_EL2.TDA and MDCR_EL3.TDA. 852 * For EL0, they are also controlled by MDSCR_EL1.TDCC. 853 */ 854 static CPAccessResult access_tdcc(CPUARMState *env, const ARMCPRegInfo *ri, 855 bool isread) 856 { 857 int el = arm_current_el(env); 858 uint64_t mdcr_el2 = arm_mdcr_el2_eff(env); 859 bool mdscr_el1_tdcc = extract32(env->cp15.mdscr_el1, 12, 1); 860 bool mdcr_el2_tda = (mdcr_el2 & MDCR_TDA) || (mdcr_el2 & MDCR_TDE) || 861 (arm_hcr_el2_eff(env) & HCR_TGE); 862 bool mdcr_el2_tdcc = cpu_isar_feature(aa64_fgt, env_archcpu(env)) && 863 (mdcr_el2 & MDCR_TDCC); 864 bool mdcr_el3_tdcc = cpu_isar_feature(aa64_fgt, env_archcpu(env)) && 865 (env->cp15.mdcr_el3 & MDCR_TDCC); 866 867 if (el < 1 && mdscr_el1_tdcc) { 868 return CP_ACCESS_TRAP; 869 } 870 if (el < 2 && (mdcr_el2_tda || mdcr_el2_tdcc)) { 871 return CP_ACCESS_TRAP_EL2; 872 } 873 if (el < 3 && ((env->cp15.mdcr_el3 & MDCR_TDA) || mdcr_el3_tdcc)) { 874 return CP_ACCESS_TRAP_EL3; 875 } 876 return CP_ACCESS_OK; 877 } 878 879 static void oslar_write(CPUARMState *env, const ARMCPRegInfo *ri, 880 uint64_t value) 881 { 882 /* 883 * Writes to OSLAR_EL1 may update the OS lock status, which can be 884 * read via a bit in OSLSR_EL1. 885 */ 886 int oslock; 887 888 if (ri->state == ARM_CP_STATE_AA32) { 889 oslock = (value == 0xC5ACCE55); 890 } else { 891 oslock = value & 1; 892 } 893 894 env->cp15.oslsr_el1 = deposit32(env->cp15.oslsr_el1, 1, 1, oslock); 895 } 896 897 static void osdlr_write(CPUARMState *env, const ARMCPRegInfo *ri, 898 uint64_t value) 899 { 900 ARMCPU *cpu = env_archcpu(env); 901 /* 902 * Only defined bit is bit 0 (DLK); if Feat_DoubleLock is not 903 * implemented this is RAZ/WI. 904 */ 905 if(arm_feature(env, ARM_FEATURE_AARCH64) 906 ? cpu_isar_feature(aa64_doublelock, cpu) 907 : cpu_isar_feature(aa32_doublelock, cpu)) { 908 env->cp15.osdlr_el1 = value & 1; 909 } 910 } 911 912 static void dbgclaimset_write(CPUARMState *env, const ARMCPRegInfo *ri, 913 uint64_t value) 914 { 915 env->cp15.dbgclaim |= (value & 0xFF); 916 } 917 918 static uint64_t dbgclaimset_read(CPUARMState *env, const ARMCPRegInfo *ri) 919 { 920 /* CLAIM bits are RAO */ 921 return 0xFF; 922 } 923 924 static void dbgclaimclr_write(CPUARMState *env, const ARMCPRegInfo *ri, 925 uint64_t value) 926 { 927 env->cp15.dbgclaim &= ~(value & 0xFF); 928 } 929 930 static const ARMCPRegInfo debug_cp_reginfo[] = { 931 /* 932 * DBGDRAR, DBGDSAR: always RAZ since we don't implement memory mapped 933 * debug components. The AArch64 version of DBGDRAR is named MDRAR_EL1; 934 * unlike DBGDRAR it is never accessible from EL0. 935 * DBGDSAR is deprecated and must RAZ from v8 anyway, so it has no AArch64 936 * accessor. 937 */ 938 { .name = "DBGDRAR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 0, 939 .access = PL0_R, .accessfn = access_tdra, 940 .type = ARM_CP_CONST | ARM_CP_NO_GDB, .resetvalue = 0 }, 941 { .name = "MDRAR_EL1", .state = ARM_CP_STATE_AA64, 942 .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 0, 943 .access = PL1_R, .accessfn = access_tdra, 944 .type = ARM_CP_CONST, .resetvalue = 0 }, 945 { .name = "DBGDSAR", .cp = 14, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0, 946 .access = PL0_R, .accessfn = access_tdra, 947 .type = ARM_CP_CONST | ARM_CP_NO_GDB, .resetvalue = 0 }, 948 /* Monitor debug system control register; the 32-bit alias is DBGDSCRext. */ 949 { .name = "MDSCR_EL1", .state = ARM_CP_STATE_BOTH, 950 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2, 951 .access = PL1_RW, .accessfn = access_tda, 952 .fgt = FGT_MDSCR_EL1, 953 .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1), 954 .resetvalue = 0 }, 955 /* 956 * MDCCSR_EL0[30:29] map to EDSCR[30:29]. Simply RAZ as the external 957 * Debug Communication Channel is not implemented. 958 */ 959 { .name = "MDCCSR_EL0", .state = ARM_CP_STATE_AA64, 960 .opc0 = 2, .opc1 = 3, .crn = 0, .crm = 1, .opc2 = 0, 961 .access = PL0_R, .accessfn = access_tdcc, 962 .type = ARM_CP_CONST, .resetvalue = 0 }, 963 /* 964 * These registers belong to the Debug Communications Channel, 965 * which is not implemented. However we implement RAZ/WI behaviour 966 * with trapping to prevent spurious SIGILLs if the guest OS does 967 * access them as the support cannot be probed for. 968 */ 969 { .name = "OSDTRRX_EL1", .state = ARM_CP_STATE_BOTH, .cp = 14, 970 .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 0, .opc2 = 2, 971 .access = PL1_RW, .accessfn = access_tdcc, 972 .type = ARM_CP_CONST, .resetvalue = 0 }, 973 { .name = "OSDTRTX_EL1", .state = ARM_CP_STATE_BOTH, .cp = 14, 974 .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 2, 975 .access = PL1_RW, .accessfn = access_tdcc, 976 .type = ARM_CP_CONST, .resetvalue = 0 }, 977 /* DBGDTRTX_EL0/DBGDTRRX_EL0 depend on direction */ 978 { .name = "DBGDTR_EL0", .state = ARM_CP_STATE_BOTH, .cp = 14, 979 .opc0 = 2, .opc1 = 3, .crn = 0, .crm = 5, .opc2 = 0, 980 .access = PL0_RW, .accessfn = access_tdcc, 981 .type = ARM_CP_CONST, .resetvalue = 0 }, 982 /* 983 * OSECCR_EL1 provides a mechanism for an operating system 984 * to access the contents of EDECCR. EDECCR is not implemented though, 985 * as is the rest of external device mechanism. 986 */ 987 { .name = "OSECCR_EL1", .state = ARM_CP_STATE_BOTH, .cp = 14, 988 .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 2, 989 .access = PL1_RW, .accessfn = access_tda, 990 .fgt = FGT_OSECCR_EL1, 991 .type = ARM_CP_CONST, .resetvalue = 0 }, 992 /* 993 * DBGDSCRint[15,12,5:2] map to MDSCR_EL1[15,12,5:2]. Map all bits as 994 * it is unlikely a guest will care. 995 * We don't implement the configurable EL0 access. 996 */ 997 { .name = "DBGDSCRint", .state = ARM_CP_STATE_AA32, 998 .cp = 14, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0, 999 .type = ARM_CP_ALIAS, 1000 .access = PL1_R, .accessfn = access_tda, 1001 .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1), }, 1002 { .name = "OSLAR_EL1", .state = ARM_CP_STATE_BOTH, 1003 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 4, 1004 .access = PL1_W, .type = ARM_CP_NO_RAW, 1005 .accessfn = access_tdosa, 1006 .fgt = FGT_OSLAR_EL1, 1007 .writefn = oslar_write }, 1008 { .name = "OSLSR_EL1", .state = ARM_CP_STATE_BOTH, 1009 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 4, 1010 .access = PL1_R, .resetvalue = 10, 1011 .accessfn = access_tdosa, 1012 .fgt = FGT_OSLSR_EL1, 1013 .fieldoffset = offsetof(CPUARMState, cp15.oslsr_el1) }, 1014 /* Dummy OSDLR_EL1: 32-bit Linux will read this */ 1015 { .name = "OSDLR_EL1", .state = ARM_CP_STATE_BOTH, 1016 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 3, .opc2 = 4, 1017 .access = PL1_RW, .accessfn = access_tdosa, 1018 .fgt = FGT_OSDLR_EL1, 1019 .writefn = osdlr_write, 1020 .fieldoffset = offsetof(CPUARMState, cp15.osdlr_el1) }, 1021 /* 1022 * Dummy DBGVCR: Linux wants to clear this on startup, but we don't 1023 * implement vector catch debug events yet. 1024 */ 1025 { .name = "DBGVCR", 1026 .cp = 14, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0, 1027 .access = PL1_RW, .accessfn = access_tda, 1028 .type = ARM_CP_NOP }, 1029 /* 1030 * Dummy DBGVCR32_EL2 (which is only for a 64-bit hypervisor 1031 * to save and restore a 32-bit guest's DBGVCR) 1032 */ 1033 { .name = "DBGVCR32_EL2", .state = ARM_CP_STATE_AA64, 1034 .opc0 = 2, .opc1 = 4, .crn = 0, .crm = 7, .opc2 = 0, 1035 .access = PL2_RW, .accessfn = access_tda, 1036 .type = ARM_CP_NOP | ARM_CP_EL3_NO_EL2_KEEP }, 1037 /* 1038 * Dummy MDCCINT_EL1, since we don't implement the Debug Communications 1039 * Channel but Linux may try to access this register. The 32-bit 1040 * alias is DBGDCCINT. 1041 */ 1042 { .name = "MDCCINT_EL1", .state = ARM_CP_STATE_BOTH, 1043 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0, 1044 .access = PL1_RW, .accessfn = access_tdcc, 1045 .type = ARM_CP_NOP }, 1046 /* 1047 * Dummy DBGCLAIM registers. 1048 * "The architecture does not define any functionality for the CLAIM tag bits.", 1049 * so we only keep the raw bits 1050 */ 1051 { .name = "DBGCLAIMSET_EL1", .state = ARM_CP_STATE_BOTH, 1052 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 6, 1053 .type = ARM_CP_ALIAS, 1054 .access = PL1_RW, .accessfn = access_tda, 1055 .fgt = FGT_DBGCLAIM, 1056 .writefn = dbgclaimset_write, .readfn = dbgclaimset_read }, 1057 { .name = "DBGCLAIMCLR_EL1", .state = ARM_CP_STATE_BOTH, 1058 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 7, .crm = 9, .opc2 = 6, 1059 .access = PL1_RW, .accessfn = access_tda, 1060 .fgt = FGT_DBGCLAIM, 1061 .writefn = dbgclaimclr_write, .raw_writefn = raw_write, 1062 .fieldoffset = offsetof(CPUARMState, cp15.dbgclaim) }, 1063 }; 1064 1065 static const ARMCPRegInfo debug_lpae_cp_reginfo[] = { 1066 /* 64 bit access versions of the (dummy) debug registers */ 1067 { .name = "DBGDRAR", .cp = 14, .crm = 1, .opc1 = 0, 1068 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_64BIT | ARM_CP_NO_GDB, 1069 .resetvalue = 0 }, 1070 { .name = "DBGDSAR", .cp = 14, .crm = 2, .opc1 = 0, 1071 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_64BIT | ARM_CP_NO_GDB, 1072 .resetvalue = 0 }, 1073 }; 1074 1075 static void dbgwvr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1076 uint64_t value) 1077 { 1078 ARMCPU *cpu = env_archcpu(env); 1079 int i = ri->crm; 1080 1081 /* 1082 * Bits [1:0] are RES0. 1083 * 1084 * It is IMPLEMENTATION DEFINED whether [63:49] ([63:53] with FEAT_LVA) 1085 * are hardwired to the value of bit [48] ([52] with FEAT_LVA), or if 1086 * they contain the value written. It is CONSTRAINED UNPREDICTABLE 1087 * whether the RESS bits are ignored when comparing an address. 1088 * 1089 * Therefore we are allowed to compare the entire register, which lets 1090 * us avoid considering whether or not FEAT_LVA is actually enabled. 1091 */ 1092 value &= ~3ULL; 1093 1094 raw_write(env, ri, value); 1095 if (tcg_enabled()) { 1096 hw_watchpoint_update(cpu, i); 1097 } 1098 } 1099 1100 static void dbgwcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1101 uint64_t value) 1102 { 1103 ARMCPU *cpu = env_archcpu(env); 1104 int i = ri->crm; 1105 1106 raw_write(env, ri, value); 1107 if (tcg_enabled()) { 1108 hw_watchpoint_update(cpu, i); 1109 } 1110 } 1111 1112 static void dbgbvr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1113 uint64_t value) 1114 { 1115 ARMCPU *cpu = env_archcpu(env); 1116 int i = ri->crm; 1117 1118 raw_write(env, ri, value); 1119 if (tcg_enabled()) { 1120 hw_breakpoint_update(cpu, i); 1121 } 1122 } 1123 1124 static void dbgbcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1125 uint64_t value) 1126 { 1127 ARMCPU *cpu = env_archcpu(env); 1128 int i = ri->crm; 1129 1130 /* 1131 * BAS[3] is a read-only copy of BAS[2], and BAS[1] a read-only 1132 * copy of BAS[0]. 1133 */ 1134 value = deposit64(value, 6, 1, extract64(value, 5, 1)); 1135 value = deposit64(value, 8, 1, extract64(value, 7, 1)); 1136 1137 raw_write(env, ri, value); 1138 if (tcg_enabled()) { 1139 hw_breakpoint_update(cpu, i); 1140 } 1141 } 1142 1143 void define_debug_regs(ARMCPU *cpu) 1144 { 1145 /* 1146 * Define v7 and v8 architectural debug registers. 1147 * These are just dummy implementations for now. 1148 */ 1149 int i; 1150 int wrps, brps, ctx_cmps; 1151 1152 /* 1153 * The Arm ARM says DBGDIDR is optional and deprecated if EL1 cannot 1154 * use AArch32. Given that bit 15 is RES1, if the value is 0 then 1155 * the register must not exist for this cpu. 1156 */ 1157 if (cpu->isar.dbgdidr != 0) { 1158 ARMCPRegInfo dbgdidr = { 1159 .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0, 1160 .opc1 = 0, .opc2 = 0, 1161 .access = PL0_R, .accessfn = access_tda, 1162 .type = ARM_CP_CONST, .resetvalue = cpu->isar.dbgdidr, 1163 }; 1164 define_one_arm_cp_reg(cpu, &dbgdidr); 1165 } 1166 1167 /* 1168 * DBGDEVID is present in the v7 debug architecture if 1169 * DBGDIDR.DEVID_imp is 1 (bit 15); from v7.1 and on it is 1170 * mandatory (and bit 15 is RES1). DBGDEVID1 and DBGDEVID2 exist 1171 * from v7.1 of the debug architecture. Because no fields have yet 1172 * been defined in DBGDEVID2 (and quite possibly none will ever 1173 * be) we don't define an ARMISARegisters field for it. 1174 * These registers exist only if EL1 can use AArch32, but that 1175 * happens naturally because they are only PL1 accessible anyway. 1176 */ 1177 if (extract32(cpu->isar.dbgdidr, 15, 1)) { 1178 ARMCPRegInfo dbgdevid = { 1179 .name = "DBGDEVID", 1180 .cp = 14, .opc1 = 0, .crn = 7, .opc2 = 2, .crn = 7, 1181 .access = PL1_R, .accessfn = access_tda, 1182 .type = ARM_CP_CONST, .resetvalue = cpu->isar.dbgdevid, 1183 }; 1184 define_one_arm_cp_reg(cpu, &dbgdevid); 1185 } 1186 if (cpu_isar_feature(aa32_debugv7p1, cpu)) { 1187 ARMCPRegInfo dbgdevid12[] = { 1188 { 1189 .name = "DBGDEVID1", 1190 .cp = 14, .opc1 = 0, .crn = 7, .opc2 = 1, .crn = 7, 1191 .access = PL1_R, .accessfn = access_tda, 1192 .type = ARM_CP_CONST, .resetvalue = cpu->isar.dbgdevid1, 1193 }, { 1194 .name = "DBGDEVID2", 1195 .cp = 14, .opc1 = 0, .crn = 7, .opc2 = 0, .crn = 7, 1196 .access = PL1_R, .accessfn = access_tda, 1197 .type = ARM_CP_CONST, .resetvalue = 0, 1198 }, 1199 }; 1200 define_arm_cp_regs(cpu, dbgdevid12); 1201 } 1202 1203 brps = arm_num_brps(cpu); 1204 wrps = arm_num_wrps(cpu); 1205 ctx_cmps = arm_num_ctx_cmps(cpu); 1206 1207 assert(ctx_cmps <= brps); 1208 1209 define_arm_cp_regs(cpu, debug_cp_reginfo); 1210 1211 if (arm_feature(&cpu->env, ARM_FEATURE_LPAE)) { 1212 define_arm_cp_regs(cpu, debug_lpae_cp_reginfo); 1213 } 1214 1215 for (i = 0; i < brps; i++) { 1216 char *dbgbvr_el1_name = g_strdup_printf("DBGBVR%d_EL1", i); 1217 char *dbgbcr_el1_name = g_strdup_printf("DBGBCR%d_EL1", i); 1218 ARMCPRegInfo dbgregs[] = { 1219 { .name = dbgbvr_el1_name, .state = ARM_CP_STATE_BOTH, 1220 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 4, 1221 .access = PL1_RW, .accessfn = access_tda, 1222 .fgt = FGT_DBGBVRN_EL1, 1223 .fieldoffset = offsetof(CPUARMState, cp15.dbgbvr[i]), 1224 .writefn = dbgbvr_write, .raw_writefn = raw_write 1225 }, 1226 { .name = dbgbcr_el1_name, .state = ARM_CP_STATE_BOTH, 1227 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 5, 1228 .access = PL1_RW, .accessfn = access_tda, 1229 .fgt = FGT_DBGBCRN_EL1, 1230 .fieldoffset = offsetof(CPUARMState, cp15.dbgbcr[i]), 1231 .writefn = dbgbcr_write, .raw_writefn = raw_write 1232 }, 1233 }; 1234 define_arm_cp_regs(cpu, dbgregs); 1235 g_free(dbgbvr_el1_name); 1236 g_free(dbgbcr_el1_name); 1237 } 1238 1239 for (i = 0; i < wrps; i++) { 1240 char *dbgwvr_el1_name = g_strdup_printf("DBGWVR%d_EL1", i); 1241 char *dbgwcr_el1_name = g_strdup_printf("DBGWCR%d_EL1", i); 1242 ARMCPRegInfo dbgregs[] = { 1243 { .name = dbgwvr_el1_name, .state = ARM_CP_STATE_BOTH, 1244 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 6, 1245 .access = PL1_RW, .accessfn = access_tda, 1246 .fgt = FGT_DBGWVRN_EL1, 1247 .fieldoffset = offsetof(CPUARMState, cp15.dbgwvr[i]), 1248 .writefn = dbgwvr_write, .raw_writefn = raw_write 1249 }, 1250 { .name = dbgwcr_el1_name, .state = ARM_CP_STATE_BOTH, 1251 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 7, 1252 .access = PL1_RW, .accessfn = access_tda, 1253 .fgt = FGT_DBGWCRN_EL1, 1254 .fieldoffset = offsetof(CPUARMState, cp15.dbgwcr[i]), 1255 .writefn = dbgwcr_write, .raw_writefn = raw_write 1256 }, 1257 }; 1258 define_arm_cp_regs(cpu, dbgregs); 1259 g_free(dbgwvr_el1_name); 1260 g_free(dbgwcr_el1_name); 1261 } 1262 } 1263